From 50e9075bb50f99bff878266ebf8648da5bb72f51 Mon Sep 17 00:00:00 2001
From: dekzter <kappa118@gmail.com>
Date: Sat, 25 Oct 2025 08:15:39 -0400
Subject: [PATCH 01/67] initial run of a binary and encoded redis client - no
 more encoding / decoding data into redis, huge PITA (still some outstanding
 spots I need to patch)

---
 apps/channels/api_views.py                    |   6 +-
 apps/channels/tasks.py                        |   4 +-
 apps/proxy/tasks.py                           |   2 +-
 apps/proxy/ts_proxy/channel_status.py         | 208 ++++++------------
 apps/proxy/ts_proxy/server.py                 |  75 +++----
 .../ts_proxy/services/channel_service.py      |  20 +-
 apps/proxy/ts_proxy/stream_manager.py         |  14 +-
 apps/proxy/ts_proxy/url_utils.py              |   8 +-
 .../multi_worker_connection_manager.py        |  14 +-
 apps/proxy/vod_proxy/views.py                 |  16 +-
 core/redis_pubsub.py                          |   4 -
 core/tasks.py                                 |   2 +-
 core/utils.py                                 | 192 ++++++++--------
 dispatcharr/persistent_lock.py                |   2 +-
 14 files changed, 253 insertions(+), 314 deletions(-)

diff --git a/apps/channels/api_views.py b/apps/channels/api_views.py
index 862de7f9..aa25ca85 100644
--- a/apps/channels/api_views.py
+++ b/apps/channels/api_views.py
@@ -1849,14 +1849,12 @@ class RecordingViewSet(viewsets.ModelViewSet):
                 client_set_key = RedisKeys.clients(channel_uuid)
                 client_ids = r.smembers(client_set_key) or []
                 stopped = 0
-                for raw_id in client_ids:
+                for cid in client_ids:
                     try:
-                        cid = raw_id.decode("utf-8") if isinstance(raw_id, (bytes, bytearray)) else str(raw_id)
                         meta_key = RedisKeys.client_metadata(channel_uuid, cid)
                         ua = r.hget(meta_key, "user_agent")
-                        ua_s = ua.decode("utf-8") if isinstance(ua, (bytes, bytearray)) else (ua or "")
                         # Identify DVR recording client by its user agent
-                        if ua_s and "Dispatcharr-DVR" in ua_s:
+                        if ua and "Dispatcharr-DVR" in ua:
                             try:
                                 ChannelService.stop_client(channel_uuid, cid)
                                 stopped += 1
diff --git a/apps/channels/tasks.py b/apps/channels/tasks.py
index 3943cf16..28da31b3 100755
--- a/apps/channels/tasks.py
+++ b/apps/channels/tasks.py
@@ -1875,14 +1875,14 @@ def run_recording(recording_id, channel_id, start_time_str, end_time_str):
                 md = r.hgetall(metadata_key)
                 if md:
                     def _gv(bkey):
-                        return md.get(bkey.encode('utf-8'))
+                        return md.get(bkey)
 
                     def _d(bkey, cast=str):
                         v = _gv(bkey)
                         try:
                             if v is None:
                                 return None
-                            s = v.decode('utf-8')
+                            s = v
                             return cast(s) if cast is not str else s
                         except Exception:
                             return None
diff --git a/apps/proxy/tasks.py b/apps/proxy/tasks.py
index 68843712..d42e4d9a 100644
--- a/apps/proxy/tasks.py
+++ b/apps/proxy/tasks.py
@@ -31,7 +31,7 @@ def fetch_channel_stats():
         while True:
             cursor, keys = redis_client.scan(cursor, match=channel_pattern)
             for key in keys:
-                channel_id_match = re.search(r"ts_proxy:channel:(.*):metadata", key.decode('utf-8'))
+                channel_id_match = re.search(r"ts_proxy:channel:(.*):metadata", key)
                 if channel_id_match:
                     ch_id = channel_id_match.group(1)
                     channel_info = ChannelStatus.get_basic_channel_info(ch_id)
diff --git a/apps/proxy/ts_proxy/channel_status.py b/apps/proxy/ts_proxy/channel_status.py
index 8f1d0649..015d5ca2 100644
--- a/apps/proxy/ts_proxy/channel_status.py
+++ b/apps/proxy/ts_proxy/channel_status.py
@@ -38,19 +38,19 @@ class ChannelStatus:
 
         info = {
             'channel_id': channel_id,
-            'state': metadata.get(ChannelMetadataField.STATE.encode('utf-8'), b'unknown').decode('utf-8'),
-            'url': metadata.get(ChannelMetadataField.URL.encode('utf-8'), b'').decode('utf-8'),
-            'stream_profile': metadata.get(ChannelMetadataField.STREAM_PROFILE.encode('utf-8'), b'').decode('utf-8'),
-            'started_at': metadata.get(ChannelMetadataField.INIT_TIME.encode('utf-8'), b'0').decode('utf-8'),
-            'owner': metadata.get(ChannelMetadataField.OWNER.encode('utf-8'), b'unknown').decode('utf-8'),
-            'buffer_index': int(buffer_index_value.decode('utf-8')) if buffer_index_value else 0,
+            'state': metadata.get(ChannelMetadataField.STATE, 'unknown'),
+            'url': metadata.get(ChannelMetadataField.URL, ''),
+            'stream_profile': metadata.get(ChannelMetadataField.STREAM_PROFILE, ''),
+            'started_at': metadata.get(ChannelMetadataField.INIT_TIME, '0'),
+            'owner': metadata.get(ChannelMetadataField.OWNER, 'unknown'),
+            'buffer_index': int(buffer_index_value) if buffer_index_value else 0,
         }
 
         # Add stream ID and name information
-        stream_id_bytes = metadata.get(ChannelMetadataField.STREAM_ID.encode('utf-8'))
+        stream_id_bytes = metadata.get(ChannelMetadataField.STREAM_ID)
         if stream_id_bytes:
             try:
-                stream_id = int(stream_id_bytes.decode('utf-8'))
+                stream_id = int(stream_id_bytes)
                 info['stream_id'] = stream_id
 
                 # Look up stream name from database
@@ -65,10 +65,10 @@ class ChannelStatus:
                 logger.warning(f"Invalid stream_id format in Redis: {stream_id_bytes}")
 
         # Add M3U profile information
-        m3u_profile_id_bytes = metadata.get(ChannelMetadataField.M3U_PROFILE.encode('utf-8'))
+        m3u_profile_id_bytes = metadata.get(ChannelMetadataField.M3U_PROFILE)
         if m3u_profile_id_bytes:
             try:
-                m3u_profile_id = int(m3u_profile_id_bytes.decode('utf-8'))
+                m3u_profile_id = int(m3u_profile_id_bytes)
                 info['m3u_profile_id'] = m3u_profile_id
 
                 # Look up M3U profile name from database
@@ -83,22 +83,22 @@ class ChannelStatus:
                 logger.warning(f"Invalid m3u_profile_id format in Redis: {m3u_profile_id_bytes}")
 
         # Add timing information
-        state_changed_field = ChannelMetadataField.STATE_CHANGED_AT.encode('utf-8')
+        state_changed_field = ChannelMetadataField.STATE_CHANGED_AT
         if state_changed_field in metadata:
-            state_changed_at = float(metadata[state_changed_field].decode('utf-8'))
+            state_changed_at = float(metadata[state_changed_field])
             info['state_changed_at'] = state_changed_at
             info['state_duration'] = time.time() - state_changed_at
 
-        init_time_field = ChannelMetadataField.INIT_TIME.encode('utf-8')
+        init_time_field = ChannelMetadataField.INIT_TIME
         if init_time_field in metadata:
-            created_at = float(metadata[init_time_field].decode('utf-8'))
+            created_at = float(metadata[init_time_field])
             info['started_at'] = created_at
             info['uptime'] = time.time() - created_at
 
         # Add data throughput information
-        total_bytes_field = ChannelMetadataField.TOTAL_BYTES.encode('utf-8')
+        total_bytes_field = ChannelMetadataField.TOTAL_BYTES
         if total_bytes_field in metadata:
-            total_bytes = int(metadata[total_bytes_field].decode('utf-8'))
+            total_bytes = int(metadata[total_bytes_field])
             info['total_bytes'] = total_bytes
 
             # Format total bytes in human-readable form
@@ -128,40 +128,40 @@ class ChannelStatus:
         clients = []
 
         for client_id in client_ids:
-            client_id_str = client_id.decode('utf-8')
+            client_id_str = client_id
             client_key = RedisKeys.client_metadata(channel_id, client_id_str)
             client_data = proxy_server.redis_client.hgetall(client_key)
 
             if client_data:
                 client_info = {
                     'client_id': client_id_str,
-                    'user_agent': client_data.get(b'user_agent', b'unknown').decode('utf-8'),
-                    'worker_id': client_data.get(b'worker_id', b'unknown').decode('utf-8'),
+                    'user_agent': client_data.get('user_agent', 'unknown'),
+                    'worker_id': client_data.get('worker_id', 'unknown'),
                 }
 
-                if b'connected_at' in client_data:
-                    connected_at = float(client_data[b'connected_at'].decode('utf-8'))
+                if 'connected_at' in client_data:
+                    connected_at = float(client_data['connected_at'])
                     client_info['connected_at'] = connected_at
                     client_info['connection_duration'] = time.time() - connected_at
 
-                if b'last_active' in client_data:
-                    last_active = float(client_data[b'last_active'].decode('utf-8'))
+                if 'last_active' in client_data:
+                    last_active = float(client_data['last_active'])
                     client_info['last_active'] = last_active
                     client_info['last_active_ago'] = time.time() - last_active
 
                 # Add transfer rate statistics
-                if b'bytes_sent' in client_data:
-                    client_info['bytes_sent'] = int(client_data[b'bytes_sent'].decode('utf-8'))
+                if 'bytes_sent' in client_data:
+                    client_info['bytes_sent'] = int(client_data['bytes_sent'])
 
                 # Add average transfer rate
-                if b'avg_rate_KBps' in client_data:
-                    client_info['avg_rate_KBps'] = float(client_data[b'avg_rate_KBps'].decode('utf-8'))
-                elif b'transfer_rate_KBps' in client_data:  # For backward compatibility
-                    client_info['avg_rate_KBps'] = float(client_data[b'transfer_rate_KBps'].decode('utf-8'))
+                if 'avg_rate_KBps' in client_data:
+                    client_info['avg_rate_KBps'] = float(client_data['avg_rate_KBps'])
+                elif 'transfer_rate_KBps' in client_data:  # For backward compatibility
+                    client_info['avg_rate_KBps'] = float(client_data['transfer_rate_KBps'])
 
                 # Add current transfer rate
-                if b'current_rate_KBps' in client_data:
-                    client_info['current_rate_KBps'] = float(client_data[b'current_rate_KBps'].decode('utf-8'))
+                if 'current_rate_KBps' in client_data:
+                    client_info['current_rate_KBps'] = float(client_data['current_rate_KBps'])
 
                 clients.append(client_info)
 
@@ -235,7 +235,7 @@ class ChannelStatus:
                     while True:
                         cursor, keys = proxy_server.redis_client.scan(cursor, match=buffer_key_pattern, count=100)
                         if keys:
-                            all_buffer_keys.extend([k.decode('utf-8') for k in keys])
+                            all_buffer_keys.extend([k for k in keys])
                         if cursor == 0 or len(all_buffer_keys) >= 20:  # Limit to 20 keys
                             break
 
@@ -265,61 +265,22 @@ class ChannelStatus:
             }
 
         # Add FFmpeg stream information
-        video_codec = metadata.get(ChannelMetadataField.VIDEO_CODEC.encode('utf-8'))
-        if video_codec:
-            info['video_codec'] = video_codec.decode('utf-8')
-
-        resolution = metadata.get(ChannelMetadataField.RESOLUTION.encode('utf-8'))
-        if resolution:
-            info['resolution'] = resolution.decode('utf-8')
-
-        source_fps = metadata.get(ChannelMetadataField.SOURCE_FPS.encode('utf-8'))
-        if source_fps:
-            info['source_fps'] = float(source_fps.decode('utf-8'))
-
-        pixel_format = metadata.get(ChannelMetadataField.PIXEL_FORMAT.encode('utf-8'))
-        if pixel_format:
-            info['pixel_format'] = pixel_format.decode('utf-8')
-
-        source_bitrate = metadata.get(ChannelMetadataField.SOURCE_BITRATE.encode('utf-8'))
-        if source_bitrate:
-            info['source_bitrate'] = float(source_bitrate.decode('utf-8'))
-
-        audio_codec = metadata.get(ChannelMetadataField.AUDIO_CODEC.encode('utf-8'))
-        if audio_codec:
-            info['audio_codec'] = audio_codec.decode('utf-8')
-
-        sample_rate = metadata.get(ChannelMetadataField.SAMPLE_RATE.encode('utf-8'))
-        if sample_rate:
-            info['sample_rate'] = int(sample_rate.decode('utf-8'))
-
-        audio_channels = metadata.get(ChannelMetadataField.AUDIO_CHANNELS.encode('utf-8'))
-        if audio_channels:
-            info['audio_channels'] = audio_channels.decode('utf-8')
-
-        audio_bitrate = metadata.get(ChannelMetadataField.AUDIO_BITRATE.encode('utf-8'))
-        if audio_bitrate:
-            info['audio_bitrate'] = float(audio_bitrate.decode('utf-8'))
+        info['video_codec'] = metadata.get(ChannelMetadataField.VIDEO_CODEC)
+        info['resolution'] = metadata.get(ChannelMetadataField.RESOLUTION)
+        info['source_fps'] = metadata.get(ChannelMetadataField.SOURCE_FPS)
+        info['pixel_format'] = metadata.get(ChannelMetadataField.PIXEL_FORMAT)
+        info['source_bitrate'] = metadata.get(ChannelMetadataField.SOURCE_BITRATE)
+        info['audio_codec'] = metadata.get(ChannelMetadataField.AUDIO_CODEC)
+        info['sample_rate'] = metadata.get(ChannelMetadataField.SAMPLE_RATE)
+        info['audio_channels'] = metadata.get(ChannelMetadataField.AUDIO_CHANNELS)
+        info['audio_bitrate'] = metadata.get(ChannelMetadataField.AUDIO_BITRATE)
 
         # Add FFmpeg performance stats
-        ffmpeg_speed = metadata.get(ChannelMetadataField.FFMPEG_SPEED.encode('utf-8'))
-        if ffmpeg_speed:
-            info['ffmpeg_speed'] = float(ffmpeg_speed.decode('utf-8'))
-
-        ffmpeg_fps = metadata.get(ChannelMetadataField.FFMPEG_FPS.encode('utf-8'))
-        if ffmpeg_fps:
-            info['ffmpeg_fps'] = float(ffmpeg_fps.decode('utf-8'))
-
-        actual_fps = metadata.get(ChannelMetadataField.ACTUAL_FPS.encode('utf-8'))
-        if actual_fps:
-            info['actual_fps'] = float(actual_fps.decode('utf-8'))
-
-        ffmpeg_bitrate = metadata.get(ChannelMetadataField.FFMPEG_BITRATE.encode('utf-8'))
-        if ffmpeg_bitrate:
-            info['ffmpeg_bitrate'] = float(ffmpeg_bitrate.decode('utf-8'))
-        stream_type = metadata.get(ChannelMetadataField.STREAM_TYPE.encode('utf-8'))
-        if stream_type:
-            info['stream_type'] = stream_type.decode('utf-8')
+        info['ffmpeg_speed'] = metadata.get(ChannelMetadataField.FFMPEG_SPEED)
+        info['ffmpeg_fps'] = metadata.get(ChannelMetadataField.FFMPEG_FPS)
+        info['actual_fps'] = metadata.get(ChannelMetadataField.ACTUAL_FPS)
+        info['ffmpeg_bitrate'] = metadata.get(ChannelMetadataField.FFMPEG_BITRATE)
+        info['stream_type'] = metadata.get(ChannelMetadataField.STREAM_TYPE)
 
         return info
 
@@ -364,33 +325,27 @@ class ChannelStatus:
             client_count = proxy_server.redis_client.scard(client_set_key) or 0
 
             # Calculate uptime
-            init_time_bytes = metadata.get(ChannelMetadataField.INIT_TIME.encode('utf-8'), b'0')
-            created_at = float(init_time_bytes.decode('utf-8'))
+            init_time_bytes = metadata.get(ChannelMetadataField.INIT_TIME, '0')
+            created_at = float(init_time_bytes)
             uptime = time.time() - created_at if created_at > 0 else 0
 
-            # Safely decode bytes or use defaults
-            def safe_decode(bytes_value, default="unknown"):
-                if bytes_value is None:
-                    return default
-                return bytes_value.decode('utf-8')
-
             # Simplified info
             info = {
                 'channel_id': channel_id,
-                'state': safe_decode(metadata.get(ChannelMetadataField.STATE.encode('utf-8'))),
-                'url': safe_decode(metadata.get(ChannelMetadataField.URL.encode('utf-8')), ""),
-                'stream_profile': safe_decode(metadata.get(ChannelMetadataField.STREAM_PROFILE.encode('utf-8')), ""),
-                'owner': safe_decode(metadata.get(ChannelMetadataField.OWNER.encode('utf-8'))),
-                'buffer_index': int(buffer_index_value.decode('utf-8')) if buffer_index_value else 0,
+                'state': metadata.get(ChannelMetadataField.STATE),
+                'url': metadata.get(ChannelMetadataField.URL, ""),
+                'stream_profile': metadata.get(ChannelMetadataField.STREAM_PROFILE, ""),
+                'owner': metadata.get(ChannelMetadataField.OWNER),
+                'buffer_index': int(buffer_index_value) if buffer_index_value else 0,
                 'client_count': client_count,
                 'uptime': uptime
             }
 
             # Add stream ID and name information
-            stream_id_bytes = metadata.get(ChannelMetadataField.STREAM_ID.encode('utf-8'))
+            stream_id_bytes = metadata.get(ChannelMetadataField.STREAM_ID)
             if stream_id_bytes:
                 try:
-                    stream_id = int(stream_id_bytes.decode('utf-8'))
+                    stream_id = int(stream_id_bytes)
                     info['stream_id'] = stream_id
 
                     # Look up stream name from database
@@ -405,9 +360,9 @@ class ChannelStatus:
                     logger.warning(f"Invalid stream_id format in Redis: {stream_id_bytes}")
 
             # Add data throughput information to basic info
-            total_bytes_bytes = proxy_server.redis_client.hget(metadata_key, ChannelMetadataField.TOTAL_BYTES.encode('utf-8'))
+            total_bytes_bytes = proxy_server.redis_client.hget(metadata_key, ChannelMetadataField.TOTAL_BYTES)
             if total_bytes_bytes:
-                total_bytes = int(total_bytes_bytes.decode('utf-8'))
+                total_bytes = int(total_bytes_bytes)
                 info['total_bytes'] = total_bytes
 
                 # Calculate and add bitrate
@@ -434,26 +389,25 @@ class ChannelStatus:
             if client_ids:
                 # Get up to 10 clients for the basic view
                 for client_id in list(client_ids)[:10]:
-                    client_id_str = client_id.decode('utf-8')
-                    client_key = RedisKeys.client_metadata(channel_id, client_id_str)
+                    client_key = RedisKeys.client_metadata(channel_id, client_id)
 
                     # Efficient way - just retrieve the essentials
                     client_info = {
-                        'client_id': client_id_str,
+                        'client_id': client_id,
                     }
 
                     # Safely get user_agent and ip_address
                     user_agent_bytes = proxy_server.redis_client.hget(client_key, 'user_agent')
-                    client_info['user_agent'] = safe_decode(user_agent_bytes)
+                    client_info['user_agent'] = user_agent_bytes
 
                     ip_address_bytes = proxy_server.redis_client.hget(client_key, 'ip_address')
                     if ip_address_bytes:
-                        client_info['ip_address'] = safe_decode(ip_address_bytes)
+                        client_info['ip_address'] = ip_address_bytes
 
                     # Just get connected_at for client age
                     connected_at_bytes = proxy_server.redis_client.hget(client_key, 'connected_at')
                     if connected_at_bytes:
-                        connected_at = float(connected_at_bytes.decode('utf-8'))
+                        connected_at = float(connected_at_bytes)
                         client_info['connected_since'] = time.time() - connected_at
 
                     clients.append(client_info)
@@ -462,10 +416,10 @@ class ChannelStatus:
             info['clients'] = clients
 
             # Add M3U profile information
-            m3u_profile_id_bytes = metadata.get(ChannelMetadataField.M3U_PROFILE.encode('utf-8'))
-            if m3u_profile_id_bytes:
+            m3u_profile_id = metadata.get(ChannelMetadataField.M3U_PROFILE)
+            if m3u_profile_id:
                 try:
-                    m3u_profile_id = int(m3u_profile_id_bytes.decode('utf-8'))
+                    m3u_profile_id = int(m3u_profile_id)
                     info['m3u_profile_id'] = m3u_profile_id
 
                     # Look up M3U profile name from database
@@ -477,32 +431,16 @@ class ChannelStatus:
                     except (ImportError, DatabaseError) as e:
                         logger.warning(f"Failed to get M3U profile name for ID {m3u_profile_id}: {e}")
                 except ValueError:
-                    logger.warning(f"Invalid m3u_profile_id format in Redis: {m3u_profile_id_bytes}")
+                    logger.warning(f"Invalid m3u_profile_id format in Redis: {m3u_profile_id}")
 
             # Add stream info to basic info as well
-            video_codec = metadata.get(ChannelMetadataField.VIDEO_CODEC.encode('utf-8'))
-            if video_codec:
-                info['video_codec'] = video_codec.decode('utf-8')
-
-            resolution = metadata.get(ChannelMetadataField.RESOLUTION.encode('utf-8'))
-            if resolution:
-                info['resolution'] = resolution.decode('utf-8')
-
-            source_fps = metadata.get(ChannelMetadataField.SOURCE_FPS.encode('utf-8'))
-            if source_fps:
-                info['source_fps'] = float(source_fps.decode('utf-8'))
-            ffmpeg_speed = metadata.get(ChannelMetadataField.FFMPEG_SPEED.encode('utf-8'))
-            if ffmpeg_speed:
-                info['ffmpeg_speed'] = float(ffmpeg_speed.decode('utf-8'))
-            audio_codec = metadata.get(ChannelMetadataField.AUDIO_CODEC.encode('utf-8'))
-            if audio_codec:
-                info['audio_codec'] = audio_codec.decode('utf-8')
-            audio_channels = metadata.get(ChannelMetadataField.AUDIO_CHANNELS.encode('utf-8'))
-            if audio_channels:
-                info['audio_channels'] = audio_channels.decode('utf-8')
-            stream_type = metadata.get(ChannelMetadataField.STREAM_TYPE.encode('utf-8'))
-            if stream_type:
-                info['stream_type'] = stream_type.decode('utf-8')
+            info['video_codec'] = metadata.get(ChannelMetadataField.VIDEO_CODEC)
+            info['resolution'] = metadata.get(ChannelMetadataField.RESOLUTION)
+            info['source_fps'] = metadata.get(ChannelMetadataField.SOURCE_FPS)
+            info['ffmpeg_speed'] = metadata.get(ChannelMetadataField.FFMPEG_SPEED)
+            info['audio_codec'] = metadata.get(ChannelMetadataField.AUDIO_CODEC)
+            info['audio_channels'] = metadata.get(ChannelMetadataField.AUDIO_CHANNELS)
+            info['stream_type'] = metadata.get(ChannelMetadataField.STREAM_TYPE)
 
             return info
         except Exception as e:
diff --git a/apps/proxy/ts_proxy/server.py b/apps/proxy/ts_proxy/server.py
index cca827a9..7a59f530 100644
--- a/apps/proxy/ts_proxy/server.py
+++ b/apps/proxy/ts_proxy/server.py
@@ -157,7 +157,8 @@ class ProxyServer:
                             socket_timeout=60,
                             socket_connect_timeout=10,
                             socket_keepalive=True,
-                            health_check_interval=30
+                            health_check_interval=30,
+                            decode_responses=True
                         )
                         logger.info("Created fallback Redis PubSub client for event listener")
 
@@ -178,8 +179,8 @@ class ProxyServer:
                             continue
 
                         try:
-                            channel = message["channel"].decode("utf-8")
-                            data = json.loads(message["data"].decode("utf-8"))
+                            channel = message["channel"]
+                            data = json.loads(message["data"])
 
                             event_type = data.get("event")
                             channel_id = data.get("channel_id")
@@ -374,7 +375,7 @@ class ProxyServer:
         try:
             lock_key = RedisKeys.channel_owner(channel_id)
             return self._execute_redis_command(
-                lambda: self.redis_client.get(lock_key).decode('utf-8') if self.redis_client.get(lock_key) else None
+                lambda: self.redis_client.get(lock_key) if self.redis_client.get(lock_key) else None
             )
         except Exception as e:
             logger.error(f"Error getting channel owner: {e}")
@@ -415,7 +416,7 @@ class ProxyServer:
             current_owner = self._execute_redis_command(
                 lambda: self.redis_client.get(lock_key)
             )
-            if current_owner and current_owner.decode('utf-8') == self.worker_id:
+            if current_owner and current_owner == self.worker_id:
                 # Refresh TTL
                 self._execute_redis_command(
                     lambda: self.redis_client.expire(lock_key, ttl)
@@ -440,7 +441,7 @@ class ProxyServer:
 
             # Only delete if we're the current owner to prevent race conditions
             current = self.redis_client.get(lock_key)
-            if current and current.decode('utf-8') == self.worker_id:
+            if current and current == self.worker_id:
                 self.redis_client.delete(lock_key)
                 logger.info(f"Released ownership of channel {channel_id}")
 
@@ -462,7 +463,7 @@ class ProxyServer:
             current = self.redis_client.get(lock_key)
 
             # Only extend if we're still the owner
-            if current and current.decode('utf-8') == self.worker_id:
+            if current and current == self.worker_id:
                 self.redis_client.expire(lock_key, ttl)
                 return True
             return False
@@ -478,15 +479,15 @@ class ProxyServer:
                 metadata_key = RedisKeys.channel_metadata(channel_id)
                 if self.redis_client.exists(metadata_key):
                     metadata = self.redis_client.hgetall(metadata_key)
-                    if b'state' in metadata:
-                        state = metadata[b'state'].decode('utf-8')
+                    if 'state' in metadata:
+                        state = metadata['state']
                         active_states = [ChannelState.INITIALIZING, ChannelState.CONNECTING,
                                         ChannelState.WAITING_FOR_CLIENTS, ChannelState.ACTIVE, ChannelState.BUFFERING]
                         if state in active_states:
                             logger.info(f"Channel {channel_id} already being initialized with state {state}")
                             # Create buffer and client manager only if we don't have them
                             if channel_id not in self.stream_buffers:
-                                self.stream_buffers[channel_id] = StreamBuffer(channel_id, redis_client=self.redis_client)
+                                self.stream_buffers[channel_id] = StreamBuffer(channel_id, redis_client=RedisClient.get_buffer())
                             if channel_id not in self.client_managers:
                                 self.client_managers[channel_id] = ClientManager(
                                     channel_id,
@@ -497,7 +498,7 @@ class ProxyServer:
 
             # Create buffer and client manager instances (or reuse if they exist)
             if channel_id not in self.stream_buffers:
-                buffer = StreamBuffer(channel_id, redis_client=self.redis_client)
+                buffer = StreamBuffer(channel_id, redis_client=RedisClient.get_buffer())
                 self.stream_buffers[channel_id] = buffer
 
             if channel_id not in self.client_managers:
@@ -536,18 +537,18 @@ class ProxyServer:
 
                 # If no url was passed, try to get from Redis
                 if not url and existing_metadata:
-                    url_bytes = existing_metadata.get(b'url')
+                    url_bytes = existing_metadata.get('url')
                     if url_bytes:
-                        channel_url = url_bytes.decode('utf-8')
+                        channel_url = url_bytes
 
-                    ua_bytes = existing_metadata.get(b'user_agent')
+                    ua_bytes = existing_metadata.get('user_agent')
                     if ua_bytes:
-                        channel_user_agent = ua_bytes.decode('utf-8')
+                        channel_user_agent = ua_bytes
 
                 # Get stream ID from metadata if not provided
-                if not channel_stream_id and b'stream_id' in existing_metadata:
+                if not channel_stream_id and 'stream_id' in existing_metadata:
                     try:
-                        channel_stream_id = int(existing_metadata[b'stream_id'].decode('utf-8'))
+                        channel_stream_id = int(existing_metadata['stream_id'])
                         logger.debug(f"Found stream_id {channel_stream_id} in metadata for channel {channel_id}")
                     except (ValueError, TypeError) as e:
                         logger.debug(f"Could not parse stream_id from metadata: {e}")
@@ -562,7 +563,7 @@ class ProxyServer:
 
                 # Create buffer but not stream manager (only if not already exists)
                 if channel_id not in self.stream_buffers:
-                    buffer = StreamBuffer(channel_id=channel_id, redis_client=self.redis_client)
+                    buffer = StreamBuffer(channel_id=channel_id, redis_client=RedisClient.get_buffer())
                     self.stream_buffers[channel_id] = buffer
 
                 # Create client manager with channel_id and redis_client (only if not already exists)
@@ -585,7 +586,7 @@ class ProxyServer:
 
                 # Create buffer but not stream manager (only if not already exists)
                 if channel_id not in self.stream_buffers:
-                    buffer = StreamBuffer(channel_id=channel_id, redis_client=self.redis_client)
+                    buffer = StreamBuffer(channel_id=channel_id, redis_client=RedisClient.get_buffer())
                     self.stream_buffers[channel_id] = buffer
 
                 # Create client manager with channel_id and redis_client (only if not already exists)
@@ -624,12 +625,12 @@ class ProxyServer:
                 # Verify the stream_id was set correctly in Redis
                 stream_id_value = self.redis_client.hget(metadata_key, "stream_id")
                 if stream_id_value:
-                    logger.info(f"Verified stream_id {stream_id_value.decode('utf-8')} is set in Redis for channel {channel_id}")
+                    logger.info(f"Verified stream_id {stream_id_value} is set in Redis for channel {channel_id}")
                 else:
                     logger.warning(f"Failed to set stream_id in Redis for channel {channel_id}")
 
             # Create stream buffer
-            buffer = StreamBuffer(channel_id=channel_id, redis_client=self.redis_client)
+            buffer = StreamBuffer(channel_id=channel_id, redis_client=RedisClient.get_buffer())
             logger.debug(f"Created StreamBuffer for channel {channel_id}")
             self.stream_buffers[channel_id] = buffer
 
@@ -700,8 +701,8 @@ class ProxyServer:
                 metadata = self.redis_client.hgetall(metadata_key)
 
                 # Get channel state and owner
-                state = metadata.get(b'state', b'unknown').decode('utf-8')
-                owner = metadata.get(b'owner', b'').decode('utf-8')
+                state = metadata.get('state', 'unknown')
+                owner = metadata.get('owner', '')
 
                 # States that indicate the channel is running properly
                 valid_states = [ChannelState.ACTIVE, ChannelState.WAITING_FOR_CLIENTS,
@@ -726,8 +727,8 @@ class ProxyServer:
                     return True
                 else:
                     # Unknown or initializing state, check how long it's been in this state
-                    if b'state_changed_at' in metadata:
-                        state_changed_at = float(metadata[b'state_changed_at'].decode('utf-8'))
+                    if 'state_changed_at' in metadata:
+                        state_changed_at = float(metadata['state_changed_at'])
                         state_age = time.time() - state_changed_at
 
                         # If in initializing state for too long, consider it stale
@@ -762,8 +763,8 @@ class ProxyServer:
 
             # If we have metadata, log details for debugging
             if metadata:
-                state = metadata.get(b'state', b'unknown').decode('utf-8')
-                owner = metadata.get(b'owner', b'unknown').decode('utf-8')
+                state = metadata.get('state', 'unknown')
+                owner = metadata.get('owner', 'unknown')
                 logger.info(f"Zombie channel details - state: {state}, owner: {owner}")
 
             # Clean up Redis keys
@@ -931,8 +932,8 @@ class ProxyServer:
                             if self.redis_client:
                                 metadata_key = RedisKeys.channel_metadata(channel_id)
                                 metadata = self.redis_client.hgetall(metadata_key)
-                                if metadata and b'state' in metadata:
-                                    channel_state = metadata[b'state'].decode('utf-8')
+                                if metadata and 'state' in metadata:
+                                    channel_state = metadata['state']
 
                             # Check if channel has any clients left
                             total_clients = 0
@@ -948,9 +949,9 @@ class ProxyServer:
                             if channel_state in [ChannelState.CONNECTING, ChannelState.WAITING_FOR_CLIENTS]:
                                 # Get connection ready time from metadata
                                 connection_ready_time = None
-                                if metadata and b'connection_ready_time' in metadata:
+                                if metadata and 'connection_ready_time' in metadata:
                                     try:
-                                        connection_ready_time = float(metadata[b'connection_ready_time'].decode('utf-8'))
+                                        connection_ready_time = float(metadata['connection_ready_time'])
                                     except (ValueError, TypeError):
                                         pass
 
@@ -981,8 +982,8 @@ class ProxyServer:
                                         # Grace period expired but we have clients - mark channel as active
                                         logger.info(f"Grace period expired with {total_clients} clients - marking channel {channel_id} as active")
                                         old_state = "unknown"
-                                        if metadata and b'state' in metadata:
-                                            old_state = metadata[b'state'].decode('utf-8')
+                                        if metadata and 'state' in metadata:
+                                            old_state = metadata['state']
                                         if self.update_channel_state(channel_id, ChannelState.ACTIVE, {
                                             "grace_period_ended_at": str(time.time()),
                                             "clients_at_activation": str(total_clients)
@@ -998,7 +999,7 @@ class ProxyServer:
                                     disconnect_value = self.redis_client.get(disconnect_key)
                                     if disconnect_value:
                                         try:
-                                            disconnect_time = float(disconnect_value.decode('utf-8'))
+                                            disconnect_time = float(disconnect_value)
                                         except (ValueError, TypeError) as e:
                                             logger.error(f"Invalid disconnect time for channel {channel_id}: {e}")
 
@@ -1076,7 +1077,7 @@ class ProxyServer:
 
             for key in channel_keys:
                 try:
-                    channel_id = key.decode('utf-8').split(':')[2]
+                    channel_id = key.split(':')[2]
 
                     # Skip channels we already have locally
                     if channel_id in self.stream_buffers:
@@ -1170,8 +1171,8 @@ class ProxyServer:
             # Get current state for logging
             current_state = None
             metadata = self.redis_client.hgetall(metadata_key)
-            if metadata and b'state' in metadata:
-                current_state = metadata[b'state'].decode('utf-8')
+            if metadata and 'state' in metadata:
+                current_state = metadata['state']
 
             # Only update if state is actually changing
             if current_state == new_state:
diff --git a/apps/proxy/ts_proxy/services/channel_service.py b/apps/proxy/ts_proxy/services/channel_service.py
index 551e2d27..6e7d3878 100644
--- a/apps/proxy/ts_proxy/services/channel_service.py
+++ b/apps/proxy/ts_proxy/services/channel_service.py
@@ -59,7 +59,7 @@ class ChannelService:
             # Verify the stream_id was set
             stream_id_value = proxy_server.redis_client.hget(metadata_key, ChannelMetadataField.STREAM_ID)
             if stream_id_value:
-                logger.debug(f"Verified stream_id {stream_id_value.decode('utf-8')} is now set in Redis")
+                logger.debug(f"Verified stream_id {stream_id_value} is now set in Redis")
             else:
                 logger.error(f"Failed to set stream_id {stream_id} in Redis before initialization")
 
@@ -129,7 +129,7 @@ class ChannelService:
             try:
                 # This is inefficient but used for diagnostics - in production would use more targeted checks
                 redis_keys = proxy_server.redis_client.keys(f"ts_proxy:*:{channel_id}*")
-                redis_keys = [k.decode('utf-8') for k in redis_keys] if redis_keys else []
+                redis_keys = [k for k in redis_keys] if redis_keys else []
             except Exception as e:
                 logger.error(f"Error checking Redis keys: {e}")
 
@@ -234,8 +234,8 @@ class ChannelService:
             metadata_key = RedisKeys.channel_metadata(channel_id)
             try:
                 metadata = proxy_server.redis_client.hgetall(metadata_key)
-                if metadata and b'state' in metadata:
-                    state = metadata[b'state'].decode('utf-8')
+                if metadata and 'state' in metadata:
+                    state = metadata['state']
                     channel_info = {"state": state}
 
                     # Immediately mark as stopping in metadata so clients detect it faster
@@ -375,8 +375,8 @@ class ChannelService:
             metadata = proxy_server.redis_client.hgetall(metadata_key)
 
             # Extract state and owner
-            state = metadata.get(ChannelMetadataField.STATE.encode(), b'unknown').decode('utf-8')
-            owner = metadata.get(ChannelMetadataField.OWNER.encode(), b'unknown').decode('utf-8')
+            state = metadata.get(ChannelMetadataField.STATE.encode(), 'unknown')
+            owner = metadata.get(ChannelMetadataField.OWNER.encode(), 'unknown')
 
             # Valid states indicate channel is running properly
             valid_states = [ChannelState.ACTIVE, ChannelState.WAITING_FOR_CLIENTS, ChannelState.CONNECTING]
@@ -402,7 +402,7 @@ class ChannelService:
             }
 
             if last_data:
-                last_data_time = float(last_data.decode('utf-8'))
+                last_data_time = float(last_data)
                 data_age = time.time() - last_data_time
                 details["last_data_age"] = data_age
 
@@ -598,7 +598,7 @@ class ChannelService:
     def _update_stream_stats_in_db(stream_id, **stats):
         """Update stream stats in database"""
         from django.db import connection
-        
+
         try:
             from apps.channels.models import Stream
             from django.utils import timezone
@@ -624,7 +624,7 @@ class ChannelService:
         except Exception as e:
             logger.error(f"Error updating stream stats in database for stream {stream_id}: {e}")
             return False
-            
+
         finally:
             # Always close database connection after update
             try:
@@ -645,7 +645,7 @@ class ChannelService:
         metadata_key = RedisKeys.channel_metadata(channel_id)
 
         # First check if the key exists and what type it is
-        key_type = proxy_server.redis_client.type(metadata_key).decode('utf-8')
+        key_type = proxy_server.redis_client.type(metadata_key)
         logger.debug(f"Redis key {metadata_key} is of type: {key_type}")
 
         # Build metadata update dict
diff --git a/apps/proxy/ts_proxy/stream_manager.py b/apps/proxy/ts_proxy/stream_manager.py
index 99ae8027..73118768 100644
--- a/apps/proxy/ts_proxy/stream_manager.py
+++ b/apps/proxy/ts_proxy/stream_manager.py
@@ -89,7 +89,7 @@ class StreamManager:
                     # Try to get stream_id specifically
                     stream_id_bytes = buffer.redis_client.hget(metadata_key, "stream_id")
                     if stream_id_bytes:
-                        self.current_stream_id = int(stream_id_bytes.decode('utf-8'))
+                        self.current_stream_id = int(stream_id_bytes)
                         self.tried_stream_ids.add(self.current_stream_id)
                         logger.info(f"Loaded stream ID {self.current_stream_id} from Redis for channel {buffer.channel_id}")
                     else:
@@ -362,7 +362,7 @@ class StreamManager:
                     current_owner = self.buffer.redis_client.get(owner_key)
 
                     # Use the worker_id that was passed in during initialization
-                    if current_owner and self.worker_id and current_owner.decode('utf-8') == self.worker_id:
+                    if current_owner and self.worker_id and current_owner == self.worker_id:
                         # Determine the appropriate error message based on retry failures
                         if self.tried_stream_ids and len(self.tried_stream_ids) > 0:
                             error_message = f"All {len(self.tried_stream_ids)} stream options failed"
@@ -948,10 +948,10 @@ class StreamManager:
                         logger.debug(f"Updated m3u profile for channel {self.channel_id} to use profile from stream {stream_id}")
                     else:
                         logger.warning(f"Failed to update stream profile for channel {self.channel_id}")
-                    
+
             except Exception as e:
                 logger.error(f"Error updating stream profile for channel {self.channel_id}: {e}")
-                
+
             finally:
                 # Always close database connection after profile update
                 try:
@@ -1348,9 +1348,9 @@ class StreamManager:
                     current_state = None
                     try:
                         metadata = redis_client.hgetall(metadata_key)
-                        state_field = ChannelMetadataField.STATE.encode('utf-8')
+                        state_field = ChannelMetadataField.STATE
                         if metadata and state_field in metadata:
-                            current_state = metadata[state_field].decode('utf-8')
+                            current_state = metadata[state_field]
                     except Exception as e:
                         logger.error(f"Error checking current state: {e}")
 
@@ -1555,4 +1555,4 @@ class StreamManager:
         """Safely reset the URL switching state if it gets stuck"""
         self.url_switching = False
         self.url_switch_start_time = 0
-        logger.info(f"Reset URL switching state for channel {self.channel_id}")
\ No newline at end of file
+        logger.info(f"Reset URL switching state for channel {self.channel_id}")
diff --git a/apps/proxy/ts_proxy/url_utils.py b/apps/proxy/ts_proxy/url_utils.py
index db53cc74..0bfde312 100644
--- a/apps/proxy/ts_proxy/url_utils.py
+++ b/apps/proxy/ts_proxy/url_utils.py
@@ -215,9 +215,9 @@ def get_stream_info_for_switch(channel_id: str, target_stream_id: Optional[int]
                     existing_stream_id = redis_client.get(f"channel_stream:{channel.id}")
                     if existing_stream_id:
                         # Decode bytes to string/int for proper Redis key lookup
-                        existing_stream_id = existing_stream_id.decode('utf-8')
+                        existing_stream_id = existing_stream_id
                         existing_profile_id = redis_client.get(f"stream_profile:{existing_stream_id}")
-                        if existing_profile_id and int(existing_profile_id.decode('utf-8')) == profile.id:
+                        if existing_profile_id and int(existing_profile_id) == profile.id:
                             channel_using_profile = True
                             logger.debug(f"Channel {channel.id} already using profile {profile.id}")
 
@@ -353,9 +353,9 @@ def get_alternate_streams(channel_id: str, current_stream_id: Optional[int] = No
                         existing_stream_id = redis_client.get(f"channel_stream:{channel.id}")
                         if existing_stream_id:
                             # Decode bytes to string/int for proper Redis key lookup
-                            existing_stream_id = existing_stream_id.decode('utf-8')
+                            existing_stream_id = existing_stream_id
                             existing_profile_id = redis_client.get(f"stream_profile:{existing_stream_id}")
-                            if existing_profile_id and int(existing_profile_id.decode('utf-8')) == profile.id:
+                            if existing_profile_id and int(existing_profile_id) == profile.id:
                                 channel_using_profile = True
                                 logger.debug(f"Channel {channel.id} already using profile {profile.id}")
 
diff --git a/apps/proxy/vod_proxy/multi_worker_connection_manager.py b/apps/proxy/vod_proxy/multi_worker_connection_manager.py
index fefc8739..e1fe4c4b 100644
--- a/apps/proxy/vod_proxy/multi_worker_connection_manager.py
+++ b/apps/proxy/vod_proxy/multi_worker_connection_manager.py
@@ -219,7 +219,7 @@ class RedisBackedVODConnection:
 
             # Convert bytes keys/values to strings if needed
             if isinstance(list(data.keys())[0], bytes):
-                data = {k.decode('utf-8'): v.decode('utf-8') for k, v in data.items()}
+                data = {k: v for k, v in data.items()}
 
             return SerializableConnectionState.from_dict(data)
         except Exception as e:
@@ -1115,14 +1115,14 @@ class MultiWorkerVODConnectionManager:
 
                         # Convert bytes to strings if needed
                         if isinstance(list(data.keys())[0], bytes):
-                            data = {k.decode('utf-8'): v.decode('utf-8') for k, v in data.items()}
+                            data = {k: v for k, v in data.items()}
 
                         last_activity = float(data.get('last_activity', 0))
                         active_streams = int(data.get('active_streams', 0))
 
                         # Clean up if stale and no active streams
                         if (current_time - last_activity > max_age_seconds) and active_streams == 0:
-                            session_id = key.decode('utf-8').replace('vod_persistent_connection:', '')
+                            session_id = key.replace('vod_persistent_connection:', '')
                             logger.info(f"Cleaning up stale connection: {session_id}")
 
                             # Clean up connection and related keys
@@ -1219,7 +1219,7 @@ class MultiWorkerVODConnectionManager:
             if connection_data:
                 # Convert bytes to strings if needed
                 if isinstance(list(connection_data.keys())[0], bytes):
-                    connection_data = {k.decode('utf-8'): v.decode('utf-8') for k, v in connection_data.items()}
+                    connection_data = {k: v for k, v in connection_data.items()}
 
                 profile_id = connection_data.get('m3u_profile_id')
                 if profile_id:
@@ -1279,7 +1279,7 @@ class MultiWorkerVODConnectionManager:
 
                         # Convert bytes keys/values to strings if needed
                         if isinstance(list(connection_data.keys())[0], bytes):
-                            connection_data = {k.decode('utf-8'): v.decode('utf-8') for k, v in connection_data.items()}
+                            connection_data = {k: v for k, v in connection_data.items()}
 
                         # Check if content matches (using consolidated data)
                         stored_content_type = connection_data.get('content_obj_type', '')
@@ -1289,7 +1289,7 @@ class MultiWorkerVODConnectionManager:
                             continue
 
                         # Extract session ID
-                        session_id = key.decode('utf-8').replace('vod_persistent_connection:', '')
+                        session_id = key.replace('vod_persistent_connection:', '')
 
                         # Check if Redis-backed connection exists and has no active streams
                         redis_connection = RedisBackedVODConnection(session_id, self.redis_client)
@@ -1367,4 +1367,4 @@ class MultiWorkerVODConnectionManager:
             return redis_connection.get_session_metadata()
         except Exception as e:
             logger.error(f"Error getting session info for {session_id}: {e}")
-            return None
\ No newline at end of file
+            return None
diff --git a/apps/proxy/vod_proxy/views.py b/apps/proxy/vod_proxy/views.py
index 00ed8a10..12e1d071 100644
--- a/apps/proxy/vod_proxy/views.py
+++ b/apps/proxy/vod_proxy/views.py
@@ -550,14 +550,7 @@ class VODStreamView(View):
                 connection_data = redis_client.hgetall(persistent_connection_key)
 
                 if connection_data:
-                    # Decode Redis hash data
-                    decoded_data = {}
-                    for k, v in connection_data.items():
-                        k_str = k.decode('utf-8') if isinstance(k, bytes) else k
-                        v_str = v.decode('utf-8') if isinstance(v, bytes) else v
-                        decoded_data[k_str] = v_str
-
-                    existing_profile_id = decoded_data.get('m3u_profile_id')
+                    existing_profile_id = connection_data.get('m3u_profile_id')
                     if existing_profile_id:
                         try:
                             existing_profile = M3UAccountProfile.objects.get(
@@ -770,19 +763,16 @@ class VODStatsView(View):
 
                 for key in keys:
                     try:
-                        key_str = key.decode('utf-8') if isinstance(key, bytes) else key
                         connection_data = redis_client.hgetall(key)
 
                         if connection_data:
                             # Extract session ID from key
-                            session_id = key_str.replace('vod_persistent_connection:', '')
+                            session_id = key.replace('vod_persistent_connection:', '')
 
                             # Decode Redis hash data
                             combined_data = {}
                             for k, v in connection_data.items():
-                                k_str = k.decode('utf-8') if isinstance(k, bytes) else k
-                                v_str = v.decode('utf-8') if isinstance(v, bytes) else v
-                                combined_data[k_str] = v_str
+                                combined_data[k] = v
 
                             # Get content info from the connection data (using correct field names)
                             content_type = combined_data.get('content_obj_type', 'unknown')
diff --git a/core/redis_pubsub.py b/core/redis_pubsub.py
index 5d0032b0..b1f48b1f 100644
--- a/core/redis_pubsub.py
+++ b/core/redis_pubsub.py
@@ -201,10 +201,6 @@ class RedisPubSubManager:
 
                     channel = message.get('channel')
                     if channel:
-                        # Decode binary channel name if needed
-                        if isinstance(channel, bytes):
-                            channel = channel.decode('utf-8')
-
                         # Find and call the appropriate handler
                         handler = self.message_handlers.get(channel)
                         if handler:
diff --git a/core/tasks.py b/core/tasks.py
index f757613b..257d8660 100644
--- a/core/tasks.py
+++ b/core/tasks.py
@@ -404,7 +404,7 @@ def fetch_channel_stats():
         while True:
             cursor, keys = redis_client.scan(cursor, match=channel_pattern)
             for key in keys:
-                channel_id_match = re.search(r"ts_proxy:channel:(.*):metadata", key.decode('utf-8'))
+                channel_id_match = re.search(r"ts_proxy:channel:(.*):metadata", key)
                 if channel_id_match:
                     ch_id = channel_id_match.group(1)
                     channel_info = ChannelStatus.get_basic_channel_info(ch_id)
diff --git a/core/utils.py b/core/utils.py
index 36ac5fef..9cc4c26f 100644
--- a/core/utils.py
+++ b/core/utils.py
@@ -42,101 +42,116 @@ def natural_sort_key(text):
     return [convert(c) for c in re.split('([0-9]+)', text)]
 
 class RedisClient:
+    _initialized = False
     _client = None
+    _buffer = None
     _pubsub_client = None
 
+    @classmethod
+    def _init_client(cls, decode_responses=True, max_retries=5, retry_interval=1):
+        retry_count = 0
+        while retry_count < max_retries:
+            try:
+                # Get connection parameters from settings or environment
+                redis_host = os.environ.get("REDIS_HOST", getattr(settings, 'REDIS_HOST', 'localhost'))
+                redis_port = int(os.environ.get("REDIS_PORT", getattr(settings, 'REDIS_PORT', 6379)))
+                redis_db = int(os.environ.get("REDIS_DB", getattr(settings, 'REDIS_DB', 0)))
+
+                # Use standardized settings
+                socket_timeout = getattr(settings, 'REDIS_SOCKET_TIMEOUT', 5)
+                socket_connect_timeout = getattr(settings, 'REDIS_SOCKET_CONNECT_TIMEOUT', 5)
+                health_check_interval = getattr(settings, 'REDIS_HEALTH_CHECK_INTERVAL', 30)
+                socket_keepalive = getattr(settings, 'REDIS_SOCKET_KEEPALIVE', True)
+                retry_on_timeout = getattr(settings, 'REDIS_RETRY_ON_TIMEOUT', True)
+
+                # Create Redis client with better defaults
+                client = redis.Redis(
+                    host=redis_host,
+                    port=redis_port,
+                    db=redis_db,
+                    socket_timeout=socket_timeout,
+                    socket_connect_timeout=socket_connect_timeout,
+                    socket_keepalive=socket_keepalive,
+                    health_check_interval=health_check_interval,
+                    retry_on_timeout=retry_on_timeout,
+                    decode_responses=decode_responses
+                )
+
+                # Validate connection with ping
+                client.ping()
+                if cls._initialized is False:
+                    client.flushdb()
+                    cls._initialized = True
+
+                # Disable persistence on first connection - improves performance
+                # Only try to disable if not in a read-only environment
+                try:
+                    client.config_set('save', '')  # Disable RDB snapshots
+                    client.config_set('appendonly', 'no')  # Disable AOF logging
+
+                    # Set optimal memory settings with environment variable support
+                    # Get max memory from environment or use a larger default (512MB instead of 256MB)
+                    #max_memory = os.environ.get('REDIS_MAX_MEMORY', '512mb')
+                    #eviction_policy = os.environ.get('REDIS_EVICTION_POLICY', 'allkeys-lru')
+
+                    # Apply memory settings
+                    #client.config_set('maxmemory-policy', eviction_policy)
+                    #client.config_set('maxmemory', max_memory)
+
+                    #logger.info(f"Redis configured with maxmemory={max_memory}, policy={eviction_policy}")
+
+                    # Disable protected mode when in debug mode
+                    if os.environ.get('DISPATCHARR_DEBUG', '').lower() == 'true':
+                        client.config_set('protected-mode', 'no')  # Disable protected mode in debug
+                        logger.warning("Redis protected mode disabled for debug environment")
+
+                    logger.trace("Redis persistence disabled for better performance")
+                except redis.exceptions.ResponseError as e:
+                    # Improve error handling for Redis configuration errors
+                    if "OOM" in str(e):
+                        logger.error(f"Redis OOM during configuration: {e}")
+                        # Try to increase maxmemory as an emergency measure
+                        try:
+                            client.config_set('maxmemory', '768mb')
+                            logger.warning("Applied emergency Redis memory increase to 768MB")
+                        except:
+                            pass
+                    else:
+                        logger.error(f"Redis configuration error: {e}")
+
+                logger.info(f"Connected to Redis at {redis_host}:{redis_port}/{redis_db}")
+                break
+
+            except (ConnectionError, TimeoutError) as e:
+                retry_count += 1
+                if retry_count >= max_retries:
+                    logger.error(f"Failed to connect to Redis after {max_retries} attempts: {e}")
+                    return None
+                else:
+                    # Use exponential backoff for retries
+                    wait_time = retry_interval * (2 ** (retry_count - 1))
+                    logger.warning(f"Redis connection failed. Retrying in {wait_time}s... ({retry_count}/{max_retries})")
+                    time.sleep(wait_time)
+
+            except Exception as e:
+                logger.error(f"Unexpected error connecting to Redis: {e}")
+                return None
+
+        return client
+
     @classmethod
     def get_client(cls, max_retries=5, retry_interval=1):
         if cls._client is None:
-            retry_count = 0
-            while retry_count < max_retries:
-                try:
-                    # Get connection parameters from settings or environment
-                    redis_host = os.environ.get("REDIS_HOST", getattr(settings, 'REDIS_HOST', 'localhost'))
-                    redis_port = int(os.environ.get("REDIS_PORT", getattr(settings, 'REDIS_PORT', 6379)))
-                    redis_db = int(os.environ.get("REDIS_DB", getattr(settings, 'REDIS_DB', 0)))
-
-                    # Use standardized settings
-                    socket_timeout = getattr(settings, 'REDIS_SOCKET_TIMEOUT', 5)
-                    socket_connect_timeout = getattr(settings, 'REDIS_SOCKET_CONNECT_TIMEOUT', 5)
-                    health_check_interval = getattr(settings, 'REDIS_HEALTH_CHECK_INTERVAL', 30)
-                    socket_keepalive = getattr(settings, 'REDIS_SOCKET_KEEPALIVE', True)
-                    retry_on_timeout = getattr(settings, 'REDIS_RETRY_ON_TIMEOUT', True)
-
-                    # Create Redis client with better defaults
-                    client = redis.Redis(
-                        host=redis_host,
-                        port=redis_port,
-                        db=redis_db,
-                        socket_timeout=socket_timeout,
-                        socket_connect_timeout=socket_connect_timeout,
-                        socket_keepalive=socket_keepalive,
-                        health_check_interval=health_check_interval,
-                        retry_on_timeout=retry_on_timeout
-                    )
-
-                    # Validate connection with ping
-                    client.ping()
-                    client.flushdb()
-
-                    # Disable persistence on first connection - improves performance
-                    # Only try to disable if not in a read-only environment
-                    try:
-                        client.config_set('save', '')  # Disable RDB snapshots
-                        client.config_set('appendonly', 'no')  # Disable AOF logging
-
-                        # Set optimal memory settings with environment variable support
-                        # Get max memory from environment or use a larger default (512MB instead of 256MB)
-                        #max_memory = os.environ.get('REDIS_MAX_MEMORY', '512mb')
-                        #eviction_policy = os.environ.get('REDIS_EVICTION_POLICY', 'allkeys-lru')
-
-                        # Apply memory settings
-                        #client.config_set('maxmemory-policy', eviction_policy)
-                        #client.config_set('maxmemory', max_memory)
-
-                        #logger.info(f"Redis configured with maxmemory={max_memory}, policy={eviction_policy}")
-
-                        # Disable protected mode when in debug mode
-                        if os.environ.get('DISPATCHARR_DEBUG', '').lower() == 'true':
-                            client.config_set('protected-mode', 'no')  # Disable protected mode in debug
-                            logger.warning("Redis protected mode disabled for debug environment")
-
-                        logger.trace("Redis persistence disabled for better performance")
-                    except redis.exceptions.ResponseError as e:
-                        # Improve error handling for Redis configuration errors
-                        if "OOM" in str(e):
-                            logger.error(f"Redis OOM during configuration: {e}")
-                            # Try to increase maxmemory as an emergency measure
-                            try:
-                                client.config_set('maxmemory', '768mb')
-                                logger.warning("Applied emergency Redis memory increase to 768MB")
-                            except:
-                                pass
-                        else:
-                            logger.error(f"Redis configuration error: {e}")
-
-                    logger.info(f"Connected to Redis at {redis_host}:{redis_port}/{redis_db}")
-
-                    cls._client = client
-                    break
-
-                except (ConnectionError, TimeoutError) as e:
-                    retry_count += 1
-                    if retry_count >= max_retries:
-                        logger.error(f"Failed to connect to Redis after {max_retries} attempts: {e}")
-                        return None
-                    else:
-                        # Use exponential backoff for retries
-                        wait_time = retry_interval * (2 ** (retry_count - 1))
-                        logger.warning(f"Redis connection failed. Retrying in {wait_time}s... ({retry_count}/{max_retries})")
-                        time.sleep(wait_time)
-
-                except Exception as e:
-                    logger.error(f"Unexpected error connecting to Redis: {e}")
-                    return None
-
+            cls._client = cls._init_client(decode_responses=True, max_retries=max_retries, retry_interval=retry_interval)
         return cls._client
 
+    @classmethod
+    def get_buffer(cls, max_retries=5, retry_interval=1):
+        """Get Redis client optimized for binary data (no decoding)"""
+        if cls._buffer is None:
+            cls._buffer = cls._init_client(decode_responses=False, max_retries=max_retries, retry_interval=retry_interval)
+        return cls._buffer
+
     @classmethod
     def get_pubsub_client(cls, max_retries=5, retry_interval=1):
         """Get Redis client optimized for PubSub operations"""
@@ -165,7 +180,8 @@ class RedisClient:
                         socket_connect_timeout=socket_connect_timeout,
                         socket_keepalive=socket_keepalive,
                         health_check_interval=health_check_interval,
-                        retry_on_timeout=retry_on_timeout
+                        retry_on_timeout=retry_on_timeout,
+                        decode_responses=True
                     )
 
                     # Validate connection with ping
diff --git a/dispatcharr/persistent_lock.py b/dispatcharr/persistent_lock.py
index 360c9b5d..fe62be43 100644
--- a/dispatcharr/persistent_lock.py
+++ b/dispatcharr/persistent_lock.py
@@ -48,7 +48,7 @@ class PersistentLock:
         Returns True if the expiration was successfully extended.
         """
         current_value = self.redis_client.get(self.lock_key)
-        if current_value and current_value.decode("utf-8") == self.lock_token:
+        if current_value and current_value == self.lock_token:
             self.redis_client.expire(self.lock_key, self.lock_timeout)
             self.has_lock = False
             return True

From 16183329623e163ec01145b721e2197571c12097 Mon Sep 17 00:00:00 2001
From: dekzter <kappa118@gmail.com>
Date: Wed, 12 Nov 2025 17:52:11 -0500
Subject: [PATCH 02/67] byte to string fix

---
 apps/proxy/vod_proxy/connection_manager.py | 55 ++++++++++------------
 1 file changed, 26 insertions(+), 29 deletions(-)

diff --git a/apps/proxy/vod_proxy/connection_manager.py b/apps/proxy/vod_proxy/connection_manager.py
index dea5759b..00ca77aa 100644
--- a/apps/proxy/vod_proxy/connection_manager.py
+++ b/apps/proxy/vod_proxy/connection_manager.py
@@ -329,15 +329,15 @@ class VODConnectionManager:
                             continue
 
                         # Extract session info
-                        stored_content_type = session_data.get(b'content_type', b'').decode('utf-8')
-                        stored_content_uuid = session_data.get(b'content_uuid', b'').decode('utf-8')
+                        stored_content_type = session_data.get('content_type', '')
+                        stored_content_uuid = session_data.get('content_uuid', '')
 
                         # Check if content matches
                         if stored_content_type != content_type or stored_content_uuid != content_uuid:
                             continue
 
                         # Extract session ID from key
-                        session_id = key.decode('utf-8').replace('vod_session:', '')
+                        session_id = key.replace('vod_session:', '')
 
                         # Check if session has an active persistent connection
                         persistent_conn = self._persistent_connections.get(session_id)
@@ -351,13 +351,13 @@ class VODConnectionManager:
                             continue
 
                         # Get stored client info for comparison
-                        stored_client_ip = session_data.get(b'client_ip', b'').decode('utf-8')
-                        stored_user_agent = session_data.get(b'user_agent', b'').decode('utf-8')
+                        stored_client_ip = session_data.get('client_ip', '')
+                        stored_user_agent = session_data.get('user_agent', '')
 
                         # Check timeshift parameters match
-                        stored_utc_start = session_data.get(b'utc_start', b'').decode('utf-8')
-                        stored_utc_end = session_data.get(b'utc_end', b'').decode('utf-8')
-                        stored_offset = session_data.get(b'offset', b'').decode('utf-8')
+                        stored_utc_start = session_data.get('utc_start', '')
+                        stored_utc_end = session_data.get('utc_end', '')
+                        stored_offset = session_data.get('offset', '')
 
                         current_utc_start = utc_start or ""
                         current_utc_end = utc_end or ""
@@ -394,7 +394,7 @@ class VODConnectionManager:
                                 'session_id': session_id,
                                 'score': score,
                                 'reasons': match_reasons,
-                                'last_activity': float(session_data.get(b'last_activity', b'0').decode('utf-8'))
+                                'last_activity': float(session_data.get('last_activity', '0'))
                             })
 
                     except Exception as e:
@@ -536,7 +536,7 @@ class VODConnectionManager:
                 # Get current bytes and add to it
                 current_bytes = self.redis_client.hget(connection_key, "bytes_sent")
                 if current_bytes:
-                    total_bytes = int(current_bytes.decode('utf-8')) + bytes_sent
+                    total_bytes = int(current_bytes) + bytes_sent
                 else:
                     total_bytes = bytes_sent
                 update_data["bytes_sent"] = str(total_bytes)
@@ -571,7 +571,7 @@ class VODConnectionManager:
             profile_id = None
             if b"m3u_profile_id" in connection_data:
                 try:
-                    profile_id = int(connection_data[b"m3u_profile_id"].decode('utf-8'))
+                    profile_id = int(connection_data["m3u_profile_id"])
                 except ValueError:
                     pass
 
@@ -617,16 +617,14 @@ class VODConnectionManager:
             # Convert bytes to strings and parse numbers
             info = {}
             for key, value in connection_data.items():
-                key_str = key.decode('utf-8')
-                value_str = value.decode('utf-8')
 
                 # Parse numeric fields
-                if key_str in ['connected_at', 'last_activity']:
-                    info[key_str] = float(value_str)
-                elif key_str in ['bytes_sent', 'position_seconds', 'm3u_profile_id']:
-                    info[key_str] = int(value_str)
+                if key in ['connected_at', 'last_activity']:
+                    info[key] = float(value)
+                elif key in ['bytes_sent', 'position_seconds', 'm3u_profile_id']:
+                    info[key] = int(valuvaluee_str)
                 else:
-                    info[key_str] = value_str
+                    info[key] = value
 
             return info
 
@@ -676,14 +674,13 @@ class VODConnectionManager:
 
                 for key in keys:
                     try:
-                        key_str = key.decode('utf-8')
                         last_activity = self.redis_client.hget(key, "last_activity")
 
                         if last_activity:
-                            last_activity_time = float(last_activity.decode('utf-8'))
+                            last_activity_time = float(last_activity)
                             if current_time - last_activity_time > max_age_seconds:
                                 # Extract info for cleanup
-                                parts = key_str.split(':')
+                                parts = key.split(':')
                                 if len(parts) >= 5:
                                     content_type = parts[2]
                                     content_uuid = parts[3]
@@ -1342,9 +1339,9 @@ class VODConnectionManager:
                     session_data = self.redis_client.hgetall(session_key)
                     if session_data:
                         # Get session details for connection cleanup
-                        content_type = session_data.get(b'content_type', b'').decode('utf-8')
-                        content_uuid = session_data.get(b'content_uuid', b'').decode('utf-8')
-                        profile_id = session_data.get(b'profile_id')
+                        content_type = session_data.get('content_type', '')
+                        content_uuid = session_data.get('content_uuid', '')
+                        profile_id = session_data.get('profile_id')
 
                         # Generate client_id from session_id (matches what's used during streaming)
                         client_id = session_id
@@ -1355,12 +1352,12 @@ class VODConnectionManager:
                             self.remove_connection(content_type, content_uuid, client_id)
 
                         # Remove from profile connections if counted (additional safety check)
-                        if session_data.get(b'connection_counted') == b'True' and profile_id:
-                            profile_key = self._get_profile_connections_key(int(profile_id.decode('utf-8')))
+                        if session_data.get('connection_counted') == 'True' and profile_id:
+                            profile_key = self._get_profile_connections_key(int(profile_id))
                             current_count = int(self.redis_client.get(profile_key) or 0)
                             if current_count > 0:
                                 self.redis_client.decr(profile_key)
-                                logger.info(f"[{session_id}] Decremented profile {profile_id.decode('utf-8')} connections")
+                                logger.info(f"[{session_id}] Decremented profile {profile_id} connections")
 
                     # Remove session tracking key
                     self.redis_client.delete(session_key)
@@ -1380,7 +1377,7 @@ class VODConnectionManager:
 
                         if session_related_keys:
                             # Filter out keys we already deleted
-                            remaining_keys = [k for k in session_related_keys if k.decode('utf-8') != session_key]
+                            remaining_keys = [k for k in session_related_keys if k != session_key]
                             if remaining_keys:
                                 self.redis_client.delete(*remaining_keys)
                                 logger.info(f"[{session_id}] Cleaned up {len(remaining_keys)} additional session-related keys")
@@ -1410,7 +1407,7 @@ class VODConnectionManager:
                 if self.redis_client:
                     session_data = self.redis_client.hgetall(session_key)
                     if session_data:
-                        created_at = float(session_data.get(b'created_at', b'0').decode('utf-8'))
+                        created_at = float(session_data.get('created_at', '0'))
                         if current_time - created_at > max_age_seconds:
                             logger.info(f"[{session_id}] Session older than {max_age_seconds}s")
                             stale_sessions.append(session_id)

From cd35e671e56a29e57e256351010147a4c8145c88 Mon Sep 17 00:00:00 2001
From: dekzter <kappa118@gmail.com>
Date: Wed, 12 Nov 2025 17:52:48 -0500
Subject: [PATCH 03/67] byte to string fix

---
 apps/proxy/ts_proxy/stream_generator.py | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/apps/proxy/ts_proxy/stream_generator.py b/apps/proxy/ts_proxy/stream_generator.py
index 368691b8..25122d74 100644
--- a/apps/proxy/ts_proxy/stream_generator.py
+++ b/apps/proxy/ts_proxy/stream_generator.py
@@ -108,13 +108,13 @@ class StreamGenerator:
                 metadata_key = RedisKeys.channel_metadata(self.channel_id)
                 metadata = proxy_server.redis_client.hgetall(metadata_key)
 
-                if metadata and b'state' in metadata:
-                    state = metadata[b'state'].decode('utf-8')
+                if metadata and 'state' in metadata:
+                    state = metadata['state']
                     if state in ['waiting_for_clients', 'active']:
                         logger.info(f"[{self.client_id}] Channel {self.channel_id} now ready (state={state})")
                         return True
                     elif state in ['error', 'stopped', 'stopping']:  # Added 'stopping' to error states
-                        error_message = metadata.get(b'error_message', b'Unknown error').decode('utf-8')
+                        error_message = metadata.get('error_message', 'Unknown error')
                         logger.error(f"[{self.client_id}] Channel {self.channel_id} in error state: {state}, message: {error_message}")
                         # Send error packet before giving up
                         yield create_ts_packet('error', f"Error: {error_message}")
@@ -122,9 +122,9 @@ class StreamGenerator:
                     else:
                         # Improved logging to track initialization progress
                         init_time = "unknown"
-                        if b'init_time' in metadata:
+                        if 'init_time' in metadata:
                             try:
-                                init_time_float = float(metadata[b'init_time'].decode('utf-8'))
+                                init_time_float = float(metadata['init_time'])
                                 init_duration = time.time() - init_time_float
                                 init_time = f"{init_duration:.1f}s ago"
                             except:
@@ -267,8 +267,8 @@ class StreamGenerator:
             # Also check channel state in metadata
             metadata_key = RedisKeys.channel_metadata(self.channel_id)
             metadata = proxy_server.redis_client.hgetall(metadata_key)
-            if metadata and b'state' in metadata:
-                state = metadata[b'state'].decode('utf-8')
+            if metadata and 'state' in metadata:
+                state = metadata['state']
                 if state in ['error', 'stopped', 'stopping']:
                     logger.info(f"[{self.client_id}] Channel in {state} state, terminating stream")
                     return False
@@ -397,8 +397,6 @@ class StreamGenerator:
                 if metadata:
                     stream_id_bytes = proxy_server.redis_client.hget(metadata_key, ChannelMetadataField.STREAM_ID)
                     if stream_id_bytes:
-                        stream_id = int(stream_id_bytes.decode('utf-8'))
-
                         # Check if we're the last client
                         if self.channel_id in proxy_server.client_managers:
                             client_count = proxy_server.client_managers[self.channel_id].get_total_client_count()
@@ -459,4 +457,4 @@ def create_stream_generator(channel_id, client_id, client_ip, client_user_agent,
     Returns a function that can be passed to StreamingHttpResponse.
     """
     generator = StreamGenerator(channel_id, client_id, client_ip, client_user_agent, channel_initializing)
-    return generator.generate
\ No newline at end of file
+    return generator.generate

From 2ca2a51e2e63dcdc8c8ab7942472caaf2b9f4a0d Mon Sep 17 00:00:00 2001
From: dekzter <kappa118@gmail.com>
Date: Sat, 6 Dec 2025 09:36:50 -0500
Subject: [PATCH 04/67] reverted fix so only updated values are modified

---
 apps/proxy/ts_proxy/channel_status.py | 34 +++++++++++++++++++++------
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/apps/proxy/ts_proxy/channel_status.py b/apps/proxy/ts_proxy/channel_status.py
index 015d5ca2..4ac8f63f 100644
--- a/apps/proxy/ts_proxy/channel_status.py
+++ b/apps/proxy/ts_proxy/channel_status.py
@@ -434,13 +434,33 @@ class ChannelStatus:
                     logger.warning(f"Invalid m3u_profile_id format in Redis: {m3u_profile_id}")
 
             # Add stream info to basic info as well
-            info['video_codec'] = metadata.get(ChannelMetadataField.VIDEO_CODEC)
-            info['resolution'] = metadata.get(ChannelMetadataField.RESOLUTION)
-            info['source_fps'] = metadata.get(ChannelMetadataField.SOURCE_FPS)
-            info['ffmpeg_speed'] = metadata.get(ChannelMetadataField.FFMPEG_SPEED)
-            info['audio_codec'] = metadata.get(ChannelMetadataField.AUDIO_CODEC)
-            info['audio_channels'] = metadata.get(ChannelMetadataField.AUDIO_CHANNELS)
-            info['stream_type'] = metadata.get(ChannelMetadataField.STREAM_TYPE)
+            video_codec = metadata.get(ChannelMetadataField.VIDEO_CODEC)
+            if video_codec:
+                info['video_codec'] = video_codec
+
+            resolution = metadata.get(ChannelMetadataField.RESOLUTION)
+            if resolution:
+                info['resolution'] = resolution
+
+            source_fps = metadata.get(ChannelMetadataField.SOURCE_FPS)
+            if source_fps:
+                info['source_fps'] = float(source_fps)
+
+            ffmpeg_speed = metadata.get(ChannelMetadataField.FFMPEG_SPEED)
+            if ffmpeg_speed:
+                info['ffmpeg_speed'] = float(ffmpeg_speed)
+
+            audio_codec = metadata.get(ChannelMetadataField.AUDIO_CODEC)
+            if audio_codec:
+                info['audio_codec'] = audio_codec
+
+            audio_channels = metadata.get(ChannelMetadataField.AUDIO_CHANNELS)
+            if audio_channels:
+                info['audio_channels'] = audio_channels
+
+            stream_type = metadata.get(ChannelMetadataField.STREAM_TYPE)
+            if stream_type:
+                info['stream_type'] = stream_type
 
             return info
         except Exception as e:

From dba70b3c585e0f2dce6cdcf157045992e617b236 Mon Sep 17 00:00:00 2001
From: dekzter <kappa118@gmail.com>
Date: Tue, 27 Jan 2026 15:23:07 -0500
Subject: [PATCH 05/67] outstanding commits, may revisit later

---
 .../migrations/0004_user_stream_priority.py   |  18 +++
 apps/channels/models.py                       | 153 +++++++++++++++++-
 apps/channels/tasks.py                        |   5 +-
 apps/proxy/ts_proxy/client_manager.py         |  16 +-
 apps/proxy/ts_proxy/server.py                 |   6 -
 apps/proxy/ts_proxy/utils.py                  |   4 +-
 apps/proxy/ts_proxy/views.py                  |  26 +--
 docker/init/02-postgres.sh                    |   2 -
 docker/init/03-init-dispatcharr.sh            |   2 +-
 docker/init/99-init-dev.sh                    |  50 +++---
 docker/uwsgi.dev.ini                          |   4 +-
 frontend/prettier.config.js                   |   4 +-
 frontend/src/components/forms/User.jsx        |  40 +++--
 frontend/src/pages/Users.jsx                  |  35 ----
 14 files changed, 242 insertions(+), 123 deletions(-)
 create mode 100644 apps/accounts/migrations/0004_user_stream_priority.py

diff --git a/apps/accounts/migrations/0004_user_stream_priority.py b/apps/accounts/migrations/0004_user_stream_priority.py
new file mode 100644
index 00000000..35c8bbae
--- /dev/null
+++ b/apps/accounts/migrations/0004_user_stream_priority.py
@@ -0,0 +1,18 @@
+# Generated by Django 5.2.4 on 2025-10-21 19:32
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0003_alter_user_custom_properties'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='user',
+            name='stream_priority',
+            field=models.IntegerField(default=0, help_text='Priority level for streaming tasks. Lower values indicate higher priority.'),
+        ),
+    ]
diff --git a/apps/channels/models.py b/apps/channels/models.py
index 3dfb392b..7282d025 100644
--- a/apps/channels/models.py
+++ b/apps/channels/models.py
@@ -166,7 +166,7 @@ class Stream(models.Model):
 
         return stream_profile
 
-    def get_stream(self):
+    def get_stream(self, requester=None):
         """
         Finds an available stream for the requested channel and returns the selected stream and profile.
         """
@@ -349,7 +349,145 @@ class Channel(models.Model):
 
         return stream_profile
 
-    def get_stream(self):
+    def _pick_channel_to_preempt(
+        self,
+        profile_id,
+        requester_level,
+        redis_client,
+        exclude_channel_ids=None,
+        cooldown_seconds=30,
+    ):
+        """
+        Pick the lowest-impact channel to terminate on the given profile.
+        Returns: Optional[int] channel_id to preempt
+        """
+        exclude_channel_ids = set(exclude_channel_ids or [])
+        candidates = []
+
+        # 1) Try to get active channel IDs for this profile from an index set if available
+        ch_set_key = f"ts_proxy:profile:{profile_id}:channels"
+        try:
+            ch_ids = { (int(x) if not isinstance(x, int) else x) for x in (redis_client.smembers(ch_set_key) or set()) }
+        except Exception:
+            ch_ids = set()
+
+        logger.debug("Candidate channels for preemption:")
+        logger.debug(ch_ids)
+
+        # 2) Fallback: scan metadata keys and filter by m3u_profile == profile_id
+        if not ch_ids:
+            cursor = 0
+            pattern = "ts_proxy:channel:*:metadata"
+            while True:
+                cursor, keys = redis_client.scan(cursor=cursor, match=pattern, count=500)
+                if keys:
+                    # Prefer HGET m3u_profile if metadata is a hash
+                    pipe = redis_client.pipeline()
+                    for k in keys:
+                        pipe.hget(k, "m3u_profile")
+                    prof_vals = pipe.execute()
+                    for k, prof_val in zip(keys, prof_vals):
+                        try:
+                            pid = int(prof_val) if prof_val is not None else None
+                        except Exception:
+                            pid = None
+
+                        if pid == profile_id:
+                            parts = k.split(":")  # ts_proxy:channel:{id}:metadata
+                            if len(parts) >= 4:
+                                try:
+                                    ch_ids.add(int(parts[2]))
+                                except Exception:
+                                    pass
+                if cursor == 0:
+                    break
+
+        logger.debug("Candidate channels for preemption:")
+        logger.debug(ch_ids)
+
+        if not ch_ids:
+            return None
+
+        # 3) Score candidates
+        for ch_id in ch_ids:
+            if ch_id in exclude_channel_ids:
+                continue
+
+            # Skip if recently preempted
+            last_preempt_key = f"ts_proxy:channel:{ch_id}:last_preempt"
+            try:
+                last_preempt = float(redis_client.get(last_preempt_key) or 0.0)
+            except Exception:
+                last_preempt = 0.0
+            if last_preempt and (time.time() - last_preempt) < cooldown_seconds:
+                continue
+
+            # Clients and their levels
+            clients_key = f"ts_proxy:channel:{ch_id}:clients"
+            member_ids = list(redis_client.smembers(clients_key) or [])
+            viewer_count = len(member_ids)
+            max_viewer_level = 0
+            if viewer_count:
+                pipe = redis_client.pipeline()
+                for cid in member_ids:
+                    pipe.hget(f"ts_proxy:channel:{ch_id}:clients:{cid}", "user_level")
+                levels_raw = pipe.execute()
+                levels = []
+                for lv in levels_raw:
+                    try:
+                        levels.append(int(lv or 0))
+                    except Exception:
+                        levels.append(0)
+                max_viewer_level = max(levels or [0])
+
+            # Only preempt if requester strictly outranks this channel's viewers
+            if requester_level <= max_viewer_level:
+                continue
+
+            # Metadata (protected/recording/started_at_ts)
+            meta_key = f"ts_proxy:channel:{ch_id}:metadata"
+            try:
+                protected, recording, started_at_ts = redis_client.hmget(
+                    meta_key, "protected", "recording", "started_at_ts"
+                )
+            except Exception:
+                protected = recording = started_at_ts = None
+
+            protected = str(protected or "0") in ("1", "true", "True")
+            recording = str(recording or "0") in ("1", "true", "True")
+            if protected or recording:
+                continue
+
+            try:
+                started_at_ts = float(started_at_ts) if started_at_ts is not None else None
+            except Exception:
+                started_at_ts = None
+            if started_at_ts is None:
+                started_at_ts = time.time()  # treat unknown as newest
+
+            # Score: lower is safer to terminate
+            has_viewers = 1 if viewer_count > 0 else 0
+            score = (has_viewers, max_viewer_level, viewer_count, started_at_ts)
+            candidates.append((score, ch_id))
+
+        logger.debug("Candidate channels after scoring:")
+        logger.debug(candidates)
+
+        if not candidates:
+            return None
+
+        candidates.sort(key=lambda x: x[0])
+        victim_id = candidates[0][1]
+
+        # Mark preempt timestamp to avoid thrashing
+        try:
+            redis_client.set(f"ts_proxy:channel:{victim_id}:last_preempt", str(time.time()), ex=3600)
+        except Exception:
+            pass
+
+        return victim_id
+
+    def get_stream(self, requester=None):
         """
         Finds an available stream for the requested channel and returns the selected stream and profile.
 
@@ -438,6 +576,17 @@ class Channel(models.Model):
                         None,
                     )  # Return newly assigned stream and matched profile
                 else:
+                    # At capacity: try to preempt a lower-impact channel on this profile
+                    victim_channel_id = self._pick_channel_to_preempt(
+                        profile_id=profile.id,
+                        requester_level=requester.user_level if requester else 100,
+                        redis_client=redis_client,
+                        exclude_channel_ids=None,
+                    )
+                    if victim_channel_id:
+                        logger.info(f"Preempting channel {victim_channel_id} for new stream on profile {profile.id}")
+                        # return self.id, profile.id, victim_channel_id
+
                     # This profile is at max connections
                     has_streams_but_maxed_out = True
                     logger.debug(
diff --git a/apps/channels/tasks.py b/apps/channels/tasks.py
index ffb2b97a..b63577d2 100755
--- a/apps/channels/tasks.py
+++ b/apps/channels/tasks.py
@@ -1900,11 +1900,8 @@ def run_recording(recording_id, channel_id, start_time_str, end_time_str):
                 metadata_key = RedisKeys.channel_metadata(str(channel.uuid))
                 md = r.hgetall(metadata_key)
                 if md:
-                    def _gv(bkey):
-                        return md.get(bkey)
-
                     def _d(bkey, cast=str):
-                        v = _gv(bkey)
+                        v = md.get(key)
                         try:
                             if v is None:
                                 return None
diff --git a/apps/proxy/ts_proxy/client_manager.py b/apps/proxy/ts_proxy/client_manager.py
index bffecdde..80be26f1 100644
--- a/apps/proxy/ts_proxy/client_manager.py
+++ b/apps/proxy/ts_proxy/client_manager.py
@@ -1,10 +1,8 @@
 """Client connection management for TS streams"""
 
 import threading
-import logging
 import time
 import json
-import gevent
 from typing import Set, Optional
 from apps.proxy.config import TSConfig as Config
 from redis.exceptions import ConnectionError, TimeoutError
@@ -123,7 +121,7 @@ class ClientManager:
                             # Check for stale activity using last_active field
                             last_active = self.redis_client.hget(client_key, "last_active")
                             if last_active:
-                                last_active_time = float(last_active.decode('utf-8'))
+                                last_active_time = float(last_active)
                                 ghost_timeout = self.heartbeat_interval * getattr(Config, 'GHOST_CLIENT_MULTIPLIER', 5.0)
 
                                 if current_time - last_active_time > ghost_timeout:
@@ -224,7 +222,7 @@ class ClientManager:
         except Exception as e:
             logger.error(f"Error notifying owner of client activity: {e}")
 
-    def add_client(self, client_id, client_ip, user_agent=None):
+    def add_client(self, client_id, client_ip, user_agent=None, user=None):
         """Add a client with duplicate prevention"""
         if client_id in self._registered_clients:
             logger.debug(f"Client {client_id} already registered, skipping")
@@ -242,7 +240,8 @@ class ClientManager:
             "ip_address": client_ip,
             "connected_at": current_time,
             "last_active": current_time,
-            "worker_id": self.worker_id or "unknown"
+            "worker_id": self.worker_id or "unknown",
+            "user_level": user.user_level if user is not None else 100, # default to a high value since no user means the non-user specific M3U/HDHR
         }
 
         try:
@@ -303,8 +302,6 @@ class ClientManager:
 
     def remove_client(self, client_id):
         """Remove a client from this channel and Redis"""
-        client_ip = None
-
         with self.lock:
             if client_id in self.clients:
                 self.clients.remove(client_id)
@@ -317,11 +314,6 @@ class ClientManager:
             if self.redis_client:
                 # Get client IP before removing the data
                 client_key = f"ts_proxy:channel:{self.channel_id}:clients:{client_id}"
-                client_data = self.redis_client.hgetall(client_key)
-                if client_data and b'ip_address' in client_data:
-                    client_ip = client_data[b'ip_address'].decode('utf-8')
-                elif client_data and 'ip_address' in client_data:
-                    client_ip = client_data['ip_address']
 
                 # Remove from channel's client set
                 self.redis_client.srem(self.client_set_key, client_id)
diff --git a/apps/proxy/ts_proxy/server.py b/apps/proxy/ts_proxy/server.py
index 9773e487..7d4a9f89 100644
--- a/apps/proxy/ts_proxy/server.py
+++ b/apps/proxy/ts_proxy/server.py
@@ -1121,12 +1121,6 @@ class ProxyServer:
                                     else:
                                         # Grace period expired with clients - mark channel as active
                                         logger.info(f"Grace period expired with {total_clients} clients - marking channel {channel_id} as active")
-<<<<<<< HEAD
-                                        old_state = "unknown"
-                                        if metadata and 'state' in metadata:
-                                            old_state = metadata['state']
-=======
->>>>>>> origin/dev
                                         if self.update_channel_state(channel_id, ChannelState.ACTIVE, {
                                             "grace_period_ended_at": str(time.time()),
                                             "clients_at_activation": str(total_clients)
diff --git a/apps/proxy/ts_proxy/utils.py b/apps/proxy/ts_proxy/utils.py
index 20a6e140..ff9e1780 100644
--- a/apps/proxy/ts_proxy/utils.py
+++ b/apps/proxy/ts_proxy/utils.py
@@ -83,7 +83,7 @@ def create_ts_packet(packet_type='null', message=None):
 
     # Add message to payload if provided
     if message:
-        msg_bytes = message.encode('utf-8')
+        msg_bytes = message
         packet[4:4+min(len(msg_bytes), 180)] = msg_bytes[:180]
 
     return bytes(packet)
@@ -113,4 +113,4 @@ def get_logger(component_name=None):
             # Default if detection fails
             logger_name = "ts_proxy"
 
-    return logging.getLogger(logger_name)
\ No newline at end of file
+    return logging.getLogger(logger_name)
diff --git a/apps/proxy/ts_proxy/views.py b/apps/proxy/ts_proxy/views.py
index 91f254a7..0f9c1228 100644
--- a/apps/proxy/ts_proxy/views.py
+++ b/apps/proxy/ts_proxy/views.py
@@ -45,7 +45,7 @@ logger = get_logger()
 
 
 @api_view(["GET"])
-def stream_ts(request, channel_id):
+def stream_ts(request, channel_id, user=None):
     if not network_access_allowed(request, "STREAMS"):
         return JsonResponse({"error": "Forbidden"}, status=403)
 
@@ -80,9 +80,9 @@ def stream_ts(request, channel_id):
             metadata_key = RedisKeys.channel_metadata(channel_id)
             if proxy_server.redis_client.exists(metadata_key):
                 metadata = proxy_server.redis_client.hgetall(metadata_key)
-                state_field = ChannelMetadataField.STATE.encode("utf-8")
+                state_field = ChannelMetadataField.STATE
                 if state_field in metadata:
-                    channel_state = metadata[state_field].decode("utf-8")
+                    channel_state = metadata[state_field]
 
                     # Active/running states - channel is operational, don't reinitialize
                     if channel_state in [
@@ -120,7 +120,7 @@ def stream_ts(request, channel_id):
                     else:
                         owner_field = ChannelMetadataField.OWNER.encode("utf-8")
                         if owner_field in metadata:
-                            owner = metadata[owner_field].decode("utf-8")
+                            owner = metadata[owner_field]
                             owner_heartbeat_key = f"ts_proxy:worker:{owner}:heartbeat"
                             if proxy_server.redis_client.exists(owner_heartbeat_key):
                                 # Owner is still active with unknown state - don't reinitialize
@@ -373,7 +373,7 @@ def stream_ts(request, channel_id):
                                         metadata_key, ChannelMetadataField.STATE
                                     )
                                     if state_bytes:
-                                        current_state = state_bytes.decode("utf-8")
+                                        current_state = state_bytes
                                         logger.debug(
                                             f"[{client_id}] Current state of channel {channel_id}: {current_state}"
                                         )
@@ -449,12 +449,12 @@ def stream_ts(request, channel_id):
                 )
 
                 if url_bytes:
-                    url = url_bytes.decode("utf-8")
+                    url = url_bytes
                 if ua_bytes:
-                    stream_user_agent = ua_bytes.decode("utf-8")
+                    stream_user_agent = ua_bytes
                 # Extract transcode setting from Redis
                 if profile_bytes:
-                    profile_str = profile_bytes.decode("utf-8")
+                    profile_str = profile_bytes
                     use_transcode = (
                         profile_str == PROXY_PROFILE_NAME or profile_str == "None"
                     )
@@ -490,7 +490,7 @@ def stream_ts(request, channel_id):
         # Register client
         buffer = proxy_server.stream_buffers[channel_id]
         client_manager = proxy_server.client_managers[channel_id]
-        client_manager.add_client(client_id, client_ip, client_user_agent)
+        client_manager.add_client(client_id, client_ip, client_user_agent, user)
         logger.info(f"[{client_id}] Client registered with channel {channel_id}")
 
         # Create a stream generator for this client
@@ -553,7 +553,7 @@ def stream_xc(request, username, password, channel_id):
         channel = get_object_or_404(Channel, id=channel_id)
 
     # @TODO: we've got the  file 'type' via extension, support this when we support multiple outputs
-    return stream_ts(request._request, str(channel.uuid))
+    return stream_ts(request._request, str(channel.uuid), user)
 
 
 @csrf_exempt
@@ -681,7 +681,7 @@ def channel_status(request, channel_id=None):
                 )
                 for key in keys:
                     channel_id_match = re.search(
-                        r"ts_proxy:channel:(.*):metadata", key.decode("utf-8")
+                        r"ts_proxy:channel:(.*):metadata", key
                     )
                     if channel_id_match:
                         ch_id = channel_id_match.group(1)
@@ -802,7 +802,7 @@ def next_stream(request, channel_id):
                     metadata_key, ChannelMetadataField.STREAM_ID
                 )
                 if stream_id_bytes:
-                    current_stream_id = int(stream_id_bytes.decode("utf-8"))
+                    current_stream_id = int(stream_id_bytes)
                     logger.info(
                         f"Found current stream ID {current_stream_id} in Redis for channel {channel_id}"
                     )
@@ -812,7 +812,7 @@ def next_stream(request, channel_id):
                         metadata_key, ChannelMetadataField.M3U_PROFILE
                     )
                     if profile_id_bytes:
-                        profile_id = int(profile_id_bytes.decode("utf-8"))
+                        profile_id = int(profile_id_bytes)
                         logger.info(
                             f"Found M3U profile ID {profile_id} in Redis for channel {channel_id}"
                         )
diff --git a/docker/init/02-postgres.sh b/docker/init/02-postgres.sh
index e36dd744..233a5fb8 100644
--- a/docker/init/02-postgres.sh
+++ b/docker/init/02-postgres.sh
@@ -162,5 +162,3 @@ ensure_utf8_encoding() {
         echo "Database $POSTGRES_DB converted to UTF8 and permissions set."
     fi
 }
-
-
diff --git a/docker/init/03-init-dispatcharr.sh b/docker/init/03-init-dispatcharr.sh
index 5fbef23d..bfe081e2 100644
--- a/docker/init/03-init-dispatcharr.sh
+++ b/docker/init/03-init-dispatcharr.sh
@@ -64,4 +64,4 @@ if [ "$(id -u)" = "0" ]; then
     fi
 
     chmod +x /data
-fi
\ No newline at end of file
+fi
diff --git a/docker/init/99-init-dev.sh b/docker/init/99-init-dev.sh
index 861c8307..fc8ef18a 100644
--- a/docker/init/99-init-dev.sh
+++ b/docker/init/99-init-dev.sh
@@ -1,25 +1,33 @@
 #!/bin/bash
 
-echo "🚀 Development Mode - Setting up Frontend..."
+if [ ! -e "/tmp/init" ]; then
+    echo "🚀 Development Mode - Setting up Frontend..."
 
