shell: youtube nav icon: download → import

download is used by the Downloads section tile on the home screen. YouTube ingest gets the new import icon (arrow entering box) instead.
icons: add import icon (arrow entering box)
2026-05-31 10:52:10 -04:00 · 2026-05-31 10:50:43 -04:00 · 2026-05-31 00:19:34 -04:00 · 2026-05-30 18:59:27 -04:00 · 2026-05-30 18:57:20 -04:00 · 2026-05-30 17:32:15 -04:00
31 changed files with 3142 additions and 321 deletions
--- a/.env.example
+++ b/.env.example
@ -63,3 +63,10 @@ GOOGLE_ALLOWED_DOMAIN=
 # Note: if a Google-linked account also has TOTP enabled, sign-in still requires
 # the authenticator code (Google is treated as the first factor). Accounts without
 # TOTP complete sign-in in one Google step.
+
+# Playout / Master Control (MCR)
+# Image tag the mam-api spawns when a channel starts. Build with:
+#   docker compose --profile build-only build playout
+PLAYOUT_IMAGE=wild-dragon-playout:latest
+# Base AMCP port — each channel binds to BASE + channel_id (in CasparCG terms).
+PLAYOUT_AMCP_BASE_PORT=5250
--- a/WORK_LOG_PLAYOUT.md
+++ b/WORK_LOG_PLAYOUT.md
@ -0,0 +1,101 @@
+# Playout / Master Control — Implementation Work Log
+
+**Branch:** `feat/playout-mcr` (off `main`)
+**Started:** 2026-05-30
+**Status:** Code complete, awaiting runtime validation
+
+Tracks the build of the playout (MCR) subsystem against the design at
+`docs/superpowers/specs/2026-05-30-playout-mcr-design.md`.
+
+---
+
+## Commit sequence
+
+| # | Commit | Scope |
+|---|--------|-------|
+| 1 | `docs(playout)` | Design spec, §7 questions answered |
+| 2 | `feat(mam-api): migration 029` | Six tables, failover columns, audio_normalized flag |
+| 3 | `feat(worker): playout-stage` | S3 → /media + EBU R128 loudnorm + index.js wiring |
+| 4 | `feat(playout): sidecar` | CasparCG image + AMCP shim, HLS preview consumer, fps-aware frame math |
+| 5 | `feat(mam-api): /playout control plane + auto-failover` | Routes + scheduler health tick + restartChannel helper |
+| 6 | `feat(web-ui): MCR page` | screens-playout, styles, app/shell/index.html wiring |
+| 7 | `build(playout): compose wiring + .env knobs` | /media volume, queue addition, build-only service |
+| 8 | `docs(playout): work log` | This file |
+
+## Resolved §7 decisions (2026-05-30)
+
+- **Audio loudness:** pre-normalize at stage time. ffmpeg `loudnorm` two-pass
+  (I=-23 LUFS, TP=-1 dBTP, LRA=11), linear mode preserves dynamics. Output
+  AAC 192k @ 48 kHz, video stream copied. Per-item `audio_normalized` flag
+  so re-stages of the same asset skip the pass.
+- **Frame rate:** `1080p5994` default (was `1080i5994`). Per-channel
+  override allowed via `video_format`. `fpsFor(videoFormat)` helper in
+  the sidecar drives SEEK / LENGTH / transition-frames math.
+- **Preview latency:** HLS v1. CasparCG runs a second FFMPEG consumer
+  alongside the primary output, writing `/media/live/<channel_id>/index.m3u8`
+  (~600 kbps, 2s segments, 6-window list). Web UI plays via the existing
+  HLS plumbing.
+- **Failover:** auto-restart on healthy node for NDI/SRT/RTMP. Alert-only
+  for DeckLink (device-index pinning makes blind re-placement risky).
+  Scheduler tick (PG advisory lock, same lock as recorder schedules) polls
+  sidecar `/status`; ~3 missed checks → `restartChannel(id)` picks the most
+  recently-seen-online other node, bumps `restart_count`, calls `/start`.
+
+## Architecture notes
+
+**Sidecar model.** One CasparCG container per channel. Spawned by mam-api
+via local Docker socket (primary node) or remote node-agent
+`/sidecar/start`. Tracked in `playout_sidecars` plus `playout_channels.container_id`.
+Killed on `/stop` or by `restartChannel` during failover.
+
+**Media flow.**
+```
+S3 master/proxy → playout-stage worker → /media/playout/<assetId>.<ext>
+                                         (loudnormed, AAC@-23 LUFS)
+                                                ↓
+                                       CasparCG channel #1
+                                                ↓
+                                   primary consumer  HLS consumer
+                                  (DeckLink/NDI/         ↓
+                                   SRT/RTMP)        /media/live/<ch_id>/*.m3u8
+```
+
+**Port contention.** `assertDeckLinkFree()` blocks starting a SDI channel
+when a recorder or another channel on the same node+device_index is active.
+
+**Failover scope.** NDI/SRT/RTMP have no hardware tie, so any healthy
+cluster_node is eligible. DeckLink channels surface an alert in the UI
+(`status='error'` + `error_message`) and require operator intervention.
+
+## Testing checklist
+
+- [ ] Apply migration 029 on dev DB
+- [ ] Build playout image: `docker compose --profile build-only build playout`
+- [ ] Build web-ui (`screens-playout` joins the esbuild list automatically)
+- [ ] Create channel via POST /api/v1/playout/channels (SRT first, no HW)
+- [ ] Stage 2-3 assets to a playlist, verify loudnorm metadata in stderr
+- [ ] Start channel → sidecar container appears in `docker ps`
+- [ ] AMCP smoke: `telnet <host> 5250`, `VERSION`, `INFO`
+- [ ] Play playlist; verify HLS at /media/live/<id>/index.m3u8
+- [ ] Skip / pause / resume / stop
+- [ ] As-run log: GET /api/v1/playout/channels/:id/asrun
+- [ ] Kill sidecar container → scheduler should restart on another node
+      within ~3 ticks (~45s), restart_count increments
+- [ ] DeckLink channel kill: status flips to 'error', NO restart attempt
+- [ ] Try starting a decklink channel on a device_index already held by a
+      recorder → 409
+- [ ] MCR UI smoke: nav entry visible, page renders, drag-drop adds items,
+      transport buttons hit the API
+
+## Known gaps (deferred)
+
+- No WebRTC preview (HLS-only v1 — 4-6s lag, fine for confidence monitor).
+- No graphics/CG overlay layer in Phase A (templates land in Phase B).
+- No Phase B scheduler / 24/7 wall-clock channel (schema is in place,
+  scheduler tick is not).
+- No multi-channel grid view (one channel at a time per page).
+- No timecode / remaining-duration overlay (would need CasparCG INFO poll).
+- No audio level meters on the UI.
+- `restartChannel` updates DB state and triggers `/start`; if the new node
+  also fails repeatedly, there's no exponential backoff yet — bounded only
+  by the manual stop button.
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -40,6 +40,7 @@ services:
      - /var/run/docker.sock:/var/run/docker.sock
      - /mnt/NVME/MAM/wild-dragon-live:/live
      - /mnt/NVME/MAM/wild-dragon-growing:/growing
+      - /mnt/NVME/MAM/wild-dragon-media:/media
      - /mnt/NVME/MAM/sdk:/sdk
      - /dev/shm:/dev/shm
      - /run/dbus:/run/dbus
@ -61,6 +62,8 @@ services:
      NODE_IP: ${NODE_IP}
      NODE_HOSTNAME: ${NODE_HOSTNAME:-}
      CAPTURE_TOKEN: ${CAPTURE_TOKEN}
+      PLAYOUT_IMAGE: ${PLAYOUT_IMAGE:-wild-dragon-playout:latest}
+      PLAYOUT_AMCP_BASE_PORT: ${PLAYOUT_AMCP_BASE_PORT:-5250}
    deploy:
      resources:
        reservations:
@ -120,14 +123,16 @@ services:
      # after the capability-routing split, so import jobs sat unprocessed and
      # assets stayed `ingesting` forever. import is concurrency-1 + network-
      # bound, so one consumer (this heavy/primary worker) is sufficient.
-      WORKER_QUEUES: proxy,conform,trim,import
+      WORKER_QUEUES: proxy,conform,trim,import,playout-stage
      RUN_PROMOTION: "true"
      PROXY_CONCURRENCY: "2"
+      PLAYOUT_MEDIA_DIR: /media
      NVIDIA_VISIBLE_DEVICES: GPU-79afca3e-2ab2-a6ea-1c44-706c1f0a26d6
      WORKER_LABEL: "zampp1 / Tesla P4"
      NVIDIA_DRIVER_CAPABILITIES: video,compute,utility
    volumes:
      - /mnt/NVME/MAM/wild-dragon-growing:/growing
+      - /mnt/NVME/MAM/wild-dragon-media:/media
    networks:
      - wild-dragon

@ -176,12 +181,22 @@ services:
      - "${PORT_WEB_UI:-7434}:80"
    volumes:
      - /mnt/NVME/MAM/wild-dragon-live:/live
+      - /mnt/NVME/MAM/wild-dragon-media:/media:ro
      - /dev/shm:/dev/shm
      - /run/dbus:/run/dbus
      - /run/systemd:/run/systemd
    networks:
      - wild-dragon

+  # Build-only: the CasparCG sidecar image. mam-api spawns these on-demand per
+  # channel (one container per playout channel), so this service is never up'd —
+  # it exists so `docker compose build playout` produces the image the API tags
+  # via PLAYOUT_IMAGE. Profile excludes it from default `up`.
+  playout:
+    profiles: ["build-only"]
+    build: ./services/playout
+    image: wild-dragon-playout:latest
+
 volumes:
  postgres_data:
  redis_data:
--- a/docs/superpowers/specs/2026-05-30-playout-mcr-design.md
+++ b/docs/superpowers/specs/2026-05-30-playout-mcr-design.md
@ -0,0 +1,235 @@
+# Wild Dragon MAM — Playout / Master Control (MCR)
+
+**Date:** 2026-05-30 (revised 2026-05-30 — §7 closed)
+**Status:** APPROVED — implementation in progress (code drafted but uncommitted; see WORK_LOG_PLAYOUT.md)
+**Author:** Zac + Claude
+
+---
+
+## Resolved Decisions
+
+| Question | Decision |
+|----------|----------|
+| Playout engine | **CasparCG Server** (orchestrated via AMCP), not ffmpeg-native |
+| Channel count | **Multi-channel from start** — N independent channels, placed across cluster nodes by capability (mirrors recorders) |
+| Scheduling model | **Phased** — Phase A: on-demand playlist player; Phase B: 24/7 continuous channel |
+| Output targets | SDI (DeckLink), NDI, SRT, RTMP — all via CasparCG consumers |
+| Media source | Assets live in **S3**; must be staged to a CasparCG-local media volume before play (see §4) |
+| CasparCG packaging | **Build our own image** (like `capture/build-with-decklink.sh`) — GL context via GPU passthrough or Xvfb; NDI + DeckLink SDKs fetched at build time (not redistributable) |
+| Master codec playability | Zac confirms current masters **play fine in CasparCG** — no transcode-for-playout step; staging is a plain S3→/media copy. Validate on hardware but do not gate on it |
+| Management UI | **Single Dragonflight `playout.html` GUI** drives everything via AMCP; operator never touches CasparCG directly |
+
+---
+
+## Overview
+
+Playout adds **master-control-room** capability to Dragonflight: take library assets, arrange them on a timeline / playlist, and play them out continuously to a broadcast output — SDI via DeckLink, or stream via SRT / RTMP / NDI. Drag-and-drop scheduling, a program/preview monitor, and as-run logging.
+
+This is the **mirror image** of the existing capture path. Capture is `input → ffmpeg encode → S3`. Playout is `S3 asset → engine → output`. We reuse three things wholesale:
+
+1. **Cluster node + capability model** — nodes already advertise DeckLink/Deltacast/GPU in `cluster_nodes.capabilities`; channels are placed on nodes that have a free output port, exactly as recorders claim input ports.
+2. **Sidecar orchestration** — mam-api spawns containers via the local Docker socket or the remote `node-agent /sidecar/start`. A CasparCG channel is just a different sidecar image.
+3. **Scheduler tick + PG advisory lock** — `src/scheduler.js` already runs a single-leader tick over a schedule table. Phase B's wall-clock channel reuses this pattern.
+
+### Why CasparCG over ffmpeg-native
+
+The capture stack proves we can drive ffmpeg + DeckLink. But playout's hard part is **gapless, frame-accurate, clean transitions between clips** — every clip boundary in an ffmpeg-per-clip model is a black flash unless we engineer a concat-feeder. CasparCG solves this natively: a channel is a persistent output with a playlist, hard/mix/wipe transitions, layered graphics/logo (CG), and DeckLink/NDI/SRT/RTMP consumers built in. We orchestrate it over **AMCP** (its TCP control protocol) instead of reinventing a feeder. Trade: a new dependency + container image, and media must be on a CasparCG-visible disk (§4).
+
+---
+
+## 1. Data Model
+
+New migration `029-playout.sql`. Five tables.
+
+### 1.1 `playout_channels`
+A logical output. One channel → one engine instance → one output target.
+
+```
+id              uuid pk
+name            text                 -- "Channel 1", "Pop-up SDI"
+node_id         uuid -> cluster_nodes(id)   -- where the engine runs (null = primary)
+output_type     text   -- 'decklink' | 'ndi' | 'srt' | 'rtmp'
+output_config   jsonb  -- { device_index } | { ndi_name } | { url, latency } | { url, key }
+video_format    text   -- '1080i5994' | '1080p5994' | '720p5994' ...
+status          text   -- 'stopped' | 'starting' | 'running' | 'error'
+container_id    text                 -- running CasparCG sidecar
+project_id      uuid -> projects(id) -- RBAC scoping (nullable = admin-only)
+created_at / updated_at
+```
+
+`output_type` + `output_config` map straight to a CasparCG consumer:
+- `decklink` → `ADD <ch> DECKLINK <device> ...`
+- `ndi` → `ADD <ch> NDI ...`
+- `srt`/`rtmp` → `ADD <ch> FFMPEG <url> -f mpegts ...` (CasparCG 2.3+ ffmpeg consumer)
+
+### 1.2 `playout_playlists`
+An ordered list of items bound to a channel. Phase A's primary object.
+
+```
+id, channel_id -> playout_channels(id)
+name, loop boolean, created_at / updated_at
+```
+
+### 1.3 `playout_items`
+One entry on a playlist OR one entry on the 24/7 timeline.
+
+```
+id
+playlist_id   uuid -> playout_playlists(id)   -- Phase A
+asset_id      uuid -> assets(id)
+sort_order    int                              -- position in playlist (Phase A)
+scheduled_at  timestamptz                      -- wall-clock start (Phase B, null in A)
+in_point      numeric   -- seconds, trim head (reuse subclip in/out from editor)
+out_point     numeric   -- seconds, trim tail
+transition    text      -- 'cut' | 'mix' | 'wipe'
+transition_ms int
+graphics      jsonb     -- optional CG/template overlay (Phase B+)
+media_status  text      -- 'pending' | 'staging' | 'ready' | 'error'  (see §4)
+media_path    text      -- resolved path inside the CasparCG media volume
+```
+
+### 1.4 `playout_schedule` (Phase B)
+Day-ahead, wall-clock-bound timeline rows. Same shape as `playout_items` but `scheduled_at` is authoritative and the scheduler tick (§5) drives transitions. Phase A can ignore this table.
+
+### 1.5 `playout_as_run`
+Append-only log: what actually played, when, for how long. Compliance / billing.
+
+```
+id, channel_id, asset_id, item_id
+started_at, ended_at, duration_s, result  -- 'played' | 'skipped' | 'error'
+```
+
+---
+
+## 2. Services & Components
+
+### 2.1 New sidecar: `services/playout/` (CasparCG wrapper)
+A thin container: **CasparCG Server** + a small Node control shim exposing HTTP, the same way `capture` wraps ffmpeg.
+
+- Base image: official/community `casparcg/server` (Linux build with DeckLink + NDI + FFmpeg producers/consumers).
+- Node shim (`src/index.js`): opens an AMCP TCP socket to local CasparCG, exposes:
+  - `POST /channel/start`  → `ADD <ch> <consumer>` for the channel's output target
+  - `POST /play`           → `PLAY <ch>-<layer> <media> [transition]`
+  - `POST /loadbg` + `/play` → preview/cue then take (preview monitor)
+  - `POST /stop`, `GET /status` → `INFO <ch>` (current clip, position, fps)
+  - playlist load → translate `playout_items` rows into a sequence of AMCP `LOADBG`/`PLAY` calls, advancing on `OnTransition` / end-of-clip events.
+- Mirrors capture's status-polling contract so the UI monitor reuses existing plumbing.
+
+### 2.2 mam-api: `src/routes/playout.js`
+CRUD + control, RBAC-scoped via the existing `assertProjectAccess` helper (channels carry `project_id`).
+
+```
+GET    /playout/channels                     list (project-filtered)
+POST   /playout/channels                     create (edit on project)
+POST   /playout/channels/:id/start|stop      spawn/kill CasparCG sidecar
+GET    /playout/channels/:id/status          proxy engine INFO
+POST   /playout/channels/:id/play|pause|skip transport control
+GET/POST/PUT/DELETE /playout/playlists...    playlist + item CRUD, reorder
+POST   /playout/items/:id/stage              kick S3→media-volume staging (§4)
+GET    /playout/channels/:id/asrun           as-run log
+```
+
+Channel start/stop reuses `resolveNodeTarget()` + the Docker-socket / `node-agent /sidecar/start` split already in `recorders.js`. **Refactor opportunity:** lift that sidecar-spawn logic out of `recorders.js` into `src/orchestration/sidecar.js` so both recorders and playout share it (keep this small — only what both need).
+
+### 2.3 web-ui: `playout.html` + `public/playout.jsx`
+New MCR page. Layout:
+
+```
+┌─ PREVIEW ───────────┬─ PROGRAM (on air) ──────┐
+│  [cued clip]        │  [live output] ● ON AIR  │
+│  TC / duration      │  TC / remaining          │
+│  [CUE] [TAKE]       │  [PLAY][PAUSE][SKIP][STOP]│
+├─ MEDIA BIN ─────────┴──────────────────────────┤
+│  (draggable asset list, reuse asset browser)   │
+├─ PLAYLIST / TIMELINE ──────────────────────────┤
+│  ▸ clip A ──▸ clip B ──▸ clip C   (drag-drop)  │  Phase A: ordered list
+│  └ 24h time grid w/ now-bar                     │  Phase B: time-of-day grid
+└────────────────────────────────────────────────┘
+```
+
+- Drag-drop: reuse whatever the NLE editor timeline uses (check `editor.jsx`); assets drag from the bin into the playlist/grid.
+- API via existing `ZAMPP_API.fetch` wrapper.
+- Program monitor: HLS preview of the output — CasparCG can emit a second low-bitrate FFmpeg consumer to HLS, reusing the `/live/<id>` HLS plumbing capture already uses.
+
+---
+
+## 3. Channel placement & ports
+
+A DeckLink port is exclusive — same constraint capture already handles. A node's DeckLink port can be an **input (recorder)** or an **output (playout channel)**, never both at once. So:
+
+- Extend the capability/port-claim check: when starting a channel on `output_type=decklink`, verify the target node has that device index free (no active recorder, no active channel).
+- NDI / SRT / RTMP outputs have no hardware contention → can stack many per node (GPU/CPU-bound only).
+- Surface a unified "device map" (extend the existing cluster DeckLink-status endpoint) showing each port's role: idle / recording / playing-out.
+
+---
+
+## 4. Media staging (the S3 ⇄ CasparCG gap)
+
+**The crux.** Assets live in S3 (`original_s3_key` / `proxy_s3_key`). CasparCG plays from a **local media folder**. Options:
+
+- **A — Pre-stage to a shared media volume (recommended).** Before a clip can go on air, download/symlink it from S3 to a CasparCG-visible volume (`/media`), set `playout_items.media_status='ready'` + `media_path`. A new BullMQ `playout-stage` job (reuses the worker pattern) does the pull. UI shows per-item readiness; TAKE is blocked until `ready`. Mirrors the growing-file SMB share already mounted for capture.
+- **B — Stream from S3 via presigned URL.** CasparCG FFmpeg producer plays an HTTPS presigned URL directly. Zero staging, but seeking/trim and gapless transitions over network are fragile for broadcast. Acceptable as a fallback for SRT/RTMP, risky for SDI.
+
+**Decision:** Phase A uses **A** (stage proxies for preview, masters for air) with **B** available as a per-channel "low-latency / no-stage" toggle. Zac confirms the current masters play fine in CasparCG, so staging is a **plain S3→/media copy — no transcode-for-playout step**. (Validate on hardware during implementation, but the model does not assume a transcode stage.)
+
+---
+
+## 5. Scheduling
+
+### Phase A — playlist player
+No wall clock. Operator builds a `playout_playlists` row, drags items in, hits PLAY. The playout sidecar walks `playout_items` by `sort_order`, cueing the next clip during the current one (`LOADBG`) and taking it at end-of-clip with the configured transition. `loop` repeats. As-run logged per item.
+
+### Phase B — 24/7 continuous channel
+Wall-clock timeline in `playout_schedule`. Reuse `src/scheduler.js`:
+- Add a second tick (or extend the existing one) under the **same PG advisory lock pattern** — exactly-one-leader, so a multi-replica deploy doesn't double-fire.
+- Tick responsibilities: stage upcoming items (look-ahead window), verify the on-air item matches the schedule, **fill gaps** (loop a filler/slate asset when the timeline has a hole — a channel must never go black), roll the day forward.
+- As-run becomes the compliance record.
+
+---
+
+## 6. Phasing / Milestones
+
+**Phase A — Playlist playout MVP**
+1. Migration `029-playout.sql` (channels, playlists, items, as-run).
+2. `services/playout/` sidecar: CasparCG image + AMCP control shim, single output target (start with **SRT or NDI** — no hardware needed for dev; DeckLink behind hardware check).
+3. mam-api `routes/playout.js` — channel + playlist CRUD, start/stop, transport, RBAC.
+4. `playout-stage` BullMQ job (S3 → /media).
+5. web-ui `playout.html` — bin + drag-drop ordered playlist + program/preview monitors + transport.
+6. DeckLink output on real hardware; port-contention check vs recorders.
+
+**Phase B — 24/7 continuous channel**
+7. `playout_schedule` + time-of-day grid UI.
+8. Scheduler tick (advisory-locked) — look-ahead staging, gap-fill/slate, day-roll.
+9. As-run reporting view.
+10. Graphics/CG overlay (logo bug, lower-thirds) via CasparCG templates.
+
+---
+
+## 7. Open Questions (for review)
+
+**Resolved (2026-05-30):**
+- ~~CasparCG packaging~~ → **build our own image.** Fetch DeckLink + NDI SDKs at build time (not redistributable — same as capture's DeckLink build). GL context for the mixer comes from GPU passthrough on a real node, or **Xvfb** (virtual framebuffer) where there's no display — community images run `--privileged` + X11 socket. Pin the NDI SDK version to what the server expects (`.so` version mismatch is the common docker failure).
+- ~~Master codec playability~~ → Zac confirms masters **play fine**; no transcode-for-playout. Staging = plain S3→/media copy.
+- ~~Management GUI~~ → **single Dragonflight `playout.html`** drives everything via AMCP; operator never touches CasparCG.
+- ~~Audio loudness~~ → **pre-normalize at stage time** (Zac, 2026-05-30). `playout-stage` job runs ffmpeg `loudnorm` (EBU R128, target −23 LUFS, true-peak −1 dBTP) once, on the S3→/media copy. Output is the cached version CasparCG plays. Staging is no longer a pure copy — staging cost ≈ realtime CPU per clip on first stage; results are reusable across channels. Override (`media_status='ready'` + raw copy) available for clips already mastered to spec.
+- ~~Frame rate~~ → **`1080p5994`** default for new channels (Zac, 2026-05-30). Progressive 1080 @ 59.94 fps. Per-channel override allowed (`video_format` column). Streaming-friendly (SRT/RTMP/NDI) and current SDI gear accepts it; matches capture's 59.94 cadence.
+- ~~Preview latency~~ → **HLS v1** (Zac, 2026-05-30). Reuse capture's `/live/<id>` HLS plumbing. CasparCG emits a second low-bitrate FFmpeg consumer to HLS. ~4–6s lag, fine for confidence monitor. Operator desk gets a real downstream monitor off the SDI/NDI output anyway. Revisit WebRTC if MCR operators complain.
+- ~~Failover~~ → **auto-restart on healthy node** (Zac, 2026-05-30). Scheduler tick (§5) monitors `playout_sidecars` health (AMCP ping + container alive); on N missed checks marks the channel `error`, re-places it on another capability-matching node with a free output port, resumes the playlist from the next item after the as-run-logged on-air item. Gap = black/slate for ~5–30 s during respawn (operator sees a flag in the UI). **DeckLink channels are not auto-failed-over in v1** — device-index pinning makes the destination port non-trivial; v1 alerts and lets the operator move the channel. NDI/SRT/RTMP channels (no hardware contention) failover automatically. Tracked via `restart_count` + `last_restart_at` on `playout_channels`.
+
+**Still open:**
+- (none — all §7 questions resolved 2026-05-30)
+
+---
+
+## 8. Reused building blocks (already in the repo)
+
+| Need | Existing piece |
+|------|----------------|
+| Spawn engine container local/remote | `recorders.js` Docker-socket + `node-agent /sidecar/start` |
+| Node capability / port model | `cluster_nodes.capabilities`, cluster DeckLink-status endpoint |
+| Single-leader scheduled transitions | `src/scheduler.js` + PG advisory lock |
+| Background media jobs | BullMQ worker (`services/worker`) |
+| RBAC scoping | `src/auth/authz.js` `assertProjectAccess` (channel/project_id) |
+| HLS preview plumbing | capture's `/live/<id>` HLS output |
+| Subclip in/out points | NLE editor in/out marking |
+| API wrapper / SPA shell | `ZAMPP_API.fetch`, esbuild JSX pages |
--- a/services/mam-api/src/db/migrations/029-playout.sql
+++ b/services/mam-api/src/db/migrations/029-playout.sql
@ -0,0 +1,165 @@
+-- Migration 029 — Playout / Master Control (MCR).
+--
+-- Adds a broadcast playout subsystem: take library assets, arrange them on a
+-- playlist (Phase A) or a wall-clock timeline (Phase B), and play them out
+-- continuously to SDI (DeckLink) / NDI / SRT / RTMP via a CasparCG sidecar.
+--
+-- This is the mirror of the capture path (input -> ffmpeg -> S3). A channel is
+-- placed on a cluster node by capability the same way recorders claim input
+-- ports; the engine container is spawned via the same Docker-socket /
+-- node-agent orchestration. See docs/superpowers/specs/2026-05-30-playout-mcr-design.md.
+--
+-- Tables:
+--   playout_channels  — a logical output (one channel -> one CasparCG instance -> one target)
+--   playout_playlists — an ordered list of items bound to a channel (Phase A)
+--   playout_items     — one clip on a playlist OR one row on the timeline
+--   playout_sidecars  — running CasparCG sidecar registry (one per channel; health-checked)
+--   playout_schedule  — wall-clock day-ahead rows (Phase B; unused in A)
+--   playout_as_run    — append-only log of what actually played (compliance)
+
+-- ── Channels ───────────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS playout_channels (
+  id            UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+  name          TEXT        NOT NULL,
+  node_id       UUID        REFERENCES cluster_nodes(id) ON DELETE SET NULL,
+  output_type   TEXT        NOT NULL DEFAULT 'srt',
+  -- output_config is consumer-shape-specific:
+  --   decklink: { "device_index": 1 }
+  --   ndi:      { "ndi_name": "DRAGONFLIGHT CH1" }
+  --   srt:      { "url": "srt://host:9000", "latency": 200 }
+  --   rtmp:     { "url": "rtmp://host/live", "key": "streamkey" }
+  output_config JSONB       NOT NULL DEFAULT '{}'::jsonb,
+  -- 1080p59.94 is the house standard (matches capture cadence, streaming-friendly,
+  -- accepted by current SDI gear). Per-channel override allowed.
+  video_format  TEXT        NOT NULL DEFAULT '1080p5994',
+  status        TEXT        NOT NULL DEFAULT 'stopped',
+  container_id  TEXT,
+  -- For remote channels the node-agent reports the reachable host:port of the
+  -- sidecar HTTP shim; stored here so the API can proxy transport calls.
+  container_meta JSONB      NOT NULL DEFAULT '{}'::jsonb,
+  error_message TEXT,
+  -- Failover bookkeeping. Scheduler tick health-checks the sidecar; on N missed
+  -- checks the channel is re-placed on a healthy node (auto for ndi/srt/rtmp,
+  -- alert-only for decklink — device-index pinning makes re-placement non-trivial).
+  restart_count       INTEGER     NOT NULL DEFAULT 0,
+  last_restart_at     TIMESTAMPTZ,
+  last_heartbeat_at   TIMESTAMPTZ,
+  -- RBAC scoping: a NULL project_id resolves to admin-only (authz.js), the same
+  -- convention recorders use for unassigned resources.
+  project_id    UUID        REFERENCES projects(id) ON DELETE SET NULL,
+  created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  CHECK (output_type IN ('decklink','ndi','srt','rtmp')),
+  CHECK (status IN ('stopped','starting','running','error'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_playout_channels_node    ON playout_channels (node_id);
+CREATE INDEX IF NOT EXISTS idx_playout_channels_project ON playout_channels (project_id);
+
+-- ── Playlists ──────────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS playout_playlists (
+  id          UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+  channel_id  UUID        NOT NULL REFERENCES playout_channels(id) ON DELETE CASCADE,
+  name        TEXT        NOT NULL,
+  loop        BOOLEAN     NOT NULL DEFAULT FALSE,
+  created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_playout_playlists_channel ON playout_playlists (channel_id);
+
+-- ── Items ──────────────────────────────────────────────────────────────────
+-- One entry on a playlist (Phase A, ordered by sort_order) OR one entry on the
+-- timeline (Phase B, ordered by scheduled_at). in/out points reuse the editor's
+-- subclip trim model (seconds). media_status tracks the S3 -> /media staging
+-- (see playout-stage worker job); a clip cannot go on air until 'ready'.
+CREATE TABLE IF NOT EXISTS playout_items (
+  id            UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+  playlist_id   UUID        REFERENCES playout_playlists(id) ON DELETE CASCADE,
+  asset_id      UUID        NOT NULL REFERENCES assets(id) ON DELETE CASCADE,
+  sort_order    INTEGER     NOT NULL DEFAULT 0,
+  scheduled_at  TIMESTAMPTZ,
+  in_point      NUMERIC,
+  out_point     NUMERIC,
+  transition    TEXT        NOT NULL DEFAULT 'cut',
+  transition_ms INTEGER     NOT NULL DEFAULT 0,
+  graphics      JSONB,
+  media_status  TEXT        NOT NULL DEFAULT 'pending',
+  media_path    TEXT,
+  -- Set when playout-stage has run loudnorm (EBU R128, -23 LUFS / -1 dBTP) on
+  -- the staged file. Re-stages skip the loudnorm pass when true.
+  audio_normalized BOOLEAN  NOT NULL DEFAULT FALSE,
+  created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  CHECK (transition IN ('cut','mix','wipe')),
+  CHECK (media_status IN ('pending','staging','ready','error'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_playout_items_playlist ON playout_items (playlist_id, sort_order);
+CREATE INDEX IF NOT EXISTS idx_playout_items_asset    ON playout_items (asset_id);
+
+-- ── Sidecars ───────────────────────────────────────────────────────────────
+-- Running CasparCG container registry, one row per running channel. The
+-- scheduler tick (src/scheduler.js) pings each sidecar's /status endpoint and
+-- updates last_heartbeat_at; missed checks trigger the failover path in
+-- routes/playout.js.
+CREATE TABLE IF NOT EXISTS playout_sidecars (
+  id                UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+  channel_id        UUID        NOT NULL REFERENCES playout_channels(id) ON DELETE CASCADE,
+  node_id           UUID        REFERENCES cluster_nodes(id) ON DELETE SET NULL,
+  container_id      TEXT        NOT NULL,
+  sidecar_url       TEXT,                                       -- http://host:port for the shim
+  amcp_port         INTEGER,                                    -- in-container AMCP port (default 5250)
+  status            TEXT        NOT NULL DEFAULT 'running',
+  last_heartbeat_at TIMESTAMPTZ,
+  created_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  CHECK (status IN ('starting','running','error','stopped'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_playout_sidecars_channel ON playout_sidecars (channel_id)
+  WHERE status IN ('starting','running');
+CREATE INDEX IF NOT EXISTS idx_playout_sidecars_status ON playout_sidecars (status);
+
+-- ── Schedule (Phase B) ─────────────────────────────────────────────────────
+-- Wall-clock day-ahead timeline. The scheduler tick (src/scheduler.js, under
+-- the existing PG advisory lock) drives transitions and gap-fill. Unused by the
+-- Phase A playlist player but created now so the schema is stable.
+CREATE TABLE IF NOT EXISTS playout_schedule (
+  id            UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+  channel_id    UUID        NOT NULL REFERENCES playout_channels(id) ON DELETE CASCADE,
+  asset_id      UUID        REFERENCES assets(id) ON DELETE SET NULL,
+  scheduled_at  TIMESTAMPTZ NOT NULL,
+  in_point      NUMERIC,
+  out_point     NUMERIC,
+  transition    TEXT        NOT NULL DEFAULT 'cut',
+  transition_ms INTEGER     NOT NULL DEFAULT 0,
+  is_filler     BOOLEAN     NOT NULL DEFAULT FALSE,
+  status        TEXT        NOT NULL DEFAULT 'scheduled',
+  media_status  TEXT        NOT NULL DEFAULT 'pending',
+  media_path    TEXT,
+  created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  CHECK (transition IN ('cut','mix','wipe')),
+  CHECK (status IN ('scheduled','playing','played','skipped','error')),
+  CHECK (media_status IN ('pending','staging','ready','error'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_playout_schedule_channel_time ON playout_schedule (channel_id, scheduled_at);
+CREATE INDEX IF NOT EXISTS idx_playout_schedule_status       ON playout_schedule (status, scheduled_at);
+
+-- ── As-run log ─────────────────────────────────────────────────────────────
+-- Append-only record of what actually went to air. Never updated after insert.
+CREATE TABLE IF NOT EXISTS playout_as_run (
+  id          UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+  channel_id  UUID        NOT NULL REFERENCES playout_channels(id) ON DELETE CASCADE,
+  asset_id    UUID        REFERENCES assets(id) ON DELETE SET NULL,
+  item_id     UUID,
+  clip_name   TEXT,
+  started_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  ended_at    TIMESTAMPTZ,
+  duration_s  NUMERIC,
+  result      TEXT        NOT NULL DEFAULT 'played',
+  CHECK (result IN ('played','skipped','error'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_playout_as_run_channel ON playout_as_run (channel_id, started_at DESC);
--- a/services/mam-api/src/db/migrations/031-cluster-nodes-last-seen.sql
+++ b/services/mam-api/src/db/migrations/031-cluster-nodes-last-seen.sql
@ -0,0 +1,10 @@
+-- Migration 031 — Add last_seen_at to cluster_nodes
+--
+-- Playout failover (routes/playout.js restartChannel) queries cluster_nodes.last_seen_at
+-- to find healthy nodes for channel re-placement. Column was missing from original
+-- cluster schema; heartbeat endpoint updates it via /cluster/heartbeat.
+
+ALTER TABLE cluster_nodes ADD COLUMN IF NOT EXISTS last_seen_at TIMESTAMPTZ;
+
+-- Backfill existing nodes to NOW() so they're immediately eligible for failover
+UPDATE cluster_nodes SET last_seen_at = NOW() WHERE last_seen_at IS NULL;
--- a/services/mam-api/src/index.js
+++ b/services/mam-api/src/index.js
@ -22,6 +22,7 @@ import jobsRouter from './routes/jobs.js';
 import captureRouter from './routes/capture.js';
 import uploadRouter from './routes/upload.js';
 import recordersRouter from './routes/recorders.js';
+import playoutRouter from './routes/playout.js';
 import settingsRouter from './routes/settings.js';
 import amppRouter from './routes/ampp.js';
 import groupsRouter   from './routes/groups.js';
@ -40,18 +41,12 @@ import { startCleanupLoop } from './tasks/cleanupTempSegments.js';
 const app  = express();
 const PORT = process.env.PORT || 3000;

