Fix scheduled task run notification

Release 2.8.4
Release 2.8.3
2026-08-17 00:54:13 +01:00 · 2026-08-17 00:46:07 +01:00 · 2026-08-17 00:08:05 +01:00 · 2026-08-16 22:41:39 +01:00 · 2026-08-16 22:08:32 +01:00 · 2026-08-16 17:15:31 +01:00
245 changed files with 15560 additions and 3885 deletions
@@ -1,5 +1,8 @@
 *
 !package.json
+!package-lock.json
+!build/
+!build/**
 !src/
 !src/**
 !scripts/
@@ -3,6 +3,9 @@
 ## Versioning and releases

 - Treat `package.json` as the source of truth for the application version.
+- Keep `package.json`, `build/package.player.json`, and `build/package.web.json` on the same version number.
+- Keep dependency versions and package metadata in `package.json`, `package-lock.json`, `build/package.player.json`, and `build/package.web.json` aligned unless a dependency is intentionally omitted from a specific bundle.
+- When changing bundled library versions, update the About page source data from the same package metadata or vendored asset banner rather than hardcoding a fresh literal.
 - When the app version changes, update `CHANGELOG.md` in the same change.
 - Keep database migration versions aligned with the release they actually belong to.
 - If only part of a migration batch belongs to a newer release, split that batch into a separate migration entry instead of relabeling the earlier release.
@@ -7,9 +7,20 @@ on:
  workflow_dispatch:

 jobs:
-  build-and-push:
+  build-and-push-existing-registry:
    runs-on: ubuntu-latest

+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: web
+            repository: pulse-signage-web
+            dockerfile: ./build/Dockerfile
+          - name: player
+            repository: pulse-signage-player
+            dockerfile: ./build/Dockerfile.player
+
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
@@ -17,7 +28,7 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

-      - name: Log in to container registry
+      - name: Log in to existing package registry
        uses: docker/login-action@v3
        with:
          registry: git.lzstealth.com
@@ -28,18 +39,19 @@ jobs:
        id: meta
        uses: docker/metadata-action@v5
        with:
-          images: git.lzstealth.com/LZStealth/pulse-signage
+          images: |
+            git.lzstealth.com/lzstealth/${{ matrix.repository }}
          tags: |
            type=raw,value=latest
            type=ref,event=tag
-            type=semver,pattern=v{{major}}.{{minor}}
            type=semver,pattern=v{{major}}
+            type=semver,pattern=v{{major}}.{{minor}}

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: .
-          file: ./Dockerfile
+          file: ${{ matrix.dockerfile }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
@@ -2,6 +2,321 @@

 All notable changes to this project will be documented in this file.

+## 2.8.4 - 2026-08-17
+
+### Added
+
+- Added local caching for API and RSS image placeholders under `player-cache/remote-images` for offline player playback.
+- Added reconciliation of cached remote images so files no longer referenced by slides are removed.
+
+### Fixed
+
+- Fixed popup preview authentication for background thumbnail capture.
+- Fixed thumbnails so they use the same popup-preview canvas and resolve API/RSS placeholders, fonts, styles, and cached images correctly.
+- Fixed manual scheduled-task run notifications so they use task-neutral wording.
+
+## 2.8.3 - 2026-08-17
+
+### Added
+
+- Added API, RSS, Timetable, and Time / Date placeholder help panels with shared transform and date-token documentation.
+- Added render-time API and RSS image placeholders with proportional sizing and preview-only bounding boxes.
+
+### Changed
+
+- API and RSS regions now preserve authored content when no data source is selected and remain blank when a selected source has no authored content.
+- Normal WYSIWYG image insertion remains upload-backed and separate from image placeholder transforms.
+
+## 2.8.2 - 2026-08-16
+
+### Changed
+
+- Standardized update audit events on from/to changes and added readable table diffs for nested JSON, arrays, null values, and empty strings.
+- Standardized internal `src/data` imports on the `#src` alias.
+
+## 2.8.1 - 2026-08-16
+
+### Fixed
+
+- Prevented startup and runtime duplicate-key writes from consuming auto-increment values in permission, player, onboarding, settings, and relationship tables.
+- Prevented partial timetable schemas from being incorrectly treated as fully migrated during schema version detection.
+
+### Changed
+
+- Renamed the built-in administrator role key to `super-admin`, while allowing its display name and description to be edited without being overwritten on restart.
+
+## 2.8.0 - 2026-08-16
+
+### Added
+
+- Filtered audit-log CSV export with a dedicated `audit-log.export` permission.
+- Canvas Sizes as an individual Content audit category.
+- Audit events for slide, template, playlist, and screen changes.
+- Audit events for System Settings changes.
+- Administration audit events for user and role management.
+- Audit logging enablement, category selection, and request metadata controls.
+- The extensible audit event storage, retention setting, dedicated audit-log permission, and paginated viewer foundation.
+- A Defaults settings section for player and announcement defaults.
+- A configurable maximum active session limit that removes the oldest sessions first.
+- IP address and user-agent metadata to active sessions.
+- The option for users to sign out their other active sessions from My Account.
+- Persistent administrator-controlled account locking and unlocking.
+- Database-backed login rate limiting with configurable attempts, lockout duration, and tracking scope.
+- A permissions-gated System Settings page for announcement icon suggestions, media upload limits and MIME types, session lifetime, and password-change policies.
+- Configurable forced password changes for newly created users and administrator password resets.
+- The database foundation for key-based application settings, including typed defaults and validation.
+
+### Changed
+
+- Updated the API and database documentation and added the Docker publish status badge to the project README.
+- Renamed the audit export permission to `audit-log.allow`.
+- Made Content and Data Sources audit categories opt-in and excluded automatic data-source refreshes from audit logging.
+- Split Content audit logging into individual Slides, Templates, Playlists, Screens, and Announcements categories.
+- Renamed the System Settings audit category key from `settings` to `system-settings`.
+- Split audit administration events into separate Users and Roles categories.
+- Split RSS and API data-source refresh defaults.
+- Made the default announcement duration use a value and unit selector, matching announcement forms.
+- Replaced password strength presets with customizable length, category, and character requirements.
+- Session expiration now uses the configured system setting, and user and role administration is grouped under the Settings area.
+- Renamed the system settings permissions to the `system-settings.*` namespace and migrated existing role assignments.
+- Added numeric auto-increment identifiers to every table and retained natural or relationship keys as unique constraints.
+
+## 2.7.6 - 2026-08-15
+
+### Changed
+
+- The announcement icon picker now supports searching the full Bootstrap Icons catalog while still showing the curated suggestion set by default.
+
+### Fixed
+
+- The announcement Play/Stop button now refreshes after saving screen-group changes, so Play stays disabled until the announcement actually has targets again.
+
+## 2.7.5 - 2026-08-15
+
+### Changed
+
+- The About page now reads bundled library versions from package metadata and the vendored AdminLTE stylesheet.
+- AdminLTE is now reported as 4.3.1.
+- Animate.css is now reported as 4.1.1.
+- Bootstrap Icons is now reported as 1.13.1.
+- Cropper.js is now reported as 1.6.2.
+- Express is now reported as 5.2.1.
+- Handlebars is now reported as 4.7.8.
+- hls.js is now reported as 1.7.0.
+- Multer is now reported as 2.2.0.
+- MySQL2 is now reported as 3.23.3.
+- Sharp is now reported as 0.35.3.
+- TinyMCE is now reported from the vendored package metadata.
+- ws is now reported as 8.21.3.
+- The runtime and container images now target Node.js 26.
+
+## 2.7.4 - 2026-08-15
+
+### Added
+
+- A new About page.
+
+### Changed
+
+- Refreshed the vendored AdminLTE assets to 4.3.1.
+
+## 2.7.3 - 2026-08-15
+
+### Changed
+
+- The slide image cropper now warns that SVG and GIF files will be rasterized if they are edited, and it keeps the original file only when the full image remains selected.
+- The slide image upload flow now accepts PNG, JPG, GIF, WebP, and SVG images, while the WYSIWYG image uploader now matches that same allowlist.
+- TIFF is no longer accepted by the WYSIWYG image uploader.
+
+### Fixed
+
+- The player now preserves quoted custom font-family values from rich text content, so fonts with spaces such as Old London render correctly on screens.
+
+## 2.7.2 - 2026-08-14
+
+### Fixed
+
+- HTML and webpage region previews now normalize object-shaped content before rendering, so the player, thumbnails, and popup preview show the intended iframe content instead of leaking raw objects.
+- HTML and webpage preview iframes now size explicitly to the full region bounds in the player, thumbnails, and popup preview.
+
+## 2.7.1 - 2026-08-14
+
+### Changed
+
+- The player page now supports keyboard navigation with arrow keys to move between slides.
+
+## 2.7.0 - 2026-08-14
+
+### Added
+
+- The WYSIWYG editor now supports adding small images.
+
+### Changed
+
+- The WYSIWYG image insertion flow also received a small code cleanup to simplify the related helper logic.
+- The default table formatting has been applied.
+- Timetable regions now use the renamed helpers end to end in the editor and player, including timezone-aware rendering for timetable entry placeholders.
+
+## 2.6.27 - 2026-08-14
+
+### Fixed
+
+- Scheduled task intervals now display the most appropriate exact unit, such as seconds, minutes, hours, or days, while keeping the sort order numeric.
+
+## 2.6.26 - 2026-08-10
+
+### Changed
+
+- API sources and RSS feeds now accept hours as an update interval unit, and the list and background task scheduling paths now format and convert that unit correctly.
+
+## 2.6.25 - 2026-08-10
+
+### Fixed
+
+- Screen group edit now keeps the slug locked after creation, so existing screen group URLs remain stable.
+
+## 2.6.24 - 2026-08-10
+
+### Fixed
+
+- Deferred playlist updates now keep the current slide index when the next playlist snapshot is applied, so playback no longer jumps back to the first slide mid-cycle.
+
+## 2.6.23 - 2026-08-09
+
+### Fixed
+
+- Dashboard quick-action and kiosk-launcher cards now use row spacing instead of extra card padding, so the layout stays consistent at large widths.
+- API and RSS refresh jobs now notify affected player screens only when the refreshed data actually changes, so unchanged polls no longer trigger redundant player refreshes.
+
+## 2.6.22 - 2026-08-09
+
+### Changed
+
+- Startup now logs the previously detected schema version, the current app version, and whether pending migrations exist.
+
+### Fixed
+
+- Direct-to-URL player sessions now generate and persist a stable onboarding device id in session storage, so connected screens can still be moved and renamed independently without going through the onboarding flow first.
+- The connected-clients move action now tolerates rows that only have a live connection id, which keeps move operations working for screens that skipped onboarding.
+
+## 2.6.21 - 2026-08-09
+
+### Changed
+
+- Startup now logs the previously detected schema version, the current app version, and whether migrations are required.
+- The schema documentation now reflects the timetable table rename, the new `o_app_state` table, and startup version tracking.
+- Timetable timezone placeholders now use `tz` for the short zone name and `tz_long` for the full IANA zone.
+
+## 2.6.20 - 2026-08-09
+
+### Changed
+
+- Startup now logs the previously detected schema version, the current app version, and whether migrations are required.
+
+## 2.6.19 - 2026-08-09
+
+### Changed
+
+- Timetable editor helpers, routes, and table layout now use timetable-specific naming and tighter card/table styling.
+- Connected clients now sort by client identity fields instead of the old IP-based ordering assumption.
+
+## 2.6.18 - 2026-08-09
+
+### Changed
+
+- Timetable tables were renamed from the old `schedule` names to `timetable` names, and existing databases now rename those tables during migration.
+- The timetable group editor now uses timetable-specific naming in its shared helpers and keeps the entries table aligned with the standard admin card/table layout.
+
+## 2.6.17 - 2026-08-09
+
+### Changed
+
+- Existing timetable groups and entries are now migrated to Europe/London, and timetable dates are rewritten to UTC using that source timezone so the wall-clock meaning stays intact.
+
+### Fixed
+
+- New timetable groups now default to Europe/London so the timetable editor and saved data start from the same timezone assumption as the migrated rows.
+
+## 2.6.16 - 2026-08-09
+
+### Changed
+
+- Timetable groups now store an IANA time zone and render their entry datetimes in that timetable time zone, so schedules keep the same wall-clock meaning when they are edited from another country.
+
+### Fixed
+
+- Timetable entry date inputs now round-trip through the timetable time zone instead of the browser locale, so saving from Florida while targeting Germany keeps the intended local times.
+
+## 2.6.15 - 2026-08-08
+
+### Fixed
+
+- Slide update media sync on the player now removes uploads that were removed from the slide, so player storage stays aligned with the current slide content.
+- Routine player and player-bridge media upload/delete logs were removed to keep remote player and bridge operation quieter.
+- Background task descriptions no longer repeat the player slug when the task key already ends with that player name.
+
+## 2.6.14 - 2026-08-08
+
+### Fixed
+
+- Slide updates and template deletes now fan out media sync work across all live players instead of targeting only one player.
+
+## 2.6.13 - 2026-08-08
+
+### Fixed
+
+- The player bundle now keeps the browser-only QR export dependencies lazy-loaded, so the remote player image no longer needs `puppeteer-core` or `@sparticuz/chromium` at startup.
+- Remote player startup sync now falls back to `WEB_INTERNAL_URL` when it is configured, which avoids 404s when the bridge is not the correct sync target.
+- The player startup sync and media-write info logs were removed to keep normal remote-player operation quieter.
+
+## 2.6.12 - 2026-08-08
+
+### Fixed
+
+- The Docker build inputs now live under `build/`, with separate web and player package manifests so the player image no longer carries the web browser tooling bundle.
+- The Docker publish workflow now restores `v2` and `v2.2` style image tags alongside `latest` and the full release tag.
+- Remote player sync and upload routing now carry the exact connected player device id through the bridge, so startup media and font jobs target the correct player instance in split-device deployments.
+- Player websocket registration now learns the public base URL from the actual screen request origin, so localhost and 127.0.0.1 aliases both keep websocket commands working.
+
+## 2.6.11 - 2026-08-08
+
+### Fixed
+
+- Role edits now save selected permissions from the shared RBAC form, so changes on the role page persist when you submit the form.
+- RBAC permission sections now stay open independently in the accordion, so opening one section no longer closes the others.
+
+## 2.6.10 - 2026-08-08
+
+### Fixed
+
+- The onboarding landing page and form no longer restore a previously selected screen, so the screen picker always starts clean while still keeping the saved client name.
+
+## 2.6.9 - 2026-08-08
+
+### Fixed
+
+- The connected-clients view no longer exposes or sorts by client IP, so the table stays focused on the player identity, screen, and playback state.
+- The connected-clients dashboard row renderer now keeps the actions column aligned after removing the IP column, so row updates no longer append a duplicate actions cell.
+
+## 2.6.8 - 2026-08-08
+
+### Fixed
+
+- The screen-group command buttons stay disabled until a real target group is selected, so the placeholder "Select Screen Group" state cannot send commands.
+
+## 2.6.7 - 2026-08-08
+
+### Fixed
+
+- Admin client commands now stay on the bridge for remote players, so screen control no longer depends on a public player address.
+- The connected-clients screen-group controls now use the same async bulk-command path as the dashboard, including the All Screens option and live pause/blackout toggles.
+
+## 2.6.6 - 2026-08-07
+
+### Fixed
+
+- Timetable entry editing now validates end times locally, requires the end to be at least one minute after the start, and highlights the end field when the value is invalid.
+
 ## 2.6.5 - 2026-08-07

 ### Added
@@ -1,20 +0,0 @@
-FROM node:24-alpine
-
-WORKDIR /app
-
-RUN apk add --no-cache ffmpeg chromium nss freetype harfbuzz ttf-freefont
-
-COPY package*.json ./
-RUN npm install --omit=dev --no-audit --no-fund
-
-COPY src ./src
-COPY scripts ./scripts
-
-RUN mkdir -p /app/src/web/public/vendor/animate.css && cp /app/node_modules/animate.css/animate.min.css /app/src/web/public/vendor/animate.css/animate.min.css
-RUN mkdir -p /app/src/player/public/vendor/animate.css && cp /app/node_modules/animate.css/animate.min.css /app/src/player/public/vendor/animate.css/animate.min.css
-
-RUN mkdir -p /app/media
-
-EXPOSE 3000
-
-CMD ["npm", "run", "start:web"]
@@ -1,5 +1,7 @@
 # Pulse Signage

+[![Publish Docker Image](https://git.lzstealth.com/lzstealth/pulse-signage/actions/workflows/docker-publish.yml/badge.svg?branch=main)](https://git.lzstealth.com/lzstealth/pulse-signage/actions?workflow=docker-publish.yml)
+
 Pulse Signage is a self-hosted digital signage platform for teams that want clear, reliable control over the content on every screen.

 It gives you one place to publish playlists, slides, announcements, and live updates without handing the workflow to a third-party service.
@@ -32,6 +34,7 @@ If you want the details, start with the [Compose guide](docker-compose/README.md
 - [Database schema](docs/schema.md) - the tables and data model the app maintains.
 - [WebSocket reference](docs/websocket.md) - the live player and snapshot channels.
 - [Compose guide](docker-compose/README.md) - deployment options and service layout.
+- [Changelog](CHANGELOG.md) - release history and notable changes.

 ## Explore The Docs

@@ -0,0 +1,18 @@
+FROM node:26-alpine
+
+WORKDIR /app
+
+RUN apk add --no-cache chromium nss freetype harfbuzz ttf-freefont
+
+COPY build/package.web.json ./package.json
+RUN npm install --omit=dev --no-audit --no-fund
+COPY package-lock.json ./package-lock.json
+
+COPY src ./src
+COPY scripts ./scripts
+
+RUN mkdir -p /app/media
+
+EXPOSE 3000
+
+CMD ["npm", "run", "start:web"]
@@ -0,0 +1,18 @@
+FROM node:26-alpine
+
+WORKDIR /app
+
+RUN apk add --no-cache ffmpeg
+
+COPY build/package.player.json ./package.json
+RUN npm install --omit=dev --no-audit --no-fund
+COPY package-lock.json ./package-lock.json
+
+COPY src ./src
+COPY scripts ./scripts
+
+RUN mkdir -p /app/media
+
+EXPOSE 3000
+
+CMD ["npm", "run", "start:player"]
@@ -0,0 +1,22 @@
+{
+  "name": "pulse-signage-player",
+  "version": "2.8.4",
+  "private": false,
+  "description": "Pulse Signage player application bundle",
+  "engines": {
+    "node": ">=26.0.0"
+  },
+  "main": "src/common.js",
+  "scripts": {
+    "start": "node -r dotenv/config src/player.js",
+    "start:player": "node -r dotenv/config src/player.js"
+  },
+  "dependencies": {
+    "dotenv": "^17.4.2",
+    "express": "^5.2.1",
+    "handlebars": "^4.7.8",
+    "hls.js": "^1.7.0",
+    "mysql2": "^3.23.3",
+    "ws": "^8.21.3"
+  }
+}
@@ -0,0 +1,25 @@
+{
+  "name": "pulse-signage-web",
+  "version": "2.8.4",
+  "private": false,
+  "description": "Pulse Signage web and bridge application bundle",
+  "engines": {
+    "node": ">=26.0.0"
+  },
+  "main": "src/common.js",
+  "scripts": {
+    "start": "node -r dotenv/config src/web.js",
+    "start:web": "node -r dotenv/config src/web.js"
+  },
+  "dependencies": {
+    "@sparticuz/chromium": "^149.0.0",
+    "dotenv": "^17.4.2",
+    "express": "^5.2.1",
+    "handlebars": "^4.7.8",
+    "multer": "^2.2.0",
+    "mysql2": "^3.23.3",
+    "puppeteer-core": "^25.7.0",
+    "sharp": "^0.35.3",
+    "ws": "^8.21.3"
+  }
+}
@@ -1,5 +1,6 @@
 # Shared application settings
-PULSE_SIGNAGE_IMAGE="git.lzstealth.com/lzstealth/pulse-signage:latest"
+PULSE_SIGNAGE_WEB_IMAGE="git.lzstealth.com/lzstealth/pulse-signage-web:latest"
+PULSE_SIGNAGE_PLAYER_IMAGE="git.lzstealth.com/lzstealth/pulse-signage-player:latest"
 PULSE_SIGNAGE_SHARED_SECRET=""

 # Database settings for the web, player, and bridge services
@@ -12,15 +13,14 @@ MYSQL_ROOT_PASSWORD="root_password"

 # Player settings
 PLAYER_IDENTIFIER="player-local"
-PLAYER_PUBLIC_BASE_URL="http://localhost:8081"
-PLAYER_INTERNAL_BASE_URL="http://player:8081"
+PLAYER_PUBLIC_URL="http://localhost:8081"
+PLAYER_INTERNAL_URL="http://player:8081"

 # Web app bootstrap settings
-SESSION_MAX_AGE_DAYS=14
 DEFAULT_ADMIN_USERNAME="admin"
 DEFAULT_ADMIN_NAME="Admin"
-DEFAULT_ADMIN_PASSWORD="admin"
-PASSWORD_HASH_ITERATIONS=310000
+DEFAULT_ADMIN_PASSWORD="password123!"

 # Bridge settings for the player-bridge service
-WEB_BASE_URL="http://web:8080"
+WEB_INTERNAL_URL="http://web:8080"
+BRIDGE_INTERNAL_URL="http://player-bridge:8090"
@@ -1,11 +1,11 @@
 # Shared application settings
-PULSE_SIGNAGE_IMAGE="git.lzstealth.com/lzstealth/pulse-signage:latest"
+PULSE_SIGNAGE_PLAYER_IMAGE="git.lzstealth.com/lzstealth/pulse-signage-player:latest"
 PULSE_SIGNAGE_SHARED_SECRET=""

 # Player settings
 PLAYER_IDENTIFIER="player-remote"
-PLAYER_PUBLIC_BASE_URL="http://localhost:8081"
+PLAYER_PUBLIC_URL="http://localhost:8081"
 PLAYER_AGENT_RECONNECT_DELAY_MS=5000

 # Remote player connectivity settings
-THIN_CLIENT_BASE_URL="http://192.168.0.80:8090"
+BRIDGE_PUBLIC_URL="http://player-bridge.example.com:8090"
@@ -45,7 +45,6 @@ Key configuration:

 - `DB_HOST`, `DB_PORT`, `DB_NAME`, `DB_USER`, `DB_PASSWORD`
 - `PULSE_SIGNAGE_SHARED_SECRET`
- `SESSION_MAX_AGE_DAYS`
 - `DEFAULT_ADMIN_USERNAME`
 - `DEFAULT_ADMIN_NAME`
 - `DEFAULT_ADMIN_PASSWORD`
@@ -59,15 +58,16 @@ Responsibilities:

 - serves the player UI on port `8081`
 - connects to MySQL in local mode
- connects to the bridge in remote mode through `THIN_CLIENT_BASE_URL`
+- connects to the bridge in remote mode through `BRIDGE_PUBLIC_URL`
 - registers live connections and accepts control commands

 Key configuration:

- `PLAYER_PUBLIC_BASE_URL`
- `PLAYER_INTERNAL_BASE_URL`
+- `PLAYER_PUBLIC_URL`
+- `PLAYER_INTERNAL_URL`
+- `BRIDGE_INTERNAL_URL`
 - `PLAYER_IDENTIFIER`
- `THIN_CLIENT_BASE_URL` in remote mode
+- `BRIDGE_PUBLIC_URL` in remote mode
 - `PULSE_SIGNAGE_SHARED_SECRET`
 - database settings in local mode

@@ -85,7 +85,7 @@ Responsibilities:
 Key configuration:

 - `PULSE_SIGNAGE_SHARED_SECRET`
- `WEB_BASE_URL` for the bridge when it should call the web app directly instead of inferring from request headers
+- `WEB_INTERNAL_URL` for the bridge when it should call the web app directly instead of inferring from request headers
 - `DB_HOST`, `DB_PORT`, `DB_NAME`, `DB_USER`, `DB_PASSWORD`

 ### `mysql`
@@ -112,15 +112,18 @@ Use this file as a starting point for the public compose stack.

 Important values:

- `PULSE_SIGNAGE_IMAGE` - image to run for all app services
+- `PULSE_SIGNAGE_WEB_IMAGE` - image to run for the web app and bridge services, typically `.../pulse-signage-web:latest`
+- `PULSE_SIGNAGE_PLAYER_IMAGE` - image to run for the player services, typically `.../pulse-signage-player:latest`
 - `PULSE_SIGNAGE_SHARED_SECRET` - long random secret shared by the web, player, and bridge services for authenticated requests
 - `PLAYER_IDENTIFIER` - unique local player identifier
 - `DB_*` - MySQL credentials and database name for the stack
- `PLAYER_PUBLIC_BASE_URL` - public URL the player advertises
- `PLAYER_INTERNAL_BASE_URL` - internal URL the web app uses for local player calls
- `SESSION_MAX_AGE_DAYS` - dashboard session lifetime
+- `PLAYER_PUBLIC_URL` - public URL the player advertises
+- `PLAYER_INTERNAL_URL` - internal URL the web app uses for local player calls
+- `BRIDGE_INTERNAL_URL` - bridge URL the web app uses for player snapshot and command forwarding
+- `WEB_INTERNAL_URL` - internal URL the bridge uses to call the web app directly
 - `DEFAULT_ADMIN_*` - bootstrap admin account values
 - `PASSWORD_HASH_ITERATIONS` - password hashing cost
+- `MYSQL_ROOT_PASSWORD` - root password for the local MySQL container

 ### `.env.remote.example`

@@ -128,11 +131,11 @@ Use this file on a remote player device.

 Important values:

- `PULSE_SIGNAGE_IMAGE` - image to run on the device
+- `PULSE_SIGNAGE_PLAYER_IMAGE` - image to run on the device, typically `.../pulse-signage-player:latest`
 - `PULSE_SIGNAGE_SHARED_SECRET` - must match the public stack and should be the same long random value used everywhere in the deployment
 - `PLAYER_IDENTIFIER` - unique remote player identifier
- `PLAYER_PUBLIC_BASE_URL` - public URL for the remote player
- `THIN_CLIENT_BASE_URL` - bridge URL the player connects back to
+- `PLAYER_PUBLIC_URL` - public URL for the remote player
+- `BRIDGE_PUBLIC_URL` - bridge URL the player connects back to
 - `PLAYER_AGENT_RECONNECT_DELAY_MS` - reconnect delay for the player agent

 ### `PULSE_SIGNAGE_SHARED_SECRET`
@@ -153,7 +156,8 @@ Leave it blank only if you intentionally want to run without request signing in

 | Variable | Used By | Purpose |
 | --- | --- | --- |
-| `PULSE_SIGNAGE_IMAGE` | web, player, bridge, remote player | Docker image to run for the app services. |
+| `PULSE_SIGNAGE_WEB_IMAGE` | web, bridge | Docker image to run for the web app and bridge services. |
+| `PULSE_SIGNAGE_PLAYER_IMAGE` | player, remote player | Docker image to run for the player services. |
 | `PULSE_SIGNAGE_SHARED_SECRET` | web, player, bridge, remote player | Shared secret for authenticated requests between services. |
 | `DB_HOST` | web, player, bridge | Database host name. |
 | `DB_PORT` | web, player, bridge | Database port. |
@@ -161,16 +165,20 @@ Leave it blank only if you intentionally want to run without request signing in
 | `DB_USER` | web, player, bridge, mysql | Database user. |
 | `DB_PASSWORD` | web, player, bridge, mysql | Database password. |
 | `MYSQL_ROOT_PASSWORD` | mysql | Root password for the local MySQL container. |
-| `SESSION_MAX_AGE_DAYS` | web | Session cookie lifetime. |
 | `DEFAULT_ADMIN_USERNAME` | web | Bootstrap admin username. |
 | `DEFAULT_ADMIN_NAME` | web | Bootstrap admin display name. |
 | `DEFAULT_ADMIN_PASSWORD` | web | Bootstrap admin password. |
 | `PASSWORD_HASH_ITERATIONS` | web | Password hashing cost. |
-| `PLAYER_INTERNAL_BASE_URL` | web, player | Internal player URL used by the dashboard and player runtime. |
-| `THIN_CLIENT_BASE_URL` | web, player, remote player | URL of the bridge service. |
-| `PLAYER_PUBLIC_BASE_URL` | player, remote player | Public URL advertised by the player. |
+| `PLAYER_INTERNAL_URL` | web, player | Internal player URL used by the dashboard and player runtime. |
+| `BRIDGE_INTERNAL_URL` | web | Bridge URL used by the web app for player snapshot and command forwarding. |
+| `WEB_INTERNAL_URL` | player-bridge | Internal web URL used by the bridge to call the dashboard app directly. |
+| `PLAYER_PUBLIC_URL` | player, remote player | Public URL advertised by the player. |
+| `BRIDGE_PUBLIC_URL` | player, remote player | URL of the bridge service. |
 | `PLAYER_IDENTIFIER` | player | Stable player identifier. |
 | `PLAYER_AGENT_RECONNECT_DELAY_MS` | remote player | Delay before reconnecting to the bridge. |
+| `MYSQL_DATABASE` | mysql | Database name used by the local MySQL container. |
+| `MYSQL_USER` | mysql | Database user used by the local MySQL container. |
+| `MYSQL_PASSWORD` | mysql | Database password used by the local MySQL container. |

 ## Ports

@@ -208,8 +216,8 @@ Each compose file creates its own named network:
 - The public stack expects the app services and MySQL to share the same `PULSE_SIGNAGE_SHARED_SECRET`.
 - A remote player must use the same `PULSE_SIGNAGE_SHARED_SECRET` as the bridge it connects to.
 - The bridge service is the dashboard-facing command path for connected remote players.
- The remote player should point `THIN_CLIENT_BASE_URL` at the bridge, not at the public web endpoint.
- The `PULSE_SIGNAGE_IMAGE` tag defaults to the published image, but it can be overridden for local builds or custom releases.
+- The remote player should point `BRIDGE_PUBLIC_URL` at the bridge, not at the public web endpoint.
+- The `PULSE_SIGNAGE_WEB_IMAGE` and `PULSE_SIGNAGE_PLAYER_IMAGE` tags default to the published `pulse-signage-web` and `pulse-signage-player` repositories with `latest` and `v1.2.3` style tags, but they can be overridden for local builds or custom releases.

 ## Recommended Setup

@@ -3,21 +3,21 @@ name: pulse-signage-remote
 services:

  player:
-    image: ${PULSE_SIGNAGE_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage:latest}
+    image: ${PULSE_SIGNAGE_PLAYER_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage-player:latest}
    restart: unless-stopped
+    networks:
+      - pulse_signage
    ports:
      - "8081:8081"
    environment:
-      PLAYER_PUBLIC_BASE_URL: ${PLAYER_PUBLIC_BASE_URL:-http://localhost:8081}
-      THIN_CLIENT_BASE_URL: ${THIN_CLIENT_BASE_URL:-}
+      PLAYER_IDENTIFIER: ${PLAYER_IDENTIFIER:-player-remote}
+      PLAYER_PUBLIC_URL: ${PLAYER_PUBLIC_URL:-http://localhost:8081}
+      BRIDGE_PUBLIC_URL: ${BRIDGE_PUBLIC_URL:-}
      PULSE_SIGNAGE_SHARED_SECRET: ${PULSE_SIGNAGE_SHARED_SECRET:-}
+      PLAYER_AGENT_RECONNECT_DELAY_MS: ${PLAYER_AGENT_RECONNECT_DELAY_MS:-5000}
    volumes:
      - pulse-signage:/app/media
    command: ["node", "src/player.js"]
-    networks:
-      - pulse_signage
-
-

 volumes:
  pulse-signage:
@@ -2,8 +2,10 @@ name: pulse-signage

 services:
  web:
-    image: ${PULSE_SIGNAGE_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage:latest}
+    image: ${PULSE_SIGNAGE_WEB_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage-web:latest}
    restart: unless-stopped
+    networks:
+      - pulse_signage
    ports:
      - "8080:8080"
    environment:
@@ -13,28 +15,27 @@ services:
      DB_USER: ${DB_USER:-pulse-signage}
      DB_PASSWORD: ${DB_PASSWORD:-signage_password}
      PULSE_SIGNAGE_SHARED_SECRET: ${PULSE_SIGNAGE_SHARED_SECRET:-}
-      SESSION_MAX_AGE_DAYS: ${SESSION_MAX_AGE_DAYS:-14}
+      BRIDGE_INTERNAL_URL: ${BRIDGE_INTERNAL_URL:-http://player-bridge:8090}
      DEFAULT_ADMIN_USERNAME: ${DEFAULT_ADMIN_USERNAME:-admin}
      DEFAULT_ADMIN_NAME: ${DEFAULT_ADMIN_NAME:-Admin}
-      DEFAULT_ADMIN_PASSWORD: ${DEFAULT_ADMIN_PASSWORD:-admin}
-      PASSWORD_HASH_ITERATIONS: ${PASSWORD_HASH_ITERATIONS:-310000}
+      DEFAULT_ADMIN_PASSWORD: ${DEFAULT_ADMIN_PASSWORD:-password123}
    volumes:
      - pulse-signage:/app/media
    command: ["node", "src/web.js"]
    depends_on:
      mysql:
        condition: service_healthy
-    networks:
-      - pulse_signage

  player:
-    image: ${PULSE_SIGNAGE_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage:latest}
+    image: ${PULSE_SIGNAGE_PLAYER_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage-player:latest}
    restart: unless-stopped
+    networks:
+      - pulse_signage
    ports:
      - "8081:8081"
    environment:
-      PLAYER_PUBLIC_BASE_URL: ${PLAYER_PUBLIC_BASE_URL:-http://localhost:8081}
-      PLAYER_INTERNAL_BASE_URL: ${PLAYER_INTERNAL_BASE_URL:-http://player:8081}
+      PLAYER_PUBLIC_URL: ${PLAYER_PUBLIC_URL:-http://localhost:8081}
+      PLAYER_INTERNAL_URL: ${PLAYER_INTERNAL_URL:-http://player:8081}
      PLAYER_IDENTIFIER: ${PLAYER_IDENTIFIER:-player-local}
      PULSE_SIGNAGE_SHARED_SECRET: ${PULSE_SIGNAGE_SHARED_SECRET:-}
      DB_HOST: ${DB_HOST:-mysql}
@@ -48,16 +49,16 @@ services:
    depends_on:
      mysql:
        condition: service_healthy
-    networks:
-      - pulse_signage

  player-bridge:
-    image: ${PULSE_SIGNAGE_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage:latest}
+    image: ${PULSE_SIGNAGE_WEB_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage-web:latest}
    restart: unless-stopped
+    networks:
+      - pulse_signage
    ports:
      - "8090:8090"
    environment:
-      WEB_BASE_URL: ${WEB_BASE_URL:-http://web:8080}
+      WEB_INTERNAL_URL: ${WEB_INTERNAL_URL:-http://web:8080}
      PULSE_SIGNAGE_SHARED_SECRET: ${PULSE_SIGNAGE_SHARED_SECRET:-}
      DB_HOST: ${DB_HOST:-mysql}
      DB_PORT: ${DB_PORT:-3306}
@@ -68,8 +69,6 @@ services:
    depends_on:
      mysql:
        condition: service_healthy
-    networks:
-      - pulse_signage

  mysql:
    image: mysql:8.4
@@ -286,6 +286,8 @@ Response fields:
 - `id`
 - `name`
 - `fade_between_slides`
+- `skip_unavailable_rtmp`
+- `canvas_id`

 ### Slide

@@ -293,12 +295,9 @@ Response fields:
 - `title`
 - `body`
 - `duration_seconds`
- `schedule_mode`
- `schedule_start_datetime`
- `schedule_end_datetime`
- `schedule_start_time`
- `schedule_end_time`
- `schedule_days_json`
+- `use_video_duration`
+- `disable_audio`
+- `scheduleRules`
 - `media_url`
 - `media_type`
 - `kind`
@@ -3,7 +3,7 @@
 This app creates and maintains its schema at startup through `src/db/index.js`.
 The sections below summarize the current tables and their purpose.

-Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_at` and `modified_at` when a table supports auditing.
+Tables generally use a numeric auto-increment `id` primary key. The relationship table `d_announcement_screens` intentionally uses the composite `(announcement_id, screen_id)` primary key instead. Natural and relationship keys remain as unique constraints where needed. Timestamps are stored as `created_at` and `modified_at` when a table supports auditing.

 ## Admin

@@ -16,7 +16,7 @@ Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_

 ### `a_users`

- `id`, `name`, `username`, `password_hash`, `password_salt`, `password_iterations`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `id`, `name`, `username`, `password_hash`, `password_salt`, `password_iterations`, `must_change_password`, `account_locked`, `created_at`, `created_by`, `modified_at`, `modified_by`
 - `username` is unique.

 ### `a_roles`
@@ -32,24 +32,24 @@ Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_

 ### `a_role_permissions`

- `role_id`, `permission_id`, `created_at`, `modified_at`
+- `id`, `role_id`, `permission_id`, `created_at`, `modified_at`
 - Foreign keys:
        - `role_id` -> `a_roles.id`
        - `permission_id` -> `a_permissions.id`
- Composite primary key: `(role_id, permission_id)`
+- Unique key: `(role_id, permission_id)`

 ### `a_user_roles`

- `user_id`, `role_id`, `created_at`, `modified_at`
+- `id`, `user_id`, `role_id`, `created_at`, `modified_at`
 - Foreign keys:
        - `user_id` -> `a_users.id`
        - `role_id` -> `a_roles.id`
- Composite primary key: `(user_id, role_id)`
+- Unique key: `(user_id, role_id)`

 ### `a_sessions`

- `session_hash`, `user_id`, `expires_at`, `created_at`, `created_by`, `last_used_at`, `modified_by`
- `session_hash` is the primary key.
+- `id`, `session_hash`, `user_id`, `ip_address`, `user_agent`, `expires_at`, `created_at`, `created_by`, `last_used_at`, `modified_by`
+- `session_hash` is unique.
 - Foreign key:
        - `user_id` -> `a_users.id`

@@ -116,11 +116,6 @@ Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_
 - `d_screens` - screen records and playlist assignment.
 - `d_onboarding_devices` - device-to-screen bindings and onboarded client names.

-## Announcements
-
- `d_announcements` - announcement content and display metadata.
- `d_announcement_screens` - announcement-to-screen assignments.
-
 ### `d_players`

 - `id`, `identifier`, `public_base_url`, `internal_base_url`, `last_seen_at`, `created_at`, `modified_at`
@@ -138,11 +133,20 @@ Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_

 ### `d_onboarding_devices`

- `device_id`, `client_name`, `screen_id`, `created_at`, `created_by`, `modified_at`, `modified_by`
- `device_id` is the primary key.
+- `id`, `device_id`, `client_name`, `screen_id`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `device_id` is unique.
 - Foreign key:
        - `screen_id` -> `d_screens.id` with `ON DELETE SET NULL`

+## Onboarding
+
+- The onboarding flow uses `d_onboarding_devices` to bind a device to a screen and persist the client name.
+
+## Announcements
+
+- `d_announcements` - announcement content and display metadata.
+- `d_announcement_screens` - announcement-to-screen assignments.
+
 ### `d_announcements`

 - `id`, `message`, `short_label`, `announcement_type`, `color_key`, `icon_key`, `duration_seconds`, `expires_at`, `created_at`, `created_by`, `modified_at`, `modified_by`
@@ -154,19 +158,15 @@ Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_
 - Foreign keys:
        - `announcement_id` -> `d_announcements.id` with `ON DELETE CASCADE`
        - `screen_id` -> `d_screens.id` with `ON DELETE CASCADE`
- Composite primary key: `(announcement_id, screen_id)`
-
-## Onboarding
-
- The onboarding flow uses `d_onboarding_devices` to bind a device to a screen and persist the client name.
+- Unique key: `(announcement_id, screen_id)`

 ## Integrations

 - `i_rss_feeds` - RSS feed definitions and refresh cadence.
 - `i_rss_feed_items` - cached RSS feed items.
 - `i_api_sources` - API source definitions and last response snapshot.
- `i_schedule_groups` - grouped schedule definitions used by the schedule region.
- `i_schedule_entries` - dated entries that belong to a schedule group.
+- `i_timetable_groups` - grouped timetable definitions used by the timetable region.
+- `i_timetable_entries` - dated entries that belong to a timetable group.

 ### `i_rss_feeds`

@@ -184,32 +184,53 @@ Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_

 - `id`, `name`, `api_url`, `auth_method`, `auth_username`, `auth_password`, `auth_bearer_token`, `auth_header_name`, `auth_header_value`, `items_path`, `update_interval_value`, `update_interval_unit`, `last_pulled_at`, `last_pull_error`, `last_response_status`, `last_response_content_type`, `last_response_json`, `created_at`, `created_by`, `modified_at`, `modified_by`

-### `i_schedule_groups`
+### `i_timetable_groups`

- `id`, `name`, `short_description`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `id`, `name`, `short_description`, `timezone`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `timezone` defaults to `Europe/London`.

-### `i_schedule_entries`
+### `i_timetable_entries`

 - `id`, `schedule_group_id`, `title`, `short_description`, `start_datetime`, `end_datetime`, `created_at`, `created_by`, `modified_at`, `modified_by`
 - Foreign key:
-        - `schedule_group_id` -> `i_schedule_groups.id` with `ON DELETE CASCADE`
+        - `schedule_group_id` -> `i_timetable_groups.id` with `ON DELETE CASCADE`
 - Index:
        - `(schedule_group_id, start_datetime)`

 ## Operations

 - `o_background_tasks` - queue and history for background jobs.
+- `o_app_state` - generic app state and version markers stored as key/value pairs.
+- `o_app_settings` - administrator-configurable application settings stored by key.
+- `o_audit_events` - retained audit events for administrator activity and system changes.

 ### `o_background_tasks`

 - `id`, `task_key`, `task_type`, `title`, `category`, `status`, `payload_json`, `metadata_json`, `attempts`, `created_at`, `created_by`, `started_at`, `finished_at`, `error_message`
 - Indexed by `status`, `task_key`, and `task_type`.

+### `o_app_state`
+
+- `id`, `state_key`, `state_value`, `created_at`, `modified_at`
+- `state_key` is unique.
+- `schema_version` is stored here so startup can detect the previously recorded schema version before deciding whether migrations need to run.
+
+### `o_app_settings`
+
+- `id`, `setting_key`, `setting_value`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `setting_key` is unique.
+- Values are stored as JSON and validated against the application setting definitions in `src/data/app-settings.js`.
+
+### `o_audit_events`
+
+- `id`, `occurred_at`, `category`, `event_type`, `actor_user_id`, `target_type`, `target_id`, `target_label`, `ip_address`, `user_agent`, `details_json`
+- Indexed by occurrence time, category and event type, actor, and target.
+
 ## Notes

 - The schema is initialized with `CREATE TABLE IF NOT EXISTS`, so new installs can start from an empty database.
 - `src/db/bootstrap.js` seeds the canvas size defaults, default permissions, and the default administrator role.
- The migration module stays in place for future releases, but this version treats the current schema as the install baseline.
+- `src/db/migrations.js` records the current schema version in `o_app_state` during startup so later launches can tell whether an update is happening.

 ```mermaid
 erDiagram
@@ -255,18 +276,25 @@ erDiagram
        }
        I_API_SOURCES {
        }
-        I_SCHEDULE_GROUPS {
+        I_TIMETABLE_GROUPS {
        }
-        I_SCHEDULE_ENTRIES {
+        I_TIMETABLE_ENTRIES {
+        }
+        O_APP_STATE {
+        }
+        O_APP_SETTINGS {
        }
        O_BACKGROUND_TASKS {
        }
+        O_AUDIT_EVENTS {
+        }

        A_USERS ||--o{ A_USER_ROLES : has
        A_ROLES ||--o{ A_USER_ROLES : assigned_to
        A_ROLES ||--o{ A_ROLE_PERMISSIONS : has
        A_PERMISSIONS ||--o{ A_ROLE_PERMISSIONS : granted_to
        A_USERS ||--o{ A_SESSIONS : owns
+        A_USERS ||--o{ O_AUDIT_EVENTS : acts

        C_CANVAS_SIZES ||--o{ C_TEMPLATES : used_by
        C_CANVAS_SIZES ||--o{ C_PLAYLISTS : used_by
@@ -282,5 +310,5 @@ erDiagram
        D_SCREENS ||--o{ D_ANNOUNCEMENT_SCREENS : receives

        I_RSS_FEEDS ||--o{ I_RSS_FEED_ITEMS : caches
-        I_SCHEDULE_GROUPS ||--o{ I_SCHEDULE_ENTRIES : contains
+        I_TIMETABLE_GROUPS ||--o{ I_TIMETABLE_ENTRIES : contains
 ```
@@ -1,8 +1,11 @@
 {
  "name": "pulse-signage",
-  "version": "2.6.5",
+  "version": "2.8.4",
  "private": false,
  "description": "Pulse Signage application with MySQL and media storage",
+  "engines": {
+    "node": ">=26.0.0"
+  },
  "repository": {
    "type": "git",
    "url": "https://git.lzstealth.com/LZStealth/pulse-signage.git"
@@ -17,19 +20,19 @@
    "test": "node --test"
  },
  "dependencies": {
-    "@sparticuz/chromium": "^137.0.0",
+    "@sparticuz/chromium": "^149.0.0",
    "animate.css": "^4.1.1",
-    "bootstrap-icons": "1.11.3",
+    "bootstrap-icons": "1.13.1",
    "cropperjs": "^1.6.2",
    "dotenv": "^17.4.2",
-    "express": "^4.21.2",
+    "express": "^5.2.1",
    "handlebars": "^4.7.8",
-    "hls.js": "^1.5.15",
+    "hls.js": "^1.7.0",
    "multer": "^2.2.0",
-    "mysql2": "^3.14.3",
-    "puppeteer-core": "^24.16.0",
+    "mysql2": "^3.23.3",
+    "puppeteer-core": "^25.7.0",
    "sharp": "^0.35.3",
-    "ws": "^8.21.0"
+    "ws": "^8.21.3"
  },
  "devDependencies": {
    "nodemon": "^3.1.10"
@@ -7,21 +7,55 @@ const PASSWORD_KEY_LENGTH = 32;
 const PASSWORD_DIGEST = 'sha256';
 const SESSION_BYTES = 32;

-function validatePasswordStrength(password) {
+function validatePasswordStrength(password, options) {
  const value = String(password || '');
+  const requirements = options && options.policy
+    ? getPasswordPolicyPreset(options.policy)
+    : {
+      minimumLength: Number(options && options.minimumLength) || 10,
+      minimumCategories: Number(options && options.minimumCategories) || 3,
+      requireLowercase: Boolean(options && options.requireLowercase),
+      requireUppercase: Boolean(options && options.requireUppercase),
+      requireNumber: Boolean(options && options.requireNumber),
+      requireSymbol: Boolean(options && options.requireSymbol)
+    };
  const hasLowercase = /[a-z]/.test(value);
  const hasUppercase = /[A-Z]/.test(value);
  const hasNumber = /[0-9]/.test(value);
  const hasSymbol = /[^A-Za-z0-9]/.test(value);
  const categoryCount = [hasLowercase, hasUppercase, hasNumber, hasSymbol].filter(Boolean).length;

-  if (value.length < 10 || categoryCount < 3) {
-    return 'Password must be at least 10 characters and include 3 of: uppercase, lowercase, number, and symbol.';
+  const missingRequiredCategory = requirements.requireLowercase && !hasLowercase
+    || requirements.requireUppercase && !hasUppercase
+    || requirements.requireNumber && !hasNumber
+    || requirements.requireSymbol && !hasSymbol;
+  if (value.length < requirements.minimumLength || categoryCount < requirements.minimumCategories || missingRequiredCategory) {
+    if (missingRequiredCategory) {
+      const requiredCategories = [];
+      if (requirements.requireLowercase) requiredCategories.push('lowercase');
+      if (requirements.requireUppercase) requiredCategories.push('uppercase');
+      if (requirements.requireNumber) requiredCategories.push('number');
+      if (requirements.requireSymbol) requiredCategories.push('symbol');
+      return `Password must be at least ${requirements.minimumLength} characters and include ${requiredCategories.join(', ')}.`;
+    }
+    if (requirements.minimumCategories === 4) {
+      return `Password must be at least ${requirements.minimumLength} characters and include uppercase, lowercase, number, and symbol.`;
+    }
+    return `Password must be at least ${requirements.minimumLength} characters and include ${requirements.minimumCategories} of: uppercase, lowercase, number, and symbol.`;
  }

  return '';
 }

+function getPasswordPolicyPreset(policy) {
+  const normalizedPolicy = String(policy || 'standard').trim().toLowerCase();
+  return normalizedPolicy === 'strict'
+    ? { minimumLength: 14, minimumCategories: 4 }
+    : normalizedPolicy === 'strong'
+      ? { minimumLength: 12, minimumCategories: 3 }
+      : { minimumLength: 10, minimumCategories: 3 };
+}
+
 function hashPassword(password, salt) {
  const safePassword = String(password || '');
  const safeSalt = salt || crypto.randomBytes(16).toString('hex');
@@ -27,7 +27,7 @@ const dbBootstrap = require('#src/db/bootstrap');
 const data = require('#src/data');
 const player = require('#src/player/render');
 const listQuery = require('#src/web/lib/list-query');
-const { fetchPlaylistCanvasId, fetchPlaylistCanvasSignature } = require('#src/web/lib/helpers');
+const { fetchPlaylistCanvasId } = require('#src/web/lib/helpers');

 module.exports = {
  createPool: dbCommon.createPool,
@@ -63,7 +63,6 @@ module.exports = {
  getSortDirectionQuery: listQuery.getSortDirectionQuery,
  fetchPlaylistById: data.fetchPlaylistById,
  fetchPlaylistCanvasId: fetchPlaylistCanvasId,
-  fetchPlaylistCanvasSignature: fetchPlaylistCanvasSignature,
  normalizeDisplayMode: data.normalizeDisplayMode,
  fetchTimetablesData: data.fetchTimetablesData,
  fetchTimetableGroupsPage: data.fetchTimetableGroupsPage,
@@ -1,55 +1,69 @@
-const ANNOUNCEMENT_ICON_OPTIONS = [
-  { value: 'megaphone-fill', label: 'Megaphone' },
-  { value: 'megaphone', label: 'Megaphone outline' },
-  { value: 'bell-fill', label: 'Bell' },
-  { value: 'bell', label: 'Bell outline' },
-  { value: 'exclamation-triangle-fill', label: 'Warning' },
-  { value: 'exclamation-triangle', label: 'Warning outline' },
-  { value: 'info-circle-fill', label: 'Info' },
-  { value: 'info-circle', label: 'Info outline' },
-  { value: 'check-circle-fill', label: 'Success' },
-  { value: 'check-circle', label: 'Success outline' },
-  { value: 'lightbulb-fill', label: 'Idea' },
-  { value: 'lightbulb', label: 'Idea outline' },
-  { value: 'calendar-event-fill', label: 'Calendar' },
-  { value: 'calendar-event', label: 'Calendar outline' },
-  { value: 'clock-fill', label: 'Clock' },
-  { value: 'clock', label: 'Clock outline' },
-  { value: 'wifi-off', label: 'Wi-Fi Offline' },
-  { value: 'wifi', label: 'Wi-Fi' },
-  { value: 'hdd-network', label: 'Network' },
-  { value: 'hdd-network-fill', label: 'Network fill' },
-  { value: 'speaker-fill', label: 'Speaker' },
-  { value: 'speaker', label: 'Speaker outline' },
-  { value: 'shield-fill', label: 'Shield' },
-  { value: 'shield', label: 'Shield outline' },
-  { value: 'collection-play-fill', label: 'Playlist' },
-  { value: 'collection-play', label: 'Playlist outline' },
-  { value: 'broadcast', label: 'Broadcast' },
-  { value: 'broadcast-pin', label: 'Broadcast pin' },
-  { value: 'plug-fill', label: 'Plug' },
-  { value: 'plug', label: 'Plug outline' },
-  { value: 'lightning-charge-fill', label: 'Urgent' },
-  { value: 'lightning-charge', label: 'Urgent outline' },
-  { value: 'car-front-fill', label: 'Car Front' },
-  { value: 'car-front', label: 'Car Front outline' },
-  { value: 'lamp-fill', label: 'Lamp' },
-  { value: 'lamp', label: 'Lamp outline' },
-  { value: 'envelope-fill', label: 'Message' },
-  { value: 'envelope', label: 'Message outline' },
-  { value: 'people-fill', label: 'Audience' },
-  { value: 'people', label: 'Audience outline' },
-  { value: 'browser-chrome', label: 'Browser Chrome' },
-  { value: 'browser-edge', label: 'Browser Edge' },
-  { value: 'browser-firefox', label: 'Browser Firefox' },
-  { value: 'browser-safari', label: 'Browser Safari' },
-  { value: 'cone', label: 'Cone' },
-  { value: 'cone-striped', label: 'Cone striped' },
-  { value: 'cup-straw', label: 'Cup straw' },
-  { value: 'fire', label: 'Fire' }
+const fs = require('fs');
+const path = require('path');
+
+const BOOTSTRAP_ICON_CSS_PATH = path.join(__dirname, '..', 'web', 'public', 'adminlte', 'bootstrap-icons', 'css', 'bootstrap-icons.min.css');
+
+const DEFAULT_ANNOUNCEMENT_ICON_KEYS = [
+  'megaphone-fill', 'megaphone', 'bell-fill', 'bell',
+  'exclamation-triangle-fill', 'exclamation-triangle', 'info-circle-fill', 'info-circle',
+  'check-circle-fill', 'check-circle', 'lightbulb-fill', 'lightbulb',
+  'calendar-event-fill', 'calendar-event', 'clock-fill', 'clock',
+  'wifi-off', 'wifi', 'hdd-network', 'hdd-network-fill',
+  'speaker-fill', 'speaker', 'shield-fill', 'shield',
+  'collection-play-fill', 'collection-play', 'broadcast', 'broadcast-pin',
+  'plug-fill', 'plug', 'lightning-charge-fill', 'lightning-charge',
+  'car-front-fill', 'car-front', 'lamp-fill', 'lamp',
+  'envelope-fill', 'envelope', 'people-fill', 'people',
+  'browser-chrome', 'browser-edge', 'browser-firefox', 'browser-safari',
+  'cone', 'cone-striped', 'cup-straw', 'fire'
 ];

-const ANNOUNCEMENT_ICON_KEYS = ANNOUNCEMENT_ICON_OPTIONS.map(function (option) {
+function humanizeBootstrapIconLabel(iconKey) {
+  return String(iconKey || '')
+    .trim()
+    .replace(/[-_]+/g, ' ')
+    .replace(/\b\w/g, function (character) {
+      return character.toUpperCase();
+    });
+}
+
+function loadBootstrapIconCatalog() {
+  try {
+    const css = fs.readFileSync(BOOTSTRAP_ICON_CSS_PATH, 'utf8');
+    const keys = Array.from(new Set((css.match(/\.bi-([a-z0-9-]+)::?before/g) || []).map(function (match) {
+      return String(match || '')
+        .replace(/^\.bi-/, '')
+        .replace(/::?before$/, '')
+        .trim()
+        .toLowerCase();
+    }).filter(Boolean)));
+
+    return keys.map(function (value) {
+      return {
+        value: value,
+        label: humanizeBootstrapIconLabel(value)
+      };
+    }).sort(function (left, right) {
+      return left.value.localeCompare(right.value);
+    });
+  } catch (_error) {
+    return DEFAULT_ANNOUNCEMENT_ICON_KEYS.map(function (value) {
+      return { value: value, label: humanizeBootstrapIconLabel(value) };
+    });
+  }
+}
+
+const ANNOUNCEMENT_ICON_CATALOG = loadBootstrapIconCatalog();
+const ANNOUNCEMENT_ICON_OPTIONS = DEFAULT_ANNOUNCEMENT_ICON_KEYS.map(function (value) {
+  const catalogOption = ANNOUNCEMENT_ICON_CATALOG.find(function (option) {
+    return option.value === value;
+  });
+  return catalogOption || { value: value, label: humanizeBootstrapIconLabel(value) };
+});
+
+const ANNOUNCEMENT_ICON_KEYS = DEFAULT_ANNOUNCEMENT_ICON_KEYS.slice();
+
+const ANNOUNCEMENT_ICON_CATALOG_KEYS = ANNOUNCEMENT_ICON_CATALOG.map(function (option) {
  return option.value;
 });

@@ -58,17 +72,27 @@ const ANNOUNCEMENT_ICON_LABELS = ANNOUNCEMENT_ICON_OPTIONS.reduce(function (labe
  return labels;
 }, Object.create(null));

+ANNOUNCEMENT_ICON_CATALOG.forEach(function (option) {
+  if (!Object.prototype.hasOwnProperty.call(ANNOUNCEMENT_ICON_LABELS, option.value)) {
+    ANNOUNCEMENT_ICON_LABELS[option.value] = option.label;
+  }
+});
+
 const DEFAULT_ANNOUNCEMENT_ICON = 'megaphone-fill';

 function normalizeAnnouncementIcon(value) {
  const normalized = String(value || '').trim().toLowerCase();
-  return ANNOUNCEMENT_ICON_KEYS.includes(normalized) ? normalized : DEFAULT_ANNOUNCEMENT_ICON;
+  return ANNOUNCEMENT_ICON_CATALOG_KEYS.includes(normalized) ? normalized : DEFAULT_ANNOUNCEMENT_ICON;
 }

 module.exports = {
+  DEFAULT_ANNOUNCEMENT_ICON_KEYS,
  ANNOUNCEMENT_ICON_OPTIONS,
  ANNOUNCEMENT_ICON_KEYS,
+  ANNOUNCEMENT_ICON_CATALOG,
+  ANNOUNCEMENT_ICON_CATALOG_KEYS,
  ANNOUNCEMENT_ICON_LABELS,
  DEFAULT_ANNOUNCEMENT_ICON,
+  humanizeBootstrapIconLabel,
  normalizeAnnouncementIcon
 };
@@ -11,7 +11,10 @@ const ITEMS_PATH_MAX_LENGTH = 255;

 function normalizeUpdateIntervalUnit(value) {
  const unit = String(value || '').trim().toLowerCase();
-  return unit === 'seconds' ? 'seconds' : 'minutes';
+  if (unit === 'seconds' || unit === 'minutes' || unit === 'hours') {
+    return unit;
+  }
+  return 'minutes';
 }

 function normalizeAuthMethod(value) {
@@ -19,10 +22,6 @@ function normalizeAuthMethod(value) {
  return ['basic', 'bearer', 'api_key_header'].includes(method) ? method : 'none';
 }

-function getItemsPath(source) {
-  return String(source && (source.items_path || source.itemsPath) || '').trim();
-}
-
 function buildAuthHeaders(source) {
  const method = normalizeAuthMethod(source && (source.auth_method || source.authMethod));
  const headers = {};
@@ -0,0 +1,207 @@
+const { DEFAULT_ANNOUNCEMENT_ICON_KEYS } = require('./announcement-icons');
+
+const SETTING_DEFINITIONS = [
+  { key: 'app.name', type: 'string', defaultValue: 'Pulse Signage' },
+  { key: 'locale.timezone', type: 'string', defaultValue: 'Europe/London' },
+  { key: 'locale.language', type: 'string', defaultValue: 'en' },
+  { key: 'ui.theme', type: 'enum', values: ['dark', 'light', 'auto'], defaultValue: 'dark' },
+  { key: 'security.session_lifetime_days', type: 'integer', min: 1, defaultValue: 14 },
+  { key: 'security.allow_user_session_revocation', type: 'boolean', defaultValue: true },
+  { key: 'security.max_active_sessions', type: 'integer', min: 0, defaultValue: 0 },
+  { key: 'security.password_min_length', type: 'integer', min: 8, defaultValue: 10 },
+  { key: 'security.password_min_categories', type: 'integer', min: 1, defaultValue: 3 },
+  { key: 'security.password_require_lowercase', type: 'boolean', defaultValue: false },
+  { key: 'security.password_require_uppercase', type: 'boolean', defaultValue: false },
+  { key: 'security.password_require_number', type: 'boolean', defaultValue: false },
+  { key: 'security.password_require_symbol', type: 'boolean', defaultValue: false },
+  { key: 'security.require_password_change_for_new_users', type: 'boolean', defaultValue: true },
+  { key: 'security.require_password_change_after_admin_reset', type: 'boolean', defaultValue: true },
+  { key: 'security.login_max_attempts', type: 'integer', min: 1, defaultValue: 5 },
+  { key: 'security.login_lockout_minutes', type: 'integer', min: 1, defaultValue: 15 },
+  { key: 'security.login_rate_limit_scope', type: 'enum', values: ['both', 'username', 'ip'], defaultValue: 'both' },
+  { key: 'audit.enabled', type: 'boolean', defaultValue: true },
+  { key: 'audit.categories', type: 'string_array', defaultValue: ['authentication', 'security', 'sessions', 'users', 'roles', 'system-settings'] },
+  { key: 'audit.include_request_metadata', type: 'boolean', defaultValue: true },
+  { key: 'audit.retention_days', type: 'integer', min: 0, defaultValue: 180 },
+  { key: 'uploads.image_max_bytes', type: 'integer', min: 1, defaultValue: 100 * 1024 * 1024 },
+  { key: 'uploads.video_max_bytes', type: 'integer', min: 1, defaultValue: 1024 * 1024 * 1024 },
+  { key: 'uploads.wysiwyg_image_max_bytes', type: 'integer', min: 1, defaultValue: 2 * 1024 * 1024 },
+  { key: 'uploads.allowed_mime_types', type: 'string_array', defaultValue: ['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'image/svg+xml', 'video/mp4', 'video/webm', 'video/ogg'] },
+  { key: 'uploads.cleanup_days', type: 'integer', min: 0, defaultValue: 30 },
+  { key: 'uploads.optimize_images', type: 'boolean', defaultValue: true },
+  { key: 'announcements.default_icon', type: 'string', defaultValue: 'megaphone-fill' },
+  { key: 'announcements.default_duration_value', type: 'integer', min: 1, defaultValue: 10 },
+  { key: 'announcements.default_duration_unit', type: 'enum', values: ['seconds', 'minutes'], defaultValue: 'seconds' },
+  { key: 'announcements.suggested_icons', type: 'string_array', defaultValue: DEFAULT_ANNOUNCEMENT_ICON_KEYS.slice() },
+  { key: 'player.default_slide_duration_seconds', type: 'integer', min: 1, defaultValue: 10 },
+  { key: 'player.default_fade_between_slides', type: 'boolean', defaultValue: true },
+  { key: 'player.skip_unavailable_rtmp', type: 'boolean', defaultValue: true }
+  ,{ key: 'data-sources.rss_default_interval_value', type: 'integer', min: 1, defaultValue: 60 }
+  ,{ key: 'data-sources.rss_default_interval_unit', type: 'enum', values: ['seconds', 'minutes', 'hours'], defaultValue: 'minutes' }
+  ,{ key: 'data-sources.api_default_interval_value', type: 'integer', min: 1, defaultValue: 60 }
+  ,{ key: 'data-sources.api_default_interval_unit', type: 'enum', values: ['seconds', 'minutes', 'hours'], defaultValue: 'minutes' }
+];
+
+const DEFINITIONS_BY_KEY = new Map(SETTING_DEFINITIONS.map(function (definition) {
+  return [definition.key, definition];
+}));
+
+function cloneValue(value) {
+  if (Array.isArray(value)) {
+    return value.slice();
+  }
+  return value;
+}
+
+function getAppSettingDefinitions() {
+  return SETTING_DEFINITIONS.map(function (definition) {
+    return Object.assign({}, definition, {
+      values: definition.values ? definition.values.slice() : undefined,
+      defaultValue: cloneValue(definition.defaultValue)
+    });
+  });
+}
+
+function getDefaultAppSettings() {
+  return SETTING_DEFINITIONS.reduce(function (settings, definition) {
+    settings[definition.key] = cloneValue(definition.defaultValue);
+    return settings;
+  }, {});
+}
+
+function normalizeSettingValue(key, value) {
+  const definition = DEFINITIONS_BY_KEY.get(String(key || '').trim());
+  if (!definition) {
+    throw new Error('Unknown application setting: ' + key);
+  }
+
+  if (definition.type === 'string') {
+    return String(value == null ? '' : value).trim();
+  }
+
+  if (definition.type === 'integer') {
+    const normalized = Number(value);
+    if (!Number.isInteger(normalized) || normalized < definition.min) {
+      throw new Error('Invalid value for application setting: ' + definition.key);
+    }
+    return normalized;
+  }
+
+  if (definition.type === 'boolean') {
+    if (value === true || value === 1 || value === '1' || value === 'true') {
+      return true;
+    }
+    if (value === false || value === 0 || value === '0' || value === 'false') {
+      return false;
+    }
+    throw new Error('Invalid value for application setting: ' + definition.key);
+  }
+
+  if (definition.type === 'enum') {
+    const normalized = String(value == null ? '' : value).trim();
+    if (!definition.values.includes(normalized)) {
+      throw new Error('Invalid value for application setting: ' + definition.key);
+    }
+    return normalized;
+  }
+
+  if (definition.type === 'string_array') {
+    if (!Array.isArray(value)) {
+      throw new Error('Invalid value for application setting: ' + definition.key);
+    }
+    return Array.from(new Set(value.map(function (item) {
+      return String(item || '').trim();
+    }).filter(Boolean)));
+  }
+
+  throw new Error('Unsupported application setting type: ' + definition.type);
+}
+
+function normalizeAppSettings(settings) {
+  const input = settings && typeof settings === 'object' ? settings : {};
+  return SETTING_DEFINITIONS.reduce(function (normalized, definition) {
+    const value = Object.prototype.hasOwnProperty.call(input, definition.key)
+      ? input[definition.key]
+      : definition.defaultValue;
+    normalized[definition.key] = normalizeSettingValue(definition.key, value);
+    return normalized;
+  }, {});
+}
+
+function parseStoredValue(value) {
+  if (typeof value !== 'string') {
+    return value;
+  }
+  try {
+    return JSON.parse(value);
+  } catch (_error) {
+    return value;
+  }
+}
+
+async function fetchAppSettings(pool) {
+  const [rows] = await pool.query('SELECT id, setting_key, setting_value FROM o_app_settings ORDER BY setting_key');
+  const storedSettings = {};
+  (rows || []).forEach(function (row) {
+    const key = String(row && row.setting_key || '').trim();
+    if (DEFINITIONS_BY_KEY.has(key)) {
+      storedSettings[key] = parseStoredValue(row.setting_value);
+    }
+  });
+  return normalizeAppSettings(Object.assign({}, getDefaultAppSettings(), storedSettings));
+}
+
+async function saveAppSettings(pool, settings, modifiedBy) {
+  const inputSettings = settings && typeof settings === 'object' ? settings : {};
+  const normalizedSettings = normalizeAppSettings(inputSettings);
+  const connection = typeof pool.getConnection === 'function' ? await pool.getConnection() : pool;
+  const shouldRelease = connection !== pool;
+
+  try {
+    if (typeof connection.beginTransaction === 'function') {
+      await connection.beginTransaction();
+    }
+    for (const definition of SETTING_DEFINITIONS) {
+      if (!Object.prototype.hasOwnProperty.call(inputSettings, definition.key)) {
+        continue;
+      }
+      await connection.query(
+        `UPDATE o_app_settings
+            SET setting_value = ?, modified_by = ?
+          WHERE setting_key = ?`,
+        [JSON.stringify(normalizedSettings[definition.key]), modifiedBy || null, definition.key]
+      );
+      await connection.query(
+        `INSERT INTO o_app_settings (setting_key, setting_value, created_by, modified_by)
+         SELECT ?, ?, ?, ?
+          WHERE NOT EXISTS (
+            SELECT 1 FROM o_app_settings WHERE setting_key = ?
+          )`,
+        [definition.key, JSON.stringify(normalizedSettings[definition.key]), modifiedBy || null, modifiedBy || null, definition.key]
+      );
+    }
+    if (typeof connection.commit === 'function') {
+      await connection.commit();
+    }
+  } catch (error) {
+    if (typeof connection.rollback === 'function') {
+      await connection.rollback();
+    }
+    throw error;
+  } finally {
+    if (shouldRelease && typeof connection.release === 'function') {
+      connection.release();
+    }
+  }
+
+  return normalizedSettings;
+}
+
+module.exports = {
+  getAppSettingDefinitions,
+  getDefaultAppSettings,
+  normalizeSettingValue,
+  normalizeAppSettings,
+  fetchAppSettings,
+  saveAppSettings
+};
@@ -0,0 +1,118 @@
+const AUDIT_EVENT_CATEGORIES = Object.freeze({
+  AUTHENTICATION: 'authentication',
+  SECURITY: 'security',
+  SESSIONS: 'sessions',
+  USERS: 'users',
+  ROLES: 'roles',
+  SETTINGS: 'system-settings',
+  SLIDES: 'slides',
+  TEMPLATES: 'templates',
+  PLAYLISTS: 'playlists',
+  SCREENS: 'screens',
+  ANNOUNCEMENTS: 'announcements',
+  CANVAS_SIZES: 'canvas-sizes',
+  API_SOURCES: 'api-sources',
+  RSS_FEEDS: 'rss-feeds',
+  TIMETABLES: 'timetables'
+});
+const AUDIT_CATEGORY_KEYS = Object.freeze(Object.values(AUDIT_EVENT_CATEGORIES));
+const AUDIT_CATEGORY_LABELS = Object.freeze({
+  authentication: 'Authentication',
+  security: 'Security',
+  sessions: 'Sessions',
+  users: 'Users',
+  roles: 'Roles',
+  'system-settings': 'System Settings',
+  slides: 'Slides',
+  templates: 'Templates',
+  playlists: 'Playlists',
+  screens: 'Screens',
+  announcements: 'Announcements',
+  'canvas-sizes': 'Canvas Sizes',
+  'api-sources': 'API Sources',
+  'rss-feeds': 'RSS Feeds',
+  timetables: 'Timetables'
+});
+const { fetchAppSettings } = require('./app-settings');
+
+function normalizeDetails(details) {
+  if (details === undefined || details === null) {
+    return null;
+  }
+  return JSON.stringify(details);
+}
+
+function buildAuditChanges(previousValues, nextValues) {
+  const previous = previousValues && typeof previousValues === 'object' ? previousValues : {};
+  const next = nextValues && typeof nextValues === 'object' ? nextValues : {};
+  const changes = {};
+  const keys = new Set(Object.keys(previous).concat(Object.keys(next)));
+
+  keys.forEach(function (key) {
+    if (JSON.stringify(previous[key]) !== JSON.stringify(next[key])) {
+      changes[key] = { from: previous[key], to: next[key] };
+    }
+  });
+
+  return changes;
+}
+
+function getRequestMetadata(req) {
+  const forwardedAddress = String(req && req.headers && req.headers['x-forwarded-for'] || '').split(',')[0].trim();
+  return {
+    ipAddress: forwardedAddress || String(req && req.ip || req && req.socket && req.socket.remoteAddress || '').trim() || null,
+    userAgent: String(req && req.headers && req.headers['user-agent'] || '').trim() || null
+  };
+}
+
+async function recordAuditEvent(pool, event) {
+  const input = event && typeof event === 'object' ? event : {};
+  const category = String(input.category || '').trim().toLowerCase();
+  const eventType = String(input.eventType || '').trim().toLowerCase();
+  if (!category || !eventType) {
+    throw new Error('Audit events require a category and event type.');
+  }
+
+  await pool.query(
+    `INSERT INTO o_audit_events
+      (category, event_type, actor_user_id, target_type, target_id, target_label, ip_address, user_agent, details_json)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    [
+      category,
+      eventType,
+      Number.isInteger(Number(input.actorUserId)) && Number(input.actorUserId) > 0 ? Number(input.actorUserId) : null,
+      String(input.targetType || '').trim() || null,
+      String(input.targetId || '').trim() || null,
+      String(input.targetLabel || '').trim() || null,
+      String(input.ipAddress || '').trim() || null,
+      String(input.userAgent || '').trim() || null,
+      normalizeDetails(input.details)
+    ]
+  );
+}
+
+async function recordRequestAuditEvent(pool, req, event) {
+  try {
+    const settings = await fetchAppSettings(pool);
+    const category = String(event && event.category || '').trim().toLowerCase();
+    const enabledCategories = Array.isArray(settings['audit.categories']) ? settings['audit.categories'] : AUDIT_CATEGORY_KEYS;
+    if (!settings['audit.enabled'] || !enabledCategories.includes(category)) {
+      return;
+    }
+    const metadata = settings['audit.include_request_metadata'] ? getRequestMetadata(req) : {};
+    await recordAuditEvent(pool, Object.assign({}, event, metadata));
+  } catch (error) {
+    // Auditing must not turn a successful login or administration action into a failed request.
+    console.error('Unable to record audit event:', error.message);
+  }
+}
+
+module.exports = {
+  AUDIT_EVENT_CATEGORIES,
+  AUDIT_CATEGORY_KEYS,
+  AUDIT_CATEGORY_LABELS,
+  getRequestMetadata,
+  buildAuditChanges,
+  recordAuditEvent,
+  recordRequestAuditEvent
+};
@@ -4,7 +4,7 @@ const { fetchAdminData, fetchPlaylistsPage, fetchSlidesPage, fetchTemplatesPage,
 const { ANNOUNCEMENT_TYPES, ANNOUNCEMENT_COLORS, ANNOUNCEMENT_ICONS, DEFAULT_ANNOUNCEMENT_ICON, normalizeAnnouncementType, normalizeAnnouncementColor, normalizeAnnouncementIcon, fetchAnnouncementsPage, fetchAnnouncementById, fetchActiveAnnouncement, buildAnnouncementPayload } = require('./announcements');
 const { ANNOUNCEMENT_ICON_OPTIONS, ANNOUNCEMENT_ICON_LABELS } = require('./announcement-icons');
 const { fetchPlaylistById } = require('./playlists');
-const { normalizeDisplayMode, fetchTimetablesData, fetchTimetableGroupsPage, fetchTimetableGroupById, fetchTimetableEntriesByGroupId, buildTimetableGroupPayload } = require('./schedules');
+const { normalizeDisplayMode, fetchTimetablesData, fetchTimetableGroupsPage, fetchTimetableGroupById, fetchTimetableEntriesByGroupId, buildTimetableGroupPayload } = require('./timetables');
 const { fetchApiSourcesData, fetchApiSourcesPage, fetchApiSourceById, fetchApiSourceResponse, buildApiSourcePayload } = require('./api-sources');
 const { fetchRssFeedsData, fetchRssFeedsPage, fetchRssFeedById, fetchRssFeedItemsByFeedId, normalizeRssFeedItem, buildRssFeedPayload, fetchRssFeedItems, replaceRssFeedItems } = require('./rss-feeds');
 const { slugify, uniqueScreenSlug, fetchScreenById, fetchScreenEditData, fetchScreenPlayerUrls, fetchPlayerPublicBaseUrl, fetchScreenPlayerRecord, fetchPlayerRecordByIdentifier } = require('./screens');
@@ -92,15 +92,19 @@ async function upsertPlayerRegistration(pool, options) {
    return null;
  }