-# Install Node.js
-if ! command -v node 2>&1 >/dev/null
-then
-    echo "=== setting up nodejs ==="
-    curl -sL https://deb.nodesource.com/setup_23.x -o /tmp/nodesource_setup.sh
-    bash /tmp/nodesource_setup.sh
-    apt-get update
-    apt-get install -y --no-install-recommends \
-        nodejs
-fi
-
-# Install frontend dependencies
-cd /app/frontend && npm install
-# Install pip dependencies
-cd /app && pip install -r requirements.txt
-
-# Install debugpy for remote debugging
-if [ "$DISPATCHARR_DEBUG" = "true" ]; then
-    echo "=== setting up debugpy ==="
-    pip install debugpy
+    # Install Node.js
+    if ! command -v node 2>&1 >/dev/null
+    then
+        echo "=== setting up nodejs ==="
+        curl -sL https://deb.nodesource.com/setup_23.x -o /tmp/nodesource_setup.sh
+        bash /tmp/nodesource_setup.sh
+        apt-get update
+        apt-get install -y --no-install-recommends \
+            nodejs
+    fi
+
+    # Install frontend dependencies
+    cd /app/frontend && npm install
+    # Install pip dependencies
+    cd /app && pip install -r requirements.txt
+
+    # Install debugpy for remote debugging
+    if [ "$DISPATCHARR_DEBUG" = "true" ]; then
+        echo "=== setting up debugpy ==="
+        pip install debugpy
+    fi
+
+    if [[ "$DISPATCHARR_ENV" = "dev" ]]; then
+        touch /tmp/init
+    fi
+else
+    echo "Development mode initialization already done. Skipping dev setup."
 fi
diff --git a/docker/uwsgi.dev.ini b/docker/uwsgi.dev.ini
index e476e216..e6d0806d 100644
--- a/docker/uwsgi.dev.ini
+++ b/docker/uwsgi.dev.ini
@@ -8,7 +8,7 @@
 exec-pre = python /app/scripts/wait_for_redis.py
 
 ; Start Redis first
-attach-daemon = redis-server
+attach-daemon = redis-server --protected-mode no
 ; Then start other services with configurable nice level (default: 5 for low priority)
 ; Users can override via CELERY_NICE_LEVEL environment variable in docker-compose
 attach-daemon = nice -n $(CELERY_NICE_LEVEL) celery -A dispatcharr worker --autoscale=6,1
@@ -59,4 +59,4 @@ logformat-strftime = true
 log-date = %%Y-%%m-%%d %%H:%%M:%%S,000
 # Use formatted time with environment variable for log level
 log-format = %(ftime) $(DISPATCHARR_LOG_LEVEL) uwsgi.requests Worker ID: %(wid) %(method) %(status) %(uri) %(msecs)ms
-log-buffering = 1024  # Add buffer size limit for logging
\ No newline at end of file
+log-buffering = 1024  # Add buffer size limit for logging
diff --git a/frontend/prettier.config.js b/frontend/prettier.config.js
index d2b86878..e143dfef 100644
--- a/frontend/prettier.config.js
+++ b/frontend/prettier.config.js
@@ -3,8 +3,8 @@ export default {
   semi: true, // Add semicolons at the end of statements
   singleQuote: true, // Use single quotes instead of double
   tabWidth: 2, // Set the indentation width
-  trailingComma: "es5", // Add trailing commas where valid in ES5
+  trailingComma: 'es5', // Add trailing commas where valid in ES5
   printWidth: 80, // Wrap lines at 80 characters
   bracketSpacing: true, // Add spaces inside object braces
-  arrowParens: "always", // Always include parentheses around arrow function parameters
+  arrowParens: 'always', // Always include parentheses around arrow function parameters
 };
diff --git a/frontend/src/components/forms/User.jsx b/frontend/src/components/forms/User.jsx
index 619b156f..6ec8705e 100644
--- a/frontend/src/components/forms/User.jsx
+++ b/frontend/src/components/forms/User.jsx
@@ -12,8 +12,9 @@ import {
   Stack,
   MultiSelect,
   ActionIcon,
+  NumberInput,
 } from '@mantine/core';
-import { RotateCcwKey, X } from 'lucide-react';
+import { RotateCcwKey } from 'lucide-react';
 import { useForm } from '@mantine/form';
 import useChannelsStore from '../../store/channels';
 import { USER_LEVELS, USER_LEVEL_LABELS } from '../../constants';
@@ -209,26 +210,23 @@ const User = ({ user = null, isOpen, onClose }) => {
               key={form.key('last_name')}
             />
 
-            <Group align="flex-end">
-              <TextInput
-                label="XC Password"
-                description="Clear to disable XC API"
-                {...form.getInputProps('xc_password')}
-                key={form.key('xc_password')}
-                style={{ flex: 1 }}
-                rightSectionWidth={30}
-                rightSection={
-                  <ActionIcon
-                    variant="transparent"
-                    size="sm"
-                    color="white"
-                    onClick={generateXCPassword}
-                  >
-                    <RotateCcwKey />
-                  </ActionIcon>
-                }
-              />
-            </Group>
+            <TextInput
+              label="XC Password"
+              description="Clear to disable XC API"
+              {...form.getInputProps('xc_password')}
+              key={form.key('xc_password')}
+              rightSectionWidth={30}
+              rightSection={
+                <ActionIcon
+                  variant="transparent"
+                  size="sm"
+                  color="white"
+                  onClick={generateXCPassword}
+                >
+                  <RotateCcwKey />
+                </ActionIcon>
+              }
+            />
 
             {showPermissions && (
               <MultiSelect
diff --git a/frontend/src/pages/Users.jsx b/frontend/src/pages/Users.jsx
index 570e49c1..92583a8e 100644
--- a/frontend/src/pages/Users.jsx
+++ b/frontend/src/pages/Users.jsx
@@ -2,49 +2,14 @@ import React, { useState } from 'react';
 import UsersTable from '../components/tables/UsersTable';
 import { Box } from '@mantine/core';
 import useAuthStore from '../store/auth';
-import { USER_LEVELS } from '../constants';
 
 const UsersPage = () => {
   const authUser = useAuthStore((s) => s.user);
 
-  const [selectedUser, setSelectedUser] = useState(null);
-  const [userModalOpen, setUserModalOpen] = useState(false);
-  const [confirmDeleteOpen, setConfirmDeleteOpen] = useState(false);
-  const [deleteTarget, setDeleteTarget] = useState(null);
-  const [userToDelete, setUserToDelete] = useState(null);
-
   if (!authUser.id) {
     return <></>;
   }
 
-  const closeUserModal = () => {
-    setSelectedUser(null);
-    setUserModalOpen(false);
-  };
-  const editUser = (user) => {
-    setSelectedUser(user);
-    setUserModalOpen(true);
-  };
-
-  const deleteUser = (id) => {
-    // Get user details for the confirmation dialog
-    const user = users.find((u) => u.id === id);
-    setUserToDelete(user);
-    setDeleteTarget(id);
-
-    // Skip warning if it's been suppressed
-    if (isWarningSuppressed('delete-user')) {
-      return executeDeleteUser(id);
-    }
-
-    setConfirmDeleteOpen(true);
-  };
-
-  const executeDeleteUser = async (id) => {
-    await API.deleteUser(id);
-    setConfirmDeleteOpen(false);
-  };
-
   return (
     <Box style={{ padding: 10 }}>
       <UsersTable />

From 1dd368278ca733b9976b4a01a02df438c6d10eeb Mon Sep 17 00:00:00 2001
From: dekzter <kappa118@gmail.com>
Date: Fri, 13 Mar 2026 09:57:22 -0400
Subject: [PATCH 06/67] reverted value checking for consistency, added in user
 id to client info

---
 .../migrations/0004_user_stream_priority.py   | 18 -----
 apps/proxy/ts_proxy/channel_status.py         | 70 +++++++++++++++----
 apps/proxy/ts_proxy/client_manager.py         |  3 +-
 apps/proxy/ts_proxy/server.py                 |  7 +-
 4 files changed, 59 insertions(+), 39 deletions(-)
 delete mode 100644 apps/accounts/migrations/0004_user_stream_priority.py

diff --git a/apps/accounts/migrations/0004_user_stream_priority.py b/apps/accounts/migrations/0004_user_stream_priority.py
deleted file mode 100644
index 35c8bbae..00000000
--- a/apps/accounts/migrations/0004_user_stream_priority.py
+++ /dev/null
@@ -1,18 +0,0 @@
-# Generated by Django 5.2.4 on 2025-10-21 19:32
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('accounts', '0003_alter_user_custom_properties'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='user',
-            name='stream_priority',
-            field=models.IntegerField(default=0, help_text='Priority level for streaming tasks. Lower values indicate higher priority.'),
-        ),
-    ]
diff --git a/apps/proxy/ts_proxy/channel_status.py b/apps/proxy/ts_proxy/channel_status.py
index 4ac8f63f..ffb6be2c 100644
--- a/apps/proxy/ts_proxy/channel_status.py
+++ b/apps/proxy/ts_proxy/channel_status.py
@@ -265,22 +265,64 @@ class ChannelStatus:
             }
 
         # Add FFmpeg stream information
-        info['video_codec'] = metadata.get(ChannelMetadataField.VIDEO_CODEC)
-        info['resolution'] = metadata.get(ChannelMetadataField.RESOLUTION)
-        info['source_fps'] = metadata.get(ChannelMetadataField.SOURCE_FPS)
-        info['pixel_format'] = metadata.get(ChannelMetadataField.PIXEL_FORMAT)
-        info['source_bitrate'] = metadata.get(ChannelMetadataField.SOURCE_BITRATE)
-        info['audio_codec'] = metadata.get(ChannelMetadataField.AUDIO_CODEC)
-        info['sample_rate'] = metadata.get(ChannelMetadataField.SAMPLE_RATE)
-        info['audio_channels'] = metadata.get(ChannelMetadataField.AUDIO_CHANNELS)
-        info['audio_bitrate'] = metadata.get(ChannelMetadataField.AUDIO_BITRATE)
+        video_codec = metadata.get(ChannelMetadataField.VIDEO_CODEC)
+        if video_codec:
+            info['video_codec'] = video_codec
+
+        resolution = metadata.get(ChannelMetadataField.RESOLUTION)
+        if resolution:
+            info['resolution'] = resolution
+
+        source_fps = metadata.get(ChannelMetadataField.SOURCE_FPS)
+        if source_fps:
+            info['source_fps'] = source_fps
+
+        pixel_format = metadata.get(ChannelMetadataField.PIXEL_FORMAT)
+        if pixel_format:
+            info['pixel_format'] = pixel_format
+
+        source_bitrate = metadata.get(ChannelMetadataField.SOURCE_BITRATE)
+        if source_bitrate:
+            info['source_bitrate'] = source_bitrate
+
+        audio_codec = metadata.get(ChannelMetadataField.AUDIO_CODEC)
+        if audio_codec:
+            info['audio_codec'] = audio_codec
+
+        sample_rate = metadata.get(ChannelMetadataField.SAMPLE_RATE)
+        if sample_rate:
+            info['sample_rate'] = sample_rate
+
+        audio_channels = metadata.get(ChannelMetadataField.AUDIO_CHANNELS)
+        if audio_channels:
+            info['audio_channels'] = audio_channels
+
+        audio_bitrate = metadata.get(ChannelMetadataField.AUDIO_BITRATE)
+        if audio_bitrate:
+            info['audio_bitrate'] = audio_bitrate
+
 
         # Add FFmpeg performance stats
-        info['ffmpeg_speed'] = metadata.get(ChannelMetadataField.FFMPEG_SPEED)
-        info['ffmpeg_fps'] = metadata.get(ChannelMetadataField.FFMPEG_FPS)
-        info['actual_fps'] = metadata.get(ChannelMetadataField.ACTUAL_FPS)
-        info['ffmpeg_bitrate'] = metadata.get(ChannelMetadataField.FFMPEG_BITRATE)
-        info['stream_type'] = metadata.get(ChannelMetadataField.STREAM_TYPE)
+        ffmpeg_speed = metadata.get(ChannelMetadataField.FFMPEG_SPEED)
+        if ffmpeg_speed:
+            info['ffmpeg_speed'] = ffmpeg_speed
+
+        ffmpeg_fps = metadata.get(ChannelMetadataField.FFMPEG_FPS)
+        if ffmpeg_fps:
+            info['ffmpeg_fps'] = ffmpeg_fps
+
+        actual_fps = metadata.get(ChannelMetadataField.ACTUAL_FPS)
+        if actual_fps:
+            info['actual_fps'] = actual_fps
+
+        ffmpeg_bitrate = metadata.get(ChannelMetadataField.FFMPEG_BITRATE)
+        if ffmpeg_bitrate:
+            info['ffmpeg_bitrate'] = ffmpeg_bitrate
+
+        stream_type = metadata.get(ChannelMetadataField.STREAM_TYPE)
+        if stream_type:
+            info['stream_type'] = stream_type
+
 
         return info
 
diff --git a/apps/proxy/ts_proxy/client_manager.py b/apps/proxy/ts_proxy/client_manager.py
index 394ad5ea..c0e5ab0b 100644
--- a/apps/proxy/ts_proxy/client_manager.py
+++ b/apps/proxy/ts_proxy/client_manager.py
@@ -247,7 +247,8 @@ class ClientManager:
             "connected_at": current_time,
             "last_active": current_time,
             "worker_id": self.worker_id or "unknown",
-            "user_level": user.user_level if user is not None else 100, # default to a high value since no user means the non-user specific M3U/HDHR
+            "user_id": str(user.id) if user is not None else "unknown",
+            # "user_level": user.user_level if user is not None else 100, # default to a high value since no user means the non-user specific M3U/HDHR
         }
 
         try:
diff --git a/apps/proxy/ts_proxy/server.py b/apps/proxy/ts_proxy/server.py
index 1999b491..4c51768a 100644
--- a/apps/proxy/ts_proxy/server.py
+++ b/apps/proxy/ts_proxy/server.py
@@ -459,10 +459,6 @@ class ProxyServer:
             lock_key = RedisKeys.channel_owner(channel_id)
             current = self.redis_client.get(lock_key)
 
-<<<<<<< HEAD
-            # Only extend if we're still the owner
-            if current and current == self.worker_id:
-=======
             if current is None:
                 # Key expired — re-acquire if we have the stream_manager
                 if channel_id in self.stream_managers:
@@ -476,8 +472,7 @@ class ProxyServer:
                         return False
                 return False
 
-            if current.decode('utf-8') == self.worker_id:
->>>>>>> origin/dev
+            if current == self.worker_id:
                 self.redis_client.expire(lock_key, ttl)
                 return True
 

From 1f97143bf892905579e655526f55c6ad16ac4380 Mon Sep 17 00:00:00 2001
From: None <190783071+CodeBormen@users.noreply.github.com>
Date: Sun, 15 Mar 2026 00:59:58 -0500
Subject: [PATCH 07/67] fix: resolve HTML named entities in XMLTV files before
 parsing

lxml 6.0.2 with recover=True silently drops HTML named entities (e.g. &eacute;, &icirc;) that are not valid XML, causing channel names and program data to lose characters during EPG ingestion.

- Add preprocessing step in fetch_xmltv() that converts HTML named entities to Unicode while preserving XML-predefined entities
- Detect encoding from XML declaration, fall back to UTF-8 for unknown codecs, skip files that fail to decode cleanly
- Guard against entities resolving to XML-special characters and html.unescape partial matching edge cases
- Add 28 unit tests covering entity resolution, encoding detection, and file-level processing
---
 apps/epg/tasks.py                        |  89 +++++++++++
 apps/epg/tests/test_entity_resolution.py | 195 +++++++++++++++++++++++
 2 files changed, 284 insertions(+)
 create mode 100644 apps/epg/tests/test_entity_resolution.py

diff --git a/apps/epg/tasks.py b/apps/epg/tasks.py
index f4c85256..5d567e6e 100644
--- a/apps/epg/tasks.py
+++ b/apps/epg/tasks.py
@@ -1,8 +1,11 @@
 # apps/epg/tasks.py
 
+import codecs
 import logging
 import gzip
+import html as html_module
 import os
+import re
 import uuid
 import requests
 import time  # Add import for tracking download progress
@@ -28,6 +31,85 @@ from core.utils import acquire_task_lock, release_task_lock, TaskLockRenewer, se
 
 logger = logging.getLogger(__name__)
 
+# Regex and helpers for resolving HTML named entities in XMLTV files.
+# lxml only recognises the 5 XML-predefined entities; HTML entities like
+# &eacute; are silently dropped in recovery mode.  This substitution
+# converts them to Unicode before the file reaches the parser.
+_XML_ENTITIES = frozenset({'amp', 'lt', 'gt', 'quot', 'apos'})
+_XML_SPECIAL_CHARS = frozenset('&<>\'"')
+_NAMED_ENTITY_RE = re.compile(r'&([a-zA-Z][a-zA-Z0-9]*);')
+
+
+def _replace_html_entity(match):
+    """Replace a single HTML named entity, preserving XML-special ones.
+
+    Skips lowercase XML entities (fast path) and any entity whose resolved
+    output contains XML-special characters that would break parsing.  This
+    also guards against html.unescape partially matching sub-patterns
+    (e.g. &ampersand; being split into &amp + ersand;).
+    """
+    original = match.group(0)
+    name = match.group(1)
+    if name in _XML_ENTITIES:
+        return original
+    resolved = html_module.unescape(original)
+    if resolved == original:
+        return original
+    # If the resolved output contains any XML-special character, replacing
+    # it would produce invalid XML (bare &, <, >, etc.)
+    if _XML_SPECIAL_CHARS.intersection(resolved):
+        return original
+    return resolved
+
+
+def _detect_xml_encoding(header):
+    """Detect encoding from raw XML header bytes, defaulting to UTF-8.
+
+    Falls back to UTF-8 if the declared encoding is not recognized by Python.
+    """
+    m = re.match(rb'<\?xml[^>]*encoding=["\']([^"\']+)["\']', header)
+    if m:
+        declared = m.group(1).decode('ascii')
+        try:
+            codecs.lookup(declared)
+            return declared
+        except LookupError:
+            logger.warning(f"Unknown encoding '{declared}', falling back to UTF-8")
+            return 'utf-8'
+    return 'utf-8'
+
+
+def _resolve_html_entities(file_path):
+    """Replace HTML named entities in an XMLTV file with Unicode characters.
+
+    Processes line-by-line to keep memory usage low, writes to a temp file,
+    then atomically replaces the original.  Honors the encoding declared
+    in the XML declaration.  If the file cannot be decoded cleanly it is
+    left untouched for lxml to handle with its own recovery mode.
+    """
+    # Read the first 200 bytes to detect encoding from the XML declaration
+    with open(file_path, 'rb') as f:
+        header = f.read(200)
+    encoding = _detect_xml_encoding(header)
+
+    temp_path = file_path + '.entity_tmp'
+    success = False
+    try:
+        with open(file_path, 'r', encoding=encoding) as src, \
+             open(temp_path, 'w', encoding=encoding) as dst:
+            for line in src:
+                dst.write(_NAMED_ENTITY_RE.sub(_replace_html_entity, line))
+        os.replace(temp_path, file_path)
+        success = True
+        logger.debug(f"Resolved HTML entities in {file_path} (encoding: {encoding})")
+    except (UnicodeDecodeError, UnicodeEncodeError):
+        # Leave the file untouched for lxml to handle with its own
+        # encoding detection and recovery mode.
+        logger.debug(f"Skipping entity resolution for {file_path}: encoding error with {encoding}")
+    finally:
+        if not success and os.path.exists(temp_path):
+            os.unlink(temp_path)
+
 
 def validate_icon_url_fast(icon_url, max_length=None):
     """
@@ -280,6 +362,9 @@ def fetch_xmltv(source):
         # Send a download complete notification
         send_epg_update(source.id, "downloading", 100, status="success")
 
+        # Resolve HTML named entities so lxml doesn't drop them during parsing
+        _resolve_html_entities(source.extracted_file_path or source.file_path)
+
         # Return True to indicate successful fetch, processing will continue with parse_channels_only
         return True
 
@@ -526,6 +611,10 @@ def fetch_xmltv(source):
             source.save(update_fields=['status'])
 
             logger.info(f"Cached EPG file saved to {source.file_path}")
+
+            # Resolve HTML named entities so lxml doesn't drop them during parsing
+            _resolve_html_entities(source.extracted_file_path or source.file_path)
+
             return True
 
     except requests.exceptions.HTTPError as e:
diff --git a/apps/epg/tests/test_entity_resolution.py b/apps/epg/tests/test_entity_resolution.py
new file mode 100644
index 00000000..353d9b51
--- /dev/null
+++ b/apps/epg/tests/test_entity_resolution.py
@@ -0,0 +1,195 @@
+import os
+import tempfile
+
+from django.test import TestCase
+
+from apps.epg.tasks import (
+    _NAMED_ENTITY_RE,
+    _detect_xml_encoding,
+    _replace_html_entity,
+    _resolve_html_entities,
+)
+
+
+class ReplaceHtmlEntityTests(TestCase):
+    """Tests for the regex callback that resolves individual HTML entities."""
+
+    def _sub(self, text):
+        return _NAMED_ENTITY_RE.sub(_replace_html_entity, text)
+
+    def test_french_accented(self):
+        self.assertEqual(self._sub("Cha&icirc;ne T&eacute;l&eacute;"), "Chaîne Télé")
+
+    def test_german_umlauts(self):
+        self.assertEqual(self._sub("M&uuml;nchen &Uuml;bersicht &szlig;"), "München Übersicht ß")
+
+    def test_spanish(self):
+        self.assertEqual(self._sub("Espa&ntilde;a &iquest;Qu&eacute;?"), "España ¿Qué?")
+
+    def test_portuguese(self):
+        self.assertEqual(self._sub("Comunica&ccedil;&atilde;o"), "Comunicação")
+
+    def test_scandinavian(self):
+        self.assertEqual(self._sub("Norsk &oslash; &aring; &aelig;"), "Norsk ø å æ")
+
+    def test_greek_letters(self):
+        self.assertEqual(self._sub("&alpha;&beta;&gamma;"), "αβγ")
+
+    def test_currency_and_symbols(self):
+        self.assertEqual(self._sub("&copy; &euro; &pound; &yen;"), "© € £ ¥")
+
+    def test_preserves_xml_amp(self):
+        self.assertEqual(self._sub("A &amp; B"), "A &amp; B")
+
+    def test_preserves_xml_lt_gt(self):
+        self.assertEqual(self._sub("&lt;tag&gt;"), "&lt;tag&gt;")
+
+    def test_preserves_xml_quot_apos(self):
+        self.assertEqual(self._sub("&quot;hello&apos;"), "&quot;hello&apos;")
+
+    def test_preserves_uppercase_xml_entities(self):
+        """&AMP;, &LT;, &GT;, &QUOT; resolve to XML-special chars; must not be replaced."""
+        self.assertEqual(self._sub("&AMP;"), "&AMP;")
+        self.assertEqual(self._sub("&LT;"), "&LT;")
+        self.assertEqual(self._sub("&GT;"), "&GT;")
+        self.assertEqual(self._sub("&QUOT;"), "&QUOT;")
+
+    def test_partial_entity_match_preserved(self):
+        """html.unescape can partially match &amp inside &ampersand; — must not corrupt."""
+        self.assertEqual(self._sub("&ampersand;"), "&ampersand;")
+
+    def test_mixed_html_and_xml_entities(self):
+        self.assertEqual(
+            self._sub("R&eacute;sum&eacute; &amp; Co &lt;test&gt;"),
+            "Résumé &amp; Co &lt;test&gt;",
+        )
+
+    def test_plain_ascii_unchanged(self):
+        self.assertEqual(self._sub("Plain ASCII text"), "Plain ASCII text")
+
+    def test_direct_utf8_unchanged(self):
+        self.assertEqual(self._sub("日本語テレビ"), "日本語テレビ")
+
+    def test_unknown_entity_preserved(self):
+        self.assertEqual(self._sub("&zzfakeentity;"), "&zzfakeentity;")
+
+
+class ResolveHtmlEntitiesFileTests(TestCase):
+    """Tests for the file-level preprocessing function."""
+
+    def _make_file(self, content):
+        fd, path = tempfile.mkstemp(suffix=".xml")
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            f.write(content)
+        self.addCleanup(lambda: os.unlink(path) if os.path.exists(path) else None)
+        return path
+
+    def test_resolves_entities_in_file(self):
+        path = self._make_file(
+            '<?xml version="1.0"?>\n<tv><channel><display-name>T&eacute;l&eacute;</display-name></channel></tv>'
+        )
+        _resolve_html_entities(path)
+        with open(path, "r", encoding="utf-8") as f:
+            content = f.read()
+        self.assertIn("Télé", content)
+        self.assertNotIn("&eacute;", content)
+
+    def test_preserves_xml_entities_in_file(self):
+        path = self._make_file("<tv><desc>A &amp; B &lt;C&gt;</desc></tv>")
+        _resolve_html_entities(path)
+        with open(path, "r", encoding="utf-8") as f:
+            content = f.read()
+        self.assertIn("&amp;", content)
+        self.assertIn("&lt;", content)
+        self.assertIn("&gt;", content)
+
+    def test_no_temp_file_left_on_success(self):
+        path = self._make_file("<tv>test</tv>")
+        _resolve_html_entities(path)
+        self.assertFalse(os.path.exists(path + ".entity_tmp"))
+
+    def test_plain_file_unchanged(self):
+        original = '<?xml version="1.0"?>\n<tv><channel><display-name>Plain</display-name></channel></tv>'
+        path = self._make_file(original)
+        _resolve_html_entities(path)
+        with open(path, "r", encoding="utf-8") as f:
+            content = f.read()
+        self.assertEqual(content, original)
+
+    def test_utf8_content_preserved(self):
+        original = "<tv><channel><display-name>日本語テレビ</display-name></channel></tv>"
+        path = self._make_file(original)
+        _resolve_html_entities(path)
+        with open(path, "r", encoding="utf-8") as f:
+            content = f.read()
+        self.assertIn("日本語テレビ", content)
+
+    def test_iso_8859_1_encoding(self):
+        """Files declaring ISO-8859-1 should be read in that encoding."""
+        xml = '<?xml version="1.0" encoding="ISO-8859-1"?>\n<tv><channel><display-name>Cha&icirc;ne</display-name></channel></tv>'
+        fd, path = tempfile.mkstemp(suffix=".xml")
+        with os.fdopen(fd, "wb") as f:
+            f.write(xml.encode("iso-8859-1"))
+        self.addCleanup(lambda: os.unlink(path) if os.path.exists(path) else None)
+
+        _resolve_html_entities(path)
+        with open(path, "r", encoding="iso-8859-1") as f:
+            content = f.read()
+        self.assertIn("Cha\u00eene", content)
+        self.assertNotIn("&icirc;", content)
+
+    def test_detect_encoding_utf8_default(self):
+        """Headers without an encoding declaration default to UTF-8."""
+        self.assertEqual(_detect_xml_encoding(b'<?xml version="1.0"?>'), "utf-8")
+
+    def test_detect_encoding_iso_8859_1(self):
+        """Encoding is read from the XML declaration."""
+        self.assertEqual(
+            _detect_xml_encoding(b'<?xml version="1.0" encoding="ISO-8859-1"?>'),
+            "ISO-8859-1",
+        )
+
+    def test_detect_encoding_single_quotes(self):
+        """Encoding detection works with single-quoted attributes."""
+        self.assertEqual(
+            _detect_xml_encoding(b"<?xml version='1.0' encoding='windows-1252'?>"),
+            "windows-1252",
+        )
+
+    def test_detect_encoding_unknown_falls_back(self):
+        """Unrecognized encoding falls back to UTF-8."""
+        self.assertEqual(
+            _detect_xml_encoding(b'<?xml version="1.0" encoding="x-fake-codec"?>'),
+            "utf-8",
+        )
+
+    def test_iso_8859_1_with_entities_roundtrip(self):
+        """ISO-8859-1 file with entities: resolved without corrupting existing accented chars."""
+        # Mix of direct ISO-8859-1 chars and HTML entities
+        xml_str = '<?xml version="1.0" encoding="ISO-8859-1"?>\n<tv><channel><display-name>D\xe9j\xe0 &eacute;mission</display-name></channel></tv>'
+        fd, path = tempfile.mkstemp(suffix=".xml")
+        with os.fdopen(fd, "wb") as f:
+            f.write(xml_str.encode("iso-8859-1"))
+        self.addCleanup(lambda: os.unlink(path) if os.path.exists(path) else None)
+
+        _resolve_html_entities(path)
+        with open(path, "r", encoding="iso-8859-1") as f:
+            content = f.read()
+        self.assertIn("D\xe9j\xe0", content, "Existing accented chars should be preserved")
+        self.assertIn("\xe9mission", content, "Entity should be resolved")
+        self.assertNotIn("&eacute;", content)
+
+    def test_mismatched_encoding_leaves_file_untouched(self):
+        """File declaring UTF-8 but containing Latin-1 bytes is left alone."""
+        # \xe9 is valid ISO-8859-1 but invalid as a standalone UTF-8 byte
+        raw = b'<?xml version="1.0" encoding="UTF-8"?>\n<tv><channel><display-name>\xe9</display-name></channel></tv>'
+        fd, path = tempfile.mkstemp(suffix=".xml")
+        with os.fdopen(fd, "wb") as f:
+            f.write(raw)
+        self.addCleanup(lambda: os.unlink(path) if os.path.exists(path) else None)
+
+        original_bytes = raw  # save for comparison
+        _resolve_html_entities(path)
+        with open(path, "rb") as f:
+            result_bytes = f.read()
+        self.assertEqual(result_bytes, original_bytes, "File should be untouched on decode error")

From 01a214851de1fffd76e829a8aff884d6e15dc5c3 Mon Sep 17 00:00:00 2001
From: None <190783071+CodeBormen@users.noreply.github.com>
Date: Sun, 15 Mar 2026 01:11:29 -0500
Subject: [PATCH 08/67] fix: catch all exceptions in entity resolution to avoid
 breaking EPG refresh

Previously only UnicodeDecodeError/UnicodeEncodeError were caught. Unexpected errors like disk full or permission denied would propagate
and crash the EPG refresh, which would have succeeded before the preprocessing step existed. Now all exceptions are caught and logged, leaving the original file untouched for lxml to handle as before.
---
 apps/epg/tasks.py | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/apps/epg/tasks.py b/apps/epg/tasks.py
index 5d567e6e..df1e0836 100644
--- a/apps/epg/tasks.py
+++ b/apps/epg/tasks.py
@@ -84,8 +84,10 @@ def _resolve_html_entities(file_path):
 
     Processes line-by-line to keep memory usage low, writes to a temp file,
     then atomically replaces the original.  Honors the encoding declared
-    in the XML declaration.  If the file cannot be decoded cleanly it is
-    left untouched for lxml to handle with its own recovery mode.
+    in the XML declaration.
+
+    This function is strictly additive — on any error the original file is
+    left untouched so lxml can handle it as it always did.
     """
     # Read the first 200 bytes to detect encoding from the XML declaration
     with open(file_path, 'rb') as f:
@@ -102,10 +104,12 @@ def _resolve_html_entities(file_path):
         os.replace(temp_path, file_path)
         success = True
         logger.debug(f"Resolved HTML entities in {file_path} (encoding: {encoding})")
-    except (UnicodeDecodeError, UnicodeEncodeError):
-        # Leave the file untouched for lxml to handle with its own
-        # encoding detection and recovery mode.
-        logger.debug(f"Skipping entity resolution for {file_path}: encoding error with {encoding}")
+    except Exception as e:
+        # On any error, leave the original file untouched for lxml to
+        # handle with its own encoding detection and recovery mode.
+        # This ensures the preprocessing step never breaks a previously
+        # working EPG refresh.
+        logger.debug(f"Skipping entity resolution for {file_path}: {e}")
     finally:
         if not success and os.path.exists(temp_path):
             os.unlink(temp_path)

From 99a328ca171e864f1b0b9d301b82cbcf77716a08 Mon Sep 17 00:00:00 2001
From: dekzter <kappa118@gmail.com>
Date: Thu, 19 Mar 2026 12:45:01 -0400
Subject: [PATCH 09/67] fixed bug when filtering after category was selected

---
 apps/vod/api_views.py | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/apps/vod/api_views.py b/apps/vod/api_views.py
index 3bd984e6..8b778c81 100644
--- a/apps/vod/api_views.py
+++ b/apps/vod/api_views.py
@@ -578,13 +578,15 @@ class UnifiedContentViewSet(viewsets.ReadOnlyModelViewSet):
                 "series.id IN (SELECT DISTINCT series_id FROM vod_m3useriesrelation msr JOIN m3u_m3uaccount ma ON msr.m3u_account_id = ma.id WHERE ma.is_active = true)"
             ]
 
-            params = []
+            movie_params = []
+            series_params = []
 
             if search:
                 where_conditions[0] += " AND LOWER(movies.name) LIKE %s"
                 where_conditions[1] += " AND LOWER(series.name) LIKE %s"
                 search_param = f"%{search.lower()}%"
-                params.extend([search_param, search_param])
+                movie_params.append(search_param)
+                series_params.append(search_param)
 
             if category:
                 if '|' in category:
@@ -592,15 +594,20 @@ class UnifiedContentViewSet(viewsets.ReadOnlyModelViewSet):
                     if cat_type == 'movie':
                         where_conditions[0] += " AND movies.id IN (SELECT movie_id FROM vod_m3umovierelation mmr JOIN vod_vodcategory c ON mmr.category_id = c.id WHERE c.name = %s)"
                         where_conditions[1] = "1=0"  # Exclude series
-                        params.append(cat_name)
+                        movie_params.append(cat_name)
+                        series_params = []  # no params needed for "1=0"
                     elif cat_type == 'series':
                         where_conditions[1] += " AND series.id IN (SELECT series_id FROM vod_m3useriesrelation msr JOIN vod_vodcategory c ON msr.category_id = c.id WHERE c.name = %s)"
                         where_conditions[0] = "1=0"  # Exclude movies
-                        params.append(cat_name)
+                        series_params.append(cat_name)
+                        movie_params = []  # no params needed for "1=0"
                 else:
                     where_conditions[0] += " AND movies.id IN (SELECT movie_id FROM vod_m3umovierelation mmr JOIN vod_vodcategory c ON mmr.category_id = c.id WHERE c.name = %s)"
                     where_conditions[1] += " AND series.id IN (SELECT series_id FROM vod_m3useriesrelation msr JOIN vod_vodcategory c ON msr.category_id = c.id WHERE c.name = %s)"
-                    params.extend([category, category])
+                    movie_params.append(category)
+                    series_params.append(category)
+
+            params = movie_params + series_params
 
             # Use UNION ALL with ORDER BY and LIMIT/OFFSET for true unified pagination
             # This is much more efficient than Python sorting

From ba0036445c102a41dbd92add1bb1eeac6ed79549 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 20 Mar 2026 10:23:52 -0500
Subject: [PATCH 10/67] Enhancement: Status filter for M3U group and VOD
 category filter modals: A new **All / Enabled / Disabled** segmented control
 is now shown alongside the text search input in the Live, VOD - Movies, and
 VOD - Series tabs of the M3U Group Filter modal. The status filter works in
 combination with the text search and also scopes the "Select Visible" /
 "Deselect Visible" buttons so they only act on the currently visible subset.
 (Closes #312)

---
 CHANGELOG.md                                  |  4 ++
 .../src/components/forms/LiveGroupFilter.jsx  | 37 ++++++++++++++-----
 .../components/forms/VODCategoryFilter.jsx    | 37 ++++++++++++++-----
 3 files changed, 58 insertions(+), 20 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 71b8b8c1..e01acf2a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Status filter for M3U group and VOD category filter modals: A new **All / Enabled / Disabled** segmented control is now shown alongside the text search input in the Live, VOD - Movies, and VOD - Series tabs of the M3U Group Filter modal. The status filter works in combination with the text search and also scopes the "Select Visible" / "Deselect Visible" buttons so they only act on the currently visible subset. (Closes #312)
+
 ## [0.21.1] - 2026-03-18
 
 ### Fixed
diff --git a/frontend/src/components/forms/LiveGroupFilter.jsx b/frontend/src/components/forms/LiveGroupFilter.jsx
index b06024e4..09d073f5 100644
--- a/frontend/src/components/forms/LiveGroupFilter.jsx
+++ b/frontend/src/components/forms/LiveGroupFilter.jsx
@@ -19,6 +19,7 @@ import {
   Popover,
   ScrollArea,
   Center,
+  SegmentedControl,
 } from '@mantine/core';
 import { Info } from 'lucide-react';
 import useChannelsStore from '../../store/channels';
@@ -54,6 +55,7 @@ const LiveGroupFilter = ({
   const streamProfiles = useStreamProfilesStore((s) => s.profiles);
   const fetchStreamProfiles = useStreamProfilesStore((s) => s.fetchProfiles);
   const [groupFilter, setGroupFilter] = useState('');
+  const [statusFilter, setStatusFilter] = useState('all');
   const [epgSources, setEpgSources] = useState([]);
 
   // Logo selection functionality
@@ -177,13 +179,22 @@ const LiveGroupFilter = ({
     setCurrentEditingGroupId(null);
   };
 
+  const isVisible = (group) => {
+    const matchesText = group.name
+      .toLowerCase()
+      .includes(groupFilter.toLowerCase());
+    const matchesStatus =
+      statusFilter === 'all' ||
+      (statusFilter === 'enabled' && group.enabled) ||
+      (statusFilter === 'disabled' && !group.enabled);
+    return matchesText && matchesStatus;
+  };
+
   const selectAll = () => {
     setGroupStates(
       groupStates.map((state) => ({
         ...state,
-        enabled: state.name.toLowerCase().includes(groupFilter.toLowerCase())
-          ? true
-          : state.enabled,
+        enabled: isVisible(state) ? true : state.enabled,
       }))
     );
   };
@@ -192,9 +203,7 @@ const LiveGroupFilter = ({
     setGroupStates(
       groupStates.map((state) => ({
         ...state,
-        enabled: state.name.toLowerCase().includes(groupFilter.toLowerCase())
-          ? false
-          : state.enabled,
+        enabled: isVisible(state) ? false : state.enabled,
       }))
     );
   };
@@ -220,7 +229,7 @@ const LiveGroupFilter = ({
         description="When disabled, new groups from the M3U source will be created but disabled by default. You can enable them manually later."
       />
 
-      <Flex gap="sm">
+      <Flex gap="sm" align="center">
         <TextInput
           placeholder="Filter groups..."
           value={groupFilter}
@@ -228,6 +237,16 @@ const LiveGroupFilter = ({
           style={{ flex: 1 }}
           size="xs"
         />
+        <SegmentedControl
+          value={statusFilter}
+          onChange={setStatusFilter}
+          size="xs"
+          data={[
+            { label: 'All', value: 'all' },
+            { label: 'Enabled', value: 'enabled' },
+            { label: 'Disabled', value: 'disabled' },
+          ]}
+        />
         <Button variant="default" size="xs" onClick={selectAll}>
           Select Visible
         </Button>
@@ -245,9 +264,7 @@ const LiveGroupFilter = ({
           verticalSpacing="xs"
         >
           {groupStates
-            .filter((group) =>
-              group.name.toLowerCase().includes(groupFilter.toLowerCase())
-            )
+            .filter((group) => isVisible(group))
             .sort((a, b) => a.name.localeCompare(b.name))
             .map((group) => (
               <Group
diff --git a/frontend/src/components/forms/VODCategoryFilter.jsx b/frontend/src/components/forms/VODCategoryFilter.jsx
index a6dccdd2..73932249 100644
--- a/frontend/src/components/forms/VODCategoryFilter.jsx
+++ b/frontend/src/components/forms/VODCategoryFilter.jsx
@@ -11,6 +11,7 @@ import {
   Divider,
   Box,
   Checkbox,
+  SegmentedControl,
 } from '@mantine/core';
 import { CircleCheck, CircleX } from 'lucide-react';
 import useVODStore from '../../store/useVODStore';
@@ -25,6 +26,7 @@ const VODCategoryFilter = ({
 }) => {
   const categories = useVODStore((s) => s.categories);
   const [filter, setFilter] = useState('');
+  const [statusFilter, setStatusFilter] = useState('all');
 
   useEffect(() => {
     if (Object.keys(categories).length === 0) {
@@ -64,13 +66,22 @@ const VODCategoryFilter = ({
     );
   };
 
+  const isVisible = (category) => {
+    const matchesText = category.name
+      .toLowerCase()
+      .includes(filter.toLowerCase());
+    const matchesStatus =
+      statusFilter === 'all' ||
+      (statusFilter === 'enabled' && category.enabled) ||
+      (statusFilter === 'disabled' && !category.enabled);
+    return matchesText && matchesStatus;
+  };
+
   const selectAll = () => {
     setCategoryStates(
       categoryStates.map((state) => ({
         ...state,
-        enabled: state.name.toLowerCase().includes(filter.toLowerCase())
-          ? true
-          : state.enabled,
+        enabled: isVisible(state) ? true : state.enabled,
       }))
     );
   };
@@ -79,9 +90,7 @@ const VODCategoryFilter = ({
     setCategoryStates(
       categoryStates.map((state) => ({
         ...state,
-        enabled: state.name.toLowerCase().includes(filter.toLowerCase())
-          ? false
-          : state.enabled,
+        enabled: isVisible(state) ? false : state.enabled,
       }))
     );
   };
@@ -98,7 +107,7 @@ const VODCategoryFilter = ({
         description="When disabled, new categories from the provider will be created but disabled by default. You can enable them manually later."
       />
 
-      <Flex gap="sm">
+      <Flex gap="sm" align="center">
         <TextInput
           placeholder="Filter categories..."
           value={filter}
@@ -106,6 +115,16 @@ const VODCategoryFilter = ({
           style={{ flex: 1 }}
           size="xs"
         />
+        <SegmentedControl
+          value={statusFilter}
+          onChange={setStatusFilter}
+          size="xs"
+          data={[
+            { label: 'All', value: 'all' },
+            { label: 'Enabled', value: 'enabled' },
+            { label: 'Disabled', value: 'disabled' },
+          ]}
+        />
         <Button variant="default" size="xs" onClick={selectAll}>
           Select Visible
         </Button>
@@ -121,9 +140,7 @@ const VODCategoryFilter = ({
           verticalSpacing="xs"
         >
           {categoryStates
-            .filter((category) => {
-              return category.name.toLowerCase().includes(filter.toLowerCase());
-            })
+            .filter((category) => isVisible(category))
             .sort((a, b) => a.name.localeCompare(b.name))
             .map((category) => (
               <Group

From 874f5fce6a6533c33ba350f4ba411c2986c61415 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 20 Mar 2026 11:37:51 -0500
Subject: [PATCH 11/67] Refactor: Removed unused imports from `M3UGroupFilter`,
 `LiveGroupFilter`, and `VODCategoryFilter` (`Yup`, `M3UProfiles`, several
 unused Mantine components, dead `OptionWithTooltip` component, duplicate
 lucide-react imports, and `Divider` in `VODCategoryFilter`). No behaviour
 changes.

---
 CHANGELOG.md                                  |  4 +++
 .../src/components/forms/LiveGroupFilter.jsx  |  3 +-
 .../src/components/forms/M3UGroupFilter.jsx   | 34 +------------------
 .../components/forms/VODCategoryFilter.jsx    |  1 -
 4 files changed, 6 insertions(+), 36 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e01acf2a..a2300474 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Status filter for M3U group and VOD category filter modals: A new **All / Enabled / Disabled** segmented control is now shown alongside the text search input in the Live, VOD - Movies, and VOD - Series tabs of the M3U Group Filter modal. The status filter works in combination with the text search and also scopes the "Select Visible" / "Deselect Visible" buttons so they only act on the currently visible subset. (Closes #312)
 
+### Changed
+
+- Frontend cleanup: removed unused imports from `M3UGroupFilter`, `LiveGroupFilter`, and `VODCategoryFilter` (`Yup`, `M3UProfiles`, several unused Mantine components, dead `OptionWithTooltip` component, duplicate lucide-react imports, and `Divider` in `VODCategoryFilter`). No behaviour changes.
+
 ## [0.21.1] - 2026-03-18
 
 ### Fixed
diff --git a/frontend/src/components/forms/LiveGroupFilter.jsx b/frontend/src/components/forms/LiveGroupFilter.jsx
index 09d073f5..4cfdaca6 100644
--- a/frontend/src/components/forms/LiveGroupFilter.jsx
+++ b/frontend/src/components/forms/LiveGroupFilter.jsx
@@ -21,10 +21,9 @@ import {
   Center,
   SegmentedControl,
 } from '@mantine/core';
-import { Info } from 'lucide-react';
+import { Info, CircleCheck, CircleX } from 'lucide-react';
 import useChannelsStore from '../../store/channels';
 import useStreamProfilesStore from '../../store/streamProfiles';
-import { CircleCheck, CircleX } from 'lucide-react';
 import { useChannelLogoSelection } from '../../hooks/useSmartLogos';
 import { FixedSizeList as List } from 'react-window';
 import LazyLogo from '../LazyLogo';
diff --git a/frontend/src/components/forms/M3UGroupFilter.jsx b/frontend/src/components/forms/M3UGroupFilter.jsx
index 0a7dc224..20713d4e 100644
--- a/frontend/src/components/forms/M3UGroupFilter.jsx
+++ b/frontend/src/components/forms/M3UGroupFilter.jsx
@@ -1,52 +1,20 @@
 // Modal.js
-import React, { useState, useEffect, forwardRef } from 'react';
-import * as Yup from 'yup';
+import React, { useState, useEffect } from 'react';
 import API from '../../api';
-import M3UProfiles from './M3UProfiles';
 import {
   LoadingOverlay,
-  TextInput,
   Button,
-  Checkbox,
   Modal,
   Flex,
-  NativeSelect,
-  FileInput,
-  Select,
-  Space,
-  Chip,
   Stack,
-  Group,
-  Center,
-  SimpleGrid,
-  Text,
-  NumberInput,
-  Divider,
-  Alert,
-  Box,
-  MultiSelect,
-  Tooltip,
   Tabs,
 } from '@mantine/core';
-import { Info } from 'lucide-react';
 import useChannelsStore from '../../store/channels';
 import useVODStore from '../../store/useVODStore';
-import { CircleCheck, CircleX } from 'lucide-react';
 import { notifications } from '@mantine/notifications';
 import LiveGroupFilter from './LiveGroupFilter';
 import VODCategoryFilter from './VODCategoryFilter';
 
-// Custom item component for MultiSelect with tooltip
-const OptionWithTooltip = forwardRef(
-  ({ label, description, ...others }, ref) => (
-    <Tooltip label={description} withArrow>
-      <div ref={ref} {...others}>
-        {label}
-      </div>
-    </Tooltip>
-  )
-);
-
 const M3UGroupFilter = ({ playlist = null, isOpen, onClose }) => {
   const channelGroups = useChannelsStore((s) => s.channelGroups);
   const fetchCategories = useVODStore((s) => s.fetchCategories);
diff --git a/frontend/src/components/forms/VODCategoryFilter.jsx b/frontend/src/components/forms/VODCategoryFilter.jsx
index 73932249..646aeca1 100644
--- a/frontend/src/components/forms/VODCategoryFilter.jsx
+++ b/frontend/src/components/forms/VODCategoryFilter.jsx
@@ -8,7 +8,6 @@ import {
   Group,
   SimpleGrid,
   Text,
-  Divider,
   Box,
   Checkbox,
   SegmentedControl,

From 36a8e92d941e29ce7cbcd5de715d792873a2dae9 Mon Sep 17 00:00:00 2001
From: None <190783071+CodeBormen@users.noreply.github.com>
Date: Fri, 20 Mar 2026 11:48:06 -0500
Subject: [PATCH 12/67] fix(dvr): prevent duplicate recordings after EPG
 refresh

- Replace ProgramData.id-based dedup with stable (tvg_id, start_time, end_time) key from Recording.custom_properties.program. ProgramData IDs change on every EPG refresh; the old dedup always passed after refresh, creating duplicates.

- Fix secondary timeslot guard to compare original program times (stored in custom_properties) instead of offset-adjusted Recording times. With DVR pre/post offsets configured, the old guard never matched.

- Add acquire_task_lock/release_task_lock to serialize concurrent evaluate_series_rules calls. Multiple EPG source refreshes firing evaluate_series_rules.delay() simultaneously raced to create duplicate recordings.
---
 apps/channels/tasks.py                        |  75 +-
 apps/channels/tests/test_series_rule_dedup.py | 718 ++++++++++++++++++
 2 files changed, 776 insertions(+), 17 deletions(-)
 create mode 100644 apps/channels/tests/test_series_rule_dedup.py

diff --git a/apps/channels/tasks.py b/apps/channels/tasks.py
index b5969cd1..449a3f4a 100755
--- a/apps/channels/tasks.py
+++ b/apps/channels/tasks.py
@@ -19,6 +19,7 @@ from rapidfuzz import fuzz
 from apps.channels.models import Channel
 from apps.epg.models import EPGData
 from core.models import CoreSettings
+from core.utils import acquire_task_lock, release_task_lock
 
 from django.db import OperationalError, close_old_connections
 from channels.layers import get_channel_layer
@@ -1070,12 +1071,39 @@ def match_single_channel_epg(channel_id):
 
 def evaluate_series_rules_impl(tvg_id: str | None = None):
     """Synchronous implementation of series rule evaluation; returns details for debugging."""
+    result = {"scheduled": 0, "details": []}
+
+    # Serialize all invocations to prevent concurrent evaluations from
+    # racing to create duplicate recordings (e.g. multiple EPG sources
+    # refreshing simultaneously each firing evaluate_series_rules.delay()).
+    # If Redis is unavailable, proceed without lock — the primary and
+    # secondary dedup guards still prevent duplicates.
+    lock_acquired = False
+    try:
+        lock_acquired = acquire_task_lock('evaluate_series_rules', 'all')
+        if not lock_acquired:
+            result["details"].append({"status": "skipped", "reason": "concurrent evaluation in progress"})
+            return result
+    except (ConnectionError, OSError):
+        logger.warning("Could not acquire series rule evaluation lock (Redis unavailable), proceeding without lock")
+
+    try:
+        return _evaluate_series_rules_locked(tvg_id, result)
+    finally:
+        if lock_acquired:
+            try:
+                release_task_lock('evaluate_series_rules', 'all')
+            except (ConnectionError, OSError):
+                logger.warning("Could not release series rule evaluation lock")
+
+
+def _evaluate_series_rules_locked(tvg_id, result):
+    """Inner implementation of series rule evaluation, called under lock."""
     from django.utils import timezone
     from apps.channels.models import Recording, Channel
     from apps.epg.models import EPGData, ProgramData
 
     rules = CoreSettings.get_dvr_series_rules()
-    result = {"scheduled": 0, "details": []}
     if not isinstance(rules, list) or not rules:
         return result
 
@@ -1089,14 +1117,23 @@ def evaluate_series_rules_impl(tvg_id: str | None = None):
     now = timezone.now()
     horizon = now + timedelta(days=7)
 
-    # Preload existing recordings' program ids to avoid duplicates
-    existing_program_ids = set()
-    for rec in Recording.objects.all().only("custom_properties"):
+    # Preload existing recordings keyed by stable program attributes that
+    # survive EPG refreshes (tvg_id + original start/end times stored in
+    # custom_properties).  ProgramData.id changes on every EPG refresh so
+    # it cannot be used for deduplication.  Only load future recordings
+    # to bound the set size — past recordings cannot collide with newly
+    # scheduled future programs.
+    existing_program_keys = set()
+    for cp in Recording.objects.filter(
+        end_time__gte=now,
+    ).values_list("custom_properties", flat=True):
         try:
-            pid = rec.custom_properties.get("program", {}).get("id") if rec.custom_properties else None
-            if pid is not None:
-                # Normalize to string for consistent comparisons
-                existing_program_ids.add(str(pid))
+            prog_data = (cp or {}).get("program", {})
+            tvg_id_val = prog_data.get("tvg_id")
+            st = prog_data.get("start_time")
+            et = prog_data.get("end_time")
+            if tvg_id_val and st and et:
+                existing_program_keys.add((str(tvg_id_val), str(st), str(et)))
         except Exception:
             continue
 
@@ -1191,17 +1228,21 @@ def evaluate_series_rules_impl(tvg_id: str | None = None):
         created_here = 0
         for prog in unique_programs:
             try:
-                # Skip if already scheduled by program id
-                if str(prog.id) in existing_program_ids:
+                # Skip if a recording already exists for this exact airing
+                # (keyed by tvg_id + original program times, which are stable
+                # across EPG refreshes unlike ProgramData.id).
+                prog_key = (str(prog.tvg_id), prog.start_time.isoformat(), prog.end_time.isoformat())
+                if prog_key in existing_program_keys:
                     continue
-                # Extra guard: skip if a recording exists for the same channel + timeslot
+                # Extra guard: DB query using the same stable attributes
+                # stored in custom_properties (unadjusted program times,
+                # not offset-adjusted Recording.start_time/end_time).
                 try:
-                    from django.db.models import Q
                     if Recording.objects.filter(
-                        channel=channel,
-                        start_time=prog.start_time,
-                        end_time=prog.end_time,
-                    ).filter(Q(custom_properties__program__id=prog.id) | Q(custom_properties__program__title=prog.title)).exists():
+                        custom_properties__program__tvg_id=prog.tvg_id,
+                        custom_properties__program__start_time=prog.start_time.isoformat(),
+                        custom_properties__program__end_time=prog.end_time.isoformat(),
+                    ).exists():
                         continue
                 except Exception:
                     continue  # already scheduled/recorded
@@ -1245,7 +1286,7 @@ def evaluate_series_rules_impl(tvg_id: str | None = None):
                         }
                     },
                 )
-                existing_program_ids.add(str(prog.id))
+                existing_program_keys.add(prog_key)
                 created_here += 1
                 try:
                     prefetch_recording_artwork.apply_async(args=[rec.id], countdown=1)
diff --git a/apps/channels/tests/test_series_rule_dedup.py b/apps/channels/tests/test_series_rule_dedup.py
new file mode 100644
index 00000000..33aff695
--- /dev/null
+++ b/apps/channels/tests/test_series_rule_dedup.py
@@ -0,0 +1,718 @@
+"""Tests for series rule evaluation deduplication.
+
+Unit tests verify the dedup logic in evaluate_series_rules_impl.
+Integration tests exercise the full path: EPG refresh → series rule
+evaluation → Recording creation → post_save signal chain.
+"""
+from datetime import timedelta
+from unittest.mock import patch, MagicMock
+
+from django.test import TestCase
+from django.utils import timezone
+
+from apps.channels.models import Channel, Recording
+from apps.epg.models import EPGSource, EPGData, ProgramData
+from core.models import CoreSettings
+
+
+def _set_series_rules(rules):
+    """Helper to store series rules in CoreSettings."""
+    CoreSettings.set_dvr_series_rules(rules)
+
+
+def _set_dvr_offsets(pre_min=0, post_min=0):
+    """Helper to store DVR pre/post offsets."""
+    CoreSettings._update_group("dvr_settings", "DVR Settings", {
+        "pre_offset_minutes": pre_min,
+        "post_offset_minutes": post_min,
+    })
+
+
+class SeriesRuleDedupBaseTestCase(TestCase):
+    """Shared setup for series rule dedup tests."""
+
+    def setUp(self):
+        self.now = timezone.now()
+        self.epg_source = EPGSource.objects.create(
+            name="Test EPG", source_type="xmltv"
+        )
+        self.epg = EPGData.objects.create(
+            tvg_id="test.channel.1",
+            name="Test Channel EPG",
+            epg_source=self.epg_source,
+        )
+        self.channel = Channel.objects.create(
+            channel_number=1, name="Test Channel", epg_data=self.epg
+        )
+
+        _set_series_rules([{
+            "tvg_id": "test.channel.1",
+            "mode": "all",
+            "title": "Test Show",
+        }])
+        _set_dvr_offsets(pre_min=0, post_min=0)
+
+    def _create_program(self, hours_from_now=1, title="Test Show",
+                        sub_title="Episode 1", tvg_id="test.channel.1"):
+        """Create a ProgramData at the given offset."""
+        start = self.now + timedelta(hours=hours_from_now)
+        end = start + timedelta(hours=1)
+        return ProgramData.objects.create(
+            epg=self.epg,
+            tvg_id=tvg_id,
+            start_time=start,
+            end_time=end,
+            title=title,
+            sub_title=sub_title,
+        )
+
+    def _simulate_epg_refresh(self, programs_data):
+        """Delete all ProgramData and recreate with new IDs (simulates EPG refresh)."""
+        ProgramData.objects.filter(epg=self.epg).delete()
+        new_programs = []
+        for data in programs_data:
+            prog = ProgramData.objects.create(epg=self.epg, **data)
+            new_programs.append(prog)
+        return new_programs
+
+    def _program_data_for_refresh(self, prog):
+        """Build the dict needed by _simulate_epg_refresh from a ProgramData."""
+        return {
+            "tvg_id": prog.tvg_id,
+            "start_time": prog.start_time,
+            "end_time": prog.end_time,
+            "title": prog.title,
+            "sub_title": prog.sub_title,
+        }
+
+
+# ---------------------------------------------------------------------------
+# Unit tests: dedup logic in evaluate_series_rules_impl
+# ---------------------------------------------------------------------------
+
+@patch("apps.channels.tasks.prefetch_recording_artwork")
+@patch("apps.channels.signals.schedule_recording_task", return_value="mock-task-id")
+class ProgramIdStabilityTests(SeriesRuleDedupBaseTestCase):
+    """Verify dedup works after EPG refresh changes ProgramData IDs."""
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_no_duplicate_after_epg_refresh(self, mock_release, mock_lock,
+                                            mock_schedule, mock_artwork):
+        """Same program should not be recorded twice after EPG refresh."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        prog = self._create_program(hours_from_now=2)
+        old_id = prog.id
+        result1 = evaluate_series_rules_impl()
+        self.assertEqual(result1["scheduled"], 1)
+        self.assertEqual(Recording.objects.count(), 1)
+
+        new_programs = self._simulate_epg_refresh(
+            [self._program_data_for_refresh(prog)]
+        )
+        self.assertNotEqual(old_id, new_programs[0].id)
+
+        result2 = evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 1)
+        self.assertEqual(result2["scheduled"], 0)
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_no_duplicate_with_offsets_after_refresh(self, mock_release, mock_lock,
+                                                     mock_schedule, mock_artwork):
+        """Dedup works when DVR offsets shift Recording times away from program times."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        _set_dvr_offsets(pre_min=5, post_min=5)
+        prog = self._create_program(hours_from_now=2)
+        result1 = evaluate_series_rules_impl()
+        self.assertEqual(result1["scheduled"], 1)
+
+        rec = Recording.objects.first()
+        self.assertEqual(rec.start_time, prog.start_time - timedelta(minutes=5))
+        self.assertEqual(rec.end_time, prog.end_time + timedelta(minutes=5))
+
+        self._simulate_epg_refresh([self._program_data_for_refresh(prog)])
+        result2 = evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 1)
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_different_episodes_still_recorded(self, mock_release, mock_lock,
+                                               mock_schedule, mock_artwork):
+        """Different episodes on the same channel should each get a recording."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        self._create_program(hours_from_now=2, sub_title="Episode 1")
+        self._create_program(hours_from_now=4, sub_title="Episode 2")
+        result = evaluate_series_rules_impl()
+        self.assertEqual(result["scheduled"], 2)
+        self.assertEqual(Recording.objects.count(), 2)
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_new_episode_after_refresh_is_recorded(self, mock_release, mock_lock,
+                                                   mock_schedule, mock_artwork):
+        """A genuinely new episode appearing after EPG refresh should be recorded."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        prog = self._create_program(hours_from_now=2, sub_title="Episode 1")
+        evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 1)
+
+        self._simulate_epg_refresh([
+            self._program_data_for_refresh(prog),
+            {
+                "tvg_id": "test.channel.1",
+                "start_time": prog.end_time,
+                "end_time": prog.end_time + timedelta(hours=1),
+                "title": "Test Show",
+                "sub_title": "Episode 2",
+            },
+        ])
+
+        result2 = evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 2)
+        self.assertEqual(result2["scheduled"], 1)
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_multiple_epg_refreshes_no_duplicates(self, mock_release, mock_lock,
+                                                   mock_schedule, mock_artwork):
+        """Multiple consecutive EPG refreshes should not accumulate duplicates."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        prog = self._create_program(hours_from_now=2)
+        evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 1)
+
+        for _ in range(5):
+            self._simulate_epg_refresh([self._program_data_for_refresh(prog)])
+            evaluate_series_rules_impl()
+
+        self.assertEqual(Recording.objects.count(), 1)
+
+
+@patch("apps.channels.tasks.prefetch_recording_artwork")
+@patch("apps.channels.signals.schedule_recording_task", return_value="mock-task-id")
+class ConcurrencyGuardTests(SeriesRuleDedupBaseTestCase):
+    """Verify the task lock prevents concurrent evaluation."""
+
+    def test_lock_acquired_and_released(self, mock_schedule, mock_artwork):
+        """evaluate_series_rules_impl acquires and releases the task lock."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        self._create_program(hours_from_now=2)
+
+        with patch("apps.channels.tasks.acquire_task_lock", return_value=True) as mock_lock, \
+             patch("apps.channels.tasks.release_task_lock") as mock_release:
+            evaluate_series_rules_impl()
+            mock_lock.assert_called_once_with('evaluate_series_rules', 'all')
+            mock_release.assert_called_once_with('evaluate_series_rules', 'all')
+
+    def test_skips_when_lock_held(self, mock_schedule, mock_artwork):
+        """Returns early with skip reason when lock is already held."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        self._create_program(hours_from_now=2)
+
+        with patch("apps.channels.tasks.acquire_task_lock", return_value=False):
+            result = evaluate_series_rules_impl()
+            self.assertEqual(result["scheduled"], 0)
+            self.assertTrue(
+                any(d.get("reason") == "concurrent evaluation in progress"
+                    for d in result["details"]),
+            )
+            self.assertEqual(Recording.objects.count(), 0)
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_lock_released_on_exception(self, mock_release, mock_lock,
+                                        mock_schedule, mock_artwork):
+        """Lock is released even if the inner implementation raises."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        with patch("apps.channels.tasks._evaluate_series_rules_locked",
+                   side_effect=RuntimeError("test error")):
+            with self.assertRaises(RuntimeError):
+                evaluate_series_rules_impl()
+            mock_release.assert_called_once_with('evaluate_series_rules', 'all')
+
+
+@patch("apps.channels.tasks.prefetch_recording_artwork")
+@patch("apps.channels.signals.schedule_recording_task", return_value="mock-task-id")
+class SecondaryGuardTests(SeriesRuleDedupBaseTestCase):
+    """Verify the secondary DB guard uses stable program attributes."""
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_secondary_guard_catches_duplicate_with_offsets(self, mock_release, mock_lock,
+                                                            mock_schedule, mock_artwork):
+        """Secondary guard works with stale program IDs and DVR offsets."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        _set_dvr_offsets(pre_min=10, post_min=10)
+        prog = self._create_program(hours_from_now=2)
+
+        # Pre-existing recording with a stale program ID (from previous EPG refresh)
+        Recording.objects.create(
+            channel=self.channel,
+            start_time=prog.start_time - timedelta(minutes=10),
+            end_time=prog.end_time + timedelta(minutes=10),
+            custom_properties={
+                "program": {
+                    "id": 99999,
+                    "tvg_id": prog.tvg_id,
+                    "title": prog.title,
+                    "start_time": prog.start_time.isoformat(),
+                    "end_time": prog.end_time.isoformat(),
+                }
+            },
+        )
+
+        result = evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 1)
+        self.assertEqual(result["scheduled"], 0)
+
+
+# ---------------------------------------------------------------------------
+# Integration tests: full path from EPG refresh through recording creation
+# ---------------------------------------------------------------------------
+
+@patch("apps.channels.tasks.prefetch_recording_artwork")
+@patch("apps.channels.signals.schedule_recording_task", return_value="mock-task-id")
+class IntegrationEPGRefreshTests(SeriesRuleDedupBaseTestCase):
+    """End-to-end tests simulating the EPG refresh → evaluate → record flow.
+
+    These exercise the full signal chain: evaluate_series_rules_impl creates
+    a Recording, the post_save signal fires schedule_recording_task, and
+    subsequent evaluations (after EPG refresh) must not create duplicates.
+    """
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_full_flow_single_episode_no_duplicates(self, mock_release, mock_lock,
+                                                     mock_schedule, mock_artwork):
+        """Simulate: create rule → evaluate → EPG refresh → re-evaluate.
+
+        The full recording lifecycle must result in exactly 1 recording.
+        """
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        # Initial EPG data
+        prog = self._create_program(hours_from_now=2, sub_title="Pilot")
+
+        # First evaluation creates the recording
+        result1 = evaluate_series_rules_impl()
+        self.assertEqual(result1["scheduled"], 1)
+        self.assertEqual(Recording.objects.count(), 1)
+
+        # Verify the recording was created with correct program metadata
+        rec = Recording.objects.first()
+        self.assertEqual(rec.custom_properties["program"]["tvg_id"], "test.channel.1")
+        self.assertEqual(rec.custom_properties["program"]["title"], "Test Show")
+        self.assertEqual(
+            rec.custom_properties["program"]["start_time"],
+            prog.start_time.isoformat()
+        )
+
+        # Verify the post_save signal scheduled a task
+        mock_schedule.assert_called()
+        initial_schedule_count = mock_schedule.call_count
+
+        # Simulate EPG refresh (programs get new DB IDs)
+        self._simulate_epg_refresh([self._program_data_for_refresh(prog)])
+
+        # Re-evaluate after refresh (this is what EPG refresh triggers)
+        result2 = evaluate_series_rules_impl()
+        self.assertEqual(result2["scheduled"], 0)
+        self.assertEqual(Recording.objects.count(), 1)
+
+        # No additional task scheduling should have occurred
+        self.assertEqual(mock_schedule.call_count, initial_schedule_count)
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_full_flow_with_offsets_no_duplicates(self, mock_release, mock_lock,
+                                                   mock_schedule, mock_artwork):
+        """Full flow with DVR offsets: recording times differ from program times."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        _set_dvr_offsets(pre_min=5, post_min=10)
+        prog = self._create_program(hours_from_now=3, sub_title="Episode 1")
+
+        result1 = evaluate_series_rules_impl()
+        self.assertEqual(result1["scheduled"], 1)
+
+        rec = Recording.objects.first()
+        # Verify offset-adjusted recording times
+        self.assertEqual(rec.start_time, prog.start_time - timedelta(minutes=5))
+        self.assertEqual(rec.end_time, prog.end_time + timedelta(minutes=10))
+        # Verify original (unadjusted) program times in custom_properties
+        self.assertEqual(
+            rec.custom_properties["program"]["start_time"],
+            prog.start_time.isoformat()
+        )
+        self.assertEqual(
+            rec.custom_properties["program"]["end_time"],
+            prog.end_time.isoformat()
+        )
+
+        # EPG refresh + re-evaluate
+        self._simulate_epg_refresh([self._program_data_for_refresh(prog)])
+        result2 = evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 1)
+        self.assertEqual(result2["scheduled"], 0)
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_full_flow_multiple_episodes_across_refreshes(self, mock_release, mock_lock,
+                                                           mock_schedule, mock_artwork):
+        """New episodes appear across multiple EPG refreshes; each recorded once."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        ep1 = self._create_program(hours_from_now=2, sub_title="Episode 1")
+        evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 1)
+
+        # EPG refresh adds episode 2 alongside episode 1
+        ep1_data = self._program_data_for_refresh(ep1)
+        ep2_start = ep1.end_time
+        ep2_data = {
+            "tvg_id": "test.channel.1",
+            "start_time": ep2_start,
+            "end_time": ep2_start + timedelta(hours=1),
+            "title": "Test Show",
+            "sub_title": "Episode 2",
+        }
+        self._simulate_epg_refresh([ep1_data, ep2_data])
+        evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 2)
+
+        # Another EPG refresh adds episode 3
+        ep3_start = ep2_start + timedelta(hours=1)
+        ep3_data = {
+            "tvg_id": "test.channel.1",
+            "start_time": ep3_start,
+            "end_time": ep3_start + timedelta(hours=1),
+            "title": "Test Show",
+            "sub_title": "Episode 3",
+        }
+        self._simulate_epg_refresh([ep1_data, ep2_data, ep3_data])
+        evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 3)
+
+        # Final EPG refresh with no new episodes — count must stay at 3
+        self._simulate_epg_refresh([ep1_data, ep2_data, ep3_data])
+        evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 3)
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_full_flow_multiple_series_rules(self, mock_release, mock_lock,
+                                              mock_schedule, mock_artwork):
+        """Multiple series rules on different channels, each evaluated correctly."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        # Second channel with its own EPG
+        epg2 = EPGData.objects.create(
+            tvg_id="test.channel.2",
+            name="Channel 2 EPG",
+            epg_source=self.epg_source,
+        )
+        channel2 = Channel.objects.create(
+            channel_number=2, name="Test Channel 2", epg_data=epg2
+        )
+
+        _set_series_rules([
+            {"tvg_id": "test.channel.1", "mode": "all", "title": "Show A"},
+            {"tvg_id": "test.channel.2", "mode": "all", "title": "Show B"},
+        ])
+
+        # Programs on both channels
+        start1 = self.now + timedelta(hours=2)
+        prog1 = ProgramData.objects.create(
+            epg=self.epg, tvg_id="test.channel.1",
+            start_time=start1, end_time=start1 + timedelta(hours=1),
+            title="Show A", sub_title="Episode 1",
+        )
+        start2 = self.now + timedelta(hours=3)
+        prog2 = ProgramData.objects.create(
+            epg=epg2, tvg_id="test.channel.2",
+            start_time=start2, end_time=start2 + timedelta(hours=1),
+            title="Show B", sub_title="Episode 1",
+        )
+
+        evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 2)
+        self.assertEqual(Recording.objects.filter(channel=self.channel).count(), 1)
+        self.assertEqual(Recording.objects.filter(channel=channel2).count(), 1)
+
+        # EPG refresh for both channels
+        ProgramData.objects.filter(epg=self.epg).delete()
+        ProgramData.objects.filter(epg=epg2).delete()
+        ProgramData.objects.create(
+            epg=self.epg, tvg_id="test.channel.1",
+            start_time=start1, end_time=start1 + timedelta(hours=1),
+            title="Show A", sub_title="Episode 1",
+        )
+        ProgramData.objects.create(
+            epg=epg2, tvg_id="test.channel.2",
+            start_time=start2, end_time=start2 + timedelta(hours=1),
+            title="Show B", sub_title="Episode 1",
+        )
+
+        evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 2,
+                         "No duplicates across multiple series rules after EPG refresh")
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_full_flow_rapid_epg_refreshes_simulate_user_report(
+        self, mock_release, mock_lock, mock_schedule, mock_artwork
+    ):
+        """Reproduce the user-reported scenario: series rule + multiple EPG refreshes
+        causing count to balloon from 6 to 25 and 5 simultaneous recordings.
+
+        Simulates 6 episodes with 5 EPG refreshes (each assigning new ProgramData IDs).
+        """
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        # Create 6 episodes (the user had "next of 6")
+        episodes = []
+        for i in range(6):
+            start = self.now + timedelta(hours=2 + i * 2)
+            episodes.append({
+                "tvg_id": "test.channel.1",
+                "start_time": start,
+                "end_time": start + timedelta(hours=1),
+                "title": "Test Show",
+                "sub_title": f"Episode {i + 1}",
+            })
+
+        # Create initial ProgramData
+        for ep in episodes:
+            ProgramData.objects.create(epg=self.epg, **ep)
+
+        # First evaluation: should create exactly 6 recordings
+        evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 6)
+
+        # Simulate 5 EPG refreshes (the user saw count balloon to 25)
+        for refresh_num in range(5):
+            self._simulate_epg_refresh(episodes)
+            result = evaluate_series_rules_impl()
+            self.assertEqual(
+                Recording.objects.count(), 6,
+                f"After EPG refresh #{refresh_num + 1}, expected 6 recordings "
+                f"but got {Recording.objects.count()}"
+            )
+            self.assertEqual(result["scheduled"], 0)
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_full_flow_recording_survives_program_removal_and_readd(
+        self, mock_release, mock_lock, mock_schedule, mock_artwork
+    ):
+        """Program temporarily disappears from EPG then reappears — no duplicate."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        prog = self._create_program(hours_from_now=2, sub_title="Episode 1")
+        evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 1)
+
+        # EPG refresh removes the program entirely
+        self._simulate_epg_refresh([])
+        evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 1,
+                         "Existing recording preserved when program disappears from EPG")
+
+        # EPG refresh adds the program back (new ID)
+        self._simulate_epg_refresh([self._program_data_for_refresh(prog)])
+        evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 1,
+                         "No duplicate when program reappears with new ID")
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_full_flow_celery_task_wrapper_calls_impl(self, mock_release, mock_lock,
+                                                       mock_schedule, mock_artwork):
+        """The @shared_task evaluate_series_rules delegates to _impl correctly."""
+        from apps.channels.tasks import evaluate_series_rules
+
+        self._create_program(hours_from_now=2)
+        result = evaluate_series_rules()
+        self.assertEqual(result["scheduled"], 1)
+        self.assertEqual(Recording.objects.count(), 1)
+
+        # Call again (simulating a second EPG refresh trigger)
+        result2 = evaluate_series_rules()
+        self.assertEqual(result2["scheduled"], 0)
+        self.assertEqual(Recording.objects.count(), 1)
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_full_flow_tvg_id_scoped_evaluation(self, mock_release, mock_lock,
+                                                 mock_schedule, mock_artwork):
+        """Scoped evaluation (tvg_id parameter) still prevents duplicates."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        prog = self._create_program(hours_from_now=2)
+        result1 = evaluate_series_rules_impl(tvg_id="test.channel.1")
+        self.assertEqual(result1["scheduled"], 1)
+
+        self._simulate_epg_refresh([self._program_data_for_refresh(prog)])
+        result2 = evaluate_series_rules_impl(tvg_id="test.channel.1")
+        self.assertEqual(result2["scheduled"], 0)
+        self.assertEqual(Recording.objects.count(), 1)
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_full_flow_offset_change_between_refreshes(self, mock_release, mock_lock,
+                                                        mock_schedule, mock_artwork):
+        """Changing DVR offsets between EPG refreshes doesn't create duplicates.
+
+        Even though Recording.start_time/end_time change when offsets change,
+        the dedup key uses the original program times from custom_properties.
+        """
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        _set_dvr_offsets(pre_min=5, post_min=5)
+        prog = self._create_program(hours_from_now=2)
+        evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 1)
+
+        rec = Recording.objects.first()
+        original_start = rec.start_time
+        original_end = rec.end_time
+
+        # Change offsets
+        _set_dvr_offsets(pre_min=10, post_min=15)
+
+        # EPG refresh
+        self._simulate_epg_refresh([self._program_data_for_refresh(prog)])
+        result = evaluate_series_rules_impl()
+        self.assertEqual(Recording.objects.count(), 1,
+                         "Changing offsets between refreshes should not create duplicates")
+        self.assertEqual(result["scheduled"], 0)
+
+
+# ---------------------------------------------------------------------------
+# Edge case tests: Redis unavailability, non-series recordings, robustness
+# ---------------------------------------------------------------------------
+
+@patch("apps.channels.tasks.prefetch_recording_artwork")
+@patch("apps.channels.signals.schedule_recording_task", return_value="mock-task-id")
+class RedisUnavailabilityTests(SeriesRuleDedupBaseTestCase):
+    """Verify evaluation works when Redis is unavailable (lock cannot be acquired)."""
+
+    def test_proceeds_when_redis_down(self, mock_schedule, mock_artwork):
+        """Evaluation succeeds (with dedup guards) when Redis raises on lock acquire."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        self._create_program(hours_from_now=2)
+
+        with patch("apps.channels.tasks.acquire_task_lock",
+                   side_effect=ConnectionError("Redis unavailable")):
+            result = evaluate_series_rules_impl()
+            self.assertEqual(result["scheduled"], 1)
+            self.assertEqual(Recording.objects.count(), 1)
+
+    def test_dedup_still_works_without_lock(self, mock_schedule, mock_artwork):
+        """Dedup guards prevent duplicates even when the lock is unavailable."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        prog = self._create_program(hours_from_now=2)
+
+        # First call: Redis down, proceeds without lock
+        with patch("apps.channels.tasks.acquire_task_lock",
+                   side_effect=ConnectionError("Redis unavailable")):
+            evaluate_series_rules_impl()
+            self.assertEqual(Recording.objects.count(), 1)
+
+        # EPG refresh
+        self._simulate_epg_refresh([self._program_data_for_refresh(prog)])
+
+        # Second call: Redis still down
+        with patch("apps.channels.tasks.acquire_task_lock",
+                   side_effect=ConnectionError("Redis unavailable")):
+            result = evaluate_series_rules_impl()
+            self.assertEqual(Recording.objects.count(), 1,
+                             "Dedup guards prevent duplicates even without lock")
+            self.assertEqual(result["scheduled"], 0)
+
+    def test_lock_not_released_when_not_acquired(self, mock_schedule, mock_artwork):
+        """release_task_lock is not called if acquire raised an exception."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        self._create_program(hours_from_now=2)
+
+        with patch("apps.channels.tasks.acquire_task_lock",
+                   side_effect=ConnectionError("Redis unavailable")), \
+             patch("apps.channels.tasks.release_task_lock") as mock_release:
+            evaluate_series_rules_impl()
+            mock_release.assert_not_called()
+
+
+@patch("apps.channels.tasks.prefetch_recording_artwork")
+@patch("apps.channels.signals.schedule_recording_task", return_value="mock-task-id")
+class NonSeriesRecordingTests(SeriesRuleDedupBaseTestCase):
+    """Verify non-series recordings don't interfere with series rule dedup."""
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_manual_recording_without_program_data_ignored(self, mock_release, mock_lock,
+                                                            mock_schedule, mock_artwork):
+        """Recordings without custom_properties.program are skipped by dedup key builder."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        # Manual recording with no program metadata
+        Recording.objects.create(
+            channel=self.channel,
+            start_time=self.now + timedelta(hours=2),
+            end_time=self.now + timedelta(hours=3),
+            custom_properties={},
+        )
+
+        prog = self._create_program(hours_from_now=2)
+        result = evaluate_series_rules_impl()
+        self.assertEqual(result["scheduled"], 1)
+        self.assertEqual(Recording.objects.count(), 2)
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_recurring_rule_recording_does_not_interfere(self, mock_release, mock_lock,
+                                                          mock_schedule, mock_artwork):
+        """Recordings from recurring rules (custom_properties.rule) don't block series rules."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        Recording.objects.create(
+            channel=self.channel,
+            start_time=self.now + timedelta(hours=2),
+            end_time=self.now + timedelta(hours=3),
+            custom_properties={"rule": {"id": 1, "name": "Daily News"}},
+        )
+
+        prog = self._create_program(hours_from_now=2)
+        result = evaluate_series_rules_impl()
+        self.assertEqual(result["scheduled"], 1)
+        self.assertEqual(Recording.objects.count(), 2)
+
+    @patch("apps.channels.tasks.acquire_task_lock", return_value=True)
+    @patch("apps.channels.tasks.release_task_lock")
+    def test_recording_with_null_custom_properties_ignored(self, mock_release, mock_lock,
+                                                            mock_schedule, mock_artwork):
+        """Recordings with None custom_properties don't crash the dedup key builder."""
+        from apps.channels.tasks import evaluate_series_rules_impl
+
+        Recording.objects.create(
+            channel=self.channel,
+            start_time=self.now + timedelta(hours=2),
+            end_time=self.now + timedelta(hours=3),
+            custom_properties=None,
+        )
+
+        prog = self._create_program(hours_from_now=2)
+        result = evaluate_series_rules_impl()
+        self.assertEqual(result["scheduled"], 1)

From 7cd4abb6946a9c1a306918b6ee326279bc87f0a2 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sat, 21 Mar 2026 14:07:30 -0500
Subject: [PATCH 13/67] Enhancement: Network Access settings: leaving a field
 blank no longer shows a validation error. The default CIDR range for that
 field is saved automatically and a "Defaults Restored" warning is displayed
 listing which fields were reset. (Closes #726)

---
 CHANGELOG.md                                  |  3 ++
 .../forms/settings/NetworkAccessForm.jsx      | 43 +++++++++++++++++--
 .../forms/settings/NetworkAccessFormUtils.js  |  4 ++
 3 files changed, 46 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a2300474..bbc76777 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Frontend cleanup: removed unused imports from `M3UGroupFilter`, `LiveGroupFilter`, and `VODCategoryFilter` (`Yup`, `M3UProfiles`, several unused Mantine components, dead `OptionWithTooltip` component, duplicate lucide-react imports, and `Divider` in `VODCategoryFilter`). No behaviour changes.
+- Network Access settings: leaving a field blank no longer shows a validation error. The default CIDR range for that field is saved automatically and a "Defaults Restored" warning is displayed listing which fields were reset. (Closes #726)
+
+### Fixed
 
 ## [0.21.1] - 2026-03-18
 
diff --git a/frontend/src/components/forms/settings/NetworkAccessForm.jsx b/frontend/src/components/forms/settings/NetworkAccessForm.jsx
index 04ab60b0..ca165ce6 100644
--- a/frontend/src/components/forms/settings/NetworkAccessForm.jsx
+++ b/frontend/src/components/forms/settings/NetworkAccessForm.jsx
@@ -1,6 +1,6 @@
 import { NETWORK_ACCESS_OPTIONS } from '../../../constants.js';
 import useSettingsStore from '../../../store/settings.jsx';
-import React, { useEffect, useState } from 'react';
+import React, { useEffect, useRef, useState } from 'react';
 import { useForm } from '@mantine/form';
 import {
   checkSetting,
@@ -19,12 +19,14 @@ const NetworkAccessForm = React.memo(({ active }) => {
 
   const [networkAccessError, setNetworkAccessError] = useState(null);
   const [saved, setSaved] = useState(false);
+  const [restoredDefaults, setRestoredDefaults] = useState([]);
   const [networkAccessConfirmOpen, setNetworkAccessConfirmOpen] =
     useState(false);
   const [saving, setSaving] = useState(false);
   const [netNetworkAccessConfirmCIDRs, setNetNetworkAccessConfirmCIDRs] =
     useState([]);
   const [clientIpAddress, setClientIpAddress] = useState(null);
+  const pendingSaveValuesRef = useRef(null);
 
   const networkAccessForm = useForm({
     mode: 'controlled',
@@ -33,7 +35,10 @@ const NetworkAccessForm = React.memo(({ active }) => {
   });
 
   useEffect(() => {
-    if (!active) setSaved(false);
+    if (!active) {
+      setSaved(false);
+      setRestoredDefaults([]);
+    }
   }, [active]);
 
   useEffect(() => {
@@ -58,9 +63,31 @@ const NetworkAccessForm = React.memo(({ active }) => {
   const onNetworkAccessSubmit = async () => {
     setSaved(false);
     setNetworkAccessError(null);
+    setRestoredDefaults([]);
+
+    // Check for blank fields and substitute defaults before saving
+    const currentValues = networkAccessForm.getValues();
+    const defaults = getNetworkAccessDefaults();
+    const restoredLabels = [];
+    const submitValues = { ...currentValues };
+
+    Object.keys(currentValues).forEach((key) => {
+      if (!currentValues[key] || currentValues[key].trim() === '') {
+        submitValues[key] = defaults[key];
+        restoredLabels.push(NETWORK_ACCESS_OPTIONS[key]?.label || key);
+      }
+    });
+
+    if (restoredLabels.length > 0) {
+      networkAccessForm.setValues(submitValues);
+      setRestoredDefaults(restoredLabels);
+    }
+
+    pendingSaveValuesRef.current = submitValues;
+
     const check = await checkSetting({
       ...settings['network_access'],
-      value: networkAccessForm.getValues(), // Send as object
+      value: submitValues,
     });
 
     if (check.error && check.message) {
@@ -84,10 +111,12 @@ const NetworkAccessForm = React.memo(({ active }) => {
   const saveNetworkAccess = async () => {
     setSaved(false);
     setSaving(true);
+    const values =
+      pendingSaveValuesRef.current || networkAccessForm.getValues();
     try {
       await updateSetting({
         ...settings['network_access'],
-        value: networkAccessForm.getValues(), // Send as object
+        value: values,
       });
       setSaved(true);
     } catch (e) {
@@ -113,6 +142,12 @@ const NetworkAccessForm = React.memo(({ active }) => {
               title="Saved Successfully"
             ></Alert>
           )}
+          {restoredDefaults.length > 0 && (
+            <Alert variant="light" color="yellow" title="Defaults Restored">
+              The following fields were empty and have been restored to their
+              defaults: {restoredDefaults.join(', ')}
+            </Alert>
+          )}
           {networkAccessError && (
             <Alert
               variant="light"
diff --git a/frontend/src/utils/forms/settings/NetworkAccessFormUtils.js b/frontend/src/utils/forms/settings/NetworkAccessFormUtils.js
index 1a871571..ac863b0b 100644
--- a/frontend/src/utils/forms/settings/NetworkAccessFormUtils.js
+++ b/frontend/src/utils/forms/settings/NetworkAccessFormUtils.js
@@ -16,6 +16,10 @@ export const getNetworkAccessFormInitialValues = () => {
 export const getNetworkAccessFormValidation = () => {
   return Object.keys(NETWORK_ACCESS_OPTIONS).reduce((acc, key) => {
     acc[key] = (value) => {
+      if (!value || value.trim() === '') {
+        return null; // Empty values will be replaced with defaults on submit
+      }
+
       if (
         value
           .split(',')