-// ── Middleware ────────────────────────────────────────────────────────────────
-// Tightened CORS — once cookies carry authority, `origin: true` would let
-// any site forge requests with the cookie. Drive the allowlist from env.
 const allowedOrigins = (process.env.ALLOWED_ORIGINS || '')
  .split(',').map(s => s.trim()).filter(Boolean);
 app.use(cors({
  origin: (origin, cb) => {
-    // No Origin header (same-origin or curl) — allow.
    if (!origin) return cb(null, true);
    if (allowedOrigins.length === 0 || allowedOrigins.includes(origin)) return cb(null, true);
-    // Reject cleanly: omit the Allow-Origin header so the browser surfaces
-    // a real CORS error instead of a 500 from a thrown Error in the callback.
    console.warn('[cors] rejected origin:', origin);
    return cb(null, false);
  },
@ -59,14 +54,8 @@ app.use(cors({
 }));
 app.use(express.json({ limit: '50mb' }));

-// Trust the reverse proxy only when explicitly told to (production HTTPS).
 if (process.env.TRUST_PROXY === 'true') app.set('trust proxy', 1);

-// HSTS — once a browser has seen this header over HTTPS for dragonflight.live,
-// it auto-upgrades every future http:// request to https:// before hitting the
-// wire. Cookies are Secure-only (below) and the CORS allowlist rejects HTTP,
-// so without HSTS a user who lands on http:// silently can't log in.
-// Only emit on actual HTTPS responses; req.secure honors trust proxy + X-Forwarded-Proto.
 if (process.env.AUTH_ENABLED === 'true') {
  app.use((req, res, next) => {
    if (req.secure) res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
@ -74,17 +63,13 @@ if (process.env.AUTH_ENABLED === 'true') {
  });
 }

-// Hard-fail when production-mode auth has no stable session secret. Without
-// this, express-session falls back to an in-memory random secret which
-// invalidates every session on restart and breaks multi-node deployments.
 if (process.env.AUTH_ENABLED === 'true' && !process.env.SESSION_SECRET) {
  console.error('[fatal] SESSION_SECRET is required when AUTH_ENABLED=true');
  process.exit(1);
 }

-// Session — actually wired this time. See specs/2026-05-27-auth-system-design.md.
 app.use(session({
-  store: new PgStore({ pool, tableName: 'sessions', pruneSessionInterval: 60 * 15 /* seconds = 15 min */ }),
+  store: new PgStore({ pool, tableName: 'sessions', pruneSessionInterval: 60 * 15 }),
  secret: process.env.SESSION_SECRET,
  name:   'dragonflight.sid',
  cookie: {
@ -94,36 +79,26 @@ app.use(session({
    path:     '/',
    maxAge:   8 * 3600 * 1000,
  },
-  rolling: false,         // sliding renewal handled in requireAuth so idle + absolute can be enforced separately
+  rolling: false,
  resave:  false,
  saveUninitialized: false,
 }));

-// ── Health ────────────────────────────────────────────────────────────────────
 app.get('/health', (_req, res) => res.json({ status: 'ok' }));

-// ── Auth gate ─────────────────────────────────────────────────────────────────
-// req.path is relative to the /api/v1 mount, so /auth/login NOT /api/v1/auth/login.
 const UNAUTH_PATHS = new Set([
  '/auth/login', '/auth/login/totp', '/auth/setup', '/auth/setup-required',
  '/auth/google', '/auth/google/callback', '/auth/google/enabled',
 ]);
-// node-agent now authenticates /cluster/heartbeat with a bound api_token
-// (migration 019 + bound_hostname on the token). requireAuth handles the
-// bearer lookup and sets req.tokenBoundHostname; the heartbeat handler in
-// routes/cluster.js verifies body.hostname matches that binding.
 app.use('/api/v1', requireUiHeader);
 app.use('/api/v1', (req, res, next) => {
  if (UNAUTH_PATHS.has(req.path)) return next();
  return requireAuth(req, res, next);
 });

-// ── API Routes ────────────────────────────────────────────────────────────────
 app.use('/api/v1/auth',    authRouter);
-// User and group administration is admin-only (RBAC v2). The auth gate above
-// already established req.user; requireAdmin rejects non-admins with 403.
 app.use('/api/v1/auth/users', requireAdmin, usersRouter);
-app.use('/api/v1/users', requireAdmin, usersRouter);  // alias for the SPA Users page
+app.use('/api/v1/users', requireAdmin, usersRouter);
 app.use('/api/v1/auth/tokens', requireAuth, tokensRouter);
 app.use('/api/v1/assets',    assetsRouter);
 app.use('/api/v1/projects',  projectsRouter);
@ -132,6 +107,7 @@ app.use('/api/v1/jobs',      jobsRouter);
 app.use('/api/v1/capture',   captureRouter);
 app.use('/api/v1/upload',    uploadRouter);
 app.use('/api/v1/recorders', recordersRouter);
+app.use('/api/v1/playout',   playoutRouter);
 app.use('/api/v1/settings',  settingsRouter);
 app.use('/api/v1/ampp',      amppRouter);
 app.use('/api/v1/groups',    requireAdmin, groupsRouter);
@ -145,21 +121,14 @@ app.use('/api/v1/assets/:assetId/comments', commentsRouter);
 app.use('/api/v1/imports',   importsRouter);
 app.use('/api/v1/storage',   storageRouter);

-// ── Error handler ─────────────────────────────────────────────────────────────
 app.use(errorHandler);

-// ── Start ────────────────────────────────────────────────────────────────────
 import { readdirSync, readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';

 const __dirnameMig = dirname(fileURLToPath(import.meta.url));
 async function runMigrations() {
-  // Issue #107 — previously the loop swallowed errors and let the server boot
-  // on a half-migrated schema. Now: track applied migrations in a table, run
-  // every pending one inside a transaction, and exit non-zero on failure so
-  // the orchestrator restarts (and so an operator notices) instead of serving
-  // 500s for the next month.
  const dir = join(__dirnameMig, 'db', 'migrations');
  let files = [];
  try { files = readdirSync(dir).filter(f => f.endsWith('.sql')).sort(); } catch { return; }
@ -172,7 +141,6 @@ async function runMigrations() {
    )
  `);

-  // Allow forcing a re-run via env when iterating locally.
  const force = process.env.MIGRATIONS_FORCE === '1';
  const allowFailures = process.env.MIGRATIONS_ALLOW_FAILURES === '1';

@ -198,7 +166,6 @@ async function runMigrations() {
      console.error('[migration] FAILED ' + f + ': ' + err.message);
      client.release();
      if (allowFailures) continue;
-      // Hard fail — better to crash now than serve traffic on a broken schema.
      console.error('[migration] aborting startup. Set MIGRATIONS_ALLOW_FAILURES=1 to override.');
      process.exit(1);
    }
@ -207,13 +174,9 @@ async function runMigrations() {
 }
 await runMigrations();

-// Load S3 config from DB so any settings saved via the Settings page override env vars
 await loadS3ConfigFromDb();

-// ── Cluster self-heartbeat ────────────────────────────────────────────────────
 function getLocalIp() {
-  // Prefer an explicit override — useful when running inside Docker where
-  // os.networkInterfaces() returns container bridge IPs, not the host LAN IP.
  if (process.env.NODE_IP) return process.env.NODE_IP;

  const ifaces = os.networkInterfaces();
@ -225,9 +188,6 @@ function getLocalIp() {
  return '127.0.0.1';
 }

-// Detect NVIDIA GPUs available to this container via nvidia-smi.
-// Returns an array like [{ index: 0, name: 'Tesla P4', memory_mb: 7680 }, ...]
-// or an empty array if nvidia-smi is unavailable or no GPUs found.
 function detectGpus() {
  return new Promise(resolve => {
    exec(
@ -249,6 +209,10 @@ function detectGpus() {
  });
 }

+// Primary mam-api node self-registers in cluster_nodes every 30s. Must write
+// BOTH last_seen (legacy column) and last_seen_at (added by mig 031, used by
+// playout failover) — otherwise the primary appears stale to the failover
+// query and channels get re-placed off it incorrectly.
 async function selfHeartbeat() {
  const load  = os.loadavg()[0];
  const total = os.totalmem();
@ -260,14 +224,15 @@ async function selfHeartbeat() {
  pool.query(
    `INSERT INTO cluster_nodes
       (hostname, ip_address, role, version, api_url,
-        cpu_usage, mem_used_mb, mem_total_mb, capabilities, last_seen)
-     VALUES ($1,$2,'primary',$3,$4,$5,$6,$7,$8,NOW())
+        cpu_usage, mem_used_mb, mem_total_mb, capabilities, last_seen, last_seen_at)
+     VALUES ($1,$2,'primary',$3,$4,$5,$6,$7,$8,NOW(),NOW())
     ON CONFLICT (hostname) DO UPDATE SET
       ip_address   = EXCLUDED.ip_address,
       cpu_usage    = EXCLUDED.cpu_usage,
       mem_used_mb  = EXCLUDED.mem_used_mb,
       mem_total_mb = EXCLUDED.mem_total_mb,
       capabilities = EXCLUDED.capabilities,
+       last_seen_at = NOW(),
       last_seen    = NOW()`,
    [
      process.env.NODE_HOSTNAME || os.hostname(),
@ -292,39 +257,26 @@ const server = app.listen(PORT, () => {
  if (process.env.AUTH_ENABLED === 'true' && process.env.TRUST_PROXY !== 'true') {
    console.warn('[auth] WARNING: AUTH_ENABLED=true but TRUST_PROXY=false — req.ip will be the proxy IP, login rate-limit will throttle all clients together. Set TRUST_PROXY=true when behind nginx/HTTPS.');
  }
-  // Boot the recorder scheduler tick loop after the HTTP server is live so
-  // the loop's self-calls to /recorders/:id/start|stop reach a ready socket.
  startSchedulerLoop();
-
-  // Boot the temp-segment cleanup loop (runs hourly).
  startCleanupLoop();
 });

-// Issue #100 — graceful shutdown. Without this, `docker stop` (SIGTERM) killed
-// the process mid-scheduler-tick, leaving Redis connections and Docker
-// sockets dangling and producing partial DB writes. Now: stop the scheduler,
-// finish in-flight HTTP requests, close PG/Redis pools, and exit cleanly
-// (or hard-exit after 25 s if something is stuck).
 let _shuttingDown = false;
 async function gracefulShutdown(signal) {
  if (_shuttingDown) return;
  _shuttingDown = true;
  console.log(`[shutdown] received ${signal} — closing gracefully…`);

-  // Stop accepting new requests + wind down the scheduler tick.
  try { stopSchedulerLoop(); } catch (_) {}

-  // Force-exit watchdog so a hung connection can't keep us alive forever.
  const killSwitch = setTimeout(() => {
    console.error('[shutdown] forced exit after 25s timeout');
    process.exit(1);
  }, 25_000);
  killSwitch.unref();

-  // Stop the HTTP server (waits for in-flight requests to finish).
  await new Promise(resolve => server.close(resolve));

-  // Close DB pool + S3 client + any other resources. Best-effort.
  try { await pool.end(); } catch (e) { console.warn('[shutdown] pool.end:', e.message); }

  console.log('[shutdown] clean exit');
--- a/services/mam-api/src/middleware/auth.js
+++ b/services/mam-api/src/middleware/auth.js
@ -1,6 +1,23 @@
+import crypto from 'crypto';
 import pool from '../db/pool.js';
 import { parseBearer, hashToken } from '../auth/tokens.js';

+// In-process service token for the scheduler's loopback self-calls
+// (scheduler.js -> /recorders|/playout). The scheduler runs in THIS process, so
+// a per-boot random constant needs no env/compose config and is never exposed:
+// it only travels over the loopback fetch inside the same process. Multi-replica
+// is safe because each replica's scheduler only ever calls 127.0.0.1 (itself),
+// matching that replica's token. Requests bearing it are treated as the seeded
+// admin (DEV_USER) so RBAC + FK-bearing routes work.
+export const INTERNAL_TOKEN = crypto.randomBytes(32).toString('hex');
+const INTERNAL_HEADER = 'x-internal-token';
+
+function isInternalCall(req) {
+  const got = req.headers[INTERNAL_HEADER];
+  if (typeof got !== 'string' || got.length !== INTERNAL_TOKEN.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(got), Buffer.from(INTERNAL_TOKEN));
+}
+
 // Stable UUID matching migration 023's seeded dev user.
 /** UUID of the seeded dev-mode placeholder. NOT a sentinel for "any unauthenticated user". */
 export const DEV_USER_ID = '00000000-0000-4000-8000-000000000000';
@ -25,6 +42,13 @@ async function loadUser(id) {
 }

 export async function requireAuth(req, res, next) {
+  // Internal loopback self-call (scheduler). Acts as the seeded admin so RBAC
+  // and FK-bearing routes work, regardless of AUTH_ENABLED.
+  if (isInternalCall(req)) {
+    req.user = DEV_USER;
+    return next();
+  }
+
  // Dev mode — attach the seeded dev user so FK-bearing routes work.
  if (process.env.AUTH_ENABLED !== 'true') {
    req.user = DEV_USER;
@ -98,6 +122,8 @@ const CSRF_EXEMPT_PATHS = new Set(['/cluster/heartbeat']);

 export function requireUiHeader(req, res, next) {
  if (!MUTATING.has(req.method)) return next();
+  // Internal loopback self-call (scheduler) — not a browser, can't be drive-by'd.
+  if (isInternalCall(req)) return next();
  // Bearer-authed requests (Premiere panel, scripts) are exempt — they're not
  // browsers and can't be drive-by'd from another origin.
  if (req.headers.authorization?.toLowerCase().startsWith('bearer ')) return next();
--- a/services/mam-api/src/routes/cluster.js
+++ b/services/mam-api/src/routes/cluster.js
@ -4,10 +4,6 @@ import pool from '../db/pool.js';

 const router = express.Router();

-// If the agent reported Docker's default bridge IP (172.17.x) but the request
-// itself came from a real LAN address, prefer the request source IP instead.
-// We only check 172.17.x — the default docker0 bridge — not the full RFC1918
-// 172.16/12 block, since real LANs (e.g. 172.18.91.x) fall in that range.
 function pickIp(reportedIp, reqIp) {
  const clean = (s) => (s || '').replace(/^::ffff:/, '');
  const isDockerBridge = (ip) => /^172\.17\./.test(ip || '');
@ -41,7 +37,6 @@ function dockerRequest(path, method = 'GET', body = null) {
  });
 }

-// GET / – list all registered cluster nodes with online status
 router.get('/', async (req, res, next) => {
  try {
    const r = await pool.query(
@ -57,7 +52,6 @@ router.get('/', async (req, res, next) => {
  } catch (err) { next(err); }
 });

-// GET /containers – list all containers on the local Docker host
 router.get('/containers', async (req, res, next) => {
  try {
    const containers = await dockerRequest('/containers/json?all=true');
@ -88,7 +82,6 @@ router.get('/containers', async (req, res, next) => {
  }
 });

-// POST /containers/:nameOrId/restart
 router.post('/containers/:nameOrId/restart', async (req, res, next) => {
  try {
    await dockerRequest(`/containers/${encodeURIComponent(req.params.nameOrId)}/restart`, 'POST');
@ -96,7 +89,6 @@ router.post('/containers/:nameOrId/restart', async (req, res, next) => {
  } catch (err) { next(err); }
 });

-// POST /heartbeat – upsert this node's registration (includes hardware capabilities)
 router.post('/heartbeat', async (req, res, next) => {
  try {
    const {
@ -108,11 +100,6 @@ router.post('/heartbeat', async (req, res, next) => {

    if (!hostname) return res.status(400).json({ error: 'hostname is required' });

-    // Issue #106 — any authenticated user used to be able to POST a heartbeat
-    // for an arbitrary hostname and overwrite the primary node's `api_url`,
-    // effectively hijacking job dispatch. Now: if the caller's token is bound
-    // to a hostname (node-agent tokens are bound at issue time), the body
-    // hostname must match. Admin users with no binding are allowed for ops.
    if (process.env.AUTH_ENABLED === 'true') {
      const bound = req.tokenBoundHostname;
      if (bound && bound !== hostname) {
@ -132,8 +119,8 @@ router.post('/heartbeat', async (req, res, next) => {
    const r = await pool.query(
      `INSERT INTO cluster_nodes
         (hostname, ip_address, role, version, api_url,
-          cpu_usage, mem_used_mb, mem_total_mb, last_seen, capabilities, metadata, metrics)
-       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,NOW(),$9,$10,$11)
+          cpu_usage, mem_used_mb, mem_total_mb, last_seen, last_seen_at, capabilities, metadata, metrics)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,NOW(),NOW(),$9,$10,$11)
       ON CONFLICT (hostname) DO UPDATE SET
         ip_address   = EXCLUDED.ip_address,
         role         = EXCLUDED.role,
@ -143,6 +130,7 @@ router.post('/heartbeat', async (req, res, next) => {
         mem_used_mb  = EXCLUDED.mem_used_mb,
         mem_total_mb = EXCLUDED.mem_total_mb,
         last_seen    = NOW(),
+         last_seen_at = NOW(),
         capabilities = EXCLUDED.capabilities,
         metadata     = EXCLUDED.metadata,
         metrics      = COALESCE(EXCLUDED.metrics, cluster_nodes.metrics)
@ -165,42 +153,25 @@ router.post('/heartbeat', async (req, res, next) => {
  } catch (err) { next(err); }
 });