+  await pool.query(
+    `UPDATE d_players
+        SET public_base_url = ?, internal_base_url = ?, last_seen_at = CURRENT_TIMESTAMP, modified_at = CURRENT_TIMESTAMP
+      WHERE identifier = ?`,
+    [publicBaseUrl || null, internalBaseUrl || null, identifier]
+  );
  await pool.query(
    `INSERT INTO d_players (identifier, public_base_url, internal_base_url, last_seen_at)
-     VALUES (?, ?, ?, CURRENT_TIMESTAMP)
-     ON DUPLICATE KEY UPDATE
-       public_base_url = VALUES(public_base_url),
-       internal_base_url = VALUES(internal_base_url),
-       last_seen_at = CURRENT_TIMESTAMP,
-       modified_at = CURRENT_TIMESTAMP`,
-    [identifier, publicBaseUrl || null, internalBaseUrl || null]
+     SELECT ?, ?, ?, CURRENT_TIMESTAMP
+      WHERE NOT EXISTS (
+        SELECT 1 FROM d_players WHERE identifier = ?
+      )`,
+    [identifier, publicBaseUrl || null, internalBaseUrl || null, identifier]
  );

  return resolvePlayerRegistration(pool, identifier);
@@ -115,15 +119,22 @@ async function recordPlayerHeartbeat(pool, options) {
    return null;
  }

+  await pool.query(
+    `UPDATE d_players
+        SET public_base_url = COALESCE(?, public_base_url),
+            internal_base_url = COALESCE(?, internal_base_url),
+            last_seen_at = CURRENT_TIMESTAMP,
+            modified_at = CURRENT_TIMESTAMP
+      WHERE identifier = ?`,
+    [publicBaseUrl || null, internalBaseUrl || null, identifier]
+  );
  await pool.query(
    `INSERT INTO d_players (identifier, public_base_url, internal_base_url, last_seen_at)
-     VALUES (?, ?, ?, CURRENT_TIMESTAMP)
-     ON DUPLICATE KEY UPDATE
-       public_base_url = COALESCE(VALUES(public_base_url), public_base_url),
-       internal_base_url = COALESCE(VALUES(internal_base_url), internal_base_url),
-       last_seen_at = CURRENT_TIMESTAMP,
-       modified_at = CURRENT_TIMESTAMP`,
-    [identifier, publicBaseUrl || null, internalBaseUrl || null]
+     SELECT ?, ?, ?, CURRENT_TIMESTAMP
+      WHERE NOT EXISTS (
+        SELECT 1 FROM d_players WHERE identifier = ?
+      )`,
+    [identifier, publicBaseUrl || null, internalBaseUrl || null, identifier]
  );

  return resolvePlayerRegistration(pool, identifier);
@@ -1,24 +1,6 @@
-const fs = require('fs');
 const path = require('path');
 const QRCodeStyling = require(path.join(__dirname, '..', 'web', 'public', 'vendor', 'qr-code-styling', 'qr-code-styling.js'));
-const puppeteer = require('puppeteer-core');
-const chromiumModule = require('@sparticuz/chromium');
 const QR_PNG_WIDTH = 2048;
-const QR_STYLING_SCRIPT_PATH = path.join(__dirname, '..', 'web', 'public', 'vendor', 'qr-code-styling', 'qr-code-styling.js');
-const SYSTEM_CHROMIUM_PATHS = [
-  process.env.PUPPETEER_EXECUTABLE_PATH,
-  process.env.CHROMIUM_PATH,
-  '/usr/bin/chromium',
-  '/usr/bin/chromium-browser',
-  '/usr/local/bin/chromium',
-  '/snap/bin/chromium'
-].filter(Boolean);
-const chromium = chromiumModule && typeof chromiumModule.executablePath === 'function'
-  ? chromiumModule
-  : chromiumModule && chromiumModule.default && typeof chromiumModule.default.executablePath === 'function'
-    ? chromiumModule.default
-    : chromiumModule;
-let qrBrowserPromise = null;

 function escapeXml(value) {
  return String(value === undefined || value === null ? '' : value).replace(/[&<>"']/g, function (character) {
@@ -347,74 +329,6 @@ function buildQrStylingOptions(source) {
  };
 }

-function getQrBrowser() {
-  if (qrBrowserPromise) {
-    return qrBrowserPromise;
-  }
-
-  qrBrowserPromise = (async function () {
-    let executablePath = SYSTEM_CHROMIUM_PATHS.find(function (candidate) {
-      return fs.existsSync(candidate);
-    }) || '';
-    const usingSystemChromium = Boolean(executablePath);
-
-    if (!executablePath && chromium && typeof chromium.executablePath === 'function') {
-      executablePath = await chromium.executablePath();
-    }
-
-    if (!executablePath || !fs.existsSync(executablePath)) {
-      throw new Error('Chromium executable was not found.');
-    }
-
-    return puppeteer.launch({
-      args: usingSystemChromium
-        ? [
-            '--no-sandbox',
-            '--disable-setuid-sandbox',
-            '--disable-dev-shm-usage',
-            '--disable-gpu'
-          ]
-        : puppeteer.defaultArgs({
-            args: chromium && chromium.args ? chromium.args : [],
-            headless: 'shell'
-          }),
-      defaultViewport: usingSystemChromium
-        ? { width: QR_PNG_WIDTH, height: QR_PNG_WIDTH, deviceScaleFactor: 1 }
-        : chromium && chromium.defaultViewport ? chromium.defaultViewport : null,
-      executablePath: executablePath,
-      headless: usingSystemChromium ? true : 'shell'
-    });
-  })();
-
-  return qrBrowserPromise;
-}
-
-async function blobToDataUrl(blob) {
-  if (!blob) {
-    return '';
-  }
-
-  if (typeof blob === 'string') {
-    return blob;
-  }
-
-  if (typeof blob.arrayBuffer === 'function') {
-    const buffer = await blob.arrayBuffer();
-    const bytes = new Uint8Array(buffer);
-    let binary = '';
-    for (let index = 0; index < bytes.length; index += 1) {
-      binary += String.fromCharCode(bytes[index]);
-    }
-    return 'data:' + String(blob.type || 'image/png') + ';base64,' + Buffer.from(binary, 'binary').toString('base64');
-  }
-
-  if (typeof blob.text === 'function') {
-    return blob.text();
-  }
-
-  return '';
-}
-
 async function createStyledQrCodeDataUrl(value) {
  const source = value && typeof value === 'object' ? value : { value: value };
  const options = buildQrStylingOptions(source);
@@ -435,10 +349,6 @@ async function createStyledQrCodeSvg(value) {
  return renderStyledQrRawData(options, 'svg');
 }

-async function createQrCodeDataUrlPlain(value) {
-  return createStyledQrCodeDataUrl(value);
-}
-
 async function createQrCodeSvg(value) {
  return createStyledQrCodeSvg(value);
 }
@@ -9,7 +9,10 @@ const URL_MAX_LENGTH = 1024;

 function normalizeUpdateIntervalUnit(value) {
  const unit = String(value || '').trim().toLowerCase();
-  return unit === 'seconds' ? 'seconds' : 'minutes';
+  if (unit === 'seconds' || unit === 'minutes' || unit === 'hours') {
+    return unit;
+  }
+  return 'minutes';
 }

 async function fetchRssFeedsData(pool) {
@@ -6,38 +6,93 @@ const { parseJsonSafe, validateMaxLength } = require('./utils');
 const TITLE_MAX_LENGTH = 255;
 const { buildQrCodeContent } = require('./qr-code');

-const ALLOWED_RICH_TEXT_TAGS = ['b', 'strong', 'i', 'em', 'u', 'br', 'p', 'div', 'ul', 'ol', 'li'];
 const DEFAULT_FONT_SIZE = 32;

+const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
+
+function sanitizeRichTextAttributes(tagName, attrText) {
+  const allowedAttributes = {
+    a: ['href', 'title', 'target', 'rel', 'class', 'style'],
+    blockquote: ['class', 'style'],
+    div: ['class', 'style'],
+    figure: ['class', 'style'],
+    figcaption: ['class', 'style'],
+    h1: ['class', 'style'],
+    h2: ['class', 'style'],
+    h3: ['class', 'style'],
+    h4: ['class', 'style'],
+    h5: ['class', 'style'],
+    h6: ['class', 'style'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'class', 'style', 'loading', 'decoding'],
+    li: ['class', 'style'],
+    ol: ['class', 'style', 'start'],
+    p: ['class', 'style'],
+    pre: ['class', 'style'],
+    span: ['class', 'style'],
+    table: ['class', 'style'],
+    td: ['class', 'style', 'colspan', 'rowspan'],
+    th: ['class', 'style', 'colspan', 'rowspan', 'scope'],
+    tr: ['class', 'style'],
+    ul: ['class', 'style']
+  };
+  const allowed = allowedAttributes[tagName] || [];
+  if (!allowed.length) {
+    return '';
+  }
+
+  const attrs = [];
+  String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) => {
+    const lowerKey = String(key || '').toLowerCase();
+    if (!allowed.includes(lowerKey)) {
+      return '';
+    }
+
+    const value = doubleQuoted !== undefined ? doubleQuoted : singleQuoted !== undefined ? singleQuoted : bareValue !== undefined ? bareValue : '';
+    if (lowerKey === 'href' && /^(?:\s*javascript:|\s*data:)/i.test(String(value || ''))) {
+      return '';
+    }
+    if (lowerKey === 'style' && /(?:expression\s*\(|javascript:|url\s*\()/i.test(String(value || ''))) {
+      return '';
+    }
+    if (lowerKey === 'target') {
+      const targetValue = String(value || '').trim();
+      if (targetValue === '_blank') {
+        attrs.push(' target="_blank"');
+        if (!attrs.includes(' rel="noreferrer noopener"')) {
+          attrs.push(' rel="noreferrer noopener"');
+        }
+        return '';
+      }
+    }
+    attrs.push(' ' + lowerKey + '="' + String(value || '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;') + '"');
+    return '';
+  });
+
+  return attrs.join('');
+}
+
 function sanitizeRichText(html) {
  let output = String(html || '');
  output = output.replace(/<script[\s\S]*?<\/script>/gi, '');
  output = output.replace(/<style[\s\S]*?<\/style>/gi, '');
  return output.replace(/<[^>]+>/g, (tag) => {
-    const match = tag.match(/^<\s*(\/?)\s*([a-z0-9]+)(?:\s[^>]*)?>$/i);
+    const match = tag.match(/^<\s*(\/?)\s*([a-z0-9]+)([\s\S]*?)(\/?)>$/i);
    if (!match) {
      return '';
    }
    const closing = Boolean(match[1]);
    const name = String(match[2] || '').toLowerCase();
+    const attrText = String(match[3] || '');
    if (!ALLOWED_RICH_TEXT_TAGS.includes(name)) {
      return '';
    }
-    if (name === 'br') {
-      return '<br>';
+    if (closing) {
+      return `</${name}>`;
    }
-    return closing ? `</${name}>` : `<${name}>`;
+    return `<${name}${sanitizeRichTextAttributes(name, attrText)}>`;
  });
 }

-function normalizePlainText(value) {
-  return String(value === undefined || value === null ? '' : value)
-    .replace(/<\s*br\s*\/?\s*>/gi, '\n')
-    .replace(/<[^>]*>/g, '')
-    .replace(/&nbsp;/gi, ' ')
-    .trim();
-}
-
 function stripEditorOnlyMarkup(value) {
  return String(value || '')
    .replace(/<pre[^>]*class="[^"]*api-region-sample-preview[^"]*"[^>]*>[\s\S]*?<\/pre>/gi, '')
@@ -308,6 +363,49 @@ async function buildTemplateContent(pool, template, body, filesByField, existing
        value: submitted === undefined ? String(current.value !== undefined ? current.value : current.text !== undefined ? current.text : '') : String(submitted || ''),
        timezone: timezoneValue === undefined || timezoneValue === null ? String(current.timezone || current.time_zone || '') : String(timezoneValue || '').trim()
      };
+    } else if (region.region_type === 'timetable') {
+      const current = existingContent && existingContent[region.region_key] && typeof existingContent[region.region_key] === 'object' ? existingContent[region.region_key] : {};
+      const suffix = '_' + region.id;
+      const generic = {};
+      const submittedText = body[`region_text_${region.id}`];
+      const normalizedText = submittedText === undefined ? String(current.text !== undefined ? current.text : current.value !== undefined ? current.value : '') : String(submittedText || '');
+
+      Object.keys(body || {}).forEach((key) => {
+        if (!key.startsWith('region_') || !key.endsWith(suffix)) {
+          return;
+        }
+
+        const field = key.slice('region_'.length, -suffix.length);
+        if (!field || field === 'type' || field === 'key' || field === 'name' || field === 'label') {
+          return;
+        }
+
+        generic[field] = body[key];
+      });
+
+      if (Object.prototype.hasOwnProperty.call(generic, 'timetable_display_mode')) {
+        generic.display_mode = generic.timetable_display_mode;
+        delete generic.timetable_display_mode;
+      }
+
+      if (Object.prototype.hasOwnProperty.call(generic, 'timetable_max_items')) {
+        generic.max_items = generic.timetable_max_items;
+        delete generic.timetable_max_items;
+      }
+
+      Object.keys(current).forEach((key) => {
+        if (generic[key] === undefined) {
+          generic[key] = current[key];
+        }
+      });
+
+      delete generic.timetable_display_mode;
+      delete generic.timetable_max_items;
+
+      generic.text = normalizedText;
+      generic.value = normalizedText;
+      generic.type = region.region_type;
+      content[region.region_key] = generic;
    } else if (region.region_type === 'rss') {
      const submitted = body[`region_text_${region.id}`];
      const current = existingContent && existingContent[region.region_key] ? existingContent[region.region_key] : {};
@@ -320,7 +418,7 @@ async function buildTemplateContent(pool, template, body, filesByField, existing
      content[region.region_key] = {
        type: 'rss',
        value: stripEditorOnlyMarkup(normalizeEditorMarkup(submitted === undefined ? String(current.value || '') : String(submitted || ''))),
-        feed_id: feedId === undefined || feedId === null || feedId === '' ? (current.feed_id || null) : Number(feedId),
+        feed_id: feedId === undefined || feedId === null ? (current.feed_id || null) : (feedId === '' ? null : Number(feedId)),
        item_number: Math.min(itemCount, Number.isFinite(parsedItemNumber) && parsedItemNumber > 0 ? parsedItemNumber : 1),
        variable_name: 'item',
        font_family: style.font_family,
@@ -338,7 +436,7 @@ async function buildTemplateContent(pool, template, body, filesByField, existing
      content[region.region_key] = {
        type: 'api',
        value: stripEditorOnlyMarkup(normalizeEditorMarkup(submitted === undefined ? String(current.value || '') : String(submitted || ''))),
-        source_id: sourceId === undefined || sourceId === null || sourceId === '' ? (current.source_id || null) : Number(sourceId),
+        source_id: sourceId === undefined || sourceId === null ? (current.source_id || null) : (sourceId === '' ? null : Number(sourceId)),
        item_number: Number.isFinite(parsedItemNumber) && parsedItemNumber > 0 ? parsedItemNumber : 1,
        items_path: itemsPath === undefined || itemsPath === null ? (current.items_path === undefined || current.items_path === null ? '' : String(current.items_path)) : String(itemsPath || '').trim(),
        variable_name: 'item',
@@ -387,7 +485,7 @@ async function buildTemplateContent(pool, template, body, filesByField, existing
      const style = getTextRegionStyle(body, region, existingContent);
      content[region.region_key] = {
        type: 'text',
-        value: stripEditorOnlyMarkup(normalizeEditorMarkup(submitted === undefined ? current : String(submitted || ''))),
+        value: sanitizeRichText(stripEditorOnlyMarkup(normalizeEditorMarkup(submitted === undefined ? current : String(submitted || '')))),
        font_family: style.font_family,
        font_size: style.font_size,
        font_color: style.font_color
@@ -194,43 +194,6 @@ function extractTemplateRegions(body) {
  return regions;
 }

-function extractGenericRegionContent(region, body, filesByField, existingContent) {
-  const content = {};
-  const current = existingContent && existingContent[region.region_key] && typeof existingContent[region.region_key] === 'object' ? existingContent[region.region_key] : {};
-  const suffix = '_' + region.id;
-
-  Object.keys(body || {}).forEach((key) => {
-    if (!key.startsWith('region_') || !key.endsWith(suffix)) {
-      return;
-    }
-    const field = key.slice('region_'.length, -suffix.length);
-    if (!field || field === 'type' || field === 'key' || field === 'name' || field === 'label') {
-      return;
-    }
-    content[field] = body[key];
-  });
-
-  Object.keys(filesByField || {}).forEach((fieldName) => {
-    if (!fieldName.startsWith('region_') || !fieldName.endsWith(suffix)) {
-      return;
-    }
-    const field = fieldName.slice('region_'.length, -suffix.length);
-    if (!field) {
-      return;
-    }
-    content[field] = `/media/uploads/${filesByField[fieldName].filename}`;
-  });
-
-  Object.keys(current).forEach((key) => {
-    if (content[key] === undefined) {
-      content[key] = current[key];
-    }
-  });
-
-  content.type = region.region_type;
-  return content;
-}
-
 function getFilesByField(files) {
  const map = {};
  (files || []).forEach((file) => {
@@ -4,6 +4,23 @@ const { fetchPagedRows, validateMaxLength } = require('./utils');

 const NAME_MAX_LENGTH = 255;
 const DESCRIPTION_MAX_LENGTH = 255;
+const DEFAULT_TIME_ZONE = 'Europe/London';
+
+function normalizeTimeZone(value, fallback) {
+  const raw = String(value || '').trim();
+  if (!raw) {
+    return String(fallback || DEFAULT_TIME_ZONE).trim() || DEFAULT_TIME_ZONE;
+  }
+
+  try {
+    new Intl.DateTimeFormat('en-GB', { timeZone: raw }).format(new Date());
+    return raw;
+  } catch (_error) {
+    const error = new Error('Timetable time zone is invalid.');
+    error.statusCode = 400;
+    throw error;
+  }
+}

 function normalizeDisplayMode(value) {
  const mode = String(value || 'upcoming').trim().toLowerCase();
@@ -15,15 +32,15 @@ function normalizeDisplayMode(value) {

 async function fetchTimetablesData(pool) {
  const [timetableGroups] = await pool.query(`
-    SELECT g.id, g.name, g.short_description, g.created_at, g.modified_at, g.created_by, g.modified_by,
-           (SELECT COUNT(*) FROM i_schedule_entries e WHERE e.schedule_group_id = g.id) AS entry_count,
-           (SELECT MIN(e.start_datetime) FROM i_schedule_entries e WHERE e.schedule_group_id = g.id AND e.start_datetime IS NOT NULL) AS next_start_datetime
-    FROM i_schedule_groups g
+    SELECT g.id, g.name, g.short_description, g.timezone, g.created_at, g.modified_at, g.created_by, g.modified_by,
+           (SELECT COUNT(*) FROM i_timetable_entries e WHERE e.schedule_group_id = g.id) AS entry_count,
+           (SELECT MIN(e.start_datetime) FROM i_timetable_entries e WHERE e.schedule_group_id = g.id AND e.start_datetime IS NOT NULL) AS next_start_datetime
+    FROM i_timetable_groups g
    ORDER BY g.modified_at DESC, g.id DESC
  `);
  const [timetableEntries] = await pool.query(`
    SELECT id, schedule_group_id, title, short_description, start_datetime, end_datetime, created_at, modified_at, created_by, modified_by
-    FROM i_schedule_entries
+    FROM i_timetable_entries
    ORDER BY schedule_group_id ASC, start_datetime ASC, id ASC
  `);

@@ -50,17 +67,18 @@ async function fetchTimetablesData(pool) {

 async function fetchTimetableGroupsPage(pool, page, pageSize, searchTerm, sortKey, sortDirection) {
  const paged = await fetchPagedRows(pool, {
-    selectSql: `SELECT g.id, g.name, g.short_description, g.created_at, g.modified_at, g.created_by, g.modified_by,
-           (SELECT COUNT(*) FROM i_schedule_entries e WHERE e.schedule_group_id = g.id) AS entry_count,
-           (SELECT MIN(e.start_datetime) FROM i_schedule_entries e WHERE e.schedule_group_id = g.id AND e.start_datetime IS NOT NULL) AS next_start_datetime
-    FROM i_schedule_groups g
+    selectSql: `SELECT g.id, g.name, g.short_description, g.timezone, g.created_at, g.modified_at, g.created_by, g.modified_by,
+        (SELECT COUNT(*) FROM i_timetable_entries e WHERE e.schedule_group_id = g.id) AS entry_count,
+        (SELECT MIN(e.start_datetime) FROM i_timetable_entries e WHERE e.schedule_group_id = g.id AND e.start_datetime IS NOT NULL) AS next_start_datetime
+      FROM i_timetable_groups g
    ORDER BY g.modified_at DESC, g.id DESC`,
-    countSql: 'SELECT COUNT(*) AS count FROM i_schedule_groups',
+      countSql: 'SELECT COUNT(*) AS count FROM i_timetable_groups',
    searchColumns: ['g.name', 'g.short_description'],
    searchTerm: searchTerm,
    sortColumns: {
      name: 'g.name',
      description: 'g.short_description',
+      timezone: 'g.timezone',
      entries: 'entry_count',
      next_start: 'next_start_datetime',
      created: 'g.created_at',
@@ -77,7 +95,7 @@ async function fetchTimetableGroupsPage(pool, page, pageSize, searchTerm, sortKe

 async function fetchTimetableGroupById(pool, id) {
  const [rows] = await pool.query(
-    'SELECT id, name, short_description, created_at, modified_at, created_by, modified_by FROM i_schedule_groups WHERE id = ?',
+    'SELECT id, name, short_description, timezone, created_at, modified_at, created_by, modified_by FROM i_timetable_groups WHERE id = ?',
    [id]
  );

@@ -87,7 +105,7 @@ async function fetchTimetableGroupById(pool, id) {
 async function fetchTimetableEntriesByGroupId(pool, timetableGroupId) {
  const [rows] = await pool.query(
    `SELECT id, schedule_group_id, title, short_description, start_datetime, end_datetime, created_at, modified_at, created_by, modified_by
-     FROM i_schedule_entries
+     FROM i_timetable_entries
     WHERE schedule_group_id = ?
     ORDER BY start_datetime ASC, id ASC`,
    [timetableGroupId]
@@ -100,6 +118,7 @@ function buildTimetableGroupPayload(req, existingTimetableGroup) {
  const fallback = existingTimetableGroup || {};
  const name = validateMaxLength(req.body.name || fallback.name || '', NAME_MAX_LENGTH, 'Timetable group name');
  const shortDescription = validateMaxLength(req.body.short_description || req.body.shortDescription || fallback.short_description || '', DESCRIPTION_MAX_LENGTH, 'Timetable group description');
+  const timezone = normalizeTimeZone(req.body.timezone || req.body.time_zone || fallback.timezone || DEFAULT_TIME_ZONE, fallback.timezone || DEFAULT_TIME_ZONE);

  if (!name) {
    const error = new Error('Timetable group name is required.');
@@ -109,7 +128,8 @@ function buildTimetableGroupPayload(req, existingTimetableGroup) {

  return {
    name: name,
-    shortDescription: shortDescription
+    shortDescription: shortDescription,
+    timezone: timezone
  };
 }

@@ -119,5 +139,6 @@ module.exports = {
  fetchTimetableGroupsPage,
  fetchTimetableGroupById,
  fetchTimetableEntriesByGroupId,
-  buildTimetableGroupPayload
+  buildTimetableGroupPayload,
+  normalizeTimeZone
 };
@@ -15,11 +15,19 @@ async function bootstrapDatabase(pool) {
  }

  for (const permission of PERMISSIONS) {
+    await pool.query(
+      `UPDATE a_permissions
+          SET name = ?, section_name = ?, description = ?, modified_by = ?
+        WHERE permission_key = ?`,
+      [permission.name, permission.sectionName, permission.description || null, null, permission.key]
+    );
    await pool.query(
      `INSERT INTO a_permissions (permission_key, name, section_name, description, created_by, modified_by)
-       VALUES (?, ?, ?, ?, ?, ?)
-       ON DUPLICATE KEY UPDATE name = VALUES(name), section_name = VALUES(section_name), description = VALUES(description), modified_by = VALUES(modified_by)` ,
-      [permission.key, permission.name, permission.sectionName, permission.description || null, null, null]
+       SELECT ?, ?, ?, ?, ?, ?
+        WHERE NOT EXISTS (
+          SELECT 1 FROM a_permissions WHERE permission_key = ?
+        )`,
+      [permission.key, permission.name, permission.sectionName, permission.description || null, null, null, permission.key]
    );
  }

@@ -35,22 +43,37 @@ async function bootstrapDatabase(pool) {
    );
  }

-  await pool.query('UPDATE a_users SET name = username WHERE name IS NULL OR name = ""');
+  const [legacyRoleRows] = await pool.query('SELECT id FROM a_roles WHERE role_key = ? LIMIT 1', ['administrators']);
+  const [currentRoleRows] = await pool.query('SELECT id FROM a_roles WHERE role_key = ? LIMIT 1', [DEFAULT_ROLE.key]);
+  if (legacyRoleRows.length && !currentRoleRows.length) {
+    await pool.query(
+      `UPDATE a_roles
+          SET role_key = ?, name = ?, description = ?, modified_by = ?
+        WHERE role_key = ?`,
+      [DEFAULT_ROLE.key, DEFAULT_ROLE.name, DEFAULT_ROLE.description || null, null, 'administrators']
+    );
+  }

  await pool.query(
    `INSERT INTO a_roles (role_key, name, description, created_by, modified_by)
-     VALUES (?, ?, ?, ?, ?)
-     ON DUPLICATE KEY UPDATE name = VALUES(name), description = VALUES(description), modified_by = VALUES(modified_by)`,
-    [DEFAULT_ROLE.key, DEFAULT_ROLE.name, DEFAULT_ROLE.description || null, null, null]
+     SELECT ?, ?, ?, ?, ?
+      WHERE NOT EXISTS (
+        SELECT 1 FROM a_roles WHERE role_key = ?
+      )`,
+    [DEFAULT_ROLE.key, DEFAULT_ROLE.name, DEFAULT_ROLE.description || null, null, null, DEFAULT_ROLE.key]
  );

  const [defaultRoleRows] = await pool.query('SELECT id FROM a_roles WHERE role_key = ? LIMIT 1', [DEFAULT_ROLE.key]);
  const defaultRoleId = defaultRoleRows.length ? Number(defaultRoleRows[0].id) : null;
  if (defaultRoleId) {
    await pool.query(
-      `INSERT IGNORE INTO a_role_permissions (role_id, permission_id, created_by, modified_by)
-       SELECT ?, id, NULL, NULL FROM a_permissions`,
-      [defaultRoleId]
+      `INSERT INTO a_role_permissions (role_id, permission_id, created_by, modified_by)
+       SELECT ?, permissions.id, NULL, NULL
+         FROM a_permissions permissions
+         LEFT JOIN a_role_permissions existing
+           ON existing.role_id = ? AND existing.permission_id = permissions.id
+        WHERE existing.id IS NULL`,
+      [defaultRoleId, defaultRoleId]
    );
  }