From 61d713fcda5ac6ffd90286c8512d64ff83e222c6 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sat, 21 Mar 2026 15:14:58 -0500
Subject: [PATCH 14/67] test: update validation for empty CIDR range to allow
 defaults on submit

---
 .../settings/__tests__/NetworkAccessForm.test.jsx | 15 ++++++++-------
 .../__tests__/NetworkAccessFormUtils.test.js      |  3 ++-
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/frontend/src/components/forms/settings/__tests__/NetworkAccessForm.test.jsx b/frontend/src/components/forms/settings/__tests__/NetworkAccessForm.test.jsx
index 15e5e430..d3008354 100644
--- a/frontend/src/components/forms/settings/__tests__/NetworkAccessForm.test.jsx
+++ b/frontend/src/components/forms/settings/__tests__/NetworkAccessForm.test.jsx
@@ -313,10 +313,10 @@ describe('NetworkAccessForm', () => {
       fireEvent.click(screen.getByTestId('confirm-ok'));
 
       await waitFor(() => {
-        expect(screen.getByTestId('alert')).toBeInTheDocument();
-        expect(screen.getByTestId('alert-title')).toHaveTextContent(
-          'Saved Successfully'
-        );
+        const alertTitles = screen.getAllByTestId('alert-title');
+        expect(
+          alertTitles.some((el) => el.textContent === 'Saved Successfully')
+        ).toBe(true);
       });
     });
 
@@ -399,9 +399,10 @@ describe('NetworkAccessForm', () => {
       fireEvent.click(screen.getByTestId('confirm-ok'));
 
       await waitFor(() => {
-        expect(screen.getByTestId('alert-title')).toHaveTextContent(
-          'Saved Successfully'
-        );
+        const alertTitles = screen.getAllByTestId('alert-title');
+        expect(
+          alertTitles.some((el) => el.textContent === 'Saved Successfully')
+        ).toBe(true);
       });
     });
   });
diff --git a/frontend/src/utils/forms/settings/__tests__/NetworkAccessFormUtils.test.js b/frontend/src/utils/forms/settings/__tests__/NetworkAccessFormUtils.test.js
index 11438d00..2cc885ec 100644
--- a/frontend/src/utils/forms/settings/__tests__/NetworkAccessFormUtils.test.js
+++ b/frontend/src/utils/forms/settings/__tests__/NetworkAccessFormUtils.test.js
@@ -131,7 +131,8 @@ describe('NetworkAccessFormUtils', () => {
         NetworkAccessFormUtils.getNetworkAccessFormValidation();
       const validator = validation['network-access-admin'];
 
-      expect(validator('')).toBe('Invalid CIDR range');
+      // Empty values are allowed — defaults are substituted on submit
+      expect(validator('')).toBe(null);
     });
 
     it('should return empty object when NETWORK_ACCESS_OPTIONS is empty', () => {

From b30a24e2fb384383466a033a4ebb809ac9399a66 Mon Sep 17 00:00:00 2001
From: None <190783071+CodeBormen@users.noreply.github.com>
Date: Sat, 21 Mar 2026 17:24:09 -0500
Subject: [PATCH 15/67] feat: add TLS connection support for Redis and
 PostgreSQL (#950)

- Add 10 env vars for Redis/PostgreSQL TLS (REDIS_SSL, REDIS_SSL_VERIFY, REDIS_SSL_CA_CERT, REDIS_SSL_CERT, REDIS_SSL_KEY, POSTGRES_SSL, POSTGRES_SSL_MODE, POSTGRES_SSL_CA_CERT, POSTGRES_SSL_CERT, POSTGRES_SSL_KEY)
- Propagate SSL params to all Redis connection points: RedisClient, stream view, PubSub, client manager, Celery broker/result backend, Django Channels, and pre-Django startup scripts
- Add Celery SSL config via URL query string params (required by Kombu's internal URL parsing)
- Add PostgreSQL sslmode and certificate options to DATABASES config
- Add startup validation: cert file existence, URL scheme conflict detection, TLS status logging
- Add TLS error hints to Redis connection failure messages
- Add Connection Security panel in System Settings (modular mode only) showing encryption, verification, and mTLS status
- Add PG client key permission fix in web and celery entrypoints for Docker Desktop compatibility (0777 to 0600)
- Add TLS env var passthrough in entrypoint for su - login shells
- Document TLS env vars in modular docker-compose.yml
- Change env_mode from dev/prod to actual DISPATCHARR_ENV value for modular mode detection
---
 apps/proxy/ts_proxy/client_manager.py         |   3 +-
 apps/proxy/ts_proxy/server.py                 |   4 +-
 core/api_views.py                             |  17 +-
 core/utils.py                                 |  25 ++-
 core/views.py                                 |   4 +-
 dispatcharr/persistent_lock.py                |  24 ++-
 dispatcharr/settings.py                       | 176 ++++++++++++++++--
 docker/docker-compose.yml                     |  36 +++-
 docker/entrypoint.celery.sh                   |  17 ++
 docker/entrypoint.sh                          |  30 +++
 .../settings/ConnectionSecurityPanel.jsx      | 174 +++++++++++++++++
 .../forms/settings/SystemSettingsForm.jsx     |  13 +-
 .../__tests__/SystemSettingsForm.test.jsx     |   7 +
 .../src/store/__tests__/settings.test.jsx     |   6 +-
 frontend/src/store/settings.jsx               |   4 +-
 scripts/wait_for_redis.py                     |  48 ++++-
 16 files changed, 540 insertions(+), 48 deletions(-)
 create mode 100644 frontend/src/components/forms/settings/ConnectionSecurityPanel.jsx

diff --git a/apps/proxy/ts_proxy/client_manager.py b/apps/proxy/ts_proxy/client_manager.py
index ea2aa5b0..d62551c1 100644
--- a/apps/proxy/ts_proxy/client_manager.py
+++ b/apps/proxy/ts_proxy/client_manager.py
@@ -58,7 +58,8 @@ class ClientManager:
             from django.conf import settings
 
             redis_url = getattr(settings, 'REDIS_URL', 'redis://localhost:6379/0')
-            redis_client = redis.Redis.from_url(redis_url, decode_responses=True)
+            ssl_params = getattr(settings, 'REDIS_SSL_PARAMS', {})
+            redis_client = redis.Redis.from_url(redis_url, decode_responses=True, **ssl_params)
             all_channels = []
             cursor = 0
 
diff --git a/apps/proxy/ts_proxy/server.py b/apps/proxy/ts_proxy/server.py
index b72b350a..50729991 100644
--- a/apps/proxy/ts_proxy/server.py
+++ b/apps/proxy/ts_proxy/server.py
@@ -166,6 +166,7 @@ class ProxyServer:
                         redis_password = os.environ.get("REDIS_PASSWORD", getattr(settings, 'REDIS_PASSWORD', ''))
                         redis_user = os.environ.get("REDIS_USER", getattr(settings, 'REDIS_USER', ''))
 
+                        ssl_params = getattr(settings, 'REDIS_SSL_PARAMS', {})
                         pubsub_client = redis.Redis(
                             host=redis_host,
                             port=redis_port,
@@ -175,7 +176,8 @@ class ProxyServer:
                             socket_timeout=60,
                             socket_connect_timeout=10,
                             socket_keepalive=True,
-                            health_check_interval=30
+                            health_check_interval=30,
+                            **ssl_params
                         )
                         logger.info("Created fallback Redis PubSub client for event listener")
 
diff --git a/core/api_views.py b/core/api_views.py
index dd15886c..a81ddf54 100644
--- a/core/api_views.py
+++ b/core/api_views.py
@@ -3,6 +3,7 @@
 import json
 import ipaddress
 import logging
+from django.conf import settings as django_settings
 from django.db import models
 from rest_framework import viewsets, status
 from rest_framework.response import Response
@@ -301,7 +302,9 @@ def environment(request):
             country_code = None
             country_name = None
 
-    # 4) Get environment mode from system environment variable
+    # 4) Get environment mode and TLS status from settings
+    postgres_ssl = getattr(django_settings, "POSTGRES_SSL", False)
+
     return Response(
         {
             "authenticated": True,
@@ -309,7 +312,17 @@ def environment(request):
             "local_ip": local_ip,
             "country_code": country_code,
             "country_name": country_name,
-            "env_mode": "dev" if os.getenv("DISPATCHARR_ENV") == "dev" else "prod",
+            "env_mode": os.getenv("DISPATCHARR_ENV", "aio"),
+            "redis_tls": {
+                "enabled": getattr(django_settings, "REDIS_SSL", False),
+                "verify": getattr(django_settings, "REDIS_SSL_VERIFY", True),
+                "mtls": bool(getattr(django_settings, "REDIS_SSL_CERT", "") and getattr(django_settings, "REDIS_SSL_KEY", "")),
+            },
+            "postgres_tls": {
+                "enabled": postgres_ssl,
+                "ssl_mode": getattr(django_settings, "POSTGRES_SSL_MODE", "verify-full") if postgres_ssl else None,
+                "mtls": bool(getattr(django_settings, "POSTGRES_SSL_CERT", "") and getattr(django_settings, "POSTGRES_SSL_KEY", "")),
+            },
         }
     )
 
diff --git a/core/utils.py b/core/utils.py
index ef5aa702..20714724 100644
--- a/core/utils.py
+++ b/core/utils.py
@@ -13,6 +13,8 @@ from django.core.validators import URLValidator
 from django.core.exceptions import ValidationError
 import gc
 
+_REDIS_TLS_HINT = " (TLS is enabled — verify certificate paths and that Redis is configured for TLS)"
+
 logger = logging.getLogger(__name__)
 
 # Import the command detector
@@ -65,6 +67,9 @@ class RedisClient:
                     socket_keepalive = getattr(settings, 'REDIS_SOCKET_KEEPALIVE', True)
                     retry_on_timeout = getattr(settings, 'REDIS_RETRY_ON_TIMEOUT', True)
 
+                    # TLS params from settings (empty dict when TLS is disabled)
+                    ssl_params = getattr(settings, 'REDIS_SSL_PARAMS', {})
+
                     # Create Redis client with better defaults
                     client = redis.Redis(
                         host=redis_host,
@@ -76,7 +81,8 @@ class RedisClient:
                         socket_connect_timeout=socket_connect_timeout,
                         socket_keepalive=socket_keepalive,
                         health_check_interval=health_check_interval,
-                        retry_on_timeout=retry_on_timeout
+                        retry_on_timeout=retry_on_timeout,
+                        **ssl_params
                     )
 
                     # Validate connection with ping
@@ -125,8 +131,9 @@ class RedisClient:
 
                 except (ConnectionError, TimeoutError) as e:
                     retry_count += 1
+                    _tls_hint = _REDIS_TLS_HINT if ssl_params else ""
                     if retry_count >= max_retries:
-                        logger.error(f"Failed to connect to Redis after {max_retries} attempts: {e}")
+                        logger.error(f"Failed to connect to Redis after {max_retries} attempts: {e}{_tls_hint}")
                         return None
                     else:
                         # Use exponential backoff for retries
@@ -135,7 +142,8 @@ class RedisClient:
                         time.sleep(wait_time)
 
                 except Exception as e:
-                    logger.error(f"Unexpected error connecting to Redis: {e}")
+                    _tls_hint = _REDIS_TLS_HINT if ssl_params else ""
+                    logger.error(f"Unexpected error connecting to Redis: {e}{_tls_hint}")
                     return None
 
         return cls._client
@@ -161,6 +169,8 @@ class RedisClient:
                     health_check_interval = getattr(settings, 'REDIS_HEALTH_CHECK_INTERVAL', 30)
                     retry_on_timeout = getattr(settings, 'REDIS_RETRY_ON_TIMEOUT', True)
 
+                    ssl_params = getattr(settings, 'REDIS_SSL_PARAMS', {})
+
                     # Create Redis client with PubSub-optimized settings - no timeout
                     client = redis.Redis(
                         host=redis_host,
@@ -172,7 +182,8 @@ class RedisClient:
                         socket_connect_timeout=socket_connect_timeout,
                         socket_keepalive=socket_keepalive,
                         health_check_interval=health_check_interval,
-                        retry_on_timeout=retry_on_timeout
+                        retry_on_timeout=retry_on_timeout,
+                        **ssl_params
                     )
 
                     # Validate connection with ping
@@ -185,8 +196,9 @@ class RedisClient:
 
                 except (ConnectionError, TimeoutError) as e:
                     retry_count += 1
+                    _tls_hint = _REDIS_TLS_HINT if ssl_params else ""
                     if retry_count >= max_retries:
-                        logger.error(f"Failed to connect to Redis for PubSub after {max_retries} attempts: {e}")
+                        logger.error(f"Failed to connect to Redis for PubSub after {max_retries} attempts: {e}{_tls_hint}")
                         return None
                     else:
                         # Use exponential backoff for retries
@@ -195,7 +207,8 @@ class RedisClient:
                         time.sleep(wait_time)
 
                 except Exception as e:
-                    logger.error(f"Unexpected error connecting to Redis for PubSub: {e}")
+                    _tls_hint = _REDIS_TLS_HINT if ssl_params else ""
+                    logger.error(f"Unexpected error connecting to Redis for PubSub: {e}{_tls_hint}")
                     return None
 
         return cls._pubsub_client
diff --git a/core/views.py b/core/views.py
index 082cccc3..b3e6dfb2 100644
--- a/core/views.py
+++ b/core/views.py
@@ -42,12 +42,14 @@ def stream_view(request, channel_uuid):
         redis_db = int(getattr(settings, "REDIS_DB", "0"))
         redis_password = getattr(settings, "REDIS_PASSWORD", "")
         redis_user = getattr(settings, "REDIS_USER", "")
+        ssl_params = getattr(settings, "REDIS_SSL_PARAMS", {})
         redis_client = redis.Redis(
             host=redis_host,
             port=redis_port,
             db=redis_db,
             password=redis_password if redis_password else None,
-            username=redis_user if redis_user else None
+            username=redis_user if redis_user else None,
+            **ssl_params
         )
 
         # Retrieve the channel by the provided stream_id.
diff --git a/dispatcharr/persistent_lock.py b/dispatcharr/persistent_lock.py
index 2ed72bf4..64e9e6ba 100644
--- a/dispatcharr/persistent_lock.py
+++ b/dispatcharr/persistent_lock.py
@@ -74,18 +74,40 @@ class PersistentLock:
 # Example usage (for testing purposes only):
 if __name__ == "__main__":
     import os
+    import sys
     # Connect to Redis using environment variables; adjust connection parameters as needed.
     redis_host = os.environ.get("REDIS_HOST", "localhost")
     redis_port = int(os.environ.get("REDIS_PORT", 6379))
     redis_db = int(os.environ.get("REDIS_DB", 0))
     redis_password = os.environ.get("REDIS_PASSWORD", "")
     redis_user = os.environ.get("REDIS_USER", "")
+    ssl_kwargs = {}
+    if os.environ.get("REDIS_SSL", "false").lower() == "true":
+        import ssl as _ssl
+        ssl_kwargs["ssl"] = True
+        ssl_kwargs["ssl_cert_reqs"] = (
+            _ssl.CERT_REQUIRED if os.environ.get("REDIS_SSL_VERIFY", "true").lower() == "true"
+            else _ssl.CERT_NONE
+        )
+        for env_var, key in [
+            ("REDIS_SSL_CA_CERT", "ssl_ca_certs"),
+            ("REDIS_SSL_CERT", "ssl_certfile"),
+            ("REDIS_SSL_KEY", "ssl_keyfile"),
+        ]:
+            path = os.environ.get(env_var, "")
+            if path:
+                if not os.path.isfile(path):
+                    print(f"Redis TLS: {env_var}={path!r} — file not found.")
+                    sys.exit(1)
+                ssl_kwargs[key] = path
+
     client = redis.Redis(
         host=redis_host,
         port=redis_port,
         db=redis_db,
         password=redis_password if redis_password else None,
-        username=redis_user if redis_user else None
+        username=redis_user if redis_user else None,
+        **ssl_kwargs
     )
     lock = PersistentLock(client, "lock:example_account", lock_timeout=120)
 
diff --git a/dispatcharr/settings.py b/dispatcharr/settings.py
index b0d387b2..ec61eb4d 100644
--- a/dispatcharr/settings.py
+++ b/dispatcharr/settings.py
@@ -1,7 +1,23 @@
 import os
+import ssl
 from pathlib import Path
 from datetime import timedelta
 from urllib.parse import quote_plus
+from django.core.exceptions import ImproperlyConfigured
+
+
+def _validate_tls_cert_paths(paths, service_name):
+    """Validate that configured TLS certificate file paths exist on disk.
+
+    Raises ImproperlyConfigured with a clear message identifying the
+    service and missing file so operators can fix their environment.
+    """
+    for env_var, file_path in paths:
+        if file_path and not Path(file_path).is_file():
+            raise ImproperlyConfigured(
+                f"{service_name} TLS: {env_var}={file_path!r} — file not found. "
+                f"Check that the certificate file exists and the volume is mounted correctly."
+            )
 
 BASE_DIR = Path(__file__).resolve().parent.parent
 
@@ -12,6 +28,37 @@ REDIS_DB = os.environ.get("REDIS_DB", "0")
 REDIS_USER = os.environ.get("REDIS_USER", "")
 REDIS_PASSWORD = os.environ.get("REDIS_PASSWORD", "")
 
+# Redis TLS configuration
+REDIS_SSL = os.environ.get("REDIS_SSL", "false").lower() == "true"
+REDIS_SSL_VERIFY = os.environ.get("REDIS_SSL_VERIFY", "true").lower() == "true"
+REDIS_SSL_CA_CERT = os.environ.get("REDIS_SSL_CA_CERT", "")
+REDIS_SSL_CERT = os.environ.get("REDIS_SSL_CERT", "")
+REDIS_SSL_KEY = os.environ.get("REDIS_SSL_KEY", "")
+
+# Reusable dict of SSL kwargs for redis.Redis() constructors
+REDIS_SSL_PARAMS = {}
+if REDIS_SSL:
+    _validate_tls_cert_paths([
+        ("REDIS_SSL_CA_CERT", REDIS_SSL_CA_CERT),
+        ("REDIS_SSL_CERT", REDIS_SSL_CERT),
+        ("REDIS_SSL_KEY", REDIS_SSL_KEY),
+    ], "Redis")
+
+    REDIS_SSL_PARAMS["ssl"] = True
+    REDIS_SSL_PARAMS["ssl_cert_reqs"] = ssl.CERT_REQUIRED if REDIS_SSL_VERIFY else ssl.CERT_NONE
+    if REDIS_SSL_CA_CERT:
+        REDIS_SSL_PARAMS["ssl_ca_certs"] = REDIS_SSL_CA_CERT
+    if REDIS_SSL_CERT:
+        REDIS_SSL_PARAMS["ssl_certfile"] = REDIS_SSL_CERT
+    if REDIS_SSL_KEY:
+        REDIS_SSL_PARAMS["ssl_keyfile"] = REDIS_SSL_KEY
+
+    _mtls = "enabled" if REDIS_SSL_CERT and REDIS_SSL_KEY else "disabled"
+    _verify = "on" if REDIS_SSL_VERIFY else "off"
+    print(f"Redis TLS: enabled (verify={_verify}, mTLS={_mtls})")
+else:
+    print("Redis TLS: disabled")
+
 # Set DEBUG to True for development, False for production
 if os.environ.get("DISPATCHARR_DEBUG", "False").lower() == "true":
     DEBUG = True
@@ -120,20 +167,46 @@ TEMPLATES = [
 WSGI_APPLICATION = "dispatcharr.wsgi.application"
 ASGI_APPLICATION = "dispatcharr.asgi.application"
 
+_redis_scheme = "rediss" if REDIS_SSL else "redis"
+
+# URL-encoded auth string shared by CHANNEL_LAYERS and Celery broker URLs
+if REDIS_PASSWORD:
+    _encoded_password = quote_plus(REDIS_PASSWORD)
+    if REDIS_USER:
+        _redis_auth = f"{quote_plus(REDIS_USER)}:{_encoded_password}@"
+    else:
+        _redis_auth = f":{_encoded_password}@"
+else:
+    _redis_auth = ""
+
+_channels_redis_url = f"{_redis_scheme}://{_redis_auth}{REDIS_HOST}:{REDIS_PORT}/{REDIS_DB}"
+# channels_redis accepts either a URL string or a dict with "address" + kwargs.
+# When TLS is enabled, pass SSL params alongside the URL so the connection pool
+# uses the correct CA cert and verification settings.
+if REDIS_SSL:
+    # Filter out "ssl" key — the rediss:// scheme already enables SSL.
+    # Passing ssl=True as a kwarg to aioredis from_url causes an error.
+    _channels_ssl = {k: v for k, v in REDIS_SSL_PARAMS.items() if k != "ssl"}
+    _channels_host = {"address": _channels_redis_url, **_channels_ssl}
+else:
+    _channels_host = _channels_redis_url
+
 CHANNEL_LAYERS = {
     "default": {
         "BACKEND": "channels_redis.core.RedisChannelLayer",
         "CONFIG": {
-            "hosts": ["redis://{redis_auth}{host}:{port}/{db}".format(
-                redis_auth=f"{quote_plus(REDIS_USER)}:{quote_plus(REDIS_PASSWORD)}@" if REDIS_PASSWORD and REDIS_USER else f":{quote_plus(REDIS_PASSWORD)}@" if REDIS_PASSWORD else "",
-                host=REDIS_HOST,
-                port=REDIS_PORT,
-                db=REDIS_DB
-            )],  # URL format supports authentication
+            "hosts": [_channels_host],
         },
     },
 }
 
+# PostgreSQL TLS configuration (defined before DATABASES for module-level access)
+POSTGRES_SSL = os.environ.get("POSTGRES_SSL", "false").lower() == "true"
+POSTGRES_SSL_MODE = os.environ.get("POSTGRES_SSL_MODE", "verify-full")
+POSTGRES_SSL_CA_CERT = os.environ.get("POSTGRES_SSL_CA_CERT", "")
+POSTGRES_SSL_CERT = os.environ.get("POSTGRES_SSL_CERT", "")
+POSTGRES_SSL_KEY = os.environ.get("POSTGRES_SSL_KEY", "")
+
 if os.getenv("DB_ENGINE", None) == "sqlite":
     DATABASES = {
         "default": {
@@ -154,6 +227,28 @@ else:
         }
     }
 
+    if POSTGRES_SSL:
+        _validate_tls_cert_paths([
+            ("POSTGRES_SSL_CA_CERT", POSTGRES_SSL_CA_CERT),
+            ("POSTGRES_SSL_CERT", POSTGRES_SSL_CERT),
+            ("POSTGRES_SSL_KEY", POSTGRES_SSL_KEY),
+        ], "PostgreSQL")
+
+        DATABASES["default"]["OPTIONS"] = {
+            "sslmode": POSTGRES_SSL_MODE,
+        }
+        if POSTGRES_SSL_CA_CERT:
+            DATABASES["default"]["OPTIONS"]["sslrootcert"] = POSTGRES_SSL_CA_CERT
+        if POSTGRES_SSL_CERT:
+            DATABASES["default"]["OPTIONS"]["sslcert"] = POSTGRES_SSL_CERT
+        if POSTGRES_SSL_KEY:
+            DATABASES["default"]["OPTIONS"]["sslkey"] = POSTGRES_SSL_KEY
+
+        _mtls = "enabled" if POSTGRES_SSL_CERT and POSTGRES_SSL_KEY else "disabled"
+        print(f"PostgreSQL TLS: enabled (sslmode={POSTGRES_SSL_MODE}, mTLS={_mtls})")
+    else:
+        print("PostgreSQL TLS: disabled")
+
 AUTH_PASSWORD_VALIDATORS = [
     {
         "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
@@ -208,22 +303,52 @@ STATICFILES_DIRS = [
 DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
 AUTH_USER_MODEL = "accounts.User"
 
-# Build default Redis URL from components for Celery with optional authentication
-# Build auth string conditionally with URL encoding for special characters
-if REDIS_PASSWORD:
-    encoded_password = quote_plus(REDIS_PASSWORD)
-    if REDIS_USER:
-        encoded_user = quote_plus(REDIS_USER)
-        redis_auth = f"{encoded_user}:{encoded_password}@"
-    else:
-        redis_auth = f":{encoded_password}@"
+_default_redis_url = f"{_redis_scheme}://{_redis_auth}{REDIS_HOST}:{REDIS_PORT}/{REDIS_DB}"
+# Celery/Kombu require SSL parameters in the URL query string because
+# internal URL parsing can overwrite the CELERY_BROKER_USE_SSL dict.
+if REDIS_SSL:
+    _celery_ssl_params = [
+        f"ssl_cert_reqs={'CERT_REQUIRED' if REDIS_SSL_VERIFY else 'CERT_NONE'}",
+    ]
+    if REDIS_SSL_CA_CERT:
+        _celery_ssl_params.append(f"ssl_ca_certs={REDIS_SSL_CA_CERT}")
+    if REDIS_SSL_CERT:
+        _celery_ssl_params.append(f"ssl_certfile={REDIS_SSL_CERT}")
+    if REDIS_SSL_KEY:
+        _celery_ssl_params.append(f"ssl_keyfile={REDIS_SSL_KEY}")
+    _default_celery_url = f"{_default_redis_url}?{'&'.join(_celery_ssl_params)}"
 else:
-    redis_auth = ""
-
-_default_redis_url = f"redis://{redis_auth}{REDIS_HOST}:{REDIS_PORT}/{REDIS_DB}"
-CELERY_BROKER_URL = os.environ.get("CELERY_BROKER_URL", _default_redis_url)
+    _default_celery_url = _default_redis_url
+CELERY_BROKER_URL = os.environ.get("CELERY_BROKER_URL", _default_celery_url)
 CELERY_RESULT_BACKEND = os.environ.get("CELERY_RESULT_BACKEND", CELERY_BROKER_URL)
 
+# Validate that URL overrides don't conflict with TLS settings
+for _url_var, _url_val in [
+    ("CELERY_BROKER_URL", CELERY_BROKER_URL),
+    ("CELERY_RESULT_BACKEND", CELERY_RESULT_BACKEND),
+]:
+    _is_override = os.environ.get(_url_var) is not None
+    if not _is_override:
+        continue
+    _url_is_ssl = _url_val.startswith("rediss://")
+    if REDIS_SSL and not _url_is_ssl:
+        raise ImproperlyConfigured(
+            f"REDIS_SSL is enabled but {_url_var} uses redis:// (plaintext). "
+            f"Change the URL scheme to rediss:// or remove the {_url_var} override."
+        )
+    if not REDIS_SSL and _url_is_ssl:
+        raise ImproperlyConfigured(
+            f"{_url_var} uses rediss:// (TLS) but REDIS_SSL is not enabled. "
+            f"Set REDIS_SSL=true and configure the TLS certificate settings."
+        )
+
+# Celery TLS configuration — required in addition to the rediss:// URL scheme.
+# Uses the same cert params as REDIS_SSL_PARAMS, minus the "ssl" key that
+# redis-py needs but Celery/Kombu does not.
+if REDIS_SSL:
+    CELERY_BROKER_USE_SSL = {k: v for k, v in REDIS_SSL_PARAMS.items() if k != "ssl"}
+    CELERY_RESULT_BACKEND_USE_SSL = CELERY_BROKER_USE_SSL
+
 # Configure Redis key prefix
 CELERY_RESULT_BACKEND_TRANSPORT_OPTIONS = {
     "global_keyprefix": "celery-tasks:",  # Set the Redis key prefix for Celery
@@ -299,8 +424,19 @@ SIMPLE_JWT = {
     "BLACKLIST_AFTER_ROTATION": True,  # Optional: Whether to blacklist refresh tokens
 }
 
-# Redis connection settings
+# Redis connection settings — _default_redis_url uses rediss:// when REDIS_SSL is enabled
 REDIS_URL = os.environ.get("REDIS_URL", _default_redis_url)
+if os.environ.get("REDIS_URL") is not None:
+    if REDIS_SSL and not REDIS_URL.startswith("rediss://"):
+        raise ImproperlyConfigured(
+            "REDIS_SSL is enabled but REDIS_URL uses redis:// (plaintext). "
+            "Change the URL scheme to rediss:// or remove the REDIS_URL override."
+        )
+    if not REDIS_SSL and REDIS_URL.startswith("rediss://"):
+        raise ImproperlyConfigured(
+            "REDIS_URL uses rediss:// (TLS) but REDIS_SSL is not enabled. "
+            "Set REDIS_SSL=true and configure the TLS certificate settings."
+        )
 REDIS_SOCKET_TIMEOUT = 60  # Socket timeout in seconds
 REDIS_SOCKET_CONNECT_TIMEOUT = 5  # Connection timeout in seconds
 REDIS_HEALTH_CHECK_INTERVAL = 15  # Health check every 15 seconds
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index d674460a..547ac249 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -14,6 +14,7 @@ services:
       - 9191:9191
     volumes:
       - ./data:/data
+      #- ./certs:/certs:ro  # TLS certificates (optional)
     depends_on:
       db:
         condition: service_healthy
@@ -33,15 +34,26 @@ services:
       - POSTGRES_DB=dispatcharr
       - POSTGRES_USER=dispatch
       - POSTGRES_PASSWORD=secret
+      # PostgreSQL TLS (optional) — mount certs via the volume above
+      #- POSTGRES_SSL=true                             # required to enable TLS
+      #- POSTGRES_SSL_MODE=verify-full                 # optional: verify-full (default) | verify-ca | require
+      #- POSTGRES_SSL_CA_CERT=/certs/postgres/ca.crt   # optional: CA cert to verify the server
+      #- POSTGRES_SSL_CERT=/certs/postgres/client.crt  # optional: client cert (only if server requires client auth)
+      #- POSTGRES_SSL_KEY=/certs/postgres/client.key   # optional: client key  (only if server requires client auth)
 
       # Redis Connection
       - REDIS_HOST=redis
       - REDIS_PORT=6379
-
       # Redis Authentication (Optional)
       # Uncomment and set if your Redis requires authentication:
       #- REDIS_PASSWORD=your_strong_redis_password
       #- REDIS_USER=your_redis_username  # For Redis 6+ ACL - see Redis service below
+      # Redis TLS (optional) — mount certs via the volume above
+      #- REDIS_SSL=true                                # required to enable TLS
+      #- REDIS_SSL_VERIFY=true                         # optional: set false for self-signed certs without a CA
+      #- REDIS_SSL_CA_CERT=/certs/redis/ca.crt         # optional: CA cert to verify the server
+      #- REDIS_SSL_CERT=/certs/redis/client.crt        # optional: client cert (only if server requires client auth)
+      #- REDIS_SSL_KEY=/certs/redis/client.key         # optional: client key  (only if server requires client auth)
 
       # Logging
       - DISPATCHARR_LOG_LEVEL=info
@@ -95,6 +107,7 @@ services:
         condition: service_started
     volumes:
       - ./data:/data
+      #- ./certs:/certs:ro  # TLS certificates (optional)
     extra_hosts:
       - "host.docker.internal:host-gateway"
     entrypoint: ["/app/docker/entrypoint.celery.sh"]
@@ -108,21 +121,30 @@ services:
       # Must match the web service port for DVR recording and internal API calls
       - DISPATCHARR_PORT=9191
 
-      # PostgreSQL Connection
+      # PostgreSQL — must match web service settings
       - POSTGRES_HOST=db
       - POSTGRES_PORT=5432
       - POSTGRES_DB=dispatcharr
       - POSTGRES_USER=dispatch
       - POSTGRES_PASSWORD=secret
+      # PostgreSQL TLS — must match web service
+      #- POSTGRES_SSL=true
+      #- POSTGRES_SSL_MODE=verify-full
+      #- POSTGRES_SSL_CA_CERT=/certs/postgres/ca.crt
+      #- POSTGRES_SSL_CERT=/certs/postgres/client.crt
+      #- POSTGRES_SSL_KEY=/certs/postgres/client.key
 
-      # Redis Connection
+      # Redis — must match web service settings
       - REDIS_HOST=redis
       - REDIS_PORT=6379
-
-      # Redis Authentication (Optional)
-      # Uncomment and set if your Redis requires authentication:
       #- REDIS_PASSWORD=your_strong_redis_password
-      #- REDIS_USER=your_redis_username  # For Redis 6+ ACL - see Redis service below
+      #- REDIS_USER=your_redis_username
+      # Redis TLS — must match web service
+      #- REDIS_SSL=true
+      #- REDIS_SSL_VERIFY=true
+      #- REDIS_SSL_CA_CERT=/certs/redis/ca.crt
+      #- REDIS_SSL_CERT=/certs/redis/client.crt
+      #- REDIS_SSL_KEY=/certs/redis/client.key
 
       # Logging
       - DISPATCHARR_LOG_LEVEL=info
diff --git a/docker/entrypoint.celery.sh b/docker/entrypoint.celery.sh
index 7a69f430..d7a43255 100644
--- a/docker/entrypoint.celery.sh
+++ b/docker/entrypoint.celery.sh
@@ -36,6 +36,23 @@ if [ "$USE_LEGACY_NUMPY" = "true" ]; then
     fi
 fi
 
+# Fix TLS client key permissions for PostgreSQL (same issue as web entrypoint).
+# libpq requires 0600 but Docker Desktop mounts files as 0777.
+if [ -n "${POSTGRES_SSL_KEY:-}" ] && [ -f "$POSTGRES_SSL_KEY" ]; then
+    _key_perms=$(stat -c '%a' "$POSTGRES_SSL_KEY" 2>/dev/null)
+    if [ "$_key_perms" != "600" ] && [ "$_key_perms" != "640" ]; then
+        _fixed_key="/data/.pg-client-celery.key"
+        cp "$POSTGRES_SSL_KEY" "$_fixed_key"
+        chmod 600 "$_fixed_key"
+        # Match ownership to the user running Celery if running as root
+        if [ "$(id -u)" = "0" ] && [ -n "${PUID:-}" ]; then
+            chown "${PUID}:${PGID:-$PUID}" "$_fixed_key"
+        fi
+        export POSTGRES_SSL_KEY="$_fixed_key"
+        echo "Fixed PostgreSQL client key permissions (${_key_perms} → 600)"
+    fi
+fi
+
 # Wait for migrations to complete
 # Uses 'migrate --check' which exits 0 only when all migrations are applied,
 # and exits 1 on unapplied migrations OR connection errors (safe either way)
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index 0de0afd5..7365a300 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -112,6 +112,14 @@ variables=(
     CELERY_NICE_LEVEL UWSGI_NICE_LEVEL DJANGO_SECRET_KEY
 )
 
+# TLS variables are optional — only propagate when set to avoid noisy warnings
+for _tls_var in POSTGRES_SSL POSTGRES_SSL_MODE POSTGRES_SSL_CA_CERT POSTGRES_SSL_CERT POSTGRES_SSL_KEY \
+                REDIS_SSL REDIS_SSL_VERIFY REDIS_SSL_CA_CERT REDIS_SSL_CERT REDIS_SSL_KEY; do
+    if [ -n "${!_tls_var+x}" ]; then
+        variables+=("$_tls_var")
+    fi
+done
+
 # Truncate files before rewriting
 > /etc/profile.d/dispatcharr.sh
 
@@ -229,6 +237,28 @@ if [ "$USE_LEGACY_NUMPY" = "true" ]; then
     fi
 fi
 
+# Fix TLS client key permissions for PostgreSQL.
+# libpq requires the client key to be 0600 or stricter. Volume-mounted files
+# from Windows/macOS hosts often have 0755 permissions, so copy the key to a
+# writable location with correct permissions if needed.
+if [ -n "${POSTGRES_SSL_KEY:-}" ] && [ -f "$POSTGRES_SSL_KEY" ]; then
+    _key_perms=$(stat -c '%a' "$POSTGRES_SSL_KEY" 2>/dev/null)
+    if [ "$_key_perms" != "600" ] && [ "$_key_perms" != "640" ]; then
+        _fixed_key="/data/.pg-client.key"
+        cp "$POSTGRES_SSL_KEY" "$_fixed_key"
+        chmod 600 "$_fixed_key"
+        if [ "$(id -u)" = "0" ] && [ -n "${PUID:-}" ]; then
+            chown "${PUID}:${PGID}" "$_fixed_key"
+        fi
+        export POSTGRES_SSL_KEY="$_fixed_key"
+        # Update /etc/environment so login shells see the fixed path
+        sed -i "/^POSTGRES_SSL_KEY=/d" /etc/environment
+        echo "POSTGRES_SSL_KEY='$_fixed_key'" >> /etc/environment
+        sed -i "s|export POSTGRES_SSL_KEY=.*|export POSTGRES_SSL_KEY='$_fixed_key'|" /etc/profile.d/dispatcharr.sh
+        echo "Fixed PostgreSQL client key permissions (${_key_perms} → 600)"
+    fi
+fi
+
 # Run Django commands as non-root user to prevent permission issues
 su - "$POSTGRES_USER" -c "cd /app && python manage.py migrate --noinput"
 su - "$POSTGRES_USER" -c "cd /app && python manage.py collectstatic --noinput"
diff --git a/frontend/src/components/forms/settings/ConnectionSecurityPanel.jsx b/frontend/src/components/forms/settings/ConnectionSecurityPanel.jsx
new file mode 100644
index 00000000..f8c9614a
--- /dev/null
+++ b/frontend/src/components/forms/settings/ConnectionSecurityPanel.jsx
@@ -0,0 +1,174 @@
+import React from 'react';
+import {
+  Badge,
+  Group,
+  Paper,
+  SimpleGrid,
+  Stack,
+  Text,
+  Tooltip,
+} from '@mantine/core';
+import useSettingsStore from '../../../store/settings.jsx';
+
+const TlsOption = ({ label, description, tooltip, badgeText, badgeColor }) => (
+  <div>
+    <Group gap="xs" align="center">
+      <Text size="sm" fw={500}>
+        {label}
+      </Text>
+      <Tooltip label={tooltip}>
+        <Badge color={badgeColor} variant="light" size="sm">
+          {badgeText}
+        </Badge>
+      </Tooltip>
+    </Group>
+    <Text size="xs" c="dimmed">
+      {description}
+    </Text>
+  </div>
+);
+
+const TlsServiceCard = ({ serviceName, children }) => (
+  <Paper p="md" withBorder h="100%">
+    <Stack gap="sm">
+      <Text fw={600}>{serviceName}</Text>
+      {children}
+    </Stack>
+  </Paper>
+);
+
+const RedisStatus = ({ tls }) => {
+  const enabled = tls?.enabled ?? false;
+  const verify = tls?.verify ?? true;
+  const mtls = tls?.mtls ?? false;
+
+  let verifyColor = 'gray';
+  let verifyTooltip = 'Verification is not active — TLS is disabled';
+  if (enabled) {
+    verifyColor = verify ? 'green' : 'yellow';
+    verifyTooltip = verify
+      ? "The server's identity is verified using a trusted certificate"
+      : 'The connection is encrypted but the server identity is not verified';
+  }
+
+  let mtlsColor = 'gray';
+  let mtlsTooltip = 'Mutual authentication is not active';
+  if (enabled && mtls) {
+    mtlsColor = 'green';
+    mtlsTooltip = 'Both client and server verify each other with certificates';
+  }
+
+  return (
+    <TlsServiceCard serviceName="Redis">
+      <TlsOption
+        label="Encryption"
+        description="Encrypt traffic between Dispatcharr and Redis."
+        tooltip={
+          enabled
+            ? 'The connection is encrypted'
+            : 'The connection is not encrypted'
+        }
+        badgeText={enabled ? 'Enabled' : 'Disabled'}
+        badgeColor={enabled ? 'green' : 'gray'}
+      />
+      <TlsOption
+        label="Server Verification"
+        description="Verify the Redis server's identity using a CA certificate."
+        tooltip={verifyTooltip}
+        badgeText={verify && enabled ? 'On' : 'Off'}
+        badgeColor={verifyColor}
+      />
+      <TlsOption
+        label="Mutual TLS"
+        description="Authenticate Dispatcharr to Redis using a client certificate."
+        tooltip={mtlsTooltip}
+        badgeText={mtls && enabled ? 'Active' : 'Inactive'}
+        badgeColor={mtlsColor}
+      />
+    </TlsServiceCard>
+  );
+};
+
+const PostgresStatus = ({ tls }) => {
+  const enabled = tls?.enabled ?? false;
+  const sslMode = tls?.ssl_mode;
+  const mtls = tls?.mtls ?? false;
+
+  let modeColor = 'gray';
+  let modeTooltip = 'Verification mode is not active — TLS is disabled';
+  let modeBadge = 'Off';
+  if (enabled && sslMode) {
+    modeBadge = sslMode;
+    if (sslMode === 'verify-full') {
+      modeColor = 'green';
+      modeTooltip = 'Server certificate and hostname are both verified';
+    } else if (sslMode === 'verify-ca') {
+      modeColor = 'yellow';
+      modeTooltip =
+        'Server certificate is verified, but hostname is not checked';
+    } else {
+      modeColor = 'yellow';
+      modeTooltip = 'Connection is encrypted but the server is not verified';
+    }
+  }
+
+  let mtlsColor = 'gray';
+  let mtlsTooltip = 'Mutual authentication is not active';
+  if (enabled && mtls) {
+    mtlsColor = 'green';
+    mtlsTooltip = 'Both client and server verify each other with certificates';
+  }
+
+  return (
+    <TlsServiceCard serviceName="PostgreSQL">
+      <TlsOption
+        label="Encryption"
+        description="Encrypt traffic between Dispatcharr and PostgreSQL."
+        tooltip={
+          enabled
+            ? 'The connection is encrypted'
+            : 'The connection is not encrypted'
+        }
+        badgeText={enabled ? 'Enabled' : 'Disabled'}
+        badgeColor={enabled ? 'green' : 'gray'}
+      />
+      <TlsOption
+        label="Verification Mode"
+        description="How strictly to verify the PostgreSQL server's identity."
+        tooltip={modeTooltip}
+        badgeText={modeBadge}
+        badgeColor={modeColor}
+      />
+      <TlsOption
+        label="Mutual TLS"
+        description="Authenticate Dispatcharr to PostgreSQL using a client certificate."
+        tooltip={mtlsTooltip}
+        badgeText={mtls && enabled ? 'Active' : 'Inactive'}
+        badgeColor={mtlsColor}
+      />
+    </TlsServiceCard>
+  );
+};
+
+const ConnectionSecurityPanel = React.memo(() => {
+  const environment = useSettingsStore((s) => s.environment);
+  const isModular = environment.env_mode === 'modular';
+
+  return (
+    <Stack gap="md">
+      <Text size="sm" c="dimmed">
+        {isModular
+          ? 'Encrypt connections to Redis and PostgreSQL using environment variables in the docker compose file.'
+          : 'Connection encryption is only available in modular deployment mode with external services.'}
+      </Text>
+      {isModular && (
+        <SimpleGrid cols={{ base: 1, sm: 2 }} spacing="md">
+          <RedisStatus tls={environment.redis_tls} />
+          <PostgresStatus tls={environment.postgres_tls} />
+        </SimpleGrid>
+      )}
+    </Stack>
+  );
+});
+
+export default ConnectionSecurityPanel;
diff --git a/frontend/src/components/forms/settings/SystemSettingsForm.jsx b/frontend/src/components/forms/settings/SystemSettingsForm.jsx
index a8c8d45b..132830ff 100644
--- a/frontend/src/components/forms/settings/SystemSettingsForm.jsx
+++ b/frontend/src/components/forms/settings/SystemSettingsForm.jsx
@@ -5,7 +5,16 @@ import {
   parseSettings,
   saveChangedSettings,
 } from '../../../utils/pages/SettingsUtils.js';
-import { Alert, Button, Flex, NumberInput, Stack, Text } from '@mantine/core';
+import {
+  Alert,
+  Button,
+  Divider,
+  Flex,
+  NumberInput,
+  Stack,
+  Text,
+} from '@mantine/core';
+import ConnectionSecurityPanel from './ConnectionSecurityPanel.jsx';
 import { useForm } from '@mantine/form';
 import { getSystemSettingsFormInitialValues } from '../../../utils/forms/settings/SystemSettingsFormUtils.js';
 
@@ -68,6 +77,8 @@ const SystemSettingsForm = React.memo(({ active }) => {
         max={1000}
         step={10}
       />
+      <Divider my="md" label="Connection Security" labelPosition="left" />
+      <ConnectionSecurityPanel />
       <Flex mih={50} gap="xs" justify="flex-end" align="flex-end">
         <Button
           onClick={form.onSubmit(onSubmit)}
diff --git a/frontend/src/components/forms/settings/__tests__/SystemSettingsForm.test.jsx b/frontend/src/components/forms/settings/__tests__/SystemSettingsForm.test.jsx
index a3b156d5..f0b11231 100644
--- a/frontend/src/components/forms/settings/__tests__/SystemSettingsForm.test.jsx
+++ b/frontend/src/components/forms/settings/__tests__/SystemSettingsForm.test.jsx
@@ -16,6 +16,12 @@ vi.mock('../../../../utils/forms/settings/SystemSettingsFormUtils.js', () => ({
   getSystemSettingsFormInitialValues: vi.fn(),
 }));
 
+vi.mock('../ConnectionSecurityPanel.jsx', () => ({
+  default: () => (
+    <div data-testid="connection-security-panel">ConnectionSecurityPanel</div>
+  ),
+}));
+
 // ── Mantine form ───────────────────────────────────────────────────────────────
 vi.mock('@mantine/form', () => ({
   useForm: vi.fn(),
@@ -47,6 +53,7 @@ vi.mock('@mantine/core', () => ({
   ),
   Stack: ({ children }) => <div>{children}</div>,
   Text: ({ children }) => <span>{children}</span>,
+  Divider: () => <hr />,
 }));
 
 // ──────────────────────────────────────────────────────────────────────────────
diff --git a/frontend/src/store/__tests__/settings.test.jsx b/frontend/src/store/__tests__/settings.test.jsx
index 016fce07..9eee6f26 100644
--- a/frontend/src/store/__tests__/settings.test.jsx
+++ b/frontend/src/store/__tests__/settings.test.jsx
@@ -14,7 +14,7 @@ describe('useSettingsStore', () => {
         public_ip: '',
         country_code: '',
         country_name: '',
-        env_mode: 'prod',
+        env_mode: 'aio',
       },
       version: {
         version: '',
@@ -33,7 +33,7 @@ describe('useSettingsStore', () => {
       public_ip: '',
       country_code: '',
       country_name: '',
-      env_mode: 'prod',
+      env_mode: 'aio',
     });
     expect(result.current.isLoading).toBe(false);
     expect(result.current.error).toBe(null);
@@ -87,7 +87,7 @@ describe('useSettingsStore', () => {
       public_ip: '',
       country_code: '',
       country_name: '',
-      env_mode: 'prod',
+      env_mode: 'aio',
     });
   });
 
diff --git a/frontend/src/store/settings.jsx b/frontend/src/store/settings.jsx
index d7d46a3f..1b28f475 100644
--- a/frontend/src/store/settings.jsx
+++ b/frontend/src/store/settings.jsx
@@ -8,7 +8,7 @@ const useSettingsStore = create((set, get) => ({
     public_ip: '',
     country_code: '',
     country_name: '',
-    env_mode: 'prod',
+    env_mode: 'aio',
   },
   version: {
     version: '',
@@ -40,7 +40,7 @@ const useSettingsStore = create((set, get) => ({
           public_ip: '',
           country_code: '',
           country_name: '',
-          env_mode: 'prod',
+          env_mode: 'aio',
         },
       };
 
diff --git a/scripts/wait_for_redis.py b/scripts/wait_for_redis.py
index e1814411..9c2d6eaf 100644
--- a/scripts/wait_for_redis.py
+++ b/scripts/wait_for_redis.py
@@ -34,10 +34,49 @@ def _flush_non_celery_keys(client):
     logger.info(f"Modular mode: selectively cleared {deleted} non-Celery Redis key(s)")
 
 
+def _build_ssl_kwargs():
+    """Build Redis SSL kwargs from environment variables.
+
+    Validates that any configured certificate file paths exist on disk
+    and logs a summary of the active TLS configuration.
+    """
+    ssl_kwargs = {}
+    if os.environ.get("REDIS_SSL", "false").lower() == "true":
+        import ssl as _ssl
+        ssl_kwargs["ssl"] = True
+        ssl_kwargs["ssl_cert_reqs"] = (
+            _ssl.CERT_REQUIRED if os.environ.get("REDIS_SSL_VERIFY", "true").lower() == "true"
+            else _ssl.CERT_NONE
+        )
+        cert_paths = {
+            "REDIS_SSL_CA_CERT": os.environ.get("REDIS_SSL_CA_CERT", ""),
+            "REDIS_SSL_CERT": os.environ.get("REDIS_SSL_CERT", ""),
+            "REDIS_SSL_KEY": os.environ.get("REDIS_SSL_KEY", ""),
+        }
+        for env_var, path in cert_paths.items():
+            if path and not os.path.isfile(path):
+                logger.error(
+                    f"Redis TLS: {env_var}={path!r} — file not found. "
+                    f"Check that the certificate file exists and the volume is mounted correctly."
+                )
+                sys.exit(1)
+
+        if cert_paths["REDIS_SSL_CA_CERT"]:
+            ssl_kwargs["ssl_ca_certs"] = cert_paths["REDIS_SSL_CA_CERT"]
+        if cert_paths["REDIS_SSL_CERT"]:
+            ssl_kwargs["ssl_certfile"] = cert_paths["REDIS_SSL_CERT"]
+        if cert_paths["REDIS_SSL_KEY"]:
+            ssl_kwargs["ssl_keyfile"] = cert_paths["REDIS_SSL_KEY"]
+
+        logger.info("Redis TLS: enabled")
+    return ssl_kwargs
+
+
 def wait_for_redis(host='localhost', port=6379, db=0, password='', username='', max_retries=30, retry_interval=2):
     """Wait for Redis to become available"""
     redis_client = None
     retry_count = 0
+    ssl_kwargs = _build_ssl_kwargs()
 
     logger.info(f"Waiting for Redis at {host}:{port}/{db}...")
 
@@ -50,7 +89,8 @@ def wait_for_redis(host='localhost', port=6379, db=0, password='', username='',
                 password=password if password else None,
                 username=username if username else None,
                 socket_timeout=2,
-                socket_connect_timeout=2
+                socket_connect_timeout=2,
+                **ssl_kwargs
             )
             redis_client.ping()
             # Clear stale state on startup. In AIO mode, every service restarts
@@ -66,14 +106,16 @@ def wait_for_redis(host='localhost', port=6379, db=0, password='', username='',
             return True
         except (redis.exceptions.ConnectionError, redis.exceptions.TimeoutError) as e:
             retry_count += 1
+            _tls_hint = " (TLS is enabled — verify certificate paths and that Redis is configured for TLS)" if ssl_kwargs else ""
             if retry_count >= max_retries:
-                logger.error(f"❌ Failed to connect to Redis after {max_retries} attempts: {e}")
+                logger.error(f"❌ Failed to connect to Redis after {max_retries} attempts: {e}{_tls_hint}")
                 return False
 
             logger.info(f"⏳ Redis not available yet, retrying in {retry_interval}s... ({retry_count}/{max_retries})")
             time.sleep(retry_interval)
         except Exception as e:
-            logger.error(f"❌ Unexpected error connecting to Redis: {e}")
+            _tls_hint = " (TLS is enabled — verify certificate paths and that Redis is configured for TLS)" if ssl_kwargs else ""
+            logger.error(f"❌ Unexpected error connecting to Redis: {e}{_tls_hint}")
             return False
 
     return False

From 034f0623bf4442f2647b62cecf2fc3042e80f5a6 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Mon, 23 Mar 2026 17:48:35 -0500
Subject: [PATCH 16/67] fix(tasks): handle AttributeError in series rule
 evaluation lock acquisition and release

---
 apps/channels/tasks.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/channels/tasks.py b/apps/channels/tasks.py
index 449a3f4a..f619ec47 100755
--- a/apps/channels/tasks.py
+++ b/apps/channels/tasks.py
@@ -1084,7 +1084,7 @@ def evaluate_series_rules_impl(tvg_id: str | None = None):
         if not lock_acquired:
             result["details"].append({"status": "skipped", "reason": "concurrent evaluation in progress"})
             return result
-    except (ConnectionError, OSError):
+    except (ConnectionError, OSError, AttributeError):
         logger.warning("Could not acquire series rule evaluation lock (Redis unavailable), proceeding without lock")
 
     try:
@@ -1093,7 +1093,7 @@ def evaluate_series_rules_impl(tvg_id: str | None = None):
         if lock_acquired:
             try:
                 release_task_lock('evaluate_series_rules', 'all')
-            except (ConnectionError, OSError):
+            except (ConnectionError, OSError, AttributeError):
                 logger.warning("Could not release series rule evaluation lock")
 
 

From 3831d72d13ff3e0a23f4bee70607b308756ea9a3 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Mon, 23 Mar 2026 17:54:27 -0500
Subject: [PATCH 17/67] changelog: Update changelog for dvr recording pr.

---
 CHANGELOG.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bbc76777..61ad05d3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Duplicate recordings created when EPG sources refresh and re-evaluate series rules — Thanks [@CodeBormen](https://github.com/CodeBormen):
+  - **Program ID instability**: `parse_programs_for_source()` deletes and recreates all `ProgramData` rows with new auto-increment IDs on every EPG refresh. The dedup set used these IDs, so it never matched after a refresh. Deduplication now uses a stable `(tvg_id, start_time, end_time)` composite key sourced from `Recording.custom_properties.program`.
+  - **Secondary guard using wrong times**: The DB guard compared unadjusted program times against offset-adjusted `Recording.start_time`/`end_time`, so it never matched when any DVR pre/post offset was configured. It now queries `custom_properties__program__start_time/end_time` (the original, unadjusted program times stored at recording creation).
+  - **No concurrency guard**: Each EPG source refresh fired `evaluate_series_rules.delay()` independently. Concurrent tasks loaded the dedup set before others committed, allowing races. Evaluation is now serialized with `acquire_task_lock` (reusing the existing EPG task pattern). Gracefully degrades if Redis is unavailable — the primary and secondary dedup guards still protect. (Fixes #940)
+
 ## [0.21.1] - 2026-03-18
 
 ### Fixed

From 9da6f7794cc9a3f749577814b7c3b767a3b41b48 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Mon, 23 Mar 2026 18:26:52 -0500
Subject: [PATCH 18/67] fix: ensure PGID defaults to PUID when setting
 ownership for PostgreSQL SSL key (matching entrypoint.celery behavior.

---
 docker/entrypoint.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index 7365a300..33fe33dd 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -248,7 +248,7 @@ if [ -n "${POSTGRES_SSL_KEY:-}" ] && [ -f "$POSTGRES_SSL_KEY" ]; then
         cp "$POSTGRES_SSL_KEY" "$_fixed_key"
         chmod 600 "$_fixed_key"
         if [ "$(id -u)" = "0" ] && [ -n "${PUID:-}" ]; then
-            chown "${PUID}:${PGID}" "$_fixed_key"
+            chown "${PUID}:${PGID:-$PUID}" "$_fixed_key"
         fi
         export POSTGRES_SSL_KEY="$_fixed_key"
         # Update /etc/environment so login shells see the fixed path

From 516c2e478c6ae2bcd9d5d0ed47edae98b7e9fe00 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Mon, 23 Mar 2026 19:55:43 -0500
Subject: [PATCH 19/67] Conditionally render Connection Security panel based on
 deployment mode

---
 .../settings/ConnectionSecurityPanel.jsx      | 16 +++-----
 .../forms/settings/SystemSettingsForm.jsx     | 10 ++++-
 .../__tests__/SystemSettingsForm.test.jsx     | 37 +++++++++++++++++--
 3 files changed, 47 insertions(+), 16 deletions(-)

diff --git a/frontend/src/components/forms/settings/ConnectionSecurityPanel.jsx b/frontend/src/components/forms/settings/ConnectionSecurityPanel.jsx
index f8c9614a..9d6016d4 100644
--- a/frontend/src/components/forms/settings/ConnectionSecurityPanel.jsx
+++ b/frontend/src/components/forms/settings/ConnectionSecurityPanel.jsx
@@ -152,21 +152,17 @@ const PostgresStatus = ({ tls }) => {
 
 const ConnectionSecurityPanel = React.memo(() => {
   const environment = useSettingsStore((s) => s.environment);
-  const isModular = environment.env_mode === 'modular';
 
   return (
     <Stack gap="md">
       <Text size="sm" c="dimmed">
-        {isModular
-          ? 'Encrypt connections to Redis and PostgreSQL using environment variables in the docker compose file.'
-          : 'Connection encryption is only available in modular deployment mode with external services.'}
+        Encrypt connections to Redis and PostgreSQL using environment variables
+        in the docker compose file.
       </Text>
-      {isModular && (
-        <SimpleGrid cols={{ base: 1, sm: 2 }} spacing="md">
-          <RedisStatus tls={environment.redis_tls} />
-          <PostgresStatus tls={environment.postgres_tls} />
-        </SimpleGrid>
-      )}
+      <SimpleGrid cols={{ base: 1, sm: 2 }} spacing="md">
+        <RedisStatus tls={environment.redis_tls} />
+        <PostgresStatus tls={environment.postgres_tls} />
+      </SimpleGrid>
     </Stack>
   );
 });
diff --git a/frontend/src/components/forms/settings/SystemSettingsForm.jsx b/frontend/src/components/forms/settings/SystemSettingsForm.jsx
index 132830ff..5206bf97 100644
--- a/frontend/src/components/forms/settings/SystemSettingsForm.jsx
+++ b/frontend/src/components/forms/settings/SystemSettingsForm.jsx
@@ -20,6 +20,8 @@ import { getSystemSettingsFormInitialValues } from '../../../utils/forms/setting
 
 const SystemSettingsForm = React.memo(({ active }) => {
   const settings = useSettingsStore((s) => s.settings);
+  const isModular =
+    useSettingsStore((s) => s.environment.env_mode) === 'modular';
 
   const [saved, setSaved] = useState(false);
 
@@ -77,8 +79,12 @@ const SystemSettingsForm = React.memo(({ active }) => {
         max={1000}
         step={10}
       />
-      <Divider my="md" label="Connection Security" labelPosition="left" />
-      <ConnectionSecurityPanel />
+      {isModular && (
+        <>
+          <Divider my="md" label="Connection Security" labelPosition="left" />
+          <ConnectionSecurityPanel />
+        </>
+      )}
       <Flex mih={50} gap="xs" justify="flex-end" align="flex-end">
         <Button
           onClick={form.onSubmit(onSubmit)}
diff --git a/frontend/src/components/forms/settings/__tests__/SystemSettingsForm.test.jsx b/frontend/src/components/forms/settings/__tests__/SystemSettingsForm.test.jsx
index f0b11231..4b610e54 100644
--- a/frontend/src/components/forms/settings/__tests__/SystemSettingsForm.test.jsx
+++ b/frontend/src/components/forms/settings/__tests__/SystemSettingsForm.test.jsx
@@ -76,7 +76,15 @@ const makeSettings = (overrides = {}) => ({
   ...overrides,
 });
 
-const setupMocks = ({ settings = makeSettings() } = {}) => {
+const makeEnvironment = (overrides = {}) => ({
+  env_mode: 'aio',
+  ...overrides,
+});
+
+const setupMocks = ({
+  settings = makeSettings(),
+  environment = makeEnvironment(),
+} = {}) => {
   const formValues = { max_system_events: settings?.max_system_events ?? 100 };
 
   const formMock = {
@@ -92,7 +100,9 @@ const setupMocks = ({ settings = makeSettings() } = {}) => {
 
   vi.mocked(useForm).mockReturnValue(formMock);
   vi.mocked(getSystemSettingsFormInitialValues).mockReturnValue(formValues);
-  vi.mocked(useSettingsStore).mockImplementation((sel) => sel({ settings }));
+  vi.mocked(useSettingsStore).mockImplementation((sel) =>
+    sel({ settings, environment })
+  );
   vi.mocked(parseSettings).mockReturnValue(formValues);
   vi.mocked(getChangedSettings).mockReturnValue({
     max_system_events: settings?.max_system_events ?? 100,
@@ -155,6 +165,22 @@ describe('SystemSettingsForm', () => {
       expect(screen.queryByTestId('alert')).not.toBeInTheDocument();
     });
 
+    it('does not render Connection Security panel in non-modular mode', () => {
+      setupMocks({ environment: makeEnvironment({ env_mode: 'aio' }) });
+      render(<SystemSettingsForm active={true} />);
+      expect(
+        screen.queryByTestId('connection-security-panel')
+      ).not.toBeInTheDocument();
+    });
+
+    it('renders Connection Security panel in modular mode', () => {
+      setupMocks({ environment: makeEnvironment({ env_mode: 'modular' }) });
+      render(<SystemSettingsForm active={true} />);
+      expect(
+        screen.getByTestId('connection-security-panel')
+      ).toBeInTheDocument();
+    });
+
     it('renders NumberInput with value from form values', () => {
       setupMocks({ settings: makeSettings({ max_system_events: 250 }) });
       render(<SystemSettingsForm active={true} />);
@@ -174,7 +200,10 @@ describe('SystemSettingsForm', () => {
       vi.mocked(useForm).mockReturnValue(formMock);
       vi.mocked(getSystemSettingsFormInitialValues).mockReturnValue(formValues);
       vi.mocked(useSettingsStore).mockImplementation((sel) =>
-        sel({ settings: makeSettings({ max_system_events: 0 }) })
+        sel({
+          settings: makeSettings({ max_system_events: 0 }),
+          environment: makeEnvironment(),
+        })
       );
       vi.mocked(parseSettings).mockReturnValue(formValues);
       vi.mocked(getChangedSettings).mockReturnValue({});
@@ -218,7 +247,7 @@ describe('SystemSettingsForm', () => {
         max_system_events: 100,
       });
       vi.mocked(useSettingsStore).mockImplementation((sel) =>
-        sel({ settings: null })
+        sel({ settings: null, environment: makeEnvironment() })
       );
       vi.mocked(parseSettings).mockReturnValue({});
       vi.mocked(saveChangedSettings).mockResolvedValue(undefined);

From 99fe8c96a2aef75a284d902a17e2a54eb6dd863f Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Tue, 24 Mar 2026 12:39:09 -0500
Subject: [PATCH 20/67] refactor: Move utility functions from
 pages/guideUtils.js to utils/guideUtils.js and update imports

---
 CHANGELOG.md                                  |   1 +
 frontend/src/components/GuideRow.jsx          |   2 +-
 frontend/src/components/HourTimeline.jsx      |   2 +-
 .../src/components/ProgramDetailModal.jsx     |   2 +-
 .../components/__tests__/GuideRow.test.jsx    |   2 +-
 .../__tests__/HourTimeline.test.jsx           |  49 +++++---
 frontend/src/pages/Guide.jsx                  | 105 +++++++++++-------
 frontend/src/pages/__tests__/Guide.test.jsx   |  13 ++-
 .../src/utils/cards/RecordingCardUtils.js     |   5 +-
 frontend/src/{pages => utils}/guideUtils.js   |   0
 10 files changed, 116 insertions(+), 65 deletions(-)
 rename frontend/src/{pages => utils}/guideUtils.js (100%)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 61ad05d3..4b4aa7bf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Moved `guideUtils.js` from `frontend/src/pages/` to `frontend/src/utils/` to be consistent with other utility modules (e.g. `networkUtils.js`). Updated all imports across `GuideRow.jsx`, `HourTimeline.jsx`, `ProgramDetailModal.jsx`, `RecordingCardUtils.js`, `Guide.jsx`, and related test files.
 - Frontend cleanup: removed unused imports from `M3UGroupFilter`, `LiveGroupFilter`, and `VODCategoryFilter` (`Yup`, `M3UProfiles`, several unused Mantine components, dead `OptionWithTooltip` component, duplicate lucide-react imports, and `Divider` in `VODCategoryFilter`). No behaviour changes.
 - Network Access settings: leaving a field blank no longer shows a validation error. The default CIDR range for that field is saved automatically and a "Defaults Restored" warning is displayed listing which fields were reset. (Closes #726)
 
diff --git a/frontend/src/components/GuideRow.jsx b/frontend/src/components/GuideRow.jsx
index a1cdaed9..a13ddcdf 100644
--- a/frontend/src/components/GuideRow.jsx
+++ b/frontend/src/components/GuideRow.jsx
@@ -5,7 +5,7 @@ import {
   MINUTE_BLOCK_WIDTH,
   MINUTE_INCREMENT,
   PROGRAM_HEIGHT,
-} from '../pages/guideUtils.js';
+} from '../utils/guideUtils.js';
 import { Box, Flex, Text, Tooltip } from '@mantine/core';
 import { Play } from 'lucide-react';
 import logo from '../images/logo.png';
diff --git a/frontend/src/components/HourTimeline.jsx b/frontend/src/components/HourTimeline.jsx
index 0d5e70b4..5e1fc621 100644
--- a/frontend/src/components/HourTimeline.jsx
+++ b/frontend/src/components/HourTimeline.jsx
@@ -1,7 +1,7 @@
 import React from 'react';
 import { Box, Text } from '@mantine/core';
 import { format } from '../utils/dateTimeUtils.js';
-import { HOUR_WIDTH } from '../pages/guideUtils.js';
+import { HOUR_WIDTH } from '../utils/guideUtils.js';
 
 const HourBlock = React.memo(
   ({ hourData, timeFormat, formatDayLabel, handleTimeClick }) => {
diff --git a/frontend/src/components/ProgramDetailModal.jsx b/frontend/src/components/ProgramDetailModal.jsx
index 07ff77e0..89388cb4 100644
--- a/frontend/src/components/ProgramDetailModal.jsx
+++ b/frontend/src/components/ProgramDetailModal.jsx
@@ -16,7 +16,7 @@ import API from '../api';
 import useVideoStore from '../store/useVideoStore';
 import useSettingsStore from '../store/settings';
 import { getShowVideoUrl } from '../utils/cards/RecordingCardUtils';
-import { formatSeasonEpisode } from '../pages/guideUtils';
+import { formatSeasonEpisode } from '../utils/guideUtils';
 import {
   format,
   initializeTime,
diff --git a/frontend/src/components/__tests__/GuideRow.test.jsx b/frontend/src/components/__tests__/GuideRow.test.jsx
index a78d6978..703ff76a 100644
--- a/frontend/src/components/__tests__/GuideRow.test.jsx
+++ b/frontend/src/components/__tests__/GuideRow.test.jsx
@@ -6,7 +6,7 @@ import {
   CHANNEL_WIDTH,
   HOUR_WIDTH,
   PROGRAM_HEIGHT,
-} from '../../pages/guideUtils';
+} from '../../utils/guideUtils';
 
 // Mock logo import
 vi.mock('../../images/logo.png', () => ({
diff --git a/frontend/src/components/__tests__/HourTimeline.test.jsx b/frontend/src/components/__tests__/HourTimeline.test.jsx
index 372ec155..393e559e 100644
--- a/frontend/src/components/__tests__/HourTimeline.test.jsx
+++ b/frontend/src/components/__tests__/HourTimeline.test.jsx
@@ -3,7 +3,7 @@ import { render, screen, fireEvent } from '@testing-library/react';
 import '@testing-library/jest-dom';
 import HourTimeline from '../HourTimeline';
 import { format } from '../../utils/dateTimeUtils';
-import { HOUR_WIDTH } from '../../pages/guideUtils';
+import { HOUR_WIDTH } from '../../utils/guideUtils';
 
 // Mock date utilities
 vi.mock('../../utils/dateTimeUtils', () => ({
@@ -108,7 +108,9 @@ describe('HourTimeline', () => {
         />
       );
 
-      const hourBlocks = container.querySelectorAll('[style*="cursor: pointer"]');
+      const hourBlocks = container.querySelectorAll(
+        '[style*="cursor: pointer"]'
+      );
       hourBlocks.forEach((block) => {
         expect(block).toHaveAttribute('w', `${HOUR_WIDTH}`);
         expect(block).toHaveAttribute('h', '40px');
@@ -126,16 +128,16 @@ describe('HourTimeline', () => {
         />
       );
 
-      const hourBlocks = container.querySelectorAll('[style*="cursor: pointer"]');
+      const hourBlocks = container.querySelectorAll(
+        '[style*="cursor: pointer"]'
+      );
       expect(hourBlocks[0]).toHaveStyle({
         backgroundColor: '#1B2421',
       });
     });
 
     it('should apply special styling for new day blocks', () => {
-      const newDayTimeline = [
-        { time: mockTime3, isNewDay: true },
-      ];
+      const newDayTimeline = [{ time: mockTime3, isNewDay: true }];
 
       const { container } = render(
         <HourTimeline
@@ -154,9 +156,7 @@ describe('HourTimeline', () => {
     });
 
     it('should apply bold font weight to day label on new day', () => {
-      const newDayTimeline = [
-        { time: mockTime3, isNewDay: true },
-      ];
+      const newDayTimeline = [{ time: mockTime3, isNewDay: true }];
 
       const { container } = render(
         <HourTimeline
@@ -198,7 +198,9 @@ describe('HourTimeline', () => {
         />
       );
 
-      const markers = container.querySelectorAll('[style*="background-color: rgb(113, 128, 150);"]');
+      const markers = container.querySelectorAll(
+        '[style*="background-color: rgb(113, 128, 150);"]'
+      );
       expect(markers.length).toBe(3); // 15, 30, 45 minute markers
     });
 
@@ -212,7 +214,9 @@ describe('HourTimeline', () => {
         />
       );
 
-      const markers = container.querySelectorAll('[style*="backgroundColor: #718096"]');
+      const markers = container.querySelectorAll(
+        '[style*="backgroundColor: #718096"]'
+      );
       const positions = ['25%', '50%', '75%'];
 
       markers.forEach((marker, index) => {
@@ -238,10 +242,15 @@ describe('HourTimeline', () => {
         />
       );
 
-      const hourBlocks = container.querySelectorAll('[style*="cursor: pointer"]');
+      const hourBlocks = container.querySelectorAll(
+        '[style*="cursor: pointer"]'
+      );
       fireEvent.click(hourBlocks[0]);
 
-      expect(mockHandleTimeClick).toHaveBeenCalledWith(mockTime1, expect.any(Object));
+      expect(mockHandleTimeClick).toHaveBeenCalledWith(
+        mockTime1,
+        expect.any(Object)
+      );
     });
 
     it('should call handleTimeClick with correct time for each block', () => {
@@ -254,13 +263,21 @@ describe('HourTimeline', () => {
         />
       );
 
-      const hourBlocks = container.querySelectorAll('[style*="cursor: pointer"]');
+      const hourBlocks = container.querySelectorAll(
+        '[style*="cursor: pointer"]'
+      );
 
       fireEvent.click(hourBlocks[0]);
-      expect(mockHandleTimeClick).toHaveBeenCalledWith(mockTime1, expect.any(Object));
+      expect(mockHandleTimeClick).toHaveBeenCalledWith(
+        mockTime1,
+        expect.any(Object)
+      );
 
       fireEvent.click(hourBlocks[1]);
-      expect(mockHandleTimeClick).toHaveBeenCalledWith(mockTime2, expect.any(Object));
+      expect(mockHandleTimeClick).toHaveBeenCalledWith(
+        mockTime2,
+        expect.any(Object)
+      );
     });
   });
 
diff --git a/frontend/src/pages/Guide.jsx b/frontend/src/pages/Guide.jsx
index 81171637..1132bc3d 100644
--- a/frontend/src/pages/Guide.jsx
+++ b/frontend/src/pages/Guide.jsx
@@ -66,7 +66,7 @@ import {
   PX_PER_MS,
   calcProgressPct,
   sortChannels,
-} from './guideUtils';
+} from '../utils/guideUtils';
 import API from '../api';
 import { getShowVideoUrl } from '../utils/cards/RecordingCardUtils.js';
 import {
@@ -387,7 +387,8 @@ export default function TVChannelGuide({ startDate, endDate }) {
       }
     };
     document.addEventListener('visibilitychange', handleVisibilityChange);
-    return () => document.removeEventListener('visibilitychange', handleVisibilityChange);
+    return () =>
+      document.removeEventListener('visibilitychange', handleVisibilityChange);
   }, []);
 
   // Pixel offset for the "now" vertical line
@@ -863,7 +864,8 @@ export default function TVChannelGuide({ startDate, endDate }) {
         (startOffsetMinutes / MINUTE_INCREMENT) * MINUTE_BLOCK_WIDTH;
 
       const widthPx =
-        (durationMinutes / MINUTE_INCREMENT) * MINUTE_BLOCK_WIDTH - PROGRAM_GAP_PX * 2;
+        (durationMinutes / MINUTE_INCREMENT) * MINUTE_BLOCK_WIDTH -
+        PROGRAM_GAP_PX * 2;
 
       const recording = recordingsByProgramId.get(program.id);
 
@@ -960,14 +962,25 @@ export default function TVChannelGuide({ startDate, endDate }) {
               </Text>
 
               {/* Row 2: S/E badge + Subtitle or description fallback */}
-              {(seasonEpisodeLabel || program.sub_title || program.description) && (
-                <Group gap={4} wrap="nowrap" style={{ overflow: 'hidden', minWidth: 0 }}>
+              {(seasonEpisodeLabel ||
+                program.sub_title ||
+                program.description) && (
+                <Group
+                  gap={4}
+                  wrap="nowrap"
+                  style={{ overflow: 'hidden', minWidth: 0 }}
+                >
                   {seasonEpisodeLabel && (
                     <Badge
                       size="xs"
                       variant="light"
                       color="cyan"
-                      styles={{ root: { backgroundColor: 'rgba(20,90,110,0.55)', flexShrink: 0 } }}
+                      styles={{
+                        root: {
+                          backgroundColor: 'rgba(20,90,110,0.55)',
+                          flexShrink: 0,
+                        },
+                      }}
                     >
                       {seasonEpisodeLabel}
                     </Badge>
@@ -1007,7 +1020,12 @@ export default function TVChannelGuide({ startDate, endDate }) {
                     size="xs"
                     variant="light"
                     color="red"
-                    styles={{ root: { backgroundColor: 'rgba(120,20,20,0.55)', flexShrink: 0 } }}
+                    styles={{
+                      root: {
+                        backgroundColor: 'rgba(120,20,20,0.55)',
+                        flexShrink: 0,
+                      },
+                    }}
                   >
                     LIVE
                   </Badge>
@@ -1017,7 +1035,12 @@ export default function TVChannelGuide({ startDate, endDate }) {
                     size="xs"
                     variant="light"
                     color="green"
-                    styles={{ root: { backgroundColor: 'rgba(20,100,20,0.55)', flexShrink: 0 } }}
+                    styles={{
+                      root: {
+                        backgroundColor: 'rgba(20,100,20,0.55)',
+                        flexShrink: 0,
+                      },
+                    }}
                   >
                     NEW
                   </Badge>
@@ -1026,39 +1049,44 @@ export default function TVChannelGuide({ startDate, endDate }) {
             </Box>
 
             {/* Progress bar for currently-airing programs — updated every second via DOM */}
-            {isLive && (() => {
-              const durationMs = programEndMs - programStartMs;
-              if (durationMs <= 0) return null;
-              const initialPct = calcProgressPct(Date.now(), programStartMs, durationMs);
-              return (
-                <Box
-                  pos="absolute"
-                  bottom={0}
-                  left={0}
-                  right={0}
-                  h={4}
-                  style={{
-                    backgroundColor: 'rgba(255, 255, 255, 0.1)',
-                    borderRadius: '0 0 8px 8px',
-                    overflow: 'hidden',
-                  }}
-                >
+            {isLive &&
+              (() => {
+                const durationMs = programEndMs - programStartMs;
+                if (durationMs <= 0) return null;
+                const initialPct = calcProgressPct(
+                  Date.now(),
+                  programStartMs,
+                  durationMs
+                );
+                return (
                   <Box
-                    className="guide-progress-fill"
-                    data-start-ms={programStartMs}
-                    data-end-ms={programEndMs}
-                    h="100%"
+                    pos="absolute"
+                    bottom={0}
+                    left={0}
+                    right={0}
+                    h={4}
                     style={{
-                      width: '100%',
-                      backgroundColor: 'rgba(255, 255, 255, 0.5)',
-                      borderRadius: '0 0 0 8px',
-                      transformOrigin: 'left',
-                      transform: `scaleX(${initialPct})`,
+                      backgroundColor: 'rgba(255, 255, 255, 0.1)',
+                      borderRadius: '0 0 8px 8px',
+                      overflow: 'hidden',
                     }}
-                  />
-                </Box>
-              );
-            })()}
+                  >
+                    <Box
+                      className="guide-progress-fill"
+                      data-start-ms={programStartMs}
+                      data-end-ms={programEndMs}
+                      h="100%"
+                      style={{
+                        width: '100%',
+                        backgroundColor: 'rgba(255, 255, 255, 0.5)',
+                        borderRadius: '0 0 0 8px',
+                        transformOrigin: 'left',
+                        transform: `scaleX(${initialPct})`,
+                      }}
+                    />
+                  </Box>
+                );
+              })()}
           </Paper>
         </Box>
       );
@@ -1354,7 +1382,6 @@ export default function TVChannelGuide({ startDate, endDate }) {
                 />
               </Box>
             </Box>
-
           </Box>
         </Box>
 
diff --git a/frontend/src/pages/__tests__/Guide.test.jsx b/frontend/src/pages/__tests__/Guide.test.jsx
index 07ef1eeb..c6577006 100644
--- a/frontend/src/pages/__tests__/Guide.test.jsx
+++ b/frontend/src/pages/__tests__/Guide.test.jsx
@@ -10,7 +10,7 @@ import useSettingsStore from '../../store/settings';
 import useVideoStore from '../../store/useVideoStore';
 import useLocalStorage from '../../hooks/useLocalStorage';
 import { showNotification } from '../../utils/notificationUtils.js';
-import * as guideUtils from '../guideUtils';
+import * as guideUtils from '../../utils/guideUtils';
 import * as recordingCardUtils from '../../utils/cards/RecordingCardUtils.js';
 import * as dateTimeUtils from '../../utils/dateTimeUtils.js';
 import userEvent from '@testing-library/user-event';
@@ -127,7 +127,12 @@ vi.mock('@mantine/core', async () => {
       </select>
     ),
     Badge: ({ children, size, variant, color, style }) => (
-      <span data-size={size} data-variant={variant} data-color={color} style={style}>
+      <span
+        data-size={size}
+        data-variant={variant}
+        data-color={color}
+        style={style}
+      >
         {children}
       </span>
     ),
@@ -208,8 +213,8 @@ vi.mock('../../components/ProgramDetailModal', () => ({
     ) : null,
 }));
 
-vi.mock('../guideUtils', async () => {
-  const actual = await vi.importActual('../guideUtils');
+vi.mock('../../utils/guideUtils', async () => {
+  const actual = await vi.importActual('../../utils/guideUtils');
   return {
     ...actual,
     fetchPrograms: vi.fn(),
diff --git a/frontend/src/utils/cards/RecordingCardUtils.js b/frontend/src/utils/cards/RecordingCardUtils.js
index 43e3fb95..48e14393 100644
--- a/frontend/src/utils/cards/RecordingCardUtils.js
+++ b/frontend/src/utils/cards/RecordingCardUtils.js
@@ -1,7 +1,7 @@
 import API from '../../api.js';
 import useChannelsStore from '../../store/channels.jsx';
 import defaultLogo from '../../images/logo.png';
-import { formatSeasonEpisode } from '../../pages/guideUtils.js';
+import { formatSeasonEpisode } from '../guideUtils.js';
 
 export const removeRecording = (id) => {
   // Optimistically remove immediately from UI
@@ -111,7 +111,8 @@ export const getRecordingUrl = (customProps, env_mode) => {
 };
 
 export const getSeasonLabel = (season, episode, onscreen) => {
-  if (season != null && episode != null) return formatSeasonEpisode(season, episode);
+  if (season != null && episode != null)
+    return formatSeasonEpisode(season, episode);
   return onscreen || null;
 };
 
diff --git a/frontend/src/pages/guideUtils.js b/frontend/src/utils/guideUtils.js
similarity index 100%
rename from frontend/src/pages/guideUtils.js
rename to frontend/src/utils/guideUtils.js

From 0ac8b21964a43f398eadef123b900daa7fda5b75 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Tue, 24 Mar 2026 12:53:08 -0500
Subject: [PATCH 21/67] =?UTF-8?q?Enhancement:=20M3U=20table=20**Max=20Stre?=
 =?UTF-8?q?ams**=20column=20now=20reflects=20the=20combined=20limit=20acro?=
 =?UTF-8?q?ss=20all=20active=20profiles.=20When=20a=20playlist=20has=20mul?=
 =?UTF-8?q?tiple=20active=20profiles,=20the=20column=20displays=20their=20?=
 =?UTF-8?q?summed=20total=20(or=20=E2=88=9E=20if=20any=20profile=20is=20un?=
 =?UTF-8?q?limited)=20and=20a=20hover=20tooltip=20lists=20each=20profile's?=
 =?UTF-8?q?=20individual=20limit=20by=20name.=20(Closes=20#816)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md                                 |  1 +
 frontend/src/components/tables/M3UsTable.jsx | 40 ++++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4b4aa7bf..68d58355 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- M3U table **Max Streams** column now reflects the combined limit across all active profiles. When a playlist has multiple active profiles, the column displays their summed total (or ∞ if any profile is unlimited) and a hover tooltip lists each profile's individual limit by name. (Closes #816)
 - Moved `guideUtils.js` from `frontend/src/pages/` to `frontend/src/utils/` to be consistent with other utility modules (e.g. `networkUtils.js`). Updated all imports across `GuideRow.jsx`, `HourTimeline.jsx`, `ProgramDetailModal.jsx`, `RecordingCardUtils.js`, `Guide.jsx`, and related test files.
 - Frontend cleanup: removed unused imports from `M3UGroupFilter`, `LiveGroupFilter`, and `VODCategoryFilter` (`Yup`, `M3UProfiles`, several unused Mantine components, dead `OptionWithTooltip` component, duplicate lucide-react imports, and `Divider` in `VODCategoryFilter`). No behaviour changes.
 - Network Access settings: leaving a field blank no longer shows a validation error. The default CIDR range for that field is saved automatically and a "Defaults Restored" warning is displayed listing which fields were reset. (Closes #726)
diff --git a/frontend/src/components/tables/M3UsTable.jsx b/frontend/src/components/tables/M3UsTable.jsx
index 99aeed9b..4db3fb3f 100644
--- a/frontend/src/components/tables/M3UsTable.jsx
+++ b/frontend/src/components/tables/M3UsTable.jsx
@@ -588,6 +588,46 @@ const M3UTable = () => {
         accessorKey: 'max_streams',
         sortable: true,
         size: 125,
+        cell: ({ cell, row }) => {
+          const profiles = row.original.profiles || [];
+          const activeProfiles = profiles.filter((p) => p.is_active);
+
+          if (activeProfiles.length <= 1) {
+            const val = cell.getValue();
+            return <Text size="xs">{val === 0 ? '∞' : val}</Text>;
+          }
+
+          const hasUnlimited = activeProfiles.some((p) => p.max_streams === 0);
+          const total = hasUnlimited
+            ? null
+            : activeProfiles.reduce((sum, p) => sum + p.max_streams, 0);
+
+          const tooltipLines = activeProfiles
+            .map(
+              (p) =>
+                `${p.name}: ${p.max_streams === 0 ? 'Unlimited' : p.max_streams}`
+            )
+            .join('\n');
+
+          return (
+            <Tooltip
+              label={tooltipLines}
+              multiline
+              width={220}
+              style={{ whiteSpace: 'pre-line' }}
+            >
+              <Text
+                size="xs"
+                style={{
+                  cursor: 'default',
+                  textDecoration: 'underline dotted',
+                }}
+              >
+                {hasUnlimited ? '∞' : total}
+              </Text>
+            </Tooltip>
+          );
+        },
       },
       {
         header: 'Expiration',

From 1246f75c6b8b6042620000c305c5ec5183ca54ec Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Tue, 24 Mar 2026 13:03:19 -0500
Subject: [PATCH 22/67] Enhancement: Toggling an M3U profile's active state now
 immediately updates the playlist store (including the `playlists` array), so
 the **Max Streams** total in the M3U table reflects the change without a page
 reload. - M3U account form: **Max Streams** field changed from a plain text
 input to a number input with increment/decrement controls, consistent with
 other integer fields. - M3U account form: removed unused `useMantineTheme`
 import and `theme` variable.

---
 CHANGELOG.md                          | 3 +++
 frontend/src/api.js                   | 4 +---
 frontend/src/components/forms/M3U.jsx | 6 ++----
 3 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 68d58355..2346a6e4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - M3U table **Max Streams** column now reflects the combined limit across all active profiles. When a playlist has multiple active profiles, the column displays their summed total (or ∞ if any profile is unlimited) and a hover tooltip lists each profile's individual limit by name. (Closes #816)
+- Toggling an M3U profile's active state now immediately updates the playlist store (including the `playlists` array), so the **Max Streams** total in the M3U table reflects the change without a page reload.
+- M3U account form: **Max Streams** field changed from a plain text input to a number input with increment/decrement controls, consistent with other integer fields.
+- M3U account form: removed unused `useMantineTheme` import and `theme` variable.
 - Moved `guideUtils.js` from `frontend/src/pages/` to `frontend/src/utils/` to be consistent with other utility modules (e.g. `networkUtils.js`). Updated all imports across `GuideRow.jsx`, `HourTimeline.jsx`, `ProgramDetailModal.jsx`, `RecordingCardUtils.js`, `Guide.jsx`, and related test files.
 - Frontend cleanup: removed unused imports from `M3UGroupFilter`, `LiveGroupFilter`, and `VODCategoryFilter` (`Yup`, `M3UProfiles`, several unused Mantine components, dead `OptionWithTooltip` component, duplicate lucide-react imports, and `Divider` in `VODCategoryFilter`). No behaviour changes.
 - Network Access settings: leaving a field blank no longer shows a validation error. The default CIDR range for that field is saved automatically and a "Defaults Restored" warning is displayed listing which fields were reset. (Closes #726)
diff --git a/frontend/src/api.js b/frontend/src/api.js
index b1c103d8..3d66eae2 100644
--- a/frontend/src/api.js
+++ b/frontend/src/api.js
@@ -1601,9 +1601,7 @@ export default class API {
       });
 
       const playlist = await API.getPlaylist(accountId);
-      usePlaylistsStore
-        .getState()
-        .updateProfiles(playlist.id, playlist.profiles);
+      usePlaylistsStore.getState().updatePlaylist(playlist);
     } catch (e) {
       errorNotification(`Failed to update profile for account ${accountId}`, e);
     }
diff --git a/frontend/src/components/forms/M3U.jsx b/frontend/src/components/forms/M3U.jsx
index c8caeaef..3a5b7c2e 100644
--- a/frontend/src/components/forms/M3U.jsx
+++ b/frontend/src/components/forms/M3U.jsx
@@ -12,7 +12,6 @@ import {
   Flex,
   Select,
   FileInput,
-  useMantineTheme,
   NumberInput,
   Divider,
   Stack,
@@ -37,8 +36,6 @@ const M3U = ({
   onClose,
   playlistCreated = false,
 }) => {
-  const theme = useMantineTheme();
-
   const userAgents = useUserAgentsStore((s) => s.userAgents);
   const fetchChannelGroups = useChannelsStore((s) => s.fetchChannelGroups);
   const fetchEPGs = useEPGsStore((s) => s.fetchEPGs);
@@ -398,13 +395,14 @@ const M3U = ({
             <Divider size="sm" orientation="vertical" />
 
             <Stack gap="5" style={{ flex: 1 }}>
-              <TextInput
+              <NumberInput
                 style={{ width: '100%' }}
                 id="max_streams"
                 name="max_streams"
                 label="Max Streams"
                 placeholder="0 = Unlimited"
                 description="Maximum number of concurrent streams (0 for unlimited)"
+                min={0}
                 {...form.getInputProps('max_streams')}
                 key={form.key('max_streams')}
               />

From ec876716c58792482c7a7cc7a37ebf71fd5d65aa Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Tue, 24 Mar 2026 13:08:45 -0500
Subject: [PATCH 23/67] tests: Fix tests that use guide utils.