-// GET /devices/blackmagic/signal – live video-presence state for every
-// DeckLink port across the cluster.  For each port we check whether there is
-// an active SDI recorder assigned to it and, if so, query the capture
-// container for its real signal state (receiving / lost / connecting /
-// error).  Ports without a recorder get signal = 'no-recorder'.
-//
-// Response shape (array):
-//   { node_id, hostname, index, device, model,
-//     signal, framesReceived, currentFps, recorder_id, recorder_status }
 router.get('/devices/blackmagic/signal', async (req, res, next) => {
  try {
-    // 1. Fetch all cluster nodes with DeckLink capabilities.
    const nodesResult = await pool.query(
      `SELECT id, hostname, ip_address, api_url, capabilities,
              EXTRACT(EPOCH FROM (NOW() - last_seen)) AS stale_seconds
       FROM cluster_nodes
       WHERE capabilities IS NOT NULL`
    );
-
-    // 2. Fetch all SDI recorders that are pinned to a node+device_index.
    const recResult = await pool.query(
      `SELECT id, name, status, container_id, node_id, device_index,
              source_config
       FROM recorders
       WHERE source_type = 'sdi' AND node_id IS NOT NULL`
    );
-
-    // Build a fast lookup: "${node_id}:${device_index}" → recorder row.
    const recByPort = new Map();
    for (const r of recResult.rows) {
      const devIdx = r.device_index ?? r.source_config?.device ?? 0;
      recByPort.set(`${r.node_id}:${devIdx}`, r);
    }
-
-    // 3. For each port, determine signal state.  We fire all capture-container
-    //    fetches concurrently so the endpoint stays fast even with many ports.
    const tasks = [];
    for (const node of nodesResult.rows) {
      const nodeOnline = Number(node.stale_seconds) < 120;
@ -208,79 +179,51 @@ router.get('/devices/blackmagic/signal', async (req, res, next) => {
      const model = (node.capabilities && node.capabilities.blackmagic_model) || null;
      const localHostname = process.env.NODE_HOSTNAME || '';
      const isRemote = node.api_url && node.hostname !== localHostname;
-
      bm.forEach((d, idx) => {
        const portIndex = d.index !== undefined ? d.index : idx;
        const rec = recByPort.get(`${node.id}:${portIndex}`);
-
        tasks.push((async () => {
          const base = {
-            node_id:        node.id,
-            hostname:       node.hostname,
-            index:          portIndex,
-            device:         d.device || null,
-            model,
-            node_online:    nodeOnline,
-            recorder_id:    rec ? rec.id : null,
-            recorder_name:  rec ? rec.name : null,
+            node_id: node.id, hostname: node.hostname, index: portIndex,
+            device: d.device || null, model, node_online: nodeOnline,
+            recorder_id: rec ? rec.id : null, recorder_name: rec ? rec.name : null,
            recorder_status: rec ? rec.status : null,
-            signal:         'no-recorder',
-            framesReceived: null,
-            currentFps:     null,
+            signal: 'no-recorder', framesReceived: null, currentFps: null,
          };
-
          if (!rec || rec.status !== 'recording' || !rec.container_id) {
-            // No active capture — if there's a recorder but it's not recording,
-            // report that; otherwise the port is unassigned.
            if (rec && rec.status !== 'recording') base.signal = 'idle';
            return base;
          }
-
-          // Active recording — query the capture container for real signal.
          try {
            let live = null;
            if (isRemote) {
-              const r = await fetch(
-                `${node.api_url}/sidecar/${rec.container_id}/status`,
-                { signal: AbortSignal.timeout(2500) }
-              );
+              const r = await fetch(`${node.api_url}/sidecar/${rec.container_id}/status`, { signal: AbortSignal.timeout(2500) });
              if (r.ok) live = (await r.json()).live;
            } else {
-              const r = await fetch(
-                `http://recorder-${rec.id}:3001/capture/status`,
-                { signal: AbortSignal.timeout(2000) }
-              );
+              const r = await fetch(`http://recorder-${rec.id}:3001/capture/status`, { signal: AbortSignal.timeout(2000) });
              if (r.ok) live = await r.json();
            }
            if (live && live.signal) {
-              base.signal         = live.signal;
+              base.signal = live.signal;
              base.framesReceived = live.framesReceived ?? null;
-              base.currentFps     = live.currentFps     ?? null;
-            } else {
-              base.signal = 'connecting';
-            }
-          } catch (_) {
-            base.signal = 'connecting';
-          }
+              base.currentFps = live.currentFps ?? null;
+            } else { base.signal = 'connecting'; }
+          } catch (_) { base.signal = 'connecting'; }
          return base;
        })());
      });
    }
-
    const results = await Promise.all(tasks);
    res.json(results);
  } catch (err) { next(err); }
 });

-// GET /devices/blackmagic – flatten every node's DeckLink cards for the
-// recorder picker. Returns one entry per device with the host node info.
 router.get('/devices/blackmagic', async (req, res, next) => {
  try {
    const r = await pool.query(
      `SELECT id, hostname, ip_address, role, capabilities,
              EXTRACT(EPOCH FROM (NOW() - last_seen)) AS stale_seconds
-       FROM cluster_nodes
-       WHERE capabilities IS NOT NULL`
+       FROM cluster_nodes WHERE capabilities IS NOT NULL`
    );
    const out = [];
    for (const row of r.rows) {
@ -288,157 +231,98 @@ router.get('/devices/blackmagic', async (req, res, next) => {
      const bm = (row.capabilities && row.capabilities.blackmagic) || [];
      const model = (row.capabilities && row.capabilities.blackmagic_model) || null;
      bm.forEach((d, idx) => {
-        out.push({
-          node_id:    row.id,
-          hostname:   row.hostname,
-          ip_address: row.ip_address,
-          role:       row.role,
-          online,
-          model,
-          index:      d.index !== undefined ? d.index : idx,
-          device:     d.device,
-        });
+        out.push({ node_id: row.id, hostname: row.hostname, ip_address: row.ip_address,
+          role: row.role, online, model, index: d.index !== undefined ? d.index : idx, device: d.device });
      });
    }
    res.json(out);
  } catch (err) { next(err); }
 });

-// GET /devices/deltacast – flatten every node's Deltacast cards for the
-// recorder picker. Mirrors /devices/blackmagic shape so the UI can treat
-// both card types uniformly.
 router.get('/devices/deltacast', async (req, res, next) => {
  try {
    const r = await pool.query(
      `SELECT id, hostname, ip_address, role, capabilities,
              EXTRACT(EPOCH FROM (NOW() - last_seen)) AS stale_seconds
-       FROM cluster_nodes
-       WHERE capabilities IS NOT NULL`
+       FROM cluster_nodes WHERE capabilities IS NOT NULL`
    );
    const out = [];
    for (const row of r.rows) {
      const online = Number(row.stale_seconds) < 120;
-      const dc    = (row.capabilities && row.capabilities.deltacast) || [];
+      const dc = (row.capabilities && row.capabilities.deltacast) || [];
      const model = (row.capabilities && row.capabilities.deltacast_model) || null;
-      // Also synthesise entries from DELTACAST_PORT_COUNT if no entries reported yet —
-      // useful for nodes that haven't sent a heartbeat since the agent was updated.
      dc.forEach((d, idx) => {
-        out.push({
-          node_id:    row.id,
-          hostname:   row.hostname,
-          ip_address: row.ip_address,
-          role:       row.role,
-          online,
-          model:      model || 'Deltacast',
-          index:      d.index !== undefined ? d.index : idx,
-          device:     d.device,
-          present:    d.present !== false,
-          port_count: dc.length,
-        });
+        out.push({ node_id: row.id, hostname: row.hostname, ip_address: row.ip_address,
+          role: row.role, online, model: model || 'Deltacast',
+          index: d.index !== undefined ? d.index : idx, device: d.device,
+          present: d.present !== false, port_count: dc.length });
      });
    }
    res.json(out);
  } catch (err) { next(err); }
 });

-// GET /devices/deltacast/signal – live signal state for Deltacast ports.
-// Same pattern as /devices/blackmagic/signal.
 router.get('/devices/deltacast/signal', async (req, res, next) => {
  try {
    const [nodesRes, recordersRes] = await Promise.all([
-      pool.query(
-        `SELECT id, hostname, ip_address, api_url, capabilities,
+      pool.query(`SELECT id, hostname, ip_address, api_url, capabilities,
                EXTRACT(EPOCH FROM (NOW() - last_seen)) AS stale_seconds
-         FROM cluster_nodes
-         WHERE capabilities IS NOT NULL`
-      ),
-      pool.query(
-        `SELECT id, node_id, device_index, status, source_type, container_id
-         FROM recorders WHERE source_type = 'deltacast'`
-      ),
+         FROM cluster_nodes WHERE capabilities IS NOT NULL`),
+      pool.query(`SELECT id, node_id, device_index, status, source_type, container_id
+         FROM recorders WHERE source_type = 'deltacast'`),
    ]);
-
    const recByNodePort = {};
    for (const rec of recordersRes.rows) {
      recByNodePort[`${rec.node_id}:${rec.device_index}`] = rec;
    }
-
    const results = [];
    const fetchPromises = [];
-
    for (const node of nodesRes.rows) {
      const online = Number(node.stale_seconds) < 120;
      const dc = (node.capabilities && node.capabilities.deltacast) || [];
      const model = (node.capabilities && node.capabilities.deltacast_model) || 'Deltacast';
-
      for (const port of dc) {
        const idx = port.index !== undefined ? port.index : dc.indexOf(port);
        const rec = recByNodePort[`${node.id}:${idx}`];
-        const base = {
-          node_id:       node.id,
-          hostname:      node.hostname,
-          ip_address:    node.ip_address,
-          online,
-          model,
-          index:         idx,
-          device:        port.device,
-          present:       port.present !== false,
-          recorder_id:   rec ? rec.id : null,
-          recorder_status: rec ? rec.status : null,
-          signal:        'no-recorder',
-          framesReceived: null,
-          currentFps:    null,
-        };
-
+        const base = { node_id: node.id, hostname: node.hostname, ip_address: node.ip_address,
+          online, model, index: idx, device: port.device, present: port.present !== false,
+          recorder_id: rec ? rec.id : null, recorder_status: rec ? rec.status : null,
+          signal: 'no-recorder', framesReceived: null, currentFps: null };
        if (!rec) { results.push(base); continue; }
        if (rec.status !== 'recording') { base.signal = 'idle'; results.push(base); continue; }
-
-        // Active recording — query capture container for real signal.
        const fetchIdx = results.length;
        results.push(base);
        fetchPromises.push((async () => {
          try {
-            const url = node.api_url
-              ? `${node.api_url}/sidecar/${rec.container_id}/status`
+            const url = node.api_url ? `${node.api_url}/sidecar/${rec.container_id}/status`
              : `http://recorder-${rec.id}:3001/capture/status`;
            const r = await fetch(url, { signal: AbortSignal.timeout(2500) });
            if (r.ok) {
              const live = await r.json();
              if (live && live.signal) {
-                results[fetchIdx].signal         = live.signal;
+                results[fetchIdx].signal = live.signal;
                results[fetchIdx].framesReceived = live.framesReceived ?? null;
-                results[fetchIdx].currentFps     = live.currentFps ?? null;
+                results[fetchIdx].currentFps = live.currentFps ?? null;
              }
            }
-          } catch (_) {
-            results[fetchIdx].signal = 'connecting';
-          }
+          } catch (_) { results[fetchIdx].signal = 'connecting'; }
        })());
      }
    }
-
    await Promise.all(fetchPromises);
    res.json(results);
  } catch (err) { next(err); }
 });

-// GET /:id/ping – probe the node's api_url/health endpoint directly
 router.get('/:id/ping', async (req, res, next) => {
  try {
-    const r = await pool.query(
-      'SELECT id, hostname, api_url FROM cluster_nodes WHERE id = $1',
-      [req.params.id]
-    );
+    const r = await pool.query('SELECT id, hostname, api_url FROM cluster_nodes WHERE id = $1', [req.params.id]);
    if (r.rowCount === 0) return res.status(404).json({ error: 'Node not found' });
-
    const node = r.rows[0];
    if (!node.api_url) return res.json({ reachable: false, reason: 'no api_url registered' });
-
    const start = Date.now();
    try {
-      const upstream = await fetch(`${node.api_url}/health`, {
-        signal: AbortSignal.timeout(4000),
-      });
+      const upstream = await fetch(`${node.api_url}/health`, { signal: AbortSignal.timeout(4000) });
      const latency_ms = Date.now() - start;
      const body = await upstream.json().catch(() => ({}));
      res.json({ reachable: upstream.ok, latency_ms, status: upstream.status, agent: body });
@ -448,8 +332,6 @@ router.get('/:id/ping', async (req, res, next) => {
  } catch (err) { next(err); }
 });

-
-// GET /metrics - live per-node utilization (CPU, RAM, GPU)
 router.get('/metrics', async (req, res, next) => {
  try {
    const r = await pool.query(
@ -457,59 +339,37 @@ router.get('/metrics', async (req, res, next) => {
              cpu_usage, mem_used_mb, mem_total_mb,
              capabilities, metrics,
              EXTRACT(EPOCH FROM (NOW() - last_seen)) AS stale_seconds
-       FROM cluster_nodes
-       ORDER BY registered_at ASC`
+       FROM cluster_nodes ORDER BY registered_at ASC`
    );
-
    const nodes = r.rows.map(row => {
-      const capGpus  = (row.capabilities && row.capabilities.gpus) || [];
+      const capGpus = (row.capabilities && row.capabilities.gpus) || [];
      const liveGpus = (row.metrics && row.metrics.gpus) || [];
-
      const gpus = capGpus.map((g, idx) => {
        const live = liveGpus.find(l => l.index === g.index) || liveGpus[idx] || {};
-        return {
-          name:            g.name || null,
-          util_pct:        live.util_pct       != null ? live.util_pct       : null,
-          memory_used_mb:  live.memory_used_mb != null ? live.memory_used_mb : null,
-          memory_total_mb: g.memory_mb         != null ? g.memory_mb         : (live.memory_total_mb ?? null),
-        };
+        return { name: g.name || null, util_pct: live.util_pct != null ? live.util_pct : null,
+          memory_used_mb: live.memory_used_mb != null ? live.memory_used_mb : null,
+          memory_total_mb: g.memory_mb != null ? g.memory_mb : (live.memory_total_mb ?? null) };
      });
-      // include any live GPUs not in static capabilities
      for (const lg of liveGpus) {
        if (!capGpus.some(g => g.index === lg.index)) {
-          gpus.push({
-            name:            lg.name            || null,
-            util_pct:        lg.util_pct        != null ? lg.util_pct        : null,
-            memory_used_mb:  lg.memory_used_mb  != null ? lg.memory_used_mb  : null,
-            memory_total_mb: lg.memory_total_mb != null ? lg.memory_total_mb : null,
-          });
+          gpus.push({ name: lg.name || null, util_pct: lg.util_pct != null ? lg.util_pct : null,
+            memory_used_mb: lg.memory_used_mb != null ? lg.memory_used_mb : null,
+            memory_total_mb: lg.memory_total_mb != null ? lg.memory_total_mb : null });
        }
      }
-
-      return {
-        id:           row.id,
-        hostname:     row.hostname,
-        role:         row.role,
-        online:       Number(row.stale_seconds) < 120,
-        last_seen:    row.last_seen,
-        cpu_util_pct: row.cpu_usage   != null ? Number(row.cpu_usage)  : null,
-        ram_used_mb:  row.mem_used_mb  != null ? row.mem_used_mb  : null,
-        ram_total_mb: row.mem_total_mb != null ? row.mem_total_mb : null,
-        gpus,
-      };
+      return { id: row.id, hostname: row.hostname, role: row.role,
+        online: Number(row.stale_seconds) < 120, last_seen: row.last_seen,
+        cpu_util_pct: row.cpu_usage != null ? Number(row.cpu_usage) : null,
+        ram_used_mb: row.mem_used_mb != null ? row.mem_used_mb : null,
+        ram_total_mb: row.mem_total_mb != null ? row.mem_total_mb : null, gpus };
    });
-
    res.json({ nodes });
  } catch (err) { next(err); }
 });