@@ -1,3 +1,6 @@
+const { version: appVersion } = require('#root/package.json');
+const { compareVersions, detectSchemaVersion, getPendingMigrations, recordSchemaVersion, runMigrations } = require('./migrations');
+
 // Snapshot only: keep this file aligned with the current schema state.
 async function ensureSchema(pool, options) {
  const schemaLockName = 'pulse_signage_schema_lock';
@@ -12,6 +15,12 @@ async function ensureSchema(pool, options) {
    }

    try {
+      const currentVersion = await detectSchemaVersion(pool);
+      const pendingMigrations = await getPendingMigrations(pool, { currentVersion: currentVersion });
+      const updateRequired = pendingMigrations.length > 0;
+
+      console.info('[schema] previous=' + currentVersion + ' current=' + appVersion + ' update=' + (updateRequired ? 'yes' : 'no'));
+
      await pool.query(`
    CREATE TABLE IF NOT EXISTS c_canvas_sizes (
      id INT AUTO_INCREMENT PRIMARY KEY,
@@ -175,13 +184,14 @@ async function ensureSchema(pool, options) {

  await pool.query(`
    CREATE TABLE IF NOT EXISTS d_announcement_screens (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
      announcement_id INT NOT NULL,
      screen_id INT NOT NULL,
      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
      created_by INT NULL,
      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      modified_by INT NULL,
-      PRIMARY KEY (announcement_id, screen_id),
+      UNIQUE KEY uq_announcement_screens_pair (announcement_id, screen_id),
      INDEX idx_announcement_screens_screen_id (screen_id),
      CONSTRAINT fk_announcement_screens_announcement FOREIGN KEY (announcement_id) REFERENCES d_announcements(id) ON DELETE CASCADE,
      CONSTRAINT fk_announcement_screens_screen FOREIGN KEY (screen_id) REFERENCES d_screens(id) ON DELETE CASCADE
@@ -238,10 +248,11 @@ async function ensureSchema(pool, options) {
  `);

  await pool.query(`
-    CREATE TABLE IF NOT EXISTS i_schedule_groups (
+    CREATE TABLE IF NOT EXISTS i_timetable_groups (
      id INT AUTO_INCREMENT PRIMARY KEY,
      name VARCHAR(255) NOT NULL,
      short_description VARCHAR(255) NULL,
+      timezone VARCHAR(64) NOT NULL DEFAULT 'Europe/London',
      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
      created_by INT NULL,
      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
@@ -250,7 +261,7 @@ async function ensureSchema(pool, options) {
  `);

  await pool.query(`
-    CREATE TABLE IF NOT EXISTS i_schedule_entries (
+    CREATE TABLE IF NOT EXISTS i_timetable_entries (
      id INT AUTO_INCREMENT PRIMARY KEY,
      schedule_group_id INT NOT NULL,
      title VARCHAR(255) NOT NULL,
@@ -261,14 +272,15 @@ async function ensureSchema(pool, options) {
      created_by INT NULL,
      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      modified_by INT NULL,
-      CONSTRAINT fk_schedule_entries_group FOREIGN KEY (schedule_group_id) REFERENCES i_schedule_groups(id) ON DELETE CASCADE,
-      INDEX idx_schedule_entries_group_start (schedule_group_id, start_datetime)
+      CONSTRAINT fk_timetable_entries_group FOREIGN KEY (schedule_group_id) REFERENCES i_timetable_groups(id) ON DELETE CASCADE,
+      INDEX idx_timetable_entries_group_start (schedule_group_id, start_datetime)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
  `);

  await pool.query(`
    CREATE TABLE IF NOT EXISTS d_onboarding_devices (
-      device_id VARCHAR(128) PRIMARY KEY,
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
+      device_id VARCHAR(128) NOT NULL UNIQUE,
      client_name VARCHAR(255) NULL,
      screen_id INT NULL,
      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
@@ -287,6 +299,8 @@ async function ensureSchema(pool, options) {
      password_hash CHAR(64) NOT NULL,
      password_salt VARCHAR(64) NOT NULL,
      password_iterations INT NOT NULL,
+      must_change_password TINYINT(1) NOT NULL DEFAULT 0,
+      account_locked TINYINT(1) NOT NULL DEFAULT 0,
      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
      created_by INT NULL,
      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
@@ -323,13 +337,14 @@ async function ensureSchema(pool, options) {

  await pool.query(`
    CREATE TABLE IF NOT EXISTS a_role_permissions (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
      role_id INT NOT NULL,
      permission_id INT NOT NULL,
      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
      created_by INT NULL,
      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      modified_by INT NULL,
-      PRIMARY KEY (role_id, permission_id),
+      UNIQUE KEY uq_role_permissions_pair (role_id, permission_id),
      CONSTRAINT fk_role_permissions_role FOREIGN KEY (role_id) REFERENCES a_roles(id) ON DELETE CASCADE,
      CONSTRAINT fk_role_permissions_permission FOREIGN KEY (permission_id) REFERENCES a_permissions(id) ON DELETE CASCADE
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
@@ -337,13 +352,14 @@ async function ensureSchema(pool, options) {

  await pool.query(`
    CREATE TABLE IF NOT EXISTS a_user_roles (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
      user_id INT NOT NULL,
      role_id INT NOT NULL,
      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
      created_by INT NULL,
      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      modified_by INT NULL,
-      PRIMARY KEY (user_id, role_id),
+      UNIQUE KEY uq_user_roles_pair (user_id, role_id),
      CONSTRAINT fk_user_roles_user FOREIGN KEY (user_id) REFERENCES a_users(id) ON DELETE CASCADE,
      CONSTRAINT fk_user_roles_role FOREIGN KEY (role_id) REFERENCES a_roles(id) ON DELETE CASCADE
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
@@ -351,8 +367,11 @@ async function ensureSchema(pool, options) {

  await pool.query(`
    CREATE TABLE IF NOT EXISTS a_sessions (
-      session_hash CHAR(64) PRIMARY KEY,
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
+      session_hash CHAR(64) NOT NULL UNIQUE,
      user_id INT NOT NULL,
+      ip_address VARCHAR(255) NULL,
+      user_agent VARCHAR(512) NULL,
      expires_at DATETIME NOT NULL,
      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
      created_by INT NULL,
@@ -362,6 +381,18 @@ async function ensureSchema(pool, options) {
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
  `);

+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS a_login_attempts (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
+      rate_key VARCHAR(600) NOT NULL UNIQUE,
+      failed_count INT NOT NULL DEFAULT 0,
+      last_failed_at DATETIME NULL,
+      locked_until DATETIME NULL,
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
+
  await pool.query(`
    CREATE TABLE IF NOT EXISTS o_background_tasks (
      id BIGINT AUTO_INCREMENT PRIMARY KEY,
@@ -383,8 +414,20 @@ async function ensureSchema(pool, options) {
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
  `);

-      const { runMigrations } = require('./migrations');
-      await runMigrations(pool, options);
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS o_app_settings (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
+      setting_key VARCHAR(191) NOT NULL UNIQUE,
+      setting_value JSON NOT NULL,
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      created_by INT NULL,
+      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+      modified_by INT NULL
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
+
+      await runMigrations(pool, Object.assign({}, options, { currentVersion: currentVersion }));
+      await recordSchemaVersion(pool, appVersion);
    } finally {
      await pool.query('SELECT RELEASE_LOCK(?)', [schemaLockName]).catch(function () {
      });
@@ -1,4 +1,7 @@
 const { version: appVersion } = require('#root/package.json');
+const TIMETABLE_TIME_ZONE = 'Europe/London';
+const APP_STATE_TABLE = 'o_app_state';
+const APP_STATE_SCHEMA_VERSION_KEY = 'schema_version';

 const VERSIONED_MIGRATIONS = [
  {
@@ -22,32 +25,32 @@ const VERSIONED_MIGRATIONS = [
      // Store the player pointer on screens so we can resolve the player without needing a player-side screen_id.
      // This is the singleton-player shortcut; a multi-player model should make this relational instead of hardcoded to '1'.
      if (!(await columnExists(pool, 'd_screens', 'player_id'))) {
-          await pool.query("ALTER TABLE d_screens ADD COLUMN player_id VARCHAR(128) NOT NULL DEFAULT '1' AFTER playlist_id");
-        } else {
-          await pool.query("UPDATE d_screens SET player_id = '1' WHERE player_id IS NULL OR player_id <> '1'");
+        await pool.query("ALTER TABLE d_screens ADD COLUMN player_id VARCHAR(128) NOT NULL DEFAULT '1' AFTER playlist_id");
+      } else {
+        await pool.query("UPDATE d_screens SET player_id = '1' WHERE player_id IS NULL OR player_id <> '1'");

-          const [playerColumnNullableRows] = await pool.query(
-            `SELECT COUNT(*) AS nullable_count
-             FROM information_schema.COLUMNS
-             WHERE TABLE_SCHEMA = DATABASE()
-               AND TABLE_NAME = 'd_screens'
-               AND COLUMN_NAME = 'player_id'
-               AND IS_NULLABLE = 'YES'`
-          );
-          if (Number(playerColumnNullableRows && playerColumnNullableRows[0] && playerColumnNullableRows[0].nullable_count) > 0) {
-            await pool.query("ALTER TABLE d_screens MODIFY COLUMN player_id VARCHAR(128) NOT NULL DEFAULT '1' AFTER playlist_id");
-          }
-        }
-
-        const [screenPlayerUniqueRows] = await pool.query(
-          `SELECT COUNT(*) AS index_count
-           FROM information_schema.STATISTICS
+        const [playerColumnNullableRows] = await pool.query(
+          `SELECT COUNT(*) AS nullable_count
+           FROM information_schema.COLUMNS
           WHERE TABLE_SCHEMA = DATABASE()
             AND TABLE_NAME = 'd_screens'
-             AND INDEX_NAME = 'uq_screens_player_id'`
+             AND COLUMN_NAME = 'player_id'
+             AND IS_NULLABLE = 'YES'`
        );
-        if (Number(screenPlayerUniqueRows && screenPlayerUniqueRows[0] && screenPlayerUniqueRows[0].index_count) > 0) {
-          await pool.query('ALTER TABLE d_screens DROP INDEX uq_screens_player_id');
+        if (Number(playerColumnNullableRows && playerColumnNullableRows[0] && playerColumnNullableRows[0].nullable_count) > 0) {
+          await pool.query("ALTER TABLE d_screens MODIFY COLUMN player_id VARCHAR(128) NOT NULL DEFAULT '1' AFTER playlist_id");
+        }
+      }
+
+      const [screenPlayerUniqueRows] = await pool.query(
+        `SELECT COUNT(*) AS index_count
+         FROM information_schema.STATISTICS
+         WHERE TABLE_SCHEMA = DATABASE()
+           AND TABLE_NAME = 'd_screens'
+           AND INDEX_NAME = 'uq_screens_player_id'`
+      );
+      if (Number(screenPlayerUniqueRows && screenPlayerUniqueRows[0] && screenPlayerUniqueRows[0].index_count) > 0) {
+        await pool.query('ALTER TABLE d_screens DROP INDEX uq_screens_player_id');
      }

      // Recreate the screen-to-player foreign key after the column exists and legacy data is copied over.
@@ -56,7 +59,6 @@ const VERSIONED_MIGRATIONS = [
      if (await columnExists(pool, 'c_template_regions', 'font_family')) {
        await pool.query('ALTER TABLE c_template_regions DROP COLUMN font_family');
      }
-
    }
  },
  {
@@ -276,6 +278,7 @@ const VERSIONED_MIGRATIONS = [
      await pool.query('RENAME TABLE d_players_rebuild TO d_players');

      await pool.query('ALTER TABLE d_screens MODIFY COLUMN player_id INT NULL AFTER playlist_id');
+      return;
    }
  },
  {
@@ -295,6 +298,200 @@ const VERSIONED_MIGRATIONS = [
      await dropForeignKeyIfExists(pool, 'd_screens', 'player_id');
      await dropColumnIfExists(pool, 'd_screens', 'player_id');
    }
+  },
+  {
+    version: '2.6.16',
+    label: 'v2.6.16 timetable timezone schema',
+    run: async function (pool) {
+      const timetableGroupsExists = await tableExists(pool, 'i_timetable_groups');
+      const scheduleGroupsExists = await tableExists(pool, 'i_schedule_groups');
+      const tableName = timetableGroupsExists ? 'i_timetable_groups' : scheduleGroupsExists ? 'i_schedule_groups' : null;
+
+      if (!tableName) {
+        return;
+      }
+
+      await ensureColumn(pool, tableName, 'timezone', "VARCHAR(64) NOT NULL DEFAULT 'Europe/London'", 'short_description');
+    }
+  },
+  {
+    version: '2.6.17',
+    label: 'v2.6.17 timetable europe/london conversion',
+    run: async function (pool) {
+      const timetableGroupsExists = await tableExists(pool, 'i_timetable_groups');
+      const timetableEntriesExists = await tableExists(pool, 'i_timetable_entries');
+      const scheduleGroupsExists = await tableExists(pool, 'i_schedule_groups');
+      const scheduleEntriesExists = await tableExists(pool, 'i_schedule_entries');
+      const groupTableName = timetableGroupsExists ? 'i_timetable_groups' : scheduleGroupsExists ? 'i_schedule_groups' : null;
+      const entryTableName = timetableEntriesExists ? 'i_timetable_entries' : scheduleEntriesExists ? 'i_schedule_entries' : null;
+
+      if (!groupTableName || !entryTableName) {
+        return;
+      }
+
+      await ensureColumn(pool, groupTableName, 'timezone', "VARCHAR(64) NOT NULL DEFAULT 'Europe/London'", 'short_description');
+
+      await pool.query('UPDATE ' + groupTableName + ' SET timezone = ?', [TIMETABLE_TIME_ZONE]);
+
+      const [rows] = await pool.query('SELECT id, start_datetime, end_datetime FROM ' + entryTableName + ' ORDER BY id ASC');
+      for (const row of rows) {
+        const startDate = convertMigrationDateTimeFromTimeZone(row.start_datetime, TIMETABLE_TIME_ZONE);
+        const endDate = row.end_datetime ? convertMigrationDateTimeFromTimeZone(row.end_datetime, TIMETABLE_TIME_ZONE) : null;
+        await pool.query(
+          'UPDATE ' + entryTableName + ' SET start_datetime = ?, end_datetime = ? WHERE id = ?',
+          [formatMigrationDateTimeUtc(startDate), endDate ? formatMigrationDateTimeUtc(endDate) : null, row.id]
+        );
+      }
+    }
+  },
+  {
+    version: '2.6.18',
+    label: 'v2.6.18 timetable table rename',
+    run: async function (pool) {
+      const scheduleGroupsExists = await tableExists(pool, 'i_schedule_groups');
+      const timetableGroupsExists = await tableExists(pool, 'i_timetable_groups');
+
+      if (scheduleGroupsExists) {
+        if (!timetableGroupsExists) {
+          await pool.query('RENAME TABLE i_schedule_groups TO i_timetable_groups, i_schedule_entries TO i_timetable_entries');
+          await ensureColumn(pool, 'i_timetable_groups', 'timezone', "VARCHAR(64) NOT NULL DEFAULT 'Europe/London'", 'short_description');
+          return;
+        }
+
+        await ensureColumn(pool, 'i_timetable_groups', 'timezone', "VARCHAR(64) NOT NULL DEFAULT 'Europe/London'", 'short_description');
+
+        await pool.query(`
+          INSERT IGNORE INTO i_timetable_groups (id, name, short_description, timezone, created_at, created_by, modified_at, modified_by)
+          SELECT id, name, short_description, 'Europe/London' AS timezone, created_at, created_by, modified_at, modified_by
+          FROM i_schedule_groups
+          ORDER BY id ASC
+        `);
+
+        await pool.query(`
+          INSERT IGNORE INTO i_timetable_entries (id, schedule_group_id, title, short_description, start_datetime, end_datetime, created_at, created_by, modified_at, modified_by)
+          SELECT id, schedule_group_id, title, short_description, start_datetime, end_datetime, created_at, created_by, modified_at, modified_by
+          FROM i_schedule_entries
+          ORDER BY schedule_group_id ASC, start_datetime ASC, id ASC
+        `);
+
+        const [groupRows] = await pool.query('SELECT COALESCE(MAX(id), 0) AS max_id FROM i_timetable_groups');
+        const [entryRows] = await pool.query('SELECT COALESCE(MAX(id), 0) AS max_id FROM i_timetable_entries');
+        const nextGroupId = Number(groupRows && groupRows[0] && groupRows[0].max_id) + 1;
+        const nextEntryId = Number(entryRows && entryRows[0] && entryRows[0].max_id) + 1;
+        await pool.query('ALTER TABLE i_timetable_groups AUTO_INCREMENT = ' + nextGroupId);
+        await pool.query('ALTER TABLE i_timetable_entries AUTO_INCREMENT = ' + nextEntryId);
+
+        await pool.query('DROP TABLE i_schedule_entries');
+        await pool.query('DROP TABLE i_schedule_groups');
+      }
+    }
+  },
+  {
+    version: '2.8.0',
+    label: 'v2.8.0 combined application schema',
+    run: async function (pool) {
+      await pool.query(`
+        CREATE TABLE IF NOT EXISTS o_app_settings (
+          id BIGINT AUTO_INCREMENT PRIMARY KEY,
+          setting_key VARCHAR(191) NOT NULL UNIQUE,
+          setting_value JSON NOT NULL,
+          created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          created_by INT NULL,
+          modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+          modified_by INT NULL
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
+      await pool.query(`
+        CREATE TABLE IF NOT EXISTS o_app_state (
+          id BIGINT AUTO_INCREMENT PRIMARY KEY,
+          state_key VARCHAR(191) NOT NULL UNIQUE,
+          state_value MEDIUMTEXT NULL,
+          created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
+
+      const numericIdTables = [
+        ['d_announcement_screens', 'uq_announcement_screens_pair', '(announcement_id, screen_id)'],
+        ['d_onboarding_devices', 'uq_onboarding_devices_device_id', '(device_id)'],
+        ['a_role_permissions', 'uq_role_permissions_pair', '(role_id, permission_id)'],
+        ['a_user_roles', 'uq_user_roles_pair', '(user_id, role_id)'],
+        ['a_sessions', 'uq_sessions_hash', '(session_hash)'],
+        ['o_app_state', 'uq_app_state_key', '(state_key)']
+      ];
+
+      for (const [tableName, uniqueKeyName, uniqueColumns] of numericIdTables) {
+        if (!(await tableExists(pool, tableName)) || await columnExists(pool, tableName, 'id')) {
+          continue;
+        }
+        await pool.query('ALTER TABLE ' + tableName + ' DROP PRIMARY KEY, ADD COLUMN id BIGINT NOT NULL AUTO_INCREMENT PRIMARY KEY FIRST, ADD UNIQUE KEY ' + uniqueKeyName + ' ' + uniqueColumns);
+      }
+      await ensureColumn(pool, 'a_users', 'must_change_password', 'TINYINT(1) NOT NULL DEFAULT 0', 'password_iterations');
+      await pool.query(`
+        CREATE TABLE IF NOT EXISTS a_login_attempts (
+          id BIGINT AUTO_INCREMENT PRIMARY KEY,
+          rate_key VARCHAR(600) NOT NULL UNIQUE,
+          failed_count INT NOT NULL DEFAULT 0,
+          last_failed_at DATETIME NULL,
+          locked_until DATETIME NULL,
+          created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
+      await ensureColumn(pool, 'a_users', 'account_locked', 'TINYINT(1) NOT NULL DEFAULT 0', 'must_change_password');
+      await ensureColumn(pool, 'a_sessions', 'ip_address', 'VARCHAR(255) NULL', 'user_id');
+      await ensureColumn(pool, 'a_sessions', 'user_agent', 'VARCHAR(512) NULL', 'ip_address');
+      await pool.query(`
+        CREATE TABLE IF NOT EXISTS o_audit_events (
+          id BIGINT AUTO_INCREMENT PRIMARY KEY,
+          occurred_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          category VARCHAR(64) NOT NULL,
+          event_type VARCHAR(128) NOT NULL,
+          actor_user_id INT NULL,
+          target_type VARCHAR(64) NULL,
+          target_id VARCHAR(191) NULL,
+          target_label VARCHAR(255) NULL,
+          ip_address VARCHAR(255) NULL,
+          user_agent VARCHAR(512) NULL,
+          details_json JSON NULL,
+          INDEX idx_audit_events_occurred_at (occurred_at),
+          INDEX idx_audit_events_category_type (category, event_type),
+          INDEX idx_audit_events_actor (actor_user_id),
+          INDEX idx_audit_events_target (target_type, target_id)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
+      await pool.query(
+        `INSERT INTO o_app_settings (setting_key, setting_value, created_by, modified_by)
+         VALUES (?, ?, NULL, NULL) ON DUPLICATE KEY UPDATE setting_value = VALUES(setting_value)`,
+        ['audit.retention_days', JSON.stringify(30)]
+      );
+      const settings = [
+        ['audit.enabled', true],
+        ['audit.categories', ['authentication', 'security', 'sessions', 'users', 'roles', 'system-settings']],
+        ['audit.include_request_metadata', true]
+      ];
+      for (const [key, value] of settings) {
+        await pool.query(
+          `INSERT INTO o_app_settings (setting_key, setting_value, created_by, modified_by)
+           VALUES (?, ?, NULL, NULL) ON DUPLICATE KEY UPDATE setting_value = VALUES(setting_value)`,
+          [key, JSON.stringify(value)]
+        );
+      }
+      await pool.query(
+        `INSERT IGNORE INTO a_permissions
+          (permission_key, name, section_name, description, created_by, modified_by)
+         VALUES (?, ?, ?, ?, NULL, NULL)`,
+        ['audit-log.allow', 'Audit log', 'Settings', 'Download filtered audit events.']
+      );
+      await pool.query(
+        `INSERT IGNORE INTO a_role_permissions (role_id, permission_id, created_by, modified_by)
+         SELECT roles.id, permissions.id, NULL, NULL
+           FROM a_roles roles
+           CROSS JOIN a_permissions permissions
+          WHERE roles.role_key = 'administrators'
+            AND permissions.permission_key = 'audit-log.allow'`
+      );
+    }
  }
 ];

@@ -311,6 +508,65 @@ async function columnExists(pool, tableName, columnName) {
  return Number(rows && rows[0] && rows[0].column_count) > 0;
 }

+async function tableExists(pool, tableName) {
+  const [rows] = await pool.query(
+    `SELECT COUNT(*) AS table_count
+     FROM information_schema.TABLES
+     WHERE TABLE_SCHEMA = DATABASE()
+       AND TABLE_NAME = ?`,
+    [tableName]
+  );
+
+  return Number(rows && rows[0] && rows[0].table_count) > 0;
+}
+
+async function detectSchemaVersion(pool) {
+  if (await tableExists(pool, APP_STATE_TABLE)) {
+    const [rows] = await pool.query(
+      'SELECT state_value FROM ' + APP_STATE_TABLE + ' WHERE state_key = ? LIMIT 1',
+      [APP_STATE_SCHEMA_VERSION_KEY]
+    );
+
+    const storedVersion = String(rows && rows[0] && rows[0].state_value || '').trim();
+    if (storedVersion) {
+      return storedVersion;
+    }
+  }
+
+  const timetableGroupsExists = await tableExists(pool, 'i_timetable_groups');
+  const timetableEntriesExists = await tableExists(pool, 'i_timetable_entries');
+  const scheduleGroupsExists = await tableExists(pool, 'i_schedule_groups');
+  const scheduleEntriesExists = await tableExists(pool, 'i_schedule_entries');
+
+  if (timetableGroupsExists && timetableEntriesExists && !scheduleGroupsExists && !scheduleEntriesExists) {
+    return '2.6.18';
+  }
+
+  return '0.0.0';
+}
+
+async function recordSchemaVersion(pool, version) {
+  await pool.query(
+    `CREATE TABLE IF NOT EXISTS ${APP_STATE_TABLE} (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
+      state_key VARCHAR(191) NOT NULL UNIQUE,
+      state_value MEDIUMTEXT NULL,
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`
+  );
+
+  const stateValue = String(version || appVersion || '0.0.0').trim();
+  await pool.query(
+    'UPDATE ' + APP_STATE_TABLE + ' SET state_value = ? WHERE state_key = ?',
+    [stateValue, APP_STATE_SCHEMA_VERSION_KEY]
+  );
+  await pool.query(
+    'INSERT INTO ' + APP_STATE_TABLE + ' (state_key, state_value) SELECT ?, ? WHERE NOT EXISTS (SELECT 1 FROM ' + APP_STATE_TABLE + ' WHERE state_key = ?)',
+    [APP_STATE_SCHEMA_VERSION_KEY, stateValue, APP_STATE_SCHEMA_VERSION_KEY]
+  );
+}
+
 async function columnIsAutoIncrement(pool, tableName, columnName) {
  const [rows] = await pool.query(
    `SELECT COUNT(*) AS auto_increment_count
@@ -512,6 +768,107 @@ function formatMigrationDateTime(value) {
  return year + '-' + month + '-' + day + 'T' + hours + ':' + minutes;
 }

+function parseMigrationDateTimeParts(value) {
+  if (!value) {
+    return null;
+  }
+
+  if (value instanceof Date) {
+    if (Number.isNaN(value.getTime())) {
+      return null;
+    }
+
+    return {
+      year: value.getUTCFullYear(),
+      month: value.getUTCMonth() + 1,
+      day: value.getUTCDate(),
+      hour: value.getUTCHours(),
+      minute: value.getUTCMinutes(),
+      second: value.getUTCSeconds()
+    };
+  }
+
+  const raw = String(value || '').trim();
+  const match = raw.match(/^(\d{4})-(\d{2})-(\d{2})(?:[ T](\d{2}):(\d{2})(?::(\d{2}))?)?$/);
+  if (!match) {
+    return null;
+  }
+
+  return {
+    year: Number(match[1]),
+    month: Number(match[2]),
+    day: Number(match[3]),
+    hour: Number(match[4] || 0),
+    minute: Number(match[5] || 0),
+    second: Number(match[6] || 0)
+  };
+}
+
+function getMigrationTimeZoneOffsetMillis(date, timeZone) {
+  if (!(date instanceof Date) || Number.isNaN(date.getTime())) {
+    return 0;
+  }
+
+  const parts = new Intl.DateTimeFormat('en-GB', {
+    timeZone: timeZone,
+    hour12: false,
+    year: 'numeric',
+    month: '2-digit',
+    day: '2-digit',
+    hour: '2-digit',
+    minute: '2-digit',
+    second: '2-digit'
+  }).formatToParts(date).reduce(function (acc, part) {
+    if (part && part.type && part.type !== 'literal') {
+      acc[part.type] = part.value;
+    }
+    return acc;
+  }, Object.create(null));
+
+  const localAsUtc = Date.UTC(
+    Number(parts.year) || 0,
+    (Number(parts.month) || 1) - 1,
+    Number(parts.day) || 1,
+    Number(parts.hour) || 0,
+    Number(parts.minute) || 0,
+    Number(parts.second) || 0,
+    0
+  );
+
+  return localAsUtc - date.getTime();
+}
+
+function convertMigrationDateTimeFromTimeZone(value, timeZone) {
+  const parts = parseMigrationDateTimeParts(value);
+  if (!parts) {
+    return null;
+  }
+
+  const utcMillis = Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute, parts.second, 0);
+  let adjusted = new Date(utcMillis - getMigrationTimeZoneOffsetMillis(new Date(utcMillis), timeZone));
+  const adjustedOffset = getMigrationTimeZoneOffsetMillis(adjusted, timeZone);
+
+  if (adjustedOffset !== getMigrationTimeZoneOffsetMillis(new Date(utcMillis), timeZone)) {
+    adjusted = new Date(utcMillis - adjustedOffset);
+  }
+
+  return adjusted;
+}
+
+function formatMigrationDateTimeUtc(value) {
+  if (!(value instanceof Date) || Number.isNaN(value.getTime())) {
+    return null;
+  }
+
+  const year = value.getUTCFullYear();
+  const month = String(value.getUTCMonth() + 1).padStart(2, '0');
+  const day = String(value.getUTCDate()).padStart(2, '0');
+  const hours = String(value.getUTCHours()).padStart(2, '0');
+  const minutes = String(value.getUTCMinutes()).padStart(2, '0');
+  const seconds = String(value.getUTCSeconds()).padStart(2, '0');
+  return year + '-' + month + '-' + day + ' ' + hours + ':' + minutes + ':' + seconds;
+}
+
 function formatMigrationTime(value) {
  if (!value) {
    return null;
@@ -562,12 +919,13 @@ function compareVersions(leftVersion, rightVersion) {
  return 0;
 }

-async function runMigrations(pool, options) {
-  // Only run migrations that are newer than the installed schema version and not beyond the app version.
+async function getPendingMigrations(pool, options) {
  const targetVersion = String(appVersion || '0.0.0').trim();
  const currentVersion = String(options && options.currentVersion || '0.0.0').trim();
  const legacyPlayerSchemaPresent = await columnExists(pool, 'd_players', 'device_id');
  const screenPlayerColumnPresent = await columnExists(pool, 'd_screens', 'player_id');
+  const legacyTimetableGroupsPresent = await tableExists(pool, 'i_schedule_groups');
+  const legacyTimetableEntriesPresent = await tableExists(pool, 'i_schedule_entries');
  let effectiveCurrentVersion = currentVersion;

  if (!legacyPlayerSchemaPresent && compareVersions(effectiveCurrentVersion, '2.1.0') < 0) {
@@ -578,14 +936,29 @@ async function runMigrations(pool, options) {
    effectiveCurrentVersion = '2.6.3';
  }

-  for (const migration of VERSIONED_MIGRATIONS) {
-    if (compareVersions(migration.version, effectiveCurrentVersion) > 0 && compareVersions(migration.version, targetVersion) <= 0) {
-      await migration.run(pool);
-    }
+  if (legacyTimetableGroupsPresent || legacyTimetableEntriesPresent) {
+    effectiveCurrentVersion = compareVersions(effectiveCurrentVersion, '2.6.18') < 0 ? '2.6.17' : '2.6.17';
+  }
+
+  return VERSIONED_MIGRATIONS.filter(function (migration) {
+    return compareVersions(migration.version, effectiveCurrentVersion) > 0 && compareVersions(migration.version, targetVersion) <= 0;
+  });
+}
+
+async function runMigrations(pool, options) {
+  // Only run migrations that are newer than the installed schema version and not beyond the app version.
+  const pendingMigrations = await getPendingMigrations(pool, options);
+
+  for (const migration of pendingMigrations) {
+    await migration.run(pool);
  }
 }

 module.exports = {
  appVersion: appVersion,
-  runMigrations: runMigrations
+  getPendingMigrations: getPendingMigrations,
+  runMigrations: runMigrations,
+  detectSchemaVersion: detectSchemaVersion,
+  recordSchemaVersion: recordSchemaVersion,
+  compareVersions: compareVersions
 };
@@ -40,8 +40,70 @@ function normalizeRemoteAddress(value) {

 function formatPlayerConnectionLabel(deviceId, remoteAddress) {
  const normalizedDeviceId = String(deviceId || '').trim() || 'unknown-player';
-  const normalizedRemoteAddress = normalizeRemoteAddress(remoteAddress);
-  return normalizedRemoteAddress ? `${normalizedDeviceId} (ip ${normalizedRemoteAddress})` : normalizedDeviceId;
+  return normalizedDeviceId;
+}
+
+function normalizeProxyBaseUrl(value) {
+  const normalized = String(value || '').trim().replace(/\/$/, '');
+  if (!normalized) {
+    return '';
+  }
+
+  try {
+    const url = new URL(normalized);
+    if (url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '::1') {
+      url.hostname = 'host.docker.internal';
+    }
+    return url.toString().replace(/\/$/, '');
+  } catch (_error) {
+    return normalized;
+  }
+}
+
+function isLocalLikeBaseUrl(value) {
+  let host = '';
+  try {
+    host = new URL(String(value || '').trim().replace(/\/$/, '')).hostname.toLowerCase();
+  } catch (_error) {
+    return false;
+  }
+
+  return host === 'localhost'
+    || host === '127.0.0.1'
+    || host === '::1'
+    || host === 'host.docker.internal'
+    || host === 'player'
+    || host === 'player-dev'
+    || host === 'player-local'
+    || host === 'player-bridge-dev'
+    || host === 'web'
+    || host === 'player-bridge'
+    || host.endsWith('.local')
+    || host.endsWith('.internal')
+    || host.endsWith('.docker.internal');
+}
+
+function resolveSnapshotUpstreamBaseUrl(player) {
+  const internalBaseUrl = normalizeProxyBaseUrl(player && player.internal_base_url);
+  if (internalBaseUrl && isLocalLikeBaseUrl(internalBaseUrl)) {
+    return internalBaseUrl;
+  }
+
+  return normalizeProxyBaseUrl(player && player.public_base_url) || null;
+}
+
+function resolvePlayerSocketForDeviceId(playerSockets, deviceId) {
+  const normalizedDeviceId = normalizeDeviceId(deviceId);
+  if (!normalizedDeviceId || !playerSockets || typeof playerSockets.get !== 'function') {
+    return null;
+  }
+
+  const socket = playerSockets.get(normalizedDeviceId);
+  if (!socket || socket.readyState !== WebSocket.OPEN) {
+    return null;
+  }
+
+  return socket;
 }

 function resolveScreenCommandTargets(slug, playerSockets, screenPlayerDeviceIds) {
@@ -51,24 +113,38 @@ function resolveScreenCommandTargets(slug, playerSockets, screenPlayerDeviceIds)
  }

  const deviceIds = screenPlayerDeviceIds.get(key);
-  if (!Array.isArray(deviceIds) || !deviceIds.length) {
-    return [];
+  const targets = Array.isArray(deviceIds)
+    ? Array.from(new Set(deviceIds.map(function (value) {
+      return normalizeDeviceId(value);
+    }).filter(Boolean))).map(function (deviceId) {
+      const socket = playerSockets.get(deviceId);
+      if (!socket || socket.readyState !== WebSocket.OPEN) {
+        return null;
+      }
+
+      return { deviceId: deviceId, socket: socket };
+    }).filter(Boolean)
+    : [];
+  if (targets.length) {
+    return targets;
  }

-  return Array.from(new Set(deviceIds.map(function (value) {
-    return normalizeDeviceId(value);
-  }).filter(Boolean))).map(function (deviceId) {
-    const socket = playerSockets.get(deviceId);
-    if (!socket || socket.readyState !== WebSocket.OPEN) {
-      return null;
-    }
+  const fallbackTargets = Array.from(playerSockets.values()).filter(function (socket) {
+    return socket && socket.readyState === WebSocket.OPEN;
+  }).map(function (socket) {
+    return {
+      deviceId: String(socket.playerDeviceId || '').trim(),
+      socket: socket
+    };
+  }).filter(function (target) {
+    return Boolean(target.deviceId);
+  });

-    return { deviceId: deviceId, socket: socket };
-  }).filter(Boolean);
+  return fallbackTargets.length === 1 ? fallbackTargets : [];
 }

 function resolveWebBaseUrl(req) {
-  const configuredWebBaseUrl = String(process.env.WEB_BASE_URL || '').trim().replace(/\/$/, '');
+  const configuredWebBaseUrl = String(process.env.WEB_INTERNAL_URL || '').trim().replace(/\/$/, '');
  if (configuredWebBaseUrl) {
    return configuredWebBaseUrl;
  }
@@ -111,6 +187,7 @@ async function start() {
  const playerPlaylistService = createPlayerPlaylistService({
    pool: pool,
    common: common,
+    mediaDir: config.mediaDir,
    snapshotDir: path.join(config.mediaDir, 'player-cache', 'screen-playlists')
  });
  app.use(express.json());
@@ -118,24 +195,130 @@ async function start() {
  const screenSnapshotsWs = new WebSocketServer({ noServer: true });
  const playerSockets = new Map();
  const screenSnapshotCache = new Map();
+  const screenSnapshotSourcesBySlug = new Map();
+  const screenSnapshotSubscribersBySlug = new Map();
  const screenPlayerDeviceIds = new Map();
  const pendingPlayerCommands = new Map();

-  function normalizeProxyBaseUrl(value) {
-    const normalized = String(value || '').trim().replace(/\/$/, '');
-    if (!normalized) {
-      return '';
+  function getScreenSnapshotSourceBucket(slug) {
+    const key = String(slug || '').trim();
+    if (!key) {
+      return null;
    }