---
 .../src/pages/__tests__/guideUtils.test.js    | 27 ++++++++++++++-----
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/frontend/src/pages/__tests__/guideUtils.test.js b/frontend/src/pages/__tests__/guideUtils.test.js
index 14d03745..0c7f5cd4 100644
--- a/frontend/src/pages/__tests__/guideUtils.test.js
+++ b/frontend/src/pages/__tests__/guideUtils.test.js
@@ -1,7 +1,7 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import dayjs from 'dayjs';
 import utc from 'dayjs/plugin/utc';
-import * as guideUtils from '../guideUtils';
+import * as guideUtils from '../../utils/guideUtils';
 import * as dateTimeUtils from '../../utils/dateTimeUtils';
 import API from '../../api';
 
@@ -676,11 +676,26 @@ describe('guideUtils', () => {
 
     it('should exclude terminal status recordings', () => {
       const recordings = [
-        { id: 1, custom_properties: { program: { id: 'p1' }, status: 'completed' } },
-        { id: 2, custom_properties: { program: { id: 'p2' }, status: 'stopped' } },
-        { id: 3, custom_properties: { program: { id: 'p3' }, status: 'interrupted' } },
-        { id: 4, custom_properties: { program: { id: 'p4' }, status: 'failed' } },
-        { id: 5, custom_properties: { program: { id: 'p5' }, status: 'recording' } },
+        {
+          id: 1,
+          custom_properties: { program: { id: 'p1' }, status: 'completed' },
+        },
+        {
+          id: 2,
+          custom_properties: { program: { id: 'p2' }, status: 'stopped' },
+        },
+        {
+          id: 3,
+          custom_properties: { program: { id: 'p3' }, status: 'interrupted' },
+        },
+        {
+          id: 4,
+          custom_properties: { program: { id: 'p4' }, status: 'failed' },
+        },
+        {
+          id: 5,
+          custom_properties: { program: { id: 'p5' }, status: 'recording' },
+        },
         { id: 6, custom_properties: { program: { id: 'p6' } } },
       ];
 

From 58f40ff27662f32edecda06f919d778c2e70a29a Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Tue, 24 Mar 2026 13:19:48 -0500
Subject: [PATCH 24/67] Bug Fix: Fixed stale references to old guideutils
 location. Also change dockerfile to get clear error messages during failure.

---
 docker/Dockerfile                                         | 8 ++++----
 .../src/components/__tests__/ProgramDetailModal.test.jsx  | 5 +++--
 frontend/src/components/forms/ProgramRecordingModal.jsx   | 2 +-
 frontend/src/components/forms/SeriesRecordingModal.jsx    | 2 +-
 4 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index 3e30a825..596c4025 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -12,7 +12,7 @@ COPY ./frontend /app/frontend
 # remove any node_modules that may have been copied from the host (x86)
 RUN rm -rf node_modules || true; \
     npm install --no-audit --progress=false;
-RUN    npm run build; \
+RUN    npm run build && \
     rm -rf node_modules .cache
 
 # --- Redeclare build arguments for the next stage ---
@@ -32,9 +32,9 @@ COPY . /app
 COPY ./docker/nginx.conf /etc/nginx/sites-enabled/default
 # Fix line endings and make entrypoint scripts executable
 RUN for f in /app/docker/entrypoint*.sh; do \
-        if [ -f "$f" ]; then \
-            sed -i 's/\r$//' "$f" && chmod +x "$f"; \
-        fi; \
+    if [ -f "$f" ]; then \
+    sed -i 's/\r$//' "$f" && chmod +x "$f"; \
+    fi; \
     done
 # Clean out existing frontend folder
 RUN rm -rf /app/frontend
diff --git a/frontend/src/components/__tests__/ProgramDetailModal.test.jsx b/frontend/src/components/__tests__/ProgramDetailModal.test.jsx
index 11e65823..0127d8f9 100644
--- a/frontend/src/components/__tests__/ProgramDetailModal.test.jsx
+++ b/frontend/src/components/__tests__/ProgramDetailModal.test.jsx
@@ -21,9 +21,10 @@ vi.mock('../../utils/dateTimeUtils.js', () => ({
   useDateTimeFormat: vi.fn(() => ({ timeFormat: 'h:mm A' })),
 }));
 
-vi.mock('../../pages/guideUtils', () => ({
+vi.mock('../../utils/guideUtils', () => ({
   formatSeasonEpisode: vi.fn((s, e) => {
-    if (s != null && e != null) return `S${String(s).padStart(2, '0')}E${String(e).padStart(2, '0')}`;
+    if (s != null && e != null)
+      return `S${String(s).padStart(2, '0')}E${String(e).padStart(2, '0')}`;
     if (s != null) return `S${String(s).padStart(2, '0')}`;
     if (e != null) return `E${String(e).padStart(2, '0')}`;
     return null;
diff --git a/frontend/src/components/forms/ProgramRecordingModal.jsx b/frontend/src/components/forms/ProgramRecordingModal.jsx
index 294cb2aa..82da2674 100644
--- a/frontend/src/components/forms/ProgramRecordingModal.jsx
+++ b/frontend/src/components/forms/ProgramRecordingModal.jsx
@@ -2,7 +2,7 @@ import React from 'react';
 import { Modal, Flex, Button } from '@mantine/core';
 import { deleteRecordingById } from '../../utils/cards/RecordingCardUtils.js';
 import { deleteSeriesAndRule } from '../../utils/cards/RecordingCardUtils.js';
-import { deleteSeriesRuleByTvgId } from '../../pages/guideUtils.js';
+import { deleteSeriesRuleByTvgId } from '../../utils/guideUtils.js';
 
 export default function ProgramRecordingModal({
   opened,
diff --git a/frontend/src/components/forms/SeriesRecordingModal.jsx b/frontend/src/components/forms/SeriesRecordingModal.jsx
index f2e6d489..7b1951b2 100644
--- a/frontend/src/components/forms/SeriesRecordingModal.jsx
+++ b/frontend/src/components/forms/SeriesRecordingModal.jsx
@@ -5,7 +5,7 @@ import { deleteSeriesAndRule } from '../../utils/cards/RecordingCardUtils.js';
 import {
   evaluateSeriesRulesByTvgId,
   fetchRules,
-} from '../../pages/guideUtils.js';
+} from '../../utils/guideUtils.js';
 import { showNotification } from '../../utils/notificationUtils.js';
 
 export default function SeriesRecordingModal({

From 6d694c8475cb2b688bb92526dc9bb535d1602c49 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Tue, 24 Mar 2026 13:41:46 -0500
Subject: [PATCH 25/67] Bug Fix: Sort max stream column by total of streams
 from all profiles.

---
 frontend/src/components/tables/M3UsTable.jsx | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/frontend/src/components/tables/M3UsTable.jsx b/frontend/src/components/tables/M3UsTable.jsx
index 4db3fb3f..2b0e6168 100644
--- a/frontend/src/components/tables/M3UsTable.jsx
+++ b/frontend/src/components/tables/M3UsTable.jsx
@@ -585,15 +585,23 @@ const M3UTable = () => {
       },
       {
         header: 'Max Streams',
-        accessorKey: 'max_streams',
+        id: 'max_streams',
+        accessorFn: (row) => {
+          const activeProfiles = (row.profiles || []).filter(
+            (p) => p.is_active
+          );
+          if (activeProfiles.length === 0) return row.max_streams;
+          if (activeProfiles.some((p) => p.max_streams === 0)) return Infinity;
+          return activeProfiles.reduce((sum, p) => sum + p.max_streams, 0);
+        },
         sortable: true,
         size: 125,
-        cell: ({ cell, row }) => {
+        cell: ({ row }) => {
           const profiles = row.original.profiles || [];
           const activeProfiles = profiles.filter((p) => p.is_active);
 
           if (activeProfiles.length <= 1) {
-            const val = cell.getValue();
+            const val = row.original.max_streams;
             return <Text size="xs">{val === 0 ? '∞' : val}</Text>;
           }
 

From c005b1ac565a318abf74d16eefff06fa159e2eae Mon Sep 17 00:00:00 2001
From: None <190783071+CodeBormen@users.noreply.github.com>
Date: Tue, 24 Mar 2026 18:25:15 -0500
Subject: [PATCH 26/67] changelog: add TLS connection support for Redis and
 PostgreSQL (#950)

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a2300474..59ebb88f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- TLS and mutual TLS (mTLS) support for Redis and PostgreSQL connections in modular deployments. Supports encrypted connections, server certificate verification (Redis: on/off; PostgreSQL: verify-full, verify-ca, require), CA certificate configuration, and client certificate authentication. Configured via environment variables in the docker compose file. Includes startup validation for certificate paths and TLS/URL scheme conflicts, and a read-only Connection Security panel in System Settings. (Closes #950)
 - Status filter for M3U group and VOD category filter modals: A new **All / Enabled / Disabled** segmented control is now shown alongside the text search input in the Live, VOD - Movies, and VOD - Series tabs of the M3U Group Filter modal. The status filter works in combination with the text search and also scopes the "Select Visible" / "Deselect Visible" buttons so they only act on the currently visible subset. (Closes #312)
 
 ### Changed

From a19be96cedc24207762201b4131c908d39a26496 Mon Sep 17 00:00:00 2001
From: dekzter <kappa118@gmail.com>
Date: Wed, 25 Mar 2026 17:33:26 -0400
Subject: [PATCH 27/67] fleshed out user limits and termination logic

---
 apps/accounts/api_views.py                    |    9 +-
 .../migrations/0006_user_stream_limit.py      |   18 +
 apps/accounts/models.py                       |    1 +
 apps/accounts/serializers.py                  |    1 +
 apps/proxy/ts_proxy/client_manager.py         |    2 +-
 apps/proxy/ts_proxy/server.py                 |   16 +-
 apps/proxy/ts_proxy/views.py                  |    8 +
 apps/proxy/urls.py                            |    2 +-
 apps/proxy/utils.py                           |  185 +++
 apps/proxy/vod_proxy/connection_manager.py    |    2 +-
 .../multi_worker_connection_manager.py        |   37 +-
 apps/proxy/vod_proxy/urls.py                  |    9 +-
 apps/proxy/vod_proxy/views.py                 | 1193 +++++++++--------
 apps/vod/api_views.py                         |    1 -
 .../022_default_user_limit_settings.py        |   24 +
 core/models.py                                |   10 +
 core/utils.py                                 |   96 +-
 core/xtream_codes.py                          |    2 +-
 dispatcharr/urls.py                           |   10 +-
 frontend/src/api.js                           |   13 +-
 frontend/src/components/forms/User.jsx        |   41 +-
 .../forms/settings/UserLimitsForm.jsx         |  116 ++
 frontend/src/constants.js                     |   27 +
 frontend/src/pages/Settings.jsx               |   14 +
 24 files changed, 1129 insertions(+), 708 deletions(-)
 create mode 100644 apps/accounts/migrations/0006_user_stream_limit.py
 create mode 100644 apps/proxy/utils.py
 create mode 100644 core/migrations/022_default_user_limit_settings.py
 create mode 100644 frontend/src/components/forms/settings/UserLimitsForm.jsx

diff --git a/apps/accounts/api_views.py b/apps/accounts/api_views.py
index 76892929..c698f07a 100644
--- a/apps/accounts/api_views.py
+++ b/apps/accounts/api_views.py
@@ -287,11 +287,10 @@ class UserViewSet(viewsets.ModelViewSet):
         if request.method == "PATCH":
             ALLOWED_FIELDS = {"custom_properties", "first_name", "last_name", "email", "password"}
             disallowed = set(request.data.keys()) - ALLOWED_FIELDS
-            if disallowed:
-                return Response(
-                    {"detail": f"Fields not allowed for self-update: {', '.join(disallowed)}"},
-                    status=400,
-                )
+
+            for key in disallowed:
+                request.data.pop(key, None)
+
             serializer = UserSerializer(user, data=request.data, partial=True)
             serializer.is_valid(raise_exception=True)
             serializer.save()
diff --git a/apps/accounts/migrations/0006_user_stream_limit.py b/apps/accounts/migrations/0006_user_stream_limit.py
new file mode 100644
index 00000000..5714e1ef
--- /dev/null
+++ b/apps/accounts/migrations/0006_user_stream_limit.py
@@ -0,0 +1,18 @@
+# Generated by Django 5.2.11 on 2026-03-19 13:46
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0005_alter_user_managers'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='user',
+            name='stream_limit',
+            field=models.IntegerField(default=0),
+        ),
+    ]
diff --git a/apps/accounts/models.py b/apps/accounts/models.py
index e04d66ed..2a32f95a 100644
--- a/apps/accounts/models.py
+++ b/apps/accounts/models.py
@@ -30,6 +30,7 @@ class User(AbstractUser):
     user_level = models.IntegerField(default=UserLevel.STREAMER)
     custom_properties = models.JSONField(default=dict, blank=True, null=True)
     api_key = models.CharField(max_length=200, blank=True, null=True, db_index=True)
+    stream_limit = models.IntegerField(default=0)
 
     def __str__(self):
         return self.username
diff --git a/apps/accounts/serializers.py b/apps/accounts/serializers.py
index c90ffef4..8a9f609e 100644
--- a/apps/accounts/serializers.py
+++ b/apps/accounts/serializers.py
@@ -65,6 +65,7 @@ class UserSerializer(serializers.ModelSerializer):
             "channel_profiles",
             "custom_properties",
             "avatar_config",
+            "stream_limit",
             "is_staff",
             "is_superuser",
             "last_login",
diff --git a/apps/proxy/ts_proxy/client_manager.py b/apps/proxy/ts_proxy/client_manager.py
index c0e5ab0b..64d2b1ec 100644
--- a/apps/proxy/ts_proxy/client_manager.py
+++ b/apps/proxy/ts_proxy/client_manager.py
@@ -247,7 +247,7 @@ class ClientManager:
             "connected_at": current_time,
             "last_active": current_time,
             "worker_id": self.worker_id or "unknown",
-            "user_id": str(user.id) if user is not None else "unknown",
+            "user_id": str(user.id) if user is not None else "0",
             # "user_level": user.user_level if user is not None else 100, # default to a high value since no user means the non-user specific M3U/HDHR
         }
 
diff --git a/apps/proxy/ts_proxy/server.py b/apps/proxy/ts_proxy/server.py
index 4c51768a..6f92fe56 100644
--- a/apps/proxy/ts_proxy/server.py
+++ b/apps/proxy/ts_proxy/server.py
@@ -374,7 +374,7 @@ class ProxyServer:
             if result is None:
                 return None
             try:
-                return result.decode('utf-8')
+                return result
             except (AttributeError, UnicodeDecodeError) as e:
                 logger.error(f"Error decoding channel owner for {channel_id}: {e}, raw={result!r}")
                 return None
@@ -940,14 +940,14 @@ class ProxyServer:
                             # Calculate runtime from init_time
                             if b'init_time' in metadata:
                                 try:
-                                    init_time = float(metadata[b'init_time'].decode('utf-8'))
+                                    init_time = float(metadata['init_time'])
                                     runtime = round(time.time() - init_time, 2)
                                 except Exception:
                                     pass
                             # Get total bytes transferred
                             if b'total_bytes' in metadata:
                                 try:
-                                    total_bytes = int(metadata[b'total_bytes'].decode('utf-8'))
+                                    total_bytes = int(metadata['total_bytes'])
                                 except Exception:
                                     pass
 
@@ -1105,7 +1105,7 @@ class ProxyServer:
                                         attempt_value = self.redis_client.get(attempt_key)
                                         if attempt_value:
                                             try:
-                                                connection_attempt_time = float(attempt_value.decode('utf-8'))
+                                                connection_attempt_time = float(attempt_value)
                                             except (ValueError, TypeError):
                                                 pass
 
@@ -1113,7 +1113,7 @@ class ProxyServer:
                                     init_time = None
                                     if metadata and b'init_time' in metadata:
                                         try:
-                                            init_time = float(metadata[b'init_time'].decode('utf-8'))
+                                            init_time = float(metadata[b'init_time'])
                                         except (ValueError, TypeError):
                                             pass
 
@@ -1350,7 +1350,7 @@ class ProxyServer:
 
             for key in channel_keys:
                 try:
-                    channel_id = key.decode('utf-8').split(':')[2]
+                    channel_id = key.split(':')[2]
 
                     # Get metadata first
                     metadata = self.redis_client.hgetall(key)
@@ -1365,7 +1365,7 @@ class ProxyServer:
                         continue
 
                     # Get owner
-                    owner = metadata.get(b'owner', b'').decode('utf-8') if b'owner' in metadata else ''
+                    owner = metadata.get('owner', '') if 'owner' in metadata else ''
 
                     # Check if owner is still alive
                     owner_alive = False
@@ -1379,7 +1379,7 @@ class ProxyServer:
 
                     # If no owner and no clients, clean it up
                     if not owner_alive and client_count == 0:
-                        state = metadata.get(b'state', b'unknown').decode('utf-8') if b'state' in metadata else 'unknown'
+                        state = metadata.get('state', 'unknown')
                         logger.warning(f"Found orphaned metadata for channel {channel_id} (state: {state}, owner: {owner}, clients: {client_count}) - cleaning up")
 
                         # If we have it locally, stop it properly to clean up transcode/proxy processes
diff --git a/apps/proxy/ts_proxy/views.py b/apps/proxy/ts_proxy/views.py
index 18c07474..fabc1053 100644
--- a/apps/proxy/ts_proxy/views.py
+++ b/apps/proxy/ts_proxy/views.py
@@ -40,6 +40,7 @@ from .utils import get_logger
 from uuid import UUID
 import gevent
 from dispatcharr.utils import network_access_allowed
+from apps.proxy.utils import check_user_stream_limits
 
 logger = get_logger()
 
@@ -71,6 +72,13 @@ def stream_ts(request, channel_id, user=None):
                 )
                 break
 
+        if user:
+            if not check_user_stream_limits(user, client_id):
+                return JsonResponse(
+                    {"error": f"Stream limit exceeded ({user.stream_limit} concurrent streams allowed)"},
+                    status=429
+                )
+
         # Check if we need to reinitialize the channel
         needs_initialization = True
         channel_state = None
diff --git a/apps/proxy/urls.py b/apps/proxy/urls.py
index 34c026a9..3a320049 100644
--- a/apps/proxy/urls.py
+++ b/apps/proxy/urls.py
@@ -6,4 +6,4 @@ urlpatterns = [
     path('ts/', include('apps.proxy.ts_proxy.urls')),
     path('hls/', include('apps.proxy.hls_proxy.urls')),
     path('vod/', include('apps.proxy.vod_proxy.urls')),
-]
\ No newline at end of file
+]
diff --git a/apps/proxy/utils.py b/apps/proxy/utils.py
new file mode 100644
index 00000000..0ea1bd27
--- /dev/null
+++ b/apps/proxy/utils.py
@@ -0,0 +1,185 @@
+import logging
+from core.utils import RedisClient
+from apps.proxy.vod_proxy.multi_worker_connection_manager import MultiWorkerVODConnectionManager, get_vod_client_stop_key
+from core.models import CoreSettings
+from apps.proxy.ts_proxy.services.channel_service import ChannelService
+
+logger = logging.getLogger("proxy")
+
+
+def attempt_stream_termination(user_id, requesting_client_id, active_connections):
+    try:
+        logger.info("[stream limits]" f"[{requesting_client_id}] User {user_id} has {len(active_connections)} active connections, checking termination candidates")
+
+        user_limit_settings = CoreSettings.get_user_limit_settings()
+        terminate_oldest = user_limit_settings.get("terminate_oldest", True)
+        prioritize_single = user_limit_settings.get("prioritize_single_client_channels", True)
+        ignore_same_channel = user_limit_settings.get("ignore_same_channel_connections", False)
+
+        channel_counts = {}
+        for connection in active_connections:
+            media_id = connection['media_id']
+            channel_counts[media_id] = channel_counts.get(media_id, 0) + 1
+
+        def prioritize(connection):
+            is_multi = channel_counts[connection['media_id']] > 1
+
+            # if we're ignoring same-channel connections, put them at the end
+            same_ch_key = 1 if (ignore_same_channel and is_multi) else 0
+
+            # key for prioritizing single-client channels
+            single_key = 0 if (prioritize_single and not is_multi) else 1
+
+            # sort by age setting
+            time_key = connection['connected_at'] if terminate_oldest else -connection['connected_at']
+
+            return (same_ch_key, single_key, time_key)
+
+        termination_candidates = sorted(active_connections, key=prioritize)
+
+        if not termination_candidates:
+            logger.warning("[stream limits]" f"[{requesting_client_id}] No termination candidates found for user {user_id}")
+            return False
+
+        target = termination_candidates[0]
+        logger.info("[stream limits]"
+            f"[{requesting_client_id}] Terminating client {target['client_id']} "
+            f"on media {target['media_id']} (connected_at={target['connected_at']})"
+        )
+
+        if target['type'] == 'live':
+            result = ChannelService.stop_client(target['media_id'], target['client_id'])
+            if result.get("status") == "error":
+                return False
+        else:
+            connection_manager = MultiWorkerVODConnectionManager.get_instance()
+            redis_client = connection_manager.redis_client
+
+            if not redis_client:
+                return False
+
+            # Check if connection exists
+            connection_key = f"vod_persistent_connection:{target['client_id']}"
+            connection_data = redis_client.hgetall(connection_key)
+            if not connection_data:
+                logger.warning(f"VOD connection not found: {target['client_id']}")
+                return False
+
+            # Set a stop signal key that the worker will check
+            stop_key = get_vod_client_stop_key(target['client_id'])
+            redis_client.setex(stop_key, 60, "true")  # 60 second TTL
+
+        return True
+    except Exception as e:
+        logger.error("[stream limits]" f"[{requesting_client_id}] Error during stream termination for user {user_id}: {e}")
+        return False
+
+def get_user_active_connections(user_id):
+    redis_client = RedisClient.get_client()
+    connections = []
+
+    try:
+        cursor = 0
+
+        # Grab live streams
+        while True:
+            cursor, keys = redis_client.scan(cursor=cursor, match="ts_proxy:channel:*:clients:*", count=1000)
+
+            for key in keys:
+                parts = key.split(':')
+                if len(parts) >= 5:
+                    channel_id = parts[2]
+                    client_id = parts[4]
+
+                    client_user_id = redis_client.hget(key, 'user_id')
+                    connected_at = redis_client.hget(key, 'connected_at')
+
+                    logger.info(f"[stream limits] user_id = {user_id}")
+                    logger.info(f"[stream limits] channel_id = {channel_id}")
+                    logger.info(f"[stream limits] client_id = {client_id}")
+
+                    if client_user_id and int(client_user_id) == user_id:
+                        try:
+                            logger.info(f"[stream limits] Found LIVE connection for user {user_id} on channel {channel_id} with client ID {client_id}")
+                            connected_at = float(connected_at) if connected_at else 0
+                            connections.append({
+                                'media_id': channel_id,
+                                'client_id': client_id,
+                                'connected_at': connected_at,
+                                'type': 'live',
+                            })
+                        except (ValueError, TypeError):
+                            pass
+
+            if cursor == 0:
+                break
+
+
+        cursor = 0
+
+        # Grab VOD
+        while True:
+            cursor, keys = redis_client.scan(cursor=cursor, match="vod_persistent_connections:*", count=1000)
+
+            for key in keys:
+                parts = key.split(':')
+                if len(parts) >= 2:
+                    client_id = parts[1]
+
+                    client_user_id = redis_client.hget(key, 'user_id')
+                    connected_at = redis_client.hget(key, 'created_at')
+
+                    logger.info(f"[stream limits] user_id = {user_id}")
+                    logger.info(f"[stream limits] client_id = {client_id}")
+
+                    if client_user_id and int(client_user_id) == user_id:
+                        try:
+                            logger.info(f"[stream limits] Found VOD connection for user {user_id} on channel {channel_id} with client ID {client_id}")
+                            connected_at = float(connected_at) if connected_at else 0
+                            connections.append({
+                                'media_id': channel_id,
+                                'client_id': client_id,
+                                'connected_at': connected_at,
+                                'type': 'vod',
+                            })
+                        except (ValueError, TypeError):
+                            pass
+
+            if cursor == 0:
+                break
+
+        return connections
+
+    except Exception as e:
+        logger.warning(f"Error getting active channel details for user {user_id}: {e}")
+        return []
+
+
+def check_user_stream_limits(user, client_id):
+    # Check user stream limits
+    if user and user.stream_limit > 0:
+        logger.info("[stream limits]" f"[{client_id}] User {user.username} (ID: {user.id}) is requesting a stream (stream_limit: {user.stream_limit})")
+        user_limit_settings = CoreSettings.get_user_limit_settings()
+
+        active_connections = get_user_active_connections(user.id)
+        unique_channel_count = set([conn['media_id'] for conn in active_connections])
+        user_stream_count = len(unique_channel_count) if user_limit_settings.get("ignore_same_channel_connections", False) else len(active_connections)
+
+        print(active_connections)
+
+        logger.info(f"[stream limits]" f"[{client_id}] User {user.username} currently has {len(active_connections)} active connections across {len(unique_channel_count)} unique channels (counting method: {'unique channels' if user_limit_settings.get('ignore_same_channel_connections', False) else 'total connections'})")
+
+        if user.stream_limit > 0 and user_stream_count >= user.stream_limit:
+            if user_limit_settings.get("terminate_on_limit_exceeded", True) == False:
+                return False
+
+            if len(active_connections) >= user.stream_limit:
+                logger.warning("[stream limits]"
+                    f"[{client_id}] User {user.username} (ID: {user.id}) has reached stream limit "
+                    f"({len(active_connections)}/{user.stream_limit} channels), attempting to free up slot"
+                )
+
+                if not attempt_stream_termination(user.id, client_id, active_connections):
+                    return False
+
+        return True
diff --git a/apps/proxy/vod_proxy/connection_manager.py b/apps/proxy/vod_proxy/connection_manager.py
index 1b838f81..ec963001 100644
--- a/apps/proxy/vod_proxy/connection_manager.py
+++ b/apps/proxy/vod_proxy/connection_manager.py
@@ -1006,7 +1006,7 @@ class VODConnectionManager:
             return HttpResponse(f"Streaming error: {str(e)}", status=500)
 
     def stream_content_with_session(self, session_id, content_obj, stream_url, m3u_profile, client_ip, user_agent, request,
-                                  utc_start=None, utc_end=None, offset=None, range_header=None):
+                                  utc_start=None, utc_end=None, offset=None, range_header=None, user=None):
         """
         Stream VOD content with persistent connection per session
 
diff --git a/apps/proxy/vod_proxy/multi_worker_connection_manager.py b/apps/proxy/vod_proxy/multi_worker_connection_manager.py
index 4e9e789e..d7787016 100644
--- a/apps/proxy/vod_proxy/multi_worker_connection_manager.py
+++ b/apps/proxy/vod_proxy/multi_worker_connection_manager.py
@@ -93,7 +93,7 @@ class SerializableConnectionState:
                  content_name: str = None, client_ip: str = None,
                  client_user_agent: str = None, utc_start: str = None,
                  utc_end: str = None, offset: str = None,
-                 worker_id: str = None, connection_type: str = "redis_backed"):
+                 worker_id: str = None, connection_type: str = "redis_backed", user_id: str = "unknown"):
         self.session_id = session_id
         self.stream_url = stream_url
         self.headers = headers
@@ -104,6 +104,7 @@ class SerializableConnectionState:
         self.last_activity = time.time()
         self.request_count = 0
         self.active_streams = 0
+        self.user_id = user_id
 
         # Session metadata (consolidated from vod_session key)
         self.content_obj_type = content_obj_type
@@ -160,7 +161,8 @@ class SerializableConnectionState:
             'last_seek_byte': str(self.last_seek_byte),
             'last_seek_percentage': str(self.last_seek_percentage),
             'total_content_size': str(self.total_content_size),
-            'last_seek_timestamp': str(self.last_seek_timestamp)
+            'last_seek_timestamp': str(self.last_seek_timestamp),
+            'user_id': str(self.user_id),
         }
 
     @classmethod
@@ -184,7 +186,8 @@ class SerializableConnectionState:
             utc_end=data.get('utc_end') or '',
             offset=data.get('offset') or '',
             worker_id=data.get('worker_id') or None,
-            connection_type=data.get('connection_type', 'redis_backed')
+            connection_type=data.get('connection_type', 'redis_backed'),
+            user_id=data.get('user_id', 'unknown')
         )
         obj.last_activity = float(data.get('last_activity', time.time()))
         obj.request_count = int(data.get('request_count', 0))
@@ -281,7 +284,7 @@ class RedisBackedVODConnection:
                          content_name: str = None, client_ip: str = None,
                          client_user_agent: str = None, utc_start: str = None,
                          utc_end: str = None, offset: str = None,
-                         worker_id: str = None) -> bool:
+                         worker_id: str = None, user=None) -> bool:
         """Create a new connection state in Redis with consolidated session metadata"""
         if not self._acquire_lock():
             logger.warning(f"[{self.session_id}] Could not acquire lock for connection creation")
@@ -309,7 +312,8 @@ class RedisBackedVODConnection:
                 utc_start=utc_start,
                 utc_end=utc_end,
                 offset=offset,
-                worker_id=worker_id
+                worker_id=worker_id,
+                user_id=user.id if user else "unknown"
             )
             success = self._save_connection_state(state)
 
@@ -365,6 +369,24 @@ class RedisBackedVODConnection:
                 timeout=(10, 10),
                 allow_redirects=allow_redirects
             )
+
+            # If the cached final_url returned an error (e.g. an ephemeral dispatcharr session
+            # that has since expired), clear it and retry from the original stream_url.
+            if response.status_code >= 400 and state.final_url:
+                logger.warning(
+                    f"[{self.session_id}] Cached final_url returned {response.status_code}, "
+                    f"clearing and retrying from stream_url"
+                )
+                response.close()
+                state.final_url = None
+                response = self.local_session.get(
+                    state.stream_url,
+                    headers=headers,
+                    stream=True,
+                    timeout=(10, 10),
+                    allow_redirects=True
+                )
+
             response.raise_for_status()
 
             # Update state with response info on first request
@@ -761,7 +783,7 @@ class MultiWorkerVODConnectionManager:
 
     def stream_content_with_session(self, session_id, content_obj, stream_url, m3u_profile,
                                   client_ip, client_user_agent, request,
-                                  utc_start=None, utc_end=None, offset=None, range_header=None):
+                                  utc_start=None, utc_end=None, offset=None, range_header=None, user=None):
         """Stream content with Redis-backed persistent connection"""
 
         # Generate client ID
@@ -858,7 +880,8 @@ class MultiWorkerVODConnectionManager:
                     utc_start=utc_start,
                     utc_end=utc_end,
                     offset=str(offset) if offset else None,
-                    worker_id=self.worker_id
+                    worker_id=self.worker_id,
+                    user=user
                 ):
                     logger.error(f"[{client_id}] Worker {self.worker_id} - Failed to create Redis connection")
                     # Roll back the profile slot reservation since connection failed
diff --git a/apps/proxy/vod_proxy/urls.py b/apps/proxy/vod_proxy/urls.py
index f48f70e0..f79e6b48 100644
--- a/apps/proxy/vod_proxy/urls.py
+++ b/apps/proxy/vod_proxy/urls.py
@@ -1,16 +1,17 @@
 from django.urls import path
 from . import views
+from .views import stream_vod
 
 app_name = 'vod_proxy'
 
 urlpatterns = [
     # Generic VOD streaming with session ID in path (for compatibility)
-    path('<str:content_type>/<uuid:content_id>/<str:session_id>', views.VODStreamView.as_view(), name='vod_stream_with_session'),
-    path('<str:content_type>/<uuid:content_id>/<str:session_id>/<int:profile_id>/', views.VODStreamView.as_view(), name='vod_stream_with_session_and_profile'),
+    path('<str:content_type>/<uuid:content_id>/<str:session_id>', stream_vod, name='vod_stream_with_session'),
+    path('<str:content_type>/<uuid:content_id>/<str:session_id>/<int:profile_id>/', stream_vod, name='vod_stream_with_session_and_profile'),
 
     # Generic VOD streaming (supports movies, episodes, series) - legacy patterns
-    path('<str:content_type>/<uuid:content_id>', views.VODStreamView.as_view(), name='vod_stream'),
-    path('<str:content_type>/<uuid:content_id>/<int:profile_id>/', views.VODStreamView.as_view(), name='vod_stream_with_profile'),
+    path('<str:content_type>/<uuid:content_id>', stream_vod, name='vod_stream'),
+    path('<str:content_type>/<uuid:content_id>/<int:profile_id>/', stream_vod, name='vod_stream_with_profile'),
 
     # VOD playlist generation
     path('playlist/', views.VODPlaylistView.as_view(), name='vod_playlist'),
diff --git a/apps/proxy/vod_proxy/views.py b/apps/proxy/vod_proxy/views.py
index e1fa8624..14e1b631 100644
--- a/apps/proxy/vod_proxy/views.py
+++ b/apps/proxy/vod_proxy/views.py
@@ -17,104 +17,376 @@ from apps.m3u.models import M3UAccount, M3UAccountProfile
 from apps.proxy.vod_proxy.connection_manager import VODConnectionManager
 from apps.proxy.vod_proxy.multi_worker_connection_manager import MultiWorkerVODConnectionManager, infer_content_type_from_url, get_vod_client_stop_key
 from .utils import get_client_info, create_vod_response
+from rest_framework.decorators import api_view
+from apps.accounts.models import User
+from apps.proxy.utils import check_user_stream_limits
 
 logger = logging.getLogger(__name__)
 
+_request_times = {}
 
-@method_decorator(csrf_exempt, name='dispatch')
-class VODStreamView(View):
-    """Handle VOD streaming requests with M3U profile support"""
 
-    def get(self, request, content_type, content_id, session_id=None, profile_id=None):
-        """
-        Stream VOD content (movies or series episodes) with session-based connection reuse
+def _get_content_and_relation(content_type, content_id, preferred_m3u_account_id=None, preferred_stream_id=None):
+    """Get the content object and its M3U relation"""
+    try:
+        logger.info(f"[CONTENT-LOOKUP] Looking up {content_type} with UUID {content_id}")
+        if preferred_m3u_account_id:
+            logger.info(f"[CONTENT-LOOKUP] Preferred M3U account ID: {preferred_m3u_account_id}")
+        if preferred_stream_id:
+            logger.info(f"[CONTENT-LOOKUP] Preferred stream ID: {preferred_stream_id}")
 
-        Args:
-            content_type: 'movie', 'series', or 'episode'
-            content_id: ID of the content
-            session_id: Optional session ID from URL path (for persistent connections)
-            profile_id: Optional M3U profile ID for authentication
-        """
-        logger.info(f"[VOD-REQUEST] Starting VOD stream request: {content_type}/{content_id}, session: {session_id}, profile: {profile_id}")
-        logger.info(f"[VOD-REQUEST] Full request path: {request.get_full_path()}")
-        logger.info(f"[VOD-REQUEST] Request method: {request.method}")
-        logger.info(f"[VOD-REQUEST] Request headers: {dict(request.headers)}")
+        if content_type == 'movie':
+            content_obj = get_object_or_404(Movie, uuid=content_id)
+            logger.info(f"[CONTENT-FOUND] Movie: {content_obj.name} (ID: {content_obj.id})")
 
-        try:
-            client_ip, client_user_agent = get_client_info(request)
+            # Filter by preferred stream ID first (most specific)
+            relations_query = content_obj.m3u_relations.filter(m3u_account__is_active=True)
+            if preferred_stream_id:
+                specific_relation = relations_query.filter(stream_id=preferred_stream_id).first()
+                if specific_relation:
+                    logger.info(f"[STREAM-SELECTED] Using specific stream: {specific_relation.stream_id} from provider: {specific_relation.m3u_account.name}")
+                    return content_obj, specific_relation
+                else:
+                    logger.warning(f"[STREAM-FALLBACK] Preferred stream ID {preferred_stream_id} not found, falling back to account/priority selection")
 
-            # Extract timeshift parameters from query string
-            # Support multiple timeshift parameter formats
-            utc_start = request.GET.get('utc_start') or request.GET.get('start') or request.GET.get('playliststart')
-            utc_end = request.GET.get('utc_end') or request.GET.get('end') or request.GET.get('playlistend')
-            offset = request.GET.get('offset') or request.GET.get('seek') or request.GET.get('t')
+            # Filter by preferred M3U account if specified
+            if preferred_m3u_account_id:
+                specific_relation = relations_query.filter(m3u_account__id=preferred_m3u_account_id).first()
+                if specific_relation:
+                    logger.info(f"[PROVIDER-SELECTED] Using preferred provider: {specific_relation.m3u_account.name}")
+                    return content_obj, specific_relation
+                else:
+                    logger.warning(f"[PROVIDER-FALLBACK] Preferred M3U account {preferred_m3u_account_id} not found, using highest priority")
 
-            # VLC specific timeshift parameters
-            if not utc_start and not offset:
-                # Check for VLC-style timestamp parameters
-                if 'timestamp' in request.GET:
-                    offset = request.GET.get('timestamp')
-                elif 'time' in request.GET:
-                    offset = request.GET.get('time')
+            # Get the highest priority active relation (fallback or default)
+            relation = relations_query.select_related('m3u_account').order_by('-m3u_account__priority', 'id').first()
 
-            # Session ID now comes from URL path parameter
-            # Remove legacy query parameter extraction since we're using path-based routing
+            if relation:
+                logger.info(f"[PROVIDER-SELECTED] Using provider: {relation.m3u_account.name} (priority: {relation.m3u_account.priority})")
 
-            # Extract Range header for seeking support
-            range_header = request.META.get('HTTP_RANGE')
+            return content_obj, relation
 
-            logger.info(f"[VOD-TIMESHIFT] Timeshift params - utc_start: {utc_start}, utc_end: {utc_end}, offset: {offset}")
-            logger.info(f"[VOD-SESSION] Session ID: {session_id}")
+        elif content_type == 'episode':
+            content_obj = get_object_or_404(Episode, uuid=content_id)
+            logger.info(f"[CONTENT-FOUND] Episode: {content_obj.name} (ID: {content_obj.id}, Series: {content_obj.series.name})")
 
-            # Log all query parameters for debugging
-            if request.GET:
-                logger.debug(f"[VOD-PARAMS] All query params: {dict(request.GET)}")
+            # Filter by preferred stream ID first (most specific)
+            relations_query = content_obj.m3u_relations.filter(m3u_account__is_active=True)
+            if preferred_stream_id:
+                specific_relation = relations_query.filter(stream_id=preferred_stream_id).first()
+                if specific_relation:
+                    logger.info(f"[STREAM-SELECTED] Using specific stream: {specific_relation.stream_id} from provider: {specific_relation.m3u_account.name}")
+                    return content_obj, specific_relation
+                else:
+                    logger.warning(f"[STREAM-FALLBACK] Preferred stream ID {preferred_stream_id} not found, falling back to account/priority selection")
 
-            if range_header:
-                logger.info(f"[VOD-RANGE] Range header: {range_header}")
+            # Filter by preferred M3U account if specified
+            if preferred_m3u_account_id:
+                specific_relation = relations_query.filter(m3u_account__id=preferred_m3u_account_id).first()
+                if specific_relation:
+                    logger.info(f"[PROVIDER-SELECTED] Using preferred provider: {specific_relation.m3u_account.name}")
+                    return content_obj, specific_relation
+                else:
+                    logger.warning(f"[PROVIDER-FALLBACK] Preferred M3U account {preferred_m3u_account_id} not found, using highest priority")
 
-                # Parse the range to understand what position VLC is seeking to
-                try:
-                    if 'bytes=' in range_header:
-                        range_part = range_header.replace('bytes=', '')
-                        if '-' in range_part:
-                            start_byte, end_byte = range_part.split('-', 1)
-                            if start_byte:
-                                start_pos_mb = int(start_byte) / (1024 * 1024)
-                                logger.info(f"[VOD-SEEK] Seeking to byte position: {start_byte} (~{start_pos_mb:.1f} MB)")
-                                if int(start_byte) > 0:
-                                    logger.info(f"[VOD-SEEK] *** ACTUAL SEEK DETECTED *** Position: {start_pos_mb:.1f} MB")
-                            else:
-                                logger.info(f"[VOD-SEEK] Open-ended range request (from start)")
-                            if end_byte:
-                                end_pos_mb = int(end_byte) / (1024 * 1024)
-                                logger.info(f"[VOD-SEEK] End position: {end_byte} bytes (~{end_pos_mb:.1f} MB)")
-                except Exception as e:
-                    logger.warning(f"[VOD-SEEK] Could not parse range header: {e}")
+            # Get the highest priority active relation (fallback or default)
+            relation = relations_query.select_related('m3u_account').order_by('-m3u_account__priority', 'id').first()
 
-                # Simple seek detection - track rapid requests
-                current_time = time.time()
-                request_key = f"{client_ip}:{content_type}:{content_id}"
+            if relation:
+                logger.info(f"[PROVIDER-SELECTED] Using provider: {relation.m3u_account.name} (priority: {relation.m3u_account.priority})")
 
-                if not hasattr(self.__class__, '_request_times'):
-                    self.__class__._request_times = {}
+            return content_obj, relation
 
-                if request_key in self.__class__._request_times:
-                    time_diff = current_time - self.__class__._request_times[request_key]
-                    if time_diff < 5.0:
-                        logger.info(f"[VOD-SEEK] Rapid request detected ({time_diff:.1f}s) - likely seeking")
+        elif content_type == 'series':
+            # For series, get the first episode
+            series = get_object_or_404(Series, uuid=content_id)
+            logger.info(f"[CONTENT-FOUND] Series: {series.name} (ID: {series.id})")
+            episode = series.episodes.first()
+            if not episode:
+                logger.error(f"[CONTENT-ERROR] No episodes found for series {series.name}")
+                return None, None
 
-                self.__class__._request_times[request_key] = current_time
+            logger.info(f"[CONTENT-FOUND] First episode: {episode.name} (ID: {episode.id})")
+
+            # Filter by preferred stream ID first (most specific)
+            relations_query = episode.m3u_relations.filter(m3u_account__is_active=True)
+            if preferred_stream_id:
+                specific_relation = relations_query.filter(stream_id=preferred_stream_id).first()
+                if specific_relation:
+                    logger.info(f"[STREAM-SELECTED] Using specific stream: {specific_relation.stream_id} from provider: {specific_relation.m3u_account.name}")
+                    return episode, specific_relation
+                else:
+                    logger.warning(f"[STREAM-FALLBACK] Preferred stream ID {preferred_stream_id} not found, falling back to account/priority selection")
+
+            # Filter by preferred M3U account if specified
+            if preferred_m3u_account_id:
+                specific_relation = relations_query.filter(m3u_account__id=preferred_m3u_account_id).first()
+                if specific_relation:
+                    logger.info(f"[PROVIDER-SELECTED] Using preferred provider: {specific_relation.m3u_account.name}")
+                    return episode, specific_relation
+                else:
+                    logger.warning(f"[PROVIDER-FALLBACK] Preferred M3U account {preferred_m3u_account_id} not found, using highest priority")
+
+            # Get the highest priority active relation (fallback or default)
+            relation = relations_query.select_related('m3u_account').order_by('-m3u_account__priority', 'id').first()
+
+            if relation:
+                logger.info(f"[PROVIDER-SELECTED] Using provider: {relation.m3u_account.name} (priority: {relation.m3u_account.priority})")
+
+            return episode, relation
+        else:
+            logger.error(f"[CONTENT-ERROR] Invalid content type: {content_type}")
+            return None, None
+
+    except Exception as e:
+        logger.error(f"Error getting content object: {e}")
+        return None, None
+
+def _get_stream_url_from_relation(relation):
+    """Get stream URL from the M3U relation"""
+    try:
+        # Log the relation type and available attributes
+        logger.info(f"[VOD-URL] Relation type: {type(relation).__name__}")
+        logger.info(f"[VOD-URL] Account type: {relation.m3u_account.account_type}")
+        logger.info(f"[VOD-URL] Stream ID: {getattr(relation, 'stream_id', 'N/A')}")
+
+        # First try the get_stream_url method (this should build URLs dynamically)
+        if hasattr(relation, 'get_stream_url'):
+            url = relation.get_stream_url()
+            if url:
+                logger.info(f"[VOD-URL] Built URL from get_stream_url(): {url}")
+                return url
             else:
-                logger.info(f"[VOD-RANGE] No Range header - full content request")
+                logger.warning(f"[VOD-URL] get_stream_url() returned None")
 
-            logger.info(f"[VOD-CLIENT] Client info - IP: {client_ip}, User-Agent: {client_user_agent[:50]}...")
+        logger.error(f"[VOD-URL] Relation has no get_stream_url method or it failed")
+        return None
+    except Exception as e:
+        logger.error(f"[VOD-URL] Error getting stream URL from relation: {e}", exc_info=True)
+        return None
 
-            # If no session ID, create one and redirect to path-based URL
-            if not session_id:
-                new_session_id = f"vod_{int(time.time() * 1000)}_{random.randint(1000, 9999)}"
-                logger.info(f"[VOD-SESSION] Creating new session: {new_session_id}")
+def _get_m3u_profile(m3u_account, profile_id, session_id=None):
+    """Get appropriate M3U profile for streaming using Redis-based viewer counts
 
+    Args:
+        m3u_account: M3UAccount instance
+        profile_id: Optional specific profile ID requested
+        session_id: Optional session ID to check for existing connections
+
+    Returns:
+        tuple: (M3UAccountProfile, current_connections) or None if no profile found
+    """
+    try:
+        from core.utils import RedisClient
+        redis_client = RedisClient.get_client()
+
+        if not redis_client:
+            logger.warning("Redis not available, falling back to default profile")
+            default_profile = M3UAccountProfile.objects.filter(
+                m3u_account=m3u_account,
+                is_active=True,
+                is_default=True
+            ).first()
+            return (default_profile, 0) if default_profile else None
+
+        # Check if this session already has an active connection
+        if session_id:
+            persistent_connection_key = f"vod_persistent_connection:{session_id}"
+            connection_data = redis_client.hgetall(persistent_connection_key)
+
+            if connection_data:
+                existing_profile_id = connection_data.get('m3u_profile_id')
+                if existing_profile_id:
+                    try:
+                        existing_profile = M3UAccountProfile.objects.get(
+                            id=int(existing_profile_id),
+                            m3u_account=m3u_account,
+                            is_active=True
+                        )
+                        # Get current connections for logging
+                        profile_connections_key = f"profile_connections:{existing_profile.id}"
+                        current_connections = int(redis_client.get(profile_connections_key) or 0)
+
+                        logger.info(f"[PROFILE-SELECTION] Session {session_id} reusing existing profile {existing_profile.id}: {current_connections}/{existing_profile.max_streams} connections")
+                        return (existing_profile, current_connections)
+                    except (M3UAccountProfile.DoesNotExist, ValueError):
+                        logger.warning(f"[PROFILE-SELECTION] Session {session_id} has invalid profile ID {existing_profile_id}, selecting new profile")
+                    except Exception as e:
+                        logger.warning(f"[PROFILE-SELECTION] Error checking existing profile for session {session_id}: {e}")
+                else:
+                    logger.debug(f"[PROFILE-SELECTION] Session {session_id} exists but has no profile ID stored")            # If specific profile requested, try to use it
+        if profile_id:
+            try:
+                profile = M3UAccountProfile.objects.get(
+                    id=profile_id,
+                    m3u_account=m3u_account,
+                    is_active=True
+                )
+                # Check Redis-based current connections
+                profile_connections_key = f"profile_connections:{profile.id}"
+                current_connections = int(redis_client.get(profile_connections_key) or 0)
+
+                if profile.max_streams == 0 or current_connections < profile.max_streams:
+                    logger.info(f"[PROFILE-SELECTION] Using requested profile {profile.id}: {current_connections}/{profile.max_streams} connections")
+                    return (profile, current_connections)
+                else:
+                    logger.warning(f"[PROFILE-SELECTION] Requested profile {profile.id} is at capacity: {current_connections}/{profile.max_streams}")
+            except M3UAccountProfile.DoesNotExist:
+                logger.warning(f"[PROFILE-SELECTION] Requested profile {profile_id} not found")
+
+        # Get active profiles ordered by priority (default first)
+        m3u_profiles = M3UAccountProfile.objects.filter(
+            m3u_account=m3u_account,
+            is_active=True
+        )
+
+        default_profile = m3u_profiles.filter(is_default=True).first()
+        if not default_profile:
+            logger.error(f"[PROFILE-SELECTION] No default profile found for M3U account {m3u_account.id}")
+            return None
+
+        # Check profiles in order: default first, then others
+        profiles = [default_profile] + list(m3u_profiles.filter(is_default=False))
+
+        for profile in profiles:
+            profile_connections_key = f"profile_connections:{profile.id}"
+            current_connections = int(redis_client.get(profile_connections_key) or 0)
+
+            # Check if profile has available connection slots
+            if profile.max_streams == 0 or current_connections < profile.max_streams:
+                logger.info(f"[PROFILE-SELECTION] Selected profile {profile.id} ({profile.name}): {current_connections}/{profile.max_streams} connections")
+                return (profile, current_connections)
+            else:
+                logger.debug(f"[PROFILE-SELECTION] Profile {profile.id} at capacity: {current_connections}/{profile.max_streams}")
+
+        # All profiles are at capacity - return None to trigger error response
+        logger.error(f"[PROFILE-SELECTION] All profiles at capacity for M3U account {m3u_account.id}, rejecting request")
+        return None
+
+    except Exception as e:
+        logger.error(f"Error getting M3U profile: {e}")
+        return None
+
+def _transform_url(original_url, m3u_profile):
+    """Transform URL based on M3U profile settings"""
+    try:
+        import re
+
+        if not original_url:
+            return None
+
+        search_pattern = m3u_profile.search_pattern
+        replace_pattern = m3u_profile.replace_pattern
+        safe_replace_pattern = re.sub(r'\$(\d+)', r'\\\1', replace_pattern)
+
+        if search_pattern and replace_pattern:
+            transformed_url = re.sub(search_pattern, safe_replace_pattern, original_url)
+            return transformed_url
+
+        return original_url
+
+    except Exception as e:
+        logger.error(f"Error transforming URL: {e}")
+        return original_url
+
+@api_view(["GET"])
+def stream_vod(request, content_type, content_id, session_id=None, profile_id=None, user=None):
+    """
+    Stream VOD content (movies or series episodes) with session-based connection reuse
+
+    Args:
+        content_type: 'movie', 'series', or 'episode'
+        content_id: ID of the content
+        session_id: Optional session ID from URL path (for persistent connections)
+        profile_id: Optional M3U profile ID for authentication
+    """
+    logger.info(f"[VOD-REQUEST] Starting VOD stream request: {content_type}/{content_id}, session: {session_id}, profile: {profile_id}")
+    logger.info(f"[VOD-REQUEST] Full request path: {request.get_full_path()}")
+    logger.info(f"[VOD-REQUEST] Request method: {request.method}")
+    logger.info(f"[VOD-REQUEST] Request headers: {dict(request.headers)}")
+
+    try:
+        client_ip, client_user_agent = get_client_info(request)
+
+        # Extract timeshift parameters from query string
+        # Support multiple timeshift parameter formats
+        utc_start = request.GET.get('utc_start') or request.GET.get('start') or request.GET.get('playliststart')
+        utc_end = request.GET.get('utc_end') or request.GET.get('end') or request.GET.get('playlistend')
+        offset = request.GET.get('offset') or request.GET.get('seek') or request.GET.get('t')
+
+        # VLC specific timeshift parameters
+        if not utc_start and not offset:
+            # Check for VLC-style timestamp parameters
+            if 'timestamp' in request.GET:
+                offset = request.GET.get('timestamp')
+            elif 'time' in request.GET:
+                offset = request.GET.get('time')
+
+        # Session ID now comes from URL path parameter
+        # Remove legacy query parameter extraction since we're using path-based routing
+
+        # Extract Range header for seeking support
+        range_header = request.META.get('HTTP_RANGE')
+
+        logger.info(f"[VOD-TIMESHIFT] Timeshift params - utc_start: {utc_start}, utc_end: {utc_end}, offset: {offset}")
+        logger.info(f"[VOD-SESSION] Session ID: {session_id}")
+
+        # Log all query parameters for debugging
+        if request.GET:
+            logger.debug(f"[VOD-PARAMS] All query params: {dict(request.GET)}")
+
+        if range_header:
+            logger.info(f"[VOD-RANGE] Range header: {range_header}")
+
+            # Parse the range to understand what position VLC is seeking to
+            try:
+                if 'bytes=' in range_header:
+                    range_part = range_header.replace('bytes=', '')
+                    if '-' in range_part:
+                        start_byte, end_byte = range_part.split('-', 1)
+                        if start_byte:
+                            start_pos_mb = int(start_byte) / (1024 * 1024)
+                            logger.info(f"[VOD-SEEK] Seeking to byte position: {start_byte} (~{start_pos_mb:.1f} MB)")
+                            if int(start_byte) > 0:
+                                logger.info(f"[VOD-SEEK] *** ACTUAL SEEK DETECTED *** Position: {start_pos_mb:.1f} MB")
+                        else:
+                            logger.info(f"[VOD-SEEK] Open-en`ded range request (from start)")
+                        if end_byte:
+                            end_pos_mb = int(end_byte) / (1024 * 1024)
+                            logger.info(f"[VOD-SEEK] End position: {end_byte} bytes (~{end_pos_mb:.1f} MB)")
+            except Exception as e:
+                logger.warning(f"[VOD-SEEK] Could not parse range header: {e}")
+
+            # Simple seek detection - track rapid requests
+            current_time = time.time()
+            request_key = f"{client_ip}:{content_type}:{content_id}"
+
+            if request_key in _request_times:
+                time_diff = current_time - _request_times[request_key]
+                if time_diff < 5.0:
+                    logger.info(f"[VOD-SEEK] Rapid request detected ({time_diff:.1f}s) - likely seeking")
+
+            _request_times[request_key] = current_time
+        else:
+            logger.info(f"[VOD-RANGE] No Range header - full content request")
+
+        logger.info(f"[VOD-CLIENT] Client info - IP: {client_ip}, User-Agent: {client_user_agent[:50]}...")
+
+        # If no session ID, create one and redirect to path-based URL
+        if not session_id:
+            new_session_id = f"vod_{int(time.time() * 1000)}_{random.randint(1000, 9999)}"
+            logger.info(f"[VOD-SESSION] Creating new session: {new_session_id}")
+
+            # Preserve any query parameters (except session_id)
+            query_params = dict(request.GET)
+            query_params.pop('session_id', None)  # Remove if present
+
+            if user:
+                redirect_url = f"{request.path}?session_id={new_session_id}"
+                if query_params:
+                    query_string = urlencode(query_params, doseq=True)
+                    redirect_url = f"{redirect_url}&{query_string}"
+            else:
                 # Build redirect URL with session ID in path, preserve query parameters
                 path_parts = request.path.rstrip('/').split('/')
 
@@ -124,10 +396,6 @@ class VODStreamView(View):
                 else:
                     new_path = f"{'/'.join(path_parts)}/{new_session_id}"
 
-                # Preserve any query parameters (except session_id)
-                query_params = dict(request.GET)
-                query_params.pop('session_id', None)  # Remove if present
-
                 if query_params:
                     from urllib.parse import urlencode
                     query_string = urlencode(query_params, doseq=True)
@@ -135,527 +403,273 @@ class VODStreamView(View):
                 else:
                     redirect_url = new_path
 
-                logger.info(f"[VOD-SESSION] Redirecting to path-based URL: {redirect_url}")
+            logger.info(f"[VOD-SESSION] Redirecting to path-based URL: {redirect_url}")
 
-                return HttpResponse(
-                    status=301,
-                    headers={'Location': redirect_url}
-                )
-
-            # Extract preferred M3U account ID and stream ID from query parameters
-            preferred_m3u_account_id = request.GET.get('m3u_account_id')
-            preferred_stream_id = request.GET.get('stream_id')
-
-            if preferred_m3u_account_id:
-                try:
-                    preferred_m3u_account_id = int(preferred_m3u_account_id)
-                except (ValueError, TypeError):
-                    logger.warning(f"[VOD-PARAM] Invalid m3u_account_id parameter: {preferred_m3u_account_id}")
-                    preferred_m3u_account_id = None
-
-            if preferred_stream_id:
-                logger.info(f"[VOD-PARAM] Preferred stream ID: {preferred_stream_id}")
-
-            # Get the content object and its relation
-            content_obj, relation = self._get_content_and_relation(content_type, content_id, preferred_m3u_account_id, preferred_stream_id)
-            if not content_obj or not relation:
-                logger.error(f"[VOD-ERROR] Content or relation not found: {content_type} {content_id}")
-                raise Http404(f"Content not found: {content_type} {content_id}")
-
-            logger.info(f"[VOD-CONTENT] Found content: {getattr(content_obj, 'name', 'Unknown')}")
-
-            # Get M3U account from relation
-            m3u_account = relation.m3u_account
-            logger.info(f"[VOD-ACCOUNT] Using M3U account: {m3u_account.name}")
-
-            # Get stream URL from relation
-            stream_url = self._get_stream_url_from_relation(relation)
-            logger.info(f"[VOD-CONTENT] Content URL: {stream_url or 'No URL found'}")
-
-            if not stream_url:
-                logger.error(f"[VOD-ERROR] No stream URL available for {content_type} {content_id}")
-                return HttpResponse("No stream URL available", status=503)
-
-            # Get M3U profile (returns profile and current connection count)
-            profile_result = self._get_m3u_profile(m3u_account, profile_id, session_id)
-
-            if not profile_result or not profile_result[0]:
-                logger.error(f"[VOD-ERROR] No suitable M3U profile found for {content_type} {content_id}")
-                return HttpResponse("No available stream", status=503)
-
-            m3u_profile, current_connections = profile_result
-            logger.info(f"[VOD-PROFILE] Using M3U profile: {m3u_profile.id} (max_streams: {m3u_profile.max_streams}, current: {current_connections})")
-
-            # Connection tracking is handled by the connection manager
-            # Transform URL based on profile
-            final_stream_url = self._transform_url(stream_url, m3u_profile)
-            logger.info(f"[VOD-URL] Final stream URL: {final_stream_url}")
-
-            # Validate stream URL
-            if not final_stream_url or not final_stream_url.startswith(('http://', 'https://')):
-                logger.error(f"[VOD-ERROR] Invalid stream URL: {final_stream_url}")
-                return HttpResponse("Invalid stream URL", status=500)
-
-            # Get connection manager (Redis-backed for multi-worker support)
-            connection_manager = MultiWorkerVODConnectionManager.get_instance()
-
-            # Stream the content with session-based connection reuse
-            logger.info("[VOD-STREAM] Calling connection manager to stream content")
-            response = connection_manager.stream_content_with_session(
-                session_id=session_id,
-                content_obj=content_obj,
-                stream_url=final_stream_url,
-                m3u_profile=m3u_profile,
-                client_ip=client_ip,
-                client_user_agent=client_user_agent,
-                request=request,
-                utc_start=utc_start,
-                utc_end=utc_end,
-                offset=offset,
-                range_header=range_header
+            return HttpResponse(
+                status=301,
+                headers={'Location': redirect_url}
             )
 
-            logger.info(f"[VOD-SUCCESS] Stream response created successfully, type: {type(response)}")
-            return response
+        if user:
+            if not check_user_stream_limits(user, session_id):
+                return JsonResponse(
+                    {"error": f"Stream limit exceeded ({user.stream_limit} concurrent streams allowed)"},
+                    status=429
+                )
 
-        except Exception as e:
-            logger.error(f"[VOD-EXCEPTION] Error streaming {content_type} {content_id}: {e}", exc_info=True)
-            return HttpResponse(f"Streaming error: {str(e)}", status=500)
+        # Extract preferred M3U account ID and stream ID from query parameters
+        preferred_m3u_account_id = request.GET.get('m3u_account_id')
+        preferred_stream_id = request.GET.get('stream_id')
 
-    def head(self, request, content_type, content_id, session_id=None, profile_id=None):
-        """
-        Handle HEAD requests for FUSE filesystem integration
-
-        Returns content length and session URL header for subsequent GET requests
-        """
-        logger.info(f"[VOD-HEAD] HEAD request: {content_type}/{content_id}, session: {session_id}, profile: {profile_id}")
-
-        try:
-            # Get client info for M3U profile selection
-            client_ip, client_user_agent = get_client_info(request)
-            logger.info(f"[VOD-HEAD] Client info - IP: {client_ip}, User-Agent: {client_user_agent[:50] if client_user_agent else 'None'}...")
-
-            # If no session ID, create one (same logic as GET)
-            if not session_id:
-                new_session_id = f"vod_{int(time.time() * 1000)}_{random.randint(1000, 9999)}"
-                logger.info(f"[VOD-HEAD] Creating new session for HEAD: {new_session_id}")
-
-                # Build session URL for response header
-                path_parts = request.path.rstrip('/').split('/')
-                if profile_id:
-                    session_url = f"{'/'.join(path_parts)}/{new_session_id}/{profile_id}/"
-                else:
-                    session_url = f"{'/'.join(path_parts)}/{new_session_id}"
-
-                session_id = new_session_id
-            else:
-                # Session already in URL, construct the current session URL
-                session_url = request.path
-                logger.info(f"[VOD-HEAD] Using existing session: {session_id}")
-
-            # Extract preferred M3U account ID and stream ID from query parameters
-            preferred_m3u_account_id = request.GET.get('m3u_account_id')
-            preferred_stream_id = request.GET.get('stream_id')
-
-            if preferred_m3u_account_id:
-                try:
-                    preferred_m3u_account_id = int(preferred_m3u_account_id)
-                except (ValueError, TypeError):
-                    logger.warning(f"[VOD-HEAD] Invalid m3u_account_id parameter: {preferred_m3u_account_id}")
-                    preferred_m3u_account_id = None
-
-            if preferred_stream_id:
-                logger.info(f"[VOD-HEAD] Preferred stream ID: {preferred_stream_id}")
-
-            # Get content and relation (same as GET)
-            content_obj, relation = self._get_content_and_relation(content_type, content_id, preferred_m3u_account_id, preferred_stream_id)
-            if not content_obj or not relation:
-                logger.error(f"[VOD-HEAD] Content or relation not found: {content_type} {content_id}")
-                return HttpResponse("Content not found", status=404)
-
-            # Get M3U account and stream URL
-            m3u_account = relation.m3u_account
-            stream_url = self._get_stream_url_from_relation(relation)
-            if not stream_url:
-                logger.error(f"[VOD-HEAD] No stream URL available for {content_type} {content_id}")
-                return HttpResponse("No stream URL available", status=503)
-
-            # Get M3U profile (returns profile and current connection count)
-            profile_result = self._get_m3u_profile(m3u_account, profile_id, session_id)
-            if not profile_result or not profile_result[0]:
-                logger.error(f"[VOD-HEAD] No M3U profile found or all profiles at capacity")
-                return HttpResponse("No available stream", status=503)
-
-            m3u_profile, current_connections = profile_result
-
-            # Transform URL if needed
-            final_stream_url = self._transform_url(stream_url, m3u_profile)
-
-            # Make a small range GET request to get content length since providers don't support HEAD
-            # We'll use a tiny range to minimize data transfer but get the headers we need
-            # Use M3U account's user agent as primary, client user agent as fallback
-            m3u_user_agent = m3u_account.get_user_agent().user_agent if m3u_account.get_user_agent() else None
-            headers = {
-                'User-Agent': m3u_user_agent or client_user_agent or 'Dispatcharr/1.0',
-                'Accept': '*/*',
-                'Range': 'bytes=0-1'  # Request only first 2 bytes
-            }
-
-            logger.info(f"[VOD-HEAD] Making small range GET request to provider: {final_stream_url}")
-            response = requests.get(final_stream_url, headers=headers, timeout=30, allow_redirects=True, stream=True)
-
-            # Check for range support - should be 206 for partial content
-            if response.status_code == 206:
-                # Parse Content-Range header to get total file size
-                content_range = response.headers.get('Content-Range', '')
-                if content_range:
-                    # Content-Range: bytes 0-1/1234567890
-                    total_size = content_range.split('/')[-1]
-                    logger.info(f"[VOD-HEAD] Got file size from Content-Range: {total_size}")
-                else:
-                    logger.warning(f"[VOD-HEAD] No Content-Range header in 206 response")
-                    total_size = response.headers.get('Content-Length', '0')
-            elif response.status_code == 200:
-                # Server doesn't support range requests, use Content-Length from full response
-                total_size = response.headers.get('Content-Length', '0')
-                logger.info(f"[VOD-HEAD] Server doesn't support ranges, got Content-Length: {total_size}")
-            else:
-                logger.error(f"[VOD-HEAD] Provider GET request failed: {response.status_code}")
-                return HttpResponse("Provider error", status=response.status_code)
-
-            # Close the small range request - we don't need to keep this connection
-            response.close()
-
-            # Store the total content length in Redis for the persistent connection to use
+        if preferred_m3u_account_id:
             try:
-                import redis
-                from django.conf import settings
-                redis_host = getattr(settings, 'REDIS_HOST', 'localhost')
-                redis_port = int(getattr(settings, 'REDIS_PORT', 6379))
-                redis_db = int(getattr(settings, 'REDIS_DB', 0))
-                redis_password = getattr(settings, 'REDIS_PASSWORD', '')
-                redis_user = getattr(settings, 'REDIS_USER', '')
-                r = redis.StrictRedis(
-                    host=redis_host,
-                    port=redis_port,
-                    db=redis_db,
-                    password=redis_password if redis_password else None,
-                    username=redis_user if redis_user else None,
-                    decode_responses=True
-                )
-                content_length_key = f"vod_content_length:{session_id}"
-                r.set(content_length_key, total_size, ex=1800)  # Store for 30 minutes
-                logger.info(f"[VOD-HEAD] Stored total content length {total_size} for session {session_id}")
-            except Exception as e:
-                logger.error(f"[VOD-HEAD] Failed to store content length in Redis: {e}")
+                preferred_m3u_account_id = int(preferred_m3u_account_id)
+            except (ValueError, TypeError):
+                logger.warning(f"[VOD-PARAM] Invalid m3u_account_id parameter: {preferred_m3u_account_id}")
+                preferred_m3u_account_id = None
 
-            # Now create a persistent connection for the session (if one doesn't exist)
-            # This ensures the FUSE GET requests will reuse the same connection
+        if preferred_stream_id:
+            logger.info(f"[VOD-PARAM] Preferred stream ID: {preferred_stream_id}")
 
-            connection_manager = MultiWorkerVODConnectionManager.get_instance()
+        # Get the content object and its relation
+        content_obj, relation = _get_content_and_relation(content_type, content_id, preferred_m3u_account_id, preferred_stream_id)
+        if not content_obj or not relation:
+            logger.error(f"[VOD-ERROR] Content or relation not found: {content_type} {content_id}")
+            raise Http404(f"Content not found: {content_type} {content_id}")
 
-            logger.info(f"[VOD-HEAD] Pre-creating persistent connection for session: {session_id}")
+        logger.info(f"[VOD-CONTENT] Found content: {getattr(content_obj, 'name', 'Unknown')}")
 
-            # We don't actually stream content here, just ensure connection is ready
-            # The actual GET requests from FUSE will use the persistent connection
+        # Get M3U account from relation
+        m3u_account = relation.m3u_account
+        logger.info(f"[VOD-ACCOUNT] Using M3U account: {m3u_account.name}")
 
-            # Use the total_size we extracted from the range response
-            provider_content_type = response.headers.get('Content-Type')
+        # Get stream URL from relation
+        stream_url = _get_stream_url_from_relation(relation)
+        logger.info(f"[VOD-CONTENT] Content URL: {stream_url or 'No URL found'}")
 
-            if provider_content_type:
-                content_type_header = provider_content_type
-                logger.info(f"[VOD-HEAD] Using provider Content-Type: {content_type_header}")
-            else:
-                # Provider didn't send Content-Type, infer from URL
-                inferred_content_type = infer_content_type_from_url(final_stream_url)
-                if inferred_content_type:
-                    content_type_header = inferred_content_type
-                    logger.info(f"[VOD-HEAD] Provider missing Content-Type, inferred from URL: {content_type_header}")
-                else:
-                    content_type_header = 'video/mp4'
-                    logger.info(f"[VOD-HEAD] No Content-Type from provider and could not infer from URL, using default: {content_type_header}")
+        if not stream_url:
+            logger.error(f"[VOD-ERROR] No stream URL available for {content_type} {content_id}")
+            return HttpResponse("No stream URL available", status=503)
 
-            logger.info(f"[VOD-HEAD] Provider response - Total Size: {total_size}, Type: {content_type_header}")
+        # Get M3U profile (returns profile and current connection count)
+        profile_result = _get_m3u_profile(m3u_account, profile_id, session_id)
 
-            # Create response with content length and session URL header
-            head_response = HttpResponse()
-            head_response['Content-Length'] = total_size
-            head_response['Content-Type'] = content_type_header
-            head_response['Accept-Ranges'] = 'bytes'
+        if not profile_result or not profile_result[0]:
+            logger.error(f"[VOD-ERROR] No suitable M3U profile found for {content_type} {content_id}")
+            return HttpResponse("No available stream", status=503)
 
-            # Custom header with session URL for FUSE
-            head_response['X-Session-URL'] = session_url
-            head_response['X-Dispatcharr-Session'] = session_id
+        m3u_profile, current_connections = profile_result
+        logger.info(f"[VOD-PROFILE] Using M3U profile: {m3u_profile.id} (max_streams: {m3u_profile.max_streams}, current: {current_connections})")
 
-            logger.info(f"[VOD-HEAD] Returning HEAD response with session URL: {session_url}")
-            return head_response
+        # Connection tracking is handled by the connection manager
+        # Transform URL based on profile
+        final_stream_url = _transform_url(stream_url, m3u_profile)
+        logger.info(f"[VOD-URL] Final stream URL: {final_stream_url}")
 
-        except Exception as e:
-            logger.error(f"[VOD-HEAD] Error in HEAD request: {e}", exc_info=True)
-            return HttpResponse(f"HEAD error: {str(e)}", status=500)
+        # Validate stream URL
+        if not final_stream_url or not final_stream_url.startswith(('http://', 'https://')):
+            logger.error(f"[VOD-ERROR] Invalid stream URL: {final_stream_url}")
+            return HttpResponse("Invalid stream URL", status=500)
 
-    def _get_content_and_relation(self, content_type, content_id, preferred_m3u_account_id=None, preferred_stream_id=None):
-        """Get the content object and its M3U relation"""
-        try:
-            logger.info(f"[CONTENT-LOOKUP] Looking up {content_type} with UUID {content_id}")
-            if preferred_m3u_account_id:
-                logger.info(f"[CONTENT-LOOKUP] Preferred M3U account ID: {preferred_m3u_account_id}")
-            if preferred_stream_id:
-                logger.info(f"[CONTENT-LOOKUP] Preferred stream ID: {preferred_stream_id}")
+        # Get connection manager (Redis-backed for multi-worker support)
+        connection_manager = MultiWorkerVODConnectionManager.get_instance()
 
-            if content_type == 'movie':
-                content_obj = get_object_or_404(Movie, uuid=content_id)
-                logger.info(f"[CONTENT-FOUND] Movie: {content_obj.name} (ID: {content_obj.id})")
+        # Stream the content with session-based connection reuse
+        logger.info("[VOD-STREAM] Calling connection manager to stream content")
+        response = connection_manager.stream_content_with_session(
+            session_id=session_id,
+            content_obj=content_obj,
+            stream_url=final_stream_url,
+            m3u_profile=m3u_profile,
+            client_ip=client_ip,
+            client_user_agent=client_user_agent,
+            request=request,
+            utc_start=utc_start,
+            utc_end=utc_end,
+            offset=offset,
+            range_header=range_header,
+            user=user,
+        )
 
-                # Filter by preferred stream ID first (most specific)
-                relations_query = content_obj.m3u_relations.filter(m3u_account__is_active=True)
-                if preferred_stream_id:
-                    specific_relation = relations_query.filter(stream_id=preferred_stream_id).first()
-                    if specific_relation:
-                        logger.info(f"[STREAM-SELECTED] Using specific stream: {specific_relation.stream_id} from provider: {specific_relation.m3u_account.name}")
-                        return content_obj, specific_relation
-                    else:
-                        logger.warning(f"[STREAM-FALLBACK] Preferred stream ID {preferred_stream_id} not found, falling back to account/priority selection")
+        logger.info(f"[VOD-SUCCESS] Stream response created successfully, type: {type(response)}")
+        return response
 
-                # Filter by preferred M3U account if specified
-                if preferred_m3u_account_id:
-                    specific_relation = relations_query.filter(m3u_account__id=preferred_m3u_account_id).first()
-                    if specific_relation:
-                        logger.info(f"[PROVIDER-SELECTED] Using preferred provider: {specific_relation.m3u_account.name}")
-                        return content_obj, specific_relation
-                    else:
-                        logger.warning(f"[PROVIDER-FALLBACK] Preferred M3U account {preferred_m3u_account_id} not found, using highest priority")
+    except Exception as e:
+        logger.error(f"[VOD-EXCEPTION] Error streaming {content_type} {content_id}: {e}", exc_info=True)
+        return HttpResponse(f"Streaming error: {str(e)}", status=500)
 
-                # Get the highest priority active relation (fallback or default)
-                relation = relations_query.select_related('m3u_account').order_by('-m3u_account__priority', 'id').first()
+@api_view(["HEAD"])
+def head_vod(request, content_type, content_id, session_id=None, profile_id=None):
+    """
+    Handle HEAD requests for FUSE filesystem integration
 
-                if relation:
-                    logger.info(f"[PROVIDER-SELECTED] Using provider: {relation.m3u_account.name} (priority: {relation.m3u_account.priority})")
+    Returns content length and session URL header for subsequent GET requests
+    """
+    logger.info(f"[VOD-HEAD] HEAD request: {content_type}/{content_id}, session: {session_id}, profile: {profile_id}")
 
-                return content_obj, relation
+    try:
+        # Get client info for M3U profile selection
+        client_ip, client_user_agent = get_client_info(request)
+        logger.info(f"[VOD-HEAD] Client info - IP: {client_ip}, User-Agent: {client_user_agent[:50] if client_user_agent else 'None'}...")
 
-            elif content_type == 'episode':
-                content_obj = get_object_or_404(Episode, uuid=content_id)
-                logger.info(f"[CONTENT-FOUND] Episode: {content_obj.name} (ID: {content_obj.id}, Series: {content_obj.series.name})")
+        # If no session ID, create one (same logic as GET)
+        if not session_id:
+            new_session_id = f"vod_{int(time.time() * 1000)}_{random.randint(1000, 9999)}"
+            logger.info(f"[VOD-HEAD] Creating new session for HEAD: {new_session_id}")
 
-                # Filter by preferred stream ID first (most specific)
-                relations_query = content_obj.m3u_relations.filter(m3u_account__is_active=True)
-                if preferred_stream_id:
-                    specific_relation = relations_query.filter(stream_id=preferred_stream_id).first()
-                    if specific_relation:
-                        logger.info(f"[STREAM-SELECTED] Using specific stream: {specific_relation.stream_id} from provider: {specific_relation.m3u_account.name}")
-                        return content_obj, specific_relation
-                    else:
-                        logger.warning(f"[STREAM-FALLBACK] Preferred stream ID {preferred_stream_id} not found, falling back to account/priority selection")
-
-                # Filter by preferred M3U account if specified
-                if preferred_m3u_account_id:
-                    specific_relation = relations_query.filter(m3u_account__id=preferred_m3u_account_id).first()
-                    if specific_relation:
-                        logger.info(f"[PROVIDER-SELECTED] Using preferred provider: {specific_relation.m3u_account.name}")
-                        return content_obj, specific_relation
-                    else:
-                        logger.warning(f"[PROVIDER-FALLBACK] Preferred M3U account {preferred_m3u_account_id} not found, using highest priority")
-
-                # Get the highest priority active relation (fallback or default)
-                relation = relations_query.select_related('m3u_account').order_by('-m3u_account__priority', 'id').first()
-
-                if relation:
-                    logger.info(f"[PROVIDER-SELECTED] Using provider: {relation.m3u_account.name} (priority: {relation.m3u_account.priority})")
-
-                return content_obj, relation
-
-            elif content_type == 'series':
-                # For series, get the first episode
-                series = get_object_or_404(Series, uuid=content_id)
-                logger.info(f"[CONTENT-FOUND] Series: {series.name} (ID: {series.id})")
-                episode = series.episodes.first()
-                if not episode:
-                    logger.error(f"[CONTENT-ERROR] No episodes found for series {series.name}")
-                    return None, None
-
-                logger.info(f"[CONTENT-FOUND] First episode: {episode.name} (ID: {episode.id})")
-
-                # Filter by preferred stream ID first (most specific)
-                relations_query = episode.m3u_relations.filter(m3u_account__is_active=True)
-                if preferred_stream_id:
-                    specific_relation = relations_query.filter(stream_id=preferred_stream_id).first()
-                    if specific_relation:
-                        logger.info(f"[STREAM-SELECTED] Using specific stream: {specific_relation.stream_id} from provider: {specific_relation.m3u_account.name}")
-                        return episode, specific_relation
-                    else:
-                        logger.warning(f"[STREAM-FALLBACK] Preferred stream ID {preferred_stream_id} not found, falling back to account/priority selection")
-
-                # Filter by preferred M3U account if specified
-                if preferred_m3u_account_id:
-                    specific_relation = relations_query.filter(m3u_account__id=preferred_m3u_account_id).first()
-                    if specific_relation:
-                        logger.info(f"[PROVIDER-SELECTED] Using preferred provider: {specific_relation.m3u_account.name}")
-                        return episode, specific_relation
-                    else:
-                        logger.warning(f"[PROVIDER-FALLBACK] Preferred M3U account {preferred_m3u_account_id} not found, using highest priority")
-
-                # Get the highest priority active relation (fallback or default)
-                relation = relations_query.select_related('m3u_account').order_by('-m3u_account__priority', 'id').first()
-
-                if relation:
-                    logger.info(f"[PROVIDER-SELECTED] Using provider: {relation.m3u_account.name} (priority: {relation.m3u_account.priority})")
-
-                return episode, relation
-            else:
-                logger.error(f"[CONTENT-ERROR] Invalid content type: {content_type}")
-                return None, None
-
-        except Exception as e:
-            logger.error(f"Error getting content object: {e}")
-            return None, None
-
-    def _get_stream_url_from_relation(self, relation):
-        """Get stream URL from the M3U relation"""
-        try:
-            # Log the relation type and available attributes
-            logger.info(f"[VOD-URL] Relation type: {type(relation).__name__}")
-            logger.info(f"[VOD-URL] Account type: {relation.m3u_account.account_type}")
-            logger.info(f"[VOD-URL] Stream ID: {getattr(relation, 'stream_id', 'N/A')}")
-
-            # First try the get_stream_url method (this should build URLs dynamically)
-            if hasattr(relation, 'get_stream_url'):
-                url = relation.get_stream_url()
-                if url:
-                    logger.info(f"[VOD-URL] Built URL from get_stream_url(): {url}")
-                    return url
-                else:
-                    logger.warning(f"[VOD-URL] get_stream_url() returned None")
-
-            logger.error(f"[VOD-URL] Relation has no get_stream_url method or it failed")
-            return None
-        except Exception as e:
-            logger.error(f"[VOD-URL] Error getting stream URL from relation: {e}", exc_info=True)
-            return None
-
-    def _get_m3u_profile(self, m3u_account, profile_id, session_id=None):
-        """Get appropriate M3U profile for streaming using Redis-based viewer counts
-
-        Args:
-            m3u_account: M3UAccount instance
-            profile_id: Optional specific profile ID requested
-            session_id: Optional session ID to check for existing connections
-
-        Returns:
-            tuple: (M3UAccountProfile, current_connections) or None if no profile found
-        """
-        try:
-            from core.utils import RedisClient
-            redis_client = RedisClient.get_client()
-
-            if not redis_client:
-                logger.warning("Redis not available, falling back to default profile")
-                default_profile = M3UAccountProfile.objects.filter(
-                    m3u_account=m3u_account,
-                    is_active=True,
-                    is_default=True
-                ).first()
-                return (default_profile, 0) if default_profile else None
-
-            # Check if this session already has an active connection
-            if session_id:
-                persistent_connection_key = f"vod_persistent_connection:{session_id}"
-                connection_data = redis_client.hgetall(persistent_connection_key)
-
-                if connection_data:
-                    existing_profile_id = connection_data.get('m3u_profile_id')
-                    if existing_profile_id:
-                        try:
-                            existing_profile = M3UAccountProfile.objects.get(
-                                id=int(existing_profile_id),
-                                m3u_account=m3u_account,
-                                is_active=True
-                            )
-                            # Get current connections for logging
-                            profile_connections_key = f"profile_connections:{existing_profile.id}"
-                            current_connections = int(redis_client.get(profile_connections_key) or 0)
-
-                            logger.info(f"[PROFILE-SELECTION] Session {session_id} reusing existing profile {existing_profile.id}: {current_connections}/{existing_profile.max_streams} connections")
-                            return (existing_profile, current_connections)
-                        except (M3UAccountProfile.DoesNotExist, ValueError):
-                            logger.warning(f"[PROFILE-SELECTION] Session {session_id} has invalid profile ID {existing_profile_id}, selecting new profile")
-                        except Exception as e:
-                            logger.warning(f"[PROFILE-SELECTION] Error checking existing profile for session {session_id}: {e}")
-                    else:
-                        logger.debug(f"[PROFILE-SELECTION] Session {session_id} exists but has no profile ID stored")            # If specific profile requested, try to use it
+            # Build session URL for response header
+            path_parts = request.path.rstrip('/').split('/')
             if profile_id:
-                try:
-                    profile = M3UAccountProfile.objects.get(
-                        id=profile_id,
-                        m3u_account=m3u_account,
-                        is_active=True
-                    )
-                    # Check Redis-based current connections
-                    profile_connections_key = f"profile_connections:{profile.id}"
-                    current_connections = int(redis_client.get(profile_connections_key) or 0)
+                session_url = f"{'/'.join(path_parts)}/{new_session_id}/{profile_id}/"
+            else:
+                session_url = f"{'/'.join(path_parts)}/{new_session_id}"
 
-                    if profile.max_streams == 0 or current_connections < profile.max_streams:
-                        logger.info(f"[PROFILE-SELECTION] Using requested profile {profile.id}: {current_connections}/{profile.max_streams} connections")
-                        return (profile, current_connections)
-                    else:
-                        logger.warning(f"[PROFILE-SELECTION] Requested profile {profile.id} is at capacity: {current_connections}/{profile.max_streams}")
-                except M3UAccountProfile.DoesNotExist:
-                    logger.warning(f"[PROFILE-SELECTION] Requested profile {profile_id} not found")
+            session_id = new_session_id
+        else:
+            # Session already in URL, construct the current session URL
+            session_url = request.path
+            logger.info(f"[VOD-HEAD] Using existing session: {session_id}")
 
-            # Get active profiles ordered by priority (default first)
-            m3u_profiles = M3UAccountProfile.objects.filter(
-                m3u_account=m3u_account,
-                is_active=True
-            )
+        # Extract preferred M3U account ID and stream ID from query parameters
+        preferred_m3u_account_id = request.GET.get('m3u_account_id')
+        preferred_stream_id = request.GET.get('stream_id')
 
-            default_profile = m3u_profiles.filter(is_default=True).first()
-            if not default_profile:
-                logger.error(f"[PROFILE-SELECTION] No default profile found for M3U account {m3u_account.id}")
-                return None
+        if preferred_m3u_account_id:
+            try:
+                preferred_m3u_account_id = int(preferred_m3u_account_id)
+            except (ValueError, TypeError):
+                logger.warning(f"[VOD-HEAD] Invalid m3u_account_id parameter: {preferred_m3u_account_id}")
+                preferred_m3u_account_id = None
 
-            # Check profiles in order: default first, then others
-            profiles = [default_profile] + list(m3u_profiles.filter(is_default=False))
+        if preferred_stream_id:
+            logger.info(f"[VOD-HEAD] Preferred stream ID: {preferred_stream_id}")
 
-            for profile in profiles:
-                profile_connections_key = f"profile_connections:{profile.id}"
-                current_connections = int(redis_client.get(profile_connections_key) or 0)
+        # Get content and relation (same as GET)
+        content_obj, relation = _get_content_and_relation(content_type, content_id, preferred_m3u_account_id, preferred_stream_id)
+        if not content_obj or not relation:
+            logger.error(f"[VOD-HEAD] Content or relation not found: {content_type} {content_id}")
+            return HttpResponse("Content not found", status=404)
 
-                # Check if profile has available connection slots
-                if profile.max_streams == 0 or current_connections < profile.max_streams:
-                    logger.info(f"[PROFILE-SELECTION] Selected profile {profile.id} ({profile.name}): {current_connections}/{profile.max_streams} connections")
-                    return (profile, current_connections)
-                else:
-                    logger.debug(f"[PROFILE-SELECTION] Profile {profile.id} at capacity: {current_connections}/{profile.max_streams}")
+        # Get M3U account and stream URL
+        m3u_account = relation.m3u_account
+        stream_url = _get_stream_url_from_relation(relation)
+        if not stream_url:
+            logger.error(f"[VOD-HEAD] No stream URL available for {content_type} {content_id}")
+            return HttpResponse("No stream URL available", status=503)
 
-            # All profiles are at capacity - return None to trigger error response
-            logger.error(f"[PROFILE-SELECTION] All profiles at capacity for M3U account {m3u_account.id}, rejecting request")
-            return None
+        # Get M3U profile (returns profile and current connection count)
+        profile_result = _get_m3u_profile(m3u_account, profile_id, session_id)
+        if not profile_result or not profile_result[0]:
+            logger.error(f"[VOD-HEAD] No M3U profile found or all profiles at capacity")
+            return HttpResponse("No available stream", status=503)
 
-        except Exception as e:
-            logger.error(f"Error getting M3U profile: {e}")
-            return None
+        m3u_profile, current_connections = profile_result
 