-// DELETE /:id – deregister a node
 router.delete('/:id', async (req, res, next) => {
  try {
-    const r = await pool.query(
-      'DELETE FROM cluster_nodes WHERE id = $1 RETURNING id',
-      [req.params.id]
-    );
+    const r = await pool.query('DELETE FROM cluster_nodes WHERE id = $1 RETURNING id', [req.params.id]);
    if (r.rowCount === 0) return res.status(404).json({ error: 'Node not found' });
    res.json({ ok: true });
  } catch (err) { next(err); }
--- a/services/mam-api/src/routes/playout.js
+++ b/services/mam-api/src/routes/playout.js
@ -0,0 +1,620 @@
+// Playout / Master Control routes.
+//
+// Control plane for the CasparCG-backed playout subsystem. Channels are placed
+// on cluster nodes and their engine containers spawned via the same Docker-socket
+// / node-agent path recorders use; the channel's transport (play / pause / skip)
+// is proxied through to the sidecar's HTTP shim, which drives CasparCG over AMCP.
+//
+// RBAC: every channel carries a project_id (NULL = admin-only, the recorder
+// convention). List routes filter by accessible projects; mutating routes assert
+// 'edit'. See docs/superpowers/specs/2026-05-30-playout-mcr-design.md.
+
+import express from 'express';
+import http from 'http';
+import { Queue } from 'bullmq';
+import pool from '../db/pool.js';
+import { validateUuid } from '../middleware/errors.js';
+import {
+  assertProjectAccess, accessibleProjectIds, isAdmin,
+} from '../auth/authz.js';
+
+const router = express.Router();
+
+const parseRedisUrl = (url) => {
+  const parsed = new URL(url);
+  return { host: parsed.hostname, port: parseInt(parsed.port, 10) };
+};
+const stageQueue = new Queue('playout-stage', {
+  connection: parseRedisUrl(process.env.REDIS_URL || 'redis://queue:6379'),
+});
+
+const PLAYOUT_SIDECAR_IMAGE = process.env.PLAYOUT_IMAGE || 'wild-dragon-playout:latest';
+
+function dockerApi(method, path, body = null) {
+  return new Promise((resolve, reject) => {
+    const options = {
+      socketPath: '/var/run/docker.sock',
+      path: `/v1.43${path}`,
+      method,
+      headers: { 'Content-Type': 'application/json' },
+    };
+    const req = http.request(options, (res) => {
+      let data = '';
+      res.on('data', (chunk) => (data += chunk));
+      res.on('end', () => {
+        try { resolve({ status: res.statusCode, data: data ? JSON.parse(data) : {} }); }
+        catch { resolve({ status: res.statusCode, data }); }
+      });
+    });
+    req.on('error', reject);
+    req.setTimeout(10000, () => req.destroy(new Error('Docker API timeout after 10s')));
+    if (body) req.write(JSON.stringify(body));
+    req.end();
+  });
+}
+
+async function resolveNodeTarget(nodeId) {
+  if (!nodeId) return { remote: false };
+  const r = await pool.query(
+    'SELECT hostname, ip_address, api_url FROM cluster_nodes WHERE id = $1', [nodeId]
+  );
+  if (r.rows.length === 0) return { remote: false };
+  const node = r.rows[0];
+  const localHostname = process.env.NODE_HOSTNAME || '';
+  if (!node.api_url || node.hostname === localHostname) return { remote: false };
+  return { remote: true, apiUrl: node.api_url, ip: node.ip_address };
+}
+
+const SIDECAR_HTTP_PORT = 3002;
+
+function channelAlias(id) { return `playout-${id}`; }
+
+function sidecarBaseUrl(channel) {
+  if (channel.container_meta && channel.container_meta.sidecar_url) {
+    return channel.container_meta.sidecar_url;
+  }
+  return `http://${channelAlias(channel.id)}:${SIDECAR_HTTP_PORT}`;
+}
+
+async function callSidecar(channel, path, method = 'POST', body = null) {
+  const url = `${sidecarBaseUrl(channel)}${path}`;
+  const res = await fetch(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body ? JSON.stringify(body) : undefined,
+    signal: AbortSignal.timeout(20000),
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => '');
+    throw new Error(`sidecar ${method} ${path} -> HTTP ${res.status}: ${text.slice(0, 200)}`);
+  }
+  return res.json().catch(() => ({}));
+}
+
+function channelToJson(r) {
+  return {
+    id: r.id,
+    name: r.name,
+    node_id: r.node_id,
+    output_type: r.output_type,
+    output_config: r.output_config,
+    video_format: r.video_format,
+    status: r.status,
+    container_id: r.container_id,
+    error_message: r.error_message,
+    project_id: r.project_id,
+    restart_count: r.restart_count ?? 0,
+    last_restart_at: r.last_restart_at,
+    last_heartbeat_at: r.last_heartbeat_at,
+    created_at: r.created_at,
+    updated_at: r.updated_at,
+  };
+}
+
+const OUTPUT_TYPES = new Set(['decklink', 'ndi', 'srt', 'rtmp']);
+
+router.param('id', async (req, res, next) => {
+  validateUuid('id')(req, res, () => {});
+  if (res.headersSent) return;
+  try {
+    const { rows } = await pool.query(
+      'SELECT * FROM playout_channels WHERE id = $1', [req.params.id]
+    );
+    if (rows.length === 0) return res.status(404).json({ error: 'Channel not found' });
+    req.channel = rows[0];
+    await assertProjectAccess(req.user, req.channel.project_id, 'view');
+    next();
+  } catch (err) { next(err); }
+});
+
+async function requireChannelEdit(req, res, next) {
+  try { await assertProjectAccess(req.user, req.channel.project_id, 'edit'); next(); }
+  catch (err) { next(err); }
+}
+
+router.get('/channels', async (req, res, next) => {
+  try {
+    let rows;
+    if (isAdmin(req.user)) {
+      ({ rows } = await pool.query('SELECT * FROM playout_channels ORDER BY created_at DESC'));
+    } else {
+      const ids = await accessibleProjectIds(req.user);
+      if (ids.length === 0) return res.json([]);
+      ({ rows } = await pool.query(
+        'SELECT * FROM playout_channels WHERE project_id = ANY($1) ORDER BY created_at DESC', [ids]
+      ));
+    }
+    res.json(rows.map(channelToJson));
+  } catch (err) { next(err); }
+});
+
+router.post('/channels', async (req, res, next) => {
+  try {
+    const { name, node_id = null, output_type = 'srt', output_config = {},
+            video_format = '1080p5994', project_id = null } = req.body || {};
+    if (!name || typeof name !== 'string') {
+      return res.status(400).json({ error: 'name is required' });
+    }
+    if (!OUTPUT_TYPES.has(output_type)) {
+      return res.status(400).json({ error: `output_type must be one of: ${[...OUTPUT_TYPES].join(', ')}` });
+    }
+    if (project_id) await assertProjectAccess(req.user, project_id, 'edit');
+    else if (!isAdmin(req.user)) return res.status(403).json({ error: 'admin required for unassigned channel' });
+
+    const { rows } = await pool.query(
+      `INSERT INTO playout_channels (name, node_id, output_type, output_config, video_format, project_id)
+       VALUES ($1,$2,$3,$4,$5,$6) RETURNING *`,
+      [name.trim(), node_id, output_type, JSON.stringify(output_config), video_format, project_id]
+    );
+    res.status(201).json(channelToJson(rows[0]));
+  } catch (err) { next(err); }
+});
+
+router.patch('/channels/:id', requireChannelEdit, async (req, res, next) => {
+  try {
+    if (req.channel.status === 'running') {
+      return res.status(409).json({ error: 'Cannot edit a running channel — stop it first' });
+    }
+    const allowed = ['name', 'node_id', 'output_type', 'output_config', 'video_format', 'project_id'];
+    const sets = [];
+    const vals = [];
+    let i = 1;
+    for (const k of allowed) {
+      if (req.body[k] === undefined) continue;
+      if (k === 'output_type' && !OUTPUT_TYPES.has(req.body[k])) {
+        return res.status(400).json({ error: 'invalid output_type' });
+      }
+      sets.push(`${k} = $${i++}`);
+      vals.push(k === 'output_config' ? JSON.stringify(req.body[k]) : req.body[k]);
+    }
+    if (sets.length === 0) return res.json(channelToJson(req.channel));
+    vals.push(req.channel.id);
+    const { rows } = await pool.query(
+      `UPDATE playout_channels SET ${sets.join(', ')}, updated_at = NOW() WHERE id = $${i} RETURNING *`, vals
+    );
+    res.json(channelToJson(rows[0]));
+  } catch (err) { next(err); }
+});
+
+router.delete('/channels/:id', requireChannelEdit, async (req, res, next) => {
+  try {
+    if (req.channel.status === 'running') {
+      return res.status(409).json({ error: 'Stop the channel before deleting it' });
+    }
+    await pool.query('DELETE FROM playout_channels WHERE id = $1', [req.channel.id]);
+    res.json({ deleted: true });
+  } catch (err) { next(err); }
+});
+
+async function assertDeckLinkFree(channel) {
+  if (channel.output_type !== 'decklink') return;
+  const idx = (channel.output_config && channel.output_config.device_index) || 1;
+  const chan = await pool.query(
+    `SELECT id FROM playout_channels
+     WHERE id <> $1 AND node_id IS NOT DISTINCT FROM $2 AND status = 'running'
+       AND output_type = 'decklink' AND (output_config->>'device_index')::int = $3`,
+    [channel.id, channel.node_id, idx]
+  );
+  if (chan.rows.length > 0) {
+    throw Object.assign(new Error(`DeckLink device ${idx} already in use by another channel on this node`), { httpStatus: 409 });
+  }
+  const rec = await pool.query(
+    `SELECT id FROM recorders
+     WHERE node_id IS NOT DISTINCT FROM $1 AND device_index = $2
+       AND status = 'recording' AND source_type = 'sdi'`,
+    [channel.node_id, idx]
+  );
+  if (rec.rows.length > 0) {
+    throw Object.assign(new Error(`DeckLink device ${idx} is in use by a recorder on this node`), { httpStatus: 409 });
+  }
+}
+
+async function spawnChannelSidecar(channel) {
+  await pool.query('UPDATE playout_channels SET status = $1, error_message = NULL WHERE id = $2', ['starting', channel.id]);
+
+  const env = [
+    `OUTPUT_TYPE=${channel.output_type}`,
+    `OUTPUT_CONFIG=${JSON.stringify(channel.output_config || {})}`,
+    `VIDEO_FORMAT=${channel.video_format}`,
+    `PORT=${SIDECAR_HTTP_PORT}`,
+    `CHANNEL_ID=${channel.id}`,
+  ];
+
+  const { remote: isRemote, apiUrl: targetNodeApiUrl } = await resolveNodeTarget(channel.node_id);
+  const dockerNetwork = process.env.DOCKER_NETWORK || 'wild-dragon_wild-dragon';
+  let containerId;
+  let containerMeta = {};
+
+  if (isRemote) {
+    const sidecarRes = await fetch(`${targetNodeApiUrl}/sidecar/start`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        image: PLAYOUT_SIDECAR_IMAGE, env,
+        capturePort: SIDECAR_HTTP_PORT,
+        sourceType: channel.output_type,
+        useGpu: false,
+        publishHttp: true,
+      }),
+      signal: AbortSignal.timeout(20000),
+    });
+    if (!sidecarRes.ok) {
+      const details = await sidecarRes.json().catch(() => ({}));
+      console.error('[playout] remote sidecar start failed:', JSON.stringify(details));
+      await pool.query('UPDATE playout_channels SET status = $1, error_message = $2 WHERE id = $3',
+        ['error', 'remote node failed to start sidecar', channel.id]);
+      throw Object.assign(new Error('Remote node failed to start sidecar'), { httpStatus: 502 });
+    }
+    const data = await sidecarRes.json();
+    containerId = data.containerId;
+    if (data.sidecarUrl || data.host) {
+      containerMeta.sidecar_url = data.sidecarUrl || `http://${data.host}:${SIDECAR_HTTP_PORT}`;
+    }
+  } else {
+    const alias = channelAlias(channel.id);
+    const hostBinds = ['/mnt/NVME/MAM/wild-dragon-media:/media'];
+    if (channel.output_type === 'decklink') hostBinds.push('/dev/blackmagic:/dev/blackmagic');
+
+    const containerConfig = {
+      Image: PLAYOUT_SIDECAR_IMAGE,
+      Env: env,
+      HostConfig: {
+        // DeckLink SDI needs raw /dev access (privileged). SRT/NDI/RTMP/HLS run
+        // unprivileged — privileged exposes host GPUs to CasparCG, and the
+        // missing in-container NVIDIA driver crashes the engine within seconds.
+        Privileged: channel.output_type === 'decklink',
+        NetworkMode: dockerNetwork,
+        Binds: hostBinds,
+      },
+      NetworkingConfig: { EndpointsConfig: { [dockerNetwork]: { Aliases: [alias] } } },
+      Hostname: alias,
+    };
+    const createRes = await dockerApi('POST', '/containers/create', containerConfig);
+    if (createRes.status !== 201) {
+      console.error('[playout] container create failed:', JSON.stringify(createRes.data));
+      await pool.query('UPDATE playout_channels SET status = $1, error_message = $2 WHERE id = $3',
+        ['error', 'container create failed', channel.id]);
+      throw Object.assign(new Error('Failed to create container'), { httpStatus: 500 });
+    }
+    containerId = createRes.data.Id;
+    const startRes = await dockerApi('POST', `/containers/${containerId}/start`);
+    if (startRes.status !== 204) {
+      console.error('[playout] container start failed:', JSON.stringify(startRes.data));
+      await dockerApi('DELETE', `/containers/${containerId}?force=true`).catch(() => {});
+      await pool.query('UPDATE playout_channels SET status = $1, error_message = $2 WHERE id = $3',
+        ['error', 'container start failed', channel.id]);
+      throw Object.assign(new Error('Failed to start container'), { httpStatus: 500 });
+    }
+  }
+
+  const { rows } = await pool.query(
+    `UPDATE playout_channels
+     SET status = 'running', container_id = $1, container_meta = $2, updated_at = NOW()
+     WHERE id = $3 RETURNING *`,
+    [containerId, JSON.stringify(containerMeta), channel.id]
+  );
+  return rows[0];
+}
+
+router.post('/channels/:id/start', requireChannelEdit, async (req, res, next) => {
+  try {
+    const channel = req.channel;
+    if (channel.status === 'running' || channel.status === 'starting') {
+      return res.status(409).json({ error: `Channel already ${channel.status}` });
+    }
+    await assertDeckLinkFree(channel);
+    const row = await spawnChannelSidecar(channel);
+    res.json(channelToJson(row));
+  } catch (err) {
+    if (err.httpStatus) return res.status(err.httpStatus).json({ error: err.message });
+    next(err);
+  }
+});
+
+router.post('/channels/:id/stop', requireChannelEdit, async (req, res, next) => {
+  try {
+    const channel = req.channel;
+    if (channel.container_id) {
+      const { remote: isRemote, apiUrl } = await resolveNodeTarget(channel.node_id);
+      if (isRemote) {
+        await fetch(`${apiUrl}/sidecar/stop`, {
+          method: 'POST', headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ containerId: channel.container_id }),
+          signal: AbortSignal.timeout(20000),
+        }).catch((e) => console.error('[playout] remote stop failed:', e.message));
+      } else {
+        await dockerApi('POST', `/containers/${channel.container_id}/stop?t=10`).catch(() => {});
+        await dockerApi('DELETE', `/containers/${channel.container_id}?force=true`).catch(() => {});
+      }
+    }
+    const { rows } = await pool.query(
+      `UPDATE playout_channels SET status = 'stopped', container_id = NULL, updated_at = NOW()
+       WHERE id = $1 RETURNING *`, [channel.id]
+    );
+    res.json(channelToJson(rows[0]));
+  } catch (err) { next(err); }
+});
+
+router.get('/channels/:id/status', async (req, res, next) => {
+  try {
+    if (req.channel.status !== 'running') {
+      return res.json({ running: false, status: req.channel.status });
+    }
+    const out = await callSidecar(req.channel, '/status', 'GET');
+    res.json({ running: true, status: req.channel.status, engine: out });
+  } catch (err) {
+    res.json({ running: true, status: req.channel.status, engine: null, engine_error: err.message });
+  }
+});
+
+async function transport(req, res, action, body = null) {
+  if (req.channel.status !== 'running') {
+    return res.status(409).json({ error: 'Channel is not running' });
+  }
+  try { res.json(await callSidecar(req.channel, action, 'POST', body)); }
+  catch (err) { res.status(502).json({ error: err.message }); }
+}
+
+router.post('/channels/:id/play', requireChannelEdit, async (req, res, next) => {
+  try {
+    if (req.channel.status !== 'running') {
+      return res.status(409).json({ error: 'Start the channel before playing' });
+    }
+    const { playlist_id } = req.body || {};
+    if (!playlist_id) return res.status(400).json({ error: 'playlist_id is required' });
+
+    const pl = await pool.query('SELECT * FROM playout_playlists WHERE id = $1 AND channel_id = $2',
+      [playlist_id, req.channel.id]);
+    if (pl.rows.length === 0) return res.status(404).json({ error: 'Playlist not found for this channel' });
+
+    const items = await pool.query(
+      `SELECT i.*, a.filename AS clip_name, a.duration_ms AS asset_duration_ms
+       FROM playout_items i JOIN assets a ON a.id = i.asset_id
+       WHERE i.playlist_id = $1 ORDER BY i.sort_order ASC`, [playlist_id]);
+
+    const notReady = items.rows.filter((i) => i.media_status !== 'ready' || !i.media_path);
+    if (notReady.length > 0) {
+      return res.status(409).json({
+        error: 'Some items are not staged yet',
+        pending: notReady.map((i) => i.id),
+      });
+    }
+
+    const payload = {
+      loop: pl.rows[0].loop,
+      items: items.rows.map((i) => ({
+        id: i.id, asset_id: i.asset_id, media_path: i.media_path,
+        in_point: i.in_point ? Number(i.in_point) : null,
+        out_point: i.out_point ? Number(i.out_point) : null,
+        transition: i.transition, transition_ms: i.transition_ms,
+        clip_name: i.clip_name,
+        asset_duration_ms: i.asset_duration_ms != null ? Number(i.asset_duration_ms) : null,
+      })),
+    };
+    const out = await callSidecar(req.channel, '/playlist/load', 'POST', payload);
+    res.json(out);
+  } catch (err) { next(err); }
+});
+
+router.post('/channels/:id/pause',  requireChannelEdit, (req, res) => transport(req, res, '/transport/pause'));
+router.post('/channels/:id/resume', requireChannelEdit, (req, res) => transport(req, res, '/transport/resume'));
+router.post('/channels/:id/skip',   requireChannelEdit, (req, res) => transport(req, res, '/transport/skip'));
+router.post('/channels/:id/stop-playback', requireChannelEdit, (req, res) => transport(req, res, '/channel/stop'));
+
+router.get('/channels/:id/asrun', async (req, res, next) => {
+  try {
+    const { rows } = await pool.query(
+      `SELECT * FROM playout_as_run WHERE channel_id = $1 ORDER BY started_at DESC LIMIT 500`,
+      [req.channel.id]);
+    res.json(rows);
+  } catch (err) { next(err); }
+});
+
+async function loadChannelForBody(req, res, next) {
+  const channelId = req.body.channel_id || req.query.channel_id;
+  if (!channelId) return res.status(400).json({ error: 'channel_id is required' });
+  try {
+    const { rows } = await pool.query('SELECT * FROM playout_channels WHERE id = $1', [channelId]);
+    if (rows.length === 0) return res.status(404).json({ error: 'Channel not found' });
+    req.channel = rows[0];
+    await assertProjectAccess(req.user, req.channel.project_id, 'edit');
+    next();
+  } catch (err) { next(err); }
+}
+
+router.get('/playlists', async (req, res, next) => {
+  try {
+    const channelId = req.query.channel_id;
+    if (!channelId) return res.status(400).json({ error: 'channel_id is required' });
+    const ch = await pool.query('SELECT project_id FROM playout_channels WHERE id = $1', [channelId]);
+    if (ch.rows.length === 0) return res.status(404).json({ error: 'Channel not found' });
+    await assertProjectAccess(req.user, ch.rows[0].project_id, 'view');
+    const { rows } = await pool.query(
+      'SELECT * FROM playout_playlists WHERE channel_id = $1 ORDER BY created_at ASC', [channelId]);
+    res.json(rows);
+  } catch (err) { next(err); }
+});
+
+router.post('/playlists', loadChannelForBody, async (req, res, next) => {
+  try {
+    const { name, loop = false } = req.body || {};
+    if (!name) return res.status(400).json({ error: 'name is required' });
+    const { rows } = await pool.query(
+      'INSERT INTO playout_playlists (channel_id, name, loop) VALUES ($1,$2,$3) RETURNING *',
+      [req.channel.id, name.trim(), !!loop]);
+    res.status(201).json(rows[0]);
+  } catch (err) { next(err); }
+});
+
+router.get('/playlists/:plid/items', validateUuid('plid'), async (req, res, next) => {
+  try {
+    const pl = await pool.query(
+      `SELECT p.*, c.project_id FROM playout_playlists p
+       JOIN playout_channels c ON c.id = p.channel_id WHERE p.id = $1`, [req.params.plid]);
+    if (pl.rows.length === 0) return res.status(404).json({ error: 'Playlist not found' });
+    await assertProjectAccess(req.user, pl.rows[0].project_id, 'view');
+    const { rows } = await pool.query(
+      `SELECT i.*, a.filename AS clip_name, a.duration_ms AS asset_duration_ms
+       FROM playout_items i JOIN assets a ON a.id = i.asset_id
+       WHERE i.playlist_id = $1 ORDER BY i.sort_order ASC`, [req.params.plid]);
+    res.json(rows);
+  } catch (err) { next(err); }
+});
+
+async function loadPlaylistEdit(plid, user) {
+  const pl = await pool.query(
+    `SELECT p.*, c.project_id FROM playout_playlists p
+     JOIN playout_channels c ON c.id = p.channel_id WHERE p.id = $1`, [plid]);
+  if (pl.rows.length === 0) { throw Object.assign(new Error('Playlist not found'), { httpStatus: 404 }); }
+  await assertProjectAccess(user, pl.rows[0].project_id, 'edit');
+  return pl.rows[0];
+}
+
+router.post('/playlists/:plid/items', validateUuid('plid'), async (req, res, next) => {
+  try {
+    await loadPlaylistEdit(req.params.plid, req.user);
+    const { asset_id, in_point = null, out_point = null,
+            transition = 'cut', transition_ms = 0 } = req.body || {};
+    if (!asset_id) return res.status(400).json({ error: 'asset_id is required' });
+
+    const ord = await pool.query(
+      'SELECT COALESCE(MAX(sort_order), -1) + 1 AS next FROM playout_items WHERE playlist_id = $1',
+      [req.params.plid]);
+    const { rows } = await pool.query(
+      `INSERT INTO playout_items (playlist_id, asset_id, sort_order, in_point, out_point, transition, transition_ms)
+       VALUES ($1,$2,$3,$4,$5,$6,$7) RETURNING *`,
+      [req.params.plid, asset_id, ord.rows[0].next, in_point, out_point, transition, transition_ms]);
+
+    await stageQueue.add('stage', { itemId: rows[0].id, assetId: asset_id }).catch((e) =>
+      console.error('[playout] failed to enqueue stage job:', e.message));
+
+    res.status(201).json(rows[0]);
+  } catch (err) {
+    if (err.httpStatus) return res.status(err.httpStatus).json({ error: err.message });
+    next(err);
+  }
+});
+
+router.put('/playlists/:plid/reorder', validateUuid('plid'), async (req, res, next) => {
+  const client = await pool.connect();
+  try {
+    await loadPlaylistEdit(req.params.plid, req.user);
+    const { order } = req.body || {};
+    if (!Array.isArray(order)) return res.status(400).json({ error: 'order must be an array of item ids' });
+    await client.query('BEGIN');
+    for (let i = 0; i < order.length; i++) {
+      await client.query(
+        'UPDATE playout_items SET sort_order = $1, updated_at = NOW() WHERE id = $2 AND playlist_id = $3',
+        [i, order[i], req.params.plid]);
+    }
+    await client.query('COMMIT');
+    res.json({ reordered: order.length });
+  } catch (err) {
+    await client.query('ROLLBACK').catch(() => {});
+    if (err.httpStatus) return res.status(err.httpStatus).json({ error: err.message });
+    next(err);
+  } finally { client.release(); }
+});
+
+router.delete('/items/:itemId', validateUuid('itemId'), async (req, res, next) => {
+  try {
+    const it = await pool.query(
+      `SELECT i.id, c.project_id FROM playout_items i
+       JOIN playout_playlists p ON p.id = i.playlist_id
+       JOIN playout_channels c ON c.id = p.channel_id WHERE i.id = $1`, [req.params.itemId]);
+    if (it.rows.length === 0) return res.status(404).json({ error: 'Item not found' });
+    await assertProjectAccess(req.user, it.rows[0].project_id, 'edit');
+    await pool.query('DELETE FROM playout_items WHERE id = $1', [req.params.itemId]);
+    res.json({ deleted: true });
+  } catch (err) { next(err); }
+});
+
+router.post('/items/:itemId/stage', validateUuid('itemId'), async (req, res, next) => {
+  try {
+    const it = await pool.query(
+      `SELECT i.id, i.asset_id, c.project_id FROM playout_items i
+       JOIN playout_playlists p ON p.id = i.playlist_id
+       JOIN playout_channels c ON c.id = p.channel_id WHERE i.id = $1`, [req.params.itemId]);
+    if (it.rows.length === 0) return res.status(404).json({ error: 'Item not found' });
+    await assertProjectAccess(req.user, it.rows[0].project_id, 'edit');
+    await pool.query("UPDATE playout_items SET media_status = 'pending' WHERE id = $1", [req.params.itemId]);
+    await stageQueue.add('stage', { itemId: it.rows[0].id, assetId: it.rows[0].asset_id });
+    res.json({ queued: true });
+  } catch (err) { next(err); }
+});
+
+export async function restartChannel(channelId) {
+  const { rows } = await pool.query('SELECT * FROM playout_channels WHERE id = $1', [channelId]);
+  if (rows.length === 0) return { restarted: false, reason: 'channel not found' };
+  const channel = rows[0];
+
+  if (channel.output_type === 'decklink') {
+    return { restarted: false, reason: 'decklink channels are alert-only' };
+  }
+
+  if (channel.container_id) {
+    const { remote, apiUrl } = await resolveNodeTarget(channel.node_id);
+    if (remote && apiUrl) {
+      await fetch(`${apiUrl}/sidecar/stop`, {
+        method: 'POST', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ containerId: channel.container_id }),
+        signal: AbortSignal.timeout(10000),
+      }).catch(() => {});
+    } else {
+      await dockerApi('DELETE', `/containers/${channel.container_id}?force=true`).catch(() => {});
+    }
+  }
+
+  const nodes = await pool.query(
+    `SELECT id, hostname, api_url, last_seen_at FROM cluster_nodes
+     WHERE id <> $1 AND last_seen_at > NOW() - INTERVAL '60 seconds'
+     ORDER BY last_seen_at DESC LIMIT 1`,
+    [channel.node_id]
+  );
+  if (nodes.rows.length === 0) {
+    await pool.query(
+      "UPDATE playout_channels SET status = 'error', error_message = $1 WHERE id = $2",
+      ['no healthy node available for failover', channel.id]
+    );
+    return { restarted: false, reason: 'no eligible node' };
+  }
+  const newNodeId = nodes.rows[0].id;
+
+  const { rows: moved } = await pool.query(
+    `UPDATE playout_channels
+     SET node_id = $1, status = 'stopped', container_id = NULL, container_meta = '{}'::jsonb,
+         restart_count = restart_count + 1, last_restart_at = NOW(),
+         error_message = NULL, updated_at = NOW()
+     WHERE id = $2 RETURNING *`,
+    [newNodeId, channel.id]
+  );
+
+  try {
+    await spawnChannelSidecar(moved[0]);
+    return { restarted: true, new_node_id: newNodeId };
+  } catch (err) {
+    return { restarted: false, reason: `respawn failed: ${err.message}` };
+  }
+}
+
+export default router;
--- a/services/mam-api/src/routes/users.js
+++ b/services/mam-api/src/routes/users.js
@ -3,10 +3,12 @@
 import express from 'express';
 import pool from '../db/pool.js';
 import { hashPassword } from '../auth/passwords.js';
-import { DEV_USER_ID } from '../middleware/auth.js';
+import { DEV_USER_ID, requireAdmin } from '../middleware/auth.js';
+import { accessibleProjectIds } from '../auth/authz.js';

 const router = express.Router();
 const MIN_PASSWORD_LEN = 12;
+const ROLES = ['admin', 'editor', 'viewer'];

 function bad(res, msg) { return res.status(400).json({ error: msg }); }

@ -14,7 +16,7 @@ function bad(res, msg) { return res.status(400).json({ error: msg }); }
 router.get('/', async (_req, res, next) => {
  try {
    const { rows } = await pool.query(
-      `SELECT id, username, display_name, role, last_login_at, created_at
+      `SELECT id, username, display_name, role, totp_enabled, last_login_at, created_at
       FROM users WHERE id <> $1 ORDER BY username`, [DEV_USER_ID]);
    res.json(rows);
  } catch (err) { next(err); }
@ -26,6 +28,7 @@ router.post('/', async (req, res, next) => {
    const { username, password, display_name, role } = req.body || {};
    if (!username || typeof username !== 'string') return bad(res, 'username required');
    if (!password || password.length < MIN_PASSWORD_LEN) return bad(res, 'password must be at least ' + MIN_PASSWORD_LEN + ' chars');
+    if (role !== undefined && !ROLES.includes(role)) return bad(res, "role must be one of: " + ROLES.join(', '));
    const hash = await hashPassword(password);
    const { rows } = await pool.query(
      `INSERT INTO users (username, password_hash, display_name, role)
@ -76,7 +79,10 @@ router.patch('/:id', async (req, res, next) => {
    if (req.params.id === DEV_USER_ID) return res.status(400).json({ error: 'cannot edit dev user' });
    const sets = []; const vals = [];
    if (typeof req.body?.display_name === 'string') { sets.push('display_name = $' + (sets.length + 1)); vals.push(req.body.display_name); }
-    if (typeof req.body?.role         === 'string') { sets.push('role = $'         + (sets.length + 1)); vals.push(req.body.role); }
+    if (typeof req.body?.role         === 'string') {
+      if (!ROLES.includes(req.body.role)) return bad(res, "role must be one of: " + ROLES.join(', '));
+      sets.push('role = $'         + (sets.length + 1)); vals.push(req.body.role);
+    }
    if (typeof req.body?.password     === 'string') {
      if (req.body.password.length < MIN_PASSWORD_LEN) return bad(res, 'password must be at least ' + MIN_PASSWORD_LEN + ' chars');
      sets.push('password_hash = $' + (sets.length + 1) + ', password_updated_at = NOW()');
@ -93,4 +99,88 @@ router.patch('/:id', async (req, res, next) => {
  } catch (err) { next(err); }
 });

+// GET /:id/access — effective per-project access for one user (admin only).
+// Reuses authz.accessibleProjectIds (MAX over direct user grant + every group the
+// user belongs to). `via` is 'direct' for a user grant, 'group:<name>' otherwise.
+// When the effective level comes from several sources we report the direct grant
+// if present, else the first contributing group.
+router.get('/:id/access', requireAdmin, async (req, res, next) => {
+  try {
+    const { rows: urows } = await pool.query(
+      `SELECT id, role FROM users WHERE id = $1`, [req.params.id]);
+    if (urows.length === 0) return res.status(404).json({ error: 'user not found' });
+    const target = urows[0];
+
+    const { rows: groups } = await pool.query(
+      `SELECT g.id, g.name
+         FROM user_groups ug JOIN groups g ON g.id = ug.group_id
+        WHERE ug.user_id = $1 ORDER BY g.name`, [target.id]);
+
+    // Admins bypass scoping — every project at 'edit', via their role.
+    const access = await accessibleProjectIds(target);
+    if (access.all) {
+      const { rows: projects } = await pool.query(
+        `SELECT id, name FROM projects ORDER BY name`);
+      return res.json({
+        projects: projects.map(p => ({
+          project_id: p.id, project_name: p.name, level: 'edit', via: 'direct',
+        })),
+        groups,
+      });
+    }
+
+    const ids = [...access.ids];
+    if (ids.length === 0) return res.json({ projects: [], groups });
+
+    // Resolve names + the source of each grant. groupNameById lets us label a
+    // group-sourced grant; a direct user grant always wins the `via` label.
+    const groupNameById = new Map(groups.map(g => [g.id, g.name]));
+    const { rows: grants } = await pool.query(
+      `SELECT pa.project_id, pa.subject_type, pa.subject_id, pa.level, p.name AS project_name
+         FROM project_access pa JOIN projects p ON p.id = pa.project_id
+        WHERE (pa.subject_type = 'user'  AND pa.subject_id = $1)
+           OR (pa.subject_type = 'group' AND pa.subject_id IN (
+                SELECT group_id FROM user_groups WHERE user_id = $1
+              ))`,
+      [target.id]);
+
+    const byProject = new Map();
+    for (const g of grants) {
+      const eff = access.levelByProject.get(g.project_id);  // already the MAX
+      const via = g.subject_type === 'user'
+        ? 'direct'
+        : 'group:' + (groupNameById.get(g.subject_id) || g.subject_id);
+      const prev = byProject.get(g.project_id);
+      // Keep a row only if it carries the effective level; prefer a direct grant
+      // when both a direct and a group grant hit the same level.
+      if (g.level === eff && (!prev || (prev.via !== 'direct' && via === 'direct'))) {
+        byProject.set(g.project_id, {
+          project_id: g.project_id, project_name: g.project_name, level: eff, via,
+        });
+      }
+    }
+
+    res.json({
+      projects: [...byProject.values()].sort((a, b) => a.project_name.localeCompare(b.project_name)),
+      groups,
+    });
+  } catch (err) { next(err); }
+});
+
+// POST /:id/totp/disable — admin clears a locked-out user's 2FA WITHOUT their
+// password (the self-service /auth/totp/disable needs the victim's own). Mirrors
+// that handler's SQL but targets :id and skips the password check. Dev user blocked.
+router.post('/:id/totp/disable', requireAdmin, async (req, res, next) => {
+  try {
+    if (req.params.id === DEV_USER_ID) return res.status(400).json({ error: 'cannot edit dev user' });
+    const { rowCount } = await pool.query(
+      `UPDATE users SET totp_enabled = FALSE, totp_secret = NULL, totp_last_counter = 0
+         WHERE id = $1 AND id <> $2`,
+      [req.params.id, DEV_USER_ID]);
+    if (rowCount === 0) return res.status(404).json({ error: 'user not found' });
+    await pool.query(`DELETE FROM user_recovery_codes WHERE user_id = $1`, [req.params.id]);
+    res.status(204).end();
+  } catch (err) { next(err); }
+});
+
 export default router;
--- a/services/mam-api/src/scheduler.js
+++ b/services/mam-api/src/scheduler.js
@ -9,6 +9,8 @@

 import pool from './db/pool.js';
 import { syncToAmpp } from './routes/upload.js';
+import { restartChannel } from './routes/playout.js';
+import { INTERNAL_TOKEN } from './middleware/auth.js';

 const TICK_INTERVAL_MS = parseInt(process.env.SCHEDULER_TICK_MS || '15000', 10);
 const SELF_URL = process.env.MAM_API_SELF_URL || `http://127.0.0.1:${process.env.PORT || 3000}`;
@ -19,7 +21,10 @@ let _interval = null;
 async function callSelf(path, method = 'POST') {
  const res = await fetch(`${SELF_URL}${path}`, {
    method,
-    headers: { 'Content-Type': 'application/json' },
+    headers: {
+      'Content-Type': 'application/json',
+      'x-internal-token': INTERNAL_TOKEN,
+    },
    signal: AbortSignal.timeout(30000),
  });
  if (!res.ok) {
@ -29,11 +34,7 @@ async function callSelf(path, method = 'POST') {
  return res.json().catch(() => ({}));
 }

-// Issue #103 — every mam-api replica runs the same tick on the same interval,
-// so a multi-node deploy would double-fire recorder starts/stops. We guard
-// the whole tick with a PG advisory lock (1 = scheduler) so exactly one
-// replica processes a given interval. Pure-Postgres, no extra infra.
-const SCHEDULER_LOCK_KEY = 8210301; // arbitrary, must be stable across replicas
+const SCHEDULER_LOCK_KEY = 8210301;

 async function tryAcquireSchedulerLock(client) {
  const r = await client.query('SELECT pg_try_advisory_lock($1) AS got', [SCHEDULER_LOCK_KEY]);
@ -52,14 +53,9 @@ async function tick() {
  try {
    haveLock = await tryAcquireSchedulerLock(client);
    if (!haveLock) {
-      // Another replica is processing this interval — bail silently.
      return;
    }

-    // 1) Atomically claim pending schedules whose window has opened. The
-    //    UPDATE...RETURNING flips status to 'running' in the same statement
-    //    so even if another replica got past the lock (it can't, but
-    //    belt-and-braces) each row can only be claimed once.
    const dueStart = await client.query(
      `UPDATE recorder_schedules
          SET status = 'starting', updated_at = NOW()
@ -92,7 +88,6 @@ async function tick() {
      }
    }

-    // 2) Atomically claim running schedules whose window has closed.
    const dueStop = await client.query(
      `UPDATE recorder_schedules
          SET status = 'stopping', updated_at = NOW()
@ -115,7 +110,6 @@ async function tick() {
        console.log(`[scheduler] stopped schedule "${s.name}" on recorder ${s.recorder_id}`);
        await enqueueNextOccurrence(s, client);
      } catch (err) {
-        // Stop failed — flag as failed but don't keep trying forever.
        await client.query(
          `UPDATE recorder_schedules
           SET status = 'failed', error_message = $2, updated_at = NOW()
@ -126,7 +120,6 @@ async function tick() {
      }
    }

-    // 3) If a schedule was cancelled while running, stop the recorder.
    const cancelledRunning = await client.query(
      `SELECT s.* FROM recorder_schedules s
       JOIN recorders r ON r.id = s.recorder_id
@ -142,9 +135,6 @@ async function tick() {
      }
    }

-    // 4) Mark stale live assets as 'error' (#66).
-    // If a capture container crashes without calling mark-empty/mark-complete,
-    // the asset row stays status='live' indefinitely. Timeout after 2 hours.
    const LIVE_TIMEOUT_MINUTES = parseInt(process.env.LIVE_ASSET_TIMEOUT_MINUTES || '120', 10);
    const staleResult = await client.query(
      `UPDATE assets
@ -161,9 +151,6 @@ async function tick() {
      }
    }

-    // 5) AMPP sync retry (#77). Pick up any pending/failed rows whose
-    //    next-attempt time has arrived and retry them. Cap per tick so we
-    //    don't burn budget on a single rough interval.
    const ampps = await client.query(
      `SELECT id, project_id, bin_id FROM assets
        WHERE ampp_sync_status IN ('pending', 'failed')
@ -175,6 +162,8 @@ async function tick() {
    for (const row of ampps.rows) {
      await syncToAmpp(row.id, row.project_id, row.bin_id);
    }
+
+    await playoutHealthTick(client);
  } catch (err) {
    console.error('[scheduler] tick error:', err);
  } finally {
@ -201,11 +190,73 @@ async function enqueueNextOccurrence(schedule, client) {
  console.log(`[scheduler] queued next "${schedule.name}" → ${start.toISOString()}`);
 }