-    try {
-      const url = new URL(normalized);
-      if (url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '::1') {
-        url.hostname = 'host.docker.internal';
-      }
-      return url.toString().replace(/\/$/, '');
-    } catch (_error) {
-      return normalized;
+    if (!screenSnapshotSourcesBySlug.has(key)) {
+      screenSnapshotSourcesBySlug.set(key, new Map());
    }
+
+    return screenSnapshotSourcesBySlug.get(key);
+  }
+
+  function getScreenSnapshotSubscriberBucket(slug) {
+    const key = String(slug || '').trim();
+    if (!key) {
+      return null;
+    }
+
+    if (!screenSnapshotSubscribersBySlug.has(key)) {
+      screenSnapshotSubscribersBySlug.set(key, new Set());
+    }
+
+    return screenSnapshotSubscribersBySlug.get(key);
+  }
+
+  function buildMergedScreenSnapshot(slug) {
+    const key = String(slug || '').trim();
+    const sourceBucket = screenSnapshotSourcesBySlug.get(key);
+    const connections = [];
+    const deviceIds = [];
+
+    if (sourceBucket && typeof sourceBucket.forEach === 'function') {
+      sourceBucket.forEach(function (payload) {
+        if (payload && Array.isArray(payload.connections)) {
+          connections.push.apply(connections, payload.connections);
+        }
+      });
+      sourceBucket.forEach(function (_payload, sourceKey) {
+        deviceIds.push(sourceKey);
+      });
+    }
+
+    return {
+      slug: key,
+      count: connections.length,
+      connections: connections,
+      deviceIds: deviceIds
+    };
+  }
+
+  function broadcastScreenSnapshot(slug) {
+    const key = String(slug || '').trim();
+    const snapshot = buildMergedScreenSnapshot(key);
+    storeScreenSnapshot(key, snapshot.connections, snapshot.deviceIds);
+
+    const bucket = screenSnapshotSubscribersBySlug.get(key);
+    if (!bucket || !bucket.size) {
+      return;
+    }
+
+    const payload = JSON.stringify({
+      type: 'snapshot',
+      slug: key,
+      connections: snapshot.connections,
+      sentAt: new Date().toISOString()
+    });
+
+    bucket.forEach(function (socket) {
+      if (socket && socket.readyState === WebSocket.OPEN) {
+        socket.send(payload);
+      }
+    });
+  }
+
+  function setScreenSnapshotSource(slug, sourceKey, connections) {
+    const key = String(slug || '').trim();
+    const normalizedSourceKey = String(sourceKey || '').trim();
+    if (!key || !normalizedSourceKey) {
+      return;
+    }
+
+    const bucket = getScreenSnapshotSourceBucket(key);
+    if (!bucket) {
+      return;
+    }
+
+    bucket.set(normalizedSourceKey, {
+      slug: key,
+      connections: Array.isArray(connections) ? connections : []
+    });
+    broadcastScreenSnapshot(key);
+  }
+
+  function clearScreenSnapshotSource(slug, sourceKey) {
+    const key = String(slug || '').trim();
+    const normalizedSourceKey = String(sourceKey || '').trim();
+    const bucket = screenSnapshotSourcesBySlug.get(key);
+    if (!bucket || !normalizedSourceKey || !bucket.has(normalizedSourceKey)) {
+      return;
+    }
+
+    bucket.delete(normalizedSourceKey);
+    if (!bucket.size) {
+      screenSnapshotSourcesBySlug.delete(key);
+    }
+
+    broadcastScreenSnapshot(key);
+  }
+
+  function clearPlayerSnapshotSources(sourceKey) {
+    const normalizedSourceKey = String(sourceKey || '').trim();
+    if (!normalizedSourceKey) {
+      return;
+    }
+
+    Array.from(screenSnapshotSourcesBySlug.keys()).forEach(function (slug) {
+      clearScreenSnapshotSource(slug, normalizedSourceKey);
+    });
  }

  async function fetchPlayerSnapshotRegistrations() {
@@ -190,7 +373,7 @@ async function start() {
      return;
    }

-    logBridge(`Player ${formatPlayerConnectionLabel(socket.playerDeviceId, socket.bridgeRemoteAddress)} has disconnected`);
+    logBridge(`Player ${formatPlayerConnectionLabel(socket.playerDeviceId)} has disconnected`);
  }

  function resolveMediaPath(fileName) {
@@ -201,8 +384,8 @@ async function start() {
    return relativePath;
  }

-  function sendPlayerCommand(commandPayload) {
-    const socket = getConnectedPlayerSocket();
+  function sendPlayerCommand(commandPayload, deviceId) {
+    const socket = resolvePlayerSocketForDeviceId(playerSockets, deviceId);
    if (!socket) {
      return Promise.resolve({ ok: false, status: 503, error: 'Player is not connected.' });
    }
@@ -345,15 +528,24 @@ async function start() {
        return res.status(400).json({ error: 'Filename is required' });
      }

+      const deviceId = normalizeDeviceId(req.query.deviceId || req.query.playerIdentifier || req.headers['x-pulse-player-device-id']);
+      if (!deviceId) {
+        return res.status(400).json({ error: 'Device ID is required.' });
+      }
+
      const bodyBuffer = Buffer.isBuffer(req.body) ? req.body : Buffer.from(req.body || '');
      const response = await sendPlayerCommand({
        command: 'media-put',
        relativePath: relativePath,
        bodyBase64: bodyBuffer.toString('base64')
-      });
+      }, deviceId);

      res.status(response.status || (response.ok ? 200 : 502)).json(response);
    } catch (error) {
+      logBridge('Player media upload failed', {
+        relativePath: req.params && req.params.filename ? String(req.params.filename).trim() : '',
+        error: error && error.message ? error.message : String(error)
+      });
      next(error);
    }
  });
@@ -365,13 +557,22 @@ async function start() {
        return res.status(400).json({ error: 'Filename is required' });
      }

+      const deviceId = normalizeDeviceId(req.query.deviceId || req.query.playerIdentifier || req.headers['x-pulse-player-device-id']);
+      if (!deviceId) {
+        return res.status(400).json({ error: 'Device ID is required.' });
+      }
+
      const response = await sendPlayerCommand({
        command: 'media-delete',
        relativePath: relativePath
-      });
+      }, deviceId);

      res.status(response.status || (response.ok ? 200 : 502)).json(response);
    } catch (error) {
+      logBridge('Player media delete failed', {
+        relativePath: req.params && req.params.filename ? String(req.params.filename).trim() : '',
+        error: error && error.message ? error.message : String(error)
+      });
      next(error);
    }
  });
@@ -641,6 +842,16 @@ async function start() {

    socket.playerDeviceId = deviceId;

+    if (messageType === 'snapshot') {
+      const slug = String(payload.slug || '').trim();
+      if (!slug) {
+        return;
+      }
+
+      setScreenSnapshotSource(slug, deviceId, Array.isArray(payload.connections) ? payload.connections : []);
+      return;
+    }
+
    if (messageType === 'register') {
      const player = await upsertPlayerRegistration(pool, {
        deviceId: deviceId,
@@ -649,7 +860,7 @@ async function start() {
      });

      playerSockets.set(deviceId, socket);
-      logBridge(`Player ${formatPlayerConnectionLabel(deviceId, socket.bridgeRemoteAddress)} has connected`);
+      logBridge(`Player ${formatPlayerConnectionLabel(deviceId)} has connected`);
      socket.send(JSON.stringify({ type: 'registered', ok: true, player: player }));
      return;
    }
@@ -696,14 +907,12 @@ async function start() {
    }

    if (!verifyRequestAuth(request)) {
-      const remoteAddress = normalizeRemoteAddress(request && request.socket && request.socket.remoteAddress);
-      logBridge(remoteAddress ? `Player (ip ${remoteAddress}) denied with wrong shared secret` : 'Player denied with wrong shared secret');
+      logBridge('Player denied with wrong shared secret');
      socket.destroy();
      return;
    }

    playersWs.handleUpgrade(request, socket, head, function (ws) {
-      ws.bridgeRemoteAddress = normalizeRemoteAddress(request && request.socket && request.socket.remoteAddress);
      playersWs.emit('connection', ws, request);
    });
  });
@@ -719,12 +928,14 @@ async function start() {
    });

    socket.on('close', function () {
+      clearPlayerSnapshotSources(socket.playerDeviceId);
      if (removeConnectedPlayerSocket(socket)) {
        logPlayerDisconnect(socket);
      }
    });

    socket.on('error', function () {
+      clearPlayerSnapshotSources(socket.playerDeviceId);
      if (removeConnectedPlayerSocket(socket)) {
        logPlayerDisconnect(socket);
      }
@@ -734,33 +945,18 @@ async function start() {
  screenSnapshotsWs.on('connection', function (socket, request, slug) {
    const normalizedSlug = String(slug || '').trim();
    const upstreamSockets = new Map();
-    const upstreamSnapshots = new Map();
    const upstreamDeviceIds = new Set();
    let refreshTimer = null;
    let closed = false;

-    function sendMergedSnapshot() {
-      if (!normalizedSlug || socket.readyState !== WebSocket.OPEN) {
-        return;
-      }
-
-      const connections = [];
-      upstreamSnapshots.forEach(function (payload) {
-        if (payload && Array.isArray(payload.connections)) {
-          connections.push.apply(connections, payload.connections);
-        }
-      });
-
-      storeScreenSnapshot(normalizedSlug, connections, Array.from(upstreamDeviceIds));
-
-      socket.send(JSON.stringify({
-        type: 'snapshot',
-        slug: normalizedSlug,
-        connections: connections,
-        sentAt: new Date().toISOString()
-      }));
+    const subscriberBucket = getScreenSnapshotSubscriberBucket(normalizedSlug);
+    if (!subscriberBucket) {
+      socket.close();
+      return;
    }

+    subscriberBucket.add(socket);
+
    function closeUpstreamSockets() {
      upstreamSockets.forEach(function (upstreamSocket) {
        try {
@@ -769,7 +965,6 @@ async function start() {
        }
      });
      upstreamSockets.clear();
-      upstreamSnapshots.clear();
    }

    async function refreshUpstreams() {
@@ -786,12 +981,19 @@ async function start() {

      const seenKeys = new Set();
      players.forEach(function (player) {
-        const baseUrl = normalizeProxyBaseUrl(player && player.public_base_url);
+        const sourceKey = String(player && player.identifier || player && player.id || '').trim();
+        const connectedSocket = sourceKey ? playerSockets.get(sourceKey) : null;
+        if (connectedSocket && connectedSocket.readyState === WebSocket.OPEN) {
+          seenKeys.add(sourceKey);
+          upstreamDeviceIds.add(sourceKey);
+          return;
+        }
+
+        const baseUrl = resolveSnapshotUpstreamBaseUrl(player);
        if (!baseUrl) {
          return;
        }

-        const sourceKey = String(player && player.identifier || player && player.id || baseUrl);
        seenKeys.add(sourceKey);
        upstreamDeviceIds.add(sourceKey);
        if (upstreamSockets.has(sourceKey)) {
@@ -814,20 +1016,15 @@ async function start() {
            if (!payload || payload.type !== 'snapshot' || String(payload.slug || '').trim() !== normalizedSlug) {
              return;
            }
-            upstreamSnapshots.set(sourceKey, {
-              slug: normalizedSlug,
-              connections: Array.isArray(payload.connections) ? payload.connections : []
-            });
-            sendMergedSnapshot();
+            setScreenSnapshotSource(normalizedSlug, sourceKey, Array.isArray(payload.connections) ? payload.connections : []);
          } catch (_error) {
          }
        };

        upstreamSocket.onclose = function () {
          upstreamSockets.delete(sourceKey);
-          upstreamSnapshots.delete(sourceKey);
-          if (!closed) {
-            sendMergedSnapshot();
+          if (!closed && !(playerSockets.get(sourceKey) && playerSockets.get(sourceKey).readyState === WebSocket.OPEN)) {
+            clearScreenSnapshotSource(normalizedSlug, sourceKey);
          }
        };

@@ -852,7 +1049,7 @@ async function start() {
        }
      });

-      sendMergedSnapshot();
+      broadcastScreenSnapshot(normalizedSlug);
    }

    refreshUpstreams();
@@ -863,6 +1060,10 @@ async function start() {

    socket.on('close', function () {
      closed = true;
+      subscriberBucket.delete(socket);
+      if (!subscriberBucket.size) {
+        screenSnapshotSubscribersBySlug.delete(normalizedSlug);
+      }
      if (refreshTimer) {
        clearInterval(refreshTimer);
        refreshTimer = null;
@@ -872,6 +1073,10 @@ async function start() {

    socket.on('error', function () {
      closed = true;
+      subscriberBucket.delete(socket);
+      if (!subscriberBucket.size) {
+        screenSnapshotSubscribersBySlug.delete(normalizedSlug);
+      }
      if (refreshTimer) {
        clearInterval(refreshTimer);
        refreshTimer = null;
@@ -882,19 +1087,32 @@ async function start() {

  app.post('/api/internal/sync/player-media', requireRequestAuth, async function (_req, res, next) {
    try {
+      logBridge('Relaying player media sync request to web');
      const webBaseUrl = resolveWebBaseUrl(_req);
      if (!webBaseUrl) {
        return res.status(502).json({ error: 'Web base URL is not configured.' });
      }

+      const requestBody = _req.body && typeof _req.body === 'object' && !Array.isArray(_req.body)
+        ? Object.assign({}, _req.body)
+        : {};
+
      const response = await fetch(`${webBaseUrl}/api/internal/sync/player-media`, {
        method: 'POST',
        headers: Object.assign({
-          Accept: 'application/json'
+          Accept: 'application/json',
+          'Content-Type': 'application/json'
        }, createRequestAuthHeaders({
          method: 'POST',
-          pathname: '/api/internal/sync/player-media'
-        }))
+          pathname: '/api/internal/sync/player-media',
+          body: requestBody
+        })),
+        body: JSON.stringify(requestBody)
+      });
+
+      logBridge('Web player media sync response received', {
+        ok: Boolean(response && response.ok),
+        status: response && response.status ? response.status : null
      });

      res.status(response.status);
@@ -904,6 +1122,53 @@ async function start() {
      }
      res.send(await response.text());
    } catch (error) {
+      logBridge('Player media sync relay failed', {
+        error: error && error.message ? error.message : String(error)
+      });
+      next(error);
+    }
+  });
+
+  app.post('/api/internal/sync/player-font', requireRequestAuth, async function (_req, res, next) {
+    try {
+      logBridge('Relaying player font sync request to web');
+      const webBaseUrl = resolveWebBaseUrl(_req);
+      if (!webBaseUrl) {
+        return res.status(502).json({ error: 'Web base URL is not configured.' });
+      }
+
+      const requestBody = _req.body && typeof _req.body === 'object' && !Array.isArray(_req.body)
+        ? Object.assign({}, _req.body)
+        : {};
+
+      const response = await fetch(`${webBaseUrl}/api/internal/sync/player-font`, {
+        method: 'POST',
+        headers: Object.assign({
+          Accept: 'application/json',
+          'Content-Type': 'application/json'
+        }, createRequestAuthHeaders({
+          method: 'POST',
+          pathname: '/api/internal/sync/player-font',
+          body: requestBody
+        })),
+        body: JSON.stringify(requestBody)
+      });
+
+      logBridge('Web player font sync response received', {
+        ok: Boolean(response && response.ok),
+        status: response && response.status ? response.status : null
+      });
+
+      res.status(response.status);
+      const contentType = response.headers.get('content-type');
+      if (contentType) {
+        res.type(contentType);
+      }
+      res.send(await response.text());
+    } catch (error) {
+      logBridge('Player font sync relay failed', {
+        error: error && error.message ? error.message : String(error)
+      });
      next(error);
    }
  });
@@ -915,7 +1180,13 @@ async function start() {
  });
 }

-module.exports = { start: start, resolveWebBaseUrl: resolveWebBaseUrl, resolveScreenCommandTargets: resolveScreenCommandTargets };
+module.exports = {
+  start: start,
+  resolveWebBaseUrl: resolveWebBaseUrl,
+  resolveScreenCommandTargets: resolveScreenCommandTargets,
+  resolveSnapshotUpstreamBaseUrl: resolveSnapshotUpstreamBaseUrl,
+  resolvePlayerSocketForDeviceId: resolvePlayerSocketForDeviceId
+};

 if (require.main === module) {
  start().catch(function (error) {
@@ -18,27 +18,50 @@ const { getConfiguredPlayerIdentifier, recordPlayerHeartbeat } = require('#src/d
 // Player runtime, media API, and websocket wiring.
 async function start() {
  const app = express();
-  const pool = String(process.env.THIN_CLIENT_BASE_URL || '').trim().replace(/\/$/, '') ? null : common.createPool();
+  const pool = String(process.env.BRIDGE_PUBLIC_URL || '').trim().replace(/\/$/, '') ? null : common.createPool();
  const PORT = Number(process.env.PLAYER_PORT || 8081);
-  const PLAYER_PUBLIC_BASE_URL = String(process.env.PLAYER_PUBLIC_BASE_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
-  const THIN_CLIENT_BASE_URL = String(process.env.THIN_CLIENT_BASE_URL || '').trim().replace(/\/$/, '');
-  const isRemotePlayer = Boolean(THIN_CLIENT_BASE_URL);
-  const PLAYER_INTERNAL_BASE_URL = String(isRemotePlayer ? THIN_CLIENT_BASE_URL : (process.env.PLAYER_INTERNAL_BASE_URL || PLAYER_PUBLIC_BASE_URL || process.env.PLAYER_BASE_URL || '')).trim().replace(/\/$/, '');
+  const PLAYER_PUBLIC_URL = String(process.env.PLAYER_PUBLIC_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  const BRIDGE_PUBLIC_URL = String(process.env.BRIDGE_PUBLIC_URL || '').trim().replace(/\/$/, '');
+  const WEB_INTERNAL_URL = String(process.env.WEB_INTERNAL_URL || '').trim().replace(/\/$/, '');
+  const isRemotePlayer = Boolean(BRIDGE_PUBLIC_URL);
+  const PLAYER_INTERNAL_URL = String(isRemotePlayer ? BRIDGE_PUBLIC_URL : (process.env.PLAYER_INTERNAL_URL || PLAYER_PUBLIC_URL || process.env.PLAYER_BASE_URL || '')).trim().replace(/\/$/, '');
  const PLAYER_DEVICE_ID = getConfiguredPlayerIdentifier();
+  const PLAYER_AGENT_RECONNECT_DELAY_MS = Number(process.env.PLAYER_AGENT_RECONNECT_DELAY_MS || 5000);
  const ASSET_DIR = path.join(__dirname, 'player', 'public');
  const MEDIA_DIR = path.join(__dirname, '..', 'media');
  const ONBOARDING_QUEUE_FILE = path.join(MEDIA_DIR, 'player-onboarding-queue.json');
  const DB_SYNC_INTERVAL_MS = Number(process.env.PLAYER_DB_SYNC_INTERVAL_MS || 15000);
+  const RECONNECT_SYNC_STALE_MS = 60 * 1000;
  const onboardingStore = createOnboardingStore(ONBOARDING_QUEUE_FILE);
+  let thinClientSocket = null;
+  let lastDisconnectAt = 0;
+  let playerPublicBaseUrl = PLAYER_PUBLIC_URL || null;
+  let refreshThinClientRegistration = null;
  const playerRuntime = createPlayerRuntime({
    pool: pool,
-    normalizeDeviceId: normalizeDeviceId
+    normalizeDeviceId: normalizeDeviceId,
+    notifySnapshot: function (snapshot) {
+      if (!thinClientSocket || thinClientSocket.readyState !== WebSocket.OPEN) {
+        return;
+      }
+
+      try {
+        thinClientSocket.send(JSON.stringify({
+          type: 'snapshot',
+          deviceId: PLAYER_DEVICE_ID,
+          slug: snapshot && snapshot.slug ? String(snapshot.slug).trim() : '',
+          connections: Array.isArray(snapshot && snapshot.connections) ? snapshot.connections : []
+        }));
+      } catch (_error) {
+      }
+    }
  });
  const playerPlaylistService = isRemotePlayer
    ? null
    : createPlayerPlaylistService({
        pool: pool,
        common: common,
+        mediaDir: MEDIA_DIR,
        snapshotDir: path.join(MEDIA_DIR, 'player-cache', 'screen-playlists')
      });
  const rtmpStreamService = createRtmpStreamService({
@@ -50,6 +73,35 @@ async function start() {

  let hasLoggedPlayerStartup = false;

+  function normalizePlayerPublicBaseUrl(value) {
+    const normalized = String(value || '').trim().replace(/\/$/, '');
+    if (!normalized) {
+      return null;
+    }
+
+    try {
+      return new URL(normalized).origin.replace(/\/$/, '');
+    } catch (_error) {
+      return normalized;
+    }
+  }
+
+  function setPlayerPublicBaseUrl(value) {
+    const nextBaseUrl = normalizePlayerPublicBaseUrl(value);
+    if (!nextBaseUrl || nextBaseUrl === playerPublicBaseUrl) {
+      return;
+    }
+
+    playerPublicBaseUrl = nextBaseUrl;
+    if (typeof refreshThinClientRegistration === 'function') {
+      refreshThinClientRegistration();
+    }
+  }
+
+  function getPlayerPublicBaseUrl() {
+    return playerPublicBaseUrl;
+  }
+
  function logPlayerStartup(connectionState) {
    if (hasLoggedPlayerStartup) {
      return;
@@ -59,9 +111,9 @@ async function start() {
    console.info('[player] startup', {
      mode: isRemotePlayer ? 'bridge client' : 'local',
      connected: connectionState && typeof connectionState.connected === 'boolean' ? connectionState.connected : false,
-      publicBaseUrl: PLAYER_PUBLIC_BASE_URL || null,
-      bridgeBaseUrl: PLAYER_INTERNAL_BASE_URL || null,
-      bridgeWebSocketUrl: THIN_CLIENT_BASE_URL ? createThinClientWebSocketUrl() : null
+      publicBaseUrl: getPlayerPublicBaseUrl(),
+      bridgeBaseUrl: PLAYER_INTERNAL_URL || null,
+      bridgeWebSocketUrl: BRIDGE_PUBLIC_URL ? createThinClientWebSocketUrl() : null
    });
  }

@@ -83,28 +135,84 @@ async function start() {
  }

  async function triggerWebMediaSync() {
-    if (!isRemotePlayer || !THIN_CLIENT_BASE_URL) {
+    const syncBaseUrl = WEB_INTERNAL_URL || BRIDGE_PUBLIC_URL;
+    if (!isRemotePlayer || !syncBaseUrl) {
      return false;
    }

+    const requestBody = {
+      playerIdentifier: PLAYER_DEVICE_ID,
+      playerPublicBaseUrl: getPlayerPublicBaseUrl(),
+      playerInternalBaseUrl: PLAYER_INTERNAL_URL
+    };
+
    try {
      const authHeaders = createRequestAuthHeaders({
        method: 'POST',
-        pathname: '/api/internal/sync/player-media'
+        pathname: '/api/internal/sync/player-media',
+        body: requestBody
      });
-      const response = await fetch(`${THIN_CLIENT_BASE_URL}/api/internal/sync/player-media`, {
+      const response = await fetch(`${syncBaseUrl}/api/internal/sync/player-media`, {
        method: 'POST',
        headers: Object.assign({
-          Accept: 'application/json'
-        }, authHeaders)
+          Accept: 'application/json',
+          'Content-Type': 'application/json'
+        }, authHeaders),
+        body: JSON.stringify(requestBody)
      });
+
      return Boolean(response && response.ok);
    } catch (_error) {
+      console.warn('[player] Startup media sync failed');
+      return false;
+    }
+  }
+
+  async function triggerWebFontSync() {
+    const syncBaseUrl = WEB_INTERNAL_URL || BRIDGE_PUBLIC_URL;
+    if (!isRemotePlayer || !syncBaseUrl) {
+      return false;
+    }
+
+    const requestBody = {
+      playerIdentifier: PLAYER_DEVICE_ID,
+      playerPublicBaseUrl: getPlayerPublicBaseUrl(),
+      playerInternalBaseUrl: PLAYER_INTERNAL_URL
+    };
+
+    try {
+      const authHeaders = createRequestAuthHeaders({
+        method: 'POST',
+        pathname: '/api/internal/sync/player-font',
+        body: requestBody
+      });
+      const response = await fetch(`${syncBaseUrl}/api/internal/sync/player-font`, {
+        method: 'POST',
+        headers: Object.assign({
+          Accept: 'application/json',
+          'Content-Type': 'application/json'
+        }, authHeaders),
+        body: JSON.stringify(requestBody)
+      });
+
+      return Boolean(response && response.ok);
+    } catch (_error) {
+      console.warn('[player] Startup font sync failed');
      return false;
    }
  }

  let webMediaSyncCompleted = false;
+  let webFontSyncCompleted = false;
+  let webFontSyncTriggered = false;
+
+  function shouldTriggerReconnectSync() {
+    if (!lastDisconnectAt) {
+      return true;
+    }
+
+    return Date.now() - lastDisconnectAt >= RECONNECT_SYNC_STALE_MS;
+  }

  async function handleThinClientCommand(socket, rawMessage) {
    let payload = null;
@@ -194,9 +302,9 @@ async function start() {
    common: common,
    playerRuntime: playerRuntime,
    onboardingStore: onboardingStore,
-    playerPublicBaseUrl: PLAYER_PUBLIC_BASE_URL,
-    playerInternalBaseUrl: PLAYER_INTERNAL_BASE_URL,
-    thinClientBaseUrl: THIN_CLIENT_BASE_URL,
+    playerPublicBaseUrl: getPlayerPublicBaseUrl(),
+    playerInternalBaseUrl: PLAYER_INTERNAL_URL,
+    bridgeBaseUrl: BRIDGE_PUBLIC_URL,
    playerDeviceId: PLAYER_DEVICE_ID
  });
  registerPlayerRoutes(app, {
@@ -207,18 +315,18 @@ async function start() {
    playerRuntime: playerRuntime,
    playerPlaylistService: playerPlaylistService,
    rtmpStreamService: rtmpStreamService,
-    playerPublicBaseUrl: PLAYER_PUBLIC_BASE_URL,
-    playerInternalBaseUrl: PLAYER_INTERNAL_BASE_URL,
-    thinClientBaseUrl: THIN_CLIENT_BASE_URL,
-    playerDeviceId: PLAYER_DEVICE_ID
+    playerInternalBaseUrl: PLAYER_INTERNAL_URL,
+    bridgeBaseUrl: BRIDGE_PUBLIC_URL,
+    playerDeviceId: PLAYER_DEVICE_ID,
+    onPlayerPublicBaseUrl: setPlayerPublicBaseUrl
  });

  function createThinClientWebSocketUrl() {
-    if (!THIN_CLIENT_BASE_URL) {
+    if (!BRIDGE_PUBLIC_URL) {
      return null;
    }

-    return THIN_CLIENT_BASE_URL.replace(/^http:/i, 'ws:').replace(/^https:/i, 'wss:') + '/ws/players';
+    return BRIDGE_PUBLIC_URL.replace(/^http:/i, 'ws:').replace(/^https:/i, 'wss:') + '/ws/players';
  }

  function startThinClientRegistration() {
@@ -256,6 +364,71 @@ async function start() {
          'x-pulse-request-timestamp': timestamp
        }, authHeaders)
      });
+      thinClientSocket = socket;
+
+      function sendHeartbeat() {
+        if (!socket || socket.readyState !== WebSocket.OPEN) {
+          return;
+        }
+
+        socket.send(JSON.stringify({
+          type: 'heartbeat',
+          deviceId: PLAYER_DEVICE_ID,
+          publicBaseUrl: getPlayerPublicBaseUrl(),
+          internalBaseUrl: PLAYER_INTERNAL_URL
+        }));
+      }
+
+      refreshThinClientRegistration = sendHeartbeat;
+
+      function triggerMediaSyncIfNeeded() {
+        if (webMediaSyncTriggered || webMediaSyncCompleted) {
+          return;
+        }
+
+        webMediaSyncTriggered = true;
+        triggerWebMediaSync().then(function (success) {
+          webMediaSyncCompleted = Boolean(success) || webMediaSyncCompleted;
+          if (!success) {
+            webMediaSyncTriggered = false;
+          }
+        }).catch(function () {
+          webMediaSyncTriggered = false;
+        });
+      }
+
+      function triggerFontSyncIfNeeded() {
+        if (webFontSyncTriggered || webFontSyncCompleted) {
+          return;
+        }
+
+        webFontSyncTriggered = true;
+        triggerWebFontSync().then(function (success) {
+          webFontSyncCompleted = Boolean(success) || webFontSyncCompleted;
+          if (!success) {
+            webFontSyncTriggered = false;
+          }
+        }).catch(function () {
+          webFontSyncTriggered = false;
+          webFontSyncCompleted = false;
+        });
+      }
+
+      function sendSnapshot(slug) {
+        if (!socket || socket.readyState !== WebSocket.OPEN) {
+          return;
+        }
+
+        try {
+          socket.send(JSON.stringify({
+            type: 'snapshot',
+            deviceId: PLAYER_DEVICE_ID,
+            slug: String(slug || '').trim(),
+            connections: playerRuntime.snapshotConnections(slug)
+          }));
+        } catch (_error) {
+        }
+      }

      socket.on('open', function () {
        logPlayerStartup({
@@ -265,42 +438,40 @@ async function start() {
        socket.send(JSON.stringify({
          type: 'register',
          deviceId: PLAYER_DEVICE_ID,
-          publicBaseUrl: PLAYER_PUBLIC_BASE_URL,
-          internalBaseUrl: PLAYER_INTERNAL_BASE_URL
+          publicBaseUrl: getPlayerPublicBaseUrl(),
+          internalBaseUrl: PLAYER_INTERNAL_URL
        }));

-        if (!webMediaSyncCompleted) {
-          triggerWebMediaSync().then(function (success) {
-            webMediaSyncTriggered = Boolean(success);
-            webMediaSyncCompleted = Boolean(success) || webMediaSyncCompleted;
-          }).catch(function () {
-            webMediaSyncTriggered = false;
-          });
-        }
+        playerRuntime.snapshotSlugs().forEach(function (slug) {
+          sendSnapshot(slug);
+        });

        heartbeatTimer = setInterval(function () {
-          if (!socket || socket.readyState !== WebSocket.OPEN) {
-            return;
-          }
-          socket.send(JSON.stringify({
-            type: 'heartbeat',
-            deviceId: PLAYER_DEVICE_ID,
-            publicBaseUrl: PLAYER_PUBLIC_BASE_URL,
-            internalBaseUrl: PLAYER_INTERNAL_BASE_URL
-          }));
-
-          if (!webMediaSyncTriggered && !webMediaSyncCompleted) {
-            triggerWebMediaSync().then(function (success) {
-              webMediaSyncTriggered = Boolean(success);
-              webMediaSyncCompleted = Boolean(success) || webMediaSyncCompleted;
-            }).catch(function () {
-              webMediaSyncTriggered = false;
-            });
-          }
+          sendHeartbeat();
        }, DB_SYNC_INTERVAL_MS);
      });

      socket.on('message', function (rawMessage) {
+        let parsedMessage = null;
+        try {
+          parsedMessage = JSON.parse(String(rawMessage || '{}'));
+        } catch (_error) {
+          parsedMessage = null;
+        }
+
+        if (parsedMessage && String(parsedMessage.type || '').trim() === 'registered') {
+          sendHeartbeat();
+          return;
+        }
+
+        if (parsedMessage && String(parsedMessage.type || '').trim() === 'heartbeat-ack') {
+          if (shouldTriggerReconnectSync()) {
+            triggerMediaSyncIfNeeded();
+            triggerFontSyncIfNeeded();
+          }
+          return;
+        }
+
        handleThinClientCommand(socket, rawMessage).catch(function (error) {
          try {
            socket.send(JSON.stringify({
@@ -316,8 +487,14 @@ async function start() {
      });

      socket.on('close', function () {
+        lastDisconnectAt = Date.now();
+        webFontSyncTriggered = false;
+        webFontSyncCompleted = false;
+        webMediaSyncCompleted = false;
        clearTimers();
-        reconnectTimer = setTimeout(connect, 5000);
+        thinClientSocket = null;
+        refreshThinClientRegistration = null;
+        reconnectTimer = setTimeout(connect, PLAYER_AGENT_RECONNECT_DELAY_MS);
      });

      socket.on('error', function () {
@@ -363,8 +540,8 @@ async function start() {
    try {
      await recordPlayerHeartbeat(pool, {
        deviceId: PLAYER_DEVICE_ID,
-        publicBaseUrl: PLAYER_PUBLIC_BASE_URL,
-        internalBaseUrl: PLAYER_INTERNAL_BASE_URL
+        publicBaseUrl: getPlayerPublicBaseUrl(),
+        internalBaseUrl: PLAYER_INTERNAL_URL
      }).catch(function (error) {
        console.error(error);
      });
@@ -392,7 +569,7 @@ async function start() {

  if (PLAYER_DEVICE_ID && !isRemotePlayer) {
    const { upsertPlayerRegistration } = require('./player/onboarding');
-    await upsertPlayerRegistration(pool, PLAYER_DEVICE_ID, PLAYER_PUBLIC_BASE_URL, PLAYER_INTERNAL_BASE_URL).catch(function (error) {
+    await upsertPlayerRegistration(pool, PLAYER_DEVICE_ID, getPlayerPublicBaseUrl(), PLAYER_INTERNAL_URL).catch(function (error) {
      console.error(error);
    });
  }
@@ -16,15 +16,16 @@ function normalizeDeviceId(value) {
 }

 function getPublicBaseUrl(req, configuredUrl) {
-  const configured = String(configuredUrl || process.env.PLAYER_PUBLIC_BASE_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
-  if (configured) {
-    return configured;
-  }
  const forwardedProto = String(req.headers['x-forwarded-proto'] || '').trim().split(',')[0];
  const protocol = forwardedProto || (req.socket && req.socket.encrypted ? 'https' : 'http');
  const forwardedHost = String(req.headers['x-forwarded-host'] || '').trim().split(',')[0];
  const host = forwardedHost || String(req.headers.host || '').trim();
-  return `${protocol}://${host}`.replace(/\/$/, '');
+  if (host) {
+    return `${protocol}://${host}`.replace(/\/$/, '');
+  }
+
+  const configured = String(configuredUrl || process.env.PLAYER_PUBLIC_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  return configured || null;
 }

 function getRequestIp(req) {
@@ -50,7 +51,7 @@ function getPlayerPublicBaseUrl(req, configuredUrl) {
 }

 function getPlayerInternalBaseUrl(configuredUrl) {
-  const configured = String(configuredUrl || process.env.PLAYER_INTERNAL_BASE_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  const configured = String(configuredUrl || process.env.PLAYER_INTERNAL_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
  return configured || null;
 }

@@ -127,8 +128,18 @@ async function commitDeviceBinding(pool, deviceId, clientName, screenSlug, isNam
    }

    await pool.query(
-      'INSERT INTO d_onboarding_devices (device_id, client_name, screen_id) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE client_name = VALUES(client_name), screen_id = VALUES(screen_id), modified_at = CURRENT_TIMESTAMP',
-      [normalizedDeviceId, normalizedClientName, screen.id]
+      `UPDATE d_onboarding_devices
+          SET client_name = ?, screen_id = ?, modified_at = CURRENT_TIMESTAMP
+        WHERE device_id = ?`,
+      [normalizedClientName, screen.id, normalizedDeviceId]
+    );
+    await pool.query(
+      `INSERT INTO d_onboarding_devices (device_id, client_name, screen_id)
+       SELECT ?, ?, ?
+        WHERE NOT EXISTS (
+          SELECT 1 FROM d_onboarding_devices WHERE device_id = ?
+        )`,
+      [normalizedDeviceId, normalizedClientName, screen.id, normalizedDeviceId]
    );

    return getOnboardingStatus(pool, normalizedDeviceId);
@@ -203,22 +214,22 @@ function registerPlayerOnboardingRoutes(app, options) {
  const common = options && options.common ? options.common : null;
  const playerRuntime = options && options.playerRuntime ? options.playerRuntime : null;
  const onboardingStore = options && options.onboardingStore ? options.onboardingStore : null;
-  const playerPublicBaseUrl = String(options && options.playerPublicBaseUrl || process.env.PLAYER_PUBLIC_BASE_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
-  const thinClientBaseUrl = String(options && options.thinClientBaseUrl || process.env.THIN_CLIENT_BASE_URL || '').trim().replace(/\/$/, '');
+  const playerPublicUrl = String(options && options.playerPublicBaseUrl || process.env.PLAYER_PUBLIC_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  const bridgeBaseUrl = String(options && options.bridgeBaseUrl || process.env.BRIDGE_PUBLIC_URL || '').trim().replace(/\/$/, '');
  const playerDeviceId = normalizeDeviceId(options && options.playerDeviceId);

  if (!app || !common) {
    throw new Error('registerPlayerOnboardingRoutes requires app and common.');
  }