-    def _transform_url(self, original_url, m3u_profile):
-        """Transform URL based on M3U profile settings"""
+        # Transform URL if needed
+        final_stream_url = _transform_url(stream_url, m3u_profile)
+
+        # Make a small range GET request to get content length since providers don't support HEAD
+        # We'll use a tiny range to minimize data transfer but get the headers we need
+        # Use M3U account's user agent as primary, client user agent as fallback
+        m3u_user_agent = m3u_account.get_user_agent().user_agent if m3u_account.get_user_agent() else None
+        headers = {
+            'User-Agent': m3u_user_agent or client_user_agent or 'Dispatcharr/1.0',
+            'Accept': '*/*',
+            'Range': 'bytes=0-1'  # Request only first 2 bytes
+        }
+
+        logger.info(f"[VOD-HEAD] Making small range GET request to provider: {final_stream_url}")
+        response = requests.get(final_stream_url, headers=headers, timeout=30, allow_redirects=True, stream=True)
+
+        # Check for range support - should be 206 for partial content
+        if response.status_code == 206:
+            # Parse Content-Range header to get total file size
+            content_range = response.headers.get('Content-Range', '')
+            if content_range:
+                # Content-Range: bytes 0-1/1234567890
+                total_size = content_range.split('/')[-1]
+                logger.info(f"[VOD-HEAD] Got file size from Content-Range: {total_size}")
+            else:
+                logger.warning(f"[VOD-HEAD] No Content-Range header in 206 response")
+                total_size = response.headers.get('Content-Length', '0')
+        elif response.status_code == 200:
+            # Server doesn't support range requests, use Content-Length from full response
+            total_size = response.headers.get('Content-Length', '0')
+            logger.info(f"[VOD-HEAD] Server doesn't support ranges, got Content-Length: {total_size}")
+        else:
+            logger.error(f"[VOD-HEAD] Provider GET request failed: {response.status_code}")
+            return HttpResponse("Provider error", status=response.status_code)
+
+        # Close the small range request - we don't need to keep this connection
+        response.close()
+
+        # Store the total content length in Redis for the persistent connection to use
         try:
-            import re
-
-            if not original_url:
-                return None
-
-            search_pattern = m3u_profile.search_pattern
-            replace_pattern = m3u_profile.replace_pattern
-            safe_replace_pattern = re.sub(r'\$(\d+)', r'\\\1', replace_pattern)
-
-            if search_pattern and replace_pattern:
-                transformed_url = re.sub(search_pattern, safe_replace_pattern, original_url)
-                return transformed_url
-
-            return original_url
-
+            import redis
+            from django.conf import settings
+            redis_host = getattr(settings, 'REDIS_HOST', 'localhost')
+            redis_port = int(getattr(settings, 'REDIS_PORT', 6379))
+            redis_db = int(getattr(settings, 'REDIS_DB', 0))
+            redis_password = getattr(settings, 'REDIS_PASSWORD', '')
+            redis_user = getattr(settings, 'REDIS_USER', '')
+            r = redis.StrictRedis(
+                host=redis_host,
+                port=redis_port,
+                db=redis_db,
+                password=redis_password if redis_password else None,
+                username=redis_user if redis_user else None,
+                decode_responses=True
+            )
+            content_length_key = f"vod_content_length:{session_id}"
+            r.set(content_length_key, total_size, ex=1800)  # Store for 30 minutes
+            logger.info(f"[VOD-HEAD] Stored total content length {total_size} for session {session_id}")
         except Exception as e:
-            logger.error(f"Error transforming URL: {e}")
-            return original_url
+            logger.error(f"[VOD-HEAD] Failed to store content length in Redis: {e}")
+
+        # Now create a persistent connection for the session (if one doesn't exist)
+        # This ensures the FUSE GET requests will reuse the same connection
+
+        connection_manager = MultiWorkerVODConnectionManager.get_instance()
+
+        logger.info(f"[VOD-HEAD] Pre-creating persistent connection for session: {session_id}")
+
+        # We don't actually stream content here, just ensure connection is ready
+        # The actual GET requests from FUSE will use the persistent connection
+
+        # Use the total_size we extracted from the range response
+        provider_content_type = response.headers.get('Content-Type')
+
+        if provider_content_type:
+            content_type_header = provider_content_type
+            logger.info(f"[VOD-HEAD] Using provider Content-Type: {content_type_header}")
+        else:
+            # Provider didn't send Content-Type, infer from URL
+            inferred_content_type = infer_content_type_from_url(final_stream_url)
+            if inferred_content_type:
+                content_type_header = inferred_content_type
+                logger.info(f"[VOD-HEAD] Provider missing Content-Type, inferred from URL: {content_type_header}")
+            else:
+                content_type_header = 'video/mp4'
+                logger.info(f"[VOD-HEAD] No Content-Type from provider and could not infer from URL, using default: {content_type_header}")
+
+        logger.info(f"[VOD-HEAD] Provider response - Total Size: {total_size}, Type: {content_type_header}")
+
+        # Create response with content length and session URL header
+        head_response = HttpResponse()
+        head_response['Content-Length'] = total_size
+        head_response['Content-Type'] = content_type_header
+        head_response['Accept-Ranges'] = 'bytes'
+
+        # Custom header with session URL for FUSE
+        head_response['X-Session-URL'] = session_url
+        head_response['X-Dispatcharr-Session'] = session_id
+
+        logger.info(f"[VOD-HEAD] Returning HEAD response with session URL: {session_url}")
+        return head_response
+
+    except Exception as e:
+        logger.error(f"[VOD-HEAD] Error in HEAD request: {e}", exc_info=True)
+        return HttpResponse(f"HEAD error: {str(e)}", status=500)
 
 @method_decorator(csrf_exempt, name='dispatch')
 class VODPlaylistView(View):
@@ -1069,4 +1083,59 @@ def stop_vod_client(request):
         logger.error(f"Error stopping VOD client: {e}", exc_info=True)
         return JsonResponse({'error': str(e)}, status=500)
 
+@api_view(["GET"])
+def stream_xc_movie(request, username, password, stream_id, extension):
+    from apps.vod.models import M3UMovieRelation
 
+    session_id = request.GET.get('session_id')
+    profile_id = request.GET.get('profile_id')
+
+    user = get_object_or_404(User, username=username)
+
+    custom_properties = user.custom_properties or {}
+
+    if "xc_password" not in custom_properties:
+        return Response({"error": "Invalid credentials"}, status=401)
+
+    if custom_properties["xc_password"] != password:
+        return Response({"error": "Invalid credentials"}, status=401)
+
+    # All authenticated users get access to VOD from all active M3U accounts
+    filters = {"movie_id": stream_id, "m3u_account__is_active": True}
+
+    try:
+        # Order by account priority to get the best relation when multiple exist
+        movie_relation = M3UMovieRelation.objects.select_related('movie').filter(**filters).order_by('-m3u_account__priority', 'id').first()
+        if not movie_relation:
+            return JsonResponse({"error": "Movie not found"}, status=404)
+    except (M3UMovieRelation.DoesNotExist, M3UMovieRelation.MultipleObjectsReturned):
+        return JsonResponse({"error": "Movie not found"}, status=404)
+
+    return stream_vod(request._request, 'movie', movie_relation.movie.uuid, session_id, profile_id, user)
+
+@api_view(["GET"])
+def stream_xc_episode(request, username, password, stream_id, extension):
+    from apps.vod.models import M3UEpisodeRelation
+
+    session_id = request.GET.get('session_id')
+    profile_id = request.GET.get('profile_id')
+
+    user = get_object_or_404(User, username=username)
+
+    custom_properties = user.custom_properties or {}
+
+    if "xc_password" not in custom_properties:
+        return Response({"error": "Invalid credentials"}, status=401)
+
+    if custom_properties["xc_password"] != password:
+        return Response({"error": "Invalid credentials"}, status=401)
+
+    # All authenticated users get access to series/episodes from all active M3U accounts
+    filters = {"episode_id": stream_id, "m3u_account__is_active": True}
+
+    try:
+        episode_relation = M3UEpisodeRelation.objects.select_related('episode').filter(**filters).order_by('-m3u_account__priority', 'id').first()
+    except M3UEpisodeRelation.DoesNotExist:
+        return JsonResponse({"error": "Episode not found"}, status=404)
+
+    return stream_vod(request._request, 'episode', episode_relation.episode.uuid, session_id, profile_id, user)
diff --git a/apps/vod/api_views.py b/apps/vod/api_views.py
index 8b778c81..edb1b110 100644
--- a/apps/vod/api_views.py
+++ b/apps/vod/api_views.py
@@ -903,4 +903,3 @@ class VODLogoViewSet(viewsets.ModelViewSet):
                 {"error": str(e)},
                 status=status.HTTP_500_INTERNAL_SERVER_ERROR
             )
-
diff --git a/core/migrations/022_default_user_limit_settings.py b/core/migrations/022_default_user_limit_settings.py
new file mode 100644
index 00000000..af758a11
--- /dev/null
+++ b/core/migrations/022_default_user_limit_settings.py
@@ -0,0 +1,24 @@
+# Generated by Django 5.1.6 on 2025-03-01 14:01
+
+from django.db import migrations
+from django.utils.text import slugify
+
+
+def preload_user_limit_settings(apps, schema_editor):
+    CoreSettings = apps.get_model("core", "CoreSettings")
+    CoreSettings.objects.create(
+        key="user_limits",
+        name="User Limits",
+        value={},
+    )
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("core", "0021_systemnotification_notificationdismissal"),
+    ]
+
+    operations = [
+        migrations.RunPython(preload_user_limit_settings),
+    ]
diff --git a/core/models.py b/core/models.py
index 4e6322e7..faf1ff0a 100644
--- a/core/models.py
+++ b/core/models.py
@@ -156,6 +156,7 @@ PROXY_SETTINGS_KEY = "proxy_settings"
 NETWORK_ACCESS_KEY = "network_access"
 SYSTEM_SETTINGS_KEY = "system_settings"
 EPG_SETTINGS_KEY = "epg_settings"
+USER_LIMITS_SETTINGS_KEY = "user_limits_settings"
 
 
 class CoreSettings(models.Model):
@@ -351,6 +352,15 @@ class CoreSettings(models.Model):
         cls._update_group(SYSTEM_SETTINGS_KEY, "System Settings", {"time_zone": value})
         return value
 
+    @classmethod
+    def get_user_limits_settings(cls):
+        return cls._get_group(USER_LIMITS_SETTINGS_KEY, {
+            "terminate_on_limit_exceeded": True,
+            "prioritize_single_client_channels": True,
+            "ignore_same_channel_connections": False,
+            "terminate_oldest": True,
+        })
+
 
 class SystemEvent(models.Model):
     """
diff --git a/core/utils.py b/core/utils.py
index ca5a6b06..05203870 100644
--- a/core/utils.py
+++ b/core/utils.py
@@ -42,7 +42,6 @@ def natural_sort_key(text):
     return [convert(c) for c in re.split('([0-9]+)', text)]
 
 class RedisClient:
-    _initialized = False
     _client = None
     _buffer = None
     _pubsub_client = None
@@ -79,9 +78,6 @@ class RedisClient:
 
                 # Validate connection with ping
                 client.ping()
-                if cls._initialized is False:
-                    client.flushdb()
-                    cls._initialized = True
 
                 # Disable persistence on first connection - improves performance
                 # Only try to disable if not in a read-only environment
@@ -141,97 +137,9 @@ class RedisClient:
 
     @classmethod
     def get_client(cls, max_retries=5, retry_interval=1):
+        """Get Redis client optimized for non-binary data (decoded responses)"""
         if cls._client is None:
-            retry_count = 0
-            while retry_count < max_retries:
-                try:
-                    # Get connection parameters from settings or environment
-                    redis_host = os.environ.get("REDIS_HOST", getattr(settings, 'REDIS_HOST', 'localhost'))
-                    redis_port = int(os.environ.get("REDIS_PORT", getattr(settings, 'REDIS_PORT', 6379)))
-                    redis_db = int(os.environ.get("REDIS_DB", getattr(settings, 'REDIS_DB', 0)))
-                    redis_password = os.environ.get("REDIS_PASSWORD", getattr(settings, 'REDIS_PASSWORD', ''))
-                    redis_user = os.environ.get("REDIS_USER", getattr(settings, 'REDIS_USER', ''))
-
-                    # Use standardized settings
-                    socket_timeout = getattr(settings, 'REDIS_SOCKET_TIMEOUT', 5)
-                    socket_connect_timeout = getattr(settings, 'REDIS_SOCKET_CONNECT_TIMEOUT', 5)
-                    health_check_interval = getattr(settings, 'REDIS_HEALTH_CHECK_INTERVAL', 30)
-                    socket_keepalive = getattr(settings, 'REDIS_SOCKET_KEEPALIVE', True)
-                    retry_on_timeout = getattr(settings, 'REDIS_RETRY_ON_TIMEOUT', True)
-
-                    # Create Redis client with better defaults
-                    client = redis.Redis(
-                        host=redis_host,
-                        port=redis_port,
-                        db=redis_db,
-                        password=redis_password if redis_password else None,
-                        username=redis_user if redis_user else None,
-                        socket_timeout=socket_timeout,
-                        socket_connect_timeout=socket_connect_timeout,
-                        socket_keepalive=socket_keepalive,
-                        health_check_interval=health_check_interval,
-                        retry_on_timeout=retry_on_timeout
-                    )
-
-                    # Validate connection with ping
-                    client.ping()
-
-                    # Disable persistence on first connection - improves performance
-                    # Only try to disable if not in a read-only environment
-                    try:
-                        client.config_set('save', '')  # Disable RDB snapshots
-                        client.config_set('appendonly', 'no')  # Disable AOF logging
-
-                        # Set optimal memory settings with environment variable support
-                        # Get max memory from environment or use a larger default (512MB instead of 256MB)
-                        #max_memory = os.environ.get('REDIS_MAX_MEMORY', '512mb')
-                        #eviction_policy = os.environ.get('REDIS_EVICTION_POLICY', 'allkeys-lru')
-
-                        # Apply memory settings
-                        #client.config_set('maxmemory-policy', eviction_policy)
-                        #client.config_set('maxmemory', max_memory)
-
-                        #logger.info(f"Redis configured with maxmemory={max_memory}, policy={eviction_policy}")
-
-                        # Disable protected mode when in debug mode
-                        if os.environ.get('DISPATCHARR_DEBUG', '').lower() == 'true':
-                            client.config_set('protected-mode', 'no')  # Disable protected mode in debug
-                            logger.warning("Redis protected mode disabled for debug environment")
-
-                        logger.trace("Redis persistence disabled for better performance")
-                    except redis.exceptions.ResponseError as e:
-                        # Improve error handling for Redis configuration errors
-                        if "OOM" in str(e):
-                            logger.error(f"Redis OOM during configuration: {e}")
-                            # Try to increase maxmemory as an emergency measure
-                            try:
-                                client.config_set('maxmemory', '768mb')
-                                logger.warning("Applied emergency Redis memory increase to 768MB")
-                            except:
-                                pass
-                        else:
-                            logger.error(f"Redis configuration error: {e}")
-
-                    logger.info(f"Connected to Redis at {redis_host}:{redis_port}/{redis_db}")
-
-                    cls._client = client
-                    break
-
-                except (ConnectionError, TimeoutError) as e:
-                    retry_count += 1
-                    if retry_count >= max_retries:
-                        logger.error(f"Failed to connect to Redis after {max_retries} attempts: {e}")
-                        return None
-                    else:
-                        # Use exponential backoff for retries
-                        wait_time = retry_interval * (2 ** (retry_count - 1))
-                        logger.warning(f"Redis connection failed. Retrying in {wait_time}s... ({retry_count}/{max_retries})")
-                        time.sleep(wait_time)
-
-                except Exception as e:
-                    logger.error(f"Unexpected error connecting to Redis: {e}")
-                    return None
-
+            cls._client = cls._init_client(decode_responses=True, max_retries=max_retries, retry_interval=retry_interval)
         return cls._client
 
     @classmethod
diff --git a/core/xtream_codes.py b/core/xtream_codes.py
index 9b56197a..822b37fd 100644
--- a/core/xtream_codes.py
+++ b/core/xtream_codes.py
@@ -62,7 +62,7 @@ class Client:
             url = f"{self.server_url}/{endpoint}"
             logger.debug(f"XC API Request: {url} with params: {params}")
 
-            response = self.session.get(url, params=params, timeout=30)
+            response = self.session.get(url, params=params, timeout=60)
             response.raise_for_status()
 
             # Check if response is empty
diff --git a/dispatcharr/urls.py b/dispatcharr/urls.py
index 092fb0cb..1319f31e 100644
--- a/dispatcharr/urls.py
+++ b/dispatcharr/urls.py
@@ -6,7 +6,7 @@ from django.views.generic import TemplateView, RedirectView
 from .routing import websocket_urlpatterns
 from apps.output.views import xc_player_api, xc_panel_api, xc_get, xc_xmltv
 from apps.proxy.ts_proxy.views import stream_xc
-from apps.output.views import xc_movie_stream, xc_series_stream
+from apps.proxy.vod_proxy.views import stream_xc_movie, stream_xc_episode
 
 urlpatterns = [
     # API Routes
@@ -44,13 +44,13 @@ urlpatterns = [
     # XC VOD endpoints
     path(
         "movie/<str:username>/<str:password>/<str:stream_id>.<str:extension>",
-        xc_movie_stream,
-        name="xc_movie_stream",
+        stream_xc_movie,
+        name="stream_xc_movie",
     ),
     path(
         "series/<str:username>/<str:password>/<str:stream_id>.<str:extension>",
-        xc_series_stream,
-        name="xc_series_stream",
+        stream_xc_episode,
+        name="stream_xc_episode",
     ),
     # Admin
     path("admin", RedirectView.as_view(url="/admin/", permanent=True)),
diff --git a/frontend/src/api.js b/frontend/src/api.js
index 9e4ac982..f299d032 100644
--- a/frontend/src/api.js
+++ b/frontend/src/api.js
@@ -2989,12 +2989,15 @@ export default class API {
     }
   }
 
-  static async updateUser(id, body) {
+  static async updateUser(id, body, self = false) {
     try {
-      const response = await request(`${host}/api/accounts/users/${id}/`, {
-        method: 'PATCH',
-        body,
-      });
+      const response = await request(
+        `${host}/api/accounts/users/${self ? 'me' : id}/`,
+        {
+          method: 'PATCH',
+          body,
+        }
+      );
 
       useUsersStore.getState().updateUser(response);
 
diff --git a/frontend/src/components/forms/User.jsx b/frontend/src/components/forms/User.jsx
index 859cd45a..f62975ff 100644
--- a/frontend/src/components/forms/User.jsx
+++ b/frontend/src/components/forms/User.jsx
@@ -17,6 +17,7 @@ import {
   Tooltip,
   Grid,
   SimpleGrid,
+  NumberInput,
   useMantineTheme,
 } from '@mantine/core';
 import { RotateCcwKey, RotateCw, X } from 'lucide-react';
@@ -48,6 +49,7 @@ const User = ({ user = null, isOpen, onClose }) => {
       last_name: '',
       email: '',
       user_level: '0',
+      stream_limit: 0,
       password: '',
       xc_password: '',
       channel_profiles: [],
@@ -117,7 +119,11 @@ const User = ({ user = null, isOpen, onClose }) => {
         delete values.password;
       }
 
-      const response = await API.updateUser(user.id, values);
+      const response = await API.updateUser(
+        user.id,
+        values,
+        isAdmin ? false : authUser.id === user.id
+      );
 
       if (user.id == authUser.id) {
         setUser(response);
@@ -139,6 +145,7 @@ const User = ({ user = null, isOpen, onClose }) => {
         last_name: user.last_name || '',
         email: user.email,
         user_level: `${user.user_level}`,
+        stream_limit: user.stream_limit || 0,
         channel_profiles:
           user.channel_profiles.length > 0
             ? user.channel_profiles.map((id) => `${id}`)
@@ -236,6 +243,7 @@ const User = ({ user = null, isOpen, onClose }) => {
               id="username"
               name="username"
               label="Username"
+              disabled={!isAdmin}
               {...form.getInputProps('username')}
               key={form.key('username')}
             />
@@ -257,19 +265,26 @@ const User = ({ user = null, isOpen, onClose }) => {
             />
 
             {showPermissions && (
-              <Select
-                label="User Level"
-                data={Object.entries(USER_LEVELS).map(([, value]) => {
-                  return {
-                    label: USER_LEVEL_LABELS[value],
-                    value: `${value}`,
-                  };
-                })}
-                {...form.getInputProps('user_level')}
-                key={form.key('user_level')}
-              />
-            )}
+              <>
+                <Select
+                  label="User Level"
+                  data={Object.entries(USER_LEVELS).map(([, value]) => {
+                    return {
+                      label: USER_LEVEL_LABELS[value],
+                      value: `${value}`,
+                    };
+                  })}
+                  {...form.getInputProps('user_level')}
+                  key={form.key('user_level')}
+                />
 
+                <NumberInput
+                  label="Stream Limit (0 = unlimited)"
+                  {...form.getInputProps('stream_limit')}
+                  key={form.key('stream_limit')}
+                />
+              </>
+            )}
           </Stack>
 
           <Stack gap="xs" style={{ flex: 1 }}>
diff --git a/frontend/src/components/forms/settings/UserLimitsForm.jsx b/frontend/src/components/forms/settings/UserLimitsForm.jsx
new file mode 100644
index 00000000..3481a7db
--- /dev/null
+++ b/frontend/src/components/forms/settings/UserLimitsForm.jsx
@@ -0,0 +1,116 @@
+import useSettingsStore from '../../../store/settings.jsx';
+import React, { useEffect, useState } from 'react';
+import { useForm } from '@mantine/form';
+import { updateSetting } from '../../../utils/pages/SettingsUtils.js';
+import {
+  Alert,
+  Button,
+  Flex,
+  NumberInput,
+  Stack,
+  TextInput,
+  Checkbox,
+} from '@mantine/core';
+import { USER_LIMITS_OPTIONS } from '../../../constants.js';
+
+const USER_LIMIT_DEFAULTS = Object.keys(USER_LIMITS_OPTIONS).reduce(
+  (acc, key) => {
+    acc[key] = USER_LIMITS_OPTIONS[key].default;
+    return acc;
+  },
+  {}
+);
+
+const UserLimitsForm = React.memo(({ active }) => {
+  const settings = useSettingsStore((s) => s.settings);
+
+  const [saved, setSaved] = useState(false);
+
+  const userLimitSettingsForm = useForm({
+    mode: 'controlled',
+    initialValues: USER_LIMIT_DEFAULTS,
+  });
+
+  useEffect(() => {
+    if (!active) setSaved(false);
+  }, [active]);
+
+  useEffect(() => {
+    if (settings) {
+      if (settings['user_limits']?.value) {
+        userLimitSettingsForm.setValues({
+          ...USER_LIMIT_DEFAULTS,
+          ...settings['user_limits'].value,
+        });
+      }
+    }
+  }, [settings]);
+
+  const resetUserLimitsToDefaults = () => {
+    userLimitSettingsForm.setValues(USER_LIMIT_DEFAULTS);
+  };
+
+  const onUserLimitsSubmit = async () => {
+    setSaved(false);
+
+    try {
+      const result = await updateSetting({
+        ...settings['user_limits'],
+        value: userLimitSettingsForm.getValues(),
+      });
+      if (result) {
+        setSaved(true);
+      }
+    } catch (error) {
+      console.error('Error saving user limit settings:', error);
+    }
+  };
+
+  return (
+    <form onSubmit={userLimitSettingsForm.onSubmit(onUserLimitsSubmit)}>
+      <Stack gap="sm">
+        {saved && (
+          <Alert
+            variant="light"
+            color="green"
+            title="Saved Successfully"
+          ></Alert>
+        )}
+
+        {Object.keys(USER_LIMITS_OPTIONS).reduce((acc, key) => {
+          const option = USER_LIMITS_OPTIONS[key];
+          acc.push(
+            <Checkbox
+              key={key}
+              label={option.label}
+              description={option.description}
+              {...userLimitSettingsForm.getInputProps(key, {
+                type: 'checkbox',
+              })}
+            />
+          );
+          return acc;
+        }, [])}
+
+        <Flex mih={50} gap="xs" justify="space-between" align="flex-end">
+          <Button
+            variant="subtle"
+            color="gray"
+            onClick={resetUserLimitsToDefaults}
+          >
+            Reset to Defaults
+          </Button>
+          <Button
+            type="submit"
+            disabled={userLimitSettingsForm.submitting}
+            variant="default"
+          >
+            Save
+          </Button>
+        </Flex>
+      </Stack>
+    </form>
+  );
+});
+
+export default UserLimitsForm;
diff --git a/frontend/src/constants.js b/frontend/src/constants.js
index 0c19eea1..e8638cc8 100644
--- a/frontend/src/constants.js
+++ b/frontend/src/constants.js
@@ -62,6 +62,33 @@ export const PROXY_SETTINGS_OPTIONS = {
   },
 };
 
+export const USER_LIMITS_OPTIONS = {
+  terminate_on_limit_exceeded: {
+    label: 'Terminate on Limit Exceeded',
+    description:
+      'Terminate a stream (based on below criteria) when the user exceeds the allowed limits',
+    default: true,
+  },
+  prioritize_single_client_channels: {
+    label: 'Prioritize Single Client Channels',
+    description:
+      'Prioritize terminating channels only a single client belonging to the user',
+    default: true,
+  },
+  ignore_same_channel_connections: {
+    label: 'Ignore Same-Channel Connections',
+    description:
+      'Multiple user connections to the same channel count as 1 connection toward user limits',
+    default: false,
+  },
+  terminate_oldest: {
+    label: 'Terminate Oldest',
+    description:
+      'Prioritize terminating the oldest stream when limits are exceeded. Setting to false prioritizes the newest stream.',
+    default: true,
+  },
+};
+
 export const M3U_FILTER_TYPES = [
   {
     label: 'Group',
diff --git a/frontend/src/pages/Settings.jsx b/frontend/src/pages/Settings.jsx
index 8bef5b47..71bbc68c 100644
--- a/frontend/src/pages/Settings.jsx
+++ b/frontend/src/pages/Settings.jsx
@@ -23,6 +23,7 @@ const BackupManager = React.lazy(
 import useAuthStore from '../store/auth';
 import { USER_LEVELS } from '../constants';
 import UiSettingsForm from '../components/forms/settings/UiSettingsForm.jsx';
+import UserLimitsForm from '../components/forms/settings/UserLimitsForm.jsx';
 import ErrorBoundary from '../components/ErrorBoundary.jsx';
 const NetworkAccessForm = React.lazy(
   () => import('../components/forms/settings/NetworkAccessForm.jsx')
@@ -200,6 +201,19 @@ const SettingsPage = () => {
                   </ErrorBoundary>
                 </AccordionPanel>
               </AccordionItem>
+
+              <AccordionItem value="user-limits">
+                <AccordionControl>User Limts</AccordionControl>
+                <AccordionPanel>
+                  <ErrorBoundary>
+                    <Suspense fallback={<Loader />}>
+                      <UserLimitsForm
+                        active={accordianValue === 'user-limits'}
+                      />
+                    </Suspense>
+                  </ErrorBoundary>
+                </AccordionPanel>
+              </AccordionItem>
             </>
           )}
         </Accordion>

From af54366d76cafec9a02fd0b0397823a4f8f81468 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Thu, 26 Mar 2026 10:15:24 -0500
Subject: [PATCH 28/67] changelog: Update changelog for XML parsing fixes.

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c5dace89..58a41e3d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- TLS and mutual TLS (mTLS) support for Redis and PostgreSQL connections in modular deployments. Supports encrypted connections, server certificate verification (Redis: on/off; PostgreSQL: verify-full, verify-ca, require), CA certificate configuration, and client certificate authentication. Configured via environment variables in the docker compose file. Includes startup validation for certificate paths and TLS/URL scheme conflicts, and a read-only Connection Security panel in System Settings. (Closes #950)
+- TLS and mutual TLS (mTLS) support for Redis and PostgreSQL connections in modular deployments. Supports encrypted connections, server certificate verification (Redis: on/off; PostgreSQL: verify-full, verify-ca, require), CA certificate configuration, and client certificate authentication. Configured via environment variables in the docker compose file. Includes startup validation for certificate paths and TLS/URL scheme conflicts, and a read-only Connection Security panel in System Settings. (Closes #950) — Thanks [@CodeBormen](https://github.com/CodeBormen)
 - Status filter for M3U group and VOD category filter modals: A new **All / Enabled / Disabled** segmented control is now shown alongside the text search input in the Live, VOD - Movies, and VOD - Series tabs of the M3U Group Filter modal. The status filter works in combination with the text search and also scopes the "Select Visible" / "Deselect Visible" buttons so they only act on the currently visible subset. (Closes #312)
 
 ### Changed
@@ -24,6 +24,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- HTML named entities in XMLTV EPG files are now resolved to Unicode characters before lxml parsing. Some EPG providers (particularly French and other European sources) use HTML named entities like `&eacute;`, `&icirc;`, `&uuml;` in channel names, program titles, and metadata. These are not valid XML entities — lxml 6.0.2 with `recover=True` silently drops them, causing characters to go missing (e.g., "Chaîne Télé" becomes "Chane Tl"). A preprocessing step in `fetch_xmltv()` now resolves HTML named entities while preserving the 5 XML-predefined entities, detecting encoding from the XML declaration (falling back to UTF-8), and processing line-by-line to a temp file before atomically replacing the original. (Closes #1095) — Thanks [@CodeBormen](https://github.com/CodeBormen)
 - Duplicate recordings created when EPG sources refresh and re-evaluate series rules — Thanks [@CodeBormen](https://github.com/CodeBormen):
   - **Program ID instability**: `parse_programs_for_source()` deletes and recreates all `ProgramData` rows with new auto-increment IDs on every EPG refresh. The dedup set used these IDs, so it never matched after a refresh. Deduplication now uses a stable `(tvg_id, start_time, end_time)` composite key sourced from `Recording.custom_properties.program`.
   - **Secondary guard using wrong times**: The DB guard compared unadjusted program times against offset-adjusted `Recording.start_time`/`end_time`, so it never matched when any DVR pre/post offset was configured. It now queries `custom_properties__program__start_time/end_time` (the original, unadjusted program times stored at recording creation).

From b671a72707867d2340932ad060075a3bb74ac637 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Thu, 26 Mar 2026 18:41:42 -0500
Subject: [PATCH 29/67] fix: resolve decode_responses migration bugs and
 user-limit regressions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix a wave of bugs introduced by the user-priority branch's migration
from manual .decode('utf-8') calls to decode_responses=True on the
metadata Redis client:

core/utils.py
- Rewrite _init_client: fix SyntaxError at line 138, missing
  redis_password/redis_user params, cls._client corruption when
  decode_responses=False was requested, and dead retry backoff logic

apps/proxy/utils.py
- Fix get_user_limit_settings() → get_user_limits_settings() (2 sites)
- Fix VOD scan key vod_persistent_connections:* → vod_persistent_connection:*
- Fix undefined channel_id in VOD loop (use content_uuid from Redis hash)
- Remove leftover print(active_connections) debug statement
- Refactor manual cursor SCAN while-loops to scan_iter()

apps/channels/tasks.py
- Fix closure bug in _d(): md.get(key) → md.get(bkey) (was reading
  the outer loop variable instead of the local bytes key)

apps/proxy/ts_proxy/server.py
- Replace stale b'init_time', b'total_bytes', b'state' byte-string
  key lookups and .decode() calls with plain string equivalents

apps/proxy/ts_proxy/services/channel_service.py
- Fix ChannelMetadataField.STATE.encode() / .OWNER.encode() →
  .STATE / .OWNER (pre-existing, broke under decoded client)

apps/proxy/ts_proxy/views.py
- Fix ChannelMetadataField.OWNER.encode("utf-8") → .OWNER

apps/proxy/ts_proxy/client_manager.py
- Fix cid.decode('utf-8') in remove_ghost_clients(): smembers()
  already returns str with decode_responses=True
---
 apps/channels/tasks.py                        |   2 +-
 apps/proxy/ts_proxy/client_manager.py         |   3 +-
 apps/proxy/ts_proxy/server.py                 |  10 +-
 .../ts_proxy/services/channel_service.py      |   8 +-
 apps/proxy/ts_proxy/views.py                  |   2 +-
 apps/proxy/utils.py                           | 108 ++++++++---------
 core/utils.py                                 | 109 ++++++------------
 debug_redis_check.py                          |  21 ++++
 8 files changed, 114 insertions(+), 149 deletions(-)
 create mode 100644 debug_redis_check.py

diff --git a/apps/channels/tasks.py b/apps/channels/tasks.py
index 52956d53..59122d9f 100755
--- a/apps/channels/tasks.py
+++ b/apps/channels/tasks.py
@@ -2494,7 +2494,7 @@ def run_recording(recording_id, channel_id, start_time_str, end_time_str):
                 md = r.hgetall(metadata_key)
                 if md:
                     def _d(bkey, cast=str):
-                        v = md.get(key)
+                        v = md.get(bkey)
                         try:
                             if v is None:
                                 return None
diff --git a/apps/proxy/ts_proxy/client_manager.py b/apps/proxy/ts_proxy/client_manager.py
index e2cfd460..e1c92256 100644
--- a/apps/proxy/ts_proxy/client_manager.py
+++ b/apps/proxy/ts_proxy/client_manager.py
@@ -428,8 +428,7 @@ class ClientManager:
         client_id_list = list(client_ids)
         pipe = redis_client.pipeline()
         for cid in client_id_list:
-            cid_str = cid.decode('utf-8')
-            pipe.exists(RedisKeys.client_metadata(channel_id, cid_str))
+            pipe.exists(RedisKeys.client_metadata(channel_id, cid))
         results = pipe.execute()
 
         stale_ids = [
diff --git a/apps/proxy/ts_proxy/server.py b/apps/proxy/ts_proxy/server.py
index b3449693..5316ec58 100644
--- a/apps/proxy/ts_proxy/server.py
+++ b/apps/proxy/ts_proxy/server.py
@@ -940,14 +940,14 @@ class ProxyServer:
                         metadata = self.redis_client.hgetall(metadata_key)
                         if metadata:
                             # Calculate runtime from init_time
-                            if b'init_time' in metadata:
+                            if 'init_time' in metadata:
                                 try:
                                     init_time = float(metadata['init_time'])
                                     runtime = round(time.time() - init_time, 2)
                                 except Exception:
                                     pass
                             # Get total bytes transferred
-                            if b'total_bytes' in metadata:
+                            if 'total_bytes' in metadata:
                                 try:
                                     total_bytes = int(metadata['total_bytes'])
                                 except Exception:
@@ -1113,9 +1113,9 @@ class ProxyServer:
 
                                     # Also get init time as a fallback
                                     init_time = None
-                                    if metadata and b'init_time' in metadata:
+                                    if metadata and 'init_time' in metadata:
                                         try:
-                                            init_time = float(metadata[b'init_time'])
+                                            init_time = float(metadata['init_time'])
                                         except (ValueError, TypeError):
                                             pass
 
@@ -1400,7 +1400,7 @@ class ProxyServer:
                         real_count = max(0, client_count - len(stale_ids))
                         if real_count <= 0:
                             # No real clients remain — safe to clean up.
-                            state = metadata.get(b'state', b'unknown').decode('utf-8') if b'state' in metadata else 'unknown'
+                            state = metadata.get('state', 'unknown')
                             logger.warning(
                                 f"Orphaned channel {channel_id} (state: {state}, "
                                 f"owner: {owner}) had {client_count} ghost client(s) "
diff --git a/apps/proxy/ts_proxy/services/channel_service.py b/apps/proxy/ts_proxy/services/channel_service.py
index 0a0945d6..d0478e8f 100644
--- a/apps/proxy/ts_proxy/services/channel_service.py
+++ b/apps/proxy/ts_proxy/services/channel_service.py
@@ -382,8 +382,8 @@ class ChannelService:
             metadata = proxy_server.redis_client.hgetall(metadata_key)
 
             # Extract state and owner
-            state = metadata.get(ChannelMetadataField.STATE.encode(), 'unknown')
-            owner = metadata.get(ChannelMetadataField.OWNER.encode(), 'unknown')
+            state = metadata.get(ChannelMetadataField.STATE, 'unknown')
+            owner = metadata.get(ChannelMetadataField.OWNER, 'unknown')
 
             # Valid states indicate channel is running properly
             valid_states = [ChannelState.ACTIVE, ChannelState.WAITING_FOR_CLIENTS, ChannelState.CONNECTING]
@@ -432,13 +432,13 @@ class ChannelService:
         try:
             # Use factory to parse the line based on stream type
             parsed_data = LogParserFactory.parse(stream_type, stream_info_line)
-            
+
             if not parsed_data:
                 return
 
             # Update Redis and database with parsed data
             ChannelService._update_stream_info_in_redis(
-                channel_id, 
+                channel_id,
                 parsed_data.get('video_codec'),
                 parsed_data.get('resolution'),
                 parsed_data.get('width'),
diff --git a/apps/proxy/ts_proxy/views.py b/apps/proxy/ts_proxy/views.py
index fabc1053..d94a03cf 100644
--- a/apps/proxy/ts_proxy/views.py
+++ b/apps/proxy/ts_proxy/views.py
@@ -127,7 +127,7 @@ def stream_ts(request, channel_id, user=None):
                         )
                     # Unknown/empty state - check if owner is alive
                     else:
-                        owner_field = ChannelMetadataField.OWNER.encode("utf-8")
+                        owner_field = ChannelMetadataField.OWNER
                         if owner_field in metadata:
                             owner = metadata[owner_field]
                             owner_heartbeat_key = f"ts_proxy:worker:{owner}:heartbeat"
diff --git a/apps/proxy/utils.py b/apps/proxy/utils.py
index 0ea1bd27..1c71b5cd 100644
--- a/apps/proxy/utils.py
+++ b/apps/proxy/utils.py
@@ -11,7 +11,7 @@ def attempt_stream_termination(user_id, requesting_client_id, active_connections
     try:
         logger.info("[stream limits]" f"[{requesting_client_id}] User {user_id} has {len(active_connections)} active connections, checking termination candidates")
 
-        user_limit_settings = CoreSettings.get_user_limit_settings()
+        user_limit_settings = CoreSettings.get_user_limits_settings()
         terminate_oldest = user_limit_settings.get("terminate_oldest", True)
         prioritize_single = user_limit_settings.get("prioritize_single_client_channels", True)
         ignore_same_channel = user_limit_settings.get("ignore_same_channel_connections", False)
@@ -79,74 +79,58 @@ def get_user_active_connections(user_id):
     connections = []
 
     try:
-        cursor = 0
-
         # Grab live streams
-        while True:
-            cursor, keys = redis_client.scan(cursor=cursor, match="ts_proxy:channel:*:clients:*", count=1000)
+        for key in redis_client.scan_iter(match="ts_proxy:channel:*:clients:*", count=1000):
+            parts = key.split(':')
+            if len(parts) >= 5:
+                channel_id = parts[2]
+                client_id = parts[4]
 
-            for key in keys:
-                parts = key.split(':')
-                if len(parts) >= 5:
-                    channel_id = parts[2]
-                    client_id = parts[4]
+                client_user_id = redis_client.hget(key, 'user_id')
+                connected_at = redis_client.hget(key, 'connected_at')
 
-                    client_user_id = redis_client.hget(key, 'user_id')
-                    connected_at = redis_client.hget(key, 'connected_at')
+                logger.info(f"[stream limits] user_id = {user_id}")
+                logger.info(f"[stream limits] channel_id = {channel_id}")
+                logger.info(f"[stream limits] client_id = {client_id}")
 
-                    logger.info(f"[stream limits] user_id = {user_id}")
-                    logger.info(f"[stream limits] channel_id = {channel_id}")
-                    logger.info(f"[stream limits] client_id = {client_id}")
-
-                    if client_user_id and int(client_user_id) == user_id:
-                        try:
-                            logger.info(f"[stream limits] Found LIVE connection for user {user_id} on channel {channel_id} with client ID {client_id}")
-                            connected_at = float(connected_at) if connected_at else 0
-                            connections.append({
-                                'media_id': channel_id,
-                                'client_id': client_id,
-                                'connected_at': connected_at,
-                                'type': 'live',
-                            })
-                        except (ValueError, TypeError):
-                            pass
-
-            if cursor == 0:
-                break
-
-
-        cursor = 0
+                if client_user_id and int(client_user_id) == user_id:
+                    try:
+                        logger.info(f"[stream limits] Found LIVE connection for user {user_id} on channel {channel_id} with client ID {client_id}")
+                        connected_at = float(connected_at) if connected_at else 0
+                        connections.append({
+                            'media_id': channel_id,
+                            'client_id': client_id,
+                            'connected_at': connected_at,
+                            'type': 'live',
+                        })
+                    except (ValueError, TypeError):
+                        pass
 
         # Grab VOD
-        while True:
-            cursor, keys = redis_client.scan(cursor=cursor, match="vod_persistent_connections:*", count=1000)
+        for key in redis_client.scan_iter(match="vod_persistent_connection:*", count=1000):
+            parts = key.split(':')
+            if len(parts) >= 2:
+                client_id = parts[1]
 
-            for key in keys:
-                parts = key.split(':')
-                if len(parts) >= 2:
-                    client_id = parts[1]
+                client_user_id = redis_client.hget(key, 'user_id')
+                connected_at = redis_client.hget(key, 'created_at')
+                content_uuid = redis_client.hget(key, 'content_uuid')
 
-                    client_user_id = redis_client.hget(key, 'user_id')
-                    connected_at = redis_client.hget(key, 'created_at')
+                logger.info(f"[stream limits] user_id = {user_id}")
+                logger.info(f"[stream limits] client_id = {client_id}")
 
-                    logger.info(f"[stream limits] user_id = {user_id}")
-                    logger.info(f"[stream limits] client_id = {client_id}")
-
-                    if client_user_id and int(client_user_id) == user_id:
-                        try:
-                            logger.info(f"[stream limits] Found VOD connection for user {user_id} on channel {channel_id} with client ID {client_id}")
-                            connected_at = float(connected_at) if connected_at else 0
-                            connections.append({
-                                'media_id': channel_id,
-                                'client_id': client_id,
-                                'connected_at': connected_at,
-                                'type': 'vod',
-                            })
-                        except (ValueError, TypeError):
-                            pass
-
-            if cursor == 0:
-                break
+                if client_user_id and int(client_user_id) == user_id:
+                    try:
+                        logger.info(f"[stream limits] Found VOD connection for user {user_id} on content {content_uuid} with client ID {client_id}")
+                        connected_at = float(connected_at) if connected_at else 0
+                        connections.append({
+                            'media_id': content_uuid or client_id,
+                            'client_id': client_id,
+                            'connected_at': connected_at,
+                            'type': 'vod',
+                        })
+                    except (ValueError, TypeError):
+                        pass
 
         return connections
 
@@ -159,14 +143,12 @@ def check_user_stream_limits(user, client_id):
     # Check user stream limits
     if user and user.stream_limit > 0:
         logger.info("[stream limits]" f"[{client_id}] User {user.username} (ID: {user.id}) is requesting a stream (stream_limit: {user.stream_limit})")
-        user_limit_settings = CoreSettings.get_user_limit_settings()
+        user_limit_settings = CoreSettings.get_user_limits_settings()
 
         active_connections = get_user_active_connections(user.id)
         unique_channel_count = set([conn['media_id'] for conn in active_connections])
         user_stream_count = len(unique_channel_count) if user_limit_settings.get("ignore_same_channel_connections", False) else len(active_connections)
 
-        print(active_connections)
-
         logger.info(f"[stream limits]" f"[{client_id}] User {user.username} currently has {len(active_connections)} active connections across {len(unique_channel_count)} unique channels (counting method: {'unique channels' if user_limit_settings.get('ignore_same_channel_connections', False) else 'total connections'})")
 
         if user.stream_limit > 0 and user_stream_count >= user.stream_limit:
diff --git a/core/utils.py b/core/utils.py
index 4d65aa91..583075c3 100644
--- a/core/utils.py
+++ b/core/utils.py
@@ -57,6 +57,8 @@ class RedisClient:
                 redis_host = os.environ.get("REDIS_HOST", getattr(settings, 'REDIS_HOST', 'localhost'))
                 redis_port = int(os.environ.get("REDIS_PORT", getattr(settings, 'REDIS_PORT', 6379)))
                 redis_db = int(os.environ.get("REDIS_DB", getattr(settings, 'REDIS_DB', 0)))
+                redis_password = os.environ.get("REDIS_PASSWORD", getattr(settings, 'REDIS_PASSWORD', ''))
+                redis_user = os.environ.get("REDIS_USER", getattr(settings, 'REDIS_USER', ''))
 
                 # Use standardized settings
                 socket_timeout = getattr(settings, 'REDIS_SOCKET_TIMEOUT', 5)
@@ -65,17 +67,23 @@ class RedisClient:
                 socket_keepalive = getattr(settings, 'REDIS_SOCKET_KEEPALIVE', True)
                 retry_on_timeout = getattr(settings, 'REDIS_RETRY_ON_TIMEOUT', True)
 
+                # TLS params from settings (empty dict when TLS is disabled)
+                ssl_params = getattr(settings, 'REDIS_SSL_PARAMS', {})
+
                 # Create Redis client with better defaults
                 client = redis.Redis(
                     host=redis_host,
                     port=redis_port,
                     db=redis_db,
+                    password=redis_password if redis_password else None,
+                    username=redis_user if redis_user else None,
                     socket_timeout=socket_timeout,
                     socket_connect_timeout=socket_connect_timeout,
                     socket_keepalive=socket_keepalive,
                     health_check_interval=health_check_interval,
                     retry_on_timeout=retry_on_timeout,
-                    decode_responses=decode_responses
+                    decode_responses=decode_responses,
+                    **ssl_params
                 )
 
                 # Validate connection with ping
@@ -87,84 +95,34 @@ class RedisClient:
                     client.config_set('save', '')  # Disable RDB snapshots
                     client.config_set('appendonly', 'no')  # Disable AOF logging
 
-                    # Set optimal memory settings with environment variable support
-                    # Get max memory from environment or use a larger default (512MB instead of 256MB)
-                    #max_memory = os.environ.get('REDIS_MAX_MEMORY', '512mb')
-                    #eviction_policy = os.environ.get('REDIS_EVICTION_POLICY', 'allkeys-lru')
-
-                    # TLS params from settings (empty dict when TLS is disabled)
-                    ssl_params = getattr(settings, 'REDIS_SSL_PARAMS', {})
-
-                    # Create Redis client with better defaults
-                    client = redis.Redis(
-                        host=redis_host,
-                        port=redis_port,
-                        db=redis_db,
-                        password=redis_password if redis_password else None,
-                        username=redis_user if redis_user else None,
-                        socket_timeout=socket_timeout,
-                        socket_connect_timeout=socket_connect_timeout,
-                        socket_keepalive=socket_keepalive,
-                        health_check_interval=health_check_interval,
-                        retry_on_timeout=retry_on_timeout,
-                        decode_responses=decode_responses,
-                        **ssl_params
-                    )
-
-                    #logger.info(f"Redis configured with maxmemory={max_memory}, policy={eviction_policy}")
-
                     # Disable protected mode when in debug mode
                     if os.environ.get('DISPATCHARR_DEBUG', '').lower() == 'true':
                         client.config_set('protected-mode', 'no')  # Disable protected mode in debug
                         logger.warning("Redis protected mode disabled for debug environment")
 
-                        # Set optimal memory settings with environment variable support
-                        # Get max memory from environment or use a larger default (512MB instead of 256MB)
-                        #max_memory = os.environ.get('REDIS_MAX_MEMORY', '512mb')
-                        #eviction_policy = os.environ.get('REDIS_EVICTION_POLICY', 'allkeys-lru')
-
-                        # Apply memory settings
-                        #client.config_set('maxmemory-policy', eviction_policy)
-                        #client.config_set('maxmemory', max_memory)
-
-                        #logger.info(f"Redis configured with maxmemory={max_memory}, policy={eviction_policy}")
-
-                        # Disable protected mode when in debug mode
-                        if os.environ.get('DISPATCHARR_DEBUG', '').lower() == 'true':
-                            client.config_set('protected-mode', 'no')  # Disable protected mode in debug
-                            logger.warning("Redis protected mode disabled for debug environment")
-
-                        logger.trace("Redis persistence disabled for better performance")
-                    except redis.exceptions.ResponseError as e:
-                        # Improve error handling for Redis configuration errors
-                        if "OOM" in str(e):
-                            logger.error(f"Redis OOM during configuration: {e}")
-                            # Try to increase maxmemory as an emergency measure
-                            try:
-                                client.config_set('maxmemory', '768mb')
-                                logger.warning("Applied emergency Redis memory increase to 768MB")
-                            except:
-                                pass
-                        else:
-                            logger.error(f"Redis configuration error: {e}")
-
-                    logger.info(f"Connected to Redis at {redis_host}:{redis_port}/{redis_db}")
-
-                    cls._client = client
-                    break
-
-                except (ConnectionError, TimeoutError) as e:
-                    retry_count += 1
-                    _tls_hint = _REDIS_TLS_HINT if ssl_params else ""
-                    if retry_count >= max_retries:
-                        logger.error(f"Failed to connect to Redis after {max_retries} attempts: {e}{_tls_hint}")
-                        return None
+                    logger.trace("Redis persistence disabled for better performance")
+                except redis.exceptions.ResponseError as e:
+                    # Improve error handling for Redis configuration errors
+                    if "OOM" in str(e):
+                        logger.error(f"Redis OOM during configuration: {e}")
+                        # Try to increase maxmemory as an emergency measure
+                        try:
+                            client.config_set('maxmemory', '768mb')
+                            logger.warning("Applied emergency Redis memory increase to 768MB")
+                        except:
+                            pass
                     else:
                         logger.error(f"Redis configuration error: {e}")
 
-                except Exception as e:
-                    _tls_hint = _REDIS_TLS_HINT if ssl_params else ""
-                    logger.error(f"Unexpected error connecting to Redis: {e}{_tls_hint}")
+                logger.info(f"Connected to Redis at {redis_host}:{redis_port}/{redis_db}")
+
+                return client
+
+            except (ConnectionError, TimeoutError) as e:
+                retry_count += 1
+                _tls_hint = _REDIS_TLS_HINT if ssl_params else ""
+                if retry_count >= max_retries:
+                    logger.error(f"Failed to connect to Redis after {max_retries} attempts: {e}{_tls_hint}")
                     return None
                 else:
                     # Use exponential backoff for retries
@@ -173,10 +131,15 @@ class RedisClient:
                     time.sleep(wait_time)
 
             except Exception as e:
-                logger.error(f"Unexpected error connecting to Redis: {e}")
+                _tls_hint = ""
+                try:
+                    _tls_hint = _REDIS_TLS_HINT if ssl_params else ""
+                except NameError:
+                    pass
+                logger.error(f"Unexpected error connecting to Redis: {e}{_tls_hint}")
                 return None
 
-        return client
+        return None
 
     @classmethod
     def get_client(cls, max_retries=5, retry_interval=1):
diff --git a/debug_redis_check.py b/debug_redis_check.py
new file mode 100644
index 00000000..9deab6d4
--- /dev/null
+++ b/debug_redis_check.py
@@ -0,0 +1,21 @@
+#!/usr/bin/env python
+import os, sys
+os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'dispatcharr.settings')
+import django
+django.setup()
+
+from core.utils import RedisClient
+
+r = RedisClient.get_client()
+print(f"Client: {r}")
+print(f"decode_responses: {r.connection_pool.connection_kwargs.get('decode_responses')}")
+
+keys = list(r.scan_iter(match='ts_proxy:channel:*:metadata', count=100))
+print(f"Found {len(keys)} metadata keys")
+for k in keys[:3]:
+    print(f"  Key: {k!r}")
+    data = r.hgetall(k)
+    field_names = list(data.keys())[:8]
+    print(f"  Fields ({len(data)} total): {field_names}")
+    state = data.get('state', 'MISSING')
+    print(f"  state={state!r}")

From 58befaa52bc3f55f5180c6b4ce4f7c07575c1cc1 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Thu, 26 Mar 2026 19:14:46 -0500
Subject: [PATCH 30/67] fix: correct indentation in check_user_stream_limits
 function

---
 apps/proxy/utils.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/proxy/utils.py b/apps/proxy/utils.py
index 1c71b5cd..fd4e88f2 100644
--- a/apps/proxy/utils.py
+++ b/apps/proxy/utils.py
@@ -164,4 +164,4 @@ def check_user_stream_limits(user, client_id):
                 if not attempt_stream_termination(user.id, client_id, active_connections):
                     return False
 
-        return True
+    return True

From aa6fb033d30c39fac6137b8afa9e3d51e8a04bec Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Thu, 26 Mar 2026 20:02:54 -0500
Subject: [PATCH 31/67] fix: update user stream limit checks to include
 media_id and rename user_limits_settings key

---
 apps/proxy/ts_proxy/views.py  |  3 +--
 apps/proxy/utils.py           | 22 ++++++++++++++++------
 apps/proxy/vod_proxy/views.py |  2 +-
 core/models.py                |  2 +-
 4 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/apps/proxy/ts_proxy/views.py b/apps/proxy/ts_proxy/views.py
index d94a03cf..64f73664 100644
--- a/apps/proxy/ts_proxy/views.py
+++ b/apps/proxy/ts_proxy/views.py
@@ -73,7 +73,7 @@ def stream_ts(request, channel_id, user=None):
                 break
 
         if user:
-            if not check_user_stream_limits(user, client_id):
+            if not check_user_stream_limits(user, client_id, media_id=channel_id):
                 return JsonResponse(
                     {"error": f"Stream limit exceeded ({user.stream_limit} concurrent streams allowed)"},
                     status=429
@@ -565,7 +565,6 @@ def stream_xc(request, username, password, channel_id):
     if custom_properties["xc_password"] != password:
         return Response({"error": "Invalid credentials"}, status=401)
 
-    print(f"Fetchin channel with ID: {channel_id}")
     if user.user_level < 10:
         user_profile_count = user.channel_profiles.count()
 
diff --git a/apps/proxy/utils.py b/apps/proxy/utils.py
index fd4e88f2..21097da6 100644
--- a/apps/proxy/utils.py
+++ b/apps/proxy/utils.py
@@ -139,26 +139,36 @@ def get_user_active_connections(user_id):
         return []
 
 
-def check_user_stream_limits(user, client_id):
+def check_user_stream_limits(user, client_id, media_id=None):
     # Check user stream limits
     if user and user.stream_limit > 0:
         logger.info("[stream limits]" f"[{client_id}] User {user.username} (ID: {user.id}) is requesting a stream (stream_limit: {user.stream_limit})")
         user_limit_settings = CoreSettings.get_user_limits_settings()
+        ignore_same_channel = user_limit_settings.get("ignore_same_channel_connections", False)
 
         active_connections = get_user_active_connections(user.id)
         unique_channel_count = set([conn['media_id'] for conn in active_connections])
-        user_stream_count = len(unique_channel_count) if user_limit_settings.get("ignore_same_channel_connections", False) else len(active_connections)
+        user_stream_count = len(unique_channel_count) if ignore_same_channel else len(active_connections)
 
-        logger.info(f"[stream limits]" f"[{client_id}] User {user.username} currently has {len(active_connections)} active connections across {len(unique_channel_count)} unique channels (counting method: {'unique channels' if user_limit_settings.get('ignore_same_channel_connections', False) else 'total connections'})")
+        logger.info(f"[stream limits]" f"[{client_id}] User {user.username} currently has {len(active_connections)} active connections across {len(unique_channel_count)} unique channels (counting method: {'unique channels' if ignore_same_channel else 'total connections'})")
 
-        if user.stream_limit > 0 and user_stream_count >= user.stream_limit:
+        # If ignore_same_channel is enabled and this request is for a live channel the user
+        # is already watching, allow it through without counting against the limit.
+        # VOD is excluded: connections aren't shared so multiple VOD connections to the
+        # same content would mean multiple upstream connections.
+        live_channel_ids = {str(conn['media_id']) for conn in active_connections if conn['type'] == 'live'}
+        if ignore_same_channel and media_id and str(media_id) in live_channel_ids:
+            logger.info(f"[stream limits][{client_id}] Same-channel reconnect for {media_id} allowed (ignore_same_channel=True)")
+            return True
+
+        if user_stream_count >= user.stream_limit:
             if user_limit_settings.get("terminate_on_limit_exceeded", True) == False:
                 return False
 
-            if len(active_connections) >= user.stream_limit:
+            if user_stream_count >= user.stream_limit:
                 logger.warning("[stream limits]"
                     f"[{client_id}] User {user.username} (ID: {user.id}) has reached stream limit "
-                    f"({len(active_connections)}/{user.stream_limit} channels), attempting to free up slot"
+                    f"({user_stream_count}/{user.stream_limit} streams), attempting to free up slot"
                 )
 
                 if not attempt_stream_termination(user.id, client_id, active_connections):
diff --git a/apps/proxy/vod_proxy/views.py b/apps/proxy/vod_proxy/views.py
index 14e1b631..d7250bcf 100644
--- a/apps/proxy/vod_proxy/views.py
+++ b/apps/proxy/vod_proxy/views.py
@@ -411,7 +411,7 @@ def stream_vod(request, content_type, content_id, session_id=None, profile_id=No
             )
 
         if user:
-            if not check_user_stream_limits(user, session_id):
+            if not check_user_stream_limits(user, session_id, media_id=content_id):
                 return JsonResponse(
                     {"error": f"Stream limit exceeded ({user.stream_limit} concurrent streams allowed)"},
                     status=429
diff --git a/core/models.py b/core/models.py
index 83b58495..a1526e73 100644
--- a/core/models.py
+++ b/core/models.py
@@ -156,7 +156,7 @@ PROXY_SETTINGS_KEY = "proxy_settings"
 NETWORK_ACCESS_KEY = "network_access"
 SYSTEM_SETTINGS_KEY = "system_settings"
 EPG_SETTINGS_KEY = "epg_settings"
-USER_LIMITS_SETTINGS_KEY = "user_limits_settings"
+USER_LIMITS_SETTINGS_KEY = "user_limits"
 
 
 class CoreSettings(models.Model):

From 46d406352443c974ae3e47f787aed525ab3121a7 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Thu, 26 Mar 2026 20:10:03 -0500
Subject: [PATCH 32/67] fix: change logging level from info to debug in user
 connection checks

---
 apps/proxy/utils.py | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/apps/proxy/utils.py b/apps/proxy/utils.py
index 21097da6..4dbb2551 100644
--- a/apps/proxy/utils.py
+++ b/apps/proxy/utils.py
@@ -89,13 +89,13 @@ def get_user_active_connections(user_id):
                 client_user_id = redis_client.hget(key, 'user_id')
                 connected_at = redis_client.hget(key, 'connected_at')
 
-                logger.info(f"[stream limits] user_id = {user_id}")
-                logger.info(f"[stream limits] channel_id = {channel_id}")
-                logger.info(f"[stream limits] client_id = {client_id}")
+                logger.debug(f"[stream limits] user_id = {user_id}")
+                logger.debug(f"[stream limits] channel_id = {channel_id}")
+                logger.debug(f"[stream limits] client_id = {client_id}")
 
                 if client_user_id and int(client_user_id) == user_id:
                     try:
-                        logger.info(f"[stream limits] Found LIVE connection for user {user_id} on channel {channel_id} with client ID {client_id}")
+                        logger.debug(f"[stream limits] Found LIVE connection for user {user_id} on channel {channel_id} with client ID {client_id}")
                         connected_at = float(connected_at) if connected_at else 0
                         connections.append({
                             'media_id': channel_id,
@@ -116,12 +116,12 @@ def get_user_active_connections(user_id):
                 connected_at = redis_client.hget(key, 'created_at')
                 content_uuid = redis_client.hget(key, 'content_uuid')
 
-                logger.info(f"[stream limits] user_id = {user_id}")
-                logger.info(f"[stream limits] client_id = {client_id}")
+                logger.debug(f"[stream limits] user_id = {user_id}")
+                logger.debug(f"[stream limits] client_id = {client_id}")
 
                 if client_user_id and int(client_user_id) == user_id:
                     try:
-                        logger.info(f"[stream limits] Found VOD connection for user {user_id} on content {content_uuid} with client ID {client_id}")
+                        logger.debug(f"[stream limits] Found VOD connection for user {user_id} on content {content_uuid} with client ID {client_id}")
                         connected_at = float(connected_at) if connected_at else 0
                         connections.append({
                             'media_id': content_uuid or client_id,
@@ -142,7 +142,7 @@ def get_user_active_connections(user_id):
 def check_user_stream_limits(user, client_id, media_id=None):
     # Check user stream limits
     if user and user.stream_limit > 0:
-        logger.info("[stream limits]" f"[{client_id}] User {user.username} (ID: {user.id}) is requesting a stream (stream_limit: {user.stream_limit})")
+        logger.debug("[stream limits]" f"[{client_id}] User {user.username} (ID: {user.id}) is requesting a stream (stream_limit: {user.stream_limit})")
         user_limit_settings = CoreSettings.get_user_limits_settings()
         ignore_same_channel = user_limit_settings.get("ignore_same_channel_connections", False)
 
@@ -150,7 +150,7 @@ def check_user_stream_limits(user, client_id, media_id=None):
         unique_channel_count = set([conn['media_id'] for conn in active_connections])
         user_stream_count = len(unique_channel_count) if ignore_same_channel else len(active_connections)
 
-        logger.info(f"[stream limits]" f"[{client_id}] User {user.username} currently has {len(active_connections)} active connections across {len(unique_channel_count)} unique channels (counting method: {'unique channels' if ignore_same_channel else 'total connections'})")
+        logger.debug(f"[stream limits]" f"[{client_id}] User {user.username} currently has {len(active_connections)} active connections across {len(unique_channel_count)} unique channels (counting method: {'unique channels' if ignore_same_channel else 'total connections'})")
 
         # If ignore_same_channel is enabled and this request is for a live channel the user
         # is already watching, allow it through without counting against the limit.
@@ -158,7 +158,7 @@ def check_user_stream_limits(user, client_id, media_id=None):
         # same content would mean multiple upstream connections.
         live_channel_ids = {str(conn['media_id']) for conn in active_connections if conn['type'] == 'live'}
         if ignore_same_channel and media_id and str(media_id) in live_channel_ids:
-            logger.info(f"[stream limits][{client_id}] Same-channel reconnect for {media_id} allowed (ignore_same_channel=True)")
+            logger.debug(f"[stream limits][{client_id}] Same-channel reconnect for {media_id} allowed (ignore_same_channel=True)")
             return True
 
         if user_stream_count >= user.stream_limit:

From 7e6041286a42e72fafe4cf88d46353b5907621a7 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Thu, 26 Mar 2026 20:16:16 -0500
Subject: [PATCH 33/67] fix: update user limit settings key in migration and
 frontend form for consistency with other settings keys.

---
 core/migrations/022_default_user_limit_settings.py        | 4 ++--
 core/models.py                                            | 2 +-
 frontend/src/components/forms/settings/UserLimitsForm.jsx | 6 +++---
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/core/migrations/022_default_user_limit_settings.py b/core/migrations/022_default_user_limit_settings.py
index af758a11..4c2b3c33 100644
--- a/core/migrations/022_default_user_limit_settings.py
+++ b/core/migrations/022_default_user_limit_settings.py
@@ -7,8 +7,8 @@ from django.utils.text import slugify
 def preload_user_limit_settings(apps, schema_editor):
     CoreSettings = apps.get_model("core", "CoreSettings")
     CoreSettings.objects.create(
-        key="user_limits",
-        name="User Limits",
+        key="user_limit_settings",
+        name="User Limit Settings",
         value={},
     )
 
diff --git a/core/models.py b/core/models.py
index a1526e73..5e86e98f 100644
--- a/core/models.py
+++ b/core/models.py
@@ -156,7 +156,7 @@ PROXY_SETTINGS_KEY = "proxy_settings"
 NETWORK_ACCESS_KEY = "network_access"
 SYSTEM_SETTINGS_KEY = "system_settings"
 EPG_SETTINGS_KEY = "epg_settings"
-USER_LIMITS_SETTINGS_KEY = "user_limits"
+USER_LIMITS_SETTINGS_KEY = "user_limit_settings"
 
 
 class CoreSettings(models.Model):
diff --git a/frontend/src/components/forms/settings/UserLimitsForm.jsx b/frontend/src/components/forms/settings/UserLimitsForm.jsx
index 3481a7db..b6a9ed5e 100644
--- a/frontend/src/components/forms/settings/UserLimitsForm.jsx
+++ b/frontend/src/components/forms/settings/UserLimitsForm.jsx
@@ -37,10 +37,10 @@ const UserLimitsForm = React.memo(({ active }) => {
 
   useEffect(() => {
     if (settings) {
-      if (settings['user_limits']?.value) {
+      if (settings['user_limit_settings']?.value) {
         userLimitSettingsForm.setValues({
           ...USER_LIMIT_DEFAULTS,
-          ...settings['user_limits'].value,
+          ...settings['user_limit_settings'].value,
         });
       }
     }
@@ -55,7 +55,7 @@ const UserLimitsForm = React.memo(({ active }) => {
 
     try {
       const result = await updateSetting({
-        ...settings['user_limits'],
+        ...settings['user_limit_settings'],
         value: userLimitSettingsForm.getValues(),
       });
       if (result) {

From 7964b2c2cb07e94292bf272fb301c09bf541a52b Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Thu, 26 Mar 2026 20:33:03 -0500
Subject: [PATCH 34/67] fix: enhance stream termination logic to handle
 multiple connections on the same channel

---
 apps/proxy/utils.py | 44 ++++++++++++++++++++++++++------------------
 1 file changed, 26 insertions(+), 18 deletions(-)

diff --git a/apps/proxy/utils.py b/apps/proxy/utils.py
index 4dbb2551..6503d1df 100644
--- a/apps/proxy/utils.py
+++ b/apps/proxy/utils.py
@@ -47,27 +47,35 @@ def attempt_stream_termination(user_id, requesting_client_id, active_connections
             f"on media {target['media_id']} (connected_at={target['connected_at']})"
         )
 
-        if target['type'] == 'live':
-            result = ChannelService.stop_client(target['media_id'], target['client_id'])
-            if result.get("status") == "error":
-                return False
-        else:
-            connection_manager = MultiWorkerVODConnectionManager.get_instance()
-            redis_client = connection_manager.redis_client
+        # When counting by unique channel, freeing one connection from a multi-connection
+        # channel doesn't free a slot — terminate all connections to that channel so the
+        # unique-channel count actually drops by one.
+        targets = (
+            [c for c in active_connections if c['media_id'] == target['media_id']]
+            if ignore_same_channel
+            else [target]
+        )
 
-            if not redis_client:
-                return False
+        for t in targets:
+            if t['type'] == 'live':
+                result = ChannelService.stop_client(t['media_id'], t['client_id'])
+                if result.get("status") == "error":
+                    logger.warning(f"[stream limits][{requesting_client_id}] Failed to stop client {t['client_id']} on channel {t['media_id']}")
+            else:
+                connection_manager = MultiWorkerVODConnectionManager.get_instance()
+                redis_client = connection_manager.redis_client
 
-            # Check if connection exists
-            connection_key = f"vod_persistent_connection:{target['client_id']}"
-            connection_data = redis_client.hgetall(connection_key)
-            if not connection_data:
-                logger.warning(f"VOD connection not found: {target['client_id']}")
-                return False
+                if not redis_client:
+                    return False
 
-            # Set a stop signal key that the worker will check
-            stop_key = get_vod_client_stop_key(target['client_id'])
-            redis_client.setex(stop_key, 60, "true")  # 60 second TTL
+                connection_key = f"vod_persistent_connection:{t['client_id']}"
+                connection_data = redis_client.hgetall(connection_key)
+                if not connection_data:
+                    logger.warning(f"VOD connection not found: {t['client_id']}")
+                    continue
+
+                stop_key = get_vod_client_stop_key(t['client_id'])
+                redis_client.setex(stop_key, 60, "true")  # 60 second TTL
 
         return True
     except Exception as e:

From 8e9a6285a4692f5e8372afdd232cb4aff52ccd7b Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Thu, 26 Mar 2026 21:16:18 -0500
Subject: [PATCH 35/67] Enhancement: Donate button added to the sidebar footer.
 A heart icon links to the project's Open Collective page, visible in both
 expanded and collapsed states. Hovering shows a "Support Dispatcharr"
 tooltip. The version string is also now clickable to copy it to the
 clipboard.

---
 CHANGELOG.md                        |  1 +
 frontend/src/components/Sidebar.jsx | 71 +++++++++++++++++++++++------
 2 files changed, 58 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 58a41e3d..36657d3f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Donate button added to the sidebar footer. A heart icon links to the project's Open Collective page, visible in both expanded and collapsed states. Hovering shows a "Support Dispatcharr" tooltip. The version string is also now clickable to copy it to the clipboard.
 - TLS and mutual TLS (mTLS) support for Redis and PostgreSQL connections in modular deployments. Supports encrypted connections, server certificate verification (Redis: on/off; PostgreSQL: verify-full, verify-ca, require), CA certificate configuration, and client certificate authentication. Configured via environment variables in the docker compose file. Includes startup validation for certificate paths and TLS/URL scheme conflicts, and a read-only Connection Security panel in System Settings. (Closes #950) — Thanks [@CodeBormen](https://github.com/CodeBormen)
 - Status filter for M3U group and VOD category filter modals: A new **All / Enabled / Disabled** segmented control is now shown alongside the text search input in the Live, VOD - Movies, and VOD - Series tabs of the M3U Group Filter modal. The status filter works in combination with the text search and also scopes the "Select Visible" / "Deselect Visible" buttons so they only act on the currently visible subset. (Closes #312)
 
diff --git a/frontend/src/components/Sidebar.jsx b/frontend/src/components/Sidebar.jsx
index 73ee13c3..f5332d3a 100644
--- a/frontend/src/components/Sidebar.jsx
+++ b/frontend/src/components/Sidebar.jsx
@@ -1,12 +1,7 @@
 import React, { useRef, useState, useMemo } from 'react';
 import { Link, useLocation } from 'react-router-dom';
 import { copyToClipboard } from '../utils';
-import {
-  Copy,
-  LogOut,
-  ChevronDown,
-  ChevronRight,
-} from 'lucide-react';
+import { Copy, LogOut, ChevronDown, ChevronRight, Heart } from 'lucide-react';
 import { getOrderedNavItems } from '../config/navigation';
 import {
   Avatar,
@@ -19,6 +14,7 @@ import {
   ActionIcon,
   AppShellNavbar,
   ScrollArea,
+  Tooltip,
 } from '@mantine/core';
 import logo from '../images/logo.png';
 import useChannelsStore from '../store/channels';
@@ -29,6 +25,21 @@ import { USER_LEVELS } from '../constants';
 import UserForm from './forms/User';
 import NotificationCenter from './NotificationCenter';
 
+const DonateButton = ({ tooltipPosition = 'top' }) => (
+  <Tooltip label="Support Dispatcharr" position={tooltipPosition}>
+    <ActionIcon
+      component="a"
+      href="https://opencollective.com/dispatcharr/contribute"
+      target="_blank"
+      rel="noopener noreferrer"
+      variant="transparent"
+      color="pink"
+    >
+      <Heart size={20} />
+    </ActionIcon>
+  </Tooltip>
+);
+
 const NavLink = ({ item, isActive, collapsed }) => {
   const IconComponent = item.icon;
   return (
@@ -328,24 +339,56 @@ const Sidebar = ({ collapsed, toggleDrawer, drawerWidth, miniDrawerWidth }) => {
       {!collapsed && (
         <Group
           gap="xs"
+          wrap="nowrap"
           style={{ padding: '0 16px 16px', justifyContent: 'space-between' }}
         >
-          <Text size="xs" c="dimmed">
-            v{appVersion?.version || '0.0.0'}
-            {appVersion?.timestamp ? `-${appVersion.timestamp}` : ''}
-          </Text>
-          {isAuthenticated && <NotificationCenter />}
+          <Tooltip
+            label={`v${appVersion?.version || '0.0.0'}${appVersion?.timestamp ? `-${appVersion.timestamp}` : ''}`}
+            position="top"
+          >
+            <Text
+              size="xs"
+              c="dimmed"
+              style={{
+                overflow: 'hidden',
+                textOverflow: 'ellipsis',
+                whiteSpace: 'nowrap',
+                minWidth: 0,
+                flex: 1,
+                cursor: 'pointer',
+              }}
+              onClick={() =>
+                copyToClipboard(
+                  `v${appVersion?.version || '0.0.0'}${appVersion?.timestamp ? `-${appVersion.timestamp}` : ''}`,
+                  {
+                    successTitle: 'Copied',
+                    successMessage: 'Version copied to clipboard',
+                  }
+                )
+              }
+            >
+              v{appVersion?.version || '0.0.0'}
+              {appVersion?.timestamp ? `-${appVersion.timestamp}` : ''}
+            </Text>
+          </Tooltip>
+          <Group gap="xs" wrap="nowrap">
+            <DonateButton />
+            {isAuthenticated && <NotificationCenter />}
+          </Group>
         </Group>
       )}
-      {collapsed && isAuthenticated && (
+      {collapsed && (
         <Box
           style={{
             padding: '0 16px 16px',
             display: 'flex',
-            justifyContent: 'center',
+            flexDirection: 'column',
+            alignItems: 'center',
+            gap: 8,
           }}
         >
-          <NotificationCenter />
+          {isAuthenticated && <NotificationCenter />}
+          <DonateButton tooltipPosition="right" />
         </Box>
       )}
 

From 7d8619f644d0c7a7d626f9ce9aacb6863a00af8f Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 27 Mar 2026 09:30:01 -0500
Subject: [PATCH 36/67] Security: Update npm dependencies to resolve frontend
 vulernabilities.

---
 CHANGELOG.md               |  8 +++++++
 frontend/package-lock.json | 44 +++++++++++++++++++++++++++-----------
 2 files changed, 39 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 58a41e3d..35b283b5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- Updated frontend npm dependencies to resolve 4 vulnerabilities (2 high, 2 moderate):
+  - Updated `brace-expansion` to 5.0.5, resolving **moderate** zero-step sequence causing process hang and memory exhaustion ([GHSA-f886-m6hf-6m8v](https://github.com/advisories/GHSA-f886-m6hf-6m8v))
+  - Updated `flatted` to 3.4.2, resolving **high** Prototype Pollution via `parse()` in NodeJS flatted ([GHSA-rf6f-7fwh-wjgh](https://github.com/advisories/GHSA-rf6f-7fwh-wjgh))
+  - Updated `picomatch` to 4.0.4, resolving **high** method injection in POSIX character classes causing incorrect glob matching ([GHSA-3v7f-55p6-f55p](https://github.com/advisories/GHSA-3v7f-55p6-f55p)) and a ReDoS vulnerability via extglob quantifiers ([GHSA-c2c7-rcm5-vvqj](https://github.com/advisories/GHSA-c2c7-rcm5-vvqj))
+  - Updated `yaml` to 1.10.3, resolving **moderate** stack overflow via deeply nested YAML collections ([GHSA-48c2-rrv3-qjmp](https://github.com/advisories/GHSA-48c2-rrv3-qjmp))
+
 ### Added
 
 - TLS and mutual TLS (mTLS) support for Redis and PostgreSQL connections in modular deployments. Supports encrypted connections, server certificate verification (Redis: on/off; PostgreSQL: verify-full, verify-ca, require), CA certificate configuration, and client certificate authentication. Configured via environment variables in the docker compose file. Includes startup validation for certificate paths and TLS/URL scheme conflicts, and a read-only Connection Security panel in System Settings. (Closes #950) — Thanks [@CodeBormen](https://github.com/CodeBormen)
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 9a0adea6..6880b99a 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -2704,16 +2704,16 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.2.tgz",
-      "integrity": "sha512-Pdk8c9poy+YhOgVWw1JNN22/HcivgKWwpxKq04M/jTmHyCZn12WPJebZxdjSa5TmBqISrUSgNYU3eRORljfCCw==",
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
+      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/cac": {
@@ -2850,9 +2850,9 @@
       }
     },
     "node_modules/cosmiconfig/node_modules/yaml": {
-      "version": "1.10.2",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz",
-      "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==",
+      "version": "1.10.3",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.3.tgz",
+      "integrity": "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==",
       "license": "ISC",
       "engines": {
         "node": ">= 6"
@@ -3554,9 +3554,9 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.1.tgz",
-      "integrity": "sha512-IxfVbRFVlV8V/yRaGzk0UVIcsKKHMSfYw66T/u4nTwlWteQePsxe//LjudR1AMX4tZW3WFCh3Zqa/sjlqpbURQ==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
       "dev": true,
       "license": "ISC"
     },
@@ -4362,9 +4362,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5794,6 +5794,24 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/yaml": {
+      "version": "2.8.3",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+      "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "peer": true,
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    },
     "node_modules/yocto-queue": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",

From b20c42f25a2efdf4a5f5afd3f5e1bea93ae8ccd1 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 27 Mar 2026 11:03:55 -0500
Subject: [PATCH 37/67] chore: update dependencies for celery, requests, torch,
 and sentence-transformers

---
 pyproject.toml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index fecc4e68..0f2d7afd 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,9 +8,9 @@ dynamic = ["version"]
 dependencies = [
     "Django==6.0.3",
     "psycopg2-binary==2.9.11",
-    "celery[redis]==5.6.2",
+    "celery[redis]==5.6.3",
     "djangorestframework==3.16.1",
-    "requests==2.32.5",
+    "requests==2.33.0",
     "psutil==7.2.2",
     "pillow",
     "drf-spectacular>=0.29.0",
@@ -27,8 +27,8 @@ dependencies = [
     "regex",
     "tzlocal",
     "pytz",
-    "torch==2.10.0+cpu",
-    "sentence-transformers==5.2.3",
+    "torch==2.11.0+cpu",
+    "sentence-transformers==5.3.0",
     "channels",
     "channels-redis==4.3.0",
     "django-filter",

From 2253e18ef8767f2045253422fa6f4658af881089 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 27 Mar 2026 11:04:37 -0500
Subject: [PATCH 38/67] changelog: Update changelog for dependency upgrades

---
 CHANGELOG.md | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 35b283b5..9d7cfc23 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,11 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
-- Updated frontend npm dependencies to resolve 4 vulnerabilities (2 high, 2 moderate):
-  - Updated `brace-expansion` to 5.0.5, resolving **moderate** zero-step sequence causing process hang and memory exhaustion ([GHSA-f886-m6hf-6m8v](https://github.com/advisories/GHSA-f886-m6hf-6m8v))
-  - Updated `flatted` to 3.4.2, resolving **high** Prototype Pollution via `parse()` in NodeJS flatted ([GHSA-rf6f-7fwh-wjgh](https://github.com/advisories/GHSA-rf6f-7fwh-wjgh))
-  - Updated `picomatch` to 4.0.4, resolving **high** method injection in POSIX character classes causing incorrect glob matching ([GHSA-3v7f-55p6-f55p](https://github.com/advisories/GHSA-3v7f-55p6-f55p)) and a ReDoS vulnerability via extglob quantifiers ([GHSA-c2c7-rcm5-vvqj](https://github.com/advisories/GHSA-c2c7-rcm5-vvqj))
-  - Updated `yaml` to 1.10.3, resolving **moderate** stack overflow via deeply nested YAML collections ([GHSA-48c2-rrv3-qjmp](https://github.com/advisories/GHSA-48c2-rrv3-qjmp))
+- Updated `requests` 2.32.5 → 2.33.0, resolving the following CVE:
+  - **CVE-2026-25645** (moderate): Insecure temp file reuse in `extract_zipped_paths()` utility function.
+- Updated frontend npm dependencies to resolve 4 audit vulnerabilities (2 moderate, 2 high):
+  - Updated `brace-expansion` 5.0.2 → 5.0.5, resolving **moderate** zero-step sequence causing process hang and memory exhaustion ([GHSA-f886-m6hf-6m8v](https://github.com/advisories/GHSA-f886-m6hf-6m8v))
+  - Updated `flatted` 3.4.1 → 3.4.2, resolving **high** Prototype Pollution via `parse()` in NodeJS flatted ([GHSA-rf6f-7fwh-wjgh](https://github.com/advisories/GHSA-rf6f-7fwh-wjgh))
+  - Updated `picomatch` 4.0.3 → 4.0.4, resolving **high** method injection in POSIX character classes causing incorrect glob matching ([GHSA-3v7f-55p6-f55p](https://github.com/advisories/GHSA-3v7f-55p6-f55p)) and a ReDoS vulnerability via extglob quantifiers ([GHSA-c2c7-rcm5-vvqj](https://github.com/advisories/GHSA-c2c7-rcm5-vvqj))
+  - Updated `yaml` 1.10.2 → 1.10.3, resolving **moderate** stack overflow via deeply nested YAML collections ([GHSA-48c2-rrv3-qjmp](https://github.com/advisories/GHSA-48c2-rrv3-qjmp))
 
 ### Added
 
@@ -22,6 +24,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Dependency updates:
+  - `requests` 2.32.5 → 2.33.0 (security patch; see Security section)
+  - `celery` 5.6.2 → 5.6.3
+  - `torch` 2.10.0+cpu → 2.11.0+cpu
+  - `sentence-transformers` 5.2.3 → 5.3.0
+  - `yt-dlp` 2026.3.13 → 2026.3.17
 - M3U table **Max Streams** column now reflects the combined limit across all active profiles. When a playlist has multiple active profiles, the column displays their summed total (or ∞ if any profile is unlimited) and a hover tooltip lists each profile's individual limit by name. (Closes #816)
 - Toggling an M3U profile's active state now immediately updates the playlist store (including the `playlists` array), so the **Max Streams** total in the M3U table reflects the change without a page reload.
 - M3U account form: **Max Streams** field changed from a plain text input to a number input with increment/decrement controls, consistent with other integer fields.

From 9c9de12b19408a7e9923594211a84fee516ed58a Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 27 Mar 2026 11:49:28 -0500
Subject: [PATCH 39/67] chore: remove unnecessary python-is-python3,
 python3-pip and streamlink from Dockerfile dependencies

---
 docker/DispatcharrBase | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/docker/DispatcharrBase b/docker/DispatcharrBase
index d2e8ceaa..3040e189 100644
--- a/docker/DispatcharrBase
+++ b/docker/DispatcharrBase
@@ -15,9 +15,8 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
     && apt-get update \
     && apt-get install --no-install-recommends -y \
     python3.13 python3.13-dev python3.13-venv libpython3.13 \
-    python-is-python3 python3-pip \
     libpcre3 libpcre3-dev libpq-dev procps pciutils \
-    nginx streamlink comskip \
+    nginx comskip \
     vlc-bin vlc-plugin-base \
     build-essential gcc g++ gfortran libopenblas-dev libopenblas0 ninja-build
 

From 36ce5a8c7184f9831a573815d95f279f5cbcddd8 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 27 Mar 2026 11:54:00 -0500
Subject: [PATCH 40/67] changelog: Update changelog for base image changes.

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9d7cfc23..f25d8572 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,6 +30,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - `torch` 2.10.0+cpu → 2.11.0+cpu
   - `sentence-transformers` 5.2.3 → 5.3.0
   - `yt-dlp` 2026.3.13 → 2026.3.17
+- Docker base image cleanup: removed `python-is-python3`, `python3-pip`, and `streamlink` from the apt package list in `DispatcharrBase`. `python3-pip` and `streamlink` were pulling outdated system Python packages (e.g. `requests 2.31.0`, `cryptography 41.0.7`, `lxml 5.2.1`) into the system Python's site-packages despite the app running entirely in the uv-managed venv at `/dispatcharrpy`. `streamlink` is already installed in the venv via `pyproject.toml`. `python-is-python3` is unnecessary as `PATH` resolves bare `python` to the venv binary.
 - M3U table **Max Streams** column now reflects the combined limit across all active profiles. When a playlist has multiple active profiles, the column displays their summed total (or ∞ if any profile is unlimited) and a hover tooltip lists each profile's individual limit by name. (Closes #816)
 - Toggling an M3U profile's active state now immediately updates the playlist store (including the `playlists` array), so the **Max Streams** total in the M3U table reflects the change without a page reload.
 - M3U account form: **Max Streams** field changed from a plain text input to a number input with increment/decrement controls, consistent with other integer fields.

From 5f45d3e9adcd7404c5bf90a189d7ae5afb129e03 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 27 Mar 2026 13:55:16 -0500
Subject: [PATCH 41/67] changelog: User stream limits

---
 CHANGELOG.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 58a41e3d..6806f29a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- User stream limits: administrators can now set a maximum number of concurrent streams per user account. When a user reaches their limit, the system can automatically terminate an existing stream to free a slot based on configurable rules. Limit enforcement applies to both live channels and VOD. (Closes #544)
+  - Each user account has a new **Stream Limit** field (0 = unlimited) configurable from the user edit form in Settings → Users.
+  - Global enforcement behaviour is configurable in Settings → User Limits:
+    - **Terminate on Limit Exceeded**: automatically stop an existing stream when the user's limit is reached (vs. rejecting the new connection).
+    - **Terminate Oldest**: prefer terminating the oldest stream when freeing a slot; disable to prefer the newest.
+    - **Prioritize Single-Client Channels**: prefer terminating streams on channels that only this user is watching.
+    - **Ignore Same-Channel Connections**: count multiple connections to the same live channel as one stream toward the limit. Same-channel reconnects are always allowed through. When this is enabled and a channel must be freed, all connections to the chosen channel are terminated together so that the unique-channel count actually decreases. VOD is explicitly excluded from this bypass since VOD connections are not shared upstream.
 - TLS and mutual TLS (mTLS) support for Redis and PostgreSQL connections in modular deployments. Supports encrypted connections, server certificate verification (Redis: on/off; PostgreSQL: verify-full, verify-ca, require), CA certificate configuration, and client certificate authentication. Configured via environment variables in the docker compose file. Includes startup validation for certificate paths and TLS/URL scheme conflicts, and a read-only Connection Security panel in System Settings. (Closes #950) — Thanks [@CodeBormen](https://github.com/CodeBormen)
 - Status filter for M3U group and VOD category filter modals: A new **All / Enabled / Disabled** segmented control is now shown alongside the text search input in the Live, VOD - Movies, and VOD - Series tabs of the M3U Group Filter modal. The status filter works in combination with the text search and also scopes the "Select Visible" / "Deselect Visible" buttons so they only act on the currently visible subset. (Closes #312)
 

From 110c8623ed2c28247d6ace39b6ef5208ed959d56 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 27 Mar 2026 13:59:50 -0500
Subject: [PATCH 42/67] delete temp script used for debugging.

---
 debug_redis_check.py | 21 ---------------------
 1 file changed, 21 deletions(-)
 delete mode 100644 debug_redis_check.py

diff --git a/debug_redis_check.py b/debug_redis_check.py
deleted file mode 100644
index 9deab6d4..00000000
--- a/debug_redis_check.py
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/usr/bin/env python
-import os, sys
-os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'dispatcharr.settings')
-import django
-django.setup()
-
-from core.utils import RedisClient
-
-r = RedisClient.get_client()
-print(f"Client: {r}")
-print(f"decode_responses: {r.connection_pool.connection_kwargs.get('decode_responses')}")
-
-keys = list(r.scan_iter(match='ts_proxy:channel:*:metadata', count=100))
-print(f"Found {len(keys)} metadata keys")
-for k in keys[:3]:
-    print(f"  Key: {k!r}")
-    data = r.hgetall(k)
-    field_names = list(data.keys())[:8]
-    print(f"  Fields ({len(data)} total): {field_names}")
-    state = data.get('state', 'MISSING')
-    print(f"  state={state!r}")

From 0827908b538b28edb9456ae490e0913077d6c65d Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 27 Mar 2026 14:12:21 -0500
Subject: [PATCH 43/67] fix: lazy load UserLimitsForm and correct spelling in
 user limits section

---
 frontend/src/pages/Settings.jsx | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/frontend/src/pages/Settings.jsx b/frontend/src/pages/Settings.jsx
index 71bbc68c..570e9f4b 100644
--- a/frontend/src/pages/Settings.jsx
+++ b/frontend/src/pages/Settings.jsx
@@ -23,8 +23,10 @@ const BackupManager = React.lazy(
 import useAuthStore from '../store/auth';
 import { USER_LEVELS } from '../constants';
 import UiSettingsForm from '../components/forms/settings/UiSettingsForm.jsx';
-import UserLimitsForm from '../components/forms/settings/UserLimitsForm.jsx';
 import ErrorBoundary from '../components/ErrorBoundary.jsx';
+const UserLimitsForm = React.lazy(
+  () => import('../components/forms/settings/UserLimitsForm.jsx')
+);
 const NetworkAccessForm = React.lazy(
   () => import('../components/forms/settings/NetworkAccessForm.jsx')
 );
@@ -203,7 +205,7 @@ const SettingsPage = () => {
               </AccordionItem>
 
               <AccordionItem value="user-limits">
-                <AccordionControl>User Limts</AccordionControl>
+                <AccordionControl>User Limits</AccordionControl>
                 <AccordionPanel>
                   <ErrorBoundary>
                     <Suspense fallback={<Loader />}>

From 3064be8194fd831a056762826b354cdf8e141737 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 27 Mar 2026 14:15:20 -0500
Subject: [PATCH 44/67] tests: Fix settings page test.

---
 frontend/src/pages/__tests__/Settings.test.jsx | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/frontend/src/pages/__tests__/Settings.test.jsx b/frontend/src/pages/__tests__/Settings.test.jsx
index fc0bc323..7a01b95a 100644
--- a/frontend/src/pages/__tests__/Settings.test.jsx
+++ b/frontend/src/pages/__tests__/Settings.test.jsx
@@ -78,6 +78,13 @@ vi.mock('../../components/forms/settings/NavOrderForm', () => ({
     </div>
   ),
 }));
+vi.mock('../../components/forms/settings/UserLimitsForm', () => ({
+  default: ({ active }) => (
+    <div data-testid="user-limits-form">
+      UserLimitsForm {active ? 'active' : 'inactive'}
+    </div>
+  ),
+}));
 vi.mock('../../components/ErrorBoundary', () => ({
   default: ({ children }) => <div data-testid="error-boundary">{children}</div>,
 }));

From 3ee925ca71f714d3fff3afb09a77a79704a71727 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 27 Mar 2026 15:14:04 -0500
Subject: [PATCH 45/67] tests: add Heart icon and Tooltip mock to Sidebar tests

---
 frontend/src/components/__tests__/Sidebar.test.jsx | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/frontend/src/components/__tests__/Sidebar.test.jsx b/frontend/src/components/__tests__/Sidebar.test.jsx
index cc5e8be2..e92b2f39 100644
--- a/frontend/src/components/__tests__/Sidebar.test.jsx
+++ b/frontend/src/components/__tests__/Sidebar.test.jsx
@@ -56,6 +56,7 @@ vi.mock('lucide-react', () => ({
   ChevronRight: () => <div data-testid="chevron-right-icon" />,
   MonitorCog: () => <div data-testid="monitor-cog-icon" />,
   Blocks: () => <div data-testid="blocks-icon" />,
+  Heart: () => <div data-testid="heart-icon" />,
 }));
 
 // Mock UserForm component
@@ -114,6 +115,7 @@ vi.mock('@mantine/core', async () => {
       </nav>
     ),
     ScrollArea: ({ children }) => <div>{children}</div>,
+    Tooltip: ({ children }) => <>{children}</>,
   };
 });
 

From 49f6871ba8d078859bc44ef4b51c7ee97e3ddcea Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Fri, 27 Mar 2026 16:36:34 -0500
Subject: [PATCH 46/67] changelog: Update formatting a bit.