+// ── Playout channel health + failover ────────────────────────────────────────
+// Tick step 6. Reuses the same advisory lock so only one replica probes the
+// sidecars. A missed probe is counted via last_heartbeat_at age: > 3 *
+// TICK_INTERVAL means 3 consecutive misses.
+//
+// IMPORTANT: when last_heartbeat_at is NULL (channel just spawned, no
+// successful tick yet), use updated_at as the grace anchor — otherwise the
+// "0" fallback makes ageMs huge and the channel is instantly failover-killed
+// before its first heartbeat can ever land.
+async function playoutHealthTick(client) {
+  let channels;
+  try {
+    ({ rows: channels } = await client.query(
+      `SELECT id, output_type, container_meta, node_id, last_heartbeat_at, updated_at, restart_count
+         FROM playout_channels WHERE status = 'running'`
+    ));
+  } catch (err) {
+    if (err.code === '42P01') return;
+    throw err;
+  }
+
+  const TIMEOUT_MS = TICK_INTERVAL_MS * 3 + 5000;
+  for (const ch of channels) {
+    const sidecarUrl =
+      ch.container_meta && ch.container_meta.sidecar_url
+        ? ch.container_meta.sidecar_url
+        : `http://playout-${ch.id}:3002`;
+    try {
+      const r = await fetch(`${sidecarUrl}/status`, { signal: AbortSignal.timeout(5000) });
+      if (!r.ok) throw new Error(`status HTTP ${r.status}`);
+      await client.query(
+        'UPDATE playout_channels SET last_heartbeat_at = NOW() WHERE id = $1', [ch.id]
+      );
+    } catch (err) {
+      const lastSeen = ch.last_heartbeat_at
+        ? new Date(ch.last_heartbeat_at).getTime()
+        : new Date(ch.updated_at).getTime();
+      const ageMs = Date.now() - lastSeen;
+      if (ageMs < TIMEOUT_MS) continue;
+
+      if (ch.output_type === 'decklink') {
+        await client.query(
+          "UPDATE playout_channels SET status = 'error', error_message = $1 WHERE id = $2",
+          [`sidecar unreachable (${err.message}); decklink channels require manual recovery`, ch.id]
+        );
+        console.error(`[scheduler] decklink channel ${ch.id} unreachable — alert-only, no auto-failover`);
+        continue;
+      }
+
+      console.warn(`[scheduler] failover: channel ${ch.id} unreachable (${err.message}), restart #${ch.restart_count + 1}`);
+      try {
+        const res = await restartChannel(ch.id);
+        if (res.restarted) {
+          console.log(`[scheduler] failover: channel ${ch.id} re-placed on node ${res.new_node_id}`);
+        } else {
+          console.error(`[scheduler] failover: channel ${ch.id} restart skipped — ${res.reason}`);
+        }
+      } catch (err2) {
+        console.error(`[scheduler] failover error for ${ch.id}: ${err2.message}`);
+      }
+    }
+  }
+}
+
 export function startSchedulerLoop() {
  if (_interval) return;
  console.log(`[scheduler] tick loop started (interval=${TICK_INTERVAL_MS}ms)`);
-  // Fire once on startup so a window that opened while the API was down
-  // doesn't have to wait a full interval.
  setTimeout(() => tick().catch(() => {}), 2000);
  _interval = setInterval(() => tick().catch(() => {}), TICK_INTERVAL_MS);
 }
--- a/services/playout/Dockerfile
+++ b/services/playout/Dockerfile
@ -0,0 +1,58 @@
+# Wild Dragon Playout sidecar — CasparCG Server + Node AMCP control shim.
+FROM ubuntu:22.04
+
+ARG CASPAR_VERSION=2.4.0-stable
+ARG CASPAR_URL=https://github.com/CasparCG/server/releases/download/v2.4.0-stable/casparcg-server-v2.4.0-stable-ubuntu22.zip
+ARG NDI_SDK_URL=
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# CEF (HTML producer) needs libnss3 + chromium runtime deps. Without these the
+# server starts fine but SIGABRTs ~30s in when it lazy-inits CEF (NSS -8023).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates curl unzip tar xz-utils gnupg \
+      xvfb libgl1-mesa-dri libglu1-mesa fonts-dejavu-core \
+      libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \
+      libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 \
+      libgbm1 libpango-1.0-0 libcairo2 libasound2 libatspi2.0-0 \
+  && mkdir -p /etc/apt/keyrings \
+  && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
+       | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
+  && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" \
+       > /etc/apt/sources.list.d/nodesource.list \
+  && apt-get update && apt-get install -y --no-install-recommends nodejs \
+  && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /tmp/caspar
+RUN set -eux; \
+  curl -fsSL "$CASPAR_URL" -o caspar.zip; \
+  unzip -q caspar.zip -d /opt; \
+  chmod +x /opt/casparcg_server/bin/casparcg /opt/casparcg_server/scanner 2>/dev/null || true; \
+  ls /opt/casparcg_server/; \
+  test -x /opt/casparcg_server/bin/casparcg; \
+  ln -sfn /opt/casparcg_server /opt/casparcg; \
+  echo "caspar binary: /opt/casparcg_server/bin/casparcg"; \
+  cd /; rm -rf /tmp/caspar
+
+RUN if [ -n "$NDI_SDK_URL" ]; then \
+      mkdir -p /opt/ndi-lib && \
+      curl -fsSL "$NDI_SDK_URL" -o /tmp/ndi.tar.gz && \
+      tar xzf /tmp/ndi.tar.gz -C /tmp && \
+      find /tmp -name 'libndi*.so*' -exec cp -a {} /opt/ndi-lib/ \; && \
+      rm -f /tmp/ndi.tar.gz && ldconfig /opt/ndi-lib || true; \
+    fi
+ENV NDI_RUNTIME_DIR_V6=/opt/ndi-lib
+
+RUN mkdir -p /media
+
+WORKDIR /app
+COPY package*.json ./
+RUN npm install --omit=dev
+COPY . .
+
+COPY casparcg.config /opt/casparcg/casparcg.config
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+EXPOSE 3002 5250
+ENTRYPOINT ["/entrypoint.sh"]
--- a/services/playout/casparcg.config
+++ b/services/playout/casparcg.config
@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <paths>
+    <media-path>/media/</media-path>
+    <log-path>/media/casparcg/log/</log-path>
+    <data-path>/media/casparcg/data/</data-path>
+    <template-path>/media/templates/</template-path>
+  </paths>
+  <channels>
+    <channel>
+      <video-mode>1080i5994</video-mode>
+      <consumers>
+      </consumers>
+    </channel>
+  </channels>
+  <controllers>
+    <tcp>
+      <port>5250</port>
+      <protocol>AMCP</protocol>
+    </tcp>
+  </controllers>
+</configuration>
--- a/services/playout/entrypoint.sh
+++ b/services/playout/entrypoint.sh
@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ -z "${DISPLAY:-}" ]; then
+  echo "[entrypoint] starting Xvfb on :99"
+  Xvfb :99 -screen 0 1920x1080x24 -nolisten tcp &
+  export DISPLAY=:99
+  for i in $(seq 1 20); do
+    [ -e /tmp/.X11-unix/X99 ] && break
+    sleep 0.25
+  done
+fi
+
+if [ -n "${CHANNEL_ID:-}" ]; then
+  mkdir -p "/media/live/${CHANNEL_ID}"
+fi
+
+mkdir -p /media/casparcg/log /media/casparcg/data /media/templates
+
+# CEF (HTML producer) initialises an NSS database at /root/.pki/nssdb and
+# Chrome caches under HOME. Pre-create writable dirs so CEF doesn't SIGABRT
+# ~30s into the run when it first lazily inits.
+mkdir -p /root/.pki/nssdb /root/.cache /tmp/cef-cache
+chmod 700 /root/.pki/nssdb
+export HOME=/root
+
+# 2.4.x zip bundles its own .so files under lib/ — add to LD_LIBRARY_PATH.
+export LD_LIBRARY_PATH="/opt/casparcg/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+
+cd /opt/casparcg
+CASPAR_CFG=/opt/casparcg/casparcg.config
+# 2.4.x: binary at bin/casparcg. 2.5.x: symlinked to casparcg at root.
+if [ -x "./bin/casparcg" ]; then CASPAR_BIN="./bin/casparcg";
+elif [ -x "./casparcg" ]; then CASPAR_BIN="./casparcg";
+elif [ -x "./CasparCG Server" ]; then CASPAR_BIN="./CasparCG Server";
+elif command -v casparcg >/dev/null; then CASPAR_BIN="casparcg";
+else echo "[entrypoint] ERROR: casparcg binary not found"; exit 1; fi
+echo "[entrypoint] launching CasparCG: $CASPAR_BIN $CASPAR_CFG"
+"$CASPAR_BIN" "$CASPAR_CFG" &
+CASPAR_PID=$!
+
+term() {
+  echo "[entrypoint] terminating CasparCG ($CASPAR_PID)"
+  kill -TERM "$CASPAR_PID" 2>/dev/null || true
+  wait "$CASPAR_PID" 2>/dev/null || true
+  exit 0
+}
+trap term SIGTERM SIGINT
+
+cd /app
+node src/index.js &
+NODE_PID=$!
+
+wait -n "$CASPAR_PID" "$NODE_PID"
+term
--- a/services/playout/package.json
+++ b/services/playout/package.json
@ -0,0 +1,18 @@
+{
+  "name": "wild-dragon-playout",
+  "version": "1.0.0",
+  "description": "Wild Dragon MAM playout sidecar — wraps a CasparCG Server instance and drives it over AMCP for master-control playout (SDI / NDI / SRT / RTMP).",
+  "type": "module",
+  "main": "src/index.js",
+  "scripts": {
+    "start": "node src/index.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "express": "^4.18.0",
+    "cors": "^2.8.0",
+    "dotenv": "^16.4.0"
+  }
+}
--- a/services/playout/src/amcp.js
+++ b/services/playout/src/amcp.js
@ -0,0 +1,182 @@
+import net from 'node:net';
+
+// Minimal AMCP (Advanced Media Control Protocol) client for CasparCG.
+//
+// AMCP is a line-based TCP protocol: each command is a single CRLF-terminated
+// line, and the server replies with a status line ("201 PLAY OK\r\n") optionally
+// followed by data lines. We keep one persistent socket per CasparCG instance
+// and serialize commands through a FIFO queue — CasparCG processes one command
+// at a time per connection, so interleaving replies would otherwise be
+// ambiguous.
+//
+// We only implement the subset the playout sidecar needs (PLAY / LOADBG / STOP /
+// CLEAR / INFO / ADD / REMOVE). Responses are returned raw; callers parse the
+// status code where they care.
+
+const CRLF = '\r\n';
+
+export class AmcpClient {
+  constructor({ host = '127.0.0.1', port = 5250 } = {}) {
+    this.host = host;
+    this.port = port;
+    this.socket = null;
+    this.connected = false;
+    this._buffer = '';
+    this._queue = [];        // pending { command, resolve, reject, timer }
+    this._active = null;     // command currently awaiting a reply
+    this._reconnectTimer = null;
+  }
+
+  connect() {
+    if (this.socket) return;
+    const socket = net.createConnection({ host: this.host, port: this.port });
+    socket.setEncoding('utf8');
+    socket.setKeepAlive(true, 10000);
+
+    socket.on('connect', () => {
+      this.connected = true;
+      console.log(`[amcp] connected to ${this.host}:${this.port}`);
+    });
+    socket.on('data', (chunk) => this._onData(chunk));
+    socket.on('error', (err) => {
+      console.error(`[amcp] socket error: ${err.message}`);
+    });
+    socket.on('close', () => {
+      this.connected = false;
+      this.socket = null;
+      // Fail any in-flight + queued commands so callers don't hang.
+      const pending = this._active ? [this._active, ...this._queue] : [...this._queue];
+      this._active = null;
+      this._queue = [];
+      for (const p of pending) {
+        clearTimeout(p.timer);
+        p.reject(new Error('AMCP connection closed'));
+      }
+      this._scheduleReconnect();
+    });
+
+    this.socket = socket;
+  }
+
+  _scheduleReconnect() {
+    if (this._reconnectTimer) return;
+    this._reconnectTimer = setTimeout(() => {
+      this._reconnectTimer = null;
+      console.log('[amcp] reconnecting...');
+      this.connect();
+    }, 2000);
+  }
+
+  // Wait until the socket is usable, up to timeoutMs.
+  async waitReady(timeoutMs = 30000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      if (this.connected) return true;
+      if (!this.socket) this.connect();
+      await new Promise((r) => setTimeout(r, 250));
+    }
+    throw new Error('AMCP not ready within timeout');
+  }
+
+  _onData(chunk) {
+    this._buffer += chunk;
+    // A CasparCG reply is a status line, optionally followed by data lines.
+    // The simplest robust framing: a command's reply is complete when we see a
+    // status line AND (for 2-line "200" multi-line replies) the terminating
+    // blank line. For our command subset, single-status-line replies dominate;
+    // we treat a reply as complete at each newline and let the active command
+    // decide whether it has enough. To keep this correct for INFO (multi-line),
+    // we accumulate until the buffer ends with a known terminator.
+    if (!this._active) {
+      // Unsolicited data (e.g. connection banner) — discard.
+      this._buffer = '';
+      return;
+    }
+    // CasparCG ends multi-line replies with CRLF on an empty line. Single-line
+    // replies (201/202/4xx/5xx) end with a single CRLF. Resolve when we have at
+    // least one complete line; for "200 ... OK" (list follows) wait for the
+    // blank-line terminator.
+    const firstLineEnd = this._buffer.indexOf(CRLF);
+    if (firstLineEnd === -1) return;
+    const statusLine = this._buffer.slice(0, firstLineEnd);
+    const code = parseInt(statusLine, 10);
+
+    if (code === 200) {
+      // Multi-line: data lines until an empty line.
+      const term = this._buffer.indexOf(CRLF + CRLF);
+      if (term === -1) return; // wait for more
+      const full = this._buffer.slice(0, term);
+      this._buffer = this._buffer.slice(term + 4);
+      this._finishActive(null, full);
+      return;
+    }
+
+    if (code === 201 || code === 202) {
+      // 201: one data line follows the status line. 202: status only.
+      if (code === 201) {
+        const secondLineEnd = this._buffer.indexOf(CRLF, firstLineEnd + 2);
+        if (secondLineEnd === -1) return;
+        const full = this._buffer.slice(0, secondLineEnd);
+        this._buffer = this._buffer.slice(secondLineEnd + 2);
+        this._finishActive(null, full);
+      } else {
+        const full = this._buffer.slice(0, firstLineEnd);
+        this._buffer = this._buffer.slice(firstLineEnd + 2);
+        this._finishActive(null, full);
+      }
+      return;
+    }
+
+    // 4xx / 5xx error, or any other single-line status.
+    const full = this._buffer.slice(0, firstLineEnd);
+    this._buffer = this._buffer.slice(firstLineEnd + 2);
+    if (code >= 400) this._finishActive(new Error(`AMCP error: ${full}`), full);
+    else this._finishActive(null, full);
+  }
+
+  _finishActive(err, data) {
+    const active = this._active;
+    this._active = null;
+    if (active) {
+      clearTimeout(active.timer);
+      if (err) active.reject(err);
+      else active.resolve(data);
+    }
+    this._pump();
+  }
+
+  _pump() {
+    if (this._active || this._queue.length === 0) return;
+    const next = this._queue.shift();
+    this._active = next;
+    try {
+      this.socket.write(next.command + CRLF);
+    } catch (err) {
+      this._active = null;
+      clearTimeout(next.timer);
+      next.reject(err);
+    }
+  }
+
+  // Send a single AMCP command and resolve with the raw reply string.
+  send(command, { timeoutMs = 15000 } = {}) {
+    return new Promise((resolve, reject) => {
+      const entry = { command, resolve, reject, timer: null };
+      entry.timer = setTimeout(() => {
+        // Drop from queue if still pending; if active, detach so the next
+        // reply doesn't get misrouted.
+        if (this._active === entry) this._active = null;
+        else this._queue = this._queue.filter((e) => e !== entry);
+        reject(new Error(`AMCP command timed out: ${command}`));
+      }, timeoutMs);
+      this._queue.push(entry);
+      this._pump();
+    });
+  }
+
+  close() {
+    if (this._reconnectTimer) { clearTimeout(this._reconnectTimer); this._reconnectTimer = null; }
+    if (this.socket) { try { this.socket.destroy(); } catch (_) {} this.socket = null; }
+    this.connected = false;
+  }
+}
--- a/services/playout/src/index.js
+++ b/services/playout/src/index.js
@ -0,0 +1,85 @@
+import express from 'express';
+import cors from 'cors';
+import dotenv from 'dotenv';
+import playoutManager from './playout-manager.js';
+
+dotenv.config();
+
+const app = express();
+const PORT = process.env.PORT || 3002;
+
+app.use(cors());
+app.use(express.json());
+
+app.get('/health', (req, res) => res.json({ status: 'ok' }));
+
+// Start the channel's output consumer. Body: { outputType, outputConfig, videoFormat }
+app.post('/channel/start', async (req, res) => {
+  try {
+    const out = await playoutManager.startChannel(req.body || {});
+    res.json(out);
+  } catch (err) {
+    console.error('[playout] /channel/start error:', err.message);
+    res.status(500).json({ error: err.message });
+  }
+});
+
+app.post('/channel/stop', async (req, res) => {
+  try { res.json(await playoutManager.stopChannel()); }
+  catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// Load + start a playlist. Body: { items: [...], loop }
+app.post('/playlist/load', async (req, res) => {
+  try {
+    const { items = [], loop = false } = req.body || {};
+    res.json(await playoutManager.loadPlaylist({ items, loop }));
+  } catch (err) {
+    console.error('[playout] /playlist/load error:', err.message);
+    res.status(500).json({ error: err.message });
+  }
+});
+
+app.post('/transport/skip',   async (req, res) => { try { res.json(await playoutManager.skip()); }   catch (e) { res.status(500).json({ error: e.message }); } });
+app.post('/transport/pause',  async (req, res) => { try { res.json(await playoutManager.pause()); }  catch (e) { res.status(500).json({ error: e.message }); } });
+app.post('/transport/resume', async (req, res) => { try { res.json(await playoutManager.resume()); } catch (e) { res.status(500).json({ error: e.message }); } });
+
+app.get('/status', (req, res) => res.json(playoutManager.getStatus()));
+
+// Auto-start: when the sidecar is spawned by mam-api with channel env, bring up
+// the output consumer immediately so the container is "on air idle" (black/slate)
+// the moment it boots, mirroring the capture sidecar's bootstrap pattern.
+async function bootstrap() {
+  const outputType = process.env.OUTPUT_TYPE;
+  if (!outputType) {
+    console.log('[bootstrap] no OUTPUT_TYPE — on-demand sidecar, waiting for /channel/start');
+    return;
+  }
+  let outputConfig = {};
+  try { outputConfig = JSON.parse(process.env.OUTPUT_CONFIG || '{}'); }
+  catch (err) { console.error('[bootstrap] bad OUTPUT_CONFIG json:', err.message); }
+  const videoFormat = process.env.VIDEO_FORMAT || '1080i5994';
+  try {
+    await playoutManager.startChannel({ outputType, outputConfig, videoFormat });
+  } catch (err) {
+    console.error('[bootstrap] channel start failed:', err.message);
+  }
+}
+
+const server = app.listen(PORT, () => {
+  console.log(`Wild Dragon Playout Service listening on port ${PORT}`);
+  // Give CasparCG a moment to come up (started by the container entrypoint).
+  playoutManager.amcp.connect();
+  bootstrap();
+});
+
+function shutdown(sig) {
+  console.log(`[playout] ${sig} — shutting down`);
+  playoutManager.stopChannel().catch(() => {}).finally(() => {
+    playoutManager.amcp.close();
+    server.close(() => process.exit(0));
+    setTimeout(() => process.exit(0), 5000);
+  });
+}
+process.on('SIGTERM', () => shutdown('SIGTERM'));
+process.on('SIGINT', () => shutdown('SIGINT'));
--- a/services/playout/src/playout-manager.js
+++ b/services/playout/src/playout-manager.js
@ -0,0 +1,316 @@
+import { AmcpClient } from './amcp.js';
+
+// Playout manager — owns one CasparCG channel's lifecycle inside this sidecar.
+//
+// One sidecar container == one CasparCG Server == one logical channel (channel
+// index 1 in CasparCG terms). We add the output consumer (DeckLink / NDI / SRT
+// / RTMP) at start, then walk a playlist by cueing the next clip on a background
+// layer (LOADBG ... AUTO) so CasparCG performs a gapless transition at end of
+// the current clip.
+//
+// Media is referenced by a path relative to CasparCG's configured media folder
+// (/media inside the container). The mam-api stages assets from S3 to that
+// shared volume and passes the resolved relative path on each item.
+
+const CHANNEL = 1;       // single CasparCG channel per sidecar
+const FG_LAYER = 10;     // foreground (on-air) layer
+const MEDIA_ROOT = process.env.CASPAR_MEDIA_ROOT || '/media';
+
+// Channel-id-derived HLS preview path. The mam-api proxies /live/<channel_id>/
+// to this directory (shared media volume) so the UI's existing HLS player
+// (capture's /live/<id> plumbing) works for playout monitors with zero new
+// transport.
+const CHANNEL_ID = process.env.CHANNEL_ID || '';
+const HLS_DIR    = CHANNEL_ID ? `${MEDIA_ROOT}/live/${CHANNEL_ID}` : '';
+
+// CasparCG SEEK / LENGTH are in frames, not seconds. Capture standard is 59.94;
+// SD/film modes need their own values. Default 60000/1001 matches both
+// '1080p5994' and '1080i5994'.
+function fpsFor(videoFormat) {
+  const f = String(videoFormat || '').toLowerCase();
+  if (f.endsWith('5994')) return 60000 / 1001;
+  if (f.endsWith('p60') || f.endsWith('i60'))  return 60;
+  if (f.endsWith('p50') || f.endsWith('i50'))  return 50;
+  if (f.endsWith('2997')) return 30000 / 1001;
+  if (f.endsWith('p30'))  return 30;
+  if (f.endsWith('p25'))  return 25;
+  if (f.endsWith('p24') || f.endsWith('2398')) return 24000 / 1001;
+  return 60000 / 1001;   // safe default for the house standard
+}
+
+// CasparCG transition syntax fragments keyed by our item.transition value.
+function transitionArgs(transition, ms, fps) {
+  if (!transition || transition === 'cut' || !ms) return '';
+  const frames = Math.max(1, Math.round((ms / 1000) * fps));
+  if (transition === 'mix') return ` MIX ${frames}`;
+  if (transition === 'wipe') return ` WIPE ${frames}`;
+  return '';
+}
+
+// Turn an absolute /media path (or a relative one) into the token CasparCG
+// expects: a path relative to MEDIA_ROOT, without extension, forward-slashed.
+// CasparCG resolves "subdir/clip" against its media folder + probes extensions.
+function toCasparToken(mediaPath) {
+  let p = String(mediaPath || '');
+  if (p.startsWith(MEDIA_ROOT)) p = p.slice(MEDIA_ROOT.length);
+  p = p.replace(/^\/+/, '');
+  p = p.replace(/\.[^/.]+$/, ''); // strip extension
+  return p;
+}
+
+export class PlayoutManager {
+  constructor() {
+    this.amcp = new AmcpClient({
+      host: process.env.CASPAR_HOST || '127.0.0.1',
+      port: parseInt(process.env.CASPAR_PORT || '5250', 10),
+    });
+    this.state = {
+      running: false,
+      outputType: null,
+      outputConfig: null,
+      videoFormat: null,
+      playlist: [],        // resolved items in play order
+      currentIndex: -1,
+      loop: false,
+      currentClip: null,
+      startedAt: null,
+      lastError: null,
+    };
+    this._advanceTimer = null;
+  }
+
+  async _consumerCommand(outputType, cfg) {
+    // Returns the AMCP ADD argument string for the requested output target.
+    if (outputType === 'decklink') {
+      const dev = cfg.device_index || 1;
+      return `DECKLINK DEVICE ${dev} EMBEDDED_AUDIO`;
+    }
+    if (outputType === 'ndi') {
+      const name = cfg.ndi_name || 'DRAGONFLIGHT';
+      return `NDI NAME "${name}"`;
+    }
+    if (outputType === 'srt' || outputType === 'rtmp') {
+      // CasparCG 2.3 streams via the FFMPEG consumer, invoked with the STREAM
+      // keyword (FILE/STREAM are interchangeable aliases for it; the bare word
+      // "FFMPEG" is the PRODUCER and is NOT a valid consumer keyword). Args must
+      // use ffmpeg's -param:stream form (-codec:v, not -vcodec) or CasparCG
+      // rejects them. The channel feeds the consumer as RGBA, so a
+      // format=yuv420p filter is required before libx264.
+      const url = cfg.url || '';
+      if (outputType === 'srt') {
+        const latency = cfg.latency || 200;
+        const full = url.includes('latency=') ? url : `${url}${url.includes('?') ? '&' : '?'}latency=${latency}`;
+        return `STREAM "${full}" -format mpegts -codec:v libx264 -preset:v veryfast -tune:v zerolatency -b:v 6M -codec:a aac -b:a 192k -filter:v format=yuv420p`;
+      }
+      const target = cfg.key ? `${url}/${cfg.key}` : url;
+      return `STREAM "${target}" -format flv -codec:v libx264 -preset:v veryfast -tune:v zerolatency -b:v 6M -codec:a aac -b:a 192k -filter:v format=yuv420p`;
+    }
+    throw new Error(`Unknown output_type: ${outputType}`);
+  }
+
+  // Start the channel: bring up CasparCG's primary output consumer for the
+  // target, plus a second FFMPEG consumer writing HLS for the UI preview
+  // monitor (~4-6s lag, reuses capture's /live/<id> plumbing).
+  async startChannel({ outputType, outputConfig = {}, videoFormat = '1080p5994' }) {
+    await this.amcp.waitReady(30000);
+
+    // Set the channel video mode, then attach the output consumer.
+    try { await this.amcp.send(`SET ${CHANNEL} MODE ${videoFormat}`); }
+    catch (err) { console.warn(`[playout] SET MODE failed (continuing): ${err.message}`); }
+
+    const consumer = await this._consumerCommand(outputType, outputConfig);
+    await this.amcp.send(`ADD ${CHANNEL} ${consumer}`);
+
+    if (HLS_DIR) {
+      try {
+        await this._addHlsConsumer();
+        console.log(`[playout] HLS preview at ${HLS_DIR}/index.m3u8`);
+      } catch (err) {
+        // HLS preview is non-fatal — operators still get the on-air output.
+        console.warn(`[playout] HLS preview consumer failed: ${err.message}`);
+      }
+    }
+
+    this.state.running = true;
+    this.state.outputType = outputType;
+    this.state.outputConfig = outputConfig;
+    this.state.videoFormat = videoFormat;
+    this.state.fps = fpsFor(videoFormat);
+    this.state.startedAt = new Date().toISOString();
+    this.state.lastError = null;
+    console.log(`[playout] channel started output=${outputType} mode=${videoFormat} fps=${this.state.fps.toFixed(3)}`);
+    return this.getStatus();
+  }
+
+  // Low-bitrate HLS for the web UI preview. Segments land in the shared media
+  // volume; the mam-api serves /live/<channel_id>/* from there.
+  async _addHlsConsumer() {
+    // mkdir is done by the entrypoint; CasparCG's ffmpeg consumer creates the
+    // playlist on first segment. 2s segments / 6-window list keeps lag low
+    // without thrashing disk.
+    // FILE keyword (alias of the FFMPEG consumer) writing a segmented HLS
+    // playlist. Same arg rules as the STREAM consumer: -param:stream form and a
+    // format=yuv420p filter ahead of libx264 (channel output is RGBA).
+    const out = `${HLS_DIR}/index.m3u8`;
+    const args = [
+      `FILE "${out}"`,
+      '-format hls',
+      '-hls_time 2',
+      '-hls_list_size 6',
+      '-hls_flags delete_segments+append_list',
+      '-codec:v libx264 -preset:v veryfast -tune:v zerolatency -b:v 800k -maxrate 1M -bufsize 2M',
+      '-g 60 -keyint_min 60 -sc_threshold 0',
+      '-codec:a aac -b:a 96k',
+      '-filter:v format=yuv420p',
+    ].join(' ');
+    await this.amcp.send(`ADD ${CHANNEL} ${args}`);
+  }
+
+  async stopChannel() {
+    this._clearAdvance();
+    try { await this.amcp.send(`STOP ${CHANNEL}-${FG_LAYER}`); } catch (_) {}
+    try { await this.amcp.send(`CLEAR ${CHANNEL}`); } catch (_) {}
+    this.state.running = false;
+    this.state.playlist = [];
+    this.state.currentIndex = -1;
+    this.state.currentClip = null;
+    console.log('[playout] channel stopped');
+    return { stopped: true };
+  }
+
+  // Load a playlist (array of { id, asset_id, media_path, in_point, out_point,
+  // transition, transition_ms, clip_name }) and start playing from index 0.
+  async loadPlaylist({ items = [], loop = false }) {
+    this.state.playlist = items;
+    this.state.loop = !!loop;
+    this.state.currentIndex = -1;
+    if (items.length === 0) return this.getStatus();
+    await this._playIndex(0);
+    return this.getStatus();
+  }
+
+  async _playIndex(index) {
+    const item = this.state.playlist[index];
+    if (!item) return;
+    const fps = this.state.fps || fpsFor(this.state.videoFormat);
+    const token = toCasparToken(item.media_path);
+    const seek = item.in_point ? ` SEEK ${Math.round(item.in_point * fps)}` : '';
+    const length = (item.out_point && item.out_point > (item.in_point || 0))
+      ? ` LENGTH ${Math.round((item.out_point - (item.in_point || 0)) * fps)}`
+      : '';
+    const trans = transitionArgs(item.transition, item.transition_ms, fps);
+
+    // PLAY puts the clip on the foreground layer immediately (first clip), with
+    // the configured transition. Subsequent clips are cued via LOADBG ... AUTO
+    // for a gapless hand-off; see _scheduleAdvance.
+    await this.amcp.send(`PLAY ${CHANNEL}-${FG_LAYER} "${token}"${seek}${length}${trans}`);
+    this.state.currentIndex = index;
+    this.state.currentClip = item.clip_name || token;
+    console.log(`[playout] PLAY [${index}] ${token}`);
+    this._reportAsRunStart(item);
+    this._scheduleAdvance(item);
+  }
+
+  // Effective on-air duration of an item in milliseconds. Prefers an explicit
+  // in/out trim, else the asset's full duration. Returns null when unknown (no
+  // duration metadata + no out_point) so the caller can skip the timer.
+  _itemDurationMs(item) {
+    const inS = item.in_point || 0;
+    if (item.out_point && item.out_point > inS) return (item.out_point - inS) * 1000;
+    if (item.asset_duration_ms != null) return Math.max(0, item.asset_duration_ms - inS * 1000);
+    return null;
+  }
+
+  // CasparCG's LOADBG ... AUTO swaps the cued background clip to foreground when
+  // the current clip ends, giving a gapless visual take. But CasparCG won't cue
+  // clip N+2 on its own and won't move OUR pointer / as-run bookkeeping. So we
+  // also arm a duration-based timer: when the current clip is due to end we
+  // advance currentIndex and cue the following clip. This keeps an arbitrary-
+  // length playlist walking, not just the first two items.
+  _scheduleAdvance(item) {
+    this._clearAdvance();
+    const next = this._nextIndex();
+    if (next === null) return;   // end of a non-looping playlist
+    const nextItem = this.state.playlist[next];
+    const nextToken = toCasparToken(nextItem.media_path);
+    const fps = this.state.fps || fpsFor(this.state.videoFormat);
+    const trans = transitionArgs(nextItem.transition, nextItem.transition_ms, fps);
+    // Cue next on background with AUTO so CasparCG performs the gapless take.
+    this.amcp.send(`LOADBG ${CHANNEL}-${FG_LAYER} "${nextToken}" AUTO${trans}`)
+      .catch((err) => console.warn(`[playout] LOADBG failed: ${err.message}`));
+
+    // Arm the pointer-advance timer. Without duration metadata we can't time the
+    // hand-off; leave AUTO to take clip N+1 visually but log a warning since the
+    // pointer (and thus clip N+2 cueing) will stall.
+    const durMs = this._itemDurationMs(item);
+    if (durMs == null) {
+      console.warn(`[playout] no duration for clip [${this.state.currentIndex}] — pointer advance stalled after this clip`);
+      return;
+    }
+    this._advanceTimer = setTimeout(() => {
+      this._advanceTimer = null;
+      // The AUTO take already happened in CasparCG; just move our pointer and
+      // cue the clip after next. _playIndex would re-PLAY and double-take, so we
+      // advance state directly and re-arm.
+      this.state.currentIndex = next;
+      this.state.currentClip = nextItem.clip_name || nextToken;
+      console.log(`[playout] advance -> [${next}] ${nextToken}`);
+      this._reportAsRunStart(nextItem);
+      this._scheduleAdvance(nextItem);
+    }, Math.max(250, durMs));
+  }
+
+  _nextIndex() {
+    const n = this.state.currentIndex + 1;
+    if (n < this.state.playlist.length) return n;
+    if (this.state.loop && this.state.playlist.length > 0) return 0;
+    return null;
+  }
+
+  _clearAdvance() {
+    if (this._advanceTimer) { clearTimeout(this._advanceTimer); this._advanceTimer = null; }
+  }
+
+  async skip() {
+    const next = this._nextIndex();
+    if (next === null) { await this.stopChannel(); return this.getStatus(); }
+    await this._playIndex(next);
+    return this.getStatus();
+  }
+
+  async pause() {
+    try { await this.amcp.send(`PAUSE ${CHANNEL}-${FG_LAYER}`); } catch (_) {}
+    return this.getStatus();
+  }
+
+  async resume() {
+    try { await this.amcp.send(`RESUME ${CHANNEL}-${FG_LAYER}`); } catch (_) {}
+    return this.getStatus();
+  }
+
+  _reportAsRunStart(item) {
+    // The mam-api owns the as-run table; the sidecar just logs locally. The API
+    // polls /status and writes as-run rows on clip change. Keeping the DB write
+    // in the API avoids giving the sidecar a DB connection.
+    this.state.currentItemId = item.id || null;
+    this.state.currentItemStartedAt = new Date().toISOString();
+  }
+
+  getStatus() {
+    return {
+      running: this.state.running,
+      outputType: this.state.outputType,
+      videoFormat: this.state.videoFormat,
+      currentIndex: this.state.currentIndex,
+      currentClip: this.state.currentClip,
+      currentItemId: this.state.currentItemId || null,
+      currentItemStartedAt: this.state.currentItemStartedAt || null,
+      playlistLength: this.state.playlist.length,
+      loop: this.state.loop,
+      startedAt: this.state.startedAt,
+      lastError: this.state.lastError,
+    };
+  }
+}
+
+export default new PlayoutManager();
--- a/services/web-ui/public/app.jsx
+++ b/services/web-ui/public/app.jsx
@ -67,7 +67,7 @@ function App() {
      schedule: ['Ingest', 'Schedule'],
      youtube: ['Ingest', 'YouTube'],
      capture: ['Ingest', 'Capture'], monitors: ['Ingest', 'Monitors'],
-      jobs: ['Jobs'], editor: ['Editor'],
+      jobs: ['Jobs'], editor: ['Editor'], playout: ['Operations', 'Playout'],
      users: ['Admin', 'Users & Groups'], tokens: ['Admin', 'Tokens'],
      containers: ['Admin', 'Containers'], cluster: ['Admin', 'Cluster'],
      settings: ['Admin', 'Settings'],
@ -120,6 +120,7 @@ function App() {
      case 'capture':   content = <Capture navigate={navigate} />; break;
      case 'monitors':  content = <Monitors navigate={navigate} />; break;
      case 'jobs':      content = <Jobs navigate={navigate} />; break;
+      case 'playout':   content = <Playout navigate={navigate} />; break;
      case 'users':     content = <Users />; break;
      case 'tokens':    content = <Tokens />; break;
      case 'billing':   content = <TokensParody />; break;
--- a/services/web-ui/public/data.jsx
+++ b/services/web-ui/public/data.jsx
@ -38,6 +38,12 @@ window.PREMIERE_RELEASES = [
 ];
 window.PREMIERE_LATEST = window.PREMIERE_RELEASES.find(r => r.latest) || window.PREMIERE_RELEASES[0];