-  if (!thinClientBaseUrl && (!pool || !playerRuntime)) {
-    throw new Error('registerPlayerOnboardingRoutes requires pool and playerRuntime unless thinClientBaseUrl is configured.');
+  if (!bridgeBaseUrl && (!pool || !playerRuntime)) {
+    throw new Error('registerPlayerOnboardingRoutes requires pool and playerRuntime unless bridgeBaseUrl is configured.');
  }

  const sharedSecret = getSharedSecret();

  async function fetchThinClient(req, pathname, options) {
-    if (!thinClientBaseUrl) {
+    if (!bridgeBaseUrl) {
      return null;
    }

@@ -239,7 +250,7 @@ function registerPlayerOnboardingRoutes(app, options) {
      headers['content-type'] = requestOptions.contentType;
    }

-    return fetch(new URL(pathname, thinClientBaseUrl).toString(), {
+    return fetch(new URL(pathname, bridgeBaseUrl).toString(), {
      method: method,
      headers: headers,
      body: body === undefined || body === null || method === 'GET' || method === 'HEAD' ? undefined : body
@@ -305,7 +316,7 @@ function registerPlayerOnboardingRoutes(app, options) {
  }, async function (req, res, next) {
    try {
      const deviceId = normalizeDeviceId(req.query.deviceId) || playerDeviceId;
-      if (thinClientBaseUrl) {
+      if (bridgeBaseUrl) {
        const response = await fetchThinClient(req, '/api/onboarding/status?deviceId=' + encodeURIComponent(deviceId || ''), {
          method: 'GET'
        });
@@ -317,7 +328,7 @@ function registerPlayerOnboardingRoutes(app, options) {
        if (!payload) {
          return res.status(502).json({ error: 'Player bridge returned an invalid response.' });
        }
-        payload.playerUrl = payload && payload.screenSlug ? `${getPublicBaseUrl(req, playerPublicBaseUrl)}/screen/${encodeURIComponent(payload.screenSlug)}` : null;
+        payload.playerUrl = payload && payload.screenSlug ? `${getPublicBaseUrl(req, playerPublicUrl)}/screen/${encodeURIComponent(payload.screenSlug)}` : null;
        return res.json(payload);
      }

@@ -329,7 +340,7 @@ function registerPlayerOnboardingRoutes(app, options) {
        screenId: status ? status.screen_id : null,
        screenSlug: status ? status.screen_slug : null,
        screenName: status ? status.screen_name : null,
-        playerUrl: status && status.screen_slug ? `${getPublicBaseUrl(req, playerPublicBaseUrl)}/screen/${encodeURIComponent(status.screen_slug)}` : null
+        playerUrl: status && status.screen_slug ? `${getPublicBaseUrl(req, playerPublicUrl)}/screen/${encodeURIComponent(status.screen_slug)}` : null
      });
    } catch (error) {
      next(error);
@@ -338,7 +349,7 @@ function registerPlayerOnboardingRoutes(app, options) {

  app.get('/api/onboarding/screens', requireOnboardingPageAuth, async function (_req, res, next) {
    try {
-      if (thinClientBaseUrl) {
+      if (bridgeBaseUrl) {
        const response = await fetchThinClient(_req, '/api/onboarding/screens', {
          method: 'GET'
        });
@@ -361,7 +372,7 @@ function registerPlayerOnboardingRoutes(app, options) {
      if (!deviceId) {
        return res.status(400).json({ error: 'Device ID is required' });
      }
-      const onboardingUrl = `${getPublicBaseUrl(req, playerPublicBaseUrl)}/onboard?deviceId=${encodeURIComponent(deviceId)}`;
+      const onboardingUrl = `${getPublicBaseUrl(req, playerPublicUrl)}/onboard?deviceId=${encodeURIComponent(deviceId)}`;
      const svg = await createStyledQrCodeSvg({ value: onboardingUrl, qr_margin: 20 });
      res.set('Content-Type', 'image/svg+xml; charset=utf-8');
      res.set('Cache-Control', 'no-store');
@@ -382,11 +393,11 @@ function registerPlayerOnboardingRoutes(app, options) {
        return res.status(429).json({ error: 'Too many onboarding attempts. Please try again later.' });
      }

-      if (thinClientBaseUrl) {
+      if (bridgeBaseUrl) {
        const forwardedBody = Object.assign({}, req.body || {}, {
          deviceId: deviceId
        });
-        const response = await fetch(new URL('/api/onboarding', thinClientBaseUrl).toString(), {
+        const response = await fetch(new URL('/api/onboarding', bridgeBaseUrl).toString(), {
          method: 'POST',
          headers: Object.assign({
            'content-type': 'application/json'
@@ -402,7 +413,7 @@ function registerPlayerOnboardingRoutes(app, options) {
        if (!payload) {
          return res.status(502).json({ error: 'Player bridge returned an invalid response.' });
        }
-        payload.playerUrl = payload && payload.screenSlug ? `${getPublicBaseUrl(req, playerPublicBaseUrl)}/screen/${encodeURIComponent(payload.screenSlug)}` : `${getPublicBaseUrl(req, playerPublicBaseUrl)}/screen/${encodeURIComponent(screenSlug)}`;
+        payload.playerUrl = payload && payload.screenSlug ? `${getPublicBaseUrl(req, playerPublicUrl)}/screen/${encodeURIComponent(payload.screenSlug)}` : `${getPublicBaseUrl(req, playerPublicUrl)}/screen/${encodeURIComponent(screenSlug)}`;
        return res.json(payload);
      }
      if (!deviceId) {
@@ -423,7 +434,7 @@ function registerPlayerOnboardingRoutes(app, options) {
        screenId: status && status.screen_id ? status.screen_id : null,
        screenSlug: status ? status.screen_slug : screenSlug,
        screenName: status && status.screen_name ? status.screen_name : null,
-        playerUrl: status && status.screen_slug ? `${getPublicBaseUrl(req, playerPublicBaseUrl)}/screen/${encodeURIComponent(status.screen_slug)}` : `${getPublicBaseUrl(req, playerPublicBaseUrl)}/screen/${encodeURIComponent(screenSlug)}`,
+        playerUrl: status && status.screen_slug ? `${getPublicBaseUrl(req, playerPublicUrl)}/screen/${encodeURIComponent(status.screen_slug)}` : `${getPublicBaseUrl(req, playerPublicUrl)}/screen/${encodeURIComponent(screenSlug)}`,
        queued: Boolean(status && status.queued)
      });
    } catch (error) {
@@ -7,6 +7,12 @@
    var form = document.getElementById("onboarding-form");
    var message = document.getElementById("onboarding-message");
    var screenSelect = document.getElementById("onboarding-screen-select");
+    function getSessionStorageItem(key) {
+      try { return window.sessionStorage.getItem(key) || ""; } catch (_error) { return ""; }
+    }
+    function setSessionStorageItem(key, value) {
+      try { window.sessionStorage.setItem(key, value); } catch (_error) {}
+    }
    function setMessage(value) { if (message) { message.textContent = value || ""; } }
      function parseResponseError(response) {
        return response.text().then(function (text) {
@@ -41,19 +47,17 @@
    }
    try {
      if (!deviceId) {
-        deviceId = window.localStorage.getItem(deviceKey) || "";
+        deviceId = window.sessionStorage.getItem(deviceKey) || "";
      }
      if (deviceId) {
-        window.localStorage.setItem(deviceKey, deviceId);
+        window.sessionStorage.setItem(deviceKey, deviceId);
      }
    } catch (_error) {}
    loadScreens().then(function () {
      try {
-        var storedClientName = window.localStorage.getItem(clientNameKey) || "";
-        var storedScreenSlug = window.localStorage.getItem(screenKey) || "";
+        var storedClientName = getSessionStorageItem(clientNameKey) || "";
        var clientNameInput = form.querySelector("input[name=\"clientName\"]");
        if (clientNameInput && storedClientName) { clientNameInput.value = storedClientName; }
-        if (screenSelect && storedScreenSlug) { screenSelect.value = storedScreenSlug; }
      } catch (_error) {}
    });
    form.addEventListener("submit", function (event) {
@@ -83,7 +87,7 @@
         })
        .then(function (payload) {
          if (!payload || !payload.screenSlug) { throw new Error("Unable to save onboarding."); }
-          if (payload.clientName) { try { window.localStorage.setItem(clientNameKey, payload.clientName); } catch (_error) {} }
+          if (payload.clientName) { setSessionStorageItem(clientNameKey, payload.clientName); }
          try { window.localStorage.setItem(screenKey, payload.screenSlug); } catch (_error) {}
          setMessage("Onboarding complete.");
          if (form) {
@@ -2,6 +2,12 @@
  (function () {
    var deviceKey = "pulse-signage-player-device-id";
    var clientNameKey = "pulse-signage-player-client-name";
+    function getSessionStorageItem(key) {
+      try { return window.sessionStorage.getItem(key) || ""; } catch (_error) { return ""; }
+    }
+    function setSessionStorageItem(key, value) {
+      try { window.sessionStorage.setItem(key, value); } catch (_error) {}
+    }
    function getClientNameStorageKey(_screenSlug) {
      return clientNameKey;
    }
@@ -25,10 +31,10 @@
    }
    function getDeviceId() {
      var stored = "";
-      try { stored = window.localStorage.getItem(deviceKey) || ""; } catch (_error) { stored = ""; }
+      try { stored = window.sessionStorage.getItem(deviceKey) || ""; } catch (_error) { stored = ""; }
      if (stored) { return stored; }
      var next = (window.crypto && window.crypto.randomUUID ? window.crypto.randomUUID() : "device-" + Date.now() + "-" + Math.random().toString(16).slice(2));
-      try { window.localStorage.setItem(deviceKey, next); } catch (_error2) {}
+      try { window.sessionStorage.setItem(deviceKey, next); } catch (_error2) {}
      return next;
    }
    function setStatus(message) { if (status) { status.textContent = message; } }
@@ -83,8 +89,8 @@
        })
        .then(function (payload) {
          if (!payload || !payload.screenSlug) { throw new Error("Unable to save onboarding."); }
-          if (payload.clientName) { try { window.localStorage.setItem(clientNameKey, payload.clientName); } catch (_error) {} }
-          if (payload.clientName && payload.screenSlug) { try { window.localStorage.setItem(getClientNameStorageKey(payload.screenSlug), payload.clientName); } catch (_error2) {} }
+          if (payload.clientName) { setSessionStorageItem(clientNameKey, payload.clientName); }
+          if (payload.clientName && payload.screenSlug) { setSessionStorageItem(getClientNameStorageKey(payload.screenSlug), payload.clientName); }
          try { window.localStorage.setItem(screenKey, payload.screenSlug); } catch (_error) {}
          setLocalMessage("Onboarding complete.");
          if (localForm) {
@@ -99,8 +105,8 @@
        .then(function (response) { return response.ok ? response.json() : null; })
        .then(function (payload) {
          if (payload && payload.onboarded && payload.screenSlug) {
-            if (payload.clientName) { try { window.localStorage.setItem(clientNameKey, payload.clientName); } catch (_error) {} }
-            if (payload.clientName && payload.screenSlug) { try { window.localStorage.setItem(getClientNameStorageKey(payload.screenSlug), payload.clientName); } catch (_error2) {} }
+            if (payload.clientName) { setSessionStorageItem(clientNameKey, payload.clientName); }
+            if (payload.clientName && payload.screenSlug) { setSessionStorageItem(getClientNameStorageKey(payload.screenSlug), payload.clientName); }
            try { window.localStorage.setItem(screenKey, payload.screenSlug); } catch (_error) {}
            window.location.replace("/screen/" + encodeURIComponent(payload.screenSlug));
            return true;
@@ -126,14 +132,11 @@
    }
    loadScreens().then(function () {
      try {
-        var storedScreenSlug = window.localStorage.getItem(screenKey) || "";
-        var storedClientName = window.localStorage.getItem(clientNameKey) || "";
-        if (!storedClientName && storedScreenSlug) { storedClientName = window.localStorage.getItem(getClientNameStorageKey(storedScreenSlug)) || ""; }
+        var storedClientName = getSessionStorageItem(clientNameKey) || "";
        if (storedClientName && localForm) {
          var clientNameInput = localForm.querySelector("input[name=\"clientName\"]");
          if (clientNameInput) { clientNameInput.value = storedClientName; }
        }
-        if (storedScreenSlug && localScreenSelect) { localScreenSelect.value = storedScreenSlug; }
      } catch (_error) {}
    });
    redirectIfOnboarded(deviceId).then(function (redirected) {
@@ -4,10 +4,31 @@
  const onboardingClientNameStorageKey = 'pulse-signage-player-client-name';
  const onboardingDeviceIdStorageKey = 'pulse-signage-player-device-id';

+  function getSessionStorageItem(key) {
+    try {
+      return window.sessionStorage.getItem(key) || '';
+    } catch (_error) {
+      return '';
+    }
+  }
+
+  function setSessionStorageItem(key, value) {
+    try {
+      window.sessionStorage.setItem(key, value);
+    } catch (_error) {
+      // ignore storage errors
+    }
+  }
+
  function getOnboardingDeviceId() {
    try {
-      var storedDeviceId = window.localStorage.getItem(onboardingDeviceIdStorageKey) || '';
-      return String(storedDeviceId || '').trim();
+      var storedDeviceId = getSessionStorageItem(onboardingDeviceIdStorageKey);
+      if (storedDeviceId) {
+        return String(storedDeviceId || '').trim();
+      }
+      var nextDeviceId = window.crypto && window.crypto.randomUUID ? window.crypto.randomUUID() : 'device-' + Date.now() + '-' + Math.random().toString(16).slice(2);
+      setSessionStorageItem(onboardingDeviceIdStorageKey, nextDeviceId);
+      return String(nextDeviceId || '').trim();
    } catch (_error) {
      return '';
    }
@@ -19,24 +40,14 @@
      return onboardingClientName;
    }
    try {
-      var storedClientName = window.localStorage.getItem(onboardingClientNameStorageKey);
+      var storedClientName = getSessionStorageItem(onboardingClientNameStorageKey);
      if (storedClientName) {
        onboardingClientName = storedClientName;
-        try {
-          window.localStorage.setItem('pulse-signage-player-client-name', storedClientName);
-        } catch (_mirrorError) {
-          // ignore storage errors
-        }
        return onboardingClientName;
      }
-      var genericClientName = window.localStorage.getItem('pulse-signage-player-client-name');
+      var genericClientName = getSessionStorageItem('pulse-signage-player-client-name');
      if (genericClientName) {
        onboardingClientName = genericClientName;
-        try {
-          window.localStorage.setItem(onboardingClientNameStorageKey, genericClientName);
-        } catch (_error) {
-          // ignore storage errors
-        }
        return onboardingClientName;
      }
    } catch (_error) {
@@ -51,12 +62,8 @@
      return;
    }
    onboardingClientName = normalizedName;
-    try {
-      window.localStorage.setItem('pulse-signage-player-client-name', normalizedName);
-      window.localStorage.setItem(onboardingClientNameStorageKey, normalizedName);
-    } catch (_error) {
-      // ignore storage errors
-    }
+    setSessionStorageItem('pulse-signage-player-client-name', normalizedName);
+    setSessionStorageItem(onboardingClientNameStorageKey, normalizedName);
    if (socket && socket.readyState === WebSocket.OPEN) {
      sendCommandState(socket);
    }
@@ -7,7 +7,7 @@
    <link rel="icon" type="image/png" href="/assets/favicon.png" />
    <link rel="stylesheet" href="/assets/adminlte/bootstrap-icons/css/bootstrap-icons.min.css" />
    <link rel="stylesheet" href="/assets/vendor/animate.css/animate.min.css" />
-    <link rel="stylesheet" href="/assets/css/player.css?v=36" />
+    <link rel="stylesheet" href="/assets/css/player.css?v=37" />
    {{{STYLESHEETS}}}
  </head>
  <body class="{{BODY_CLASS}}">
@@ -9,6 +9,8 @@ function createPlayerPlaylistService(options) {
  const pool = options && options.pool ? options.pool : null;
  const common = options && options.common ? options.common : null;
  const snapshotDir = options && options.snapshotDir ? options.snapshotDir : null;
+  const mediaDir = options && options.mediaDir ? path.resolve(String(options.mediaDir)) : null;
+  const remoteImageCacheDir = mediaDir ? path.join(mediaDir, 'player-cache', 'remote-images') : null;

  if (!pool) {
    throw new Error('pool is required');
@@ -61,6 +63,105 @@ function createPlayerPlaylistService(options) {
    return createStyledQrCodeDataUrl(value);
  }

+  function getPlaceholderImageExpressions(value, output) {
+    const expressions = output || [];
+    const source = String(value || '');
+    const pattern = /\{\{\s*([^{}]*?\.image\s*\([^{}]*\)[^{}]*?)\s*\}\}/gi;
+    let match = null;
+    while ((match = pattern.exec(source))) {
+      expressions.push(String(match[1] || '').trim());
+    }
+    return expressions;
+  }
+
+  function resolvePathValue(value, expression) {
+    const parsed = String(expression || '').replace(/\.image\s*\([^)]*\)\s*$/i, '').trim();
+    return parsed.split('.').reduce(function (current, segment) {
+      return current === undefined || current === null ? '' : current[segment];
+    }, value);
+  }
+
+  function getApiItems(responseJson, itemsPath) {
+    let current = responseJson;
+    const pathValue = String(itemsPath || '').trim();
+    if (pathValue) {
+      pathValue.split('.').forEach(function (segment) {
+        current = current === undefined || current === null ? '' : current[segment];
+      });
+      return Array.isArray(current) ? current : [];
+    }
+    if (Array.isArray(responseJson)) return responseJson;
+    if (responseJson && Array.isArray(responseJson.items)) return responseJson.items;
+    if (responseJson && Array.isArray(responseJson.results)) return responseJson.results;
+    if (responseJson && Array.isArray(responseJson.data)) return responseJson.data;
+    return responseJson ? [responseJson] : [];
+  }
+
+  async function cacheRemoteImage(url) {
+    const remoteUrl = String(url || '').trim();
+    if (!remoteImageCacheDir || !/^https?:\/\//i.test(remoteUrl)) return '';
+    const hash = crypto.createHash('sha256').update(remoteUrl).digest('hex');
+    await fs.promises.mkdir(remoteImageCacheDir, { recursive: true });
+    const existing = (await fs.promises.readdir(remoteImageCacheDir)).find(function (name) { return name.startsWith(hash + '.'); });
+    if (existing) return '/media/player-cache/remote-images/' + existing;
+    try {
+      const response = await fetch(remoteUrl, { signal: AbortSignal.timeout(15000) });
+      if (!response.ok || !String(response.headers.get('content-type') || '').toLowerCase().startsWith('image/')) return '';
+      const bytes = Buffer.from(await response.arrayBuffer());
+      if (bytes.length > 10 * 1024 * 1024) return '';
+      const contentType = String(response.headers.get('content-type') || '').toLowerCase();
+      const extension = contentType.includes('svg') ? '.svg' : contentType.includes('png') ? '.png' : contentType.includes('webp') ? '.webp' : contentType.includes('gif') ? '.gif' : '.jpg';
+      const fileName = hash + extension;
+      const filePath = path.join(remoteImageCacheDir, fileName);
+      await fs.promises.writeFile(filePath, bytes);
+      return '/media/player-cache/remote-images/' + fileName;
+    } catch (_error) {
+      return '';
+    }
+  }
+
+  async function cachePlaceholderImages(slides, rssFeeds, apiSources) {
+    if (!remoteImageCacheDir) return;
+    const usedPaths = new Set();
+    const allSlideRows = await pool.query('SELECT content_json FROM c_slides').then(function (result) { return result[0] || []; });
+    const allContents = allSlideRows.map(function (row) { return common.parseJsonSafe(row.content_json) || {}; });
+    const sourceContent = allContents.concat((slides || []).map(function (slide) { return slide.content || {}; }));
+    const cacheSource = async function (source, item, expressions) {
+      if (!source || !item) return;
+      for (const expression of expressions) {
+        const remoteUrl = String(resolvePathValue(item, expression) || '').trim();
+        const localPath = await cacheRemoteImage(remoteUrl);
+        if (localPath) {
+          source.imageCache = source.imageCache || {};
+          source.imageCache[remoteUrl] = localPath;
+          usedPaths.add(localPath);
+        }
+      }
+    };
+    for (const content of sourceContent) {
+      for (const key of Object.keys(content || {})) {
+        const region = content[key];
+        if (!region || typeof region !== 'object') continue;
+        const expressions = getPlaceholderImageExpressions(region.value, []);
+        if (!expressions.length) continue;
+        const itemNumber = Math.max(1, Number(region.item_number || 1)) - 1;
+        if (String(region.type || '').toLowerCase() === 'api') {
+          const source = (apiSources || []).find(function (entry) { return Number(entry.id) === Number(region.source_id); });
+          const items = source ? getApiItems(source.responseJson, region.items_path) : [];
+          await cacheSource(source, items[itemNumber], expressions);
+        }
+        if (String(region.type || '').toLowerCase() === 'rss') {
+          const feed = (rssFeeds || []).find(function (entry) { return Number(entry.id) === Number(region.feed_id); });
+          await cacheSource(feed, feed && feed.items && feed.items[itemNumber], expressions);
+        }
+      }
+    }
+    const files = await fs.promises.readdir(remoteImageCacheDir).catch(function () { return []; });
+    await Promise.all(files.filter(function (file) { return !usedPaths.has('/media/player-cache/remote-images/' + file); }).map(function (file) {
+      return fs.promises.unlink(path.join(remoteImageCacheDir, file)).catch(function () {});
+    }));
+  }
+
  async function buildScreenPlaylist(slug) {
    try {
      const [screenRows] = await pool.query('SELECT id, name, slug, playlist_id, created_at, modified_at, created_by, modified_by FROM d_screens WHERE slug = ?', [slug]);
@@ -241,6 +342,8 @@ function createPlayerPlaylistService(options) {
        timetableGroups = Array.isArray(timetableData && timetableData.timetableGroups) ? timetableData.timetableGroups : [];
      }

+      await cachePlaceholderImages(slides, rssFeeds, apiSources);
+
      const revision = getPlaylistRevision(screen, playlist, slideRows, scheduleRuleRows, templateRows, regionRows, rssFeeds, apiSources, timetableGroups);
      const payload = { screen: screen, playlist: playlist, slides: slides, rssFeeds: rssFeeds, apiSources: apiSources, timetableGroups: timetableGroups, revision: revision };
      await writeSnapshot(slug, payload);
@@ -4,7 +4,7 @@ body {
  width: 100%;
  height: 100%;
  overflow: hidden;
-  background: #111;
+  background: #0a0a0a;
  color: #fff;
  font-family: Arial, sans-serif;
 }
@@ -43,7 +43,7 @@ body.thumbnail-preview .player-offline-banner {
  display: flex;
  align-items: center;
  justify-content: center;
-  background: #111;
+  background: #0a0a0a;
  position: relative;
 }

@@ -294,15 +294,6 @@ body.screen-blackout #app {
  display: block;
 }

-.slide img,
-.slide video,
-.slide iframe {
-  width: 100%;
-  height: 100%;
-  object-fit: contain;
-  border: 0;
-}
-
 .body {
  position: absolute;
  left: 5%;
@@ -427,6 +427,42 @@ function normalizeBoolean(value) {
  return null;
 }

+function isEditableTarget(target) {
+  if (!target) {
+    return false;
+  }
+
+  if (target.isContentEditable) {
+    return true;
+  }
+
+  var tagName = String(target.tagName || '').toUpperCase();
+  return ['INPUT', 'TEXTAREA', 'SELECT', 'OPTION'].indexOf(tagName) !== -1;
+}
+
+function handlePlayerKeydown(event) {
+  if (!event || event.defaultPrevented || event.altKey || event.ctrlKey || event.metaKey) {
+    return;
+  }
+
+  if (isEditableTarget(event.target)) {
+    return;
+  }
+
+  if (event.key === 'ArrowLeft') {
+    event.preventDefault();
+    navigateSlides(-1);
+    return;
+  }
+
+  if (event.key === 'ArrowRight') {
+    event.preventDefault();
+    navigateSlides(1);
+  }
+}
+
+window.addEventListener('keydown', handlePlayerKeydown);
+
 // Move to the previous or next active slide.
 function navigateSlides(offset) {
  const manualSlides = getCurrentActiveSlides();
@@ -70,6 +70,7 @@ function applyPendingPlaylistUpdate() {
  if (!pendingPlaylistUpdate) {
    return false;
  }
+  var nextIndex = Number(index || 0);
  slides = pendingPlaylistUpdate.slides;
  currentPlaylistSignature = pendingPlaylistUpdate.signature;
  currentPlaylistFadeBetweenSlides = pendingPlaylistUpdate.fadeBetweenSlides;
@@ -80,7 +81,11 @@ function applyPendingPlaylistUpdate() {
  templateLayoutCache = Object.create(null);
  templateRenderPlanCache = Object.create(null);
  renderCacheViewportKey = window.innerWidth + 'x' + window.innerHeight;
-  index = 0;
+  const activeSlides = getCurrentActiveSlides();
+  if (!Number.isFinite(nextIndex) || nextIndex < 0) {
+    nextIndex = 0;
+  }
+  index = activeSlides.length ? Math.min(nextIndex, activeSlides.length - 1) : 0;
  logDebug('Applied updated playlist on slide transition.');
  return true;
 }
@@ -184,6 +189,15 @@ function refresh() {
      const nextActiveSlides = getActiveSlidesFrom(nextSlides);
      const nextFadeBetweenSlides = Boolean(data && data.playlist && data.playlist.fade_between_slides);
      const nextSkipUnavailableRtmp = Boolean(data && data.playlist && data.playlist.skip_unavailable_rtmp);
+      if (window.initialData && typeof window.initialData === 'object') {
+        window.initialData.screen = data.screen || window.initialData.screen || null;
+        window.initialData.playlist = data.playlist || null;
+        window.initialData.slides = nextSlides;
+        window.initialData.rssFeeds = Array.isArray(data.rssFeeds) ? data.rssFeeds : [];
+        window.initialData.apiSources = Array.isArray(data.apiSources) ? data.apiSources : [];
+        window.initialData.timetableGroups = Array.isArray(data.timetableGroups) ? data.timetableGroups : [];
+        window.initialData.revision = nextSignature;
+      }
      savePlaylistSnapshot({
        slides: nextSlides,
        signature: nextSignature,
@@ -188,13 +188,13 @@ function syncWebpagePreloads(sourceSlides, targetIndex) {
  preloadSignature = signature;
 }

-// Return a stable client id for this browser session.
+// Return a stable client id for this screen session.
 function getCommandClientId() {
  if (commandClientId) {
    return commandClientId;
  }
  try {
-    var storedClientId = window.localStorage.getItem(commandClientStorageKey);
+    var storedClientId = window.sessionStorage.getItem(commandClientStorageKey);
    if (storedClientId) {
      commandClientId = storedClientId;
      return commandClientId;
@@ -204,7 +204,7 @@ function getCommandClientId() {
  }
  commandClientId = (window.crypto && window.crypto.randomUUID ? window.crypto.randomUUID() : 'client-' + Date.now() + '-' + Math.random().toString(16).slice(2));
  try {
-    window.localStorage.setItem(commandClientStorageKey, commandClientId);
+    window.sessionStorage.setItem(commandClientStorageKey, commandClientId);
  } catch (_error2) {
    // ignore storage errors
  }
@@ -4,6 +4,14 @@ function sanitizeFontFamily(value) {
  return String(value || '').replace(/[^a-zA-Z0-9 ,\"-]/g, '').trim();
 }

+function normalizeStyleAttributeValue(value) {
+  return String(value || '')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&amp;quot;/g, '"')
+    .replace(/&amp;#39;/g, "'");
+}
+
 // Clamp font size to the supported range.
 function sanitizeFontSize(value) {
  return Math.max(8, Number(value || 0) || 24);
@@ -334,7 +342,7 @@ function setPlayerCanvasDimensions(canvasWidth, canvasHeight) {
  document.documentElement.style.setProperty('--player-canvas-height', height + 'px');
 }

-const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
+const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];

 function sanitizeRichTextAttributes(tagName, attrText) {
  const allowedAttributes = {
@@ -349,14 +357,19 @@ function sanitizeRichTextAttributes(tagName, attrText) {
    h4: ['class', 'style'],
    h5: ['class', 'style'],
    h6: ['class', 'style'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'class', 'style', 'loading', 'decoding'],
+    col: ['class', 'style', 'span', 'width'],
+    colgroup: ['class', 'style', 'span'],
    li: ['class', 'style'],
    ol: ['class', 'style', 'start'],
    p: ['class', 'style'],
    pre: ['class', 'style'],
    span: ['class', 'style'],
    table: ['class', 'style'],
+    tbody: ['class', 'style'],
    td: ['class', 'style', 'colspan', 'rowspan'],
    th: ['class', 'style', 'colspan', 'rowspan', 'scope'],
+    thead: ['class', 'style'],
    tr: ['class', 'style'],
    ul: ['class', 'style']
  };
@@ -365,6 +378,14 @@ function sanitizeRichTextAttributes(tagName, attrText) {
    return '';
  }

+  if (tagName === 'img') {
+    const srcMatch = String(attrText || '').match(/\bsrc\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+))/i);
+    const srcValue = srcMatch ? String(srcMatch[2] !== undefined ? srcMatch[2] : srcMatch[3] !== undefined ? srcMatch[3] : srcMatch[4] !== undefined ? srcMatch[4] : '').trim() : '';
+    if (!srcValue || !/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/]|data:image\/)/i.test(srcValue)) {
+      return '';
+    }
+  }
+
  const attrs = [];
  String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) => {
    const lowerKey = String(key || '').toLowerCase();
@@ -388,7 +409,7 @@ function sanitizeRichTextAttributes(tagName, attrText) {
        return '';
      }
    }
-    attrs.push(' ' + lowerKey + '="' + escapeHtml(value) + '"');
+    attrs.push(' ' + lowerKey + '="' + escapeHtml(lowerKey === 'style' ? normalizeStyleAttributeValue(value) : value) + '"');
    return '';
  });

@@ -56,7 +56,7 @@ function getApiItem(sourceId, itemNumber, itemsPathOverride) {
  return items[index] || null;
 }

-function substituteApiVariables(html, item) {
+function substituteApiVariables(html, item, sourceId) {
  var source = String(html || '');
  return source.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, function (_match, expression) {
    if (!item || typeof item !== 'object') {
@@ -67,7 +67,25 @@ function substituteApiVariables(html, item) {
      return '';
    }

-    return escapeHtml(placeholderUtils.formatPlaceholderValue(placeholderUtils.resolvePlaceholderExpression(item, expression)));
+    var resolved = placeholderUtils.resolvePlaceholderExpression(item, expression);
+    if (typeof placeholderUtils.isImagePlaceholderExpression === 'function' && placeholderUtils.isImagePlaceholderExpression(expression)) {
+      var imageSource = placeholderUtils.formatPlaceholderValue(resolved);
+      var source = getApiSourceById(sourceId);
+      imageSource = source && source.imageCache && source.imageCache[imageSource] ? source.imageCache[imageSource] : imageSource;
+      if (!/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/])/i.test(imageSource)) {
+        return '';
+      }
+      var imageConfig = typeof placeholderUtils.getImagePlaceholderConfig === 'function' ? placeholderUtils.getImagePlaceholderConfig(expression) : {};
+      var hasImageBounds = imageConfig.width && imageConfig.height;
+      var imageStyle = hasImageBounds
+        ? 'display:block;width:100%;height:100%;object-fit:contain;'
+        : 'display:block;width:auto;height:auto;' + (imageConfig.width ? 'max-width:' + imageConfig.width + 'px;' : '') + (imageConfig.height ? 'max-height:' + imageConfig.height + 'px;' : '');
+      var image = '<img src="' + escapeHtml(imageSource) + '" alt="" style="' + imageStyle + '" />';
+      return hasImageBounds
+        ? '<span style="display:inline-flex;align-items:center;justify-content:center;box-sizing:border-box;width:' + imageConfig.width + 'px;height:' + imageConfig.height + 'px;">' + image + '</span>'
+        : image;
+    }
+    return escapeHtml(placeholderUtils.formatPlaceholderValue(resolved));
  });
 }

@@ -120,10 +138,8 @@ function renderApiRegion(region, regionContent) {
  var fontSize = sanitizeFontSize(regionContent.font_size || region.fontSize);
  var fontColor = sanitizeTextColor(regionContent.font_color || region.fontColor);
  var item = getApiItem(sourceId, itemNumber, itemsPath);
-  var body = item ? substituteApiVariables(content, item) : '';
-  if (!body && item) {
-    body = getApiPreviewFallback(item);
-  }
+  var hasSource = String(sourceId === undefined || sourceId === null ? '' : sourceId).trim() !== '';
+  var body = hasSource ? (item ? substituteApiVariables(content, item, sourceId) : '') : content;
  var contentStyle = 'width:' + region.pixelWidth + 'px;height:' + region.pixelHeight + 'px;transform:scale(' + region.canvasScale + ');transform-origin:top left;' + (fontFamily ? 'font-family:' + escapeHtml(fontFamily) + ';' : '') + 'font-size:' + fontSize + 'px;color:' + escapeHtml(fontColor) + ';';
  if (!body) {
    return '';
@@ -2,16 +2,49 @@

 var registry = window.pulsePlayerRegionTypes;

+function normalizeRenderableValue(value) {
+  if (value && typeof value === 'object') {
+    if (value.value !== undefined) {
+      return normalizeRenderableValue(value.value);
+    }
+    if (value.text !== undefined) {
+      return normalizeRenderableValue(value.text);
+    }
+    if (value.html !== undefined) {
+      return normalizeRenderableValue(value.html);
+    }
+    if (value.content !== undefined) {
+      return normalizeRenderableValue(value.content);
+    }
+    return '';
+  }
+
+  return String(value === undefined || value === null ? '' : value);
+}
+
+function buildHtmlDocument(html) {
+  var raw = String(html || '').trim();
+  if (!raw) {
+    return '';
+  }
+
+  if (/^<!doctype\b/i.test(raw) || /^<html\b/i.test(raw)) {
+    return raw;
+  }
+
+  return '<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + raw + '</body></html>';
+}
+
 function renderHtmlRegionContent(value) {
-  var html = String(value || '').trim();
+  var html = normalizeRenderableValue(value).trim();
  if (!html) {
    return '';
  }
-  return '<iframe class="template-region-html-frame" sandbox="" scrolling="no" srcdoc="<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + escapeHtml(html) + '</body></html>" title="HTML region" loading="eager"></iframe>';
+  return '<iframe class="template-region-html-frame" sandbox="" scrolling="no" srcdoc="' + escapeHtml(buildHtmlDocument(html)) + '" title="HTML region" loading="eager" style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"></iframe>';
 }

 function renderHtmlRegion(region, regionContent) {
-  return '<div class="template-region html" style="' + region.baseStyle + '">' + renderHtmlRegionContent(regionContent.value || '') + '</div>';
+  return '<div class="template-region html" style="' + region.baseStyle + '">' + renderHtmlRegionContent(regionContent && regionContent.value !== undefined ? regionContent.value : '') + '</div>';
 }

 registry.register('html', {
@@ -1,6 +1,7 @@
 // RSS region helpers for resolving feeds, items, and nested values.