---
 CHANGELOG.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7df81dc0..c2d5a865 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -50,10 +50,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 
 - HTML named entities in XMLTV EPG files are now resolved to Unicode characters before lxml parsing. Some EPG providers (particularly French and other European sources) use HTML named entities like `&eacute;`, `&icirc;`, `&uuml;` in channel names, program titles, and metadata. These are not valid XML entities — lxml 6.0.2 with `recover=True` silently drops them, causing characters to go missing (e.g., "Chaîne Télé" becomes "Chane Tl"). A preprocessing step in `fetch_xmltv()` now resolves HTML named entities while preserving the 5 XML-predefined entities, detecting encoding from the XML declaration (falling back to UTF-8), and processing line-by-line to a temp file before atomically replacing the original. (Closes #1095) — Thanks [@CodeBormen](https://github.com/CodeBormen)
-- Duplicate recordings created when EPG sources refresh and re-evaluate series rules — Thanks [@CodeBormen](https://github.com/CodeBormen):
+- Duplicate recordings created when EPG sources refresh and re-evaluate series rules (Fixes #940) — Thanks [@CodeBormen](https://github.com/CodeBormen):
   - **Program ID instability**: `parse_programs_for_source()` deletes and recreates all `ProgramData` rows with new auto-increment IDs on every EPG refresh. The dedup set used these IDs, so it never matched after a refresh. Deduplication now uses a stable `(tvg_id, start_time, end_time)` composite key sourced from `Recording.custom_properties.program`.
   - **Secondary guard using wrong times**: The DB guard compared unadjusted program times against offset-adjusted `Recording.start_time`/`end_time`, so it never matched when any DVR pre/post offset was configured. It now queries `custom_properties__program__start_time/end_time` (the original, unadjusted program times stored at recording creation).
-  - **No concurrency guard**: Each EPG source refresh fired `evaluate_series_rules.delay()` independently. Concurrent tasks loaded the dedup set before others committed, allowing races. Evaluation is now serialized with `acquire_task_lock` (reusing the existing EPG task pattern). Gracefully degrades if Redis is unavailable — the primary and secondary dedup guards still protect. (Fixes #940)
+  - **No concurrency guard**: Each EPG source refresh fired `evaluate_series_rules.delay()` independently. Concurrent tasks loaded the dedup set before others committed, allowing races. Evaluation is now serialized with `acquire_task_lock` (reusing the existing EPG task pattern). Gracefully degrades if Redis is unavailable — the primary and secondary dedup guards still protect.
 
 ## [0.21.1] - 2026-03-18
 

From 5f4e0661478e0b372c1dc8cd3f71c0ad75417e27 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sat, 28 Mar 2026 13:33:29 -0500
Subject: [PATCH 47/67] Enhancements: - Connection cards on the Stats page now
 show the **username** of the connected user in a new User column (between IP
 Address and Connected). The username is resolved from the user store using
 the `user_id` stored in Redis client metadata; unauthenticated connections
 display "Anonymous". (Closes #766) - `ip_address` and `user_id` were not
 included in the client info returned by `get_detailed_channel_info()` despite
 being available in the Redis hash. Both fields are now extracted and
 returned. (Closes #586)

---
 CHANGELOG.md                                  |  2 +
 apps/proxy/ts_proxy/channel_status.py         |  6 ++
 .../components/cards/StreamConnectionCard.jsx | 55 ++++++++++++++++---
 3 files changed, 56 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c2d5a865..450a33ae 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Connection cards on the Stats page now show the **username** of the connected user in a new User column (between IP Address and Connected). The username is resolved from the user store using the `user_id` stored in Redis client metadata; unauthenticated connections display "Anonymous". (Closes #766)
+- `ip_address` and `user_id` were not included in the client info returned by `get_detailed_channel_info()` despite being available in the Redis hash. Both fields are now extracted and returned. (Closes #586)
 - Donate button added to the sidebar footer. A heart icon links to the project's Open Collective page, visible in both expanded and collapsed states. Hovering shows a "Support Dispatcharr" tooltip. The version string is also now clickable to copy it to the clipboard.
 - User stream limits: administrators can now set a maximum number of concurrent streams per user account. When a user reaches their limit, the system can automatically terminate an existing stream to free a slot based on configurable rules. Limit enforcement applies to both live channels and VOD. (Closes #544)
   - Each user account has a new **Stream Limit** field (0 = unlimited) configurable from the user edit form in Settings → Users.
diff --git a/apps/proxy/ts_proxy/channel_status.py b/apps/proxy/ts_proxy/channel_status.py
index b7c77024..c4a54cdc 100644
--- a/apps/proxy/ts_proxy/channel_status.py
+++ b/apps/proxy/ts_proxy/channel_status.py
@@ -143,6 +143,8 @@ class ChannelStatus:
                 'client_id': client_id_str,
                 'user_agent': client_data.get('user_agent', 'unknown'),
                 'worker_id': client_data.get('worker_id', 'unknown'),
+                'ip_address': client_data.get('ip_address', 'unknown'),
+                'user_id': client_data.get('user_id', '0'),
             }
 
             if 'connected_at' in client_data:
@@ -473,6 +475,10 @@ class ChannelStatus:
                         connected_at = float(connected_at_bytes)
                         client_info['connected_since'] = time.time() - connected_at
 
+                    user_id_bytes = proxy_server.redis_client.hget(client_key, 'user_id')
+                    if user_id_bytes:
+                        client_info['user_id'] = user_id_bytes
+
                     clients.append(client_info)
 
             # Add clients to info
diff --git a/frontend/src/components/cards/StreamConnectionCard.jsx b/frontend/src/components/cards/StreamConnectionCard.jsx
index 56d4d174..86dbc240 100644
--- a/frontend/src/components/cards/StreamConnectionCard.jsx
+++ b/frontend/src/components/cards/StreamConnectionCard.jsx
@@ -2,6 +2,7 @@ import { useLocation } from 'react-router-dom';
 import React, { useEffect, useMemo, useState } from 'react';
 import usePlaylistsStore from '../../store/playlists.jsx';
 import useSettingsStore from '../../store/settings.jsx';
+import useUsersStore from '../../store/users.jsx';
 import {
   ActionIcon,
   Badge,
@@ -123,6 +124,8 @@ const StreamConnectionCard = ({
 
   // Get M3U account data from the playlists store
   const m3uAccounts = usePlaylistsStore((s) => s.playlists);
+  // Get users for resolving user_id → username on client rows
+  const users = useUsersStore((s) => s.users);
   // Get settings for speed threshold and environment mode
   const settings = useSettingsStore((s) => s.settings);
   const env_mode =
@@ -138,6 +141,15 @@ const StreamConnectionCard = ({
     return getM3uAccountsMap(m3uAccounts);
   }, [m3uAccounts]);
 
+  // Create a map of user IDs to usernames for quick lookup
+  const usersMap = useMemo(() => {
+    const map = {};
+    users.forEach((u) => {
+      map[String(u.id)] = u.username;
+    });
+    return map;
+  }, [users]);
+
   // Update M3U profile information when channel data changes
   useEffect(() => {
     // If the channel data includes M3U profile information, update our state
@@ -314,7 +326,8 @@ const StreamConnectionCard = ({
       {
         header: 'IP Address',
         accessorKey: 'ip_address',
-        size: 150,
+        grow: true,
+        minSize: 85,
         cell: ({ cell }) => (
           <Tooltip label={cell.getValue()}>
             <Text size="xs" truncate style={{ maxWidth: '100%' }}>
@@ -323,10 +336,29 @@ const StreamConnectionCard = ({
           </Tooltip>
         ),
       },
+      {
+        id: 'user',
+        header: 'User',
+        grow: true,
+        minSize: 60,
+        accessorFn: (row) => {
+          const uid = row.user_id ? String(row.user_id) : null;
+          if (!uid || uid === '0') return 'Anonymous';
+          return usersMap[uid] || `User ${uid}`;
+        },
+        cell: ({ cell }) => (
+          <Text size="xs" truncate style={{ maxWidth: '100%' }}>
+            {cell.getValue()}
+          </Text>
+        ),
+      },
       // Updated Connected column with tooltip
       {
         id: 'connected',
         header: 'Connected',
+        grow: 1.5,
+        minSize: 70,
+        maxSize: 150,
         accessorFn: connectedAccessor(fullDateTimeFormat),
         cell: ({ cell }) => (
           <Tooltip
@@ -336,7 +368,9 @@ const StreamConnectionCard = ({
                 : 'Unknown connection time'
             }
           >
-            <Text size="xs">{cell.getValue()}</Text>
+            <Text size="xs" truncate style={{ maxWidth: '100%' }}>
+              {cell.getValue()}
+            </Text>
           </Tooltip>
         ),
       },
@@ -344,6 +378,8 @@ const StreamConnectionCard = ({
       {
         id: 'duration',
         header: 'Duration',
+        size: 82,
+        minSize: 60,
         accessorFn: durationAccessor(),
         cell: ({ cell, row }) => {
           const exactDuration =
@@ -356,7 +392,9 @@ const StreamConnectionCard = ({
                   : 'Unknown duration'
               }
             >
-              <Text size="xs">{cell.getValue()}</Text>
+              <Text size="xs" style={{ whiteSpace: 'nowrap' }}>
+                {cell.getValue()}
+              </Text>
             </Tooltip>
           );
         },
@@ -364,10 +402,11 @@ const StreamConnectionCard = ({
       {
         id: 'actions',
         header: 'Actions',
-        size: 100,
+        size: 60,
+        minSize: 40,
       },
     ],
-    [fullDateTimeFormat]
+    [fullDateTimeFormat, usersMap]
   );
 
   const channelClientsTable = useTable({
@@ -383,6 +422,7 @@ const StreamConnectionCard = ({
     }),
     headerCellRenderFns: {
       ip_address: renderHeaderCell,
+      user: renderHeaderCell,
       connected: renderHeaderCell,
       duration: renderHeaderCell,
       actions: renderHeaderCell,
@@ -610,8 +650,9 @@ const StreamConnectionCard = ({
         {currentProgram &&
           isProgramDescExpanded &&
           currentProgram.start_time &&
-          currentProgram.end_time &&
-          <ProgramProgress currentProgram={currentProgram} />}
+          currentProgram.end_time && (
+            <ProgramProgress currentProgram={currentProgram} />
+          )}
 
         {/* Add stream selection dropdown and preview button */}
         {availableStreams.length > 0 && (

From 6f516c0074e535fcee250ab0b88a8ed0c836d4d9 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sat, 28 Mar 2026 13:36:47 -0500
Subject: [PATCH 48/67] Enhancement: `CustomTable` column layout now supports
 flexible (`grow`) columns alongside fixed-width ones:   - Column definitions
 accept a `grow` property (boolean or number) to opt into flex layout. A
 numeric value sets the flex-grow weight, allowing relative sizing between
 grow columns (e.g. `grow: 2` gives a column twice the share of spare space as
 `grow: 1`).   - `maxSize` is now respected on grow columns, capping how wide
 they expand via `maxWidth`.   - The wrapper's `minWidth` calculation now uses
 `minSize` (not TanStack's 150px default) for grow columns, preventing the
 table from overflowing its container when columns would otherwise be sized
 larger than available space.

---
 CHANGELOG.md                                          |  4 ++++
 .../src/components/tables/CustomTable/CustomTable.jsx | 11 ++++++++---
 .../components/tables/CustomTable/CustomTableBody.jsx |  8 ++++----
 .../tables/CustomTable/CustomTableHeader.jsx          |  5 ++++-
 4 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 450a33ae..c15fc6c3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -34,6 +34,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- `CustomTable` column layout now supports flexible (`grow`) columns alongside fixed-width ones:
+  - Column definitions accept a `grow` property (boolean or number) to opt into flex layout. A numeric value sets the flex-grow weight, allowing relative sizing between grow columns (e.g. `grow: 2` gives a column twice the share of spare space as `grow: 1`).
+  - `maxSize` is now respected on grow columns, capping how wide they expand via `maxWidth`.
+  - The wrapper's `minWidth` calculation now uses `minSize` (not TanStack's 150px default) for grow columns, preventing the table from overflowing its container when columns would otherwise be sized larger than available space.
 - Dependency updates:
   - `requests` 2.32.5 → 2.33.0 (security patch; see Security section)
   - `celery` 5.6.2 → 5.6.3
diff --git a/frontend/src/components/tables/CustomTable/CustomTable.jsx b/frontend/src/components/tables/CustomTable/CustomTable.jsx
index e14209d2..f1f081dd 100644
--- a/frontend/src/components/tables/CustomTable/CustomTable.jsx
+++ b/frontend/src/components/tables/CustomTable/CustomTable.jsx
@@ -6,17 +6,22 @@ import CustomTableBody from './CustomTableBody';
 const CustomTable = ({ table }) => {
   const tableSize = table?.tableSize ?? 'default';
 
-  // Get column sizing state for dependency tracking
+  // columnSizing is read here so the memo below re-runs when columns are resized.
   const columnSizing = table.getState().columnSizing;
 
-  // Calculate minimum table width reactively based on column sizes
+  // Calculate minimum table width reactively based on column sizes.
+  // Grow columns contribute only their minSize (not TanStack's default 150px)
+  // so the wrapper doesn't force the table wider than its container.
   const minTableWidth = useMemo(() => {
+    void columnSizing; // reactive trigger: recalculate when column sizes change
     const headerGroups = table.getHeaderGroups();
     if (!headerGroups || headerGroups.length === 0) return 0;
 
     const width =
       headerGroups[0]?.headers.reduce((total, header) => {
-        return total + header.getSize();
+        const colDef = header.column.columnDef;
+        const size = colDef.grow ? colDef.minSize || 0 : header.getSize();
+        return total + size;
       }, 0) || 0;
 
     return width;
diff --git a/frontend/src/components/tables/CustomTable/CustomTableBody.jsx b/frontend/src/components/tables/CustomTable/CustomTableBody.jsx
index d579a41a..c8178eeb 100644
--- a/frontend/src/components/tables/CustomTable/CustomTableBody.jsx
+++ b/frontend/src/components/tables/CustomTable/CustomTableBody.jsx
@@ -126,9 +126,6 @@ const CustomTableBody = ({
           }}
         >
           {row.getVisibleCells().map((cell) => {
-            const hasFixedSize = cell.column.columnDef.size;
-            const isFlexible = !hasFixedSize;
-
             return (
               <Box
                 className="td"
@@ -136,8 +133,11 @@ const CustomTableBody = ({
                 style={{
                   ...(cell.column.columnDef.grow
                     ? {
-                        flex: '1 1 0%',
+                        flex: `${cell.column.columnDef.grow === true ? 1 : cell.column.columnDef.grow} 1 0%`,
                         minWidth: 0,
+                        ...(cell.column.columnDef.maxSize && {
+                          maxWidth: `${cell.column.columnDef.maxSize}px`,
+                        }),
                       }
                     : {
                         flex: `0 0 ${cell.column.getSize ? cell.column.getSize() : 150}px`,
diff --git a/frontend/src/components/tables/CustomTable/CustomTableHeader.jsx b/frontend/src/components/tables/CustomTable/CustomTableHeader.jsx
index f4b47171..8df6357a 100644
--- a/frontend/src/components/tables/CustomTable/CustomTableHeader.jsx
+++ b/frontend/src/components/tables/CustomTable/CustomTableHeader.jsx
@@ -110,8 +110,11 @@ const CustomTableHeader = ({
                 style={{
                   ...(header.column.columnDef.grow
                     ? {
-                        flex: '1 1 0%',
+                        flex: `${header.column.columnDef.grow === true ? 1 : header.column.columnDef.grow} 1 0%`,
                         minWidth: 0,
+                        ...(header.column.columnDef.maxSize && {
+                          maxWidth: `${header.column.columnDef.maxSize}px`,
+                        }),
                       }
                     : {
                         flex: `0 0 ${header.getSize ? header.getSize() : 150}px`,

From dd97b642c7fe7509bd62dbd212fae33e6b8f1509 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sat, 28 Mar 2026 14:21:37 -0500
Subject: [PATCH 49/67] Bug Fix: preserve original file mtime during HTML
 entity resolution to prevent infinite refresh loop

---
 apps/epg/tasks.py | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/apps/epg/tasks.py b/apps/epg/tasks.py
index df1e0836..9683c85a 100644
--- a/apps/epg/tasks.py
+++ b/apps/epg/tasks.py
@@ -94,6 +94,15 @@ def _resolve_html_entities(file_path):
         header = f.read(200)
     encoding = _detect_xml_encoding(header)
 
+    # Capture the original mtime before modifying the file so that os.replace()
+    # does not update the file's mtime.  The file watcher in core/tasks.py uses
+    # mtime to detect changes; if we let mtime advance it would trigger an
+    # infinite refresh loop for local file-based EPG sources.
+    try:
+        original_stat = os.stat(file_path)
+    except OSError:
+        original_stat = None
+
     temp_path = file_path + '.entity_tmp'
     success = False
     try:
@@ -102,6 +111,10 @@ def _resolve_html_entities(file_path):
             for line in src:
                 dst.write(_NAMED_ENTITY_RE.sub(_replace_html_entity, line))
         os.replace(temp_path, file_path)
+        # Restore the original mtime (and atime) so the file watcher does not
+        # mistake the rewrite for an external update.
+        if original_stat is not None:
+            os.utime(file_path, (original_stat.st_atime, original_stat.st_mtime))
         success = True
         logger.debug(f"Resolved HTML entities in {file_path} (encoding: {encoding})")
     except Exception as e:

From 7ece48bdf2fd95b8dc9c0208c7f5f76245cd770b Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sat, 28 Mar 2026 15:12:24 -0500
Subject: [PATCH 50/67] tests: Update frontend tests

---
 .../__tests__/M3URefreshNotification.test.jsx |   1 +
 .../__tests__/NotificationCenter.test.jsx     | 119 ++++-
 .../components/__tests__/SeriesModal.test.jsx | 172 +++++--
 .../cards/__tests__/RecordingCard.test.jsx    | 280 ++++++++---
 .../cards/__tests__/SeriesCard.test.jsx       |  60 ++-
 .../__tests__/StreamConnectionCard.test.jsx   | 150 ++++--
 .../cards/__tests__/VODCard.test.jsx          |  58 ++-
 .../__tests__/VodConnectionCard.test.jsx      | 446 ++++++++++++++----
 8 files changed, 1006 insertions(+), 280 deletions(-)

diff --git a/frontend/src/components/__tests__/M3URefreshNotification.test.jsx b/frontend/src/components/__tests__/M3URefreshNotification.test.jsx
index 2c5a5572..43375fa7 100644
--- a/frontend/src/components/__tests__/M3URefreshNotification.test.jsx
+++ b/frontend/src/components/__tests__/M3URefreshNotification.test.jsx
@@ -57,6 +57,7 @@ vi.mock('@mantine/core', async () => {
 
 // Mock lucide-react icons
 vi.mock('lucide-react', () => ({
+  ListOrdered: () => <div data-testid="icon-list-ordered" />,
   CircleCheck: () => <div data-testid="circle-check-icon" />,
 }));
 
diff --git a/frontend/src/components/__tests__/NotificationCenter.test.jsx b/frontend/src/components/__tests__/NotificationCenter.test.jsx
index 9dfb13f5..2231c951 100644
--- a/frontend/src/components/__tests__/NotificationCenter.test.jsx
+++ b/frontend/src/components/__tests__/NotificationCenter.test.jsx
@@ -33,8 +33,12 @@ vi.mock('@mantine/core', async () => {
         {children}
       </div>
     ),
-    PopoverTarget: ({ children }) => <div data-testid="popover-target">{children}</div>,
-    PopoverDropdown: ({ children }) => <div data-testid="popover-dropdown">{children}</div>,
+    PopoverTarget: ({ children }) => (
+      <div data-testid="popover-target">{children}</div>
+    ),
+    PopoverDropdown: ({ children }) => (
+      <div data-testid="popover-dropdown">{children}</div>
+    ),
     Indicator: ({ children, label, disabled, processing }) => (
       <div
         data-testid="indicator"
@@ -46,18 +50,53 @@ vi.mock('@mantine/core', async () => {
       </div>
     ),
     ActionIcon: ({ children, onClick, 'aria-label': ariaLabel, ...props }) => (
-      <button onClick={onClick} aria-label={ariaLabel} data-testid={`action-icon-${ariaLabel}`} {...props}>
+      <button
+        onClick={onClick}
+        aria-label={ariaLabel}
+        data-testid={`action-icon-${ariaLabel}`}
+        {...props}
+      >
         {children}
       </button>
     ),
-    ScrollAreaAutosize: ({ children }) => <div data-testid="scroll-area">{children}</div>,
-    Badge: ({ children, ...props }) => <span data-testid="badge" {...props}>{children}</span>,
-    Card: ({ children, ...props }) => <div data-testid="notification-card" {...props}>{children}</div>,
-    ThemeIcon: ({ children, ...props }) => <div data-testid="theme-icon" {...props}>{children}</div>,
-    Group: ({ children, ...props }) => <div data-testid="group" {...props}>{children}</div>,
-    Stack: ({ children, ...props }) => <div data-testid="stack" {...props}>{children}</div>,
-    Box: ({ children, ...props }) => <div data-testid="box" {...props}>{children}</div>,
-    Text: ({ children, ...props }) => <span data-testid="text" {...props}>{children}</span>,
+    ScrollAreaAutosize: ({ children }) => (
+      <div data-testid="scroll-area">{children}</div>
+    ),
+    Badge: ({ children, ...props }) => (
+      <span data-testid="badge" {...props}>
+        {children}
+      </span>
+    ),
+    Card: ({ children, ...props }) => (
+      <div data-testid="notification-card" {...props}>
+        {children}
+      </div>
+    ),
+    ThemeIcon: ({ children, ...props }) => (
+      <div data-testid="theme-icon" {...props}>
+        {children}
+      </div>
+    ),
+    Group: ({ children, ...props }) => (
+      <div data-testid="group" {...props}>
+        {children}
+      </div>
+    ),
+    Stack: ({ children, ...props }) => (
+      <div data-testid="stack" {...props}>
+        {children}
+      </div>
+    ),
+    Box: ({ children, ...props }) => (
+      <div data-testid="box" {...props}>
+        {children}
+      </div>
+    ),
+    Text: ({ children, ...props }) => (
+      <span data-testid="text" {...props}>
+        {children}
+      </span>
+    ),
     Button: ({ children, onClick, ...props }) => (
       <button onClick={onClick} data-testid="button" {...props}>
         {children}
@@ -84,14 +123,19 @@ vi.mock('@mantine/core', async () => {
 
 // Mock lucide-react icons
 vi.mock('lucide-react', () => ({
+  ListOrdered: () => <span data-testid="icon-list-ordered">ListOrdered</span>,
   Bell: () => <span data-testid="bell-icon">Bell</span>,
   Check: () => <span data-testid="check-icon">Check</span>,
   CheckCheck: () => <span data-testid="checkcheck-icon">CheckCheck</span>,
   Download: () => <span data-testid="download-icon">Download</span>,
-  ExternalLink: () => <span data-testid="external-link-icon">ExternalLink</span>,
+  ExternalLink: () => (
+    <span data-testid="external-link-icon">ExternalLink</span>
+  ),
   Info: () => <span data-testid="info-icon">Info</span>,
   Settings: () => <span data-testid="settings-icon">Settings</span>,
-  AlertTriangle: () => <span data-testid="alert-triangle-icon">AlertTriangle</span>,
+  AlertTriangle: () => (
+    <span data-testid="alert-triangle-icon">AlertTriangle</span>
+  ),
   Megaphone: () => <span data-testid="megaphone-icon">Megaphone</span>,
   X: () => <span data-testid="x-icon">X</span>,
   Eye: () => <span data-testid="eye-icon">Eye</span>,
@@ -279,8 +323,12 @@ describe('NotificationCenter', () => {
     });
 
     it('should handle API errors gracefully', async () => {
-      const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
-      NotificationUtils.getNotifications.mockRejectedValue(new Error('Network error'));
+      const consoleError = vi
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+      NotificationUtils.getNotifications.mockRejectedValue(
+        new Error('Network error')
+      );
 
       renderComponent();
 
@@ -311,7 +359,7 @@ describe('NotificationCenter', () => {
       fireEvent.click(screen.getByLabelText('Notifications'));
 
       const eyeButtons = screen.getAllByTestId(/action-icon-/);
-      const toggleButton = eyeButtons.find(btn =>
+      const toggleButton = eyeButtons.find((btn) =>
         btn.querySelector('[data-testid="eye-icon"]')
       );
       fireEvent.click(toggleButton);
@@ -376,7 +424,10 @@ describe('NotificationCenter', () => {
       fireEvent.click(xIcons[0].closest('button'));
 
       await waitFor(() => {
-        expect(NotificationUtils.dismissNotification).toHaveBeenCalledWith(1, 'dismissed');
+        expect(NotificationUtils.dismissNotification).toHaveBeenCalledWith(
+          1,
+          'dismissed'
+        );
       });
     });
 
@@ -445,7 +496,10 @@ describe('NotificationCenter', () => {
       fireEvent.click(applyButton);
 
       await waitFor(() => {
-        expect(NotificationUtils.dismissNotification).toHaveBeenCalledWith(2, 'applied');
+        expect(NotificationUtils.dismissNotification).toHaveBeenCalledWith(
+          2,
+          'applied'
+        );
         expect(onSettingAction).toHaveBeenCalledWith(mockNotifications[1]);
       });
     });
@@ -458,7 +512,10 @@ describe('NotificationCenter', () => {
       fireEvent.click(ignoreButton);
 
       await waitFor(() => {
-        expect(NotificationUtils.dismissNotification).toHaveBeenCalledWith(2, 'dismissed');
+        expect(NotificationUtils.dismissNotification).toHaveBeenCalledWith(
+          2,
+          'dismissed'
+        );
       });
     });
 
@@ -520,7 +577,7 @@ describe('NotificationCenter', () => {
       fireEvent.click(screen.getByLabelText('Notifications'));
 
       const eyeButtons = screen.getAllByTestId(/action-icon-/);
-      const toggleButton = eyeButtons.find(btn =>
+      const toggleButton = eyeButtons.find((btn) =>
         btn.querySelector('[data-testid="eye-icon"]')
       );
       fireEvent.click(toggleButton);
@@ -599,7 +656,7 @@ describe('NotificationCenter', () => {
       fireEvent.click(screen.getByLabelText('Notifications'));
 
       const eyeButtons = screen.getAllByTestId(/action-icon-/);
-      const toggleButton = eyeButtons.find(btn =>
+      const toggleButton = eyeButtons.find((btn) =>
         btn.querySelector('[data-testid="eye-icon"]')
       );
       fireEvent.click(toggleButton);
@@ -610,8 +667,12 @@ describe('NotificationCenter', () => {
 
   describe('Error Handling', () => {
     it('should handle dismiss notification errors', async () => {
-      const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
-      NotificationUtils.dismissNotification.mockRejectedValue(new Error('API error'));
+      const consoleError = vi
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+      NotificationUtils.dismissNotification.mockRejectedValue(
+        new Error('API error')
+      );
 
       renderComponent();
       fireEvent.click(screen.getByLabelText('Notifications'));
@@ -630,8 +691,12 @@ describe('NotificationCenter', () => {
     });
 
     it('should handle dismiss all notifications errors', async () => {
-      const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
-      NotificationUtils.dismissAllNotifications.mockRejectedValue(new Error('API error'));
+      const consoleError = vi
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+      NotificationUtils.dismissAllNotifications.mockRejectedValue(
+        new Error('API error')
+      );
 
       renderComponent();
       fireEvent.click(screen.getByLabelText('Notifications'));
@@ -655,7 +720,9 @@ describe('NotificationCenter', () => {
       renderComponent();
       fireEvent.click(screen.getByLabelText('Notifications'));
 
-      const expectedDate = new Date('2024-01-01T10:00:00Z').toLocaleDateString();
+      const expectedDate = new Date(
+        '2024-01-01T10:00:00Z'
+      ).toLocaleDateString();
       expect(screen.getByText(expectedDate)).toBeInTheDocument();
     });
   });
diff --git a/frontend/src/components/__tests__/SeriesModal.test.jsx b/frontend/src/components/__tests__/SeriesModal.test.jsx
index acbd35c1..c9715199 100644
--- a/frontend/src/components/__tests__/SeriesModal.test.jsx
+++ b/frontend/src/components/__tests__/SeriesModal.test.jsx
@@ -26,6 +26,7 @@ vi.mock('../../utils', () => ({
 
 // Mock lucide-react icons
 vi.mock('lucide-react', () => ({
+  ListOrdered: () => <div data-testid="icon-list-ordered" />,
   Play: () => <div data-testid="play-icon" />,
   Copy: () => <div data-testid="copy-icon" />,
 }));
@@ -40,27 +41,60 @@ vi.mock('@mantine/core', async () => {
       if (!opened) return null;
       return (
         <div data-testid="modal" data-title={title} data-size={size}>
-          <button onClick={onClose} data-testid="modal-close">Close</button>
+          <button onClick={onClose} data-testid="modal-close">
+            Close
+          </button>
           <div>{children}</div>
         </div>
       );
     },
-    Box: ({ children, ...props }) => <div data-testid="box" {...props}>{children}</div>,
+    Box: ({ children, ...props }) => (
+      <div data-testid="box" {...props}>
+        {children}
+      </div>
+    ),
     Button: ({ children, onClick, disabled, ...props }) => (
-      <button onClick={onClick} disabled={disabled} data-testid="button" {...props}>
+      <button
+        onClick={onClick}
+        disabled={disabled}
+        data-testid="button"
+        {...props}
+      >
         {children}
       </button>
     ),
-    Flex: ({ children, ...props }) => <div data-testid="flex" {...props}>{children}</div>,
-    Group: ({ children, ...props }) => <div data-testid="group" {...props}>{children}</div>,
+    Flex: ({ children, ...props }) => (
+      <div data-testid="flex" {...props}>
+        {children}
+      </div>
+    ),
+    Group: ({ children, ...props }) => (
+      <div data-testid="group" {...props}>
+        {children}
+      </div>
+    ),
     Image: ({ src, alt, ...props }) => (
       <img src={src} alt={alt} data-testid="image" {...props} />
     ),
-    Text: ({ children, ...props }) => <div data-testid="text" {...props}>{children}</div>,
-    Title: ({ children, order, ...props }) => (
-      <div data-testid="title" data-order={order} {...props}>{children}</div>
+    Text: ({ children, ...props }) => (
+      <div data-testid="text" {...props}>
+        {children}
+      </div>
     ),
-    Select: ({ value, onChange, data, label, placeholder, disabled, ...props }) => (
+    Title: ({ children, order, ...props }) => (
+      <div data-testid="title" data-order={order} {...props}>
+        {children}
+      </div>
+    ),
+    Select: ({
+      value,
+      onChange,
+      data,
+      label,
+      placeholder,
+      disabled,
+      ...props
+    }) => (
       <div data-testid="select" data-label={label}>
         <select
           value={value || ''}
@@ -77,39 +111,76 @@ vi.mock('@mantine/core', async () => {
         </select>
       </div>
     ),
-    Badge: ({ children, ...props }) => <a data-testid="badge" {...props}>{children}</a>,
+    Badge: ({ children, ...props }) => (
+      <a data-testid="badge" {...props}>
+        {children}
+      </a>
+    ),
     Loader: (props) => <div data-testid="loader" {...props} />,
-    Stack: ({ children, ...props }) => <div data-testid="stack" {...props}>{children}</div>,
+    Stack: ({ children, ...props }) => (
+      <div data-testid="stack" {...props}>
+        {children}
+      </div>
+    ),
     ActionIcon: ({ children, onClick, disabled, ...props }) => (
-      <button onClick={onClick} disabled={disabled} data-testid="action-icon" {...props}>
+      <button
+        onClick={onClick}
+        disabled={disabled}
+        data-testid="action-icon"
+        {...props}
+      >
         {children}
       </button>
     ),
     Tabs: ({ children, value, onChange, ...props }) => (
       <div data-testid="tabs" data-value={value} {...props}>
-        <div onClick={(e) => {
-          const tab = e.target.closest('[data-tab-value]');
-          if (tab) onChange?.(tab.dataset.tabValue);
-        }}>
+        <div
+          onClick={(e) => {
+            const tab = e.target.closest('[data-tab-value]');
+            if (tab) onChange?.(tab.dataset.tabValue);
+          }}
+        >
           {children}
         </div>
       </div>
     ),
     TabsList: ({ children }) => <div data-testid="tabs-list">{children}</div>,
     TabsTab: ({ children, value }) => (
-      <button data-testid="tabs-tab" data-tab-value={value}>{children}</button>
+      <button data-testid="tabs-tab" data-tab-value={value}>
+        {children}
+      </button>
     ),
     TabsPanel: ({ children, value }) => (
-      <div data-testid="tabs-panel" data-value={value}>{children}</div>
+      <div data-testid="tabs-panel" data-value={value}>
+        {children}
+      </div>
+    ),
+    Table: ({ children, ...props }) => (
+      <table data-testid="table" {...props}>
+        {children}
+      </table>
+    ),
+    TableThead: ({ children }) => (
+      <thead data-testid="table-thead">{children}</thead>
+    ),
+    TableTbody: ({ children }) => (
+      <tbody data-testid="table-tbody">{children}</tbody>
     ),
-    Table: ({ children, ...props }) => <table data-testid="table" {...props}>{children}</table>,
-    TableThead: ({ children }) => <thead data-testid="table-thead">{children}</thead>,
-    TableTbody: ({ children }) => <tbody data-testid="table-tbody">{children}</tbody>,
     TableTr: ({ children, onClick, ...props }) => (
-      <tr onClick={onClick} data-testid="table-tr" {...props}>{children}</tr>
+      <tr onClick={onClick} data-testid="table-tr" {...props}>
+        {children}
+      </tr>
+    ),
+    TableTh: ({ children, ...props }) => (
+      <th data-testid="table-th" {...props}>
+        {children}
+      </th>
+    ),
+    TableTd: ({ children, ...props }) => (
+      <td data-testid="table-td" {...props}>
+        {children}
+      </td>
     ),
-    TableTh: ({ children, ...props }) => <th data-testid="table-th" {...props}>{children}</th>,
-    TableTd: ({ children, ...props }) => <td data-testid="table-td" {...props}>{children}</td>,
     Divider: (props) => <hr data-testid="divider" {...props} />,
   };
 });
@@ -168,7 +239,7 @@ describe('SeriesModal', () => {
       m3u_account: { name: 'Provider 2' },
       stream_name: 'Test Series 720p',
       quality_info: null,
-    }
+    },
   ];
 
   beforeEach(() => {
@@ -187,9 +258,15 @@ describe('SeriesModal', () => {
       environment: { env_mode: 'prod' },
     };
 
-    useVODStore.mockImplementation((selector) => selector ? selector(mockVODStore) : mockVODStore);
-    useVideoStore.mockImplementation((selector) => selector ? selector(mockVideoStore) : mockVideoStore);
-    useSettingsStore.mockImplementation((selector) => selector ? selector(mockSettingsStore) : mockSettingsStore);
+    useVODStore.mockImplementation((selector) =>
+      selector ? selector(mockVODStore) : mockVODStore
+    );
+    useVideoStore.mockImplementation((selector) =>
+      selector ? selector(mockVideoStore) : mockVideoStore
+    );
+    useSettingsStore.mockImplementation((selector) =>
+      selector ? selector(mockSettingsStore) : mockSettingsStore
+    );
 
     copyToClipboard.mockResolvedValue(undefined);
   });
@@ -325,23 +402,37 @@ describe('SeriesModal', () => {
 
     it('should display IMDB link when imdb_id exists', async () => {
       render(
-        <SeriesModal series={mockDetailedSeries} opened={true} onClose={vi.fn()} />
+        <SeriesModal
+          series={mockDetailedSeries}
+          opened={true}
+          onClose={vi.fn()}
+        />
       );
 
       await waitFor(() => {
         const link = screen.getByText(/IMDB/i).closest('a');
-        expect(link).toHaveAttribute('href', 'https://www.imdb.com/title/tt1234567');
+        expect(link).toHaveAttribute(
+          'href',
+          'https://www.imdb.com/title/tt1234567'
+        );
       });
     });
 
     it('should display TMDB link when tmdb_id exists', async () => {
       render(
-        <SeriesModal series={mockDetailedSeries} opened={true} onClose={vi.fn()} />
+        <SeriesModal
+          series={mockDetailedSeries}
+          opened={true}
+          onClose={vi.fn()}
+        />
       );
 
       await waitFor(() => {
         const link = screen.getByText(/TMDB/i).closest('a');
-        expect(link).toHaveAttribute('href', 'https://www.themoviedb.org/tv/12345');
+        expect(link).toHaveAttribute(
+          'href',
+          'https://www.themoviedb.org/tv/12345'
+        );
       });
     });
   });
@@ -446,7 +537,12 @@ describe('SeriesModal', () => {
     });
 
     it('should sort episodes by episode number', async () => {
-      const episode2 = { ...mockEpisode, id: 2, episode_number: 2, name: 'Second Episode' };
+      const episode2 = {
+        ...mockEpisode,
+        id: 2,
+        episode_number: 2,
+        name: 'Second Episode',
+      };
       mockVODStore.fetchSeriesInfo.mockResolvedValue({
         ...mockDetailedSeries,
         episodesList: [episode2, mockEpisode],
@@ -592,7 +688,12 @@ describe('SeriesModal', () => {
 
   describe('Season Tabs', () => {
     it('should create tabs for each season', async () => {
-      const season2Episode = { ...mockEpisode, id: 2, season_number: 2, episode_num: 1 };
+      const season2Episode = {
+        ...mockEpisode,
+        id: 2,
+        season_number: 2,
+        episode_num: 1,
+      };
       mockVODStore.fetchSeriesInfo.mockResolvedValue({
         ...mockDetailedSeries,
         episodesList: [mockEpisode, season2Episode],
@@ -670,7 +771,6 @@ describe('SeriesModal', () => {
         <SeriesModal series={mockSeries} opened={true} onClose={vi.fn()} />
       );
 
-
       await waitFor(() => {
         expect(screen.getByText(/Provider 1 - 1080p/)).toBeInTheDocument();
       });
@@ -797,7 +897,7 @@ describe('SeriesModal', () => {
       );
 
       await waitFor(() => {
-        expect(screen.getByText('Test Account')).toBeInTheDocument()
+        expect(screen.getByText('Test Account')).toBeInTheDocument();
       });
     });
   });
diff --git a/frontend/src/components/cards/__tests__/RecordingCard.test.jsx b/frontend/src/components/cards/__tests__/RecordingCard.test.jsx
index 9566f2b5..24e8dc46 100644
--- a/frontend/src/components/cards/__tests__/RecordingCard.test.jsx
+++ b/frontend/src/components/cards/__tests__/RecordingCard.test.jsx
@@ -109,13 +109,12 @@ vi.mock('@mantine/core', async () => ({
       {children}
     </span>
   ),
-  Tooltip: ({ children, label }) => (
-    <div data-tooltip={label}>{children}</div>
-  ),
+  Tooltip: ({ children, label }) => <div data-tooltip={label}>{children}</div>,
 }));
 
 // ── lucide-react ───────────────────────────────────────────────────────────────
 vi.mock('lucide-react', () => ({
+  ListOrdered: () => <svg data-testid="icon-list-ordered" />,
   AlertTriangle: () => <svg data-testid="icon-alert-triangle" />,
   Plus: () => <svg data-testid="icon-plus" />,
   Square: () => <svg data-testid="icon-square" />,
@@ -140,8 +139,13 @@ vi.mock('../../../images/logo.png', () => ({ default: 'default-logo.png' }));
 import useChannelsStore from '../../../store/channels.jsx';
 import useSettingsStore from '../../../store/settings.jsx';
 import useVideoStore from '../../../store/useVideoStore.jsx';
-import { useDateTimeFormat, useTimeHelpers, format, isAfter, isBefore }
-  from '../../../utils/dateTimeUtils.js';
+import {
+  useDateTimeFormat,
+  useTimeHelpers,
+  format,
+  isAfter,
+  isBefore,
+} from '../../../utils/dateTimeUtils.js';
 import { notifications } from '@mantine/notifications';
 import * as RecordingCardUtils from '../../../utils/cards/RecordingCardUtils.js';
 import dayjs from 'dayjs';
@@ -187,7 +191,11 @@ const makeChannel = () => ({
 });
 
 /** Wire up all store/utility mocks with sensible defaults */
-const setupMocks = ({ now = NOW, recording = makeRecording(), channel = makeChannel() } = {}) => {
+const setupMocks = ({
+  now = NOW,
+  recording = makeRecording(),
+  channel = makeChannel(),
+} = {}) => {
   const nowMoment = makeMoment(now);
   const startMoment = makeMoment(recording.start_time);
   const endMoment = makeMoment(recording.end_time);
@@ -226,9 +234,13 @@ const setupMocks = ({ now = NOW, recording = makeRecording(), channel = makeChan
 
   vi.mocked(RecordingCardUtils.getPosterUrl).mockReturnValue('/poster.jpg');
   vi.mocked(RecordingCardUtils.getChannelLogoUrl).mockReturnValue('/logo.png');
-  vi.mocked(RecordingCardUtils.getRecordingUrl).mockReturnValue('/recordings/test.ts');
+  vi.mocked(RecordingCardUtils.getRecordingUrl).mockReturnValue(
+    '/recordings/test.ts'
+  );
   vi.mocked(RecordingCardUtils.getSeasonLabel).mockReturnValue('');
-  vi.mocked(RecordingCardUtils.getSeriesInfo).mockReturnValue({ seriesId: 's1' });
+  vi.mocked(RecordingCardUtils.getSeriesInfo).mockReturnValue({
+    seriesId: 's1',
+  });
   vi.mocked(RecordingCardUtils.getShowVideoUrl).mockReturnValue('/live/ch-1');
 
   return { mockShowVideo, mockFetchRecordings };
@@ -237,10 +249,18 @@ const setupMocks = ({ now = NOW, recording = makeRecording(), channel = makeChan
 describe('RecordingCard', () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    vi.mocked(RecordingCardUtils.stopRecordingById).mockResolvedValue(undefined);
-    vi.mocked(RecordingCardUtils.deleteRecordingById).mockResolvedValue(undefined);
-    vi.mocked(RecordingCardUtils.deleteSeriesAndRule).mockResolvedValue(undefined);
-    vi.mocked(RecordingCardUtils.extendRecordingById).mockResolvedValue(undefined);
+    vi.mocked(RecordingCardUtils.stopRecordingById).mockResolvedValue(
+      undefined
+    );
+    vi.mocked(RecordingCardUtils.deleteRecordingById).mockResolvedValue(
+      undefined
+    );
+    vi.mocked(RecordingCardUtils.deleteSeriesAndRule).mockResolvedValue(
+      undefined
+    );
+    vi.mocked(RecordingCardUtils.extendRecordingById).mockResolvedValue(
+      undefined
+    );
     vi.mocked(RecordingCardUtils.runComSkip).mockResolvedValue(undefined);
     vi.mocked(RecordingCardUtils.removeRecording).mockReturnValue(undefined);
   });
@@ -250,17 +270,23 @@ describe('RecordingCard', () => {
   describe('rendering', () => {
     it('renders the recording title', () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       expect(screen.getByText('Test Show')).toBeInTheDocument();
     });
 
     it('renders "Custom Recording" when no program title', () => {
       setupMocks({
-        recording: makeRecording({ custom_properties: { status: 'completed', program: {} } }),
+        recording: makeRecording({
+          custom_properties: { status: 'completed', program: {} },
+        }),
       });
       render(
         <RecordingCard
-          recording={makeRecording({ custom_properties: { status: 'completed', program: {} } })}
+          recording={makeRecording({
+            custom_properties: { status: 'completed', program: {} },
+          })}
           channel={makeChannel()}
         />
       );
@@ -269,7 +295,9 @@ describe('RecordingCard', () => {
 
     it('renders channel info', () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       expect(screen.getByText('501 • HBO')).toBeInTheDocument();
     });
 
@@ -281,27 +309,35 @@ describe('RecordingCard', () => {
 
     it('shows description via RecordingSynopsis for non-series completed recording', () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       expect(screen.getByTestId('recording-synopsis')).toBeInTheDocument();
       expect(screen.getByText('A test description')).toBeInTheDocument();
     });
 
     it('shows sub_title when present', () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       expect(screen.getByText('Pilot')).toBeInTheDocument();
     });
 
     it('shows season/episode label when getSeasonLabel returns a value', () => {
       setupMocks();
       vi.mocked(RecordingCardUtils.getSeasonLabel).mockReturnValue('S01E02');
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       expect(screen.getByText('S01E02')).toBeInTheDocument();
     });
 
     it('renders the poster image', () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       const img = screen.getByAltText('Test Show');
       expect(img).toHaveAttribute('src', '/poster.jpg');
     });
@@ -312,7 +348,9 @@ describe('RecordingCard', () => {
   describe('status badge', () => {
     it('shows "Completed" badge for a completed recording', () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       expect(screen.getByText('Completed')).toBeInTheDocument();
     });
 
@@ -320,7 +358,10 @@ describe('RecordingCard', () => {
       const recording = makeRecording({
         start_time: PAST,
         end_time: FUTURE,
-        custom_properties: { status: 'recording', program: { title: 'Live Show' } },
+        custom_properties: {
+          status: 'recording',
+          program: { title: 'Live Show' },
+        },
       });
       setupMocks({ recording });
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
@@ -331,7 +372,10 @@ describe('RecordingCard', () => {
       const recording = makeRecording({
         start_time: FUTURE,
         end_time: FUTURE,
-        custom_properties: { status: 'scheduled', program: { title: 'Future Show' } },
+        custom_properties: {
+          status: 'scheduled',
+          program: { title: 'Future Show' },
+        },
       });
       setupMocks({ recording });
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
@@ -373,8 +417,7 @@ describe('RecordingCard', () => {
   // ── Series group ───────────────────────────────────────────────────────────
 
   describe('series group', () => {
-    const makeSeriesRecording = () =>
-      makeRecording({ _group_count: 3 });
+    const makeSeriesRecording = () => makeRecording({ _group_count: 3 });
 
     it('shows "Series" badge when _group_count > 1', () => {
       const recording = makeSeriesRecording();
@@ -394,7 +437,9 @@ describe('RecordingCard', () => {
       const recording = makeSeriesRecording();
       setupMocks({ recording });
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
-      expect(screen.queryByTestId('recording-synopsis')).not.toBeInTheDocument();
+      expect(
+        screen.queryByTestId('recording-synopsis')
+      ).not.toBeInTheDocument();
     });
   });
 
@@ -500,7 +545,9 @@ describe('RecordingCard', () => {
 
     it('does not show "Watch Live" for a completed recording', () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       expect(screen.queryByText('Watch Live')).not.toBeInTheDocument();
     });
 
@@ -523,7 +570,9 @@ describe('RecordingCard', () => {
 
     it('shows "Watch" button for a completed recording', () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       expect(screen.getByText('Watch')).toBeInTheDocument();
     });
 
@@ -531,7 +580,10 @@ describe('RecordingCard', () => {
       const recording = makeRecording({
         start_time: FUTURE,
         end_time: FUTURE,
-        custom_properties: { status: 'scheduled', program: { title: 'Future' } },
+        custom_properties: {
+          status: 'scheduled',
+          program: { title: 'Future' },
+        },
       });
       setupMocks({ recording });
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
@@ -540,7 +592,9 @@ describe('RecordingCard', () => {
 
     it('calls showVideo with vod params when Watch is clicked', () => {
       const { mockShowVideo } = setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       fireEvent.click(screen.getByText('Watch'));
       expect(mockShowVideo).toHaveBeenCalledWith(
         '/recordings/test.ts',
@@ -552,7 +606,9 @@ describe('RecordingCard', () => {
     it('does not call showVideo when Watch is clicked but no file url', () => {
       const { mockShowVideo } = setupMocks();
       vi.mocked(RecordingCardUtils.getRecordingUrl).mockReturnValue(null);
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       fireEvent.click(screen.getByText('Watch'));
       expect(mockShowVideo).not.toHaveBeenCalled();
     });
@@ -575,7 +631,9 @@ describe('RecordingCard', () => {
   describe('"Remove commercials" button', () => {
     it('shows "Remove commercials" for a completed recording without comskip', () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       expect(screen.getByText('Remove commercials')).toBeInTheDocument();
     });
 
@@ -597,7 +655,10 @@ describe('RecordingCard', () => {
       const recording = makeRecording({
         start_time: FUTURE,
         end_time: FUTURE,
-        custom_properties: { status: 'scheduled', program: { title: 'Future' } },
+        custom_properties: {
+          status: 'scheduled',
+          program: { title: 'Future' },
+        },
       });
       setupMocks({ recording });
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
@@ -606,20 +667,31 @@ describe('RecordingCard', () => {
 
     it('calls runComSkip and shows notification on success', async () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       fireEvent.click(screen.getByText('Remove commercials'));
       await waitFor(() => {
-        expect(RecordingCardUtils.runComSkip).toHaveBeenCalledWith(makeRecording());
+        expect(RecordingCardUtils.runComSkip).toHaveBeenCalledWith(
+          makeRecording()
+        );
         expect(notifications.show).toHaveBeenCalledWith(
-          expect.objectContaining({ title: 'Removing commercials', color: 'blue.5' })
+          expect.objectContaining({
+            title: 'Removing commercials',
+            color: 'blue.5',
+          })
         );
       });
     });
 
     it('does not show notification when runComSkip throws', async () => {
-      vi.mocked(RecordingCardUtils.runComSkip).mockRejectedValue(new Error('fail'));
+      vi.mocked(RecordingCardUtils.runComSkip).mockRejectedValue(
+        new Error('fail')
+      );
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
       fireEvent.click(screen.getByText('Remove commercials'));
       await waitFor(() => {
         expect(notifications.show).not.toHaveBeenCalled();
@@ -634,7 +706,11 @@ describe('RecordingCard', () => {
       makeRecording({
         start_time: PAST,
         end_time: FUTURE,
-        custom_properties: { status: 'recording', program: { title: 'Live Show' }, file_url: '/f.ts' },
+        custom_properties: {
+          status: 'recording',
+          program: { title: 'Live Show' },
+          file_url: '/f.ts',
+        },
       });
 
     it('shows extend menu for in-progress recording', () => {
@@ -650,9 +726,15 @@ describe('RecordingCard', () => {
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
       fireEvent.click(screen.getByText('+15 minutes'));
       await waitFor(() => {
-        expect(RecordingCardUtils.extendRecordingById).toHaveBeenCalledWith('rec-1', 15);
+        expect(RecordingCardUtils.extendRecordingById).toHaveBeenCalledWith(
+          'rec-1',
+          15
+        );
         expect(notifications.show).toHaveBeenCalledWith(
-          expect.objectContaining({ title: 'Recording extended', color: 'teal' })
+          expect.objectContaining({
+            title: 'Recording extended',
+            color: 'teal',
+          })
         );
       });
     });
@@ -663,7 +745,10 @@ describe('RecordingCard', () => {
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
       fireEvent.click(screen.getByText('+30 minutes'));
       await waitFor(() => {
-        expect(RecordingCardUtils.extendRecordingById).toHaveBeenCalledWith('rec-1', 30);
+        expect(RecordingCardUtils.extendRecordingById).toHaveBeenCalledWith(
+          'rec-1',
+          30
+        );
       });
     });
 
@@ -673,12 +758,17 @@ describe('RecordingCard', () => {
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
       fireEvent.click(screen.getByText('+1 hour'));
       await waitFor(() => {
-        expect(RecordingCardUtils.extendRecordingById).toHaveBeenCalledWith('rec-1', 60);
+        expect(RecordingCardUtils.extendRecordingById).toHaveBeenCalledWith(
+          'rec-1',
+          60
+        );
       });
     });
 
     it('shows error notification when extendRecordingById throws', async () => {
-      vi.mocked(RecordingCardUtils.extendRecordingById).mockRejectedValue(new Error('Network error'));
+      vi.mocked(RecordingCardUtils.extendRecordingById).mockRejectedValue(
+        new Error('Network error')
+      );
       const recording = makeInProgress();
       setupMocks({ recording });
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
@@ -698,7 +788,11 @@ describe('RecordingCard', () => {
       makeRecording({
         start_time: PAST,
         end_time: FUTURE,
-        custom_properties: { status: 'recording', program: { title: 'Live Show' }, file_url: '/f.ts' },
+        custom_properties: {
+          status: 'recording',
+          program: { title: 'Live Show' },
+          file_url: '/f.ts',
+        },
       });
 
     it('shows stop modal when stop button is clicked', () => {
@@ -711,7 +805,9 @@ describe('RecordingCard', () => {
       fireEvent.click(stopButton);
 
       expect(screen.getByTestId('modal')).toBeInTheDocument();
-      expect(screen.getByTestId('modal-title')).toHaveTextContent('Stop Recording');
+      expect(screen.getByTestId('modal-title')).toHaveTextContent(
+        'Stop Recording'
+      );
     });
 
     it('closes stop modal when Go Back is clicked', () => {
@@ -736,7 +832,9 @@ describe('RecordingCard', () => {
       fireEvent.click(screen.getAllByText('Stop Recording')[1]);
 
       await waitFor(() => {
-        expect(RecordingCardUtils.stopRecordingById).toHaveBeenCalledWith('rec-1');
+        expect(RecordingCardUtils.stopRecordingById).toHaveBeenCalledWith(
+          'rec-1'
+        );
         expect(mockFetchRecordings).toHaveBeenCalled();
       });
     });
@@ -761,48 +859,71 @@ describe('RecordingCard', () => {
   describe('delete recording', () => {
     it('shows delete modal for a completed non-series recording', () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
 
-      const deleteButton = screen.getByTestId('icon-square-x').closest('button');
+      const deleteButton = screen
+        .getByTestId('icon-square-x')
+        .closest('button');
       fireEvent.click(deleteButton);
 
       expect(screen.getByTestId('modal')).toBeInTheDocument();
-      expect(screen.getByTestId('modal-title')).toHaveTextContent('Delete Recording');
+      expect(screen.getByTestId('modal-title')).toHaveTextContent(
+        'Delete Recording'
+      );
     });
 
     it('shows "Cancel Recording" title for upcoming recording delete', () => {
       const recording = makeRecording({
         start_time: FUTURE,
         end_time: FUTURE,
-        custom_properties: { status: 'scheduled', program: { title: 'Future Show' } },
+        custom_properties: {
+          status: 'scheduled',
+          program: { title: 'Future Show' },
+        },
       });
       setupMocks({ recording });
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
 
-      const deleteButton = screen.getByTestId('icon-square-x').closest('button');
+      const deleteButton = screen
+        .getByTestId('icon-square-x')
+        .closest('button');
       fireEvent.click(deleteButton);
 
-      expect(screen.getByTestId('modal-title')).toHaveTextContent('Cancel Recording');
+      expect(screen.getByTestId('modal-title')).toHaveTextContent(
+        'Cancel Recording'
+      );
     });
 
     it('calls removeRecording when delete is confirmed', async () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
 
-      const deleteButton = screen.getByTestId('icon-square-x').closest('button');
+      const deleteButton = screen
+        .getByTestId('icon-square-x')
+        .closest('button');
       fireEvent.click(deleteButton);
       fireEvent.click(screen.getByText('Delete'));
 
       await waitFor(() => {
-        expect(RecordingCardUtils.removeRecording).toHaveBeenCalledWith('rec-1');
+        expect(RecordingCardUtils.removeRecording).toHaveBeenCalledWith(
+          'rec-1'
+        );
       });
     });
 
     it('closes delete modal after confirming', async () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
 
-      const deleteButton = screen.getByTestId('icon-square-x').closest('button');
+      const deleteButton = screen
+        .getByTestId('icon-square-x')
+        .closest('button');
       fireEvent.click(deleteButton);
       fireEvent.click(screen.getByText('Delete'));
 
@@ -813,9 +934,13 @@ describe('RecordingCard', () => {
 
     it('closes delete modal on Go Back click', () => {
       setupMocks();
-      render(<RecordingCard recording={makeRecording()} channel={makeChannel()} />);
+      render(
+        <RecordingCard recording={makeRecording()} channel={makeChannel()} />
+      );
 
-      const deleteButton = screen.getByTestId('icon-square-x').closest('button');
+      const deleteButton = screen
+        .getByTestId('icon-square-x')
+        .closest('button');
       fireEvent.click(deleteButton);
       fireEvent.click(screen.getByText('Go Back'));
 
@@ -842,10 +967,14 @@ describe('RecordingCard', () => {
       setupMocks({ recording });
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
 
-      const deleteButton = screen.getByTestId('icon-square-x').closest('button');
+      const deleteButton = screen
+        .getByTestId('icon-square-x')
+        .closest('button');
       fireEvent.click(deleteButton);
 
-      expect(screen.getByTestId('modal-title')).toHaveTextContent('Cancel Series');
+      expect(screen.getByTestId('modal-title')).toHaveTextContent(
+        'Cancel Series'
+      );
     });
 
     it('calls deleteRecordingById when "Only this upcoming" is clicked', async () => {
@@ -853,12 +982,16 @@ describe('RecordingCard', () => {
       const { mockFetchRecordings } = setupMocks({ recording });
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
 
-      const deleteButton = screen.getByTestId('icon-square-x').closest('button');
+      const deleteButton = screen
+        .getByTestId('icon-square-x')
+        .closest('button');
       fireEvent.click(deleteButton);
       fireEvent.click(screen.getByText('Only this upcoming'));
 
       await waitFor(() => {
-        expect(RecordingCardUtils.deleteRecordingById).toHaveBeenCalledWith('rec-1');
+        expect(RecordingCardUtils.deleteRecordingById).toHaveBeenCalledWith(
+          'rec-1'
+        );
         expect(mockFetchRecordings).toHaveBeenCalled();
       });
     });
@@ -868,7 +1001,9 @@ describe('RecordingCard', () => {
       const { mockFetchRecordings } = setupMocks({ recording });
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
 
-      const deleteButton = screen.getByTestId('icon-square-x').closest('button');
+      const deleteButton = screen
+        .getByTestId('icon-square-x')
+        .closest('button');
       fireEvent.click(deleteButton);
       fireEvent.click(screen.getByText('Entire series + rule'));
 
@@ -883,7 +1018,9 @@ describe('RecordingCard', () => {
       setupMocks({ recording });
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
 
-      const deleteButton = screen.getByTestId('icon-square-x').closest('button');
+      const deleteButton = screen
+        .getByTestId('icon-square-x')
+        .closest('button');
       fireEvent.click(deleteButton);
       fireEvent.click(screen.getByText('Only this upcoming'));
 
@@ -918,13 +1055,18 @@ describe('RecordingCard', () => {
         _group_count: 3,
         start_time: FUTURE,
         end_time: FUTURE,
-        custom_properties: { status: 'scheduled', program: { title: 'Series' } },
+        custom_properties: {
+          status: 'scheduled',
+          program: { title: 'Series' },
+        },
       });
       const { mockFetchRecordings } = setupMocks({ recording });
       mockFetchRecordings.mockRejectedValue(new Error('network'));
 
       render(<RecordingCard recording={recording} channel={makeChannel()} />);
-      const deleteButton = screen.getByTestId('icon-square-x').closest('button');
+      const deleteButton = screen
+        .getByTestId('icon-square-x')
+        .closest('button');
       fireEvent.click(deleteButton);
 
       await expect(
@@ -932,4 +1074,4 @@ describe('RecordingCard', () => {
       ).resolves.not.toThrow();
     });
   });
-});
\ No newline at end of file
+});
diff --git a/frontend/src/components/cards/__tests__/SeriesCard.test.jsx b/frontend/src/components/cards/__tests__/SeriesCard.test.jsx
index fb95c882..49b8524f 100644
--- a/frontend/src/components/cards/__tests__/SeriesCard.test.jsx
+++ b/frontend/src/components/cards/__tests__/SeriesCard.test.jsx
@@ -30,7 +30,13 @@ vi.mock('@mantine/core', async () => ({
   ),
   Stack: ({ children, gap }) => <div data-testid="stack">{children}</div>,
   Text: ({ children, size, fw, c, lineClamp, style }) => (
-    <span data-testid="text" data-size={size} data-fw={fw} data-color={c} style={style}>
+    <span
+      data-testid="text"
+      data-size={size}
+      data-fw={fw}
+      data-color={c}
+      style={style}
+    >
       {children}
     </span>
   ),
@@ -38,6 +44,7 @@ vi.mock('@mantine/core', async () => ({
 
 // ── lucide-react ───────────────────────────────────────────────────────────────
 vi.mock('lucide-react', () => ({
+  ListOrdered: () => <svg data-testid="icon-list-ordered" />,
   Calendar: () => <svg data-testid="icon-calendar" />,
   Play: () => <svg data-testid="icon-play" />,
   Star: () => <svg data-testid="icon-star" />,
@@ -78,7 +85,12 @@ describe('SeriesCard', () => {
     });
 
     it('renders a fallback image when poster_url is missing', () => {
-      render(<SeriesCard series={makeSeries({ poster_url: null })} onClick={vi.fn()} />);
+      render(
+        <SeriesCard
+          series={makeSeries({ poster_url: null })}
+          onClick={vi.fn()}
+        />
+      );
       const img = screen.getByRole('img');
       expect(img).toBeInTheDocument();
     });
@@ -105,7 +117,12 @@ describe('SeriesCard', () => {
 
     it('renders play icon', () => {
       //this only renders when logo.url is missing, but we want to test that the icon itself renders correctly
-      render(<SeriesCard series={makeSeries({ logo: { url: null } })} onClick={vi.fn()} />);
+      render(
+        <SeriesCard
+          series={makeSeries({ logo: { url: null } })}
+          onClick={vi.fn()}
+        />
+      );
       expect(screen.getByTestId('icon-play')).toBeInTheDocument();
     });
 
@@ -119,27 +136,52 @@ describe('SeriesCard', () => {
 
   describe('optional fields', () => {
     it('does not crash when year is missing', () => {
-      render(<SeriesCard series={makeSeries({ year: undefined })} onClick={vi.fn()} />);
+      render(
+        <SeriesCard
+          series={makeSeries({ year: undefined })}
+          onClick={vi.fn()}
+        />
+      );
       expect(screen.getByTestId('series-card')).toBeInTheDocument();
     });
 
     it('does not crash when rating is missing', () => {
-      render(<SeriesCard series={makeSeries({ rating: undefined })} onClick={vi.fn()} />);
+      render(
+        <SeriesCard
+          series={makeSeries({ rating: undefined })}
+          onClick={vi.fn()}
+        />
+      );
       expect(screen.getByTestId('series-card')).toBeInTheDocument();
     });
 
     it('does not crash when genre is missing', () => {
-      render(<SeriesCard series={makeSeries({ genre: undefined })} onClick={vi.fn()} />);
+      render(
+        <SeriesCard
+          series={makeSeries({ genre: undefined })}
+          onClick={vi.fn()}
+        />
+      );
       expect(screen.getByTestId('series-card')).toBeInTheDocument();
     });
 
     it('does not crash when description is missing', () => {
-      render(<SeriesCard series={makeSeries({ description: undefined })} onClick={vi.fn()} />);
+      render(
+        <SeriesCard
+          series={makeSeries({ description: undefined })}
+          onClick={vi.fn()}
+        />
+      );
       expect(screen.getByTestId('series-card')).toBeInTheDocument();
     });
 
     it('does not crash when seasons is missing', () => {
-      render(<SeriesCard series={makeSeries({ seasons: undefined })} onClick={vi.fn()} />);
+      render(
+        <SeriesCard
+          series={makeSeries({ seasons: undefined })}
+          onClick={vi.fn()}
+        />
+      );
       expect(screen.getByTestId('series-card')).toBeInTheDocument();
     });
 
@@ -161,4 +203,4 @@ describe('SeriesCard', () => {
       expect(onClick).toHaveBeenCalledWith(series);
     });
   });
-});
\ No newline at end of file
+});
diff --git a/frontend/src/components/cards/__tests__/StreamConnectionCard.test.jsx b/frontend/src/components/cards/__tests__/StreamConnectionCard.test.jsx
index babcf1e6..2f006244 100644
--- a/frontend/src/components/cards/__tests__/StreamConnectionCard.test.jsx
+++ b/frontend/src/components/cards/__tests__/StreamConnectionCard.test.jsx
@@ -95,7 +95,12 @@ vi.mock('@mantine/core', () => ({
   Center: ({ children }) => <div data-testid="center">{children}</div>,
   Group: ({ children }) => <div data-testid="group">{children}</div>,
   Progress: ({ value, size, color }) => (
-    <div data-testid="progress" data-value={value} data-size={size} data-color={color} />
+    <div
+      data-testid="progress"
+      data-value={value}
+      data-size={size}
+      data-color={color}
+    />
   ),
   Select: ({ value, onChange, label, data, disabled, placeholder }) => (
     <select
@@ -129,9 +134,7 @@ vi.mock('@mantine/core', () => ({
       {children}
     </span>
   ),
-  Tooltip: ({ children, label }) => (
-    <div data-tooltip={label}>{children}</div>
-  ),
+  Tooltip: ({ children, label }) => <div data-tooltip={label}>{children}</div>,
   useMantineTheme: vi.fn(() => ({
     tailwind: { green: { 5: '#22c55e' } },
   })),
@@ -139,6 +142,22 @@ vi.mock('@mantine/core', () => ({
 
 // ── lucide-react ──────────────────────────────────────────────────────────────
 vi.mock('lucide-react', () => ({
+  // navigation.js icons (all must be present for the auth→navigation import chain)
+  ListOrdered: () => <svg data-testid="icon-list-ordered" />,
+  Play: () => <svg data-testid="icon-play" />,
+  Database: () => <svg data-testid="icon-database" />,
+  LayoutGrid: () => <svg data-testid="icon-layout-grid" />,
+  Settings: () => <svg data-testid="icon-settings" />,
+  ChartLine: () => <svg data-testid="icon-chart-line" />,
+  Video: () => <svg data-testid="icon-video" />,
+  PlugZap: () => <svg data-testid="icon-plug-zap" />,
+  User: () => <svg data-testid="icon-user" />,
+  FileImage: () => <svg data-testid="icon-file-image" />,
+  Webhook: () => <svg data-testid="icon-webhook" />,
+  Logs: () => <svg data-testid="icon-logs" />,
+  Blocks: () => <svg data-testid="icon-blocks" />,
+  MonitorCog: () => <svg data-testid="icon-monitor-cog" />,
+  // StreamConnectionCard-specific icons
   ChevronDown: () => <svg data-testid="icon-chevron-down" />,
   ChevronRight: () => <svg data-testid="icon-chevron-right" />,
   CirclePlay: () => <svg data-testid="icon-circle-play" />,
@@ -149,7 +168,6 @@ vi.mock('lucide-react', () => ({
   SquareX: () => <svg data-testid="icon-square-x" />,
   Timer: () => <svg data-testid="icon-timer" />,
   Users: () => <svg data-testid="icon-users" />,
-  Video: () => <svg data-testid="icon-video" />,
 }));
 
 // ── Imports after mocks ───────────────────────────────────────────────────────
@@ -264,13 +282,17 @@ describe('StreamConnectionCard', () => {
   describe('route guard', () => {
     it('renders nothing when pathname is not /stats', () => {
       setupLocation('/dashboard');
-      const { container } = render(<StreamConnectionCard {...defaultProps()} />);
+      const { container } = render(
+        <StreamConnectionCard {...defaultProps()} />
+      );
       expect(container.firstChild).toBeNull();
     });
 
     it('renders nothing when pathname is /channels', () => {
       setupLocation('/channels');
-      const { container } = render(<StreamConnectionCard {...defaultProps()} />);
+      const { container } = render(
+        <StreamConnectionCard {...defaultProps()} />
+      );
       expect(container.firstChild).toBeNull();
     });
 
@@ -337,7 +359,9 @@ describe('StreamConnectionCard', () => {
       vi.mocked(getStreamsByIds).mockResolvedValue([]);
       render(
         <StreamConnectionCard
-          {...defaultProps({ channel: makeChannel({ name: '', stream_id: null }) })}
+          {...defaultProps({
+            channel: makeChannel({ name: '', stream_id: null }),
+          })}
         />
       );
       expect(screen.getByText('Unnamed Channel')).toBeInTheDocument();
@@ -465,7 +489,9 @@ describe('StreamConnectionCard', () => {
 
   describe('current program', () => {
     it('does not render program section when currentProgram is null', () => {
-      render(<StreamConnectionCard {...defaultProps({ currentProgram: null })} />);
+      render(
+        <StreamConnectionCard {...defaultProps({ currentProgram: null })} />
+      );
       expect(screen.queryByText('Now Playing:')).not.toBeInTheDocument();
     });
 
@@ -493,7 +519,9 @@ describe('StreamConnectionCard', () => {
           {...defaultProps({ currentProgram: makeCurrentProgram() })}
         />
       );
-      expect(screen.queryByText('Daily news broadcast.')).not.toBeInTheDocument();
+      expect(
+        screen.queryByText('Daily news broadcast.')
+      ).not.toBeInTheDocument();
     });
 
     it('expands program description when chevron button is clicked', () => {
@@ -502,7 +530,9 @@ describe('StreamConnectionCard', () => {
           {...defaultProps({ currentProgram: makeCurrentProgram() })}
         />
       );
-      const chevronBtn = screen.getByTestId('icon-chevron-right').closest('button');
+      const chevronBtn = screen
+        .getByTestId('icon-chevron-right')
+        .closest('button');
       fireEvent.click(chevronBtn);
       expect(screen.getByText('Daily news broadcast.')).toBeInTheDocument();
     });
@@ -513,12 +543,18 @@ describe('StreamConnectionCard', () => {
           {...defaultProps({ currentProgram: makeCurrentProgram() })}
         />
       );
-      const chevronBtn = screen.getByTestId('icon-chevron-right').closest('button');
+      const chevronBtn = screen
+        .getByTestId('icon-chevron-right')
+        .closest('button');
       fireEvent.click(chevronBtn);
       expect(screen.getByText('Daily news broadcast.')).toBeInTheDocument();
-      const chevronDownBtn = screen.getByTestId('icon-chevron-down').closest('button');
+      const chevronDownBtn = screen
+        .getByTestId('icon-chevron-down')
+        .closest('button');
       fireEvent.click(chevronDownBtn);
-      expect(screen.queryByText('Daily news broadcast.')).not.toBeInTheDocument();
+      expect(
+        screen.queryByText('Daily news broadcast.')
+      ).not.toBeInTheDocument();
     });
 
     it('renders program progress when expanded and times are present', () => {
@@ -527,7 +563,9 @@ describe('StreamConnectionCard', () => {
           {...defaultProps({ currentProgram: makeCurrentProgram() })}
         />
       );
-      const chevronBtn = screen.getByTestId('icon-chevron-right').closest('button');
+      const chevronBtn = screen
+        .getByTestId('icon-chevron-right')
+        .closest('button');
       fireEvent.click(chevronBtn);
       expect(screen.getByTestId('progress')).toBeInTheDocument();
     });
@@ -536,11 +574,16 @@ describe('StreamConnectionCard', () => {
       render(
         <StreamConnectionCard
           {...defaultProps({
-            currentProgram: makeCurrentProgram({ start_time: null, end_time: null }),
+            currentProgram: makeCurrentProgram({
+              start_time: null,
+              end_time: null,
+            }),
           })}
         />
       );
-      const chevronBtn = screen.getByTestId('icon-chevron-right').closest('button');
+      const chevronBtn = screen
+        .getByTestId('icon-chevron-right')
+        .closest('button');
       fireEvent.click(chevronBtn);
       expect(screen.queryByTestId('progress')).not.toBeInTheDocument();
     });
@@ -570,9 +613,8 @@ describe('StreamConnectionCard', () => {
         { id: 11, name: 'Stream B', url: 'http://b.com', m3u_profile: null },
       ]);
       // Provide options via getStreamOptions mock
-      const { getStreamOptions } = await import(
-        '../../../utils/cards/StreamConnectionCardUtils.js'
-        );
+      const { getStreamOptions } =
+        await import('../../../utils/cards/StreamConnectionCardUtils.js');
       vi.mocked(getStreamOptions).mockReturnValue([
         { value: '10', label: 'Stream A' },
         { value: '11', label: 'Stream B' },
@@ -585,7 +627,12 @@ describe('StreamConnectionCard', () => {
 
     it('sets activeStreamId when a matching stream is found by URL', async () => {
       vi.mocked(getChannelStreams).mockResolvedValue([
-        { id: 42, name: 'Stream A', url: 'http://stream.example.com/ch1', m3u_profile: null },
+        {
+          id: 42,
+          name: 'Stream A',
+          url: 'http://stream.example.com/ch1',
+          m3u_profile: null,
+        },
       ]);
       vi.mocked(getMatchingStreamByUrl).mockReturnValue({
         id: 42,
@@ -614,11 +661,15 @@ describe('StreamConnectionCard', () => {
   describe('stream switching', () => {
     beforeEach(async () => {
       vi.mocked(getChannelStreams).mockResolvedValue([
-        { id: 10, name: 'Stream A', url: 'http://a.com', m3u_profile: { name: 'M3U A' } },
+        {
+          id: 10,
+          name: 'Stream A',
+          url: 'http://a.com',
+          m3u_profile: { name: 'M3U A' },
+        },
       ]);
-      const { getStreamOptions } = await import(
-        '../../../utils/cards/StreamConnectionCardUtils.js'
-        );
+      const { getStreamOptions } =
+        await import('../../../utils/cards/StreamConnectionCardUtils.js');
       vi.mocked(getStreamOptions).mockReturnValue([
         { value: '10', label: 'Stream A' },
       ]);
@@ -633,7 +684,9 @@ describe('StreamConnectionCard', () => {
       vi.mocked(switchStream).mockResolvedValue({});
       render(<StreamConnectionCard {...defaultProps()} />);
       await waitFor(() => screen.getByTestId('select'));
-      fireEvent.change(screen.getByTestId('select'), { target: { value: '10' } });
+      fireEvent.change(screen.getByTestId('select'), {
+        target: { value: '10' },
+      });
       await waitFor(() => {
         expect(switchStream).toHaveBeenCalledWith(
           expect.objectContaining({ channel_id: 'ch-uuid-1' }),
@@ -646,7 +699,9 @@ describe('StreamConnectionCard', () => {
       vi.mocked(switchStream).mockResolvedValue({});
       render(<StreamConnectionCard {...defaultProps()} />);
       await waitFor(() => screen.getByTestId('select'));
-      fireEvent.change(screen.getByTestId('select'), { target: { value: '10' } });
+      fireEvent.change(screen.getByTestId('select'), {
+        target: { value: '10' },
+      });
       await waitFor(() => {
         expect(showNotification).toHaveBeenCalledWith(
           expect.objectContaining({ color: 'blue.5' })
@@ -658,7 +713,9 @@ describe('StreamConnectionCard', () => {
       vi.mocked(switchStream).mockRejectedValue(new Error('Switch failed'));
       render(<StreamConnectionCard {...defaultProps()} />);
       await waitFor(() => screen.getByTestId('select'));
-      fireEvent.change(screen.getByTestId('select'), { target: { value: '10' } });
+      fireEvent.change(screen.getByTestId('select'), {
+        target: { value: '10' },
+      });
       await waitFor(() => {
         expect(showNotification).toHaveBeenCalledWith(
           expect.objectContaining({ color: 'red.5' })
@@ -672,7 +729,9 @@ describe('StreamConnectionCard', () => {
       });
       render(<StreamConnectionCard {...defaultProps()} />);
       await waitFor(() => screen.getByTestId('select'));
-      fireEvent.change(screen.getByTestId('select'), { target: { value: '10' } });
+      fireEvent.change(screen.getByTestId('select'), {
+        target: { value: '10' },
+      });
       await waitFor(() => {
         expect(screen.getByText('Updated M3U')).toBeInTheDocument();
       });
@@ -686,7 +745,9 @@ describe('StreamConnectionCard', () => {
       vi.mocked(getChannelStreams).mockResolvedValue([]);
       render(<StreamConnectionCard {...defaultProps()} />);
       await waitFor(() => {
-        expect(screen.queryByTestId('icon-circle-play')).not.toBeInTheDocument();
+        expect(
+          screen.queryByTestId('icon-circle-play')
+        ).not.toBeInTheDocument();
       });
     });
 
@@ -694,10 +755,11 @@ describe('StreamConnectionCard', () => {
       vi.mocked(getChannelStreams).mockResolvedValue([
         { id: 10, name: 'Stream A', url: 'http://a.com', m3u_profile: null },
       ]);
-      const { getStreamOptions } = await import(
-        '../../../utils/cards/StreamConnectionCardUtils.js'
-        );
-      vi.mocked(getStreamOptions).mockReturnValue([{ value: '10', label: 'Stream A' }]);
+      const { getStreamOptions } =
+        await import('../../../utils/cards/StreamConnectionCardUtils.js');
+      vi.mocked(getStreamOptions).mockReturnValue([
+        { value: '10', label: 'Stream A' },
+      ]);
       render(<StreamConnectionCard {...defaultProps()} />);
       await waitFor(() => {
         expect(screen.getByTestId('icon-circle-play')).toBeInTheDocument();
@@ -712,10 +774,11 @@ describe('StreamConnectionCard', () => {
       vi.mocked(getChannelStreams).mockResolvedValue([
         { id: 10, name: 'Stream A', url: 'http://a.com', m3u_profile: null },
       ]);
-      const { getStreamOptions } = await import(
-        '../../../utils/cards/StreamConnectionCardUtils.js'
-        );
-      vi.mocked(getStreamOptions).mockReturnValue([{ value: '10', label: 'Stream A' }]);
+      const { getStreamOptions } =
+        await import('../../../utils/cards/StreamConnectionCardUtils.js');
+      vi.mocked(getStreamOptions).mockReturnValue([
+        { value: '10', label: 'Stream A' },
+      ]);
 
       render(<StreamConnectionCard {...defaultProps()} />);
       await waitFor(() => screen.getByTestId('icon-circle-play'));
@@ -738,10 +801,11 @@ describe('StreamConnectionCard', () => {
       vi.mocked(getChannelStreams).mockResolvedValue([
         { id: 10, name: 'Stream A', url: 'http://a.com', m3u_profile: null },
       ]);
-      const { getStreamOptions } = await import(
-        '../../../utils/cards/StreamConnectionCardUtils.js'
-        );
-      vi.mocked(getStreamOptions).mockReturnValue([{ value: '10', label: 'Stream A' }]);
+      const { getStreamOptions } =
+        await import('../../../utils/cards/StreamConnectionCardUtils.js');
+      vi.mocked(getStreamOptions).mockReturnValue([
+        { value: '10', label: 'Stream A' },
+      ]);
 
       render(
         <StreamConnectionCard {...defaultProps({ channelsByUUID: {} })} />
@@ -837,4 +901,4 @@ describe('StreamConnectionCard', () => {
       expect(screen.getAllByText('0 Kbps').length).toBeGreaterThan(0);
     });
   });
-});
\ No newline at end of file
+});
diff --git a/frontend/src/components/cards/__tests__/VODCard.test.jsx b/frontend/src/components/cards/__tests__/VODCard.test.jsx
index 05e98b1e..679d8145 100644
--- a/frontend/src/components/cards/__tests__/VODCard.test.jsx
+++ b/frontend/src/components/cards/__tests__/VODCard.test.jsx
@@ -10,12 +10,22 @@ vi.mock('../../../utils/cards/VODCardUtils.js', () => ({
 // ── Mantine core ──────────────────────────────────────────────────────────────
 vi.mock('@mantine/core', () => ({
   ActionIcon: ({ children, onClick, variant, size }) => (
-    <button data-testid="action-icon" data-variant={variant} data-size={size} onClick={onClick}>
+    <button
+      data-testid="action-icon"
+      data-variant={variant}
+      data-size={size}
+      onClick={onClick}
+    >
       {children}
     </button>
   ),
   Badge: ({ children, color, variant, size }) => (
-    <span data-testid="badge" data-color={color} data-variant={variant} data-size={size}>
+    <span
+      data-testid="badge"
+      data-color={color}
+      data-variant={variant}
+      data-size={size}
+    >
       {children}
     </span>
   ),
@@ -37,14 +47,27 @@ vi.mock('@mantine/core', () => ({
       {children}
     </div>
   ),
-  CardSection: ({ children }) => <div data-testid="card-section">{children}</div>,
+  CardSection: ({ children }) => (
+    <div data-testid="card-section">{children}</div>
+  ),
   Group: ({ children, justify, gap, wrap }) => (
-    <div data-testid="group" data-justify={justify} data-gap={gap} data-wrap={wrap}>
+    <div
+      data-testid="group"
+      data-justify={justify}
+      data-gap={gap}
+      data-wrap={wrap}
+    >
       {children}
     </div>
   ),
   Image: ({ src, alt, height, fallbackSrc, fit }) => (
-    <img src={src} alt={alt} data-height={height} data-fallback={fallbackSrc} data-fit={fit} />
+    <img
+      src={src}
+      alt={alt}
+      data-height={height}
+      data-fallback={fallbackSrc}
+      data-fit={fit}
+    />
   ),
   Stack: ({ children, spacing, gap, p }) => (
     <div data-testid="stack" data-spacing={spacing} data-gap={gap} data-p={p}>
@@ -68,6 +91,7 @@ vi.mock('@mantine/core', () => ({
 
 // ── lucide-react ──────────────────────────────────────────────────────────────
 vi.mock('lucide-react', () => ({
+  ListOrdered: () => <svg data-testid="icon-list-ordered" />,
   Calendar: () => <svg data-testid="icon-calendar" />,
   Clock: () => <svg data-testid="icon-clock" />,
   Play: () => <svg data-testid="icon-play" />,
@@ -75,7 +99,10 @@ vi.mock('lucide-react', () => ({
 }));
 
 // ── Imports after mocks ───────────────────────────────────────────────────────
-import { formatDuration, getSeasonLabel } from '../../../utils/cards/VODCardUtils.js';
+import {
+  formatDuration,
+  getSeasonLabel,
+} from '../../../utils/cards/VODCardUtils.js';
 import VODCard from '../VODCard';
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
@@ -113,7 +140,9 @@ const makeEpisode = (overrides = {}) => ({
 describe('VODCard', () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    vi.mocked(formatDuration).mockImplementation((mins) => (mins ? `${mins}m` : null));
+    vi.mocked(formatDuration).mockImplementation((mins) =>
+      mins ? `${mins}m` : null
+    );
     vi.mocked(getSeasonLabel).mockReturnValue('S01E02');
   });
 
@@ -193,7 +222,9 @@ describe('VODCard', () => {
 
     it('renders the season label via getSeasonLabel', () => {
       render(<VODCard vod={makeEpisode()} onClick={vi.fn()} />);
-      expect(getSeasonLabel).toHaveBeenCalledWith(expect.objectContaining({ type: 'episode' }));
+      expect(getSeasonLabel).toHaveBeenCalledWith(
+        expect.objectContaining({ type: 'episode' })
+      );
       expect(screen.getByText(/S01E02/)).toBeInTheDocument();
     });
 
@@ -230,7 +261,9 @@ describe('VODCard', () => {
     });
 
     it('does not render an img tag when logo.url is empty string', () => {
-      render(<VODCard vod={makeMovie({ logo: { url: '' } })} onClick={vi.fn()} />);
+      render(
+        <VODCard vod={makeMovie({ logo: { url: '' } })} onClick={vi.fn()} />
+      );
       expect(screen.queryByRole('img')).not.toBeInTheDocument();
     });
   });
@@ -257,8 +290,9 @@ describe('VODCard', () => {
     it('does not render genre when absent', () => {
       render(<VODCard vod={makeMovie({ genre: null })} onClick={vi.fn()} />);
       const badges = screen.queryAllByTestId('badge');
-      const dimmedBadges = badges.filter((badge) =>
-        badge.getAttribute('data-color') === 'dimmed');
+      const dimmedBadges = badges.filter(
+        (badge) => badge.getAttribute('data-color') === 'dimmed'
+      );
       expect(dimmedBadges.length).toBe(0);
     });
   });
@@ -291,4 +325,4 @@ describe('VODCard', () => {
       expect(onClick).toHaveBeenCalledWith(vod);
     });
   });
-});
\ No newline at end of file
+});
diff --git a/frontend/src/components/cards/__tests__/VodConnectionCard.test.jsx b/frontend/src/components/cards/__tests__/VodConnectionCard.test.jsx
index 2cd35670..6deeae78 100644
--- a/frontend/src/components/cards/__tests__/VodConnectionCard.test.jsx
+++ b/frontend/src/components/cards/__tests__/VodConnectionCard.test.jsx
@@ -13,7 +13,11 @@ vi.mock('../../../utils/dateTimeUtils.js', () => ({
 vi.mock('../../../utils/cards/VodConnectionCardUtils.js', () => ({
   calculateConnectionDuration: vi.fn(() => '5m 30s'),
   calculateConnectionStartTime: vi.fn(() => 'Jan 1 2024 10:00 AM'),
-  calculateProgress: vi.fn(() => ({ totalTime: 0, currentTime: 0, percentage: 0 })),
+  calculateProgress: vi.fn(() => ({
+    totalTime: 0,
+    currentTime: 0,
+    percentage: 0,
+  })),
   formatDuration: vi.fn((secs) => (secs ? `${secs}s` : null)),
   formatTime: vi.fn((secs) => `${secs}s`),
   getEpisodeDisplayTitle: vi.fn(() => 'S01E02 — Pilot'),
@@ -28,42 +32,82 @@ vi.mock('../../../images/logo.png', () => ({ default: 'default-logo.png' }));
 // ── Mantine core ──────────────────────────────────────────────────────────────
 vi.mock('@mantine/core', () => ({
   ActionIcon: ({ children, onClick, color, variant }) => (
-    <button data-testid="action-icon" data-color={color} data-variant={variant} onClick={onClick}>
+    <button
+      data-testid="action-icon"
+      data-color={color}
+      data-variant={variant}
+      onClick={onClick}
+    >
       {children}
     </button>
   ),
   Badge: ({ children, color, variant, size }) => (
-    <span data-testid="badge" data-color={color} data-variant={variant} data-size={size}>
+    <span
+      data-testid="badge"
+      data-color={color}
+      data-variant={variant}
+      data-size={size}
+    >
       {children}
     </span>
   ),
-  Box: ({ children, style }) => <div data-testid="box" style={style}>{children}</div>,
-  Card: ({ children, shadow, style }) => (   // remove padding, radius, withBorder
+  Box: ({ children, style }) => (
+    <div data-testid="box" style={style}>
+      {children}
+    </div>
+  ),
+  Card: (
+    { children, shadow, style } // remove padding, radius, withBorder
+  ) => (
     <div data-testid="vod-connection-card" data-shadow={shadow} style={style}>
       {children}
     </div>
   ),
   Center: ({ children }) => <div data-testid="center">{children}</div>,
-  Flex: ({ children, justify }) => (         // remove align
-    <div data-testid="flex" data-justify={justify}>{children}</div>
+  Flex: (
+    { children, justify } // remove align
+  ) => (
+    <div data-testid="flex" data-justify={justify}>
+      {children}
+    </div>
   ),
-  Group: ({ children, justify, onClick, style }) => (  // remove gap, align, p
-    <div data-testid="group" data-justify={justify} onClick={onClick} style={style}>
+  Group: (
+    { children, justify, onClick, style } // remove gap, align, p
+  ) => (
+    <div
+      data-testid="group"
+      data-justify={justify}
+      onClick={onClick}
+      style={style}
+    >
       {children}
     </div>
   ),
   Progress: ({ value, size, color }) => (
-    <div data-testid="progress" data-value={value} data-size={size} data-color={color} />
+    <div
+      data-testid="progress"
+      data-value={value}
+      data-size={size}
+      data-color={color}
+    />
   ),
   Stack: ({ children, gap, pos, mt }) => (
     <div data-testid="stack" data-gap={gap} data-pos={pos} data-mt={mt}>
       {children}
     </div>
   ),
-  Text: ({ children, size, c, fw, color }) => (  // remove ff, ta
-    <span data-testid="text" data-size={size} data-c={c} data-fw={fw} data-color={color}>
-    {children}
-  </span>
+  Text: (
+    { children, size, c, fw, color } // remove ff, ta
+  ) => (
+    <span
+      data-testid="text"
+      data-size={size}
+      data-c={c}
+      data-fw={fw}
+      data-color={color}
+    >
+      {children}
+    </span>
   ),
   Tooltip: ({ children, label }) => (
     <div data-testid="tooltip" data-label={label}>
@@ -74,6 +118,7 @@ vi.mock('@mantine/core', () => ({
 