+// Teams ISO workstation installer. Placeholder slot: the .exe is not in the
+// repo yet, so `available` is false and the Downloads modal renders the row
+// disabled with a "coming soon" note. Drop the file into public/downloads/
+// and flip `available: true` (set `version`) to finish it.
+window.TEAMS_ISO = { version: null, url: '/downloads/TeamsISO.exe', available: false };
+
 window.ZAMPP_DATA = {
  PROJECTS: [],
  ASSETS: [],
--- a/services/web-ui/public/icons.jsx
+++ b/services/web-ui/public/icons.jsx
@ -8,7 +8,7 @@ const ICONS = {
  upload: <><path d="M12 16V4" /><path d="M6 10l6-6 6 6" /><path d="M4 20h16" /></>,
  record: <><rect x="2" y="6" width="14" height="12" rx="2" /><path d="M22 8l-6 4 6 4V8z" /></>,
  capture: <><circle cx="12" cy="12" r="9" /><circle cx="12" cy="12" r="4" /><circle cx="12" cy="12" r="1" /></>,
-  jobs: <><path d="M3 6h18" /><path d="M3 12h18" /><path d="M3 18h12" /></>,
+  jobs: <><path d="M8 6h13M8 12h13M8 18h13" /><circle cx="4" cy="6" r="1" fill="currentColor" /><circle cx="4" cy="12" r="1" fill="currentColor" /><circle cx="4" cy="18" r="1" fill="currentColor" /></>,
  editor: <><path d="M14.06 2.94l7 7-11 11H3v-7.06l11.06-10.94z" /><path d="M13 4l7 7" /></>,
  users: <><circle cx="9" cy="8" r="4" /><path d="M2 21a7 7 0 0 1 14 0" /><circle cx="17" cy="6" r="3" /><path d="M22 18a5 5 0 0 0-7-4.5" /></>,
  token: <><circle cx="8" cy="15" r="4" /><path d="M10.85 12.15L19 4" /><path d="M18 5l3 3" /><path d="M15 8l3 3" /></>,
@ -29,6 +29,7 @@ const ICONS = {
  audio: <><path d="M3 12v-2a2 2 0 0 1 2-2h2l5-4v16l-5-4H5a2 2 0 0 1-2-2z" /><path d="M16 8a5 5 0 0 1 0 8M19 5a9 9 0 0 1 0 14" /></>,
  image: <><rect x="3" y="3" width="18" height="18" rx="2" /><circle cx="9" cy="9" r="2" /><path d="M21 15l-5-5L5 21" /></>,
  download: <><path d="M12 4v12M6 10l6 6 6-6" /><path d="M4 20h16" /></>,
+  import: <><path d="M15 3h4a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2h-4" /><path d="M10 17l5-5-5-5" /><path d="M15 12H3" /></>,
  key:   <><circle cx="7.5" cy="15.5" r="3.5" /><path d="M10 13l9-9M16 7l3 3M14 9l3 3" /></>,
  lock:  <><rect x="5" y="11" width="14" height="10" rx="2" /><path d="M8 11V7a4 4 0 0 1 8 0v4" /></>,
  edit:  <><path d="M11 4H4a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2v-7" /><path d="M18.5 2.5a2.121 2.121 0 0 1 3 3L12 15l-4 1 1-4 9.5-9.5z" /></>,
@ -38,14 +39,14 @@ const ICONS = {
  x: <path d="M6 6l12 12M6 18L18 6" />,
  filter: <path d="M3 5h18l-7 9v6l-4-2v-4L3 5z" />,
  sort: <><path d="M3 6h13M3 12h9M3 18h5" /><path d="M17 14l3 3 3-3M20 9v8" /></>,
-  grid: <><rect x="3" y="3" width="7" height="7" /><rect x="14" y="3" width="7" height="7" /><rect x="3" y="14" width="7" height="7" /><rect x="14" y="14" width="7" height="7" /></>,
+  grid: <><rect x="3" y="3" width="7" height="7" rx="1" /><rect x="14" y="3" width="7" height="7" rx="1" /><rect x="3" y="14" width="7" height="7" rx="1" /><rect x="14" y="14" width="7" height="7" rx="1" /></>,
  list: <><path d="M8 6h13M8 12h13M8 18h13" /><circle cx="4" cy="6" r="1" fill="currentColor" /><circle cx="4" cy="12" r="1" fill="currentColor" /><circle cx="4" cy="18" r="1" fill="currentColor" /></>,
  comment: <path d="M21 11.5a8.4 8.4 0 0 1-.9 3.8 8.5 8.5 0 0 1-7.6 4.7 8.4 8.4 0 0 1-3.8-.9L3 21l1.9-5.7a8.4 8.4 0 0 1-.9-3.8 8.5 8.5 0 0 1 4.7-7.6 8.4 8.4 0 0 1 3.8-.9h.5a8.5 8.5 0 0 1 8 8v.5z" />,
  clock: <><circle cx="12" cy="12" r="9" /><path d="M12 7v5l3 2" /></>,
  layers: <><path d="M12 2L2 7l10 5 10-5-10-5z" /><path d="M2 17l10 5 10-5M2 12l10 5 10-5" /></>,
  gpu: <><rect x="3" y="7" width="18" height="10" rx="1" /><rect x="6" y="10" width="4" height="4" /><rect x="14" y="10" width="4" height="4" /><path d="M3 11H1M3 13H1M23 11h-2M23 13h-2" /></>,
  cpu: <><rect x="4" y="4" width="16" height="16" rx="2" /><rect x="9" y="9" width="6" height="6" /><path d="M9 1v3M15 1v3M9 20v3M15 20v3M20 9h3M20 14h3M1 9h3M1 14h3" /></>,
-  hdd: <><circle cx="12" cy="12" r="9" /><circle cx="12" cy="12" r="1" fill="currentColor" /></>,
+  hdd: <><ellipse cx="12" cy="6" rx="9" ry="3" /><path d="M3 6v12c0 1.66 4.03 3 9 3s9-1.34 9-3V6" /></>,
  sun: <><circle cx="12" cy="12" r="4" /><path d="M12 2v2M12 20v2M4.9 4.9l1.4 1.4M17.7 17.7l1.4 1.4M2 12h2M20 12h2M4.9 19.1l1.4-1.4M17.7 6.3l1.4-1.4" /></>,
  moon: <path d="M21 12.8A9 9 0 1 1 11.2 3a7 7 0 0 0 9.8 9.8z" />,
  signal: <><path d="M2 20h.01M7 20v-4M12 20v-8M17 20V8M22 20V4" /></>,
@ -66,7 +67,7 @@ const ICONS = {
  power: <><path d="M18.36 6.64a9 9 0 1 1-12.73 0" /><path d="M12 2v10" /></>,
  globe: <><circle cx="12" cy="12" r="9" /><path d="M3 12h18M12 3a14 14 0 0 1 0 18M12 3a14 14 0 0 0 0 18" /></>,
  package: <><path d="M3 7l9-4 9 4M3 7v10l9 4 9-4V7M3 7l9 4 9-4M12 11v10" /></>,
-  proxy: <><rect x="3" y="3" width="18" height="18" rx="2" /><path d="M9 12l3-3 3 3M12 9v8" /></>,
+  proxy: <><path d="M4 6h11M19 6h1M4 12h2M10 12h10M4 18h7M15 18h5" /><circle cx="17" cy="6" r="2" /><circle cx="8" cy="12" r="2" /><circle cx="13" cy="18" r="2" /></>,
 };

 function Icon({ name, size = 16, className, style }) {
--- a/services/web-ui/public/index.html
+++ b/services/web-ui/public/index.html
@ -21,6 +21,7 @@
 <link rel="stylesheet" href="styles-rest.css" />
 <link rel="stylesheet" href="styles-modal.css" />
 <link rel="stylesheet" href="styles-fixes.css" />
+<link rel="stylesheet" href="styles-playout.css" />
 </head>
 <body>
 <div id="root"></div>
@ -47,6 +48,7 @@
 <script src="js/bmd-card.js"></script>
 <script src="dist/screens-editor.js"></script>
 <script src="dist/screens-admin.js"></script>
+<script src="dist/screens-playout.js"></script>
 <script src="dist/modal-new-recorder.js"></script>
 <script src="dist/app.js"></script>
 </body>
--- a/services/web-ui/public/screens-admin.jsx
+++ b/services/web-ui/public/screens-admin.jsx
@ -258,28 +258,7 @@ function Users() {
        {tab === 'groups' && <GroupsPanel groups={groups} users={users} onChange={refreshGroups} />}

        {tab === 'policies' && (
-          <div className="panel" style={{ padding: '32px 24px', color: 'var(--text-2)' }}>
-            <div style={{ display: 'flex', alignItems: 'center', gap: 8, marginBottom: 12 }}>
-              <Icon name="lock" size={16} />
-              <div style={{ fontWeight: 600, fontSize: 14 }}>Access model</div>
-            </div>
-            <div style={{ fontSize: 12.5, color: 'var(--text-3)', lineHeight: 1.7, maxWidth: 640 }}>
-              <div style={{ marginBottom: 8 }}>
-                <strong style={{ color: 'var(--text-2)' }}>admin</strong> — full access to every
-                project plus user, group, cluster, and system administration.
-              </div>
-              <div style={{ marginBottom: 8 }}>
-                <strong style={{ color: 'var(--text-2)' }}>editor / viewer</strong> — see only the
-                projects they've been granted. A <em>view</em> grant is read-only; an
-                <em> edit</em> grant allows changes. Grants can target an individual user or a group.
-              </div>
-              <div>
-                Manage a project's grants from the <strong style={{ color: 'var(--text-2)' }}>Projects</strong> page
-                → a project's <em>Manage access…</em> menu. Group membership is managed on the
-                Groups tab above.
-              </div>
-            </div>
-          </div>
+          <PoliciesPanel users={users} onChange={refreshUsers} />
        )}
      </div>
      {showInvite && <InviteUserModal onCreated={onCreated} onClose={() => setShowInvite(false)} />}
@ -299,6 +278,204 @@ function Users() {
  );
 }

+// ────────────────────────────────────────────────────────────────────────────
+// PoliciesPanel - interactive per-user permission matrix for the Policies tab.
+// Keeps the access-model explainer as a small header, then renders one row per
+// user with: inline role <select> (PATCH /users/:id), a 2FA badge driven by
+// totp_enabled, an admin-only "Reset 2FA" action (POST /users/:id/totp/disable,
+// 204), and an Access expander backed by GET /users/:id/access.
+// ────────────────────────────────────────────────────────────────────────────
+function PoliciesPanel({ users, onChange }) {
+  const [expandedId, setExpandedId] = React.useState(null);
+  const [err, setErr] = React.useState(null);
+
+  const changeRole = (u, newRole) => {
+    if (u.role === newRole) return;
+    setErr(null);
+    window.ZAMPP_API.fetch('/users/' + u.id, { method: 'PATCH', body: JSON.stringify({ role: newRole }) })
+      .then(() => onChange && onChange())
+      .catch(e => setErr('Role change failed: ' + (e.message || e)));
+  };
+
+  // Reset 2FA uses a raw fetch because ZAMPP_API.fetch throws on the 204 (no JSON
+  // body). Mirrors the disable() pattern in TotpSection.
+  const resetTotp = (u) => {
+    if (!confirm(`Reset two-factor for "${u.name}" (@${u.username})?\nThey will be able to sign in without a code until they re-enrol.`)) return;
+    setErr(null);
+    fetch('/api/v1/users/' + u.id + '/totp/disable', {
+      method: 'POST',
+      credentials: 'include',
+      headers: { 'X-Requested-With': 'dragonflight-ui' },
+    })
+      .then(r => {
+        if (r.status === 204) { onChange && onChange(); return; }
+        return r.json().catch(() => ({})).then(b => { throw new Error(b.error || ('Failed (' + r.status + ')')); });
+      })
+      .catch(e => setErr('Reset 2FA failed: ' + (e.message || e)));
+  };
+
+  return (
+    <div>
+      {/* Access-model explainer (kept from the old static tab, condensed) */}
+      <div className="panel" style={{ padding: '16px 20px', marginBottom: 12, color: 'var(--text-2)' }}>
+        <div style={{ display: 'flex', alignItems: 'center', gap: 8, marginBottom: 10 }}>
+          <Icon name="lock" size={15} />
+          <div style={{ fontWeight: 600, fontSize: 13.5 }}>Access model</div>
+        </div>
+        <div style={{ fontSize: 12, color: 'var(--text-3)', lineHeight: 1.6, maxWidth: 720 }}>
+          <strong style={{ color: 'var(--text-2)' }}>admin</strong> has full access to every project plus
+          user, group, cluster, and system administration. <strong style={{ color: 'var(--text-2)' }}>editor / viewer</strong> see
+          only the projects they're granted — a <em>view</em> grant is read-only, an <em>edit</em> grant
+          allows changes, and grants can target a user or a group. Edit per-project grants from the{' '}
+          <a href="#" onClick={e => { e.preventDefault(); window.dispatchEvent(new CustomEvent('df:nav', { detail: 'projects' })); }}
+             style={{ color: 'var(--accent-text)' }}>Projects</a> page; manage group membership on the Groups tab above.
+        </div>
+      </div>
+
+      {err && <div style={{ fontSize: 12, color: 'var(--danger)', marginBottom: 8 }}>{err}</div>}
+
+      <div className="panel">
+        <div className="user-row head">
+          <div>User</div>
+          <div>Role</div>
+          <div>2FA</div>
+          <div>Access</div>
+          <div></div>
+        </div>
+        {users.length === 0 && (
+          <div style={{ padding: '32px 0', textAlign: 'center', color: 'var(--text-3)' }}>No users found</div>
+        )}
+        {users.map(u => (
+          <UserPolicyRow key={u.id} user={u}
+            expanded={expandedId === u.id}
+            onToggle={() => setExpandedId(expandedId === u.id ? null : u.id)}
+            onChangeRole={changeRole}
+            onResetTotp={resetTotp} />
+        ))}
+      </div>
+    </div>
+  );
+}
+
+function UserPolicyRow({ user: u, expanded, onToggle, onChangeRole, onResetTotp }) {
+  const [access, setAccess] = React.useState(null);  // null = not loaded, {} once fetched
+  const [loading, setLoading] = React.useState(false);
+  const [accessErr, setAccessErr] = React.useState(null);
+
+  // Lazily fetch GET /users/:id/access the first time the row is expanded.
+  React.useEffect(() => {
+    if (!expanded || access !== null) return;
+    setLoading(true); setAccessErr(null);
+    window.ZAMPP_API.fetch('/users/' + u.id + '/access')
+      .then(d => setAccess(d || {}))
+      .catch(e => { setAccess({}); setAccessErr(e.message || 'Failed to load access'); })
+      .finally(() => setLoading(false));
+  }, [expanded, access, u.id]);
+
+  const projects = (access && access.projects) || [];
+  const memberships = (access && (access.groups || access.memberships)) || [];
+
+  return (
+    <div style={{ borderBottom: '1px solid var(--border)' }}>
+      <div className="user-row" style={{ borderBottom: 'none' }}>
+        <div style={{ display: 'flex', alignItems: 'center', gap: 10 }}>
+          <div className="avatar" style={{ width: 32, height: 32, fontSize: 11, background: avatarColor(u.initials || u.id) }}>{u.initials || '??'}</div>
+          <div>
+            <div style={{ fontWeight: 500, fontSize: 13 }}>{u.name}</div>
+            <div className="mono" style={{ fontSize: 11, color: 'var(--text-3)' }}>@{u.username}</div>
+          </div>
+        </div>
+        <div>
+          <select value={u.role || 'viewer'}
+                  onChange={e => onChangeRole(u, e.target.value)}
+                  className="field-input"
+                  style={{ width: 90, padding: '3px 6px', fontSize: 11.5, appearance: 'auto' }}>
+            <option value="admin">admin</option>
+            <option value="editor">editor</option>
+            <option value="viewer">viewer</option>
+          </select>
+        </div>
+        <div>
+          {u.totp_enabled
+            ? <span className="badge success"><Icon name="key" size={10} /> 2FA on</span>
+            : <span className="badge neutral">2FA off</span>}
+        </div>
+        <div>
+          <button className="btn ghost sm" onClick={onToggle}>
+            {expanded ? 'Hide' : 'View'}
+          </button>
+        </div>
+        <div style={{ display: 'flex', justifyContent: 'flex-end' }}>
+          {u.totp_enabled && (
+            <button className="btn ghost sm danger" onClick={() => onResetTotp(u)} title="Disable this user's two-factor">
+              <Icon name="key" size={11} />Reset 2FA
+            </button>
+          )}
+        </div>
+      </div>
+
+      {expanded && (
+        <div style={{ padding: '0 16px 16px 16px', background: 'var(--bg-2)' }}>
+          {loading && <div style={{ padding: '12px 0', fontSize: 12.5, color: 'var(--text-3)' }}>Loading access…</div>}
+          {accessErr && <div style={{ padding: '8px 0', fontSize: 12, color: 'var(--danger)' }}>{accessErr}</div>}
+          {!loading && !accessErr && (u.role === 'admin') && (
+            <div style={{ padding: '12px 0', fontSize: 12.5, color: 'var(--text-3)', display: 'flex', alignItems: 'center', gap: 6 }}>
+              <Icon name="check" size={12} style={{ color: 'var(--success)' }} />
+              Admin — full access to every project.
+            </div>
+          )}
+          {!loading && !accessErr && u.role !== 'admin' && (
+            <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: 16, paddingTop: 12 }}>
+              {/* Accessible projects */}
+              <div>
+                <div style={{ fontSize: 11, color: 'var(--text-3)', textTransform: 'uppercase', letterSpacing: '0.06em', fontWeight: 600, marginBottom: 8 }}>
+                  Projects ({projects.length})
+                </div>
+                {projects.length === 0 && (
+                  <div style={{ fontSize: 12, color: 'var(--text-4)' }}>No project access granted.</div>
+                )}
+                {projects.map(p => {
+                  // Backend `via` is 'direct' for a user grant, or 'group:<name>'
+                  // when inherited from a group. Split the label off the prefix.
+                  const via = p.via || 'direct';
+                  const isGroup = via.indexOf('group') === 0;
+                  const viaLabel = isGroup ? (via.indexOf(':') >= 0 ? via.slice(via.indexOf(':') + 1) : 'group') : 'direct';
+                  return (
+                    <div key={(p.project_id || p.id) + ':' + via}
+                         style={{ display: 'flex', alignItems: 'center', gap: 8, padding: '6px 0', borderBottom: '1px solid var(--border)' }}>
+                      <span style={{ fontSize: 12.5, flex: 1 }}>{p.project_name || p.name || p.project_id || p.id}</span>
+                      <span className={`badge ${(p.level === 'edit') ? 'accent' : 'neutral'}`}>{p.level || 'view'}</span>
+                      <span className="badge neutral" title={isGroup ? 'Inherited from group ' + viaLabel : 'Granted directly'}>
+                        <Icon name={isGroup ? 'users' : 'user'} size={9} /> {viaLabel}
+                      </span>
+                    </div>
+                  );
+                })}
+              </div>
+              {/* Group memberships */}
+              <div>
+                <div style={{ fontSize: 11, color: 'var(--text-3)', textTransform: 'uppercase', letterSpacing: '0.06em', fontWeight: 600, marginBottom: 8 }}>
+                  Groups ({memberships.length})
+                </div>
+                {memberships.length === 0 && (
+                  <div style={{ fontSize: 12, color: 'var(--text-4)' }}>Not a member of any group.</div>
+                )}
+                <div style={{ display: 'flex', flexWrap: 'wrap', gap: 6 }}>
+                  {memberships.map(g => (
+                    <span key={g.id || g.group_id || g.name} className="badge neutral" style={{ display: 'inline-flex', alignItems: 'center', gap: 5 }}>
+                      <Icon name="users" size={9} />{g.name || g.group_name || g.group_id}
+                    </span>
+                  ))}
+                </div>
+              </div>
+            </div>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
+
 function EditUserModal({ user, onClose, onSaved }) {
  const [name, setName] = React.useState(user.display_name || user.name || '');
  const [saving, setSaving] = React.useState(false);
--- a/services/web-ui/public/screens-home.jsx
+++ b/services/web-ui/public/screens-home.jsx
@ -18,17 +18,24 @@
 //   Anything that would just say "all clear" is hidden, not rendered.