 var registry = window.pulsePlayerRegionTypes;
+var placeholderUtils = window.placeholderUtils || {};

 function getDefaultStyle() {
  return {
@@ -63,14 +64,34 @@ function resolveRssPath(value, path) {
  return current === undefined || current === null ? '' : current;
 }

-function substituteRssVariables(html, item) {
+function substituteRssVariables(html, item, feedId) {
  var source = String(html || '');
-  return source.replace(/\{\{\s*([a-zA-Z0-9_]+)(?:\.([a-zA-Z0-9_.]+))?\s*\}\}/g, function (_match, tokenName, tokenPath) {
+  return source.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, function (_match, expression) {
    if (!item || typeof item !== 'object') {
      return '';
    }
-    var key = tokenPath ? tokenName + '.' + tokenPath : tokenName;
-    return escapeHtml(resolveRssPath(item, key || ''));
+    if (typeof placeholderUtils.resolvePlaceholderExpression !== 'function' || typeof placeholderUtils.formatPlaceholderValue !== 'function') {
+      return '';
+    }
+    var resolved = placeholderUtils.resolvePlaceholderExpression(item, expression);
+    if (typeof placeholderUtils.isImagePlaceholderExpression === 'function' && placeholderUtils.isImagePlaceholderExpression(expression)) {
+      var imageSource = placeholderUtils.formatPlaceholderValue(resolved);
+      var feed = getRssFeedById(feedId);
+      imageSource = feed && feed.imageCache && feed.imageCache[imageSource] ? feed.imageCache[imageSource] : imageSource;
+      if (!/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/])/i.test(imageSource)) {
+        return '';
+      }
+      var imageConfig = typeof placeholderUtils.getImagePlaceholderConfig === 'function' ? placeholderUtils.getImagePlaceholderConfig(expression) : {};
+      var hasImageBounds = imageConfig.width && imageConfig.height;
+      var imageStyle = hasImageBounds
+        ? 'display:block;width:100%;height:100%;object-fit:contain;'
+        : 'display:block;width:auto;height:auto;' + (imageConfig.width ? 'max-width:' + imageConfig.width + 'px;' : '') + (imageConfig.height ? 'max-height:' + imageConfig.height + 'px;' : '');
+      var image = '<img src="' + escapeHtml(imageSource) + '" alt="" style="' + imageStyle + '" />';
+      return hasImageBounds
+        ? '<span style="display:inline-flex;align-items:center;justify-content:center;box-sizing:border-box;width:' + imageConfig.width + 'px;height:' + imageConfig.height + 'px;">' + image + '</span>'
+        : image;
+    }
+    return escapeHtml(placeholderUtils.formatPlaceholderValue(resolved));
  });
 }

@@ -83,17 +104,8 @@ function renderRssRegion(region, regionContent) {
  var fontSize = sanitizeFontSize(regionContent.font_size || region.fontSize || defaultStyle.font_size);
  var fontColor = sanitizeTextColor(regionContent.font_color || region.fontColor || defaultStyle.font_color);
  var item = getRssFeedItem(feedId, itemNumber);
-  var body = item ? substituteRssVariables(content, item) : '';
-  if (!body && item) {
-    var summaryParts = [];
-    if (item.title) {
-      summaryParts.push('<h3>' + escapeHtml(item.title) + '</h3>');
-    }
-    if (item.description) {
-      summaryParts.push('<div>' + sanitizeRichText(item.description) + '</div>');
-    }
-    body = summaryParts.join('');
-  }
+  var hasFeed = String(feedId === undefined || feedId === null ? '' : feedId).trim() !== '';
+  var body = hasFeed ? (item ? substituteRssVariables(content, item, feedId) : '') : content;
  var contentStyle = 'width:' + region.pixelWidth + 'px;height:' + region.pixelHeight + 'px;transform:scale(' + region.canvasScale + ');transform-origin:top left;' + (fontFamily ? 'font-family:' + escapeHtml(fontFamily) + ';' : '') + 'font-size:' + fontSize + 'px;color:' + escapeHtml(fontColor) + ';';
  if (!body) {
    return '';
@@ -1,6 +1,7 @@
 // Time/date region rendering and live updates.

 var registry = window.pulsePlayerRegionTypes;
+var placeholderUtils = window.placeholderUtils || {};
 var DEFAULT_FORMAT = '{{hh}}:{{mm}}';
 var DEFAULT_STYLE = {
  font_family: 'Arial',
@@ -9,15 +10,6 @@ var DEFAULT_STYLE = {
 };
 var timeDateFormatterCache = Object.create(null);

-function escapeHtml(value) {
-  return String(value === undefined || value === null ? '' : value)
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;');
-}
-
 function sanitizeTagAttributes(tagName, attrText) {
  var allowedAttributes = {
    a: ['href', 'title', 'target', 'rel', 'class', 'style'],
@@ -133,7 +125,7 @@ function resolveTimeZone(value) {
  }
 }

-function getFormatter(key, options) {
+function getTimeDateFormatter(key, options) {
  if (!timeDateFormatterCache[key]) {
    timeDateFormatterCache[key] = new Intl.DateTimeFormat('en-GB', options);
  }
@@ -141,10 +133,10 @@ function getFormatter(key, options) {
  return timeDateFormatterCache[key];
 }

-function getFormattedParts(timeZone, date) {
+function getTimeDateFormattedParts(timeZone, date) {
  var targetDate = date instanceof Date ? date : new Date();
  var resolvedTimeZone = resolveTimeZone(timeZone);
-  var numericParts = getFormatter('numeric:' + resolvedTimeZone, {
+  var numericParts = getTimeDateFormatter('numeric:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    hour12: false,
    hour: '2-digit',
@@ -154,29 +146,29 @@ function getFormattedParts(timeZone, date) {
    month: '2-digit',
    year: 'numeric'
  }).formatToParts(targetDate);
-  var weekdayLong = getFormatter('weekday-long:' + resolvedTimeZone, {
+  var weekdayLong = getTimeDateFormatter('weekday-long:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    weekday: 'long'
  }).formatToParts(targetDate);
-  var weekdayShort = getFormatter('weekday-short:' + resolvedTimeZone, {
+  var weekdayShort = getTimeDateFormatter('weekday-short:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    weekday: 'short'
  }).formatToParts(targetDate);
-  var monthLong = getFormatter('month-long:' + resolvedTimeZone, {
+  var monthLong = getTimeDateFormatter('month-long:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    month: 'long'
  }).formatToParts(targetDate);
-  var monthShort = getFormatter('month-short:' + resolvedTimeZone, {
+  var monthShort = getTimeDateFormatter('month-short:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    month: 'short'
  }).formatToParts(targetDate);
-  var ampm = getFormatter('ampm:' + resolvedTimeZone, {
+  var ampm = getTimeDateFormatter('ampm:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    hour12: true,
    hour: '2-digit',
    minute: '2-digit'
  }).formatToParts(targetDate);
-  var timezoneShort = getFormatter('tz-short:' + resolvedTimeZone, {
+  var timezoneShort = getTimeDateFormatter('tz-short:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    timeZoneName: 'short'
  }).formatToParts(targetDate);
@@ -213,27 +205,28 @@ function getFormattedParts(timeZone, date) {
    MMM: toTitleCase(getPart(monthShort, 'month')),
    MMMM: toTitleCase(getPart(monthLong, 'month')),
    a: toTitleCase(getPart(ampm, 'dayPeriod')),
-    tz: resolvedTimeZone,
-    tz_short: getPart(timezoneShort, 'timeZoneName'),
+      tz: getPart(timezoneShort, 'timeZoneName'),
+      tz_long: resolvedTimeZone,
    date: getPart(numericParts, 'year') + '-' + getPart(numericParts, 'month') + '-' + getPart(numericParts, 'day'),
    time: getPart(numericParts, 'hour') + ':' + getPart(numericParts, 'minute') + ':' + getPart(numericParts, 'second')
  };
 }

-function resolveTimeDatePlaceholder(values, expression) {
-  if (typeof placeholderUtils.resolvePlaceholderExpression === 'function' && typeof placeholderUtils.formatPlaceholderValue === 'function') {
-    return placeholderUtils.formatPlaceholderValue(placeholderUtils.resolvePlaceholderExpression(values, expression));
+function resolveTimeDateTemplatePlaceholder(values, expression) {
+  var currentPlaceholderUtils = window.placeholderUtils || placeholderUtils || {};
+  if (typeof currentPlaceholderUtils.resolvePlaceholderExpression === 'function' && typeof currentPlaceholderUtils.formatPlaceholderValue === 'function') {
+    return currentPlaceholderUtils.formatPlaceholderValue(currentPlaceholderUtils.resolvePlaceholderExpression(values, expression));
  }

  var parsed = String(expression || '').trim();
  return Object.prototype.hasOwnProperty.call(values, parsed) ? values[parsed] : '';
 }

-function renderTemplate(format, timeZone, date) {
+function renderTimeDateTemplate(format, timeZone, date) {
  var template = String(format || '').trim() || DEFAULT_FORMAT;
-  var values = getFormattedParts(timeZone, date);
+  var values = getTimeDateFormattedParts(timeZone, date);
  return template.replace(/\{\{\s*([a-zA-Z0-9_.()\-]+)\s*\}\}/g, function (_match, key) {
-    return String(resolveTimeDatePlaceholder(values, key) || '');
+    return String(resolveTimeDateTemplatePlaceholder(values, key, { timeZone: timeZone }) || '');
  });
 }

@@ -257,7 +250,7 @@ function renderTimeDateRegion(region, regionContent) {
  var fontSize = style.font_size ? 'font-size:' + Math.max(1, Math.round(Number(style.font_size))) + 'px;' : '';
  var fontColor = style.font_color ? 'color:' + escapeHtml(style.font_color) + ';' : '';
  var contentStyle = 'width:' + region.pixelWidth + 'px;height:' + region.pixelHeight + 'px;transform:scale(' + region.canvasScale + ');transform-origin:top left;' + (fontFamily ? fontFamily : '') + fontSize + fontColor + 'white-space:pre-wrap;line-height:1.1;';
-  var renderedText = renderTemplate(format, timeZone, new Date());
+  var renderedText = renderTimeDateTemplate(format, timeZone, new Date());
  return '<div class="template-region time-date" data-time-date-format="' + escapeHtml(format) + '" data-time-date-timezone="' + escapeHtml(timeZone) + '" style="' + region.baseStyle + '"><div class="template-region-text-scale" style="' + contentStyle + '">' + renderEditorJsContent(renderedText) + '</div></div>';
 }

@@ -273,7 +266,7 @@ function updateTimeDateRegion(element) {
    return;
  }

-  scaleWrapper.innerHTML = renderEditorJsContent(renderTemplate(format, timeZone, new Date()));
+  scaleWrapper.innerHTML = renderEditorJsContent(renderTimeDateTemplate(format, timeZone, new Date()));
 }

 function scheduleTimeDateRegionUpdate(element) {
@@ -2,101 +2,6 @@

 var registry = window.pulsePlayerRegionTypes;

-function escapeHtml(value) {
-  return String(value === undefined || value === null ? '' : value)
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;');
-}
-
-function sanitizeRichTextAttributes(tagName, attrText) {
-  var allowedAttributes = {
-    a: ['href', 'title', 'target', 'rel', 'class', 'style'],
-    blockquote: ['class', 'style'],
-    col: ['class', 'style', 'span', 'width'],
-    colgroup: ['class', 'style', 'span'],
-    div: ['class', 'style'],
-    figure: ['class', 'style'],
-    figcaption: ['class', 'style'],
-    h1: ['class', 'style'],
-    h2: ['class', 'style'],
-    h3: ['class', 'style'],
-    h4: ['class', 'style'],
-    h5: ['class', 'style'],
-    h6: ['class', 'style'],
-    li: ['class', 'style'],
-    ol: ['class', 'style', 'start'],
-    p: ['class', 'style'],
-    pre: ['class', 'style'],
-    span: ['class', 'style'],
-    table: ['class', 'style'],
-    tbody: ['class', 'style'],
-    td: ['class', 'style', 'colspan', 'rowspan'],
-    th: ['class', 'style', 'colspan', 'rowspan', 'scope'],
-    thead: ['class', 'style'],
-    tr: ['class', 'style'],
-    ul: ['class', 'style']
-  };
-  var allowed = allowedAttributes[tagName] || [];
-  if (!allowed.length) {
-    return '';
-  }
-
-  var attrs = [];
-  String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, function (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) {
-    var lowerKey = String(key || '').toLowerCase();
-    if (allowed.indexOf(lowerKey) === -1) {
-      return '';
-    }
-
-    var value = doubleQuoted !== undefined ? doubleQuoted : singleQuoted !== undefined ? singleQuoted : bareValue !== undefined ? bareValue : '';
-    if (lowerKey === 'href' && /^(?:\s*javascript:|\s*data:)/i.test(String(value || ''))) {
-      return '';
-    }
-    if (lowerKey === 'style' && /(?:expression\s*\(|javascript:|url\s*\()/i.test(String(value || ''))) {
-      return '';
-    }
-    if (lowerKey === 'target') {
-      var targetValue = String(value || '').trim();
-      if (targetValue === '_blank') {
-        attrs.push(' target="_blank"');
-        if (attrs.indexOf(' rel="noreferrer noopener"') === -1) {
-          attrs.push(' rel="noreferrer noopener"');
-        }
-        return '';
-      }
-    }
-    attrs.push(' ' + lowerKey + '="' + escapeHtml(value) + '"');
-    return '';
-  });
-
-  return attrs.join('');
-}
-
-function sanitizeRichText(html) {
-  var output = String(html || '');
-  output = output.replace(/<script[\s\S]*?<\/script>/gi, '');
-  output = output.replace(/<style[\s\S]*?<\/style>/gi, '');
-  return output.replace(/<[^>]+>/g, function (tag) {
-    var match = tag.match(/^<\s*(\/?)\s*([a-z0-9]+)([\s\S]*?)(\/?)>$/i);
-    if (!match) {
-      return '';
-    }
-    var closing = Boolean(match[1]);
-    var name = String(match[2] || '').toLowerCase();
-    var allowed = ['a', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
-    if (allowed.indexOf(name) === -1) {
-      return '';
-    }
-    if (closing) {
-      return '</' + name + '>';
-    }
-    return '<' + name + sanitizeRichTextAttributes(name, String(match[3] || '')) + '>';
-  });
-}
-
 function substituteTimetableVariables(html, entry) {
  var source = String(html || '');
  return source.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, function (_match, expression) {
@@ -228,6 +133,7 @@ function renderRegion(region, regionContent) {
  var maxItems = regionContent && regionContent.max_items !== undefined ? regionContent.max_items : 5;
  var group = getGroupById(groupId, groups);
  var entries = getVisibleEntries(groupId, displayMode, maxItems, groups);
+  var timeZone = group && (group.timezone || group.time_zone) ? String(group.timezone || group.time_zone) : '';
  var width = Math.max(1, Math.round(Number(region && region.pixelWidth ? region.pixelWidth : 0) || 1));
  var height = Math.max(1, Math.round(Number(region && region.pixelHeight ? region.pixelHeight : 0) || 1));
  var canvasScale = Number(region && region.canvasScale ? region.canvasScale : 1) || 1;
@@ -241,6 +147,7 @@ function renderRegion(region, regionContent) {
    return '<div class="timetable-region-entry" data-timetable-entry-index="' + index + '">' + sanitizeRichText(substituteTimetableVariables(value, Object.assign({}, entry || {}, {
      start: entry && entry.start_datetime !== undefined ? entry.start_datetime : '',
      end: entry && entry.end_datetime !== undefined ? entry.end_datetime : '',
+      timeZone: timeZone,
      group: group || {},
      entries: entries,
      index: index + 1
@@ -2,12 +2,38 @@

 var registry = window.pulsePlayerRegionTypes;

+function normalizeRenderableValue(value) {
+  if (value && typeof value === 'object') {
+    if (value.value !== undefined) {
+      return normalizeRenderableValue(value.value);
+    }
+    if (value.text !== undefined) {
+      return normalizeRenderableValue(value.text);
+    }
+    if (value.url !== undefined) {
+      return normalizeRenderableValue(value.url);
+    }
+    if (value.href !== undefined) {
+      return normalizeRenderableValue(value.href);
+    }
+    if (value.src !== undefined) {
+      return normalizeRenderableValue(value.src);
+    }
+    if (value.content !== undefined) {
+      return normalizeRenderableValue(value.content);
+    }
+    return '';
+  }
+
+  return String(value === undefined || value === null ? '' : value);
+}
+
 function renderWebpageRegion(region, regionContent) {
-  var url = String(regionContent.value || '').trim();
+  var url = normalizeRenderableValue(regionContent && regionContent.value !== undefined ? regionContent.value : '').trim();
  if (!url) {
    return '';
  }
-  return '<div class="template-region webpage" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(url) + '" title="' + escapeHtml(region.label) + '" loading="eager" referrerpolicy="no-referrer" scrolling="no"></iframe></div>';
+  return '<div class="template-region webpage" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(url) + '" title="' + escapeHtml(region.label) + '" loading="eager" referrerpolicy="no-referrer" scrolling="no" style="width:100%;height:100%;border:0;display:block;background:#fff;overflow:hidden;"></iframe></div>';
 }

 registry.register('webpage', {
@@ -25,6 +25,14 @@ function escapeHtml(value) {
    .replace(/'/g, '&#39;');
 }

+function normalizeStyleAttributeValue(value) {
+  return String(value || '')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&amp;quot;/g, '"')
+    .replace(/&amp;#39;/g, "'");
+}
+
 function sanitizeFontFamily(value) {
  return String(value || '').replace(/[^a-zA-Z0-9 ,"-]/g, '').trim();
 }
@@ -41,7 +49,7 @@ function sanitizeTextColor(value, fallback) {
  return fallback || '#000000';
 }

-const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
+const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];

 function sanitizeRichTextAttributes(tagName, attrText) {
  const allowedAttributes = {
@@ -56,6 +64,9 @@ function sanitizeRichTextAttributes(tagName, attrText) {
    h4: ['class', 'style'],
    h5: ['class', 'style'],
    h6: ['class', 'style'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'class', 'style', 'loading', 'decoding'],
+    col: ['class', 'style', 'span', 'width'],
+    colgroup: ['class', 'style', 'span'],
    li: ['class', 'style'],
    ol: ['class', 'style', 'start'],
    p: ['class', 'style'],
@@ -72,6 +83,14 @@ function sanitizeRichTextAttributes(tagName, attrText) {
    return '';
  }

+  if (tagName === 'img') {
+    const srcMatch = String(attrText || '').match(/\bsrc\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+))/i);
+    const srcValue = srcMatch ? String(srcMatch[2] !== undefined ? srcMatch[2] : srcMatch[3] !== undefined ? srcMatch[3] : srcMatch[4] !== undefined ? srcMatch[4] : '').trim() : '';
+    if (!srcValue || !/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/]|data:image\/)/i.test(srcValue)) {
+      return '';
+    }
+  }
+
  const attrs = [];
  String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) => {
    const lowerKey = String(key || '').toLowerCase();
@@ -95,7 +114,7 @@ function sanitizeRichTextAttributes(tagName, attrText) {
        return '';
      }
    }
-    attrs.push(' ' + lowerKey + '="' + escapeHtml(value) + '"');
+    attrs.push(' ' + lowerKey + '="' + escapeHtml(lowerKey === 'style' ? normalizeStyleAttributeValue(value) : value) + '"');
    return '';
  });

@@ -268,12 +287,45 @@ function renderEditorJsContent(value) {
  return wrapRichTextParagraph(sanitizeRichText(raw));
 }

+function buildHtmlDocument(html) {
+  const raw = String(html || '').trim();
+  if (!raw) {
+    return '';
+  }
+
+  if (/^<!doctype\b/i.test(raw) || /^<html\b/i.test(raw)) {
+    return raw;
+  }
+
+  return '<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + raw + '</body></html>';
+}
+
 function renderHtmlRegionContent(value) {
-  const html = String(value || '').trim();
+  const html = normalizeRenderableValue(value).trim();
  if (!html) {
    return '<div class="template-region-placeholder">HTML</div>';
  }
-  return '<iframe class="template-region-html-frame" sandbox="" srcdoc="' + escapeHtml(html) + '" title="HTML region" loading="eager"></iframe>';
+  return '<iframe class="template-region-html-frame" sandbox="" srcdoc="' + escapeHtml(buildHtmlDocument(html)) + '" title="HTML region" loading="eager" style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"></iframe>';
+}
+
+function normalizeRenderableValue(value) {
+  if (value && typeof value === 'object') {
+    if (value.value !== undefined) {
+      return normalizeRenderableValue(value.value);
+    }
+    if (value.text !== undefined) {
+      return normalizeRenderableValue(value.text);
+    }
+    if (value.html !== undefined) {
+      return normalizeRenderableValue(value.html);
+    }
+    if (value.content !== undefined) {
+      return normalizeRenderableValue(value.content);
+    }
+    return '';
+  }
+
+  return String(value === undefined || value === null ? '' : value);
 }

 function fitCanvasSize(canvasWidth, canvasHeight, maxWidth, maxHeight) {
@@ -4,6 +4,7 @@ const fs = require('fs');
 const express = require('express');
 const path = require('path');
 const { getSharedSecret, createPageAuthBundle, verifyPageAuthToken, verifyRequestAuth, createRequestAuthHeaders } = require('#src/request-auth');
+const { getPlayerPublicBaseUrl } = require('./onboarding');
 const { buildThumbnailPreviewData } = require('./thumbnail-preview');

 const TRANSIENT_DB_ERROR_CODES = ['ECONNREFUSED', 'ECONNRESET', 'ETIMEDOUT', 'EPIPE', 'ENOTFOUND', 'PROTOCOL_CONNECTION_LOST', 'POOL_CLOSED', 'ERR_POOL_CLOSED'];
@@ -31,23 +32,23 @@ function registerPlayerRoutes(app, options) {
  const playerRuntime = options && options.playerRuntime ? options.playerRuntime : null;
  const playerPlaylistService = options && options.playerPlaylistService ? options.playerPlaylistService : null;
  const rtmpStreamService = options && options.rtmpStreamService ? options.rtmpStreamService : null;
-  const playerPublicBaseUrl = String(options && options.playerPublicBaseUrl || process.env.PLAYER_PUBLIC_BASE_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
-  const playerInternalBaseUrl = String(options && options.playerInternalBaseUrl || process.env.PLAYER_INTERNAL_BASE_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
-  const thinClientBaseUrl = String(options && options.thinClientBaseUrl || process.env.THIN_CLIENT_BASE_URL || '').trim().replace(/\/$/, '');
+  const playerInternalUrl = String(options && options.playerInternalBaseUrl || process.env.PLAYER_INTERNAL_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  const bridgeBaseUrl = String(options && options.bridgeBaseUrl || process.env.BRIDGE_PUBLIC_URL || '').trim().replace(/\/$/, '');
  const playerDeviceId = String(options && options.playerDeviceId || '').trim() || null;
+  const onPlayerPublicBaseUrl = typeof options.onPlayerPublicBaseUrl === 'function' ? options.onPlayerPublicBaseUrl : null;

  if (!app || !common || !mediaDir || !assetDir || !playerRuntime || !rtmpStreamService) {
    throw new Error('registerPlayerRoutes requires app, common, mediaDir, assetDir, playerRuntime, and rtmpStreamService.');
  }

-  if (!thinClientBaseUrl && (!pool || !playerPlaylistService)) {
-    throw new Error('registerPlayerRoutes requires pool and playerPlaylistService unless thinClientBaseUrl is configured.');
+  if (!bridgeBaseUrl && (!pool || !playerPlaylistService)) {
+    throw new Error('registerPlayerRoutes requires pool and playerPlaylistService unless bridgeBaseUrl is configured.');
  }

  const sharedSecret = getSharedSecret();

-  async function fetchThinClient(req, pathname, options) {
-    if (!thinClientBaseUrl) {
+  async function fetchBridge(req, pathname, options) {
+    if (!bridgeBaseUrl) {
      return null;
    }

@@ -71,7 +72,7 @@ function registerPlayerRoutes(app, options) {
      headers['content-type'] = requestOptions.contentType;
    }

-    return fetch(new URL(pathname, thinClientBaseUrl).toString(), {
+    return fetch(new URL(pathname, bridgeBaseUrl).toString(), {
      method: method,
      headers: headers,
      body: body === undefined || body === null || method === 'GET' || method === 'HEAD' ? undefined : body
@@ -179,8 +180,8 @@ function registerPlayerRoutes(app, options) {
  });

  app.get('/api/media/config', requireRequestAuth, function (_req, res) {
-    if (thinClientBaseUrl) {
-      void fetch(new URL('/api/media/config', thinClientBaseUrl).toString(), {
+    if (bridgeBaseUrl) {
+      void fetch(new URL('/api/media/config', bridgeBaseUrl).toString(), {
        method: 'GET',
        headers: createRequestAuthHeaders({
          method: 'GET',
@@ -296,11 +297,18 @@ function registerPlayerRoutes(app, options) {
  });

  app.get('/screen/:slug', function (req, res) {
+    if (onPlayerPublicBaseUrl) {
+      try {
+        onPlayerPublicBaseUrl(getPlayerPublicBaseUrl(req, null));
+      } catch (_error) {
+      }
+    }
+
    res.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
    res.set('Pragma', 'no-cache');
-    if (thinClientBaseUrl) {
+    if (bridgeBaseUrl) {
      const pageAuthToken = createPageAuthBundle({ scope: 'player', slug: String(req.params.slug || '').trim() }).token;
-      void fetchThinClient(req, '/api/screens/' + encodeURIComponent(req.params.slug) + '/playlist?ts=' + Date.now(), {
+      void fetchBridge(req, '/api/screens/' + encodeURIComponent(req.params.slug) + '/playlist?ts=' + Date.now(), {
        method: 'GET',
        headers: pageAuthToken ? { 'x-pulse-page-auth': pageAuthToken } : {}
      }).then(async function (response) {
@@ -342,8 +350,8 @@ function registerPlayerRoutes(app, options) {

  app.get('/api/internal/slide-thumbnails/:id/preview', requireRequestAuth, async function (req, res, next) {
    try {
-      if (thinClientBaseUrl) {
-        const response = await fetchThinClient(req, '/api/internal/slide-thumbnails/' + encodeURIComponent(req.params.id) + '/preview', {
+      if (bridgeBaseUrl) {
+        const response = await fetchBridge(req, '/api/internal/slide-thumbnails/' + encodeURIComponent(req.params.id) + '/preview', {
          method: 'GET'
        });
        if (!response) {
@@ -397,8 +405,8 @@ function registerPlayerRoutes(app, options) {

  app.get('/api/screens/:slug/playlist', requirePageAuth(['player']), async function (req, res, next) {
    try {
-      if (thinClientBaseUrl) {
-        const response = await fetchThinClient(req, '/api/screens/' + encodeURIComponent(req.params.slug) + '/playlist', {
+      if (bridgeBaseUrl) {
+        const response = await fetchBridge(req, '/api/screens/' + encodeURIComponent(req.params.slug) + '/playlist', {
          method: 'GET'
        });
        if (!response) {
@@ -440,8 +448,8 @@ function registerPlayerRoutes(app, options) {

  app.get('/api/screens/:slug/announcement', requirePageAuth(['player']), async function (req, res, next) {
    try {
-      if (thinClientBaseUrl) {
-        const response = await fetchThinClient(req, '/api/screens/' + encodeURIComponent(req.params.slug) + '/announcement', {
+      if (bridgeBaseUrl) {
+        const response = await fetchBridge(req, '/api/screens/' + encodeURIComponent(req.params.slug) + '/announcement', {
          method: 'GET'
        });
        if (!response) {
@@ -21,6 +21,7 @@ function normalizePlayerPublicBaseUrl(pageUrl) {

 function createPlayerRuntime(options) {
  const pool = options && options.pool ? options.pool : null;
+  const notifySnapshot = typeof options.notifySnapshot === 'function' ? options.notifySnapshot : null;
  const normalizeDeviceId = typeof options.normalizeDeviceId === 'function'
    ? options.normalizeDeviceId
    : function (value) {
@@ -44,6 +45,76 @@ function createPlayerRuntime(options) {
    return ip;
  }

+  function firstHeaderValue(value) {
+    return String(value || '').trim().split(',')[0].trim();
+  }
+
+  function isPrivateOrReservedIp(ip) {
+    const normalized = normalizeClientIp(ip);
+    if (!normalized) {
+      return true;
+    }
+
+    const lower = normalized.toLowerCase();
+    if (lower === 'localhost' || lower === '::1') {
+      return true;
+    }
+
+    if (/^10\./.test(lower) || /^192\.168\./.test(lower) || /^127\./.test(lower) || /^169\.254\./.test(lower)) {
+      return true;
+    }
+
+    if (/^172\.(1[6-9]|2\d|3[0-1])\./.test(lower)) {
+      return true;
+    }
+
+    if (lower.startsWith('fc') || lower.startsWith('fd') || lower.startsWith('fe80:') || lower.startsWith('::ffff:127.')) {
+      return true;
+    }
+
+    return false;
+  }
+
+  function pickForwardedIp(candidates) {
+    const normalizedCandidates = Array.isArray(candidates)
+      ? candidates.map(function (candidate) {
+        return normalizeClientIp(candidate);
+      }).filter(Boolean)
+      : [];
+
+    const publicCandidate = normalizedCandidates.find(function (candidate) {
+      return !isPrivateOrReservedIp(candidate);
+    });
+
+    return publicCandidate || normalizedCandidates[0] || null;
+  }
+
+  function resolveRequestIp(request) {
+    const forwardedFor = String(request && request.headers && request.headers['x-forwarded-for'] || '').split(',');
+    const forwardedForIp = pickForwardedIp(forwardedFor);
+    if (forwardedForIp) {
+      return forwardedForIp;
+    }
+
+    const realIp = pickForwardedIp([firstHeaderValue(request && request.headers && request.headers['x-real-ip'])]);
+    if (realIp) {
+      return realIp;
+    }
+
+    const forwarded = firstHeaderValue(request && request.headers && request.headers.forwarded);
+    if (forwarded) {
+      const forwardedMatches = Array.from(forwarded.matchAll(/(?:^|,\s*|;\s*)for=(?:"?\[?)([^"\];,\s]+)/gi)).map(function (match) {
+        return match[1];
+      });
+      const forwardedIp = pickForwardedIp(forwardedMatches);
+      if (forwardedIp) {
+        return forwardedIp;
+      }
+    }
+
+    return normalizeClientIp(request && request.socket && request.socket.remoteAddress);
+  }
+
  function parseCookies(cookieHeader) {
    return String(cookieHeader || '').split(/;\s*/).reduce(function (cookies, pair) {
      if (!pair) {
@@ -144,7 +215,6 @@ function createPlayerRuntime(options) {
    const clientName = String(connection.clientName || '').trim();
    const clientId = String(connection.clientId || '').trim();
    const userAgent = String(connection.userAgent || '').trim();
-    const clientIp = String(connection.clientIp || '').trim();
    const viewport = connection.viewport && typeof connection.viewport === 'object'
      ? connection.viewport
      : null;
@@ -160,10 +230,6 @@ function createPlayerRuntime(options) {
      labelParts.push(`id ${clientId.slice(-6)}`);
    }

-    if (clientIp) {
-      labelParts.push(clientIp);
-    }
-
    if (viewport && Number.isFinite(Number(viewport.width)) && Number.isFinite(Number(viewport.height))) {
      labelParts.push(`${Number(viewport.width)}x${Number(viewport.height)}`);
    }
@@ -197,8 +263,6 @@ function createPlayerRuntime(options) {
        blackout: Boolean(connection.blackout),
        currentSlideId: connection.currentSlide && connection.currentSlide.id ? connection.currentSlide.id : null,
        currentSlideTitle: connection.currentSlide && connection.currentSlide.title ? connection.currentSlide.title : null,
-        clientIp: connection.clientIp || null,
-        remoteAddress: connection.remoteAddress || null,
        connectedAt: connection.connectedAt ? connection.connectedAt.toISOString() : null,
        lastSeenAt: connection.lastSeenAt ? connection.lastSeenAt.toISOString() : null
      };
@@ -222,6 +286,10 @@ function createPlayerRuntime(options) {
    return allConnections;
  }

+  function snapshotSlugs() {
+    return Array.from(connectionsBySlug.keys());
+  }
+
  async function isClientNameAvailableOnScreen(poolArg, clientName, excludeDeviceId) {
    return isClientNameAvailable(poolArg || pool, clientName, excludeDeviceId, snapshotAllConnections());
  }
@@ -229,6 +297,16 @@ function createPlayerRuntime(options) {
  function broadcastConnectionSnapshot(slug) {
    const key = String(slug || '').trim();
    const bucket = dashboardListenersBySlug.get(key);
+    const connections = snapshotConnections(slug);
+    if (notifySnapshot) {
+      try {
+        notifySnapshot({
+          slug: key,
+          connections: connections
+        });
+      } catch (_error) {
+      }
+    }
    if (!bucket || !bucket.size) {
      return;
    }
@@ -236,7 +314,7 @@ function createPlayerRuntime(options) {
    const payload = JSON.stringify({
      type: 'snapshot',
      slug: key,
-      connections: snapshotConnections(slug),
+      connections: connections,
      sentAt: new Date().toISOString()
    });