 // ── lucide-react ──────────────────────────────────────────────────────────────
 vi.mock('lucide-react', () => ({
+  ListOrdered: () => <svg data-testid="icon-list-ordered" />,
   ChevronDown: ({ size, style }) => (
     <svg data-testid="icon-chevron-down" data-size={size} style={style} />
   ),
@@ -100,12 +145,13 @@ import VodConnectionCard from '../VodConnectionCard';
 
 const makeConnection = (overrides = {}) => ({
   client_ip: '192.168.1.100',
-  client_id: 'client-abc-123',          // needed for stopVODClient
+  client_id: 'client-abc-123', // needed for stopVODClient
   user_agent: 'Plex/1.0',
   connected_at: '2024-01-01T10:00:00Z',
   duration: 330,
   bytes_sent: 1048576,
-  m3u_profile: {                         // M3U profile lives on connection
+  m3u_profile: {
+    // M3U profile lives on connection
     account_name: 'Main Account',
     profile_name: 'Main M3U',
   },
@@ -161,14 +207,22 @@ describe('VodConnectionCard', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     vi.useFakeTimers();
-    vi.mocked(useDateTimeFormat).mockReturnValue({ fullDateTimeFormat: 'MM/DD/YYYY h:mm A' });
-    vi.mocked(calculateProgress).mockReturnValue({ totalTime: 0, currentTime: 0, percentage: 0 });
+    vi.mocked(useDateTimeFormat).mockReturnValue({
+      fullDateTimeFormat: 'MM/DD/YYYY h:mm A',
+    });
+    vi.mocked(calculateProgress).mockReturnValue({
+      totalTime: 0,
+      currentTime: 0,
+      percentage: 0,
+    });
     vi.mocked(getMovieDisplayTitle).mockReturnValue('Test Movie (2022)');
     vi.mocked(getMovieSubtitle).mockReturnValue(['120m', 'Action']);
     vi.mocked(getEpisodeDisplayTitle).mockReturnValue('S01E02 — Pilot');
     vi.mocked(getEpisodeSubtitle).mockReturnValue(['Test Series', 'Season 1']);
     vi.mocked(calculateConnectionDuration).mockReturnValue('5m 30s');
-    vi.mocked(calculateConnectionStartTime).mockReturnValue('Jan 1 2024 10:00 AM');
+    vi.mocked(calculateConnectionStartTime).mockReturnValue(
+      'Jan 1 2024 10:00 AM'
+    );
   });
 
   afterEach(() => {
@@ -179,39 +233,69 @@ describe('VodConnectionCard', () => {
 
   describe('rendering', () => {
     it('renders the card element', () => {
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.getByTestId('vod-connection-card')).toBeInTheDocument();
     });
 
     it('renders the poster image when logo_url is present', () => {
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
-      expect(screen.getByRole('img')).toHaveAttribute('src', 'http://example.com/poster.jpg');
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
+      expect(screen.getByRole('img')).toHaveAttribute(
+        'src',
+        'http://example.com/poster.jpg'
+      );
     });
 
     it('renders the default logo when logo_url is absent', () => {
       render(
         <VodConnectionCard
-          vodContent={makeMovieContent({ content_metadata: { logo_url: null } })}
+          vodContent={makeMovieContent({
+            content_metadata: { logo_url: null },
+          })}
           stopVODClient={vi.fn()}
         />
       );
-      expect(screen.getByRole('img')).toHaveAttribute('src', 'default-logo.png');
+      expect(screen.getByRole('img')).toHaveAttribute(
+        'src',
+        'default-logo.png'
+      );
     });
 
     it('renders the stop client button', () => {
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.getByTestId('icon-square-x')).toBeInTheDocument();
     });
 
     it('renders the client IP in the connection section', () => {
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.getByText('192.168.1.100')).toBeInTheDocument();
     });
 
     it('renders "Unknown IP" when client_ip is absent', () => {
       render(
         <VodConnectionCard
-          vodContent={makeMovieContent({ individual_connection: makeConnection({ client_ip: null }) })}
+          vodContent={makeMovieContent({
+            individual_connection: makeConnection({ client_ip: null }),
+          })}
           stopVODClient={vi.fn()}
         />
       );
@@ -219,14 +303,22 @@ describe('VodConnectionCard', () => {
     });
 
     it('renders "Hide Details" / "Show Details" toggle text', () => {
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.getByText('Show Details')).toBeInTheDocument();
     });
 
     it('does not render client section when no connection is present', () => {
       render(
         <VodConnectionCard
-          vodContent={makeMovieContent({ individual_connection: null, connections: null })}
+          vodContent={makeMovieContent({
+            individual_connection: null,
+            connections: null,
+          })}
           stopVODClient={vi.fn()}
         />
       );
@@ -239,29 +331,50 @@ describe('VodConnectionCard', () => {
   describe('movie content', () => {
     it('calls getMovieDisplayTitle with vodContent', () => {
       const vodContent = makeMovieContent();
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
       expect(getMovieDisplayTitle).toHaveBeenCalledWith(vodContent);
     });
 
     it('renders the movie display title', () => {
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.getByText('Test Movie (2022)')).toBeInTheDocument();
     });
 
     it('calls getMovieSubtitle with metadata', () => {
       const vodContent = makeMovieContent();
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
-      expect(getMovieSubtitle).toHaveBeenCalledWith(vodContent.content_metadata);
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
+      expect(getMovieSubtitle).toHaveBeenCalledWith(
+        vodContent.content_metadata
+      );
     });
 
     it('renders the movie subtitle parts', () => {
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.getByText(/120m/)).toBeInTheDocument();
       expect(screen.getByText(/Action/)).toBeInTheDocument();
     });
 
     it('does not call getEpisodeDisplayTitle for a movie', () => {
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(getEpisodeDisplayTitle).not.toHaveBeenCalled();
     });
   });
@@ -271,29 +384,52 @@ describe('VodConnectionCard', () => {
   describe('episode content', () => {
     it('calls getEpisodeDisplayTitle with vodContent', () => {
       const vodContent = makeEpisodeContent();
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
-      expect(getEpisodeDisplayTitle).toHaveBeenCalledWith(vodContent.content_metadata);
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
+      expect(getEpisodeDisplayTitle).toHaveBeenCalledWith(
+        vodContent.content_metadata
+      );
     });
 
     it('renders the episode display title', () => {
-      render(<VodConnectionCard vodContent={makeEpisodeContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeEpisodeContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.getByText('S01E02 — Pilot')).toBeInTheDocument();
     });
 
     it('calls getEpisodeSubtitle with metadata', () => {
       const vodContent = makeEpisodeContent();
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
-      expect(getEpisodeSubtitle).toHaveBeenCalledWith(vodContent.content_metadata);
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
+      expect(getEpisodeSubtitle).toHaveBeenCalledWith(
+        vodContent.content_metadata
+      );
     });
 
     it('renders the episode subtitle parts', () => {
-      render(<VodConnectionCard vodContent={makeEpisodeContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeEpisodeContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.getByText(/Test Series/)).toBeInTheDocument();
       expect(screen.getByText(/Season 1/)).toBeInTheDocument();
     });
 
     it('does not call getMovieDisplayTitle for an episode', () => {
-      render(<VodConnectionCard vodContent={makeEpisodeContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeEpisodeContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(getMovieDisplayTitle).not.toHaveBeenCalled();
     });
   });
@@ -302,12 +438,22 @@ describe('VodConnectionCard', () => {
 
   describe('unknown content type', () => {
     it('renders content_name as fallback title', () => {
-      render(<VodConnectionCard vodContent={makeUnknownContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeUnknownContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.getByText('Some Stream')).toBeInTheDocument();
     });
 
     it('does not call getMovieDisplayTitle or getEpisodeDisplayTitle', () => {
-      render(<VodConnectionCard vodContent={makeUnknownContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeUnknownContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(getMovieDisplayTitle).not.toHaveBeenCalled();
       expect(getEpisodeDisplayTitle).not.toHaveBeenCalled();
     });
@@ -315,7 +461,12 @@ describe('VodConnectionCard', () => {
     it('renders no subtitle when subtitle parts are empty', () => {
       vi.mocked(getMovieSubtitle).mockReturnValue([]);
       vi.mocked(getEpisodeSubtitle).mockReturnValue([]);
-      render(<VodConnectionCard vodContent={makeUnknownContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeUnknownContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       // No " • " separator rendered for empty subtitle
       expect(screen.queryByText(' • ')).not.toBeInTheDocument();
     });
@@ -326,7 +477,9 @@ describe('VodConnectionCard', () => {
   describe('connection source fallback', () => {
     it('uses individual_connection when present', () => {
       const vodContent = makeMovieContent();
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
       expect(screen.getByText('192.168.1.100')).toBeInTheDocument();
     });
 
@@ -336,7 +489,9 @@ describe('VodConnectionCard', () => {
         individual_connection: null,
         connections: [connection],
       });
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
       expect(screen.getByText('10.0.0.1')).toBeInTheDocument();
     });
   });
@@ -345,7 +500,12 @@ describe('VodConnectionCard', () => {
 
   describe('M3U profile', () => {
     it('renders M3U profile name when present', () => {
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.getByText('Main M3U')).toBeInTheDocument();
     });
 
@@ -353,7 +513,9 @@ describe('VodConnectionCard', () => {
       const vodContent = makeMovieContent({
         individual_connection: makeConnection({ m3u_profile: null }),
       });
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
       expect(screen.queryByText('Main M3U')).not.toBeInTheDocument();
     });
   });
@@ -364,14 +526,24 @@ describe('VodConnectionCard', () => {
     it('calls stopVODClient with the connection when stop button is clicked', () => {
       const stopVODClient = vi.fn();
       const vodContent = makeMovieContent();
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={stopVODClient} />);
+      render(
+        <VodConnectionCard
+          vodContent={vodContent}
+          stopVODClient={stopVODClient}
+        />
+      );
       fireEvent.click(screen.getByTestId('icon-square-x').closest('button'));
       expect(stopVODClient).toHaveBeenCalledWith('client-abc-123');
     });
 
     it('calls stopVODClient once per click', () => {
       const stopVODClient = vi.fn();
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={stopVODClient} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={stopVODClient}
+        />
+      );
       fireEvent.click(screen.getByTestId('icon-square-x').closest('button'));
       fireEvent.click(screen.getByTestId('icon-square-x').closest('button'));
       expect(stopVODClient).toHaveBeenCalledTimes(2);
@@ -382,30 +554,58 @@ describe('VodConnectionCard', () => {
 
   describe('client expand/collapse', () => {
     it('starts collapsed (Show Details visible)', () => {
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.getByText('Show Details')).toBeInTheDocument();
       expect(screen.queryByText('Hide Details')).not.toBeInTheDocument();
     });
 
     it('expands to show client details on header click', () => {
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
-      const header = screen.getByText('Show Details').closest('[data-testid="group"]');
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
+      const header = screen
+        .getByText('Show Details')
+        .closest('[data-testid="group"]');
       fireEvent.click(header);
       expect(screen.getByText('Hide Details')).toBeInTheDocument();
     });
 
     it('shows user agent in expanded details', () => {
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
-      const header = screen.getByText('Show Details').closest('[data-testid="group"]');
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
+      const header = screen
+        .getByText('Show Details')
+        .closest('[data-testid="group"]');
       fireEvent.click(header);
       expect(screen.getByText('Plex/1.0')).toBeInTheDocument();
     });
 
     it('collapses back when header is clicked again', () => {
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
-      const header = screen.getByText('Show Details').closest('[data-testid="group"]');
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
+      const header = screen
+        .getByText('Show Details')
+        .closest('[data-testid="group"]');
       fireEvent.click(header);
-      fireEvent.click(screen.getByText('Hide Details').closest('[data-testid="group"]'));
+      fireEvent.click(
+        screen.getByText('Hide Details').closest('[data-testid="group"]')
+      );
       expect(screen.getByText('Show Details')).toBeInTheDocument();
     });
 
@@ -413,8 +613,12 @@ describe('VodConnectionCard', () => {
       const vodContent = makeMovieContent({
         individual_connection: makeConnection({ user_agent: 'Unknown' }),
       });
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
-      const header = screen.getByText('Show Details').closest('[data-testid="group"]');
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
+      const header = screen
+        .getByText('Show Details')
+        .closest('[data-testid="group"]');
       fireEvent.click(header);
       expect(screen.queryByText('Unknown')).not.toBeInTheDocument();
     });
@@ -423,8 +627,12 @@ describe('VodConnectionCard', () => {
       const vodContent = makeMovieContent({
         individual_connection: makeConnection({ user_agent: null }),
       });
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
-      const header = screen.getByText('Show Details').closest('[data-testid="group"]');
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
+      const header = screen
+        .getByText('Show Details')
+        .closest('[data-testid="group"]');
       fireEvent.click(header);
       // "Plex/1.0" should not appear
       expect(screen.queryByText('Plex/1.0')).not.toBeInTheDocument();
@@ -434,8 +642,12 @@ describe('VodConnectionCard', () => {
       const vodContent = makeMovieContent({
         individual_connection: makeConnection({ bytes_sent: 0 }),
       });
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
-      const header = screen.getByText('Show Details').closest('[data-testid="group"]');
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
+      const header = screen
+        .getByText('Show Details')
+        .closest('[data-testid="group"]');
       fireEvent.click(header);
       expect(screen.queryByText('Data Sent:')).not.toBeInTheDocument();
     });
@@ -444,8 +656,12 @@ describe('VodConnectionCard', () => {
       const vodContent = makeMovieContent({
         individual_connection: makeConnection({ duration: 0 }),
       });
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
-      const header = screen.getByText('Show Details').closest('[data-testid="group"]');
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
+      const header = screen
+        .getByText('Show Details')
+        .closest('[data-testid="group"]');
       fireEvent.click(header);
       expect(screen.queryByText('Watch Duration:')).not.toBeInTheDocument();
     });
@@ -455,26 +671,58 @@ describe('VodConnectionCard', () => {
 
   describe('ConnectionProgress', () => {
     it('does not render progress bar when totalTime is 0', () => {
-      vi.mocked(calculateProgress).mockReturnValue({ totalTime: 0, currentTime: 0, percentage: 0 });
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
+      vi.mocked(calculateProgress).mockReturnValue({
+        totalTime: 0,
+        currentTime: 0,
+        percentage: 0,
+      });
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.queryByTestId('progress')).not.toBeInTheDocument();
     });
 
     it('renders progress bar when totalTime > 0', () => {
-      vi.mocked(calculateProgress).mockReturnValue({ totalTime: 7200, currentTime: 3600, percentage: 50 });
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
+      vi.mocked(calculateProgress).mockReturnValue({
+        totalTime: 7200,
+        currentTime: 3600,
+        percentage: 50,
+      });
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.getByTestId('progress')).toBeInTheDocument();
     });
 
     it('passes correct percentage value to Progress component', () => {
-      vi.mocked(calculateProgress).mockReturnValue({ totalTime: 7200, currentTime: 3600, percentage: 50 });
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
-      expect(screen.getByTestId('progress')).toHaveAttribute('data-value', '50');
+      vi.mocked(calculateProgress).mockReturnValue({
+        totalTime: 7200,
+        currentTime: 3600,
+        percentage: 50,
+      });
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
+      expect(screen.getByTestId('progress')).toHaveAttribute(
+        'data-value',
+        '50'
+      );
     });
 
     it('calls calculateProgress with connection and duration_secs', () => {
       const vodContent = makeMovieContent();
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
       expect(calculateProgress).toHaveBeenCalledWith(
         vodContent.individual_connection,
         vodContent.content_metadata.duration_secs
@@ -484,7 +732,10 @@ describe('VodConnectionCard', () => {
     it('does not render ConnectionProgress when no connection', () => {
       render(
         <VodConnectionCard
-          vodContent={makeMovieContent({ individual_connection: null, connections: null })}
+          vodContent={makeMovieContent({
+            individual_connection: null,
+            connections: null,
+          })}
           stopVODClient={vi.fn()}
         />
       );
@@ -496,11 +747,22 @@ describe('VodConnectionCard', () => {
 
   describe('progress update timer', () => {
     it('sets up a 1-second interval to trigger re-renders', () => {
-      vi.mocked(calculateProgress).mockReturnValue({ totalTime: 7200, currentTime: 0, percentage: 0 });
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
+      vi.mocked(calculateProgress).mockReturnValue({
+        totalTime: 7200,
+        currentTime: 0,
+        percentage: 0,
+      });
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
 
       const callsBefore = vi.mocked(calculateProgress).mock.calls.length;
-      act(() => { vi.advanceTimersByTime(1000); });
+      act(() => {
+        vi.advanceTimersByTime(1000);
+      });
       const callsAfter = vi.mocked(calculateProgress).mock.calls.length;
 
       expect(callsAfter).toBeGreaterThan(callsBefore);
@@ -509,7 +771,10 @@ describe('VodConnectionCard', () => {
     it('clears the interval on unmount', () => {
       const clearIntervalSpy = vi.spyOn(globalThis, 'clearInterval');
       const { unmount } = render(
-        <VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
       );
       unmount();
       expect(clearIntervalSpy).toHaveBeenCalled();
@@ -521,23 +786,34 @@ describe('VodConnectionCard', () => {
   describe('connection duration and start time', () => {
     it('calls calculateConnectionDuration with the connection', () => {
       const vodContent = makeMovieContent();
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
-      expect(calculateConnectionDuration).toHaveBeenCalledWith(vodContent.individual_connection);
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
+      expect(calculateConnectionDuration).toHaveBeenCalledWith(
+        vodContent.individual_connection
+      );
     });
 
     it('renders the duration returned by calculateConnectionDuration', () => {
       vi.mocked(calculateConnectionDuration).mockReturnValue('12m 45s');
-      render(<VodConnectionCard vodContent={makeMovieContent()} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard
+          vodContent={makeMovieContent()}
+          stopVODClient={vi.fn()}
+        />
+      );
       expect(screen.getByText('12m 45s')).toBeInTheDocument();
     });
 
     it('calls calculateConnectionStartTime with connection and fullDateTimeFormat', () => {
       const vodContent = makeMovieContent();
-      render(<VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />);
+      render(
+        <VodConnectionCard vodContent={vodContent} stopVODClient={vi.fn()} />
+      );
       expect(calculateConnectionStartTime).toHaveBeenCalledWith(
         vodContent.individual_connection,
         'MM/DD/YYYY h:mm A'
       );
     });
   });
-});
\ No newline at end of file
+});

From 17b8e6587f40b5ab503b10117894791b96901085 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sat, 28 Mar 2026 15:49:35 -0500
Subject: [PATCH 51/67] changelog: Move issue to correct location and formatted
 them for auto-closing.

---
 CHANGELOG.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c15fc6c3..6e5cc040 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,8 +19,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Connection cards on the Stats page now show the **username** of the connected user in a new User column (between IP Address and Connected). The username is resolved from the user store using the `user_id` stored in Redis client metadata; unauthenticated connections display "Anonymous". (Closes #766)
-- `ip_address` and `user_id` were not included in the client info returned by `get_detailed_channel_info()` despite being available in the Redis hash. Both fields are now extracted and returned. (Closes #586)
+- Connection cards on the Stats page now show the **username** of the connected user in a new User column (between IP Address and Connected). The username is resolved from the user store using the `user_id` stored in Redis client metadata; unauthenticated connections display "Anonymous". (Closes #766, Closes #586)
+- `ip_address` and `user_id` were not included in the client info returned by `get_detailed_channel_info()` despite being available in the Redis hash. Both fields are now extracted and returned.
 - Donate button added to the sidebar footer. A heart icon links to the project's Open Collective page, visible in both expanded and collapsed states. Hovering shows a "Support Dispatcharr" tooltip. The version string is also now clickable to copy it to the clipboard.
 - User stream limits: administrators can now set a maximum number of concurrent streams per user account. When a user reaches their limit, the system can automatically terminate an existing stream to free a slot based on configurable rules. Limit enforcement applies to both live channels and VOD. (Closes #544)
   - Each user account has a new **Stream Limit** field (0 = unlimited) configurable from the user edit form in Settings → Users.

From 30246a4d491416d650f546288dbc3e3ef3acfb4e Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sat, 28 Mar 2026 16:28:47 -0500
Subject: [PATCH 52/67] changelog: Add change for VOD XC endpoint.

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6e5cc040..e8cab3a7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -34,6 +34,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- XtreamCodes VOD endpoints (`/movie/` and `/series/`) no longer redirect clients to a UUID-based proxy URL. Requests are now handled directly in the proxy layer via `stream_xc_movie` and `stream_xc_episode`, which call `stream_vod()` internally. The original XC path is preserved for the client throughout the stream.
 - `CustomTable` column layout now supports flexible (`grow`) columns alongside fixed-width ones:
   - Column definitions accept a `grow` property (boolean or number) to opt into flex layout. A numeric value sets the flex-grow weight, allowing relative sizing between grow columns (e.g. `grow: 2` gives a column twice the share of spare space as `grow: 1`).
   - `maxSize` is now respected on grow columns, capping how wide they expand via `maxWidth`.

From 38f5156ca690db20bd361858323b7454f8a11333 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sat, 28 Mar 2026 16:46:06 -0500
Subject: [PATCH 53/67] Enhancement: Show username in VOD cards.

---
 CHANGELOG.md                                  |  4 +--
 apps/proxy/vod_proxy/views.py                 |  1 +
 .../components/cards/VodConnectionCard.jsx    | 33 +++++++++++++++----
 3 files changed, 30 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e8cab3a7..31693df0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,8 +19,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Connection cards on the Stats page now show the **username** of the connected user in a new User column (between IP Address and Connected). The username is resolved from the user store using the `user_id` stored in Redis client metadata; unauthenticated connections display "Anonymous". (Closes #766, Closes #586)
-- `ip_address` and `user_id` were not included in the client info returned by `get_detailed_channel_info()` despite being available in the Redis hash. Both fields are now extracted and returned.
+- Connection cards on the Stats page now show the **username** of the connected user. For live channel connections a new User column appears between IP Address and Connected; for VOD connections the username is shown inline next to the IP address in the Client summary row. The username is resolved from the user store using the `user_id` stored in Redis client metadata. (Closes #766, Closes #586)
+- `ip_address` and `user_id` were not included in the client info returned by `get_detailed_channel_info()` despite being available in the Redis hash. Both fields are now extracted and returned. `user_id` is now also included in the VOD stats response.
 - Donate button added to the sidebar footer. A heart icon links to the project's Open Collective page, visible in both expanded and collapsed states. Hovering shows a "Support Dispatcharr" tooltip. The version string is also now clickable to copy it to the clipboard.
 - User stream limits: administrators can now set a maximum number of concurrent streams per user account. When a user reaches their limit, the system can automatically terminate an existing stream to free a slot based on configurable rules. Limit enforcement applies to both live channels and VOD. (Closes #544)
   - Each user account has a new **Stream Limit** field (0 = unlimited) configurable from the user edit form in Settings → Users.
diff --git a/apps/proxy/vod_proxy/views.py b/apps/proxy/vod_proxy/views.py
index d7250bcf..4382caaa 100644
--- a/apps/proxy/vod_proxy/views.py
+++ b/apps/proxy/vod_proxy/views.py
@@ -949,6 +949,7 @@ class VODStatsView(View):
                                 'm3u_profile': m3u_profile_info,
                                 'client_id': client_id,
                                 'client_ip': combined_data.get('client_ip', 'Unknown'),
+                                'user_id': combined_data.get('user_id', '0'),
                                 'user_agent': combined_data.get('client_user_agent', 'Unknown'),
                                 'connected_at': combined_data.get('created_at'),
                                 'last_activity': combined_data.get('last_activity'),
diff --git a/frontend/src/components/cards/VodConnectionCard.jsx b/frontend/src/components/cards/VodConnectionCard.jsx
index 5e081c03..90b4c034 100644
--- a/frontend/src/components/cards/VodConnectionCard.jsx
+++ b/frontend/src/components/cards/VodConnectionCard.jsx
@@ -1,5 +1,5 @@
 // Format duration for content length
-import React, { useCallback, useEffect, useState } from 'react';
+import React, { useCallback, useEffect, useMemo, useState } from 'react';
 import logo from '../../images/logo.png';
 import {
   ActionIcon,
@@ -38,6 +38,7 @@ import {
   getMovieDisplayTitle,
   getMovieSubtitle,
 } from '../../utils/cards/VodConnectionCardUtils.js';
+import useUsersStore from '../../store/users.jsx';
 
 const ClientDetails = ({ connection, connectionStartTime }) => {
   return (
@@ -142,7 +143,10 @@ const ClientDetails = ({ connection, connectionStartTime }) => {
 };
 
 const ConnectionProgress = ({ connection, durationSecs }) => {
-  const { totalTime, currentTime, percentage } = calculateProgress(connection, durationSecs);
+  const { totalTime, currentTime, percentage } = calculateProgress(
+    connection,
+    durationSecs
+  );
   return totalTime > 0 ? (
     <Stack gap="xs" mt="sm">
       <Group justify="space-between" align="center">
@@ -172,6 +176,14 @@ const ConnectionProgress = ({ connection, durationSecs }) => {
 const VodConnectionCard = ({ vodContent, stopVODClient }) => {
   const { fullDateTimeFormat } = useDateTimeFormat();
   const [isClientExpanded, setIsClientExpanded] = useState(false);
+  const users = useUsersStore((s) => s.users);
+  const usersMap = useMemo(() => {
+    const map = {};
+    users.forEach((u) => {
+      map[String(u.id)] = u.username;
+    });
+    return map;
+  }, [users]);
   const [, setUpdateTrigger] = useState(0); // Force re-renders for progress updates
 
   // Get metadata from the VOD content
@@ -377,13 +389,12 @@ const VodConnectionCard = ({ vodContent, stopVODClient }) => {
         </Group>
 
         {/* Progress bar - show current position in content */}
-        {connection &&
-          metadata.duration_secs &&
+        {connection && metadata.duration_secs && (
           <ConnectionProgress
             connection={connection}
             durationSecs={metadata.duration_secs}
           />
-        }
+        )}
 
         {/* Client information section - collapsible like channel cards */}
         {connection && (
@@ -403,11 +414,21 @@ const VodConnectionCard = ({ vodContent, stopVODClient }) => {
             >
               <Group gap={8}>
                 <Text size="sm" fw={500} color="dimmed">
-                  Client:
+                  Client IP:
                 </Text>
                 <Text size="sm" ff={'monospace'}>
                   {connection.client_ip || 'Unknown IP'}
                 </Text>
+                {usersMap[String(connection.user_id)] && (
+                  <>
+                    <Text size="sm" c="dimmed">
+                      User:
+                    </Text>
+                    <Text size="sm">
+                      {usersMap[String(connection.user_id)]}
+                    </Text>
+                  </>
+                )}
               </Group>
 
               <Group gap={8}>

From 3cb0925357323d79fd74ec29bd33697246ee389b Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sat, 28 Mar 2026 17:04:57 -0500
Subject: [PATCH 54/67] tests: Add user store mock and additional icons for
 VodConnectionCard tests

---
 .../__tests__/VodConnectionCard.test.jsx      | 21 ++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/frontend/src/components/cards/__tests__/VodConnectionCard.test.jsx b/frontend/src/components/cards/__tests__/VodConnectionCard.test.jsx
index 6deeae78..7b0014e7 100644
--- a/frontend/src/components/cards/__tests__/VodConnectionCard.test.jsx
+++ b/frontend/src/components/cards/__tests__/VodConnectionCard.test.jsx
@@ -116,16 +116,35 @@ vi.mock('@mantine/core', () => ({
   ),
 }));
 
+// ── useUsersStore ─────────────────────────────────────────────────────────────
+vi.mock('../../../store/users.jsx', () => ({
+  default: vi.fn((selector) => selector({ users: [] })),
+}));
+
 // ── lucide-react ──────────────────────────────────────────────────────────────
 vi.mock('lucide-react', () => ({
+  // navigation.js icons (all must be present for the auth→navigation import chain)
   ListOrdered: () => <svg data-testid="icon-list-ordered" />,
+  Play: () => <svg data-testid="icon-play" />,
+  Database: () => <svg data-testid="icon-database" />,
+  LayoutGrid: () => <svg data-testid="icon-layout-grid" />,
+  Settings: () => <svg data-testid="icon-settings" />,
+  ChartLine: () => <svg data-testid="icon-chart-line" />,
+  Video: () => <svg data-testid="icon-video" />,
+  PlugZap: () => <svg data-testid="icon-plug-zap" />,
+  User: () => <svg data-testid="icon-user" />,
+  FileImage: () => <svg data-testid="icon-file-image" />,
+  Webhook: () => <svg data-testid="icon-webhook" />,
+  Logs: () => <svg data-testid="icon-logs" />,
+  Blocks: () => <svg data-testid="icon-blocks" />,
+  MonitorCog: () => <svg data-testid="icon-monitor-cog" />,
+  // VodConnectionCard-specific icons
   ChevronDown: ({ size, style }) => (
     <svg data-testid="icon-chevron-down" data-size={size} style={style} />
   ),
   HardDriveUpload: () => <svg data-testid="icon-hdd-upload" />,
   SquareX: () => <svg data-testid="icon-square-x" />,
   Timer: () => <svg data-testid="icon-timer" />,
-  Video: () => <svg data-testid="icon-video" />,
 }));
 
 // ── Imports after mocks ───────────────────────────────────────────────────────

From f00d1fe63cf4de38a35f922c4075c4821ff84316 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sat, 28 Mar 2026 18:04:11 -0500
Subject: [PATCH 55/67] =?UTF-8?q?Bug=20Fix/Enhancement:=20-=20Web=20UI=20s?=
 =?UTF-8?q?tream=20preview=20(`FloatingVideo`)=20was=20calling=20`mpegts.c?=
 =?UTF-8?q?reatePlayer()`=20with=20all=20`Config`=20options=20(e.g.=20`ena?=
 =?UTF-8?q?bleWorker`,=20`liveSync`,=20`headers`)=20merged=20into=20the=20?=
 =?UTF-8?q?first=20`MediaDataSource`=20argument.=20mpegts.js=20only=20read?=
 =?UTF-8?q?s=20`Config`=20from=20the=20optional=20second=20argument;=20unr?=
 =?UTF-8?q?ecognised=20fields=20in=20the=20first=20are=20silently=20ignore?=
 =?UTF-8?q?d.=20As=20a=20result=20all=20player=20configuration=20was=20eff?=
 =?UTF-8?q?ectively=20the=20library=20defaults=20=E2=80=94=20worker=20offl?=
 =?UTF-8?q?oading=20was=20disabled,=20latency=20management=20had=20no=20ef?=
 =?UTF-8?q?fect,=20and=20the=20`Authorization:=20Bearer`=20header=20(requi?=
 =?UTF-8?q?red=20for=20user=20identification)=20was=20never=20sent.=20Fixe?=
 =?UTF-8?q?d=20by=20splitting=20into=20the=20correct=20two-argument=20call?=
 =?UTF-8?q?.=20Both=20`liveBufferLatencyChasing`=20and=20`liveSync`=20have?=
 =?UTF-8?q?=20been=20disabled,=20eliminating=20playback-rate=20fluctuation?=
 =?UTF-8?q?s=20that=20caused=20audible=20stuttering=20on=20live=20streams.?=
 =?UTF-8?q?=20SourceBuffer=20cleanup=20thresholds=20were=20also=20relaxed?=
 =?UTF-8?q?=20from=2010s/5s=20to=20120s/60s=20to=20prevent=20frequent=20So?=
 =?UTF-8?q?urceBuffer=20pauses.=20-=20Web=20UI=20stream=20preview=20now=20?=
 =?UTF-8?q?sends=20an=20`Authorization:=20Bearer`=20header=20with=20each?=
 =?UTF-8?q?=20mpegts.js=20request,=20identifying=20the=20logged-in=20user.?=
 =?UTF-8?q?=20Live=20channel=20previews=20initiated=20from=20the=20web=20U?=
 =?UTF-8?q?I=20now=20appear=20on=20the=20Stats=20page=20with=20the=20corre?=
 =?UTF-8?q?ct=20username=20rather=20than=20as=20unknown=20user.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md                              |  2 ++
 apps/proxy/ts_proxy/views.py              |  3 ++
 frontend/src/components/FloatingVideo.jsx | 40 ++++++++++++++---------
 3 files changed, 30 insertions(+), 15 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 31693df0..1b2e001f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Connection cards on the Stats page now show the **username** of the connected user. For live channel connections a new User column appears between IP Address and Connected; for VOD connections the username is shown inline next to the IP address in the Client summary row. The username is resolved from the user store using the `user_id` stored in Redis client metadata. (Closes #766, Closes #586)
 - `ip_address` and `user_id` were not included in the client info returned by `get_detailed_channel_info()` despite being available in the Redis hash. Both fields are now extracted and returned. `user_id` is now also included in the VOD stats response.
+- Web UI stream preview now sends an `Authorization: Bearer` header with each mpegts.js request, identifying the logged-in user. Live channel previews initiated from the web UI now appear on the Stats page with the correct username rather than as unknown user.
 - Donate button added to the sidebar footer. A heart icon links to the project's Open Collective page, visible in both expanded and collapsed states. Hovering shows a "Support Dispatcharr" tooltip. The version string is also now clickable to copy it to the clipboard.
 - User stream limits: administrators can now set a maximum number of concurrent streams per user account. When a user reaches their limit, the system can automatically terminate an existing stream to free a slot based on configurable rules. Limit enforcement applies to both live channels and VOD. (Closes #544)
   - Each user account has a new **Stream Limit** field (0 = unlimited) configurable from the user edit form in Settings → Users.
@@ -56,6 +57,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Web UI stream preview (`FloatingVideo`) was calling `mpegts.createPlayer()` with all `Config` options (e.g. `enableWorker`, `liveSync`, `headers`) merged into the first `MediaDataSource` argument. mpegts.js only reads `Config` from the optional second argument; unrecognised fields in the first are silently ignored. As a result all player configuration was effectively the library defaults — worker offloading was disabled, latency management had no effect, and the `Authorization: Bearer` header (required for user identification) was never sent. Fixed by splitting into the correct two-argument call. Both `liveBufferLatencyChasing` and `liveSync` have been disabled, eliminating playback-rate fluctuations that caused audible stuttering on live streams. SourceBuffer cleanup thresholds were also relaxed from 10s/5s to 120s/60s to prevent frequent SourceBuffer pauses.
 - HTML named entities in XMLTV EPG files are now resolved to Unicode characters before lxml parsing. Some EPG providers (particularly French and other European sources) use HTML named entities like `&eacute;`, `&icirc;`, `&uuml;` in channel names, program titles, and metadata. These are not valid XML entities — lxml 6.0.2 with `recover=True` silently drops them, causing characters to go missing (e.g., "Chaîne Télé" becomes "Chane Tl"). A preprocessing step in `fetch_xmltv()` now resolves HTML named entities while preserving the 5 XML-predefined entities, detecting encoding from the XML declaration (falling back to UTF-8), and processing line-by-line to a temp file before atomically replacing the original. (Closes #1095) — Thanks [@CodeBormen](https://github.com/CodeBormen)
 - Duplicate recordings created when EPG sources refresh and re-evaluate series rules (Fixes #940) — Thanks [@CodeBormen](https://github.com/CodeBormen):
   - **Program ID instability**: `parse_programs_for_source()` deletes and recreates all `ProgramData` rows with new auto-increment IDs on every EPG refresh. The dedup set used these IDs, so it never matched after a refresh. Deduplication now uses a stable `(tvg_id, start_time, end_time)` composite key sourced from `Recording.custom_properties.program`.
diff --git a/apps/proxy/ts_proxy/views.py b/apps/proxy/ts_proxy/views.py
index 64f73664..c8699191 100644
--- a/apps/proxy/ts_proxy/views.py
+++ b/apps/proxy/ts_proxy/views.py
@@ -51,6 +51,9 @@ def stream_ts(request, channel_id, user=None):
         return JsonResponse({"error": "Forbidden"}, status=403)
 
     """Stream TS data to client with immediate response and keep-alive packets during initialization"""
+    if user is None and hasattr(request, 'user') and request.user.is_authenticated:
+        user = request.user
+
     channel = get_stream_object(channel_id)
 
     client_user_agent = None
diff --git a/frontend/src/components/FloatingVideo.jsx b/frontend/src/components/FloatingVideo.jsx
index 0a63e53f..ccba7934 100644
--- a/frontend/src/components/FloatingVideo.jsx
+++ b/frontend/src/components/FloatingVideo.jsx
@@ -2,6 +2,7 @@
 import React, { useCallback, useEffect, useRef, useState } from 'react';
 import Draggable from 'react-draggable';
 import useVideoStore from '../store/useVideoStore';
+import useAuthStore from '../store/auth';
 import mpegts from 'mpegts.js';
 import { CloseButton, Flex, Loader, Text, Box } from '@mantine/core';
 import {
@@ -117,6 +118,7 @@ export default function FloatingVideo() {
   const contentType = useVideoStore((s) => s.contentType);
   const metadata = useVideoStore((s) => s.metadata);
   const hideVideo = useVideoStore((s) => s.hideVideo);
+  const accessToken = useAuthStore((s) => s.accessToken);
 
   const videoRef = useRef(null);
   const playerRef = useRef(null);
@@ -300,7 +302,8 @@ export default function FloatingVideo() {
     setLoadError(null);
 
     console.log('Initializing live stream player for:', streamUrl);
-
+    console.log('Access token present:', !!accessToken);
+    console.log('Current access token from auth store:', accessToken);
     try {
       if (!mpegts.getFeatureList().mseLivePlayback) {
         setIsLoading(false);
@@ -310,20 +313,27 @@ export default function FloatingVideo() {
         return;
       }
 
-      const player = mpegts.createPlayer({
-        type: 'mpegts',
-        url: streamUrl,
-        isLive: true,
-        enableWorker: true,
-        enableStashBuffer: false,
-        liveBufferLatencyChasing: true,
-        liveSync: true,
-        cors: true,
-        autoCleanupSourceBuffer: true,
-        autoCleanupMaxBackwardDuration: 10,
-        autoCleanupMinBackwardDuration: 5,
-        reuseRedirectedURL: true,
-      });
+      const player = mpegts.createPlayer(
+        {
+          type: 'mpegts',
+          url: streamUrl,
+          isLive: true,
+          cors: true,
+        },
+        {
+          enableWorker: true,
+          enableStashBuffer: false,
+          liveBufferLatencyChasing: false,
+          liveSync: false,
+          autoCleanupSourceBuffer: true,
+          autoCleanupMaxBackwardDuration: 120,
+          autoCleanupMinBackwardDuration: 60,
+          reuseRedirectedURL: true,
+          headers: accessToken
+            ? { Authorization: `Bearer ${accessToken}` }
+            : undefined,
+        }
+      );
 
       player.attachMediaElement(videoRef.current);
 

From 1d3cd5fd75ff4568fef0080bf2a4d12351c8ea60 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sat, 28 Mar 2026 18:14:25 -0500
Subject: [PATCH 56/67] tests: Update floating video test.

---
 frontend/src/components/__tests__/FloatingVideo.test.jsx | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/frontend/src/components/__tests__/FloatingVideo.test.jsx b/frontend/src/components/__tests__/FloatingVideo.test.jsx
index 63f3ee3d..b511b60b 100644
--- a/frontend/src/components/__tests__/FloatingVideo.test.jsx
+++ b/frontend/src/components/__tests__/FloatingVideo.test.jsx
@@ -150,6 +150,10 @@ describe('FloatingVideo', () => {
           type: 'mpegts',
           url: 'http://example.com/stream.ts',
           isLive: true,
+        }),
+        expect.objectContaining({
+          enableWorker: true,
+          enableStashBuffer: false,
         })
       );
     });

From 6d06422ddd40e8581bc8f338005ce354f417ff7e Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sun, 29 Mar 2026 16:06:14 -0500
Subject: [PATCH 57/67] Enhancement: `client_connect` and `client_disconnect`
 system events now include the **username** of the connected user. The
 username is stored alongside the client metadata in Redis and included in the
 event payload for `log_system_event` calls (making it available to webhook
 and script integrations).

---
 CHANGELOG.md                            |  1 +
 apps/proxy/ts_proxy/client_manager.py   | 11 ++++++++---
 apps/proxy/ts_proxy/stream_generator.py | 14 +++++++++-----
 apps/proxy/ts_proxy/views.py            |  2 +-
 4 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1b2e001f..58e5d90d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Connection cards on the Stats page now show the **username** of the connected user. For live channel connections a new User column appears between IP Address and Connected; for VOD connections the username is shown inline next to the IP address in the Client summary row. The username is resolved from the user store using the `user_id` stored in Redis client metadata. (Closes #766, Closes #586)
 - `ip_address` and `user_id` were not included in the client info returned by `get_detailed_channel_info()` despite being available in the Redis hash. Both fields are now extracted and returned. `user_id` is now also included in the VOD stats response.
 - Web UI stream preview now sends an `Authorization: Bearer` header with each mpegts.js request, identifying the logged-in user. Live channel previews initiated from the web UI now appear on the Stats page with the correct username rather than as unknown user.
+- `client_connect` and `client_disconnect` system events now include the **username** of the connected user. The username is stored alongside the client metadata in Redis and included in the event payload for `log_system_event` calls (making it available to webhook and script integrations).
 - Donate button added to the sidebar footer. A heart icon links to the project's Open Collective page, visible in both expanded and collapsed states. Hovering shows a "Support Dispatcharr" tooltip. The version string is also now clickable to copy it to the clipboard.
 - User stream limits: administrators can now set a maximum number of concurrent streams per user account. When a user reaches their limit, the system can automatically terminate an existing stream to free a slot based on configurable rules. Limit enforcement applies to both live channels and VOD. (Closes #544)
   - Each user account has a new **Stream Limit** field (0 = unlimited) configurable from the user edit form in Settings → Users.
diff --git a/apps/proxy/ts_proxy/client_manager.py b/apps/proxy/ts_proxy/client_manager.py
index e1c92256..af7eb7d3 100644
--- a/apps/proxy/ts_proxy/client_manager.py
+++ b/apps/proxy/ts_proxy/client_manager.py
@@ -278,7 +278,8 @@ class ClientManager:
                         "channel_id": self.channel_id,
                         "client_id": client_id,
                         "worker_id": self.worker_id or "unknown",
-                        "timestamp": time.time()
+                        "timestamp": time.time(),
+                        "username": user.username if user is not None else "unknown"
                     }
 
                     if user_agent:
@@ -319,8 +320,11 @@ class ClientManager:
             self.last_active_time = time.time()
 
             if self.redis_client:
-                # Get client IP before removing the data
+                # Get client data before removing the data
                 client_key = f"ts_proxy:channel:{self.channel_id}:clients:{client_id}"
+                client_username = self.redis_client.hget(client_key, "username") or "unknown"
+                if isinstance(client_username, bytes):
+                    client_username = client_username.decode("utf-8")
 
                 # Remove from channel's client set
                 self.redis_client.srem(self.client_set_key, client_id)
@@ -361,7 +365,8 @@ class ClientManager:
                         "client_id": client_id,
                         "worker_id": self.worker_id or "unknown",
                         "timestamp": time.time(),
-                        "remaining_clients": remaining
+                        "remaining_clients": remaining,
+                        "username": client_username
                     })
                     self.redis_client.publish(RedisKeys.events_channel(self.channel_id), event_data)
 
diff --git a/apps/proxy/ts_proxy/stream_generator.py b/apps/proxy/ts_proxy/stream_generator.py
index d58e4ea2..0036be5c 100644
--- a/apps/proxy/ts_proxy/stream_generator.py
+++ b/apps/proxy/ts_proxy/stream_generator.py
@@ -25,7 +25,7 @@ class StreamGenerator:
     data delivery, and cleanup.
     """
 
-    def __init__(self, channel_id, client_id, client_ip, client_user_agent, channel_initializing=False):
+    def __init__(self, channel_id, client_id, client_ip, client_user_agent, channel_initializing=False, user=None):
         """
         Initialize the stream generator with client and channel details.
 
@@ -35,12 +35,14 @@ class StreamGenerator:
             client_ip: Client's IP address
             client_user_agent: User agent string from client
             channel_initializing: Whether the channel is still initializing
+            user: Authenticated user making the request
         """
         self.channel_id = channel_id
         self.client_id = client_id
         self.client_ip = client_ip
         self.client_user_agent = client_user_agent
         self.channel_initializing = channel_initializing
+        self.user = user
 
         # Performance and state tracking
         self.stream_start_time = time.time()
@@ -112,7 +114,8 @@ class StreamGenerator:
                     channel_name=channel_obj.name,
                     client_ip=self.client_ip,
                     client_id=self.client_id,
-                    user_agent=self.client_user_agent[:100] if self.client_user_agent else None
+                    user_agent=self.client_user_agent[:100] if self.client_user_agent else None,
+                    username=self.user.username if self.user else None
                 )
             except Exception as e:
                 logger.error(f"Could not log client connect event: {e}")
@@ -593,7 +596,8 @@ class StreamGenerator:
                     client_id=self.client_id,
                     user_agent=self.client_user_agent[:100] if self.client_user_agent else None,
                     duration=round(elapsed, 2),
-                    bytes_sent=self.bytes_sent
+                    bytes_sent=self.bytes_sent,
+                    username=self.user.username if self.user else None
                 )
             except Exception as e:
                 logger.error(f"Could not log client disconnect event: {e}")
@@ -628,10 +632,10 @@ class StreamGenerator:
 
             gevent.spawn(delayed_shutdown)
 
-def create_stream_generator(channel_id, client_id, client_ip, client_user_agent, channel_initializing=False):
+def create_stream_generator(channel_id, client_id, client_ip, client_user_agent, channel_initializing=False, user=None):
     """
     Factory function to create a new stream generator.
     Returns a function that can be passed to StreamingHttpResponse.
     """
-    generator = StreamGenerator(channel_id, client_id, client_ip, client_user_agent, channel_initializing)
+    generator = StreamGenerator(channel_id, client_id, client_ip, client_user_agent, channel_initializing, user=user)
     return generator.generate
diff --git a/apps/proxy/ts_proxy/views.py b/apps/proxy/ts_proxy/views.py
index c8699191..5750616b 100644
--- a/apps/proxy/ts_proxy/views.py
+++ b/apps/proxy/ts_proxy/views.py
@@ -532,7 +532,7 @@ def stream_ts(request, channel_id, user=None):
 
         # Create a stream generator for this client
         generate = create_stream_generator(
-            channel_id, client_id, client_ip, client_user_agent, channel_initializing
+            channel_id, client_id, client_ip, client_user_agent, channel_initializing, user=user
         )
 
         # Return the StreamingHttpResponse from the main function

From 121199de9c52e201430b7b83cba5b346acff1f30 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sun, 29 Mar 2026 16:20:04 -0500
Subject: [PATCH 58/67] refactor: remove unused playlist store imports and
 update Text component to use 'div' as the component type

---
 frontend/src/components/forms/M3UProfile.jsx | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/frontend/src/components/forms/M3UProfile.jsx b/frontend/src/components/forms/M3UProfile.jsx
index 7c24b212..b400c1e5 100644
--- a/frontend/src/components/forms/M3UProfile.jsx
+++ b/frontend/src/components/forms/M3UProfile.jsx
@@ -18,14 +18,9 @@ import {
 } from '@mantine/core';
 import { DateTimePicker } from '@mantine/dates';
 import { useWebSocket } from '../../WebSocket';
-import usePlaylistsStore from '../../store/playlists';
 
 const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
   const [websocketReady, sendMessage] = useWebSocket();
-
-  const profileSearchPreview = usePlaylistsStore((s) => s.profileSearchPreview);
-  const profileResult = usePlaylistsStore((s) => s.profileResult);
-
   const [streamUrl, setStreamUrl] = useState('');
   const [searchPattern, setSearchPattern] = useState('');
   const [replacePattern, setReplacePattern] = useState('');
@@ -339,7 +334,7 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
           <Grid gutter="xs">
             <Grid.Col span={12}>
               <Paper shadow="sm" p="xs" radius="md" withBorder>
-                <Text size="sm" weight={500} mb={3}>
+                <Text size="sm" weight={500} mb={3} component="div">
                   Matched Text{' '}
                   <Badge size="xs" color="yellow">
                     highlighted

From 2e0c136796fc66051c40589571cd48778de18e75 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sun, 29 Mar 2026 16:22:44 -0500
Subject: [PATCH 59/67] fix: update dependency in useEffect to include
 sendMessage for WebSocket handling

---
 frontend/src/components/forms/M3UProfile.jsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/src/components/forms/M3UProfile.jsx b/frontend/src/components/forms/M3UProfile.jsx
index b400c1e5..4acb4552 100644
--- a/frontend/src/components/forms/M3UProfile.jsx
+++ b/frontend/src/components/forms/M3UProfile.jsx
@@ -167,7 +167,7 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
     } catch (error) {
       console.error('Error sending WebSocket message:', error);
     }
-  }, [websocketReady, m3u, debouncedPatterns, streamUrl, sampleInput]);
+  }, [websocketReady, sendMessage, m3u, debouncedPatterns, streamUrl, sampleInput]);
 
   useEffect(() => {
     const handler = setTimeout(() => {

From 698f9ff4c02ac6d3ccd3d1eb722b8ba613e5977f Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sun, 29 Mar 2026 16:33:08 -0500
Subject: [PATCH 60/67] Enhancement: Add descriptions and placeholders to input
 fields for better user guidance

---
 frontend/src/components/forms/M3UProfile.jsx | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/frontend/src/components/forms/M3UProfile.jsx b/frontend/src/components/forms/M3UProfile.jsx
index 4acb4552..d00996d7 100644
--- a/frontend/src/components/forms/M3UProfile.jsx
+++ b/frontend/src/components/forms/M3UProfile.jsx
@@ -167,7 +167,14 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
     } catch (error) {
       console.error('Error sending WebSocket message:', error);
     }
-  }, [websocketReady, sendMessage, m3u, debouncedPatterns, streamUrl, sampleInput]);
+  }, [
+    websocketReady,
+    sendMessage,
+    m3u,
+    debouncedPatterns,
+    streamUrl,
+    sampleInput,
+  ]);
 
   useEffect(() => {
     const handler = setTimeout(() => {
@@ -237,6 +244,8 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
       <form onSubmit={handleSubmit(onSubmit)}>
         <TextInput
           label="Name"
+          description="A label to identify this URL rewrite profile"
+          placeholder="e.g. Provider A - 2nd Connection"
           {...register('name')}
           error={errors.name?.message}
         />
@@ -245,6 +254,7 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
         {!isDefaultProfile && (
           <NumberInput
             label="Max Streams"
+            description="Maximum concurrent streams allowed for this profile. Set to 0 for unlimited."
             {...register('max_streams')}
             value={watch('max_streams')}
             onChange={(value) => setValue('max_streams', value || 0)}
@@ -259,12 +269,16 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
           <>
             <TextInput
               label="Search Pattern (Regex)"
+              description="A regular expression matching the part of the stream URL you want to replace. For most users, matching just the credentials is enough."
+              placeholder="e.g. username1/password1"
               value={searchPattern}
               onChange={onSearchPatternUpdate}
               error={errors.search_pattern?.message}
             />
             <TextInput
               label="Replace Pattern"
+              description="The value to substitute in place of the matched text. Use $1, $2, etc. to reference regex capture groups."
+              placeholder="e.g. username2/password2"
               value={replacePattern}
               onChange={onReplacePatternUpdate}
               error={errors.replace_pattern?.message}

From 9579248485e32fe8609f5ca1e14ebbaf04cc7d54 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sun, 29 Mar 2026 17:04:56 -0500
Subject: [PATCH 61/67] Enhancement: M3U Profile form (XC accounts): added a
 **Simple / Advanced** mode toggle for credential-based URL rewriting. In
 Simple mode users enter just a new username and password; the search and
 replace patterns are built automatically from the account's current
 credentials. In Advanced mode the full regex fields are shown as before. The
 selected mode is saved to `custom_properties.xcMode` and auto-detected on
 existing profiles (a profile whose search pattern matches the account's
 current `username/password` is recognised as Simple automatically). The Live
 Regex Demonstration panel is hidden in Simple mode.

---
 CHANGELOG.md                                 |   1 +
 frontend/src/components/forms/M3UProfile.jsx | 169 ++++++++++++++++---
 2 files changed, 149 insertions(+), 21 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 58e5d90d..e046aa43 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -36,6 +36,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- M3U Profile form (XC accounts): added a **Simple / Advanced** mode toggle for credential-based URL rewriting. In Simple mode users enter just a new username and password; the search and replace patterns are built automatically from the account's current credentials. In Advanced mode the full regex fields are shown as before. The selected mode is saved to `custom_properties.xcMode` and auto-detected on existing profiles (a profile whose search pattern matches the account's current `username/password` is recognised as Simple automatically). The Live Regex Demonstration panel is hidden in Simple mode.
 - XtreamCodes VOD endpoints (`/movie/` and `/series/`) no longer redirect clients to a UUID-based proxy URL. Requests are now handled directly in the proxy layer via `stream_xc_movie` and `stream_xc_episode`, which call `stream_vod()` internally. The original XC path is preserved for the client throughout the stream.
 - `CustomTable` column layout now supports flexible (`grow`) columns alongside fixed-width ones:
   - Column definitions accept a `grow` property (boolean or number) to opt into flex layout. A numeric value sets the flex-grow weight, allowing relative sizing between grow columns (e.g. `grow: 2` gives a column twice the share of spare space as `grow: 1`).
diff --git a/frontend/src/components/forms/M3UProfile.jsx b/frontend/src/components/forms/M3UProfile.jsx
index d00996d7..bbb2823c 100644
--- a/frontend/src/components/forms/M3UProfile.jsx
+++ b/frontend/src/components/forms/M3UProfile.jsx
@@ -15,6 +15,7 @@ import {
   Grid,
   Textarea,
   NumberInput,
+  SegmentedControl,
 } from '@mantine/core';
 import { DateTimePicker } from '@mantine/dates';
 import { useWebSocket } from '../../WebSocket';
@@ -26,6 +27,10 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
   const [replacePattern, setReplacePattern] = useState('');
   const [debouncedPatterns, setDebouncedPatterns] = useState({});
   const [sampleInput, setSampleInput] = useState('');
+  const [xcMode, setXcMode] = useState('simple');
+  const [newUsername, setNewUsername] = useState('');
+  const [newPassword, setNewPassword] = useState('');
+  const [simpleErrors, setSimpleErrors] = useState({});
   const isDefaultProfile = profile?.is_default;
 
   const isXC = m3u?.account_type === 'XC';
@@ -45,12 +50,12 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
   const schema = Yup.object({
     name: Yup.string().required('Name is required'),
     search_pattern: Yup.string().when([], {
-      is: () => !isDefaultProfile,
+      is: () => !isDefaultProfile && !isXC,
       then: (schema) => schema.required('Search pattern is required'),
       otherwise: (schema) => schema.notRequired(),
     }),
     replace_pattern: Yup.string().when([], {
-      is: () => !isDefaultProfile,
+      is: () => !isDefaultProfile && !isXC,
       then: (schema) => schema.required('Replace pattern is required'),
       otherwise: (schema) => schema.notRequired(),
     }),
@@ -64,6 +69,7 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
     reset,
     setValue,
     watch,
+    setError,
   } = useForm({
     defaultValues,
     resolver: yupResolver(schema),
@@ -83,6 +89,32 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
       expDateValue = null;
     }
 
+    // For XC simple mode: validate simple inputs and build patterns from credentials
+    if (isXC && xcMode === 'simple' && !isDefaultProfile) {
+      const errs = {};
+      if (!newUsername.trim()) errs.newUsername = 'New username is required';
+      if (!newPassword.trim()) errs.newPassword = 'New password is required';
+      if (Object.keys(errs).length > 0) {
+        setSimpleErrors(errs);
+        return;
+      }
+      setSimpleErrors({});
+      values.search_pattern = `${m3u?.username || ''}/${m3u?.password || ''}`;
+      values.replace_pattern = `${newUsername.trim()}/${newPassword.trim()}`;
+    }
+
+    // For XC advanced mode: validate regex pattern fields
+    if (isXC && xcMode === 'advanced' && !isDefaultProfile) {
+      if (!searchPattern.trim()) {
+        setError('search_pattern', { message: 'Search pattern is required' });
+        return;
+      }
+      if (!replacePattern.trim()) {
+        setError('replace_pattern', { message: 'Replace pattern is required' });
+        return;
+      }
+    }
+
     // For default profiles, only send name and custom_properties (notes)
     let submitValues;
     if (isDefaultProfile) {
@@ -105,6 +137,7 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
           // Preserve existing custom_properties and add/update notes
           ...(profile?.custom_properties || {}),
           notes: values.notes || '',
+          ...(isXC ? { xcMode } : {}),
         },
       };
     }
@@ -200,12 +233,63 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
     reset(defaultValues);
     setSearchPattern(profile?.search_pattern || '');
     setReplacePattern(profile?.replace_pattern || '');
-  }, [defaultValues, profile, reset]);
+    if (isXC && !isDefaultProfile) {
+      const storedMode = profile?.custom_properties?.xcMode;
+      let detectedMode;
+      if (storedMode) {
+        detectedMode = storedMode;
+      } else if (
+        profile?.search_pattern &&
+        profile.search_pattern === `${m3u?.username}/${m3u?.password}`
+      ) {
+        detectedMode = 'simple';
+      } else if (profile?.search_pattern) {
+        detectedMode = 'advanced';
+      } else {
+        detectedMode = 'simple';
+      }
+      setXcMode(detectedMode);
+      if (detectedMode === 'simple') {
+        const rp = profile?.replace_pattern || '';
+        const idx = rp.indexOf('/');
+        setNewUsername(idx === -1 ? rp : rp.slice(0, idx));
+        setNewPassword(idx === -1 ? '' : rp.slice(idx + 1));
+      }
+    }
+  }, [
+    defaultValues,
+    isDefaultProfile,
+    isXC,
+    m3u?.password,
+    m3u?.username,
+    profile,
+    reset,
+  ]);
 
   const handleSampleInputChange = (e) => {
     setSampleInput(e.target.value);
   };
 
+  const handleXcModeChange = (mode) => {
+    if (mode === 'advanced' && xcMode === 'simple') {
+      // Pre-populate regex fields from current simple values
+      const sp = `${m3u?.username || ''}/${m3u?.password || ''}`;
+      const rp = `${newUsername}/${newPassword}`;
+      setSearchPattern(sp);
+      setReplacePattern(rp);
+      setValue('search_pattern', sp);
+      setValue('replace_pattern', rp);
+    } else if (mode === 'simple' && xcMode === 'advanced') {
+      // Parse current replace pattern back into username/password
+      const idx = replacePattern.indexOf('/');
+      setNewUsername(
+        idx === -1 ? replacePattern : replacePattern.slice(0, idx)
+      );
+      setNewPassword(idx === -1 ? '' : replacePattern.slice(idx + 1));
+    }
+    setXcMode(mode);
+  };
+
   // Local regex testing for immediate visual feedback
   const getHighlightedSearchText = () => {
     if (!searchPattern || !sampleInput) return sampleInput;
@@ -267,22 +351,65 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
         {/* Only show search/replace fields for non-default profiles */}
         {!isDefaultProfile && (
           <>
-            <TextInput
-              label="Search Pattern (Regex)"
-              description="A regular expression matching the part of the stream URL you want to replace. For most users, matching just the credentials is enough."
-              placeholder="e.g. username1/password1"
-              value={searchPattern}
-              onChange={onSearchPatternUpdate}
-              error={errors.search_pattern?.message}
-            />
-            <TextInput
-              label="Replace Pattern"
-              description="The value to substitute in place of the matched text. Use $1, $2, etc. to reference regex capture groups."
-              placeholder="e.g. username2/password2"
-              value={replacePattern}
-              onChange={onReplacePatternUpdate}
-              error={errors.replace_pattern?.message}
-            />
+            {isXC && (
+              <SegmentedControl
+                mt="xs"
+                mb="xs"
+                fullWidth
+                size="xs"
+                value={xcMode}
+                onChange={handleXcModeChange}
+                data={[
+                  { label: 'Simple', value: 'simple' },
+                  { label: 'Advanced (Regex)', value: 'advanced' },
+                ]}
+              />
+            )}
+            {isXC && xcMode === 'simple' ? (
+              <>
+                <TextInput
+                  label="New Username"
+                  description="Your updated XC account username. The current username in all stream URLs will be replaced with this."
+                  placeholder="e.g. username2"
+                  value={newUsername}
+                  onChange={(e) => {
+                    setNewUsername(e.target.value);
+                    setSimpleErrors((s) => ({ ...s, newUsername: undefined }));
+                  }}
+                  error={simpleErrors.newUsername}
+                />
+                <TextInput
+                  label="New Password"
+                  description="Your updated XC account password. The current password in all stream URLs will be replaced with this."
+                  placeholder="e.g. password2"
+                  value={newPassword}
+                  onChange={(e) => {
+                    setNewPassword(e.target.value);
+                    setSimpleErrors((s) => ({ ...s, newPassword: undefined }));
+                  }}
+                  error={simpleErrors.newPassword}
+                />
+              </>
+            ) : (
+              <>
+                <TextInput
+                  label="Search Pattern (Regex)"
+                  description="A regular expression matching the part of the stream URL you want to replace. For most users, matching just the credentials is enough."
+                  placeholder="e.g. username1/password1"
+                  value={searchPattern}
+                  onChange={onSearchPatternUpdate}
+                  error={errors.search_pattern?.message}
+                />
+                <TextInput
+                  label="Replace Pattern"
+                  description="The value to substitute in place of the matched text. Use $1, $2, etc. to reference regex capture groups."
+                  placeholder="e.g. username2/password2"
+                  value={replacePattern}
+                  onChange={onReplacePatternUpdate}
+                  error={errors.replace_pattern?.message}
+                />
+              </>
+            )}
           </>
         )}
 
@@ -326,8 +453,8 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
         </Flex>
       </form>
 
-      {/* Only show regex demonstration for non-default profiles */}
-      {!isDefaultProfile && (
+      {/* Only show regex demonstration for non-default profiles in advanced mode */}
+      {!isDefaultProfile && (!isXC || xcMode === 'advanced') && (
         <>
           <Title order={4} mt={15} mb={10}>
             Live Regex Demonstration

From 086cc749591f5b7b76c8185df8038937837df806 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sun, 29 Mar 2026 17:55:08 -0500
Subject: [PATCH 62/67] =?UTF-8?q?Bug=20Fix:=20M3U=20profile=20URL=20rewrit?=
 =?UTF-8?q?ing=20now=20uses=20the=20`regex`=20module=20instead=20of=20`re`?=
 =?UTF-8?q?=20across=20all=20URL=20transform=20code=20paths=20(`url=5Futil?=
 =?UTF-8?q?s.transform=5Furl`,=20`core/views.py`,=20`vod=5Fproxy/=5Ftransf?=
 =?UTF-8?q?orm=5Furl`,=20`tasks.get=5Ftransformed=5Fcredentials`,=20and=20?=
 =?UTF-8?q?the=20WebSocket=20live-preview=20handler=20in=20`consumers.py`)?=
 =?UTF-8?q?.=20The=20`regex`=20module=20natively=20accepts=20JavaScript/PC?=
 =?UTF-8?q?RE-style=20named=20capture=20groups=20(`(=3F<name>...)`)=20with?=
 =?UTF-8?q?out=20any=20conversion,=20eliminating=20the=20root=20cause=20of?=
 =?UTF-8?q?=20patterns=20that=20matched=20in=20the=20frontend=20live=20pre?=
 =?UTF-8?q?view=20but=20failed=20on=20the=20backend=20with=20a=20`re.error?=
 =?UTF-8?q?`.=20As=20a=20further=20improvement,=20`regex`=20also=20support?=
 =?UTF-8?q?s=20variable-length=20lookbehind=20assertions=20(e.g.=20`(=3F<?=
 =?UTF-8?q?=3Da+)`),=20which=20`re`=20rejects=20with=20an=20error;=20patte?=
 =?UTF-8?q?rns=20using=20these=20will=20now=20work=20correctly=20on=20the?=
 =?UTF-8?q?=20backend=20as=20well.=20Replace-pattern=20JS=20tokens=20are?=
 =?UTF-8?q?=20still=20normalised=20before=20calling=20`regex.sub`:=20`$<na?=
 =?UTF-8?q?me>`=20=E2=86=92=20`\g<name>`=20and=20`$1`/`$2`/=E2=80=A6=20?=
 =?UTF-8?q?=E2=86=92=20`\1`/`\2`/=E2=80=A6=20(Python=20replacement=20synta?=
 =?UTF-8?q?x).=20Also=20fixed=20a=20bug=20in=20the=20WebSocket=20preview?=
 =?UTF-8?q?=20handler=20where=20a=20pattern=20error=20was=20incorrectly=20?=
 =?UTF-8?q?returning=20the=20search=20pattern=20string=20as=20the=20previe?=
 =?UTF-8?q?w=20output=20instead=20of=20the=20original=20URL.=20(Fixes=20#1?=
 =?UTF-8?q?005)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md                                 |  1 +
 apps/m3u/tasks.py                            |  9 ++++++---
 apps/proxy/ts_proxy/url_utils.py             | 11 ++++++-----
 apps/proxy/vod_proxy/views.py                |  9 ++++++---
 core/views.py                                |  9 ++++++---
 dispatcharr/consumers.py                     |  6 +++---
 frontend/src/components/forms/M3UProfile.jsx |  2 +-
 7 files changed, 29 insertions(+), 18 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e046aa43..249ea29b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -59,6 +59,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- M3U profile URL rewriting now uses the `regex` module instead of `re` across all URL transform code paths (`url_utils.transform_url`, `core/views.py`, `vod_proxy/_transform_url`, `tasks.get_transformed_credentials`, and the WebSocket live-preview handler in `consumers.py`). The `regex` module natively accepts JavaScript/PCRE-style named capture groups (`(?<name>...)`) without any conversion, eliminating the root cause of patterns that matched in the frontend live preview but failed on the backend with a `re.error`. As a further improvement, `regex` also supports variable-length lookbehind assertions (e.g. `(?<=a+)`), which `re` rejects with an error; patterns using these will now work correctly on the backend as well. Replace-pattern JS tokens are still normalised before calling `regex.sub`: `$<name>` → `\g<name>` and `$1`/`$2`/… → `\1`/`\2`/… (Python replacement syntax). Also fixed a bug in the WebSocket preview handler where a pattern error was incorrectly returning the search pattern string as the preview output instead of the original URL. (Fixes #1005)
 - Web UI stream preview (`FloatingVideo`) was calling `mpegts.createPlayer()` with all `Config` options (e.g. `enableWorker`, `liveSync`, `headers`) merged into the first `MediaDataSource` argument. mpegts.js only reads `Config` from the optional second argument; unrecognised fields in the first are silently ignored. As a result all player configuration was effectively the library defaults — worker offloading was disabled, latency management had no effect, and the `Authorization: Bearer` header (required for user identification) was never sent. Fixed by splitting into the correct two-argument call. Both `liveBufferLatencyChasing` and `liveSync` have been disabled, eliminating playback-rate fluctuations that caused audible stuttering on live streams. SourceBuffer cleanup thresholds were also relaxed from 10s/5s to 120s/60s to prevent frequent SourceBuffer pauses.
 - HTML named entities in XMLTV EPG files are now resolved to Unicode characters before lxml parsing. Some EPG providers (particularly French and other European sources) use HTML named entities like `&eacute;`, `&icirc;`, `&uuml;` in channel names, program titles, and metadata. These are not valid XML entities — lxml 6.0.2 with `recover=True` silently drops them, causing characters to go missing (e.g., "Chaîne Télé" becomes "Chane Tl"). A preprocessing step in `fetch_xmltv()` now resolves HTML named entities while preserving the 5 XML-predefined entities, detecting encoding from the XML declaration (falling back to UTF-8), and processing line-by-line to a temp file before atomically replacing the original. (Closes #1095) — Thanks [@CodeBormen](https://github.com/CodeBormen)
 - Duplicate recordings created when EPG sources refresh and re-evaluate series rules (Fixes #940) — Thanks [@CodeBormen](https://github.com/CodeBormen):
diff --git a/apps/m3u/tasks.py b/apps/m3u/tasks.py
index 9c31fa75..354a2ef4 100644
--- a/apps/m3u/tasks.py
+++ b/apps/m3u/tasks.py
@@ -1,6 +1,7 @@
 # apps/m3u/tasks.py
 import logging
 import re
+import regex
 import requests
 import os
 import gc
@@ -2399,11 +2400,13 @@ def get_transformed_credentials(account, profile=None):
         # Apply profile-specific transformations if profile is provided
         if profile and profile.search_pattern and profile.replace_pattern:
             try:
-                # Handle backreferences in the replacement pattern
-                safe_replace_pattern = re.sub(r'\$(\d+)', r'\\\1', profile.replace_pattern)
+                # Handle backreferences: convert JS-style $<name> -> \g<name>, $1 -> \1
+                # regex module accepts JS-style (?<name>...) named groups natively
+                safe_replace_pattern = regex.sub(r'\$<([^>]+)>', r'\\g<\1>', profile.replace_pattern)
+                safe_replace_pattern = regex.sub(r'\$(\d+)', r'\\\1', safe_replace_pattern)
 
                 # Apply transformation to the complete URL
-                transformed_complete_url = re.sub(profile.search_pattern, safe_replace_pattern, complete_url)
+                transformed_complete_url = regex.sub(profile.search_pattern, safe_replace_pattern, complete_url)
                 logger.info(f"Transformed complete URL: {complete_url} -> {transformed_complete_url}")
 
                 # Extract components from the transformed URL
diff --git a/apps/proxy/ts_proxy/url_utils.py b/apps/proxy/ts_proxy/url_utils.py
index 55e44c35..5f4615a4 100644
--- a/apps/proxy/ts_proxy/url_utils.py
+++ b/apps/proxy/ts_proxy/url_utils.py
@@ -3,7 +3,7 @@ Utilities for handling stream URLs and transformations.
 """
 
 import logging
-import re
+import regex
 from typing import Optional, Tuple, List
 from django.shortcuts import get_object_or_404
 from apps.channels.models import Channel, Stream
@@ -146,13 +146,14 @@ def transform_url(input_url: str, search_pattern: str, replace_pattern: str) ->
         logger.debug(f"  base URL: {input_url}")
         logger.debug(f"  search: {search_pattern}")
 
-        # Handle backreferences in the replacement pattern
-        safe_replace_pattern = re.sub(r'\$(\d+)', r'\\\1', replace_pattern)
+        # Convert JS-style backreferences in replace pattern: $<name> -> \g<name>, $1 -> \1
+        safe_replace_pattern = regex.sub(r'\$<([^>]+)>', r'\\g<\1>', replace_pattern)
+        safe_replace_pattern = regex.sub(r'\$(\d+)', r'\\\1', safe_replace_pattern)
         logger.debug(f"  replace: {replace_pattern}")
         logger.debug(f"  safe replace: {safe_replace_pattern}")
 
-        # Apply the transformation
-        stream_url = re.sub(search_pattern, safe_replace_pattern, input_url)
+        # Apply the transformation (regex module accepts JS-style (?<name>...) natively)
+        stream_url = regex.sub(search_pattern, safe_replace_pattern, input_url)
         logger.info(f"Generated stream url: {stream_url}")
 
         return stream_url
diff --git a/apps/proxy/vod_proxy/views.py b/apps/proxy/vod_proxy/views.py
index 4382caaa..8db51ebd 100644
--- a/apps/proxy/vod_proxy/views.py
+++ b/apps/proxy/vod_proxy/views.py
@@ -270,17 +270,20 @@ def _get_m3u_profile(m3u_account, profile_id, session_id=None):
 def _transform_url(original_url, m3u_profile):
     """Transform URL based on M3U profile settings"""
     try:
-        import re
+        import regex
 
         if not original_url:
             return None
 
         search_pattern = m3u_profile.search_pattern
         replace_pattern = m3u_profile.replace_pattern
-        safe_replace_pattern = re.sub(r'\$(\d+)', r'\\\1', replace_pattern)
+        # Convert JS-style backreferences in replace: $<name> -> \g<name>, $1 -> \1
+        safe_replace_pattern = regex.sub(r'\$<([^>]+)>', r'\\g<\1>', replace_pattern)
+        safe_replace_pattern = regex.sub(r'\$(\d+)', r'\\\1', safe_replace_pattern)
 
         if search_pattern and replace_pattern:
-            transformed_url = re.sub(search_pattern, safe_replace_pattern, original_url)
+            # regex module accepts JS-style (?<name>...) named groups natively
+            transformed_url = regex.sub(search_pattern, safe_replace_pattern, original_url)
             return transformed_url
 
         return original_url
diff --git a/core/views.py b/core/views.py
index b3e6dfb2..7321367c 100644
--- a/core/views.py
+++ b/core/views.py
@@ -4,7 +4,7 @@ from shlex import split as shlex_split
 import sys
 import subprocess
 import logging
-import re
+import regex
 import redis
 
 from django.conf import settings
@@ -132,10 +132,13 @@ def stream_view(request, channel_uuid):
         # Prepare the pattern replacement.
         logger.debug("Executing the following pattern replacement:")
         logger.debug(f"  search: {active_profile.search_pattern}")
-        safe_replace_pattern = re.sub(r'\$(\d+)', r'\\\1', active_profile.replace_pattern)
+        # Convert JS-style backreferences in replace: $<name> -> \g<name>, $1 -> \1
+        safe_replace_pattern = regex.sub(r'\$<([^>]+)>', r'\\g<\1>', active_profile.replace_pattern)
+        safe_replace_pattern = regex.sub(r'\$(\d+)', r'\\\1', safe_replace_pattern)
         logger.debug(f"  replace: {active_profile.replace_pattern}")
         logger.debug(f"  safe replace: {safe_replace_pattern}")
-        stream_url = re.sub(active_profile.search_pattern, safe_replace_pattern, input_url)
+        # regex module accepts JS-style (?<name>...) named groups natively
+        stream_url = regex.sub(active_profile.search_pattern, safe_replace_pattern, input_url)
         logger.debug(f"Generated stream url: {stream_url}")
 
         # Get the stream profile set on the channel.
diff --git a/dispatcharr/consumers.py b/dispatcharr/consumers.py
index 4e21bdae..7b62d957 100644
--- a/dispatcharr/consumers.py
+++ b/dispatcharr/consumers.py
@@ -1,6 +1,6 @@
 import json
 from channels.generic.websocket import AsyncWebsocketConsumer
-import re, logging
+import regex, logging
 
 logger = logging.getLogger(__name__)
 
@@ -54,9 +54,9 @@ class MyWebSocketConsumer(AsyncWebsocketConsumer):
 
             # Apply the transformation using the replace_with_mark function
             try:
-                search_preview = re.sub(data["search"], replace_with_mark, data["url"])
+                search_preview = regex.sub(data["search"], replace_with_mark, data["url"])
             except Exception as e:
-                search_preview = data["search"]
+                search_preview = data["url"]
                 logger.error(f"Failed to generate replace preview: {e}")
 
             result = transform_url(data["url"], data["search"], data["replace"])
diff --git a/frontend/src/components/forms/M3UProfile.jsx b/frontend/src/components/forms/M3UProfile.jsx
index bbb2823c..65da3e17 100644
--- a/frontend/src/components/forms/M3UProfile.jsx
+++ b/frontend/src/components/forms/M3UProfile.jsx
@@ -290,7 +290,7 @@ const RegexFormAndView = ({ profile = null, m3u, isOpen, onClose }) => {
     setXcMode(mode);
   };
 
-  // Local regex testing for immediate visual feedback
+  // Local regex for the live demo preview
   const getHighlightedSearchText = () => {
     if (!searchPattern || !sampleInput) return sampleInput;
     try {

From d4ecf45bc29ebcf7ebbbb8214a35773d0f32e8c2 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sun, 29 Mar 2026 19:51:57 -0500
Subject: [PATCH 63/67] =?UTF-8?q?Bug=20Fix/Enhancement:=20-=20EPG=20refres?=
 =?UTF-8?q?h=20tasks=20(`refresh=5Fepg=5Fdata`)=20were=20being=20killed=20?=
 =?UTF-8?q?mid-transaction=20on=20large=20EPG=20sources.=20The=20`soft=5Ft?=
 =?UTF-8?q?ime=5Flimit=3D1700s`=20introduced=20in=20v0.21.0=20raised=20`So?=
 =?UTF-8?q?ftTimeLimitExceeded`,=20a=20subclass=20of=20`Exception`,=20whic?=
 =?UTF-8?q?h=20was=20swallowed=20by=20the=20existing=20`except=20Exception?=
 =?UTF-8?q?`=20handler=20in=20`parse=5Fprograms=5Ffor=5Fsource`,=20leaving?=
 =?UTF-8?q?=20the=20database=20in=20a=20partial=20state=20with=20no=20logg?=
 =?UTF-8?q?ed=20error.=20The=20underlying=20cause=20is=20that=20the=20HTML?=
 =?UTF-8?q?=20entity=20preprocessing=20step=20added=20in=20v0.21.0=20adds?=
 =?UTF-8?q?=202=E2=80=9310+=20minutes=20on=20multi-gigabyte=20EPG=20files,?=
 =?UTF-8?q?=20pushing=20total=20task=20duration=20past=20the=201700s=20lim?=
 =?UTF-8?q?it=20for=20large=20sources.=20`soft=5Ftime=5Flimit`=20has=20bee?=
 =?UTF-8?q?n=20removed=20from=20`refresh=5Fepg=5Fdata`=20and=20`time=5Flim?=
 =?UTF-8?q?it`=20raised=20to=2014400s=20(4=20hours)=20as=20a=20true=20last?=
 =?UTF-8?q?-resort=20ceiling;=20the=20existing=20`TaskLockRenewer`=20daemo?=
 =?UTF-8?q?n=20thread=20continues=20to=20renew=20the=20Redis=20lock=20ever?=
 =?UTF-8?q?y=20120s=20for=20legitimately=20long-running=20tasks.=20-=20HTM?=
 =?UTF-8?q?L=20entity=20preprocessing=20(`=5Fresolve=5Fhtml=5Fentities`)?=
 =?UTF-8?q?=20now=20performs=20a=20fast=20binary=20pre-scan=20before=20any?=
 =?UTF-8?q?=20file=20read=20or=20write.=20The=20pre-scan=20reads=20the=20f?=
 =?UTF-8?q?ile=20in=204=20MB=20chunks=20without=20text=20decoding=20and=20?=
 =?UTF-8?q?exits=20immediately=20on=20the=20first=20non-XML=20named=20enti?=
 =?UTF-8?q?ty=20found.=20For=20EPG=20sources=20that=20contain=20no=20HTML?=
 =?UTF-8?q?=20entities=20=E2=80=94=20the=20common=20case=20=E2=80=94=20the?=
 =?UTF-8?q?=20full=20line-by-line=20read+rewrite=20pass=20(which=20takes?=
 =?UTF-8?q?=202=E2=80=9310+=20minutes=20on=20a=202.5=20GB=20file)=20is=20s?=
 =?UTF-8?q?kipped=20entirely.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md      |   2 +
 apps/epg/tasks.py | 104 ++++++++++++++++++++++++++++++++--------------
 2 files changed, 74 insertions(+), 32 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 249ea29b..e8bccb55 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -66,6 +66,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - **Program ID instability**: `parse_programs_for_source()` deletes and recreates all `ProgramData` rows with new auto-increment IDs on every EPG refresh. The dedup set used these IDs, so it never matched after a refresh. Deduplication now uses a stable `(tvg_id, start_time, end_time)` composite key sourced from `Recording.custom_properties.program`.
   - **Secondary guard using wrong times**: The DB guard compared unadjusted program times against offset-adjusted `Recording.start_time`/`end_time`, so it never matched when any DVR pre/post offset was configured. It now queries `custom_properties__program__start_time/end_time` (the original, unadjusted program times stored at recording creation).
   - **No concurrency guard**: Each EPG source refresh fired `evaluate_series_rules.delay()` independently. Concurrent tasks loaded the dedup set before others committed, allowing races. Evaluation is now serialized with `acquire_task_lock` (reusing the existing EPG task pattern). Gracefully degrades if Redis is unavailable — the primary and secondary dedup guards still protect.
+- EPG refresh tasks (`refresh_epg_data`) were being killed mid-transaction on large EPG sources. The `soft_time_limit=1700s` introduced in v0.21.0 raised `SoftTimeLimitExceeded`, a subclass of `Exception`, which was swallowed by the existing `except Exception` handler in `parse_programs_for_source`, leaving the database in a partial state with no logged error. The underlying cause is that the HTML entity preprocessing step added in v0.21.0 adds 2–10+ minutes on multi-gigabyte EPG files, pushing total task duration past the 1700s limit for large sources. `soft_time_limit` has been removed from `refresh_epg_data` and `time_limit` raised to 14400s (4 hours) as a true last-resort ceiling; the existing `TaskLockRenewer` daemon thread continues to renew the Redis lock every 120s for legitimately long-running tasks.
+- HTML entity preprocessing (`_resolve_html_entities`) now performs a fast binary pre-scan before any file read or write. The pre-scan reads the file in 4 MB chunks without text decoding and exits immediately on the first non-XML named entity found. For EPG sources that contain no HTML entities — the common case — the full line-by-line read+rewrite pass (which takes 2–10+ minutes on a 2.5 GB file) is skipped entirely.
 
 ## [0.21.1] - 2026-03-18
 
diff --git a/apps/epg/tasks.py b/apps/epg/tasks.py
index 9683c85a..3126453d 100644
--- a/apps/epg/tasks.py
+++ b/apps/epg/tasks.py
@@ -18,7 +18,7 @@ import zipfile
 
 from celery import shared_task
 from django.conf import settings
-from django.db import transaction
+from django.db import connection, transaction
 from django.utils import timezone
 from apps.channels.models import Channel
 from core.models import UserAgent, CoreSettings
@@ -36,8 +36,11 @@ logger = logging.getLogger(__name__)
 # &eacute; are silently dropped in recovery mode.  This substitution
 # converts them to Unicode before the file reaches the parser.
 _XML_ENTITIES = frozenset({'amp', 'lt', 'gt', 'quot', 'apos'})
+_XML_ENTITIES_BYTES = frozenset(n.encode() for n in _XML_ENTITIES)
 _XML_SPECIAL_CHARS = frozenset('&<>\'"')
 _NAMED_ENTITY_RE = re.compile(r'&([a-zA-Z][a-zA-Z0-9]*);')
+# Binary version used by the fast pre-scan (no text decoding needed)
+_BINARY_ENTITY_RE = re.compile(rb'&([a-zA-Z][a-zA-Z0-9]*);')
 
 
 def _replace_html_entity(match):
@@ -79,6 +82,32 @@ def _detect_xml_encoding(header):
     return 'utf-8'
 
 
+def _file_needs_entity_resolution(file_path):
+    """Binary pre-scan: return True only if file contains non-XML named HTML entities.
+
+    Reads in 4 MB chunks with a small overlap to catch entities that straddle
+    a chunk boundary.  Avoids all text-decode overhead — this is effectively a
+    raw memory scan and exits as soon as the first HTML entity is found.
+    """
+    CHUNK = 4 * 1024 * 1024  # 4 MB
+    OVERLAP = 32              # longer than any valid entity name + surrounding &;
+    try:
+        with open(file_path, 'rb') as f:
+            prev = b''
+            while True:
+                chunk = f.read(CHUNK)
+                if not chunk:
+                    return False
+                data = prev + chunk
+                for m in _BINARY_ENTITY_RE.finditer(data):
+                    if m.group(1).lower() not in _XML_ENTITIES_BYTES:
+                        return True
+                prev = data[-OVERLAP:]
+    except OSError:
+        return False
+    return False
+
+
 def _resolve_html_entities(file_path):
     """Replace HTML named entities in an XMLTV file with Unicode characters.
 
@@ -89,6 +118,14 @@ def _resolve_html_entities(file_path):
     This function is strictly additive — on any error the original file is
     left untouched so lxml can handle it as it always did.
     """
+    # Fast binary pre-scan: if the file contains no non-XML named entities
+    # there is nothing to do and we can skip the full read+write entirely.
+    # For large files (e.g. 2.5 GB) this avoids significant I/O time when
+    # the EPG source is already clean (the common case).
+    if not _file_needs_entity_resolution(file_path):
+        logger.debug(f"No HTML entities found in {file_path}, skipping entity resolution")
+        return
+    logger.info(f"HTML entities detected in {file_path}, resolving...")
     # Read the first 200 bytes to detect encoding from the XML declaration
     with open(file_path, 'rb') as f:
         header = f.read(200)
@@ -245,7 +282,7 @@ def refresh_all_epg_data():
     return "EPG data refreshed."
 
 
-@shared_task(time_limit=1800, soft_time_limit=1700)
+@shared_task(time_limit=14400)
 def refresh_epg_data(source_id):
     if not acquire_task_lock('refresh_epg_data', source_id):
         logger.debug(f"EPG refresh for {source_id} already running")
@@ -499,42 +536,41 @@ def fetch_xmltv(source):
 
             # Download to temporary file
             with open(temp_download_path, 'wb') as f:
-                for chunk in response.iter_content(chunk_size=16384):  # Increased chunk size for better performance
-                    if chunk:
-                        f.write(chunk)
+                for chunk in response.iter_content(chunk_size=16384):
+                    f.write(chunk)
 
-                        downloaded += len(chunk)
-                        elapsed_time = time.time() - start_time
+                    downloaded += len(chunk)
+                    elapsed_time = time.time() - start_time
 
-                        # Calculate download speed in KB/s
-                        speed = downloaded / elapsed_time / 1024 if elapsed_time > 0 else 0
+                    # Calculate download speed in KB/s
+                    speed = downloaded / elapsed_time / 1024 if elapsed_time > 0 else 0
 
-                        # Calculate progress percentage
-                        if total_size and total_size > 0:
-                            progress = min(100, int((downloaded / total_size) * 100))
-                        else:
-                            # If no content length header, estimate progress
-                            progress = min(95, int((downloaded / (10 * 1024 * 1024)) * 100))  # Assume 10MB if unknown
+                    # Calculate progress percentage
+                    if total_size and total_size > 0:
+                        progress = min(100, int((downloaded / total_size) * 100))
+                    else:
+                        # If no content length header, estimate progress
+                        progress = min(95, int((downloaded / (10 * 1024 * 1024)) * 100))  # Assume 10MB if unknown
 
-                        # Time remaining (in seconds)
-                        time_remaining = (total_size - downloaded) / (speed * 1024) if speed > 0 and total_size > 0 else 0
+                    # Time remaining (in seconds)
+                    time_remaining = (total_size - downloaded) / (speed * 1024) if speed > 0 and total_size > 0 else 0
 
-                        # Only send updates at specified intervals to avoid flooding
-                        current_time = time.time()
-                        if current_time - last_update_time >= update_interval and progress > 0:
-                            last_update_time = current_time
-                            send_epg_update(
-                                source.id,
-                                "downloading",
-                                progress,
-                                speed=round(speed, 2),
-                                elapsed_time=round(elapsed_time, 1),
-                                time_remaining=round(time_remaining, 1),
-                                downloaded=f"{downloaded / (1024 * 1024):.2f} MB"
-                            )
+                    # Only send updates at specified intervals to avoid flooding
+                    current_time = time.time()
+                    if current_time - last_update_time >= update_interval and progress > 0:
+                        last_update_time = current_time
+                        send_epg_update(
+                            source.id,
+                            "downloading",
+                            progress,
+                            speed=round(speed, 2),
+                            elapsed_time=round(elapsed_time, 1),
+                            time_remaining=round(time_remaining, 1),
+                            downloaded=f"{downloaded / (1024 * 1024):.2f} MB"
+                        )
 
-                        # Explicitly delete the chunk to free memory immediately
-                        del chunk
+                    # Explicitly delete the chunk to free memory immediately
+                    del chunk
 
             # Send completion notification
             send_epg_update(source.id, "downloading", 100)
@@ -1763,6 +1799,10 @@ def parse_programs_for_source(epg_source, tvg_id=None):
         batch_size = 1000
         try:
             with transaction.atomic():
+                # Kill any individual statement that hangs longer than 10 minutes.
+                # SET LOCAL automatically resets when this transaction ends (commit or rollback).
+                with connection.cursor() as cursor:
+                    cursor.execute("SET LOCAL statement_timeout = '10min'")
                 # Delete existing programs for mapped EPGs
                 deleted_count = ProgramData.objects.filter(epg_id__in=mapped_epg_ids).delete()[0]
                 logger.debug(f"Deleted {deleted_count} existing programs")

From 70e229a433a4046f6d0ba73737682c24775d6f11 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Sun, 29 Mar 2026 20:43:27 -0500
Subject: [PATCH 64/67] Refactor HTML entity handling in XMLTV files: replace
 regex-based entity resolution with lxml's html.entities for improved accuracy
 and performance. Inject DOCTYPE declaration to ensure proper parsing of HTML
 entities, avoiding silent drops during recovery mode.