 function Home({ navigate }) {
-  const [showPremiereDownload, setShowPremiereDownload] = React.useState(false);
+  const [showDownloads, setShowDownloads] = React.useState(false);

  // Pull live counts so the tile subtitles ("34 assets", "0 live", "3 running")
  // reflect what's actually in the DB right now, not a stale boot-time cache.
  const [cards, setCards] = React.useState({});
+  // Playout has no /metrics/home card yet (and the playout schema may not be
+  // migrated on every install); fetch /playout/channels separately and degrade
+  // silently — the tile just shows "No channels" if the endpoint isn't there.
+  const [playoutChannels, setPlayoutChannels] = React.useState(null);
  React.useEffect(() => {
    let cancelled = false;
    const load = () => {
      window.ZAMPP_API.fetch('/metrics/home?hours=1')
        .then(d => { if (!cancelled) setCards(d?.cards || {}); })
        .catch(() => {});
+      window.ZAMPP_API.fetch('/playout/channels')
+        .then(d => { if (!cancelled) setPlayoutChannels(Array.isArray(d) ? d : []); })
+        .catch(() => { if (!cancelled) setPlayoutChannels([]); });
    };
    load();
    const t = setInterval(load, 30_000);
@ -64,12 +71,27 @@ function Home({ navigate }) {
      desc: 'SDI · SRT · RTMP ingest. Start, stop, schedule.',
    },
    {
-      id: '__premiere',
-      label: 'Premiere panel',
-      icon: 'editor',
+      id: 'playout',
+      label: 'Playout',
+      icon: 'signal',
+      tone: 'accent',
+      sub: (() => {
+        if (playoutChannels === null) return '·';
+        const total = playoutChannels.length;
+        const onAir = playoutChannels.filter(c => c.status === 'running').length;
+        if (total === 0) return 'No channels';
+        if (onAir > 0) return onAir + ' on air · ' + total + ' channel' + (total === 1 ? '' : 's');
+        return total + ' channel' + (total === 1 ? '' : 's');
+      })(),
+      desc: 'Master Control. SDI · NDI · SRT · RTMP playout, playlists, as-run.',
+    },
+    {
+      id: '__downloads',
+      label: 'Downloads',
+      icon: 'download',
      tone: 'purple',
-      sub: 'v' + ((window.PREMIERE_LATEST || {}).version || '·'),
-      desc: 'Download the Adobe Premiere Pro panel for frame-accurate editing.',
+      sub: 'Plugin · Teams ISO',
+      desc: 'Download the Premiere Pro UXP plugin and the Teams ISO installer.',
    },
    {
      id: 'jobs',
@ -118,7 +140,10 @@ function Home({ navigate }) {
          />
          <h1 className="launcher-wordmark">DRAGONFLIGHT</h1>
          <p className="launcher-tagline">
-            Self-hosted broadcast media-asset management
+            Media Asset Management &amp; Production Platform
+          </p>
+          <p className="launcher-tagline launcher-tagline-motto">
+            Let's create
          </p>
        </div>

@ -127,7 +152,7 @@ function Home({ navigate }) {
            <button
              key={t.id}
              className={'launcher-tile tone-' + t.tone}
-              onClick={() => t.id === '__premiere' ? setShowPremiereDownload(true) : navigate(t.id)}
+              onClick={() => t.id === '__downloads' ? setShowDownloads(true) : navigate(t.id)}
            >
              <span className="launcher-tile-icon">
                <Icon name={t.icon} size={26} />
@ -146,7 +171,7 @@ function Home({ navigate }) {
            onClick={() => navigate('dashboard')}
          >
            <span className="launcher-tile-icon">
-              <Icon name="home" size={22} />
+              <Icon name="layout" size={22} />
            </span>
            <span className="launcher-tile-label">Dashboard</span>
            <span className="launcher-tile-sub">Operations view</span>
@ -241,15 +266,17 @@ function Home({ navigate }) {
          )}
        </div>
      </div>
-      {showPremiereDownload && <PremiereDownloadModal onClose={() => setShowPremiereDownload(false)} />}
+      {showDownloads && <DownloadsModal onClose={() => setShowDownloads(false)} />}
    </div>
  );
 }

-// Modal listing all Premiere panel downloads (ZXP + Windows installer for
-// each released version). Sourced from window.PREMIERE_RELEASES, written by
-// the Settings → SDKs section in screens-admin.jsx.
-function PremiereDownloadModal({ onClose }) {
+// Modal listing all downloads: the Premiere Pro UXP plugin (.ccx, one per
+// released version, sourced from window.PREMIERE_RELEASES written by the
+// Settings → SDKs section in screens-admin.jsx) plus the Teams ISO installer
+// (window.TEAMS_ISO; the .exe slot is wired but the file may still be pending).
+function DownloadsModal({ onClose }) {
+  const teamsIso = window.TEAMS_ISO || {};
  const releases = (window.PREMIERE_RELEASES || []).slice().sort((a, b) => {
    // Newest first; fall back to lexicographic compare on version string.
    const av = String(a.version || ''), bv = String(b.version || '');
@ -262,15 +289,40 @@ function PremiereDownloadModal({ onClose }) {
      <div className="modal" onClick={(e) => e.stopPropagation()} style={{ maxWidth: 560 }}>
        <div className="modal-head">
          <div>
-            <div style={{ fontSize: 15, fontWeight: 600 }}>Premiere panel</div>
+            <div style={{ fontSize: 15, fontWeight: 600 }}>Downloads</div>
            <div style={{ fontSize: 12, color: 'var(--text-3)', marginTop: 2 }}>
-              Adobe Premiere Pro (UXP) integration. Install the .ccx per workstation via the Adobe UXP Developer Tool, or double-click it with Creative Cloud installed.
+              The Premiere Pro (UXP) plugin and the Teams ISO installer. Install the .ccx per workstation via the Adobe UXP Developer Tool, or double-click it with Creative Cloud installed.
            </div>
          </div>
          <button className="icon-btn" aria-label="Close" onClick={onClose}><Icon name="x" /></button>
        </div>

        <div className="modal-body">
+          <div className="premiere-release">
+            <div className="premiere-release-head">
+              <span className="premiere-release-version mono">Teams ISO</span>
+              {teamsIso.version && (
+                <span className="premiere-release-date mono">v{teamsIso.version}</span>
+              )}
+            </div>
+            <div className="premiere-release-notes">
+              Windows installer for the Teams ISO workstation build.
+            </div>
+            <div className="premiere-release-actions">
+              {teamsIso.available && teamsIso.url ? (
+                <a href={teamsIso.url} download className="btn primary sm">
+                  <Icon name="download" />Teams ISO (.exe)
+                </a>
+              ) : (
+                <>
+                  <span className="btn primary sm" aria-disabled="true" style={{ opacity: 0.5, pointerEvents: 'none' }}>
+                    <Icon name="download" />Teams ISO (.exe)
+                  </span>
+                  <span style={{ fontSize: 11.5, color: 'var(--text-3)' }}>coming soon — file pending</span>
+                </>
+              )}
+            </div>
+          </div>
          {releases.length === 0 && (
            <div style={{ padding: '24px 0', textAlign: 'center', color: 'var(--text-3)', fontSize: 12 }}>
              No releases registered yet. Upload one from Settings → Capture SDKs.
--- a/services/web-ui/public/screens-playout.jsx
+++ b/services/web-ui/public/screens-playout.jsx
@ -0,0 +1,460 @@
+// screens-playout.jsx — Master Control (MCR) playout page.
+//
+// Operator workflow (Phase A — playlist player):
+//   1. Create / pick a channel (output target: SRT / RTMP / NDI / DeckLink).
+//   2. Start the channel → spawns the CasparCG sidecar, brings up the output.
+//   3. Drag assets from the media bin into the playlist; reorder by dragging.
+//      Each item stages from S3 to the CasparCG /media volume in the background.
+//   4. Hit PLAY → the engine walks the playlist gaplessly. PAUSE / SKIP / STOP
+//      transport. As-run log records what aired.
+//
+// Talks to /api/v1/playout via window.ZAMPP_API.fetch. Native HTML5 drag-drop,
+// no extra library. Components are plain globals (esbuild bundle:false).
+
+const PO_OUTPUTS = [
+  { value: 'srt',      label: 'SRT' },
+  { value: 'rtmp',     label: 'RTMP' },
+  { value: 'ndi',      label: 'NDI' },
+  { value: 'decklink', label: 'SDI (DeckLink)' },
+];
+
+const PO_FORMATS = ['1080p5994', '1080i5994', '1080p2997', '720p5994', '1080i50', '1080p25'];
+
+async function poFetch(path, opts) {
+  return window.ZAMPP_API.fetch('/playout' + path, opts);
+}
+
+// ── Output-config sub-form (varies by output type) ───────────────────────────
+function OutputConfigFields({ type, config, onChange }) {
+  const set = (k, v) => onChange({ ...config, [k]: v });
+  if (type === 'decklink') {
+    return (
+      <div className="field">
+        <label className="field-label">DeckLink device index</label>
+        <input className="field-input" type="number" min="1" value={config.device_index || 1}
+          onChange={e => set('device_index', parseInt(e.target.value, 10) || 1)} />
+      </div>
+    );
+  }
+  if (type === 'ndi') {
+    return (
+      <div className="field">
+        <label className="field-label">NDI source name</label>
+        <input className="field-input" value={config.ndi_name || ''} placeholder="DRAGONFLIGHT CH1"
+          onChange={e => set('ndi_name', e.target.value)} />
+      </div>
+    );
+  }
+  // srt / rtmp
+  return (
+    <React.Fragment>
+      <div className="field">
+        <label className="field-label">{type.toUpperCase()} URL</label>
+        <input className="field-input mono" value={config.url || ''}
+          placeholder={type === 'srt' ? 'srt://host:9000' : 'rtmp://host/live'}
+          onChange={e => set('url', e.target.value)} />
+      </div>
+      {type === 'rtmp' && (
+        <div className="field">
+          <label className="field-label">Stream key</label>
+          <input className="field-input mono" value={config.key || ''}
+            onChange={e => set('key', e.target.value)} />
+        </div>
+      )}
+      {type === 'srt' && (
+        <div className="field">
+          <label className="field-label">Latency (ms)</label>
+          <input className="field-input" type="number" value={config.latency || 200}
+            onChange={e => set('latency', parseInt(e.target.value, 10) || 200)} />
+        </div>
+      )}
+    </React.Fragment>
+  );
+}
+
+// ── Channel create modal ─────────────────────────────────────────────────────
+function ChannelCreate({ onClose, onCreated }) {
+  const PROJECTS = window.ZAMPP_DATA?.PROJECTS || [];
+  const [name, setName] = React.useState('');
+  const [outputType, setOutputType] = React.useState('srt');
+  const [config, setConfig] = React.useState({});
+  const [videoFormat, setVideoFormat] = React.useState('1080i5994');
+  const [projectId, setProjectId] = React.useState(PROJECTS[0]?.id || '');
+  const [busy, setBusy] = React.useState(false);
+  const [err, setErr] = React.useState(null);
+
+  const submit = async () => {
+    setBusy(true); setErr(null);
+    try {
+      const ch = await poFetch('/channels', {
+        method: 'POST',
+        body: JSON.stringify({
+          name, output_type: outputType, output_config: config,
+          video_format: videoFormat, project_id: projectId || null,
+        }),
+      });
+      onCreated(ch);
+    } catch (e) { setErr(e.message || 'Failed to create channel'); }
+    finally { setBusy(false); }
+  };
+
+  return (
+    <div className="modal-backdrop" onClick={onClose}>
+      <div className="modal" onClick={e => e.stopPropagation()} style={{ maxWidth: 460 }}>
+        <div className="modal-header"><h3>New Playout Channel</h3></div>
+        <div className="modal-body">
+          <div className="field">
+            <label className="field-label">Name</label>
+            <input className="field-input" value={name} autoFocus
+              onChange={e => setName(e.target.value)} placeholder="Channel 1" />
+          </div>
+          <div className="field">
+            <label className="field-label">Output</label>
+            <select className="field-input" value={outputType}
+              onChange={e => { setOutputType(e.target.value); setConfig({}); }}>
+              {PO_OUTPUTS.map(o => <option key={o.value} value={o.value}>{o.label}</option>)}
+            </select>
+          </div>
+          <OutputConfigFields type={outputType} config={config} onChange={setConfig} />
+          <div className="field">
+            <label className="field-label">Video format</label>
+            <select className="field-input" value={videoFormat} onChange={e => setVideoFormat(e.target.value)}>
+              {PO_FORMATS.map(f => <option key={f} value={f}>{f}</option>)}
+            </select>
+          </div>
+          <div className="field">
+            <label className="field-label">Project (RBAC scope)</label>
+            <select className="field-input" value={projectId} onChange={e => setProjectId(e.target.value)}>
+              <option value="">— admin only —</option>
+              {PROJECTS.map(p => <option key={p.id} value={p.id}>{p.name}</option>)}
+            </select>
+          </div>
+          {err && <div className="alert error">{err}</div>}
+        </div>
+        <div className="modal-footer">
+          <button className="btn ghost" onClick={onClose}>Cancel</button>
+          <button className="btn primary" disabled={busy || !name} onClick={submit}>
+            {busy ? 'Creating…' : 'Create'}
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+// ── Media bin: assets draggable into the playlist ────────────────────────────
+function MediaBin({ projectId }) {
+  const ASSETS = (window.ZAMPP_DATA?.ASSETS || []).filter(a =>
+    !projectId || a.project_id === projectId);
+  const [q, setQ] = React.useState('');
+  const filtered = ASSETS.filter(a => !q || (a.name || '').toLowerCase().includes(q.toLowerCase()));
+
+  const onDragStart = (e, asset) => {
+    e.dataTransfer.setData('application/x-df-asset', JSON.stringify({ id: asset.id, name: asset.name }));
+    e.dataTransfer.effectAllowed = 'copy';
+  };
+
+  return (
+    <div className="panel po-bin">
+      <div className="po-bin-head">
+        <span className="po-section-label">Media Bin</span>
+        <input className="field-input sm" placeholder="Filter…" value={q}
+          onChange={e => setQ(e.target.value)} style={{ maxWidth: 160 }} />
+      </div>
+      <div className="po-bin-list">
+        {filtered.length === 0 && <div className="muted" style={{ padding: 12 }}>No assets.</div>}
+        {filtered.map(a => (
+          <div key={a.id} className="po-bin-item" draggable
+            onDragStart={e => onDragStart(e, a)} title="Drag into the playlist">
+            <span className="po-bin-name">{a.name}</span>
+            <span className="mono muted" style={{ fontSize: 11 }}>{a.duration || ''}</span>
+          </div>
+        ))}
+      </div>
+    </div>
+  );
+}
+
+const MEDIA_STATUS_BADGE = {
+  ready:   'success', staging: 'warn', pending: 'neutral', error: 'error',
+};
+
+// ── Playlist: ordered, drag-drop reorder, drop-target for bin assets ─────────
+function Playlist({ channel, playlistId, items, onReload }) {
+  const [dragIndex, setDragIndex] = React.useState(null);
+
+  const onItemDragStart = (e, index) => {
+    setDragIndex(index);
+    e.dataTransfer.effectAllowed = 'move';
+  };
+  const onItemDragOver = (e) => { e.preventDefault(); };
+  const onItemDrop = async (e, index) => {
+    e.preventDefault();
+    // Asset dropped from the bin → append.
+    const assetRaw = e.dataTransfer.getData('application/x-df-asset');
+    if (assetRaw) {
+      const asset = JSON.parse(assetRaw);
+      await poFetch('/playlists/' + playlistId + '/items', {
+        method: 'POST', body: JSON.stringify({ asset_id: asset.id }),
+      });
+      onReload();
+      return;
+    }
+    // Reorder within the playlist.
+    if (dragIndex === null || dragIndex === index) return;
+    const order = items.map(i => i.id);
+    const [moved] = order.splice(dragIndex, 1);
+    order.splice(index, 0, moved);
+    setDragIndex(null);
+    await poFetch('/playlists/' + playlistId + '/reorder', {
+      method: 'PUT', body: JSON.stringify({ order }),
+    });
+    onReload();
+  };
+  // Dropping onto empty area appends.
+  const onContainerDrop = async (e) => {
+    const assetRaw = e.dataTransfer.getData('application/x-df-asset');
+    if (!assetRaw) return;
+    e.preventDefault();
+    const asset = JSON.parse(assetRaw);
+    await poFetch('/playlists/' + playlistId + '/items', {
+      method: 'POST', body: JSON.stringify({ asset_id: asset.id }),
+    });
+    onReload();
+  };
+
+  const removeItem = async (id) => {
+    await poFetch('/items/' + id, { method: 'DELETE' });
+    onReload();
+  };
+  const restage = async (id) => {
+    await poFetch('/items/' + id + '/stage', { method: 'POST' });
+    onReload();
+  };
+
+  return (
+    <div className="panel po-playlist" onDragOver={e => e.preventDefault()} onDrop={onContainerDrop}>
+      <div className="po-section-label" style={{ padding: '8px 12px' }}>Playlist</div>
+      {items.length === 0 && (
+        <div className="muted po-playlist-empty">Drag clips here to build the playlist.</div>
+      )}
+      {items.map((it, index) => (
+        <div key={it.id} className="po-pl-item" draggable
+          onDragStart={e => onItemDragStart(e, index)}
+          onDragOver={onItemDragOver}
+          onDrop={e => onItemDrop(e, index)}>
+          <span className="po-pl-index">{index + 1}</span>
+          <span className="po-pl-name">{it.clip_name || it.asset_id}</span>
+          <span className={'badge ' + (MEDIA_STATUS_BADGE[it.media_status] || 'neutral')}>
+            {it.media_status}
+          </span>
+          {it.media_status === 'error' && (
+            <button className="btn ghost xs" onClick={() => restage(it.id)}>Retry</button>
+          )}
+          <button className="btn ghost xs" onClick={() => removeItem(it.id)}>✕</button>
+        </div>
+      ))}
+    </div>
+  );
+}
+
+// ── Transport bar ────────────────────────────────────────────────────────────
+function Transport({ channel, playlistId, onStatus }) {
+  const [busy, setBusy] = React.useState(false);
+  const act = async (fn) => { setBusy(true); try { await fn(); } catch (e) { alert(e.message); } finally { setBusy(false); } };
+
+  const play = () => act(async () => {
+    const r = await poFetch('/channels/' + channel.id + '/play', {
+      method: 'POST', body: JSON.stringify({ playlist_id: playlistId }),
+    });
+    onStatus && onStatus(r);
+  });
+  const pause  = () => act(() => poFetch('/channels/' + channel.id + '/pause',  { method: 'POST' }));
+  const resume = () => act(() => poFetch('/channels/' + channel.id + '/resume', { method: 'POST' }));
+  const skip   = () => act(() => poFetch('/channels/' + channel.id + '/skip',   { method: 'POST' }));
+  const stopPb = () => act(() => poFetch('/channels/' + channel.id + '/stop-playback', { method: 'POST' }));
+
+  const live = channel.status === 'running';
+  return (
+    <div className="po-transport">
+      <button className="btn primary" disabled={!live || busy || !playlistId} onClick={play}>▶ Play</button>
+      <button className="btn ghost" disabled={!live || busy} onClick={pause}>⏸ Pause</button>
+      <button className="btn ghost" disabled={!live || busy} onClick={resume}>⏵ Resume</button>
+      <button className="btn ghost" disabled={!live || busy} onClick={skip}>⏭ Skip</button>
+      <button className="btn danger ghost" disabled={!live || busy} onClick={stopPb}>⏹ Stop</button>
+    </div>
+  );
+}
+
+// ── Program monitor ──────────────────────────────────────────────────────────
+function ProgramMonitor({ channel, engine }) {
+  const onAir = channel.status === 'running';
+  return (
+    <div className="po-monitor">
+      <div className="po-monitor-head">
+        <span className={'po-onair ' + (onAir ? 'live' : '')}>{onAir ? '● ON AIR' : '○ OFF'}</span>
+        <span className="mono muted">{channel.output_type?.toUpperCase()} · {channel.video_format}</span>
+      </div>
+      <div className="po-monitor-screen">
+        {engine && engine.currentClip
+          ? <div className="po-monitor-clip">{engine.currentClip}</div>
+          : <div className="muted">{onAir ? 'Idle — no clip playing' : 'Channel stopped'}</div>}
+      </div>
+      {engine && (
+        <div className="po-monitor-foot mono muted">
+          clip {engine.currentIndex >= 0 ? engine.currentIndex + 1 : '–'} / {engine.playlistLength || 0}
+          {engine.loop ? ' · loop' : ''}
+        </div>
+      )}
+    </div>
+  );
+}
+
+// ── Channel detail (monitors + bin + playlist + transport) ───────────────────
+function ChannelDetail({ channel, onChannelChange }) {
+  const [playlists, setPlaylists] = React.useState([]);
+  const [playlistId, setPlaylistId] = React.useState(null);
+  const [items, setItems] = React.useState([]);
+  const [engine, setEngine] = React.useState(null);
+  const [ch, setCh] = React.useState(channel);
+
+  React.useEffect(() => { setCh(channel); }, [channel.id]);
+
+  const loadPlaylists = React.useCallback(async () => {
+    const pls = await poFetch('/playlists?channel_id=' + channel.id);
+    setPlaylists(pls);
+    if (pls.length && !playlistId) setPlaylistId(pls[0].id);
+    if (!pls.length) {
+      // Auto-create a default playlist so the operator can start dragging.
+      const created = await poFetch('/playlists', {
+        method: 'POST', body: JSON.stringify({ channel_id: channel.id, name: 'Main' }),
+      });
+      setPlaylists([created]); setPlaylistId(created.id);
+    }
+  }, [channel.id]);
+
+  const loadItems = React.useCallback(async () => {
+    if (!playlistId) return;
+    const its = await poFetch('/playlists/' + playlistId + '/items');
+    setItems(its);
+  }, [playlistId]);
+
+  React.useEffect(() => { loadPlaylists(); }, [channel.id]);
+  React.useEffect(() => { loadItems(); }, [playlistId]);
+
+  // Poll engine status + item staging while live.
+  React.useEffect(() => {
+    let t;
+    const poll = async () => {
+      try {
+        const s = await poFetch('/channels/' + channel.id + '/status');
+        setEngine(s.engine || null);
+      } catch (_) {}
+      try { await loadItems(); } catch (_) {}
+      t = setTimeout(poll, 4000);
+    };
+    poll();
+    return () => clearTimeout(t);
+  }, [channel.id, playlistId]);
+
+  const startChannel = async () => {
+    const updated = await poFetch('/channels/' + channel.id + '/start', { method: 'POST' });
+    setCh(updated); onChannelChange(updated);
+  };
+  const stopChannel = async () => {
+    const updated = await poFetch('/channels/' + channel.id + '/stop', { method: 'POST' });
+    setCh(updated); onChannelChange(updated);
+  };
+
+  return (
+    <div className="po-detail">
+      <div className="po-detail-head">
+        <div>
+          <h3 style={{ margin: 0 }}>{ch.name}</h3>
+          <span className="mono muted">{ch.output_type?.toUpperCase()} · {ch.video_format} · {ch.status}</span>
+        </div>
+        <div className="po-detail-actions">
+          {ch.status === 'running'
+            ? <button className="btn danger" onClick={stopChannel}>Stop channel</button>
+            : <button className="btn primary" onClick={startChannel}>Start channel</button>}
+        </div>
+      </div>
+      {ch.error_message && <div className="alert error">{ch.error_message}</div>}
+
+      <div className="po-grid">
+        <ProgramMonitor channel={ch} engine={engine} />
+        <MediaBin projectId={ch.project_id} />
+      </div>
+
+      <Transport channel={ch} playlistId={playlistId} onStatus={() => loadItems()} />
+
+      {playlistId && (
+        <Playlist channel={ch} playlistId={playlistId} items={items} onReload={loadItems} />
+      )}
+    </div>
+  );
+}
+
+// ── Top-level page ───────────────────────────────────────────────────────────
+function Playout() {
+  const [channels, setChannels] = React.useState(null);
+  const [selectedId, setSelectedId] = React.useState(null);
+  const [showCreate, setShowCreate] = React.useState(false);
+  const [err, setErr] = React.useState(null);
+
+  const load = React.useCallback(async () => {
+    try {
+      const list = await poFetch('/channels');
+      setChannels(list);
+      if (list.length && !selectedId) setSelectedId(list[0].id);
+    } catch (e) { setErr(e.message); setChannels([]); }
+  }, [selectedId]);
+
+  React.useEffect(() => { load(); }, []);
+
+  const selected = (channels || []).find(c => c.id === selectedId) || null;
+  const onChannelChange = (updated) => {
+    setChannels(cs => (cs || []).map(c => c.id === updated.id ? updated : c));
+  };
+
+  return (
+    <div className="page">
+      <div className="page-header">
+        <span className="title">Playout — Master Control</span>
+        <span className="subtitle">Schedule and play assets to SDI, NDI, SRT or RTMP.</span>
+      </div>
+      <div className="page-body po-page">
+        {err && <div className="alert error">{err}</div>}
+        <div className="po-channels-bar">
+          {(channels || []).map(c => (
+            <button key={c.id}
+              className={'po-chan-tab ' + (c.id === selectedId ? 'active' : '')}
+              onClick={() => setSelectedId(c.id)}>
+              <span className={'po-chan-dot ' + (c.status === 'running' ? 'live' : '')} />
+              {c.name}
+            </button>
+          ))}
+          <button className="btn ghost sm" onClick={() => setShowCreate(true)}>+ Channel</button>
+        </div>
+
+        {channels === null && <div className="muted">Loading channels…</div>}
+        {channels !== null && channels.length === 0 && (
+          <div className="po-empty">
+            <p className="muted">No playout channels yet.</p>
+            <button className="btn primary" onClick={() => setShowCreate(true)}>Create your first channel</button>
+          </div>
+        )}
+        {selected && <ChannelDetail key={selected.id} channel={selected} onChannelChange={onChannelChange} />}
+      </div>
+
+      {showCreate && (
+        <ChannelCreate
+          onClose={() => setShowCreate(false)}
+          onCreated={(ch) => { setShowCreate(false); setChannels(cs => [...(cs || []), ch]); setSelectedId(ch.id); }}
+        />
+      )}
+    </div>
+  );
+}
+
+window.Playout = Playout;
--- a/services/web-ui/public/shell.jsx
+++ b/services/web-ui/public/shell.jsx
@ -18,9 +18,9 @@ const NAV_SECTIONS = [
    label: "Ingest",
    items: [
      { id: "upload", label: "Upload", icon: "upload" },
-      { id: "youtube", label: "YouTube", icon: "download" },
+      { id: "youtube", label: "YouTube", icon: "import" },
      { id: "recorders", label: "Recorders", icon: "record" },
-      { id: "schedule", label: "Schedule", icon: "jobs" },
+      { id: "schedule", label: "Schedule", icon: "clock" },
      { id: "monitors", label: "Monitors", icon: "monitor" },
    ],
  },
@ -28,6 +28,7 @@ const NAV_SECTIONS = [
    label: "Operations",
    items: [
      { id: "capture", label: "Capture", icon: "capture" },
+      { id: "playout", label: "Playout", icon: "signal" },
      { id: "jobs", label: "Jobs", icon: "jobs" },
    ],
  },
--- a/services/web-ui/public/styles-fixes.css
+++ b/services/web-ui/public/styles-fixes.css
@ -324,6 +324,14 @@
  letter-spacing: 0.02em;
 }

