Registo de alterações

subscriber experience, source health, security & operator tools

• Recently-watched channels rail — the web player now shows a "Recently
• Faster channel zapping — selecting a channel now pre-warms its playlist on
• Cross-content search — a single search box now finds live channels, movies
• VOD trick-play — scrubbing a movie shows a thumbnail preview strip
• Source health monitoring — a new "Saúde das fontes" sweep under
• EPG source health — a dashboard plus a stale-guide watcher that alerts when
• Steadier ingest — reconnect now fires only on a genuine source
• Off-air slate — channels can serve a configurable off-air video/slate
• Per-device kick — kick a single MAG box without touching the rest of the
• MAG command queue — send a message, reboot, or force-play to a specific STB
• Inactivity auto-disable — optional nightly job disables MAG devices unseen
• Reports — churn and revenue reports with CSV export (/reports).
• Alerting — SMTP + Telegram notifications, including a node up/down watcher.
• Webhooks — outbound, HMAC-signed events (node up/down, scheduled-action
• Scheduled bulk actions and a settings → effective-config registry page
• Light / dark theme toggle (dark stays the default).
• Anti-abuse shield — real-time per-IP detection of sniffing / flooding /
• Node ↔ master key sealing — the platform signing secret is now ECDH-sealed
• Per-device HTTPS — force an individual device's stream URLs back to HTTP
• Stronger account policy: 8-character minimum usernames and password-complexity
• /setup can now ingest an XC_VM/XUI database from an uploaded .sql dump
• Disk-pressure auto-drain — a node that crosses a disk threshold
• Node drain/cordon before restart, watchdog charts, and real per-NIC metrics on
• Fixed custom front-door ports on a fresh install — choosing non-default

Data integrity / migrations

• Stopped a migration-rerun data-corruption class. 0087, 0049, 0017
• DVR = per-channel only. Removed the platform-wide catchup.retention_days
• Single-line disable (Edit modal) and scheduled bulk disable now queue a kick
• Abuse-shield L3 IP blocks now honor their TTL (no permanent CGNAT lockout).
• Billing POST /record write is now tenant-scoped (R7 fixed only the reads).
• MAG/Stalker radio cmd no longer hands the box the raw upstream URL.
• Unauthenticated QoE beacon now rate-limited + sanity-bounded.
• Provider-sync DDL + full-table UPDATEs moved off the /vod render path
• Web player: content search + favorites; customer-facing **expiry/renewal

• Web player: every dynamic string now routes through t() (the PT/EN/ES
• Android: Login, the blocking update-gate, Settings, Player errors, Home and
• MAG/STB: "Minha Conta", the now-playing placeholder, and the fallback
• admin-web: /crons partial-status badge bug fixed (Parcial); /crons

Security / correctness

• Admin 2FA bypass closed — the p2ptv_2fa_pending cookie was HMAC-signed
• Caddy admin API no longer binds 0.0.0.0:2019 (was an unauthenticated
• Edge entitlement gate — /c/,/catchup/,/vod/ now enforce token
• Billing service now requires admin-JWT + tenant-scopes its queries (was
• SSH option-injection RCE on the master closed (install-job user/host
• Legacy /live.ts viewers are now kickable (the continuous-TS pipe
• VOD + transcoder ffmpeg gained source I/O timeouts + a max-encode watchdog (a
• Gateway circuit breaker ejects nodes that fail the data path despite a
• SLA / uptime report (/reports?type=sla) — per-channel/node availability %
• Web player was DEAD in production (a truncated player.js failed to parse)
• Android: release builds no longer fall back to the public debug signing key;

Security / reliability

• Auth-flood/scan guards no longer apply a permanent whole-IP firewall DROP —
• Public /internal/v1/iptv/auth/invalidate now peerTrusted-gated (was a
• Balance-node no longer mass-closes live sessions on restart/update (was a
• fMP4 mirror: per-segment read size-capped (OOM guard), reconnect keeps the
• player_api no longer masks backend 4xx/5xx as 200 (players retry instead of
• MAG catchup works (empty-password fetch); catchup global-retention honoured;
• Two functional indexes on the hottest auth/MAG lookups (migration 0139);
• 2FA enroll now verifies a code before enabling (no lockout); Telegram bot token

Native muxer: no segment orphans across reconnects

• The native MPEG-TS passthrough (pkg/remux/tspassthrough.go) already deleted
• Fix: PassthroughResume now carries the live segment window
• Real measured bitrate in the heartbeat / admin. The rate-floor watchdog
• Self-calibrating relative floor. live.min_source_ratio trips a source
• Labelled trips. A rate-floor close now surfaces ErrSourceRateFloor, so
• Internals: Run() gained a measuredBPS sink (origin passes nil); the dead

Self-healing: source bitrate floor (auto reconnect/failover on thin sources)

• Added a source rate-floor watchdog to the native MPEG-TS passthrough path:
• Settings-driven, no restart / no env / no SSH: live.min_source_bps,
• Loop-guard: the sustained-thin time (grace × window) is clamped above the
• Armed: live.min_source_bps=250000, live.source_rate_window_s=20,
• The relative floor (ratio × nominal) was deliberately left inert: ffprobe
• Gateway rebuilt to ship the new allowlist keys.

Balance-node stability + created channels in production

• created_channels (FAST channels) materialized as live cc-<id> now actually
• Carried the 2026-06-03 audit balance-node fixes (added Flush()), plus VOD
• Consolidated the prior cold-start / micro-freeze tuning.

Node-side blocking + VOD on the remote node

• P2PTV_BLOCK enforcement (iptables DROP) on auto/manual block propagated to
• VOD switched to progressive faststart MP4 (was fragmented → no seek /
• MAG live .ts and VOD now 302-redirect straight to the node (removed