---
 CHANGELOG.md      |   5 +-
 apps/epg/tasks.py | 220 +++++++++++++++++++---------------------------
 2 files changed, 90 insertions(+), 135 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e8bccb55..1f8aad67 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -61,13 +61,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - M3U profile URL rewriting now uses the `regex` module instead of `re` across all URL transform code paths (`url_utils.transform_url`, `core/views.py`, `vod_proxy/_transform_url`, `tasks.get_transformed_credentials`, and the WebSocket live-preview handler in `consumers.py`). The `regex` module natively accepts JavaScript/PCRE-style named capture groups (`(?<name>...)`) without any conversion, eliminating the root cause of patterns that matched in the frontend live preview but failed on the backend with a `re.error`. As a further improvement, `regex` also supports variable-length lookbehind assertions (e.g. `(?<=a+)`), which `re` rejects with an error; patterns using these will now work correctly on the backend as well. Replace-pattern JS tokens are still normalised before calling `regex.sub`: `$<name>` → `\g<name>` and `$1`/`$2`/… → `\1`/`\2`/… (Python replacement syntax). Also fixed a bug in the WebSocket preview handler where a pattern error was incorrectly returning the search pattern string as the preview output instead of the original URL. (Fixes #1005)
 - Web UI stream preview (`FloatingVideo`) was calling `mpegts.createPlayer()` with all `Config` options (e.g. `enableWorker`, `liveSync`, `headers`) merged into the first `MediaDataSource` argument. mpegts.js only reads `Config` from the optional second argument; unrecognised fields in the first are silently ignored. As a result all player configuration was effectively the library defaults — worker offloading was disabled, latency management had no effect, and the `Authorization: Bearer` header (required for user identification) was never sent. Fixed by splitting into the correct two-argument call. Both `liveBufferLatencyChasing` and `liveSync` have been disabled, eliminating playback-rate fluctuations that caused audible stuttering on live streams. SourceBuffer cleanup thresholds were also relaxed from 10s/5s to 120s/60s to prevent frequent SourceBuffer pauses.
-- HTML named entities in XMLTV EPG files are now resolved to Unicode characters before lxml parsing. Some EPG providers (particularly French and other European sources) use HTML named entities like `&eacute;`, `&icirc;`, `&uuml;` in channel names, program titles, and metadata. These are not valid XML entities — lxml 6.0.2 with `recover=True` silently drops them, causing characters to go missing (e.g., "Chaîne Télé" becomes "Chane Tl"). A preprocessing step in `fetch_xmltv()` now resolves HTML named entities while preserving the 5 XML-predefined entities, detecting encoding from the XML declaration (falling back to UTF-8), and processing line-by-line to a temp file before atomically replacing the original. (Closes #1095) — Thanks [@CodeBormen](https://github.com/CodeBormen)
+- HTML named entities in XMLTV EPG files are now correctly preserved during lxml parsing. Some EPG providers (particularly French and other European sources) use HTML named entities like `&eacute;`, `&icirc;`, `&uuml;` in channel names, program titles, and metadata. These are not valid XML entities — lxml 6.0.2 with `recover=True` silently drops them, causing characters to go missing (e.g., "Chaîne Télé" becomes "Chane Tl"). This is now fixed by injecting an XML `<!DOCTYPE tv [...]>` internal subset declaring all 252 HTML 4 named entities directly into the byte stream that lxml reads, using a lightweight in-memory wrapper (`_PrependStream`) with zero disk I/O. libxml2 resolves the entities during its normal C-level parse pass — no Python-level preprocessing or temporary files are involved. The DOCTYPE block (~8 KB) is built once at module load from Python's stdlib `html.entities.name2codepoint` and reused for every parse. Files that already declare their own `<!DOCTYPE>` are passed through unchanged. (Closes #1095) — Thanks [@CodeBormen](https://github.com/CodeBormen) for helping with this!
 - Duplicate recordings created when EPG sources refresh and re-evaluate series rules (Fixes #940) — Thanks [@CodeBormen](https://github.com/CodeBormen):
   - **Program ID instability**: `parse_programs_for_source()` deletes and recreates all `ProgramData` rows with new auto-increment IDs on every EPG refresh. The dedup set used these IDs, so it never matched after a refresh. Deduplication now uses a stable `(tvg_id, start_time, end_time)` composite key sourced from `Recording.custom_properties.program`.
   - **Secondary guard using wrong times**: The DB guard compared unadjusted program times against offset-adjusted `Recording.start_time`/`end_time`, so it never matched when any DVR pre/post offset was configured. It now queries `custom_properties__program__start_time/end_time` (the original, unadjusted program times stored at recording creation).
   - **No concurrency guard**: Each EPG source refresh fired `evaluate_series_rules.delay()` independently. Concurrent tasks loaded the dedup set before others committed, allowing races. Evaluation is now serialized with `acquire_task_lock` (reusing the existing EPG task pattern). Gracefully degrades if Redis is unavailable — the primary and secondary dedup guards still protect.
-- EPG refresh tasks (`refresh_epg_data`) were being killed mid-transaction on large EPG sources. The `soft_time_limit=1700s` introduced in v0.21.0 raised `SoftTimeLimitExceeded`, a subclass of `Exception`, which was swallowed by the existing `except Exception` handler in `parse_programs_for_source`, leaving the database in a partial state with no logged error. The underlying cause is that the HTML entity preprocessing step added in v0.21.0 adds 2–10+ minutes on multi-gigabyte EPG files, pushing total task duration past the 1700s limit for large sources. `soft_time_limit` has been removed from `refresh_epg_data` and `time_limit` raised to 14400s (4 hours) as a true last-resort ceiling; the existing `TaskLockRenewer` daemon thread continues to renew the Redis lock every 120s for legitimately long-running tasks.
-- HTML entity preprocessing (`_resolve_html_entities`) now performs a fast binary pre-scan before any file read or write. The pre-scan reads the file in 4 MB chunks without text decoding and exits immediately on the first non-XML named entity found. For EPG sources that contain no HTML entities — the common case — the full line-by-line read+rewrite pass (which takes 2–10+ minutes on a 2.5 GB file) is skipped entirely.
+- EPG refresh tasks (`refresh_epg_data`) were being killed mid-transaction on large EPG sources. The `soft_time_limit=1700s` introduced in v0.21.0 raised `SoftTimeLimitExceeded`, a subclass of `Exception`, which was swallowed by the existing `except Exception` handler in `parse_programs_for_source`, leaving the database in a partial state with no logged error. `soft_time_limit` has been removed from `refresh_epg_data` and `time_limit` raised to 14400s (4 hours) as a true last-resort ceiling; the existing `TaskLockRenewer` daemon thread continues to renew the Redis lock every 120s for legitimately long-running tasks.
 
 ## [0.21.1] - 2026-03-18
 
diff --git a/apps/epg/tasks.py b/apps/epg/tasks.py
index 3126453d..0d05552f 100644
--- a/apps/epg/tasks.py
+++ b/apps/epg/tasks.py
@@ -1,11 +1,9 @@
 # apps/epg/tasks.py
 
-import codecs
 import logging
 import gzip
-import html as html_module
+import html.entities
 import os
-import re
 import uuid
 import requests
 import time  # Add import for tracking download progress
@@ -31,138 +29,102 @@ from core.utils import acquire_task_lock, release_task_lock, TaskLockRenewer, se
 
 logger = logging.getLogger(__name__)
 
-# Regex and helpers for resolving HTML named entities in XMLTV files.
-# lxml only recognises the 5 XML-predefined entities; HTML entities like
-# &eacute; are silently dropped in recovery mode.  This substitution
-# converts them to Unicode before the file reaches the parser.
+# DOCTYPE internal subset for XMLTV files.  Declares all 252 HTML 4 named
+# entities so lxml/libxml2 can resolve references like &eacute; correctly
+# instead of silently dropping them in recovery mode.
+# The 5 XML-predefined entities (amp, lt, gt, quot, apos) are always
+# recognised by the XML spec and must not be redeclared.
 _XML_ENTITIES = frozenset({'amp', 'lt', 'gt', 'quot', 'apos'})
-_XML_ENTITIES_BYTES = frozenset(n.encode() for n in _XML_ENTITIES)
-_XML_SPECIAL_CHARS = frozenset('&<>\'"')
-_NAMED_ENTITY_RE = re.compile(r'&([a-zA-Z][a-zA-Z0-9]*);')
-# Binary version used by the fast pre-scan (no text decoding needed)
-_BINARY_ENTITY_RE = re.compile(rb'&([a-zA-Z][a-zA-Z0-9]*);')
 
 
-def _replace_html_entity(match):
-    """Replace a single HTML named entity, preserving XML-special ones.
+def _build_html_entity_doctype() -> bytes:
+    """Build a DOCTYPE internal subset declaring all HTML 4 named entities."""
+    lines = [b'<!DOCTYPE tv [\n']
+    for name, codepoint in sorted(html.entities.name2codepoint.items()):
+        if name not in _XML_ENTITIES:
+            # Numeric character references are always valid XML regardless of codepoint.
+            lines.append(f'<!ENTITY {name} "&#x{codepoint:X};">\n'.encode('ascii'))
+    lines.append(b']>\n')
+    return b''.join(lines)
 
-    Skips lowercase XML entities (fast path) and any entity whose resolved
-    output contains XML-special characters that would break parsing.  This
-    also guards against html.unescape partially matching sub-patterns
-    (e.g. &ampersand; being split into &amp + ersand;).
+
+_HTML_ENTITY_DOCTYPE = _build_html_entity_doctype()
+
+
+class _PrependStream:
+    """Wraps an open binary file and prepends a bytes prefix to its content.
+
+    Used by _open_xmltv_file to inject a DOCTYPE entity block before the
+    file content reaches lxml's iterparse, with zero disk I/O.
     """
-    original = match.group(0)
-    name = match.group(1)
-    if name in _XML_ENTITIES:
-        return original
-    resolved = html_module.unescape(original)
-    if resolved == original:
-        return original
-    # If the resolved output contains any XML-special character, replacing
-    # it would produce invalid XML (bare &, <, >, etc.)
-    if _XML_SPECIAL_CHARS.intersection(resolved):
-        return original
-    return resolved
+
+    __slots__ = ('_prefix', '_prefix_pos', '_file')
+
+    def __init__(self, prefix: bytes, file_obj):
+        self._prefix = prefix
+        self._prefix_pos = 0
+        self._file = file_obj
+
+    def read(self, size=-1):
+        prefix_len = len(self._prefix)
+        if self._prefix_pos >= prefix_len:
+            return self._file.read(size)
+        remaining = prefix_len - self._prefix_pos
+        if size < 0:
+            chunk = self._prefix[self._prefix_pos:] + self._file.read()
+            self._prefix_pos = prefix_len
+            return chunk
+        if size <= remaining:
+            chunk = self._prefix[self._prefix_pos:self._prefix_pos + size]
+            self._prefix_pos += size
+            return chunk
+        chunk = self._prefix[self._prefix_pos:]
+        self._prefix_pos = prefix_len
+        return chunk + self._file.read(size - remaining)
+
+    def close(self):
+        self._file.close()
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *_):
+        self.close()
 
 
-def _detect_xml_encoding(header):
-    """Detect encoding from raw XML header bytes, defaulting to UTF-8.
+def _open_xmltv_file(file_path: str):
+    """Open an XMLTV file for lxml iterparse, injecting an HTML entity DOCTYPE.
 
-    Falls back to UTF-8 if the declared encoding is not recognized by Python.
+    Prepends a <!DOCTYPE tv [...]> block that declares all 252 HTML 4 named
+    entities so lxml/libxml2 resolves references like &eacute; correctly
+    instead of silently dropping them in recovery mode.  This involves zero
+    disk I/O — the DOCTYPE is streamed in-memory before the file content.
+
+    If the file already contains a <!DOCTYPE> declaration the file is returned
+    unchanged; a second DOCTYPE would be invalid XML.
+
+    The caller is responsible for closing the returned object.
     """
-    m = re.match(rb'<\?xml[^>]*encoding=["\']([^"\']+)["\']', header)
-    if m:
-        declared = m.group(1).decode('ascii')
-        try:
-            codecs.lookup(declared)
-            return declared
-        except LookupError:
-            logger.warning(f"Unknown encoding '{declared}', falling back to UTF-8")
-            return 'utf-8'
-    return 'utf-8'
+    f = open(file_path, 'rb')
+    start = f.read(512)
 
+    # Do not inject if the file already declares a DOCTYPE.
+    if b'<!DOCTYPE' in start or b'<!doctype' in start.lower():
+        f.seek(0)
+        return f
 
-def _file_needs_entity_resolution(file_path):
-    """Binary pre-scan: return True only if file contains non-XML named HTML entities.
+    # Insert the DOCTYPE after the XML declaration if one is present.
+    stripped = start.lstrip()
+    if stripped.startswith(b'<?xml'):
+        decl_end = start.find(b'?>')
+        if decl_end >= 0:
+            xml_decl = start[:decl_end + 2]
+            f.seek(decl_end + 2)
+            return _PrependStream(xml_decl + b'\n' + _HTML_ENTITY_DOCTYPE, f)
 
-    Reads in 4 MB chunks with a small overlap to catch entities that straddle
-    a chunk boundary.  Avoids all text-decode overhead — this is effectively a
-    raw memory scan and exits as soon as the first HTML entity is found.
-    """
-    CHUNK = 4 * 1024 * 1024  # 4 MB
-    OVERLAP = 32              # longer than any valid entity name + surrounding &;
-    try:
-        with open(file_path, 'rb') as f:
-            prev = b''
-            while True:
-                chunk = f.read(CHUNK)
-                if not chunk:
-                    return False
-                data = prev + chunk
-                for m in _BINARY_ENTITY_RE.finditer(data):
-                    if m.group(1).lower() not in _XML_ENTITIES_BYTES:
-                        return True
-                prev = data[-OVERLAP:]
-    except OSError:
-        return False
-    return False
-
-
-def _resolve_html_entities(file_path):
-    """Replace HTML named entities in an XMLTV file with Unicode characters.
-
-    Processes line-by-line to keep memory usage low, writes to a temp file,
-    then atomically replaces the original.  Honors the encoding declared
-    in the XML declaration.
-
-    This function is strictly additive — on any error the original file is
-    left untouched so lxml can handle it as it always did.
-    """
-    # Fast binary pre-scan: if the file contains no non-XML named entities
-    # there is nothing to do and we can skip the full read+write entirely.
-    # For large files (e.g. 2.5 GB) this avoids significant I/O time when
-    # the EPG source is already clean (the common case).
-    if not _file_needs_entity_resolution(file_path):
-        logger.debug(f"No HTML entities found in {file_path}, skipping entity resolution")
-        return
-    logger.info(f"HTML entities detected in {file_path}, resolving...")
-    # Read the first 200 bytes to detect encoding from the XML declaration
-    with open(file_path, 'rb') as f:
-        header = f.read(200)
-    encoding = _detect_xml_encoding(header)
-
-    # Capture the original mtime before modifying the file so that os.replace()
-    # does not update the file's mtime.  The file watcher in core/tasks.py uses
-    # mtime to detect changes; if we let mtime advance it would trigger an
-    # infinite refresh loop for local file-based EPG sources.
-    try:
-        original_stat = os.stat(file_path)
-    except OSError:
-        original_stat = None
-
-    temp_path = file_path + '.entity_tmp'
-    success = False
-    try:
-        with open(file_path, 'r', encoding=encoding) as src, \
-             open(temp_path, 'w', encoding=encoding) as dst:
-            for line in src:
-                dst.write(_NAMED_ENTITY_RE.sub(_replace_html_entity, line))
-        os.replace(temp_path, file_path)
-        # Restore the original mtime (and atime) so the file watcher does not
-        # mistake the rewrite for an external update.
-        if original_stat is not None:
-            os.utime(file_path, (original_stat.st_atime, original_stat.st_mtime))
-        success = True
-        logger.debug(f"Resolved HTML entities in {file_path} (encoding: {encoding})")
-    except Exception as e:
-        # On any error, leave the original file untouched for lxml to
-        # handle with its own encoding detection and recovery mode.
-        # This ensures the preprocessing step never breaks a previously
-        # working EPG refresh.
-        logger.debug(f"Skipping entity resolution for {file_path}: {e}")
-    finally:
-        if not success and os.path.exists(temp_path):
-            os.unlink(temp_path)
+    # No XML declaration — insert DOCTYPE at the very start of the file.
+    f.seek(0)
+    return _PrependStream(_HTML_ENTITY_DOCTYPE, f)
 
 
 def validate_icon_url_fast(icon_url, max_length=None):
@@ -416,9 +378,6 @@ def fetch_xmltv(source):
         # Send a download complete notification
         send_epg_update(source.id, "downloading", 100, status="success")
 
-        # Resolve HTML named entities so lxml doesn't drop them during parsing
-        _resolve_html_entities(source.extracted_file_path or source.file_path)
-
         # Return True to indicate successful fetch, processing will continue with parse_channels_only
         return True
 
@@ -665,9 +624,6 @@ def fetch_xmltv(source):
 
             logger.info(f"Cached EPG file saved to {source.file_path}")
 
-            # Resolve HTML named entities so lxml doesn't drop them during parsing
-            _resolve_html_entities(source.extracted_file_path or source.file_path)
-
             return True
 
     except requests.exceptions.HTTPError as e:
@@ -1030,7 +986,7 @@ def parse_channels_only(source):
 
             # Open the file - no need to check file type since it's always XML now
             logger.debug(f"Opening file for channel parsing: {file_path}")
-            source_file = open(file_path, 'rb')
+            source_file = _open_xmltv_file(file_path)
 
             if process:
                 logger.debug(f"[parse_channels_only] Memory after opening file: {process.memory_info().rss / 1024 / 1024:.2f} MB")
@@ -1413,7 +1369,7 @@ def parse_programs_for_tvg_id(epg_id):
         try:
             # Open the file directly - no need to check compression
             logger.debug(f"Opening file for parsing: {file_path}")
-            source_file = open(file_path, 'rb')
+            source_file = _open_xmltv_file(file_path)
 
             # Stream parse the file using lxml's iterparse
             program_parser = etree.iterparse(source_file, events=('end',), tag='programme',  remove_blank_text=True, recover=True)
@@ -1686,7 +1642,7 @@ def parse_programs_for_source(epg_source, tvg_id=None):
 
         try:
             logger.debug(f"Opening file for single-pass parsing: {file_path}")
-            source_file = open(file_path, 'rb')
+            source_file = _open_xmltv_file(file_path)
 
             # Stream parse the file using lxml's iterparse
             program_parser = etree.iterparse(source_file, events=('end',), tag='programme', remove_blank_text=True, recover=True)

From 763f42cfffd786ba1c5c8c00bdc2df7576157d55 Mon Sep 17 00:00:00 2001
From: None <190783071+CodeBormen@users.noreply.github.com>
Date: Mon, 30 Mar 2026 20:19:27 -0500
Subject: [PATCH 65/67] fix: pass TLS parameters to all external connection
 points in modular mode

- Add setup_pg_ssl_env() to export libpq PGSSL* env vars; all child psql/pg_dump/pg_isready commands inherit TLS automatically

- Move TLS client key permission fix before external PG connections (was running after, defeating the fix)

- Enhance key fix to trigger on ownership mismatch (root-owned 0600 key unreadable by app user)

- Extract key fix to shared script (docker/init/00-fix-pg-ssl-key.sh) sourced by both entrypoints

- Default POSTGRES_PASSWORD to empty in modular mode (cert-only auth sends no spurious password)

- Propagate TLS OPTIONS to backup pg_dump/pg_restore subprocess calls via _get_pg_env()

- Pass SSL kwargs to dropdb management command's psycopg2.connect()

- Add REDIS_SSL_PARAMS to VOD proxy Redis connections missed in original TLS PR

- Add 8-scenario TLS integration test suite (PG mTLS, Redis TLS, verify-full, key fix, Celery, regression)

- Add 6 unit tests for _get_pg_env() and dropdb TLS parameter passing
---
 apps/backups/services.py                   |  28 +-
 apps/backups/tests.py                      |  90 +++
 apps/proxy/vod_proxy/connection_manager.py |   4 +-
 apps/proxy/vod_proxy/views.py              |   4 +-
 core/management/commands/dropdb.py         |   9 +-
 core/tests.py                              |  73 ++
 docker/entrypoint.celery.sh                |  19 +-
 docker/entrypoint.sh                       |  60 +-
 docker/init/00-fix-pg-ssl-key.sh           |  44 +
 docker/tests/test-tls-postgres.sh          | 892 +++++++++++++++++++++
 10 files changed, 1179 insertions(+), 44 deletions(-)
 create mode 100644 docker/init/00-fix-pg-ssl-key.sh
 create mode 100644 docker/tests/test-tls-postgres.sh

diff --git a/apps/backups/services.py b/apps/backups/services.py
index b638e701..72b7b3f2 100644
--- a/apps/backups/services.py
+++ b/apps/backups/services.py
@@ -28,10 +28,34 @@ def _is_postgresql() -> bool:
 
 
 def _get_pg_env() -> dict:
-    """Get environment variables for PostgreSQL commands."""
+    """Get environment variables for PostgreSQL commands.
+
+    Includes PGPASSWORD for password auth and PGSSL* variables for TLS.
+    Reads TLS config from DATABASES['default']['OPTIONS'], which is
+    populated by settings.py when POSTGRES_SSL=true.
+    """
     db_config = settings.DATABASES["default"]
     env = os.environ.copy()
-    env["PGPASSWORD"] = db_config.get("PASSWORD", "")
+
+    password = db_config.get("PASSWORD", "")
+    if password:
+        env["PGPASSWORD"] = password
+    else:
+        env.pop("PGPASSWORD", None)
+
+    # Propagate TLS configuration from Django OPTIONS to libpq env vars.
+    options = db_config.get("OPTIONS", {})
+    _ssl_env_map = {
+        "sslmode": "PGSSLMODE",
+        "sslrootcert": "PGSSLROOTCERT",
+        "sslcert": "PGSSLCERT",
+        "sslkey": "PGSSLKEY",
+    }
+    for opt_key, env_key in _ssl_env_map.items():
+        value = options.get(opt_key)
+        if value:
+            env[env_key] = value
+
     return env
 
 
diff --git a/apps/backups/tests.py b/apps/backups/tests.py
index e5743623..bdea2be5 100644
--- a/apps/backups/tests.py
+++ b/apps/backups/tests.py
@@ -15,6 +15,96 @@ from . import services
 User = get_user_model()
 
 
+class PgEnvTlsTestCase(TestCase):
+    """Test that _get_pg_env includes TLS and password env vars correctly."""
+    databases = []
+
+    @patch('apps.backups.services.settings')
+    def test_pg_env_includes_ssl_vars_when_tls_enabled(self, mock_settings):
+        mock_settings.DATABASES = {
+            "default": {
+                "ENGINE": "django.db.backends.postgresql",
+                "NAME": "testdb",
+                "USER": "testuser",
+                "PASSWORD": "testpass",
+                "HOST": "localhost",
+                "PORT": 5432,
+                "OPTIONS": {
+                    "sslmode": "verify-full",
+                    "sslrootcert": "/certs/ca.crt",
+                    "sslcert": "/certs/client.crt",
+                    "sslkey": "/certs/client.key",
+                },
+            }
+        }
+        env = services._get_pg_env()
+        self.assertEqual(env["PGSSLMODE"], "verify-full")
+        self.assertEqual(env["PGSSLROOTCERT"], "/certs/ca.crt")
+        self.assertEqual(env["PGSSLCERT"], "/certs/client.crt")
+        self.assertEqual(env["PGSSLKEY"], "/certs/client.key")
+        self.assertEqual(env["PGPASSWORD"], "testpass")
+
+    @patch('apps.backups.services.settings')
+    def test_pg_env_no_ssl_vars_when_tls_disabled(self, mock_settings):
+        mock_settings.DATABASES = {
+            "default": {
+                "ENGINE": "django.db.backends.postgresql",
+                "NAME": "testdb",
+                "USER": "testuser",
+                "PASSWORD": "testpass",
+                "HOST": "localhost",
+                "PORT": 5432,
+            }
+        }
+        env = services._get_pg_env()
+        self.assertNotIn("PGSSLMODE", env)
+        self.assertNotIn("PGSSLROOTCERT", env)
+        self.assertNotIn("PGSSLCERT", env)
+        self.assertNotIn("PGSSLKEY", env)
+        self.assertEqual(env["PGPASSWORD"], "testpass")
+
+    @patch('apps.backups.services.settings')
+    def test_pg_env_no_password_when_empty(self, mock_settings):
+        """Cert-only auth: PGPASSWORD must not be set when password is empty."""
+        mock_settings.DATABASES = {
+            "default": {
+                "ENGINE": "django.db.backends.postgresql",
+                "NAME": "testdb",
+                "USER": "testuser",
+                "PASSWORD": "",
+                "HOST": "localhost",
+                "PORT": 5432,
+                "OPTIONS": {"sslmode": "verify-full"},
+            }
+        }
+        env = services._get_pg_env()
+        self.assertNotIn("PGPASSWORD", env)
+        self.assertEqual(env["PGSSLMODE"], "verify-full")
+
+    @patch('apps.backups.services.settings')
+    def test_pg_env_partial_ssl_options(self, mock_settings):
+        """Server-only TLS: only sslmode and CA cert, no client cert/key."""
+        mock_settings.DATABASES = {
+            "default": {
+                "ENGINE": "django.db.backends.postgresql",
+                "NAME": "testdb",
+                "USER": "testuser",
+                "PASSWORD": "pass",
+                "HOST": "localhost",
+                "PORT": 5432,
+                "OPTIONS": {
+                    "sslmode": "verify-ca",
+                    "sslrootcert": "/certs/ca.crt",
+                },
+            }
+        }
+        env = services._get_pg_env()
+        self.assertEqual(env["PGSSLMODE"], "verify-ca")
+        self.assertEqual(env["PGSSLROOTCERT"], "/certs/ca.crt")
+        self.assertNotIn("PGSSLCERT", env)
+        self.assertNotIn("PGSSLKEY", env)
+
+
 class BackupServicesTestCase(TestCase):
     """Test cases for backup services"""
 
diff --git a/apps/proxy/vod_proxy/connection_manager.py b/apps/proxy/vod_proxy/connection_manager.py
index ec963001..1692c315 100644
--- a/apps/proxy/vod_proxy/connection_manager.py
+++ b/apps/proxy/vod_proxy/connection_manager.py
@@ -103,13 +103,15 @@ class PersistentVODConnection:
                     redis_db = int(getattr(settings, 'REDIS_DB', 0))
                     redis_password = getattr(settings, 'REDIS_PASSWORD', '')
                     redis_user = getattr(settings, 'REDIS_USER', '')
+                    ssl_params = getattr(settings, 'REDIS_SSL_PARAMS', {})
                     r = redis.StrictRedis(
                         host=redis_host,
                         port=redis_port,
                         db=redis_db,
                         password=redis_password if redis_password else None,
                         username=redis_user if redis_user else None,
-                        decode_responses=True
+                        decode_responses=True,
+                        **ssl_params
                     )
                     content_length_key = f"vod_content_length:{self.session_id}"
                     stored_length = r.get(content_length_key)
diff --git a/apps/proxy/vod_proxy/views.py b/apps/proxy/vod_proxy/views.py
index 8db51ebd..e6b6e144 100644
--- a/apps/proxy/vod_proxy/views.py
+++ b/apps/proxy/vod_proxy/views.py
@@ -615,13 +615,15 @@ def head_vod(request, content_type, content_id, session_id=None, profile_id=None
             redis_db = int(getattr(settings, 'REDIS_DB', 0))
             redis_password = getattr(settings, 'REDIS_PASSWORD', '')
             redis_user = getattr(settings, 'REDIS_USER', '')
+            ssl_params = getattr(settings, 'REDIS_SSL_PARAMS', {})
             r = redis.StrictRedis(
                 host=redis_host,
                 port=redis_port,
                 db=redis_db,
                 password=redis_password if redis_password else None,
                 username=redis_user if redis_user else None,
-                decode_responses=True
+                decode_responses=True,
+                **ssl_params
             )
             content_length_key = f"vod_content_length:{session_id}"
             r.set(content_length_key, total_size, ex=1800)  # Store for 30 minutes
diff --git a/core/management/commands/dropdb.py b/core/management/commands/dropdb.py
index 1b39a58d..3c390bef 100644
--- a/core/management/commands/dropdb.py
+++ b/core/management/commands/dropdb.py
@@ -15,6 +15,13 @@ class Command(BaseCommand):
         host = db_settings.get('HOST', 'localhost')
         port = db_settings.get('PORT', 5432)
 
+        # Read TLS parameters from Django OPTIONS (populated when POSTGRES_SSL=true)
+        db_options = db_settings.get('OPTIONS', {})
+        ssl_kwargs = {}
+        for key in ('sslmode', 'sslrootcert', 'sslcert', 'sslkey'):
+            if key in db_options:
+                ssl_kwargs[key] = db_options[key]
+
         self.stdout.write(self.style.WARNING(
             f"WARNING: This will irreversibly drop the entire database '{db_name}'!"
         ))
@@ -30,7 +37,7 @@ class Command(BaseCommand):
         maintenance_db = 'postgres'
         try:
             self.stdout.write("Connecting to maintenance database...")
-            conn = psycopg2.connect(dbname=maintenance_db, user=user, password=password, host=host, port=port)
+            conn = psycopg2.connect(dbname=maintenance_db, user=user, password=password, host=host, port=port, **ssl_kwargs)
             conn.autocommit = True
             cur = conn.cursor()
             self.stdout.write(f"Dropping database '{db_name}'...")
diff --git a/core/tests.py b/core/tests.py
index 305ab308..b4770f92 100644
--- a/core/tests.py
+++ b/core/tests.py
@@ -1,3 +1,5 @@
+from unittest.mock import patch, MagicMock
+
 from django.test import TestCase
 
 from core.models import CoreSettings, DVR_SETTINGS_KEY, EPG_SETTINGS_KEY
@@ -148,3 +150,74 @@ class EpgIgnoreListsTest(TestCase):
         ]:
             self._set_epg_field_raw(field, "not a list")
             self.assertEqual(getter(), [])
+
+
+class DropDBCommandTlsTest(TestCase):
+    """Verify dropdb management command passes TLS parameters to psycopg2."""
+    databases = []
+
+    _DB_WITH_TLS = {
+        'default': {
+            'ENGINE': 'django.db.backends.postgresql',
+            'NAME': 'testdb',
+            'USER': 'testuser',
+            'PASSWORD': 'testpass',
+            'HOST': 'localhost',
+            'PORT': 5432,
+            'OPTIONS': {
+                'sslmode': 'verify-full',
+                'sslrootcert': '/certs/ca.crt',
+                'sslcert': '/certs/client.crt',
+                'sslkey': '/certs/client.key',
+            },
+        }
+    }
+
+    _DB_NO_TLS = {
+        'default': {
+            'ENGINE': 'django.db.backends.postgresql',
+            'NAME': 'testdb',
+            'USER': 'testuser',
+            'PASSWORD': 'testpass',
+            'HOST': 'localhost',
+            'PORT': 5432,
+        }
+    }
+
+    @patch('core.management.commands.dropdb.psycopg2.connect')
+    @patch('core.management.commands.dropdb.connection')
+    @patch('builtins.input', return_value='yes')
+    def test_dropdb_passes_ssl_kwargs_when_tls_enabled(self, _inp, _conn, mock_connect):
+        mock_pg = MagicMock()
+        mock_connect.return_value = mock_pg
+        mock_pg.cursor.return_value = MagicMock()
+
+        with self.settings(DATABASES=self._DB_WITH_TLS):
+            from django.core.management import call_command
+            call_command('dropdb')
+
+        mock_connect.assert_called_once_with(
+            dbname='postgres', user='testuser', password='testpass',
+            host='localhost', port=5432,
+            sslmode='verify-full',
+            sslrootcert='/certs/ca.crt',
+            sslcert='/certs/client.crt',
+            sslkey='/certs/client.key',
+        )
+
+    @patch('core.management.commands.dropdb.psycopg2.connect')
+    @patch('core.management.commands.dropdb.connection')
+    @patch('builtins.input', return_value='yes')
+    def test_dropdb_no_ssl_kwargs_when_tls_disabled(self, _inp, _conn, mock_connect):
+        mock_pg = MagicMock()
+        mock_connect.return_value = mock_pg
+        mock_pg.cursor.return_value = MagicMock()
+
+        with self.settings(DATABASES=self._DB_NO_TLS):
+            from django.core.management import call_command
+            call_command('dropdb')
+
+        mock_connect.assert_called_once_with(
+            dbname='postgres', user='testuser', password='testpass',
+            host='localhost', port=5432,
+        )
diff --git a/docker/entrypoint.celery.sh b/docker/entrypoint.celery.sh
index d7a43255..b38b6ac3 100644
--- a/docker/entrypoint.celery.sh
+++ b/docker/entrypoint.celery.sh
@@ -36,22 +36,9 @@ if [ "$USE_LEGACY_NUMPY" = "true" ]; then
     fi
 fi
 
-# Fix TLS client key permissions for PostgreSQL (same issue as web entrypoint).
-# libpq requires 0600 but Docker Desktop mounts files as 0777.
-if [ -n "${POSTGRES_SSL_KEY:-}" ] && [ -f "$POSTGRES_SSL_KEY" ]; then
-    _key_perms=$(stat -c '%a' "$POSTGRES_SSL_KEY" 2>/dev/null)
-    if [ "$_key_perms" != "600" ] && [ "$_key_perms" != "640" ]; then
-        _fixed_key="/data/.pg-client-celery.key"
-        cp "$POSTGRES_SSL_KEY" "$_fixed_key"
-        chmod 600 "$_fixed_key"
-        # Match ownership to the user running Celery if running as root
-        if [ "$(id -u)" = "0" ] && [ -n "${PUID:-}" ]; then
-            chown "${PUID}:${PGID:-$PUID}" "$_fixed_key"
-        fi
-        export POSTGRES_SSL_KEY="$_fixed_key"
-        echo "Fixed PostgreSQL client key permissions (${_key_perms} → 600)"
-    fi
-fi
+# Fix TLS client key permissions/ownership for PostgreSQL.
+FIXED_KEY_PATH="/data/.pg-client-celery.key"
+. /app/docker/init/00-fix-pg-ssl-key.sh
 
 # Wait for migrations to complete
 # Uses 'migrate --check' which exits 0 only when all migrations are applied,
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index 33fe33dd..4bf170c8 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -30,7 +30,13 @@ echo_with_timestamp() {
 # Set PostgreSQL environment variables
 export POSTGRES_DB=${POSTGRES_DB:-dispatcharr}
 export POSTGRES_USER=${POSTGRES_USER:-dispatch}
-export POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-secret}
+# AIO mode: default to 'secret' for internal DB.
+# Modular mode: no default — cert-only auth (mTLS) uses no password.
+if [[ "${DISPATCHARR_ENV:-}" == "modular" ]]; then
+    export POSTGRES_PASSWORD="${POSTGRES_PASSWORD:-}"
+else
+    export POSTGRES_PASSWORD="${POSTGRES_PASSWORD:-secret}"
+fi
 export POSTGRES_HOST=${POSTGRES_HOST:-localhost}
 export POSTGRES_PORT=${POSTGRES_PORT:-5432}
 export PG_VERSION=$(ls /usr/lib/postgresql/ | sort -V | tail -n 1)
@@ -96,6 +102,20 @@ echo "Environment DISPATCHARR_LOG_LEVEL set to: '${DISPATCHARR_LOG_LEVEL}'"
 # Also make the log level available in /etc/environment for all login shells
 #grep -q "DISPATCHARR_LOG_LEVEL" /etc/environment || echo "DISPATCHARR_LOG_LEVEL=${DISPATCHARR_LOG_LEVEL}" >> /etc/environment
 
+# Translate Dispatcharr POSTGRES_SSL_* env vars into libpq-recognized PGSSL*
+# env vars. Called once before any external PostgreSQL connection; all child
+# processes (psql, pg_dump, pg_isready, createdb, dropdb) inherit these
+# automatically. No-op when POSTGRES_SSL is not "true".
+setup_pg_ssl_env() {
+    if [ "${POSTGRES_SSL:-false}" != "true" ]; then
+        return 0
+    fi
+    export PGSSLMODE="${POSTGRES_SSL_MODE:-verify-full}"
+    if [ -n "${POSTGRES_SSL_CA_CERT:-}" ]; then export PGSSLROOTCERT="$POSTGRES_SSL_CA_CERT"; fi
+    if [ -n "${POSTGRES_SSL_CERT:-}" ];    then export PGSSLCERT="$POSTGRES_SSL_CERT"; fi
+    if [ -n "${POSTGRES_SSL_KEY:-}" ];     then export PGSSLKEY="$POSTGRES_SSL_KEY"; fi
+}
+
 # READ-ONLY - don't let users change these
 export POSTGRES_DIR=/data/db
 
@@ -154,6 +174,22 @@ fi
 echo "Starting user setup..."
 . /app/docker/init/01-user-setup.sh
 
+# Fix TLS client key permissions/ownership BEFORE any external PG connections.
+# Must run after 01-user-setup.sh (user exists for chown) and before
+# 02-postgres.sh / pg_isready (which make the first external PG connections).
+FIXED_KEY_PATH="/data/.pg-client.key"
+. /app/docker/init/00-fix-pg-ssl-key.sh
+# Propagate the fixed path to login shells (su - strips env vars)
+if [ "${POSTGRES_SSL_KEY:-}" = "$FIXED_KEY_PATH" ]; then
+    sed -i "/^POSTGRES_SSL_KEY=/d" /etc/environment
+    echo "POSTGRES_SSL_KEY='$FIXED_KEY_PATH'" >> /etc/environment
+    sed -i "s|export POSTGRES_SSL_KEY=.*|export POSTGRES_SSL_KEY='$FIXED_KEY_PATH'|" /etc/profile.d/dispatcharr.sh
+fi
+
+# Export libpq TLS env vars so all subsequent psql/pg_dump/pg_isready calls
+# (in 02-postgres.sh, modular-mode checks, etc.) use TLS automatically.
+setup_pg_ssl_env
+
 # Initialize PostgreSQL (script handles modular vs internal mode internally)
 echo "Setting up PostgreSQL..."
 . /app/docker/init/02-postgres.sh
@@ -237,28 +273,6 @@ if [ "$USE_LEGACY_NUMPY" = "true" ]; then
     fi
 fi
 
-# Fix TLS client key permissions for PostgreSQL.
-# libpq requires the client key to be 0600 or stricter. Volume-mounted files
-# from Windows/macOS hosts often have 0755 permissions, so copy the key to a
-# writable location with correct permissions if needed.
-if [ -n "${POSTGRES_SSL_KEY:-}" ] && [ -f "$POSTGRES_SSL_KEY" ]; then
-    _key_perms=$(stat -c '%a' "$POSTGRES_SSL_KEY" 2>/dev/null)
-    if [ "$_key_perms" != "600" ] && [ "$_key_perms" != "640" ]; then
-        _fixed_key="/data/.pg-client.key"
-        cp "$POSTGRES_SSL_KEY" "$_fixed_key"
-        chmod 600 "$_fixed_key"
-        if [ "$(id -u)" = "0" ] && [ -n "${PUID:-}" ]; then
-            chown "${PUID}:${PGID:-$PUID}" "$_fixed_key"
-        fi
-        export POSTGRES_SSL_KEY="$_fixed_key"
-        # Update /etc/environment so login shells see the fixed path
-        sed -i "/^POSTGRES_SSL_KEY=/d" /etc/environment
-        echo "POSTGRES_SSL_KEY='$_fixed_key'" >> /etc/environment
-        sed -i "s|export POSTGRES_SSL_KEY=.*|export POSTGRES_SSL_KEY='$_fixed_key'|" /etc/profile.d/dispatcharr.sh
-        echo "Fixed PostgreSQL client key permissions (${_key_perms} → 600)"
-    fi
-fi
-
 # Run Django commands as non-root user to prevent permission issues
 su - "$POSTGRES_USER" -c "cd /app && python manage.py migrate --noinput"
 su - "$POSTGRES_USER" -c "cd /app && python manage.py collectstatic --noinput"
diff --git a/docker/init/00-fix-pg-ssl-key.sh b/docker/init/00-fix-pg-ssl-key.sh
new file mode 100644
index 00000000..122815f7
--- /dev/null
+++ b/docker/init/00-fix-pg-ssl-key.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+#
+# Fix TLS client key permissions and ownership for PostgreSQL.
+# libpq requires the client key to be 0600 or stricter.
+#
+# Triggers on:
+#   - Permissions too open (Docker Desktop mounts files as 0777)
+#   - Wrong ownership (Kubernetes secrets / Docker volumes mount as root;
+#     the application user can't read a root-owned 0600 key)
+#   - Read-only source (volume mounted :ro — can't chmod in place)
+#
+# Usage: source this script with FIXED_KEY_PATH set to the destination.
+#   FIXED_KEY_PATH="/data/.pg-client.key"
+#   . /app/docker/init/fix-pg-ssl-key.sh
+#
+# After sourcing, POSTGRES_SSL_KEY is updated to the fixed path if a copy
+# was needed. The caller is responsible for propagating the new value to
+# /etc/environment or profile.d if required.
+
+: "${FIXED_KEY_PATH:?FIXED_KEY_PATH must be set before sourcing fix-pg-ssl-key.sh}"
+
+if [ -n "${POSTGRES_SSL_KEY:-}" ] && [ -f "$POSTGRES_SSL_KEY" ]; then
+    _key_perms=$(stat -c '%a' "$POSTGRES_SSL_KEY" 2>/dev/null)
+    _key_owner=$(stat -c '%u' "$POSTGRES_SSL_KEY" 2>/dev/null)
+    _needs_fix=false
+
+    if [ "$_key_perms" != "600" ] && [ "$_key_perms" != "640" ]; then
+        _needs_fix=true
+    elif [ "$(id -u)" = "0" ] && [ -n "${PUID:-}" ] && [ "$_key_owner" != "$PUID" ]; then
+        _needs_fix=true
+    fi
+
+    if [ "$_needs_fix" = true ]; then
+        cp "$POSTGRES_SSL_KEY" "$FIXED_KEY_PATH"
+        chmod 600 "$FIXED_KEY_PATH"
+        if [ "$(id -u)" = "0" ] && [ -n "${PUID:-}" ]; then
+            chown "${PUID}:${PGID:-$PUID}" "$FIXED_KEY_PATH"
+        fi
+        export POSTGRES_SSL_KEY="$FIXED_KEY_PATH"
+        echo "Fixed PostgreSQL client key (perms: ${_key_perms}, owner: ${_key_owner} → ${PUID:-root}:600)"
+    fi
+
+    unset _key_perms _key_owner _needs_fix
+fi
diff --git a/docker/tests/test-tls-postgres.sh b/docker/tests/test-tls-postgres.sh
new file mode 100644
index 00000000..81230178
--- /dev/null
+++ b/docker/tests/test-tls-postgres.sh
@@ -0,0 +1,892 @@
+#!/bin/bash
+#
+# Integration test suite for TLS/mTLS in modular mode.
+# Validates that Dispatcharr connects correctly to external PostgreSQL and
+# Redis services using various TLS configurations.
+#
+# Prerequisites:
+#   - Docker Desktop (or Docker Engine) running
+#   - Internet access (pulls postgres:17, redis:latest)
+#   - ~10-15 minutes for a full run
+#
+# Usage:
+#   cd <repo_root>
+#   bash docker/tests/test-tls-postgres.sh [--skip-build] [--keep-on-fail] [scenario_name]
+#
+# Options:
+#   --skip-build    Skip Docker image build (use existing dispatcharr:tls-test image)
+#   --keep-on-fail  Don't clean up containers/volumes on failure (for debugging)
+#   scenario_name   Run only the named scenario
+#
+# Scenarios:
+#   modular_mtls_no_password      PG mTLS cert-only auth, no password
+#   modular_mtls_with_password    PG mTLS + password auth combined
+#   modular_tls_server_only       PG server-side TLS only (no client cert)
+#   modular_tls_key_permission    PG mTLS with 0777 client key (Docker Desktop scenario)
+#   modular_no_tls_regression     Non-TLS modular mode still works
+#   modular_pg_verify_full        PG mTLS with verify-full (CN must match hostname)
+#   modular_redis_tls             Redis with TLS (server-side verification)
+#   modular_full_tls_celery       PG mTLS + Redis TLS with separate Celery container
+#
+# Exit codes:
+#   0  All tests passed
+#   1  One or more tests failed (or build failed)
+
+set -uo pipefail
+
+# Prevent Git Bash (MINGW) from converting Unix paths
+export MSYS_NO_PATHCONV=1
+
+###############################################################################
+# Configuration
+###############################################################################
+IMAGE_NAME="dispatcharr:tls-test"
+TEST_PREFIX="tls_test"
+STARTUP_TIMEOUT=120
+SKIP_BUILD=false
+KEEP_ON_FAIL=false
+SINGLE_SCENARIO=""
+PASS=0
+FAIL=0
+SKIP=0
+ERRORS=()
+CERT_DIR=""
+
+# Colors (disabled if not a terminal)
+if [ -t 1 ]; then
+    RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
+    CYAN='\033[0;36m'; BOLD='\033[1m'; NC='\033[0m'
+else
+    RED=''; GREEN=''; YELLOW=''; CYAN=''; BOLD=''; NC=''
+fi
+
+###############################################################################
+# Parse arguments
+###############################################################################
+for arg in "$@"; do
+    case "$arg" in
+        --skip-build)   SKIP_BUILD=true ;;
+        --keep-on-fail) KEEP_ON_FAIL=true ;;
+        -*)             echo "Unknown option: $arg"; exit 1 ;;
+        *)              SINGLE_SCENARIO="$arg" ;;
+    esac
+done
+
+###############################################################################
+# Helpers
+###############################################################################
+CURRENT_SCENARIO=""
+CLEANUP_ITEMS=()
+
+log_pass() { echo -e "  ${GREEN}✅ $1${NC}"; PASS=$((PASS + 1)); }
+log_fail() { echo -e "  ${RED}❌ $1${NC}"; FAIL=$((FAIL + 1)); ERRORS+=("[$CURRENT_SCENARIO] $1"); }
+log_skip() { echo -e "  ${YELLOW}⏭️  $1${NC}"; SKIP=$((SKIP + 1)); }
+log_info() { echo -e "  ${CYAN}ℹ️  $1${NC}"; }
+section()  { echo -e "\n${BOLD}━━━ $1 ━━━${NC}"; SCENARIO_FAIL_BEFORE=$FAIL; }
+
+track_container() { CLEANUP_ITEMS+=("container:$1"); }
+track_volume()    { CLEANUP_ITEMS+=("volume:$1"); }
+track_network()   { CLEANUP_ITEMS+=("network:$1"); }
+
+fresh_volume() {
+    local vol="$1"
+    docker rm -f $(docker ps -aq --filter "volume=${vol}") 2>/dev/null || true
+    docker volume rm "$vol" 2>/dev/null || true
+    docker volume create "$vol" >/dev/null
+    track_volume "$vol"
+}
+
+cleanup_scenario() {
+    if [ "$KEEP_ON_FAIL" = true ] && [ ${#ERRORS[@]} -gt 0 ]; then
+        log_info "Keeping resources for debugging (--keep-on-fail)"
+        CLEANUP_ITEMS=()
+        return
+    fi
+    for item in "${CLEANUP_ITEMS[@]}"; do
+        local type="${item%%:*}"
+        local name="${item#*:}"
+        case "$type" in
+            container) docker stop "$name" 2>/dev/null; docker rm -f "$name" 2>/dev/null ;;
+            volume)    docker volume rm "$name" 2>/dev/null ;;
+            network)   docker network rm "$name" 2>/dev/null ;;
+        esac
+    done
+    CLEANUP_ITEMS=()
+}
+
+trap 'cleanup_scenario' EXIT
+
+wait_for_ready() {
+    local name="$1"
+    local timeout="${2:-$STARTUP_TIMEOUT}"
+    local elapsed=0
+
+    while [ $elapsed -lt $timeout ]; do
+        if ! docker ps -q -f "name=^${name}$" 2>/dev/null | grep -q .; then
+            echo "  Container $name exited unexpectedly"
+            return 1
+        fi
+        if docker logs "$name" 2>&1 | grep -q "uwsgi started with PID"; then
+            return 0
+        fi
+        sleep 3
+        ((elapsed+=3))
+    done
+    echo "  Timeout (${timeout}s) waiting for $name"
+    return 1
+}
+
+_capture_logs() {
+    local container="$1" logfile="$2"
+    docker logs "$container" > "$logfile" 2>&1
+}
+
+check_log_contains() {
+    local container="$1" pattern="$2" description="$3"
+    local tmplog; tmplog=$(mktemp)
+    _capture_logs "$container" "$tmplog"
+    if grep -q "$pattern" "$tmplog"; then
+        log_pass "$description"
+    else
+        log_fail "$description (pattern not found: $pattern)"
+    fi
+    rm -f "$tmplog"
+}
+
+check_log_absent() {
+    local container="$1" pattern="$2" description="$3"
+    local tmplog; tmplog=$(mktemp)
+    _capture_logs "$container" "$tmplog"
+    if grep -q "$pattern" "$tmplog"; then
+        log_fail "$description (unexpected pattern found: $pattern)"
+    else
+        log_pass "$description"
+    fi
+    rm -f "$tmplog"
+}
+
+check_migrations_done() {
+    local container="$1"
+    local tmplog; tmplog=$(mktemp)
+    _capture_logs "$container" "$tmplog"
+    if grep -qE "Running migrations|No migrations to apply|Operations to perform|Applying .+\.\.\. OK" "$tmplog"; then
+        log_pass "Django migrations completed"
+    elif grep -q "uwsgi started with PID" "$tmplog"; then
+        log_pass "Django migrations completed (confirmed via uwsgi startup)"
+    else
+        log_fail "Django migrations did not complete"
+    fi
+    rm -f "$tmplog"
+}
+
+check_no_permission_errors() {
+    local container="$1"
+    local tmplog; tmplog=$(mktemp)
+    _capture_logs "$container" "$tmplog"
+    local errors
+    errors=$(grep -iE "permission denied|operation not permitted" "$tmplog" \
+        | grep -v "GPU acceleration" | grep -v "Warning:" | head -5)
+    rm -f "$tmplog"
+    if [ -n "$errors" ]; then
+        log_fail "Permission errors in logs:"
+        echo "$errors" | while read -r line; do echo "    $line"; done
+    else
+        log_pass "No permission errors in logs"
+    fi
+}
+
+dump_logs_on_fail() {
+    local container="$1"
+    if [ $FAIL -gt ${SCENARIO_FAIL_BEFORE:-0} ]; then
+        echo -e "  ${YELLOW}--- Container logs ($container) ---${NC}"
+        docker logs "$container" 2>&1 | tail -30 | sed 's/^/    /'
+        echo -e "  ${YELLOW}--- End logs ---${NC}"
+    fi
+}
+
+###############################################################################
+# Certificate generation
+###############################################################################
+generate_test_certs() {
+    CERT_DIR=$(mktemp -d)
+    log_info "Generating test certificates in $CERT_DIR"
+
+    # Generate certs inside a container for cross-platform compatibility.
+    # Shared CA for both PG and Redis. CN of server certs must match their
+    # Docker container hostnames for verify-full mode.
+    docker run --rm --entrypoint sh \
+        -v "$(cygpath -w "$CERT_DIR" 2>/dev/null || echo "$CERT_DIR"):/certs" \
+        -w /certs alpine/openssl -c '
+        # Shared CA
+        openssl req -new -x509 -days 1 -nodes \
+            -keyout ca.key -out ca.crt -subj "/CN=Test CA" 2>/dev/null &&
+
+        # PostgreSQL server cert (CN = PG container hostname)
+        openssl req -new -nodes \
+            -keyout pg-server.key -out pg-server.csr -subj "/CN='"${TEST_PREFIX}"'_pg" 2>/dev/null &&
+        openssl x509 -req -days 1 -in pg-server.csr \
+            -CA ca.crt -CAkey ca.key -CAcreateserial -out pg-server.crt 2>/dev/null &&
+        # PostgreSQL client cert (CN = POSTGRES_USER)
+        openssl req -new -nodes \
+            -keyout pg-client.key -out pg-client.csr -subj "/CN=dispatch" 2>/dev/null &&
+        openssl x509 -req -days 1 -in pg-client.csr \
+            -CA ca.crt -CAkey ca.key -CAcreateserial -out pg-client.crt 2>/dev/null &&
+
+        # Redis server cert (CN = Redis container hostname)
+        openssl req -new -nodes \
+            -keyout redis-server.key -out redis-server.csr -subj "/CN='"${TEST_PREFIX}"'_redis" 2>/dev/null &&
+        openssl x509 -req -days 1 -in redis-server.csr \
+            -CA ca.crt -CAkey ca.key -CAcreateserial -out redis-server.crt 2>/dev/null &&
+
+        # Backwards-compat aliases (existing PG-only scenarios use these names)
+        cp pg-server.crt server.crt && cp pg-server.key server.key &&
+        cp pg-client.crt client.crt && cp pg-client.key client.key &&
+
+        chmod 600 pg-server.key pg-client.key redis-server.key server.key client.key
+    ' || { log_fail "Certificate generation failed"; return 1; }
+
+    log_pass "Test certificates generated"
+}
+
+###############################################################################
+# Start a TLS-enabled Redis container
+###############################################################################
+start_tls_redis() {
+    local name="$1" net="$2"
+
+    local cert_mount
+    cert_mount="$(cygpath -w "$CERT_DIR" 2>/dev/null || echo "$CERT_DIR")"
+
+    # Redis needs certs owned by redis user (uid 999 in the official image).
+    # Mount certs, copy to a writable location, fix ownership, then start
+    # with TLS flags.
+    docker run -d --name "$name" --network "$net" \
+        -v "${cert_mount}:/certs:ro" \
+        redis:latest \
+        sh -c '
+            cp /certs/redis-server.crt /certs/redis-server.key /certs/ca.crt /tmp/ &&
+            chmod 600 /tmp/redis-server.key &&
+            chown redis:redis /tmp/redis-server.crt /tmp/redis-server.key /tmp/ca.crt &&
+            exec redis-server \
+                --tls-port 6379 --port 0 \
+                --tls-cert-file /tmp/redis-server.crt \
+                --tls-key-file /tmp/redis-server.key \
+                --tls-ca-cert-file /tmp/ca.crt \
+                --tls-auth-clients no
+        ' >/dev/null
+
+    # Wait for Redis TLS to be ready
+    local elapsed=0
+    while [ $elapsed -lt 20 ]; do
+        if docker exec "$name" redis-cli --tls \
+            --cert /certs/redis-server.crt --key /certs/redis-server.key --cacert /certs/ca.crt \
+            ping 2>/dev/null | grep -q "PONG"; then
+            break
+        fi
+        sleep 2; elapsed=$((elapsed + 2))
+    done
+}
+
+###############################################################################
+# Start a TLS-enabled PostgreSQL container
+###############################################################################
+start_tls_postgres() {
+    local name="$1" net="$2" hba_auth="$3"
+
+    local cert_mount
+    cert_mount="$(cygpath -w "$CERT_DIR" 2>/dev/null || echo "$CERT_DIR")"
+
+    docker run -d --name "$name" --network "$net" \
+        -e POSTGRES_USER=dispatch \
+        -e POSTGRES_PASSWORD=tempsetup \
+        -e POSTGRES_DB=dispatcharr \
+        -v "${cert_mount}:/certs:ro" \
+        postgres:17 >/dev/null
+
+    # Wait for PG to initialize
+    local elapsed=0
+    while [ $elapsed -lt 30 ]; do
+        if docker exec "$name" su postgres -c "/usr/lib/postgresql/17/bin/pg_isready" 2>/dev/null | grep -q "accepting"; then
+            break
+        fi
+        sleep 2; ((elapsed+=2))
+    done
+
+    # Configure SSL and pg_hba.conf
+    docker exec "$name" bash -c "
+        cp /certs/server.crt /certs/server.key /certs/ca.crt /var/lib/postgresql/
+        chown postgres:postgres /var/lib/postgresql/server.crt /var/lib/postgresql/server.key /var/lib/postgresql/ca.crt
+        chmod 600 /var/lib/postgresql/server.key
+        echo \"ssl = on\" >> /var/lib/postgresql/data/postgresql.conf
+        echo \"ssl_cert_file = '/var/lib/postgresql/server.crt'\" >> /var/lib/postgresql/data/postgresql.conf
+        echo \"ssl_key_file = '/var/lib/postgresql/server.key'\" >> /var/lib/postgresql/data/postgresql.conf
+        echo \"ssl_ca_file = '/var/lib/postgresql/ca.crt'\" >> /var/lib/postgresql/data/postgresql.conf
+        cat > /var/lib/postgresql/data/pg_hba.conf << HBA
+local   all   all   trust
+hostssl all   all   0.0.0.0/0   ${hba_auth}
+hostssl all   all   ::0/0       ${hba_auth}
+HBA
+        su postgres -c '/usr/lib/postgresql/17/bin/pg_ctl reload -D /var/lib/postgresql/data'
+    " >/dev/null 2>&1
+    sleep 1
+}
+
+###############################################################################
+# Test scenarios
+###############################################################################
+
+test_modular_mtls_no_password() {
+    CURRENT_SCENARIO="modular_mtls_no_password"
+    section "Modular mode — mTLS cert-only auth (no password)"
+
+    local name="${TEST_PREFIX}_app"
+    local pg_name="${TEST_PREFIX}_pg"
+    local redis_name="${TEST_PREFIX}_redis"
+    local net="${TEST_PREFIX}_net"
+    local vol="${name}_data"
+    cleanup_scenario
+
+    docker network create "$net" >/dev/null 2>&1
+    fresh_volume "$vol"
+    track_network "$net"
+    track_container "$pg_name"; track_container "$redis_name"; track_container "$name"
+
+    start_tls_postgres "$pg_name" "$net" "cert"
+
+    docker run -d --name "$redis_name" --network "$net" redis:latest >/dev/null
+
+    local cert_mount
+    cert_mount="$(cygpath -w "$CERT_DIR" 2>/dev/null || echo "$CERT_DIR")"
+
+    # No POSTGRES_PASSWORD — cert-only auth
+    docker run -d --name "$name" --network "$net" \
+        -e DISPATCHARR_ENV=modular \
+        -e POSTGRES_HOST="$pg_name" \
+        -e POSTGRES_PORT=5432 \
+        -e POSTGRES_USER=dispatch \
+        -e POSTGRES_DB=dispatcharr \
+        -e REDIS_HOST="$redis_name" \
+        -e POSTGRES_SSL=true \
+        -e POSTGRES_SSL_MODE=verify-ca \
+        -e POSTGRES_SSL_CA_CERT=/certs/ca.crt \
+        -e POSTGRES_SSL_CERT=/certs/client.crt \
+        -e POSTGRES_SSL_KEY=/certs/client.key \
+        -v "${cert_mount}:/certs:ro" \
+        -v "${vol}:/data" \
+        "$IMAGE_NAME" >/dev/null
+
+    if wait_for_ready "$name"; then
+        log_pass "Container started with mTLS cert-only auth"
+        check_log_contains "$name" "PostgreSQL version check passed" \
+            "Version check passed with mTLS"
+        check_log_contains "$name" "PostgreSQL TLS: enabled" \
+            "Django sees TLS enabled"
+        check_migrations_done "$name"
+        check_no_permission_errors "$name"
+    else
+        log_fail "Container failed to start with mTLS cert-only auth"
+    fi
+    dump_logs_on_fail "$name"
+    cleanup_scenario
+}
+
+test_modular_mtls_with_password() {
+    CURRENT_SCENARIO="modular_mtls_with_password"
+    section "Modular mode — mTLS + password auth"
+
+    local name="${TEST_PREFIX}_app"
+    local pg_name="${TEST_PREFIX}_pg"
+    local redis_name="${TEST_PREFIX}_redis"
+    local net="${TEST_PREFIX}_net"
+    local vol="${name}_data"
+    cleanup_scenario
+
+    docker network create "$net" >/dev/null 2>&1
+    fresh_volume "$vol"
+    track_network "$net"
+    track_container "$pg_name"; track_container "$redis_name"; track_container "$name"
+
+    # cert + md5 password
+    start_tls_postgres "$pg_name" "$net" "cert"
+
+    docker run -d --name "$redis_name" --network "$net" redis:latest >/dev/null
+
+    local cert_mount
+    cert_mount="$(cygpath -w "$CERT_DIR" 2>/dev/null || echo "$CERT_DIR")"
+
+    docker run -d --name "$name" --network "$net" \
+        -e DISPATCHARR_ENV=modular \
+        -e POSTGRES_HOST="$pg_name" \
+        -e POSTGRES_PORT=5432 \
+        -e POSTGRES_USER=dispatch \
+        -e POSTGRES_PASSWORD=tempsetup \
+        -e POSTGRES_DB=dispatcharr \
+        -e REDIS_HOST="$redis_name" \
+        -e POSTGRES_SSL=true \
+        -e POSTGRES_SSL_MODE=verify-ca \
+        -e POSTGRES_SSL_CA_CERT=/certs/ca.crt \
+        -e POSTGRES_SSL_CERT=/certs/client.crt \
+        -e POSTGRES_SSL_KEY=/certs/client.key \
+        -v "${cert_mount}:/certs:ro" \
+        -v "${vol}:/data" \
+        "$IMAGE_NAME" >/dev/null
+
+    if wait_for_ready "$name"; then
+        log_pass "Container started with mTLS + password"
+        check_log_contains "$name" "PostgreSQL version check passed" \
+            "Version check passed with mTLS + password"
+        check_migrations_done "$name"
+    else
+        log_fail "Container failed to start with mTLS + password"
+    fi
+    dump_logs_on_fail "$name"
+    cleanup_scenario
+}
+
+test_modular_tls_server_only() {
+    CURRENT_SCENARIO="modular_tls_server_only"
+    section "Modular mode — server-only TLS (no client cert)"
+
+    local name="${TEST_PREFIX}_app"
+    local pg_name="${TEST_PREFIX}_pg"
+    local redis_name="${TEST_PREFIX}_redis"
+    local net="${TEST_PREFIX}_net"
+    local vol="${name}_data"
+    cleanup_scenario
+
+    docker network create "$net" >/dev/null 2>&1
+    fresh_volume "$vol"
+    track_network "$net"
+    track_container "$pg_name"; track_container "$redis_name"; track_container "$name"
+
+    # md5 auth over TLS (no client cert required)
+    start_tls_postgres "$pg_name" "$net" "md5"
+
+    docker run -d --name "$redis_name" --network "$net" redis:latest >/dev/null
+
+    local cert_mount
+    cert_mount="$(cygpath -w "$CERT_DIR" 2>/dev/null || echo "$CERT_DIR")"
+
+    docker run -d --name "$name" --network "$net" \
+        -e DISPATCHARR_ENV=modular \
+        -e POSTGRES_HOST="$pg_name" \
+        -e POSTGRES_PORT=5432 \
+        -e POSTGRES_USER=dispatch \
+        -e POSTGRES_PASSWORD=tempsetup \
+        -e POSTGRES_DB=dispatcharr \
+        -e REDIS_HOST="$redis_name" \
+        -e POSTGRES_SSL=true \
+        -e POSTGRES_SSL_MODE=verify-ca \
+        -e POSTGRES_SSL_CA_CERT=/certs/ca.crt \
+        -v "${cert_mount}:/certs:ro" \
+        -v "${vol}:/data" \
+        "$IMAGE_NAME" >/dev/null
+
+    if wait_for_ready "$name"; then
+        log_pass "Container started with server-only TLS"
+        check_log_contains "$name" "PostgreSQL version check passed" \
+            "Version check passed with server-only TLS"
+        check_migrations_done "$name"
+    else
+        log_fail "Container failed to start with server-only TLS"
+    fi
+    dump_logs_on_fail "$name"
+    cleanup_scenario
+}
+
+test_modular_tls_key_permission() {
+    CURRENT_SCENARIO="modular_tls_key_permission"
+    section "Modular mode — mTLS with 0777 client key (Docker Desktop scenario)"
+
+    local name="${TEST_PREFIX}_app"
+    local pg_name="${TEST_PREFIX}_pg"
+    local redis_name="${TEST_PREFIX}_redis"
+    local net="${TEST_PREFIX}_net"
+    local vol="${name}_data"
+    cleanup_scenario
+
+    docker network create "$net" >/dev/null 2>&1
+    fresh_volume "$vol"
+    track_network "$net"
+    track_container "$pg_name"; track_container "$redis_name"; track_container "$name"
+
+    start_tls_postgres "$pg_name" "$net" "cert"
+
+    docker run -d --name "$redis_name" --network "$net" redis:latest >/dev/null
+
+    # Create a copy of certs with 0777 key permissions
+    local bad_perms_dir
+    bad_perms_dir=$(mktemp -d)
+    cp "$CERT_DIR"/ca.crt "$CERT_DIR"/client.crt "$CERT_DIR"/client.key "$bad_perms_dir/"
+    chmod 777 "$bad_perms_dir/client.key"
+
+    local cert_mount
+    cert_mount="$(cygpath -w "$bad_perms_dir" 2>/dev/null || echo "$bad_perms_dir")"
+
+    docker run -d --name "$name" --network "$net" \
+        -e DISPATCHARR_ENV=modular \
+        -e POSTGRES_HOST="$pg_name" \
+        -e POSTGRES_PORT=5432 \
+        -e POSTGRES_USER=dispatch \
+        -e POSTGRES_DB=dispatcharr \
+        -e REDIS_HOST="$redis_name" \
+        -e POSTGRES_SSL=true \
+        -e POSTGRES_SSL_MODE=verify-ca \
+        -e POSTGRES_SSL_CA_CERT=/certs/ca.crt \
+        -e POSTGRES_SSL_CERT=/certs/client.crt \
+        -e POSTGRES_SSL_KEY=/certs/client.key \
+        -v "${cert_mount}:/certs:ro" \
+        -v "${vol}:/data" \
+        "$IMAGE_NAME" >/dev/null
+
+    if wait_for_ready "$name"; then
+        log_pass "Container started with 0777 client key"
+        check_log_contains "$name" "Fixed PostgreSQL client key" \
+            "Key permission fix triggered"
+        check_log_contains "$name" "PostgreSQL version check passed" \
+            "Version check passed after key fix"
+        check_migrations_done "$name"
+    else
+        log_fail "Container failed to start with 0777 client key"
+    fi
+    dump_logs_on_fail "$name"
+    rm -rf "$bad_perms_dir"
+    cleanup_scenario
+}
+
+test_modular_no_tls_regression() {
+    CURRENT_SCENARIO="modular_no_tls_regression"
+    section "Modular mode — no TLS (regression check)"
+
+    local name="${TEST_PREFIX}_app"
+    local pg_name="${TEST_PREFIX}_pg"
+    local redis_name="${TEST_PREFIX}_redis"
+    local net="${TEST_PREFIX}_net"
+    local vol="${name}_data"
+    cleanup_scenario
+
+    docker network create "$net" >/dev/null 2>&1
+    fresh_volume "$vol"
+    track_network "$net"
+    track_container "$pg_name"; track_container "$redis_name"; track_container "$name"
+
+    # Plain PostgreSQL — no TLS
+    docker run -d --name "$pg_name" --network "$net" \
+        -e POSTGRES_USER=dispatch \
+        -e POSTGRES_PASSWORD=secret \
+        -e POSTGRES_DB=dispatcharr \
+        postgres:17 >/dev/null
+
+    local elapsed=0
+    while [ $elapsed -lt 30 ]; do
+        if docker exec "$pg_name" su postgres -c "/usr/lib/postgresql/17/bin/pg_isready" 2>/dev/null | grep -q "accepting"; then
+            break
+        fi
+        sleep 2; ((elapsed+=2))
+    done
+
+    docker run -d --name "$redis_name" --network "$net" redis:latest >/dev/null
+
+    docker run -d --name "$name" --network "$net" \
+        -e DISPATCHARR_ENV=modular \
+        -e POSTGRES_HOST="$pg_name" \
+        -e POSTGRES_PORT=5432 \
+        -e POSTGRES_USER=dispatch \
+        -e POSTGRES_PASSWORD=secret \
+        -e POSTGRES_DB=dispatcharr \
+        -e REDIS_HOST="$redis_name" \
+        -v "${vol}:/data" \
+        "$IMAGE_NAME" >/dev/null
+
+    if wait_for_ready "$name"; then
+        log_pass "Container started without TLS (regression check)"
+        check_log_contains "$name" "PostgreSQL version check passed" \
+            "Version check passed without TLS"
+        check_log_absent "$name" "Fixed PostgreSQL client key" \
+            "No key fix when TLS disabled"
+        check_migrations_done "$name"
+    else
+        log_fail "Container failed to start without TLS"
+    fi
+    dump_logs_on_fail "$name"
+    cleanup_scenario
+}
+
+test_modular_pg_verify_full() {
+    CURRENT_SCENARIO="modular_pg_verify_full"
+    section "Modular mode — PG mTLS with verify-full (CN must match hostname)"
+
+    local name="${TEST_PREFIX}_app"
+    local pg_name="${TEST_PREFIX}_pg"
+    local redis_name="${TEST_PREFIX}_redis"
+    local net="${TEST_PREFIX}_net"
+    local vol="${name}_data"
+    cleanup_scenario
+
+    docker network create "$net" >/dev/null 2>&1
+    fresh_volume "$vol"
+    track_network "$net"
+    track_container "$pg_name"; track_container "$redis_name"; track_container "$name"
+
+    start_tls_postgres "$pg_name" "$net" "cert"
+
+    docker run -d --name "$redis_name" --network "$net" redis:latest >/dev/null
+
+    local cert_mount
+    cert_mount="$(cygpath -w "$CERT_DIR" 2>/dev/null || echo "$CERT_DIR")"
+
+    # verify-full requires server cert CN to match the hostname used to connect.
+    # Our PG server cert CN is "${TEST_PREFIX}_pg", which matches the container name
+    # used in POSTGRES_HOST.
+    docker run -d --name "$name" --network "$net" \
+        -e DISPATCHARR_ENV=modular \
+        -e POSTGRES_HOST="$pg_name" \
+        -e POSTGRES_PORT=5432 \
+        -e POSTGRES_USER=dispatch \
+        -e POSTGRES_DB=dispatcharr \
+        -e REDIS_HOST="$redis_name" \
+        -e POSTGRES_SSL=true \
+        -e POSTGRES_SSL_MODE=verify-full \
+        -e POSTGRES_SSL_CA_CERT=/certs/ca.crt \
+        -e POSTGRES_SSL_CERT=/certs/client.crt \
+        -e POSTGRES_SSL_KEY=/certs/client.key \
+        -v "${cert_mount}:/certs:ro" \
+        -v "${vol}:/data" \
+        "$IMAGE_NAME" >/dev/null
+
+    if wait_for_ready "$name"; then
+        log_pass "Container started with verify-full"
+        check_log_contains "$name" "PostgreSQL version check passed" \
+            "Version check passed with verify-full"
+        check_log_contains "$name" "sslmode=verify-full" \
+            "Django reports verify-full mode"
+        check_migrations_done "$name"
+    else
+        log_fail "Container failed to start with verify-full"
+    fi
+    dump_logs_on_fail "$name"
+    cleanup_scenario
+}
+
+test_modular_redis_tls() {
+    CURRENT_SCENARIO="modular_redis_tls"
+    section "Modular mode — Redis with TLS"
+
+    local name="${TEST_PREFIX}_app"
+    local pg_name="${TEST_PREFIX}_pg"
+    local redis_name="${TEST_PREFIX}_redis"
+    local net="${TEST_PREFIX}_net"
+    local vol="${name}_data"
+    cleanup_scenario
+
+    docker network create "$net" >/dev/null 2>&1
+    fresh_volume "$vol"
+    track_network "$net"
+    track_container "$pg_name"; track_container "$redis_name"; track_container "$name"
+
+    # Plain PG (no TLS) — isolate Redis TLS testing
+    docker run -d --name "$pg_name" --network "$net" \
+        -e POSTGRES_USER=dispatch \
+        -e POSTGRES_PASSWORD=secret \
+        -e POSTGRES_DB=dispatcharr \
+        postgres:17 >/dev/null
+
+    local elapsed=0
+    while [ $elapsed -lt 30 ]; do
+        if docker exec "$pg_name" su postgres -c "/usr/lib/postgresql/17/bin/pg_isready" 2>/dev/null | grep -q "accepting"; then
+            break
+        fi
+        sleep 2; elapsed=$((elapsed + 2))
+    done
+
+    start_tls_redis "$redis_name" "$net"
+
+    local cert_mount
+    cert_mount="$(cygpath -w "$CERT_DIR" 2>/dev/null || echo "$CERT_DIR")"
+
+    docker run -d --name "$name" --network "$net" \
+        -e DISPATCHARR_ENV=modular \
+        -e POSTGRES_HOST="$pg_name" \
+        -e POSTGRES_PORT=5432 \
+        -e POSTGRES_USER=dispatch \
+        -e POSTGRES_PASSWORD=secret \
+        -e POSTGRES_DB=dispatcharr \
+        -e REDIS_HOST="$redis_name" \
+        -e REDIS_SSL=true \
+        -e REDIS_SSL_VERIFY=false \
+        -e REDIS_SSL_CA_CERT=/certs/ca.crt \
+        -v "${cert_mount}:/certs:ro" \
+        -v "${vol}:/data" \
+        "$IMAGE_NAME" >/dev/null
+
+    if wait_for_ready "$name"; then
+        log_pass "Container started with Redis TLS"
+        check_log_contains "$name" "Redis TLS: enabled" \
+            "Django reports Redis TLS enabled"
+        check_log_contains "$name" "Redis at ${redis_name}" \
+            "Redis connected via TLS"
+        check_migrations_done "$name"
+    else
+        log_fail "Container failed to start with Redis TLS"
+    fi
+    dump_logs_on_fail "$name"
+    cleanup_scenario
+}
+
+test_modular_full_tls_celery() {
+    CURRENT_SCENARIO="modular_full_tls_celery"
+    section "Modular mode — PG mTLS + Redis TLS with Celery container"
+
+    local name="${TEST_PREFIX}_app"
+    local celery_name="${TEST_PREFIX}_celery"
+    local pg_name="${TEST_PREFIX}_pg"
+    local redis_name="${TEST_PREFIX}_redis"
+    local net="${TEST_PREFIX}_net"
+    local vol="${name}_data"
+    cleanup_scenario
+
+    docker network create "$net" >/dev/null 2>&1
+    fresh_volume "$vol"
+    track_network "$net"
+    track_container "$pg_name"; track_container "$redis_name"
+    track_container "$name"; track_container "$celery_name"
+
+    start_tls_postgres "$pg_name" "$net" "cert"
+    start_tls_redis "$redis_name" "$net"
+
+    local cert_mount
+    cert_mount="$(cygpath -w "$CERT_DIR" 2>/dev/null || echo "$CERT_DIR")"
+
+    # Shared env vars for both web and celery containers
+    local -a tls_env=(
+        -e DISPATCHARR_ENV=modular
+        -e POSTGRES_HOST="$pg_name"
+        -e POSTGRES_PORT=5432
+        -e POSTGRES_USER=dispatch
+        -e POSTGRES_DB=dispatcharr
+        -e REDIS_HOST="$redis_name"
+        -e POSTGRES_SSL=true
+        -e POSTGRES_SSL_MODE=verify-ca
+        -e POSTGRES_SSL_CA_CERT=/certs/ca.crt
+        -e POSTGRES_SSL_CERT=/certs/client.crt
+        -e POSTGRES_SSL_KEY=/certs/client.key
+        -e REDIS_SSL=true
+        -e REDIS_SSL_VERIFY=false
+        -e REDIS_SSL_CA_CERT=/certs/ca.crt
+    )
+
+    # Start web container first (generates JWT, runs migrations)
+    docker run -d --name "$name" --network "$net" \
+        "${tls_env[@]}" \
+        -v "${cert_mount}:/certs:ro" \
+        -v "${vol}:/data" \
+        "$IMAGE_NAME" >/dev/null
+
+    if ! wait_for_ready "$name"; then
+        log_fail "Web container failed to start with full TLS"
+        dump_logs_on_fail "$name"
+        cleanup_scenario
+        return
+    fi
+    log_pass "Web container started with PG mTLS + Redis TLS"
+
+    # Start Celery container (shares /data volume for JWT, waits for migrations)
+    docker run -d --name "$celery_name" --network "$net" \
+        "${tls_env[@]}" \
+        -e DJANGO_SETTINGS_MODULE=dispatcharr.settings \
+        -e PYTHONUNBUFFERED=1 \
+        -v "${cert_mount}:/certs:ro" \
+        -v "${vol}:/data" \
+        --entrypoint /app/docker/entrypoint.celery.sh \
+        "$IMAGE_NAME" >/dev/null
+
+    # Wait for Celery to start (look for "starting Celery" message)
+    local elapsed=0
+    local celery_ok=false
+    while [ $elapsed -lt 90 ]; do
+        if ! docker ps -q -f "name=^${celery_name}$" 2>/dev/null | grep -q .; then
+            echo "  Celery container exited unexpectedly"
+            break
+        fi
+        if docker logs "$celery_name" 2>&1 | grep -q "starting Celery"; then
+            celery_ok=true
+            break
+        fi
+        sleep 3; elapsed=$((elapsed + 3))
+    done
+
+    if [ "$celery_ok" = true ]; then
+        log_pass "Celery container started with PG mTLS + Redis TLS"
+        check_log_contains "$celery_name" "Migrations complete" \
+            "Celery confirmed migrations complete via TLS"
+        check_log_contains "$celery_name" "PostgreSQL TLS: enabled" \
+            "Celery sees PostgreSQL TLS enabled"
+        check_log_contains "$celery_name" "Redis TLS: enabled" \
+            "Celery sees Redis TLS enabled"
+    else
+        log_fail "Celery container failed to start with full TLS"
+        echo -e "  ${YELLOW}--- Celery logs ---${NC}"
+        docker logs "$celery_name" 2>&1 | tail -20 | sed 's/^/    /'
+        echo -e "  ${YELLOW}--- End logs ---${NC}"
+    fi
+
+    dump_logs_on_fail "$name"
+    cleanup_scenario
+}
+
+###############################################################################
+# Main
+###############################################################################
+echo -e "${BOLD}╔═══════════════════════════════════════════════════════════╗${NC}"
+echo -e "${BOLD}║   Dispatcharr — TLS Integration Tests                    ║${NC}"
+echo -e "${BOLD}╚═══════════════════════════════════════════════════════════╝${NC}"
+
+# Build image
+if [ "$SKIP_BUILD" = false ]; then
+    echo -e "\n${BOLD}Building test image...${NC}"
+    if ! docker build -t "$IMAGE_NAME" -f docker/Dockerfile . 2>&1 | tail -5; then
+        echo -e "${RED}Build failed${NC}"
+        exit 1
+    fi
+    echo -e "${GREEN}Build complete${NC}"
+else
+    echo -e "\n${YELLOW}Skipping build (--skip-build)${NC}"
+fi
+
+# Generate certificates
+generate_test_certs || exit 1
+
+# Run scenarios
+SCENARIOS=(
+    modular_mtls_no_password
+    modular_mtls_with_password
+    modular_tls_server_only
+    modular_tls_key_permission
+    modular_no_tls_regression
+    modular_pg_verify_full
+    modular_redis_tls
+    modular_full_tls_celery
+)
+
+for scenario in "${SCENARIOS[@]}"; do
+    if [ -n "$SINGLE_SCENARIO" ] && [ "$scenario" != "$SINGLE_SCENARIO" ]; then
+        continue
+    fi
+    "test_${scenario}"
+done
+
+# Clean up certs
+rm -rf "$CERT_DIR"
+
+# Summary
+echo -e "\n${BOLD}═══════════════════════════════════════════════════════════${NC}"
+echo -e "  ${GREEN}Passed: $PASS${NC}  ${RED}Failed: $FAIL${NC}  ${YELLOW}Skipped: $SKIP${NC}"
+if [ ${#ERRORS[@]} -gt 0 ]; then
+    echo -e "\n  ${RED}Failures:${NC}"
+    for err in "${ERRORS[@]}"; do
+        echo -e "    ${RED}• $err${NC}"
+    done
+fi
+echo -e "${BOLD}═══════════════════════════════════════════════════════════${NC}"
+
+[ $FAIL -eq 0 ]

From 6f8ca243afaa1bcb5b1cd43a72c936fa78ce8b7d Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Tue, 31 Mar 2026 09:44:55 -0500
Subject: [PATCH 66/67] fix: ensure PGSSL* environment variables are explicitly
 set by stripping inherited values

fix: use psycopg2.sql for safe database drop and create commands

fix: Also check POSTGRES_SSL is true before skipping default POSTGRES_PASSWORD

fix: update usage comment to reflect correct script path

fix: improve cleanup logic to conditionally remove certificate directory
---
 apps/backups/services.py           | 2 ++
 core/management/commands/dropdb.py | 5 +++--
 docker/entrypoint.sh               | 5 +++--
 docker/init/00-fix-pg-ssl-key.sh   | 2 +-
 docker/tests/test-tls-postgres.sh  | 4 ++--
 5 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/apps/backups/services.py b/apps/backups/services.py
index 72b7b3f2..c70160e1 100644
--- a/apps/backups/services.py
+++ b/apps/backups/services.py
@@ -51,7 +51,9 @@ def _get_pg_env() -> dict:
         "sslcert": "PGSSLCERT",
         "sslkey": "PGSSLKEY",
     }
+    # Always strip inherited PGSSL* vars first, then set only what is explicitly configured
     for opt_key, env_key in _ssl_env_map.items():
+        env.pop(env_key, None)
         value = options.get(opt_key)
         if value:
             env[env_key] = value
diff --git a/core/management/commands/dropdb.py b/core/management/commands/dropdb.py
index 3c390bef..d61b9891 100644
--- a/core/management/commands/dropdb.py
+++ b/core/management/commands/dropdb.py
@@ -1,5 +1,6 @@
 import sys
 import psycopg2
+from psycopg2 import sql
 from django.core.management.base import BaseCommand
 from django.conf import settings
 from django.db import connection
@@ -41,9 +42,9 @@ class Command(BaseCommand):
             conn.autocommit = True
             cur = conn.cursor()
             self.stdout.write(f"Dropping database '{db_name}'...")
-            cur.execute(f"DROP DATABASE IF EXISTS {db_name};")
+            cur.execute(sql.SQL("DROP DATABASE IF EXISTS {}").format(sql.Identifier(db_name)))
             self.stdout.write(f"Creating database '{db_name}'...")
-            cur.execute(f"CREATE DATABASE {db_name};")
+            cur.execute(sql.SQL("CREATE DATABASE {}").format(sql.Identifier(db_name)))
             cur.close()
             conn.close()
             self.stdout.write(self.style.SUCCESS(f"Database '{db_name}' has been dropped and recreated."))
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index 4bf170c8..ea8a95b9 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -31,8 +31,9 @@ echo_with_timestamp() {
 export POSTGRES_DB=${POSTGRES_DB:-dispatcharr}
 export POSTGRES_USER=${POSTGRES_USER:-dispatch}
 # AIO mode: default to 'secret' for internal DB.
-# Modular mode: no default — cert-only auth (mTLS) uses no password.
-if [[ "${DISPATCHARR_ENV:-}" == "modular" ]]; then
+# Modular mode + TLS: no default — cert-only auth (mTLS) uses no password.
+# Modular mode + no TLS: preserve 'secret' default for backward compatibility.
+if [[ "${DISPATCHARR_ENV:-}" == "modular" && "${POSTGRES_SSL:-}" == "true" ]]; then
     export POSTGRES_PASSWORD="${POSTGRES_PASSWORD:-}"
 else
     export POSTGRES_PASSWORD="${POSTGRES_PASSWORD:-secret}"
diff --git a/docker/init/00-fix-pg-ssl-key.sh b/docker/init/00-fix-pg-ssl-key.sh
index 122815f7..d7065815 100644
--- a/docker/init/00-fix-pg-ssl-key.sh
+++ b/docker/init/00-fix-pg-ssl-key.sh
@@ -11,7 +11,7 @@
 #
 # Usage: source this script with FIXED_KEY_PATH set to the destination.
 #   FIXED_KEY_PATH="/data/.pg-client.key"
-#   . /app/docker/init/fix-pg-ssl-key.sh
+#   . /app/docker/init/00-fix-pg-ssl-key.sh
 #
 # After sourcing, POSTGRES_SSL_KEY is updated to the fixed path if a copy
 # was needed. The caller is responsible for propagating the new value to
diff --git a/docker/tests/test-tls-postgres.sh b/docker/tests/test-tls-postgres.sh
index 81230178..8a7630dc 100644
--- a/docker/tests/test-tls-postgres.sh
+++ b/docker/tests/test-tls-postgres.sh
@@ -97,7 +97,7 @@ fresh_volume() {
 }
 
 cleanup_scenario() {
-    if [ "$KEEP_ON_FAIL" = true ] && [ ${#ERRORS[@]} -gt 0 ]; then
+    if [ "$KEEP_ON_FAIL" = true ] && [ "$FAIL" -gt "${SCENARIO_FAIL_BEFORE:-0}" ]; then
         log_info "Keeping resources for debugging (--keep-on-fail)"
         CLEANUP_ITEMS=()
         return
@@ -114,7 +114,7 @@ cleanup_scenario() {
     CLEANUP_ITEMS=()
 }
 
-trap 'cleanup_scenario' EXIT
+trap 'cleanup_scenario; [ -n "$CERT_DIR" ] && rm -rf "$CERT_DIR"' EXIT
 
 wait_for_ready() {
     local name="$1"

From 1d41433ddcb66df9fab6b23c1bfbbdceea54d933 Mon Sep 17 00:00:00 2001
From: SergeantPanda <chester.cullen@gmail.com>
Date: Tue, 31 Mar 2026 10:35:17 -0500
Subject: [PATCH 67/67] Fix: Ensure absolute URL is used for stream in
 FloatingVideo component to resolve relative URLs in WorkerGlobalScope.

---
 frontend/src/components/FloatingVideo.jsx | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/frontend/src/components/FloatingVideo.jsx b/frontend/src/components/FloatingVideo.jsx
index ccba7934..f5bdc303 100644
--- a/frontend/src/components/FloatingVideo.jsx
+++ b/frontend/src/components/FloatingVideo.jsx
@@ -313,10 +313,17 @@ export default function FloatingVideo() {
         return;
       }
 
+      // mpegts.js workers run in WorkerGlobalScope where relative URLs are
+      // not resolved against the page origin. Always pass an absolute URL.
+      const absoluteStreamUrl =
+        streamUrl.startsWith('/') && typeof window !== 'undefined'
+          ? `${window.location.origin}${streamUrl}`
+          : streamUrl;
+
       const player = mpegts.createPlayer(
         {
           type: 'mpegts',
-          url: streamUrl,
+          url: absoluteStreamUrl,
           isLive: true,
           cors: true,
         },