+.launcher-tagline-motto {
+  margin-top: 6px;
+  color: var(--accent);
+  font-style: italic;
+  font-size: 15px;
+  letter-spacing: 0.04em;
+}
+
 .launcher-grid {
  width: 100%;
  display: grid;
--- a/services/web-ui/public/styles-playout.css
+++ b/services/web-ui/public/styles-playout.css
@ -0,0 +1,104 @@
+/* Playout / Master Control (MCR) page styles. */
+
+.po-page { display: flex; flex-direction: column; gap: 14px; }
+
+/* Channel tab bar */
+.po-channels-bar {
+  display: flex; align-items: center; gap: 8px; flex-wrap: wrap;
+  padding-bottom: 10px; border-bottom: 1px solid var(--border);
+}
+.po-chan-tab {
+  display: inline-flex; align-items: center; gap: 7px;
+  padding: 6px 12px; border-radius: 8px;
+  background: var(--bg-2); border: 1px solid var(--border);
+  color: var(--text-2); font-size: 13px; cursor: pointer;
+}
+.po-chan-tab:hover { background: var(--bg-3); color: var(--text-1); }
+.po-chan-tab.active { background: var(--accent-soft); color: var(--accent-text); border-color: var(--accent-soft-2); }
+.po-chan-dot {
+  width: 8px; height: 8px; border-radius: 50%;
+  background: var(--text-3);
+}
+.po-chan-dot.live { background: var(--danger); box-shadow: 0 0 0 3px var(--danger-soft); }
+
+.po-empty { text-align: center; padding: 48px 0; display: flex; flex-direction: column; gap: 12px; align-items: center; }
+
+/* Channel detail */
+.po-detail { display: flex; flex-direction: column; gap: 14px; }
+.po-detail-head { display: flex; justify-content: space-between; align-items: flex-start; }
+.po-detail-actions { display: flex; gap: 8px; }
+
+.po-grid {
+  display: grid; grid-template-columns: 1.4fr 1fr; gap: 14px;
+}
+@media (max-width: 900px) { .po-grid { grid-template-columns: 1fr; } }
+
+.po-section-label {
+  font-size: 11px; text-transform: uppercase; letter-spacing: 0.06em;
+  color: var(--text-3); font-weight: 600;
+}
+
+/* Program monitor */
+.po-monitor {
+  background: var(--bg-1); border: 1px solid var(--border); border-radius: 12px;
+  display: flex; flex-direction: column; overflow: hidden;
+}
+.po-monitor-head {
+  display: flex; justify-content: space-between; align-items: center;
+  padding: 10px 12px; border-bottom: 1px solid var(--border);
+}
+.po-onair { font-size: 12px; font-weight: 700; color: var(--text-3); letter-spacing: 0.04em; }
+.po-onair.live { color: var(--danger); }
+.po-monitor-screen {
+  flex: 1; min-height: 220px; background: #000;
+  display: flex; align-items: center; justify-content: center;
+  color: var(--text-2);
+}
+.po-monitor-clip { font-family: var(--font-mono); font-size: 14px; color: var(--text-1); }
+.po-monitor-foot { padding: 8px 12px; border-top: 1px solid var(--border); font-size: 11px; }
+
+/* Media bin */
+.po-bin {
+  display: flex; flex-direction: column; min-height: 260px; max-height: 360px;
+  border-radius: 12px; overflow: hidden;
+}
+.po-bin-head { display: flex; justify-content: space-between; align-items: center; gap: 8px; padding: 10px 12px; border-bottom: 1px solid var(--border); }
+.po-bin-list { overflow-y: auto; flex: 1; }
+.po-bin-item {
+  display: flex; justify-content: space-between; align-items: center; gap: 8px;
+  padding: 8px 12px; border-bottom: 1px solid var(--border);
+  cursor: grab; user-select: none;
+}
+.po-bin-item:hover { background: var(--bg-3); }
+.po-bin-item:active { cursor: grabbing; }
+.po-bin-name { font-size: 13px; color: var(--text-1); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+
+/* Transport */
+.po-transport {
+  display: flex; gap: 8px; flex-wrap: wrap;
+  padding: 12px; background: var(--bg-1); border: 1px solid var(--border); border-radius: 12px;
+}
+
+/* Playlist */
+.po-playlist {
+  border-radius: 12px; overflow: hidden;
+  min-height: 120px;
+}
+.po-playlist-empty { padding: 28px 12px; text-align: center; }
+.po-pl-item {
+  display: flex; align-items: center; gap: 10px;
+  padding: 9px 12px; border-bottom: 1px solid var(--border);
+  cursor: grab; user-select: none;
+}
+.po-pl-item:hover { background: var(--bg-3); }
+.po-pl-item:active { cursor: grabbing; }
+.po-pl-index {
+  width: 22px; text-align: center; font-family: var(--font-mono);
+  font-size: 12px; color: var(--text-3);
+}
+.po-pl-name { flex: 1; font-size: 13px; color: var(--text-1); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+
+/* Small button variants reused */
+.btn.xs { padding: 2px 8px; font-size: 11px; }
+.btn.sm { padding: 5px 10px; font-size: 12px; }
+.field-input.sm { padding: 5px 8px; font-size: 12px; }
--- a/services/worker/src/index.js
+++ b/services/worker/src/index.js
@ -7,6 +7,7 @@ import { conformWorker } from './workers/conform.js';
 import { youtubeImportWorker, proxyQueue as youtubeProxyQueue } from './workers/youtube-import.js';
 import { trimWorker } from './workers/trimWorker.js';
 import { hlsWorker } from './workers/hls.js';
+import { playoutStageWorker } from './workers/playout-stage.js';
 import { startPromotionWorker } from './workers/promotion.js';

 const parseRedisUrl = (url) => {
@ -94,6 +95,9 @@ const workers = [
    lockDuration: 10 * 60 * 1000,
    lockRenewTime: 60000,
  }),
+  // playout-stage = S3 → /media volume + EBU R128 loudnorm. CPU/IO-bound;
+  // colocate with workers that already have ffmpeg + the media mount.
+  want('playout-stage') && createWorker('playout-stage', playoutStageWorker, { concurrency: 1 }),
 ].filter(Boolean);
 console.log(`WORKER_QUEUES=${_wq || '(all)'}`);

--- a/services/worker/src/workers/playout-stage.js
+++ b/services/worker/src/workers/playout-stage.js
@ -0,0 +1,137 @@
+import { join, extname } from 'path';
+import { mkdir, stat, rename, unlink } from 'fs/promises';
+import { spawn } from 'child_process';
+import { query } from '../db/client.js';
+import { downloadFromS3 } from '../s3/client.js';
+
+// Playout media staging — copy an asset from S3 into the shared CasparCG media
+// volume so a playout channel can play it. CasparCG plays from a local folder
+// (/media), not from S3, so every playlist item must be staged to 'ready'
+// before it can go on air. See docs/superpowers/specs/2026-05-30-playout-mcr-design.md §4.
+//
+// Two passes:
+//   1. download from S3 to /media/playout/<assetId><ext>.raw
+//   2. ffmpeg loudnorm (EBU R128, target I=-23 LUFS, TP=-1 dBTP, LRA=11) to the
+//      final path, then atomic rename. Skipped when items.audio_normalized=true.
+//
+// The media volume is mounted into BOTH this worker and the playout sidecars at
+// the same path (PLAYOUT_MEDIA_DIR, default /media). We stage under a per-asset
+// filename so re-staging is idempotent and multiple items referencing the same
+// asset share one file.
+
+const S3_BUCKET = process.env.S3_BUCKET || 'wild-dragon';
+const MEDIA_DIR = process.env.PLAYOUT_MEDIA_DIR || '/media';
+
+async function fileExists(p) {
+  try { const s = await stat(p); return s.size > 0; } catch { return false; }
+}
+
+// Two-pass loudnorm: pass 1 measures, pass 2 applies linear normalization with
+// the measured values. Linear mode preserves dynamics at the cost of accuracy
+// vs the target — fine for broadcast playout where transparent levels matter
+// more than hitting -23 LUFS to the decibel.
+function runFfmpeg(args) {
+  return new Promise((resolve, reject) => {
+    const proc = spawn('ffmpeg', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+    let stderr = '';
+    proc.stderr.on('data', (d) => { stderr += d.toString(); });
+    proc.on('error', reject);
+    proc.on('close', (code) => {
+      if (code === 0) resolve(stderr);
+      else reject(new Error(`ffmpeg exited ${code}: ${stderr.slice(-500)}`));
+    });
+  });
+}
+
+async function measureLoudness(inputPath) {
+  // -23 / -1 / 11 are the EBU R128 broadcast targets; loudnorm prints a JSON
+  // block to stderr after the analysis pass which feeds pass 2's measured_*
+  // params.
+  const stderr = await runFfmpeg([
+    '-hide_banner', '-nostats', '-i', inputPath,
+    '-af', 'loudnorm=I=-23:TP=-1:LRA=11:print_format=json',
+    '-f', 'null', '-',
+  ]);
+  const match = stderr.match(/\{[\s\S]*?"input_i"[\s\S]*?\}/);
+  if (!match) throw new Error('loudnorm pass 1 produced no JSON');
+  return JSON.parse(match[0]);
+}
+
+async function applyLoudnorm(inputPath, outputPath, m) {
+  // Pass 2: linear normalization using pass 1's measurements. -c:v copy keeps
+  // the video stream intact so we only re-encode audio (target AAC stereo, the
+  // common-denominator CasparCG ffmpeg producer accepts).
+  await runFfmpeg([
+    '-hide_banner', '-nostats', '-y', '-i', inputPath,
+    '-af', `loudnorm=I=-23:TP=-1:LRA=11:measured_I=${m.input_i}:measured_TP=${m.input_tp}:measured_LRA=${m.input_lra}:measured_thresh=${m.input_thresh}:offset=${m.target_offset}:linear=true:print_format=summary`,
+    '-c:v', 'copy', '-c:a', 'aac', '-b:a', '192k', '-ar', '48000',
+    outputPath,
+  ]);
+}
+
+export async function playoutStageWorker(job) {
+  const { itemId, assetId } = job.data;
+  if (!itemId || !assetId) throw new Error('playout-stage requires itemId + assetId');
+
+  await query("UPDATE playout_items SET media_status = 'staging', updated_at = NOW() WHERE id = $1", [itemId]);
+
+  try {
+    const a = await query(
+      'SELECT id, filename, original_s3_key, proxy_s3_key FROM assets WHERE id = $1', [assetId]);
+    if (a.rows.length === 0) throw new Error(`asset ${assetId} not found`);
+    const asset = a.rows[0];
+
+    // Prefer the master for air quality; fall back to proxy if no master key.
+    const s3Key = asset.original_s3_key || asset.proxy_s3_key;
+    if (!s3Key) throw new Error(`asset ${assetId} has no S3 media key to stage`);
+
+    const ext = extname(s3Key) || extname(asset.filename || '') || '.mp4';
+    // Stable per-asset path under the media volume; CasparCG resolves the token
+    // "playout/<assetId>" against MEDIA_DIR.
+    const relDir = 'playout';
+    const fileName = `${assetId}${ext}`;
+    const absDir = join(MEDIA_DIR, relDir);
+    const absPath = join(absDir, fileName);
+    const mediaPath = join(MEDIA_DIR, relDir, fileName);
+
+    await mkdir(absDir, { recursive: true });
+
+    // Skip the whole pipeline when the final file already exists from a prior
+    // stage of the same asset. The audio_normalized flag is per-item so a
+    // second item referencing the same staged file gets flipped to true below.
+    const itemRow = await query('SELECT audio_normalized FROM playout_items WHERE id = $1', [itemId]);
+    const alreadyNormalized = itemRow.rows[0]?.audio_normalized === true;
+
+    if (!(await fileExists(absPath))) {
+      const rawPath = `${absPath}.raw${ext}`;
+      console.log(`[playout-stage] downloading ${s3Key} -> ${rawPath}`);
+      await downloadFromS3(S3_BUCKET, s3Key, rawPath);
+
+      if (alreadyNormalized) {
+        // Asset was previously normalized for another item — keep the bytes
+        // as-is. Atomic rename so CasparCG never sees a partial file.
+        await rename(rawPath, absPath);
+      } else {
+        console.log(`[playout-stage] loudnorm pass 1: ${rawPath}`);
+        const measured = await measureLoudness(rawPath);
+        const tmpOut = `${absPath}.tmp${ext}`;
+        console.log(`[playout-stage] loudnorm pass 2: I=${measured.input_i} TP=${measured.input_tp} -> ${tmpOut}`);
+        await applyLoudnorm(rawPath, tmpOut, measured);
+        await rename(tmpOut, absPath);
+        await unlink(rawPath).catch(() => {});
+      }
+    } else {
+      console.log(`[playout-stage] already staged: ${absPath}`);
+    }
+
+    await query(
+      "UPDATE playout_items SET media_status = 'ready', media_path = $1, audio_normalized = TRUE, updated_at = NOW() WHERE id = $2",
+      [mediaPath, itemId]);
+    console.log(`[playout-stage] item ${itemId} ready at ${mediaPath}`);
+    return { itemId, mediaPath };
+  } catch (err) {
+    await query("UPDATE playout_items SET media_status = 'error', updated_at = NOW() WHERE id = $1", [itemId])
+      .catch(() => {});
+    throw err;
+  }
+}
Author	SHA1	Message	Date
ZGaetano	43656a5e88	shell: youtube nav icon: download → import download is used by the Downloads section tile on the home screen. YouTube ingest gets the new import icon (arrow entering box) instead.	2026-05-31 10:52:10 -04:00
ZGaetano	68461af990	icons: add import icon (arrow entering box) Distinct from download (vertical arrow+line). Used for YouTube ingest to avoid sharing a glyph with the Downloads section tile.	2026-05-31 10:50:43 -04:00
ZGaetano	8bc460025d	screens-home: fix launcher tile icons - Dashboard tile: home → layout (matches sidebar nav icon) - Playout tile: monitor → signal (matches sidebar nav fix)	2026-05-31 00:19:34 -04:00
ZGaetano	3578c7b4e9	fix(playout): Privileged only for decklink (SRT/NDI/RTMP/HLS crashed when GPU exposed without driver)	2026-05-30 18:59:27 -04:00
ZGaetano	cddcc9a29e	fix(mam-api): selfHeartbeat writes last_seen_at so primary node isn't stale-failover-killed	2026-05-30 18:57:20 -04:00
ZGaetano	0e844c0fc3	fix(scheduler): use updated_at as grace anchor when last_heartbeat_at NULL Without this, a freshly-spawned channel with NULL last_heartbeat_at was instantly failover-killed by the playoutHealthTick because `0` was used as the lastSeen timestamp, making ageMs huge on the very first tick.	2026-05-30 17:32:15 -04:00
ZGaetano	551af09dc7	fix(playout): install libnss3 so CEF can init (NSS -8023 was killing the channel ~30s in)	2026-05-30 17:16:54 -04:00
ZGaetano	4d6a999665	fix(playout): pre-create NSS dir + CEF cache so CEF/HTML producer doesn't SIGABRT	2026-05-30 17:14:07 -04:00
ZGaetano	f971d57bb9	fix(playout): use unzip not python zipfile (preserves exec bits)	2026-05-30 17:00:25 -04:00
ZGaetano	7ab70948a0	fix(playout): entrypoint handles 2.4.x bin/casparcg layout + LD_LIBRARY_PATH for bundled libs	2026-05-30 16:50:04 -04:00
ZGaetano	13bbd4216e	fix(playout): correct 2.4.0 zip layout — binary is at casparcg_server/bin/casparcg	2026-05-30 16:49:48 -04:00
ZGaetano	fcd8e8dd2e	fix(playout): entrypoint finds binary in /opt/casparcg for 2.4.x tarball layout	2026-05-30 16:44:23 -04:00
ZGaetano	67ac007706	fix(playout): downgrade CasparCG to 2.4.0 ubuntu22 zip (2.5 requires AVX2, ZAMPP has AVX only)	2026-05-30 16:44:07 -04:00
ZGaetano	b4f2fb12ff	fix(mam-api): heartbeat writes last_seen_at so playout failover sees healthy nodes	2026-05-30 16:32:11 -04:00
ZGaetano	aa7f836493	fix(playout): strip XML comments from casparcg.config (2.5 rejects them)	2026-05-30 16:30:54 -04:00
ZGaetano	c2409bd037	fix(mam-api): add last_seen_at to cluster_nodes for playout failover Playout failover queries cluster_nodes.last_seen_at to find healthy nodes for channel re-placement. Column missing from original cluster schema. Migration 031 adds column + backfills existing nodes to NOW(). Fixes scheduler error: column "last_seen_at" does not exist Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>	2026-05-30 13:39:06 -04:00
ZGaetano	42064acefa	shell: fix nav icon conflicts - schedule: jobs → clock (was sharing hamburger icon with Jobs) - playout: monitor → signal (was sharing TV icon with Monitors)	2026-05-30 13:30:42 -04:00
ZGaetano	2e2b091653	icons: fix 4 icon issues found in audit - jobs: replace hamburger (nav menu) with bulleted list (task queue) - grid: add rx="1" to match library icon (consistency) - hdd: replace circle+dot (vinyl) with cylinder (storage) - proxy: replace upload-arrow with sliders (transcode/transform)	2026-05-30 13:29:18 -04:00
Zac	c502d4a16f	feat(web-ui): update home tagline + add "Let's create" motto Tagline "Self-hosted broadcast media-asset management" -> "Media Asset Management & Production Platform"; add italic accent motto "Let's create" below it. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-30 16:04:28 +00:00
Zac	9d098e9778	feat(auth-ui): interactive permissions matrix, admin 2FA reset, Downloads button Backend (routes/users.js): - GET / now returns totp_enabled so the UI can show 2FA status - GET /:id/access — admin-only effective per-project access (MAX over direct + group grants), labels via=direct\|group:<name>; admins report all/edit - POST /:id/totp/disable — admin clears a locked-out user's 2FA without their password (self-service disable still requires it); dev user blocked - role validated against {admin,editor,viewer} on create + PATCH (was unchecked) Frontend: - Users>Policies tab: static prose replaced with interactive per-user matrix — inline role select, 2FA badge, Reset-2FA action, lazy per-user access expander - Home "Premiere panel" tile -> "Downloads"; modal renamed, adds Teams ISO row (disabled "coming soon" until the .exe is supplied); UXP .ccx link unchanged - data.jsx: window.TEAMS_ISO placeholder ({available:false}) Not runtime-tested in browser yet. Teams ISO .exe still pending from user. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-30 15:59:27 +00:00
Zac	02631f7b96	fix(playout): locate CasparCG 2.5 binary at /usr/bin/casparcg-server-2.5 First 2.5 build got past the deb install but the binary-discovery step produced an empty $BIN (test -n failed): the 2.5 deb names its executable casparcg-server-2.5, which the old case pattern (/casparcg, /CasparCG Server) didn't match. Broaden the match to /usr/bin/casparcgserver*, fall back to the known /usr/bin/casparcg-server-2.5, symlink it to /usr/local/bin/casparcg, and make /opt/casparcg a real dir for our config (no longer symlinked onto /usr/bin). Entrypoint launches `casparcg <config>` from PATH instead of ./casparcg in a cwd. Still NOT runtime-validated: 2.5 may reject the 2.3-era casparcg.config schema (a bad config shows up as "Configuration file --version was not found"); the deb ships a reference config at /usr/share/casparcg-server-2.5/casparcg.config to diff against at smoke time. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-30 15:34:02 +00:00
Zac	9436434599	fix(playout): build CasparCG 2.5.0 from .deb (2.3.3 tarball was a dead URL) The image never built: CASPAR_URL pointed at a v2.3.3-stable Linux tarball that CasparCG never published (2.3.x is Windows-only; Linux builds start at 2.4.0, and 2.4.1+ ship only as .deb). Rewrite to install the 2.5.0 noble server + CEF debs on an ubuntu:24.04 base (Node 20 via nodesource), letting apt resolve the GL/ffmpeg/openal runtime deps. Binary install dir is discovered from the deb file list and symlinked to /opt/casparcg so the entrypoint + config still run from there. Move CasparCG log/data dirs to /media (writable mount) since the install dir may be read-only. NOT runtime-validated: the 2.5 casparcg.config schema and the AMCP consumer syntax (ADD <ch> STREAM/FILE) were authored against 2.3 and must be smoke- tested against 2.5 before a channel start can be trusted. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-30 15:25:31 +00:00
Zac	f837e57969	feat(web-ui): add Playout tile to home screen Fetches /playout/channels separately and degrades silently when the endpoint or schema is absent. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-30 14:59:59 +00:00
Zac	ca71e47035	fix(playout): repair failover, authenticate scheduler self-calls, fix playlist walk + CasparCG consumer syntax Post-review fixes for the 8-commit playout-mcr drop: - Scheduler self-calls (callSelf -> /recorders, /playout) carried no auth, so under AUTH_ENABLED=true requireUiHeader 403'd every mutating POST. This broke playout failover AND scheduled recordings. Add a per-boot in-process service token (x-internal-token) the scheduler attaches; requireAuth/requireUiHeader treat it as the seeded admin. No env/compose config needed. - Failover deadlocked: restartChannel set status='starting' then the scheduler called the guarded /start route, which 409s on 'starting'. Extract the spawn body into spawnChannelSidecar() shared by /start and restartChannel; failover now spawns directly with no self-call. - Phase A playlist stalled after 2 clips: _scheduleAdvance cued the next clip via LOADBG AUTO but never advanced the pointer. Pass asset_duration_ms in the /play payload and arm a duration-based timer that advances currentIndex and cues subsequent clips, keeping as-run in sync for arbitrary-length playlists. - CasparCG consumer syntax was invalid: "ADD <ch> FFMPEG" is the producer name, not a consumer keyword, and old -vcodec/-acodec short args are rejected. Use STREAM/FILE with -codec:v / -codec:a / -preset:v / -tune:v and a format=yuv420p filter ahead of libx264 (channel output is RGBA). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-30 14:51:35 +00:00
Zac	34352e3299	docs(playout): work log — commit map, decisions, testing checklist Replaces the earlier aspirational "complete" log with the actual commit sequence on feat/playout-mcr, the §7 decisions as built, the media-flow diagram, port-contention + failover scope, and a runtime testing checklist (migration → image build → SRT smoke → failover kill test).	2026-05-30 14:05:57 +00:00
Zac	d505a488ac	build(playout): compose wiring + .env knobs - Add /mnt/NVME/MAM/wild-dragon-media:/media to mam-api (rw) and worker-p4 (rw); web-ui (ro, for serving HLS preview segments). - worker-p4 WORKER_QUEUES gains 'playout-stage' so master-tier nodes pick up the loudnorm stage jobs (they already have ffmpeg + the media mount). - New build-only 'playout' service with profile ["build-only"] so `docker compose --profile build-only build playout` produces the wild-dragon-playout:latest image without compose trying to up it as a long-running service. mam-api spawns these on demand. - mam-api env adds PLAYOUT_IMAGE + PLAYOUT_AMCP_BASE_PORT (5250 default). - .env.example: PLAYOUT_IMAGE, PLAYOUT_AMCP_BASE_PORT.	2026-05-30 14:05:57 +00:00
Zac	793011b78b	feat(web-ui): MCR page — channels, playlist, transport, preview screens-playout.jsx + styles-playout.css: program monitor (HLS preview from the sidecar), media bin, drag-drop playlist editor, transport controls. Plain HTML5 drag-drop, no extra library. Talks to /api/v1/playout via ZAMPP_API.fetch. Wired into the shell: "Playout" under Operations, breadcrumb mapping, route case in app.jsx, stylesheet + dist/screens-playout.js script in index.html. Format dropdown defaults to 1080p5994 (matches the new channel default).	2026-05-30 14:02:25 +00:00
Zac	5538683d78	feat(mam-api): /playout control plane + auto-failover Routes: channel + playlist CRUD, start/stop/play/pause/skip transport, as-run log. RBAC via assertProjectAccess on channel.project_id; null project ⇒ admin-only (recorder convention). Sidecar orchestration mirrors recorders.js: Docker socket for local node, node-agent /sidecar/start for remote. Channel start passes CHANNEL_ID env so the sidecar can write HLS preview to /media/live/<id>. DeckLink port-contention guard: blocks starting a decklink channel when a recorder or another channel on the same node+device_index is active. restartChannel(id) helper picks another healthy cluster node and re-places non-decklink channels; decklink is alert-only. Exposed for the scheduler. Scheduler tick adds step 6: poll each running channel's sidecar /status, update last_heartbeat_at, and after ~3 misses trigger restartChannel + self-call /start. Reuses the existing PG advisory lock so multi-replica deploys don't double-fire failovers.	2026-05-30 14:02:25 +00:00
Zac	d62af34e98	feat(playout): CasparCG sidecar image + Node AMCP shim One container per channel. Built like capture/build-with-decklink: NDI + DeckLink SDKs fetched at build, runs --privileged with Xvfb for the GL context where no real display is present. Components: - entrypoint.sh: Xvfb + CasparCG launch, creates /media/live/<CHANNEL_ID> - src/amcp.js: TCP AMCP client - src/playout-manager.js: channel lifecycle, playlist walk via LOADBG AUTO for gapless transitions; primary consumer (decklink/ndi/srt/rtmp) plus a second FFMPEG HLS consumer (~600 kbps, 2s segments) for the UI preview - src/index.js: HTTP shim — /channel/start, /playlist/load, transport - frame-rate helper picks fps from video_format (59.94 → 60000/1001) so SEEK / LENGTH frame math is correct	2026-05-30 14:02:25 +00:00
Zac	209f9fda52	feat(worker): playout-stage job — S3 → /media + EBU R128 loudnorm Stages playlist items from S3 to the shared CasparCG media volume. Pass 1 measures, pass 2 applies linear loudnorm (I=-23 LUFS, TP=-1 dBTP, LRA=11); output is AAC 192k @ 48 kHz, video stream copied. Atomic rename on success so CasparCG never sees a partial file. Per-item audio_normalized flag means re-stages of the same asset skip the loudnorm pass. Wired into worker/src/index.js behind WORKER_QUEUES=playout-stage so capability-routed deploys can pin it to nodes that already have ffmpeg + the media mount.	2026-05-30 14:02:25 +00:00
Zac	29187a90df	feat(mam-api): migration 029 — playout schema Six tables: channels, playlists, items, sidecars (sidecar registry for health-check), schedule (Phase B), as-run log. - video_format default 1080p5994 (house standard, capture cadence) - restart_count / last_restart_at / last_heartbeat_at on channels for auto-failover bookkeeping - audio_normalized flag on items so re-stages skip the loudnorm pass - unique partial index on (channel_id) for running sidecars	2026-05-30 14:02:25 +00:00
Zac	512267159a	docs(playout): MCR design spec — Phase A playlist + Phase B 24/7 Single-doc design covering the playout subsystem: CasparCG-backed sidecars, multi-channel placement, S3→/media staging, scheduling phases, the data model, channel placement vs port contention. §7 questions are answered inline (2026-05-30): −23 LUFS at stage time, 1080p5994 default, HLS preview v1, auto-restart-on-healthy-node failover (DeckLink alert-only).	2026-05-30 14:02:25 +00:00