@@ -416,9 +494,6 @@ function createPlayerRuntime(options) {
      return;
    }

-    const remoteAddress = request.socket && request.socket.remoteAddress ? request.socket.remoteAddress : null;
-    const forwardedFor = normalizeClientIp(String(request.headers['x-forwarded-for'] || '').split(',')[0]);
-    const normalizedRemoteAddress = normalizeClientIp(remoteAddress);
    const connectionId = crypto.randomUUID();
    const connection = {
      id: connectionId,
@@ -433,9 +508,7 @@ function createPlayerRuntime(options) {
      paused: false,
      blackout: false,
      playerPublicBaseUrl: null,
-      clientIp: forwardedFor || normalizedRemoteAddress,
-      remoteAddress: normalizedRemoteAddress,
-      label: forwardedFor || normalizedRemoteAddress || 'connected client',
+      label: 'connected client',
      connectedAt: new Date(),
      lastSeenAt: new Date()
    };
@@ -476,7 +549,6 @@ function createPlayerRuntime(options) {
      }
      connection.paused = Boolean(payload.paused);
      connection.blackout = Boolean(payload.blackout);
-      connection.clientIp = payload.clientIp ? normalizeClientIp(payload.clientIp) || connection.clientIp : connection.clientIp;
      connection.currentSlide = payload.currentSlide && typeof payload.currentSlide === 'object' ? {
        id: payload.currentSlide.id || null,
        title: payload.currentSlide.title || '',
@@ -508,6 +580,7 @@ function createPlayerRuntime(options) {
    broadcastAnnouncementRefresh: broadcastAnnouncementRefresh,
    snapshotConnections: snapshotConnections,
    snapshotAllConnections: snapshotAllConnections,
+    snapshotSlugs: snapshotSlugs,
    isClientNameAvailableOnScreen: isClientNameAvailableOnScreen,
    sendCommandToConnection: sendCommandToConnection,
    broadcastCommand: broadcastCommand
@@ -140,6 +140,24 @@ const PERMISSION_SECTIONS = [
    sectionName: 'Settings',
    order: 40,
    permissions: [
+      {
+        key: 'system-settings',
+        order: 70,
+        name: 'System settings',
+        permissions: [
+          { key: 'read', name: 'Read', description: 'View global application settings.' },
+          { key: 'update', name: 'Update', description: 'Update global application settings.' }
+        ]
+      },
+      {
+        key: 'audit-log',
+        order: 60,
+        name: 'Audit log',
+        permissions: [
+          { key: 'read', name: 'Read', description: 'View security and session audit events.' },
+          { key: 'allow', name: 'Allow', description: 'Download filtered audit events.' }
+        ]
+      },
      {
        key: 'users',
        order: 10,
@@ -194,18 +212,21 @@ const PERMISSION_SECTIONS = [
  }
 ];

-const PERMISSIONS = PERMISSION_SECTIONS.flatMap(function (section) {
-  return (Array.isArray(section.permissions) ? section.permissions : []).flatMap(function (resource) {
-    return (Array.isArray(resource.permissions) ? resource.permissions : []).map(function (action, index) {
+const PERMISSIONS = PERMISSION_SECTIONS.flatMap(function (section, sectionIndex) {
+  return (Array.isArray(section.permissions) ? section.permissions : []).flatMap(function (resource, resourceIndex) {
+    return (Array.isArray(resource.permissions) ? resource.permissions : []).map(function (action, actionIndex) {
      return {
        key: `${resource.key}.${action.key}`,
        name: resource.name,
        sectionOrder: section.order,
+        sectionIndex: sectionIndex,
        actionName: action.name,
-        permissionOrder: index + 1,
+        permissionOrder: actionIndex + 1,
+        permissionIndex: actionIndex,
        sectionName: section.sectionName,
        resourceKey: resource.key,
        resourceOrder: resource.order,
+        resourceIndex: resourceIndex,
        resourceName: resource.name,
        actionKey: action.key,
        description: action.description
@@ -215,8 +236,8 @@ const PERMISSIONS = PERMISSION_SECTIONS.flatMap(function (section) {
 });

 const DEFAULT_ROLE = {
-  key: 'administrators',
-  name: 'Administrators',
+  key: 'super-admin',
+  name: 'Super Admin',
  description: 'Full access to the admin interface.'
 };

@@ -9,6 +9,7 @@ const common = require('./common');
 const { verifyPassword, createSessionToken, hashSessionToken, hashPassword, validatePasswordStrength } = require('#src/auth');
 const pages = require('#src/web/pages');
 const registerMiddleware = require('#src/web/middleware');
+const registerNotFoundHandler = require('#src/web/middleware/not-found');
 const { createBackgroundTaskQueue } = require('#src/web/lib/background-tasks/queue');
 const { initializeBackgroundTasks } = require('#src/web/lib/background-tasks');
 const { createDataSourceTaskService } = require('#src/web/lib/background-tasks/tasks-scheduled/data-source-refresh');
@@ -23,6 +24,8 @@ const { rbacData } = require('#src/web/lib/auth');
 const { createPlayerActionService } = require('#src/web/lib/player-actions');
 const { isClientNameAvailable, withClientNameReservation } = require('#src/data/client-name-check');
 const { createSessionService } = require('#src/web/lib/auth');
+const { fetchAppSettings } = require('#src/data/app-settings');
+const { recordRequestAuditEvent } = require('#src/data/audit-log');
 const { hasAnyPermission } = require('#src/rbac');
 const { ensureFontLibrary } = require('#src/web/lib/media/font-library');
 const {
@@ -34,7 +37,6 @@ const {
  getAuditUserId,
  getCanvasSignature,
  fetchPlaylistCanvasId,
-  fetchPlaylistCanvasSignature,
  fetchScreensByPlaylistId,
  fetchScreensBySlideId,
  fetchScreensByTemplateId,
@@ -62,7 +64,8 @@ async function start() {
  const playerActionService = createPlayerActionService({
    pool: pool,
    common: common,
-    playerInternalBaseUrl: webConfig.thinClientBaseUrl
+    playerInternalBaseUrl: webConfig.playerInternalUrl,
+    bridgeInternalBaseUrl: webConfig.bridgeInternalUrl
  });
  const notifyPlayerScreens = createNotifyPlayerScreens(playerActionService.forwardPlayerCommand);

@@ -70,8 +73,8 @@ async function start() {
  const webBootstrap = createWebBootstrap({
    pool: pool,
    common: common,
-    playerInternalBaseUrl: webConfig.playerInternalBaseUrl,
-    thinClientBaseUrl: webConfig.thinClientBaseUrl,
+    playerInternalBaseUrl: webConfig.playerInternalUrl,
+    bridgeInternalBaseUrl: webConfig.bridgeInternalUrl,
    uploadDir: webConfig.uploadsDir,
    formatDashboardDate: formatDashboardDate,
    notifyPlayerScreens: notifyPlayerScreens,
@@ -91,6 +94,14 @@ async function start() {
  const sessionService = createSessionService({
    sessionCookieName: webConfig.sessionCookieName,
    sessionMaxAgeMs: webConfig.sessionMaxAgeMs,
+    getConfiguredSessionMaxAgeMs: async function () {
+      const settings = await fetchAppSettings(pool);
+      return Number(settings['security.session_lifetime_days']) * 24 * 60 * 60 * 1000;
+    },
+    getConfiguredMaxActiveSessions: async function () {
+      const settings = await fetchAppSettings(pool);
+      return Number(settings['security.max_active_sessions']);
+    },
    hashSessionToken: hashSessionToken,
    createSessionToken: createSessionToken
  });
@@ -98,6 +109,7 @@ async function start() {
  const createUserSession = sessionService.createUserSession;
  const clearSessionCookie = sessionService.clearSessionCookie;
  const setSessionCookie = sessionService.setSessionCookie;
+  const getSessionMaxAgeMs = sessionService.getSessionMaxAgeMs;
  const setAuthMessageCookie = sessionService.setAuthMessageCookie;
  const consumeAuthMessageCookie = sessionService.consumeAuthMessageCookie;
  const loadCurrentUser = sessionService.loadCurrentUser;
@@ -118,9 +130,11 @@ async function start() {
    common: common,
    pages: pages,
    upload: upload,
+    mediaDir: webConfig.mediaDir,
    uploadDir: webConfig.uploadsDir,
    createUserSession: createUserSession,
    setSessionCookie: setSessionCookie,
+    getSessionMaxAgeMs: getSessionMaxAgeMs,
    clearSessionCookie: clearSessionCookie,
    setAuthMessageCookie: setAuthMessageCookie,
    consumeAuthMessageCookie: consumeAuthMessageCookie,
@@ -130,6 +144,7 @@ async function start() {
    sessionCookieName: webConfig.sessionCookieName,
    formatDashboardDate: formatDashboardDate,
    getAuditUserId: getAuditUserId,
+    recordRequestAuditEvent: recordRequestAuditEvent,
    hashPassword: hashPassword,
    validatePasswordStrength: validatePasswordStrength,
    readArrayField: readArrayField,
@@ -139,7 +154,6 @@ async function start() {
    fetchScreensBySlideId: fetchScreensBySlideId,
    fetchScreensByTemplateId: fetchScreensByTemplateId,
    fetchPlaylistCanvasId: fetchPlaylistCanvasId,
-    fetchPlaylistCanvasSignature: fetchPlaylistCanvasSignature,
    getCanvasSignature: getCanvasSignature,
    normalizeScheduleMode: normalizeScheduleMode,
    parseDateTimeLocal: parseDateTimeLocal,
@@ -156,7 +170,6 @@ async function start() {
    },
    hasAnyPermission: hasAnyPermission,
    backgroundTaskQueue: backgroundTaskQueue,
-    mediaDir: webConfig.mediaDir,
    uploadSyncService: webBootstrap.uploadSyncService,
    collectUploadReferencesFromSlide: collectUploadReferencesFromSlide,
    collectUploadReferencesFromTemplate: collectUploadReferencesFromTemplate,
@@ -166,9 +179,15 @@ async function start() {
    buildDashboardState: webBootstrap.buildDashboardState
  });

+  registerNotFoundHandler(app);
+
  app.use(function (error, req, res, _next) {
-    console.error(error);
    const statusCode = Number(error && (error.statusCode || error.status)) || 500;
+    if (statusCode >= 500) {
+      console.error(error);
+    } else if (statusCode >= 400 && statusCode !== 404) {
+      console.warn(error && error.message ? error.message : 'Request failed.', { statusCode: statusCode });
+    }
    const isXhr = String(req.get && req.get('X-Requested-With') || '').toLowerCase() === 'xmlhttprequest';
    const wantsHtml = !isXhr && !String(req.originalUrl || '').startsWith('/api/') && (!req.accepts || req.accepts('html'));

@@ -206,11 +225,12 @@ async function start() {
    mediaDir: webConfig.mediaDir,
    backgroundTaskQueue: backgroundTaskQueue,
    webBootstrap: webBootstrap,
+    notifyPlayerScreens: notifyPlayerScreens,
    loadCurrentUser: loadCurrentUser,
    initializeBackgroundTasks: initializeBackgroundTasks,
    captureSlideThumbnail: captureSlideThumbnail,
    server: server,
-    webBaseUrl: webConfig.webBaseUrl,
+    webBaseUrl: webConfig.webInternalUrl,
    dataSourceStartupRefreshStaggerMs: webConfig.dataSourceStartupRefreshStaggerMs
  });

@@ -8,8 +8,8 @@ const { createRequestAuthHeaders } = require('#src/request-auth');
 function createWebBootstrap(options) {
  const pool = options && options.pool;
  const common = options && options.common;
-  const configuredPlayerInternalBaseUrl = String(options && options.playerInternalBaseUrl || '').replace(/\/$/, '');
-  const configuredThinClientBaseUrl = String(options && options.thinClientBaseUrl || process.env.THIN_CLIENT_BASE_URL || '').trim().replace(/\/$/, '');
+  const configuredPlayerInternalUrl = String(options && options.playerInternalBaseUrl || '').replace(/\/$/, '');
+  const configuredBridgeInternalUrl = String(options && options.bridgeInternalBaseUrl || process.env.BRIDGE_INTERNAL_URL || '').trim().replace(/\/$/, '');
  const uploadDir = String(options && options.uploadDir || '').trim();
  const dashboardRefreshIntervalMs = 5000;
  const formatDashboardDate = options && options.formatDashboardDate;
@@ -27,7 +27,7 @@ function createWebBootstrap(options) {
  let dashboardRefreshInFlight = null;
  let broadcastDashboardState = null;
  function getPlayerSnapshotSocketUrl(slug) {
-    const resolvedPlayerInternalBaseUrl = configuredThinClientBaseUrl || configuredPlayerInternalBaseUrl;
+    const resolvedPlayerInternalBaseUrl = configuredBridgeInternalUrl || configuredPlayerInternalUrl;
    if (!resolvedPlayerInternalBaseUrl) {
      throw new Error('Unable to resolve the player internal base URL.');
    }
@@ -109,7 +109,7 @@ function createWebBootstrap(options) {
  const dashboardStateService = createDashboardStateService({
    pool: pool,
    common: common,
-    thinClientBaseUrl: configuredThinClientBaseUrl,
+    thinClientBaseUrl: configuredBridgeInternalUrl,
    playerSnapshotCache: playerSnapshotCache,
    playerSnapshotSockets: playerSnapshotSockets,
    ensurePlayerSnapshotSubscription: ensurePlayerSnapshotSubscription,
@@ -120,7 +120,7 @@ function createWebBootstrap(options) {
  const uploadSyncService = createUploadSyncService({
    pool: pool,
    common: common,
-    playerInternalBaseUrl: configuredPlayerInternalBaseUrl,
+    playerInternalBaseUrl: configuredPlayerInternalUrl,
    playerSnapshotCache: playerSnapshotCache,
    notifyPlayerScreens: notifyPlayerScreens,
    backgroundTaskQueue: backgroundTaskQueue
@@ -253,7 +253,7 @@ function createWebBootstrap(options) {
  return {
    upload: upload,
    uploadSyncService: uploadSyncService,
-    playerInternalBaseUrl: configuredPlayerInternalBaseUrl || null,
+    playerInternalBaseUrl: configuredPlayerInternalUrl || null,
    buildDashboardState: buildDashboardState,
    collectUploadReferencesFromSlide: collectUploadReferencesFromSlide,
    collectUploadReferencesFromTemplate: collectUploadReferencesFromTemplate,
@@ -113,7 +113,7 @@ async function fetchRolesForUser(pool, userId) {

 async function fetchUsersWithRoles(pool) {
  const [rows] = await pool.query(
-    `SELECT u.id, u.name, u.username, u.created_at, u.modified_at,
+    `SELECT u.id, u.name, u.username, u.account_locked, u.created_at, u.modified_at,
            COALESCE(role_data.role_names, '') AS role_names,
            COALESCE(role_data.role_ids_csv, '') AS role_ids_csv
    FROM a_users u
@@ -142,7 +142,7 @@ async function fetchUsersWithRolesPage(pool, page, pageSize, searchTerm, sortKey
  const whereSql = hasExcludedUserId ? 'WHERE u.id <> ?' : '';
  const queryArgs = hasExcludedUserId ? [excludedUserId] : [];
  const paged = await fetchPagedRows(pool, {
-    selectSql: `SELECT u.id, u.name, u.username, u.created_at, u.modified_at,
+    selectSql: `SELECT u.id, u.name, u.username, u.account_locked, u.created_at, u.modified_at,
            COALESCE(role_data.role_names, '') AS role_names,
            COALESCE(role_data.role_ids_csv, '') AS role_ids_csv
    FROM a_users u
@@ -189,7 +189,7 @@ async function fetchUsersWithRolesPage(pool, page, pageSize, searchTerm, sortKey

 async function fetchUserWithRoles(pool, userId) {
  const [rows] = await pool.query(
-    `SELECT u.id, u.name, u.username, u.created_at, u.modified_at,
+    `SELECT u.id, u.name, u.username, u.account_locked, u.created_at, u.modified_at,
            COALESCE(role_data.role_names, '') AS role_names,
            COALESCE(role_data.role_ids_csv, '') AS role_ids_csv
    FROM a_users u
@@ -216,6 +216,17 @@ async function fetchUserWithRoles(pool, userId) {
  });
 }

+async function fetchActiveUserSessions(pool, userId) {
+  const [rows] = await pool.query(
+    `SELECT id, ip_address, user_agent, created_at, last_used_at, expires_at
+     FROM a_sessions
+     WHERE user_id = ? AND expires_at > NOW()
+     ORDER BY last_used_at DESC`,
+    [userId]
+  );
+  return rows || [];
+}
+
 async function syncUserRoles(pool, userId, roleIds) {
  const uniqueRoleIds = Array.from(new Set((Array.isArray(roleIds) ? roleIds : []).map(function (roleId) {
    return Number(roleId);
@@ -225,7 +236,14 @@ async function syncUserRoles(pool, userId, roleIds) {

  await pool.query('DELETE FROM a_user_roles WHERE user_id = ?', [userId]);
  for (const roleId of uniqueRoleIds) {
-    await pool.query('INSERT IGNORE INTO a_user_roles (user_id, role_id, created_by, modified_by) VALUES (?, ?, ?, ?)', [userId, roleId, null, null]);
+    await pool.query(
+      `INSERT INTO a_user_roles (user_id, role_id, created_by, modified_by)
+       SELECT ?, ?, ?, ?
+        WHERE NOT EXISTS (
+          SELECT 1 FROM a_user_roles WHERE user_id = ? AND role_id = ?
+        )`,
+      [userId, roleId, null, null, userId, roleId]
+    );
  }
 }

@@ -238,7 +256,14 @@ async function syncRoleUsers(pool, roleId, userIds) {

  await pool.query('DELETE FROM a_user_roles WHERE role_id = ?', [roleId]);
  for (const userId of uniqueUserIds) {
-    await pool.query('INSERT IGNORE INTO a_user_roles (user_id, role_id, created_by, modified_by) VALUES (?, ?, ?, ?)', [userId, roleId, null, null]);
+    await pool.query(
+      `INSERT INTO a_user_roles (user_id, role_id, created_by, modified_by)
+       SELECT ?, ?, ?, ?
+        WHERE NOT EXISTS (
+          SELECT 1 FROM a_user_roles WHERE user_id = ? AND role_id = ?
+        )`,
+      [userId, roleId, null, null, userId, roleId]
+    );
  }
 }

@@ -257,7 +282,15 @@ async function syncRolePermissions(pool, roleId, permissionKeys) {

  await pool.query('DELETE FROM a_role_permissions WHERE role_id = ?', [roleId]);
  for (const permissionRow of permissionRows) {
-    await pool.query('INSERT IGNORE INTO a_role_permissions (role_id, permission_id, created_by, modified_by) VALUES (?, ?, ?, ?)', [roleId, Number(permissionRow.id), null, null]);
+    const permissionId = Number(permissionRow.id);
+    await pool.query(
+      `INSERT INTO a_role_permissions (role_id, permission_id, created_by, modified_by)
+       SELECT ?, ?, ?, ?
+        WHERE NOT EXISTS (
+          SELECT 1 FROM a_role_permissions WHERE role_id = ? AND permission_id = ?
+        )`,
+      [roleId, permissionId, null, null, roleId, permissionId]
+    );
  }
 }

@@ -273,6 +306,7 @@ module.exports = {
  fetchUsersWithRoles,
  fetchUsersWithRolesPage,
  fetchUserWithRoles,
+  fetchActiveUserSessions,
  syncUserRoles,
  syncRoleUsers,
  syncRolePermissions
@@ -34,6 +34,8 @@ function normalizeReturnToPath(value, baseUrl) {
 function createSessionService(options) {
  const sessionCookieName = String(options && options.sessionCookieName || '').trim();
  const sessionMaxAgeMs = Number(options && options.sessionMaxAgeMs);
+  const getConfiguredSessionMaxAgeMs = options && options.getConfiguredSessionMaxAgeMs;
+  const getConfiguredMaxActiveSessions = options && options.getConfiguredMaxActiveSessions;
  const hashSessionToken = options && options.hashSessionToken;
  const createSessionToken = options && options.createSessionToken;
  const authMessageCookieName = 'pulse_auth_message';
@@ -88,7 +90,20 @@ function createSessionService(options) {
  }

  function setSessionCookie(res, token) {
-    appendCookieHeader(res, serializeCookie(sessionCookieName, token, { maxAge: sessionMaxAgeMs }));
+    const hasRequestedMaxAge = arguments.length > 2;
+    const requestedMaxAgeMs = hasRequestedMaxAge ? Number(arguments[2]) : sessionMaxAgeMs;
+    const cookieOptions = hasRequestedMaxAge && arguments[2] === null
+      ? {}
+      : { maxAge: Number.isFinite(requestedMaxAgeMs) && requestedMaxAgeMs > 0 ? requestedMaxAgeMs : sessionMaxAgeMs };
+    appendCookieHeader(res, serializeCookie(sessionCookieName, token, cookieOptions));
+  }
+
+  async function getSessionMaxAgeMs() {
+    const configuredValue = typeof getConfiguredSessionMaxAgeMs === 'function'
+      ? await getConfiguredSessionMaxAgeMs()
+      : sessionMaxAgeMs;
+    const normalizedValue = Number(configuredValue);
+    return Number.isFinite(normalizedValue) && normalizedValue > 0 ? normalizedValue : sessionMaxAgeMs;
  }

  function setAuthMessageCookie(res, message) {
@@ -113,7 +128,7 @@ function createSessionService(options) {

    const tokenHash = hashSessionToken(token);
    const [rows] = await pool.query(
-      `SELECT s.user_id, u.id, u.name, u.username
+      `SELECT s.user_id, u.id, u.name, u.username, u.must_change_password
      FROM a_sessions s
      JOIN a_users u ON u.id = s.user_id
       WHERE s.session_hash = ?
@@ -146,6 +161,7 @@ function createSessionService(options) {

    await pool.query('UPDATE a_sessions SET last_used_at = CURRENT_TIMESTAMP, modified_by = ? WHERE session_hash = ?', [rows[0].user_id, tokenHash]);
    return Object.assign({}, rows[0], {
+      mustChangePassword: Boolean(rows[0].must_change_password),
      roleKeys: roleRows.map(function (row) {
        return String(row.role_key || '').trim();
      }).filter(Boolean),
@@ -155,14 +171,34 @@ function createSessionService(options) {
    });
  }

-  async function createUserSession(pool, userId) {
+  async function createUserSession(pool, userId, configuredMaxAgeMs, metadata) {
    const token = createSessionToken();
    const tokenHash = hashSessionToken(token);
-    const expiresAt = new Date(Date.now() + sessionMaxAgeMs);
+    const maxAgeMs = Number.isFinite(Number(configuredMaxAgeMs)) && Number(configuredMaxAgeMs) > 0
+      ? Number(configuredMaxAgeMs)
+      : await getSessionMaxAgeMs();
+    const expiresAt = new Date(Date.now() + maxAgeMs);
+    const sessionMetadata = metadata && typeof metadata === 'object' ? metadata : {};
    await pool.query(
-      'INSERT INTO a_sessions (session_hash, user_id, expires_at, created_by, modified_by) VALUES (?, ?, ?, ?, ?)',
-      [tokenHash, userId, expiresAt, userId, userId]
+      'INSERT INTO a_sessions (session_hash, user_id, ip_address, user_agent, expires_at, created_by, modified_by) VALUES (?, ?, ?, ?, ?, ?, ?)',
+      [tokenHash, userId, String(sessionMetadata.ipAddress || '').slice(0, 255) || null, String(sessionMetadata.userAgent || '').slice(0, 512) || null, expiresAt, userId, userId]
    );
+
+    if (typeof getConfiguredMaxActiveSessions === 'function') {
+      const maxActiveSessions = Number(await getConfiguredMaxActiveSessions());
+      if (Number.isInteger(maxActiveSessions) && maxActiveSessions > 0) {
+        const [sessionRows] = await pool.query(
+          'SELECT id, session_hash FROM a_sessions WHERE user_id = ? AND expires_at > NOW() ORDER BY last_used_at ASC, created_at ASC, id ASC',
+          [userId]
+        );
+        const sessionsToRemove = (sessionRows || []).filter(function (session) {
+          return session.session_hash !== tokenHash;
+        }).slice(0, Math.max(0, sessionRows.length - maxActiveSessions));
+        for (const session of sessionsToRemove) {
+          await pool.query('DELETE FROM a_sessions WHERE id = ? AND user_id = ?', [session.id, userId]);
+        }
+      }
+    }
    return token;
  }

@@ -184,6 +220,7 @@ function createSessionService(options) {
    consumeAuthMessageCookie: consumeAuthMessageCookie,
    loadCurrentUser: loadCurrentUser,
    createUserSession: createUserSession,
+    getSessionMaxAgeMs: getSessionMaxAgeMs,
    requireAuth: requireAuth,
    getRequestOrigin: getRequestOrigin
  };
@@ -52,7 +52,13 @@ function registerStartupTasks(options) {
  }

  async function initialize() {
-    await loadTaskModules(backgroundTaskDirectory, options);
+    const startupTaskFile = path.join(backgroundTaskDirectory, 'data-source-refresh.js');
+    const taskModule = require(startupTaskFile);
+    const exported = getTaskExport(taskModule);
+
+    if (typeof exported === 'function') {
+      await exported(options);
+    }
  }

  return {
@@ -19,6 +19,9 @@ function normalizeIntervalMs(value, unit) {
  if (normalizedUnit === 'seconds') {
    return numericValue * 1000;
  }
+  if (normalizedUnit === 'hours') {
+    return numericValue * 60 * 60 * 1000;
+  }
  return numericValue * 60 * 1000;
 }

@@ -24,7 +24,7 @@ function registerDataSourceRefreshTask(options) {
      if (!apiSource) {
        throw new Error('API source not found.');
      }
-      return refreshApiSource(pool, common, apiSource, Number(payload.actorId) || null);
+      return refreshApiSource(pool, common, apiSource, Number(payload.actorId) || null, options.notifyPlayerScreens);
    }

    if (sourceType === 'rss-feed') {
@@ -32,7 +32,7 @@ function registerDataSourceRefreshTask(options) {
      if (!rssFeed) {
        throw new Error('RSS feed not found.');
      }
-      return refreshRssFeed(pool, common, rssFeed.id, rssFeed.feed_url, rssFeed.item_limit, Number(payload.actorId) || null);
+      return refreshRssFeed(pool, common, rssFeed.id, rssFeed.feed_url, rssFeed.item_limit, Number(payload.actorId) || null, options.notifyPlayerScreens);
    }

    throw new Error('Unsupported data source refresh task.');
@@ -9,6 +9,7 @@ function registerFontSyncTask(options) {
  backgroundTaskQueue.setTaskHandler('font-sync', async function (task) {
    const payload = task && task.payload ? task.payload : task || {};
    const uploadDir = String(payload.uploadDir || '').trim();
+    const playerIdentifier = String(payload.playerIdentifier || payload.deviceId || '').trim();
    const operations = Array.isArray(payload.operations)
      ? payload.operations
      : Array.isArray(payload.uploadPaths)
@@ -28,9 +29,9 @@ function registerFontSyncTask(options) {
        continue;
      }
      if (String(operation.type || '').trim().toLowerCase() === 'delete') {
-        await uploadSyncService.removeUploadFileFromPlayer(uploadPath, uploadDir);
+        await uploadSyncService.removeUploadFileFromPlayer(uploadPath, uploadDir, undefined, playerIdentifier);
      } else {
-        await uploadSyncService.pushUploadFileToPlayer(uploadPath, uploadDir);
+        await uploadSyncService.pushUploadFileToPlayer(uploadPath, uploadDir, undefined, playerIdentifier);
      }
    }
  });
@@ -0,0 +1,34 @@
+const { fetchAppSettings } = require('#src/data/app-settings');
+
+const TASK = {
+  key: 'audit-log-sweep',
+  title: 'Audit log cleanup',
+  category: 'cleanup',
+  intervalMs: 24 * 60 * 60 * 1000
+};
+
+function registerAuditLogSweepTask(options) {
+  const backgroundTaskQueue = options && options.backgroundTaskQueue;
+  const pool = options && options.pool;
+  if (!backgroundTaskQueue || !pool) {
+    throw new Error('registerAuditLogSweepTask requires audit cleanup dependencies.');
+  }
+  backgroundTaskQueue.registerRecurringTask({
+    key: TASK.key,
+    title: TASK.title,
+    category: TASK.category,
+    intervalMs: TASK.intervalMs,
+    metadata: {},
+    run: async function () {
+      const settings = await fetchAppSettings(pool);
+      const retentionDays = Number(settings['audit.retention_days']);
+      if (!Number.isInteger(retentionDays) || retentionDays <= 0) {
+        return;
+      }
+      const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000);
+      await pool.query('DELETE FROM o_audit_events WHERE occurred_at < ?', [cutoff]);
+    }
+  });
+}
+
+module.exports = { registerAuditLogSweepTask };
@@ -34,7 +34,7 @@ function registerRecurringDataSourceRefreshes(options) {
          sourceName: apiSource.name
        },
        run: function () {
-          return refreshApiSource(pool, common, apiSource, null);
+          return refreshApiSource(pool, common, apiSource, null, options.notifyPlayerScreens);
        }
      });
    });
@@ -52,7 +52,7 @@ function registerRecurringDataSourceRefreshes(options) {
          sourceName: rssFeed.name
        },
        run: function () {
-          return refreshRssFeed(pool, common, rssFeed.id, rssFeed.feed_url, rssFeed.item_limit, null);
+          return refreshRssFeed(pool, common, rssFeed.id, rssFeed.feed_url, rssFeed.item_limit, null, options.notifyPlayerScreens);
        }
      });
    });
@@ -115,11 +115,11 @@ function createDataSourceTaskService(options) {
  }

  async function refreshApiSourceInBackground(apiSourceId, actorId) {
-    return refreshApiSource(pool, common, apiSourceId, actorId);
+    return refreshApiSource(pool, common, apiSourceId, actorId, options.notifyPlayerScreens);
  }

  async function refreshRssFeedInBackground(rssFeedId, feedUrl, itemLimit, actorId) {
-    return refreshRssFeed(pool, common, rssFeedId, feedUrl, itemLimit, actorId);
+    return refreshRssFeed(pool, common, rssFeedId, feedUrl, itemLimit, actorId, options.notifyPlayerScreens);
  }

  return {
@@ -0,0 +1,31 @@
+const TASK = {
+  key: 'expired-session-sweep',
+  title: 'Expired session cleanup',
+  category: 'cleanup',
+  trigger: 'scheduled recurring task, hourly',
+  purpose: 'remove expired authentication sessions and their metadata.',
+  taskType: 'recurring-run',
+  intervalMs: 60 * 60 * 1000
+};
+
+function registerExpiredSessionSweepTask(options) {
+  const backgroundTaskQueue = options && options.backgroundTaskQueue;
+  const pool = options && options.pool;
+
+  if (!backgroundTaskQueue || !pool) {
+    throw new Error('registerExpiredSessionSweepTask requires the session cleanup dependencies.');
+  }
+
+  backgroundTaskQueue.registerRecurringTask({
+    key: TASK.key,
+    title: TASK.title,
+    category: TASK.category,
+    intervalMs: TASK.intervalMs,
+    metadata: {},
+    run: async function () {
+      await pool.query('DELETE FROM a_sessions WHERE expires_at <= NOW()');
+    }
+  });
+}
+
+module.exports = { registerExpiredSessionSweepTask };
@@ -18,57 +18,50 @@ function registerFontSweepTask(options) {
  const uploadSyncService = options && options.uploadSyncService;
  const pushUploadFileToPlayer = uploadSyncService && uploadSyncService.pushUploadFileToPlayer;
  const removeUploadFileFromPlayer = uploadSyncService && uploadSyncService.removeUploadFileFromPlayer;
-  const getPlayerTaskMetadata = uploadSyncService && uploadSyncService.getPlayerTaskMetadata;
  const mediaDir = String(options && options.mediaDir || '').trim();

  if (!backgroundTaskQueue || typeof pushUploadFileToPlayer !== 'function' || typeof removeUploadFileFromPlayer !== 'function' || !mediaDir) {
    throw new Error('registerFontSweepTask requires the font sweep dependencies.');
  }

-  const metadataPromise = typeof getPlayerTaskMetadata === 'function'
-    ? Promise.resolve(getPlayerTaskMetadata())
-    : Promise.resolve({});
+  backgroundTaskQueue.registerRecurringTask({
+    key: TASK.key,
+    title: TASK.title,
+    category: TASK.category,
+    intervalMs: TASK.intervalMs,
+    metadata: {
+      mediaDir: mediaDir
+    },
+    run: async function () {
+      const desiredOperations = collectFontLibrarySyncOperations(mediaDir);
+      const desiredUploadPaths = new Set(desiredOperations.map(function (operation) {
+        return operation && operation.uploadPath ? operation.uploadPath : '';
+      }).filter(Boolean));
+      const currentUploadPaths = await collectFontLibraryDirectoryUploadPaths(mediaDir);

-  return metadataPromise.then(function (metadata) {
-    backgroundTaskQueue.registerRecurringTask({
-      key: TASK.key,
-      title: TASK.title,
-      category: TASK.category,
-      intervalMs: TASK.intervalMs,
-      metadata: Object.assign({
-        mediaDir: mediaDir
-      }, metadata || {}),
-      run: async function () {
-        const desiredOperations = collectFontLibrarySyncOperations(mediaDir);
-        const desiredUploadPaths = new Set(desiredOperations.map(function (operation) {
-          return operation && operation.uploadPath ? operation.uploadPath : '';
-        }).filter(Boolean));
-        const currentUploadPaths = await collectFontLibraryDirectoryUploadPaths(mediaDir);
-
-        for (let i = 0; i < desiredOperations.length; i += 1) {
-          const operation = desiredOperations[i] || {};
-          const uploadPath = String(operation.uploadPath || '').trim();
-          if (!uploadPath) {
-            continue;
-          }
-
-          if (String(operation.type || '').trim().toLowerCase() === 'delete') {
-            await removeUploadFileFromPlayer(uploadPath, mediaDir);
-          } else {
-            await pushUploadFileToPlayer(uploadPath, mediaDir);
-          }
+      for (let i = 0; i < desiredOperations.length; i += 1) {
+        const operation = desiredOperations[i] || {};
+        const uploadPath = String(operation.uploadPath || '').trim();
+        if (!uploadPath) {
+          continue;
        }

-        for (let i = 0; i < currentUploadPaths.length; i += 1) {
-          const uploadPath = String(currentUploadPaths[i] || '').trim();
-          if (!uploadPath || desiredUploadPaths.has(uploadPath)) {
-            continue;
-          }
-
+        if (String(operation.type || '').trim().toLowerCase() === 'delete') {
          await removeUploadFileFromPlayer(uploadPath, mediaDir);
+        } else {
+          await pushUploadFileToPlayer(uploadPath, mediaDir);
        }
      }
-    });
+
+      for (let i = 0; i < currentUploadPaths.length; i += 1) {
+        const uploadPath = String(currentUploadPaths[i] || '').trim();
+        if (!uploadPath || desiredUploadPaths.has(uploadPath)) {
+          continue;
+        }
+
+        await removeUploadFileFromPlayer(uploadPath, mediaDir);
+      }
+    }
  });
 }

@@ -0,0 +1,32 @@
+const TASK = {
+  key: 'onboarding-device-prune',
+  title: 'Onboarding device prune',
+  category: 'cleanup',
+  trigger: 'scheduled recurring task, hourly',
+  purpose: 'remove stale onboarding device bindings that have been idle for more than one minute.',
+  taskType: 'recurring-run',
+  intervalMs: 60 * 60 * 1000
+};
+
+function registerOnboardingDevicePruneTask(options) {
+  const backgroundTaskQueue = options && options.backgroundTaskQueue;
+  const pool = options && options.pool;
+  const common = options && options.common;
+
+  if (!backgroundTaskQueue || !pool || !common || typeof common.pruneStaleOnboardingDevices !== 'function') {
+    throw new Error('registerOnboardingDevicePruneTask requires the onboarding prune dependencies.');
+  }
+
+  backgroundTaskQueue.registerRecurringTask({
+    key: TASK.key,
+    title: TASK.title,
+    category: TASK.category,
+    intervalMs: TASK.intervalMs,
+    metadata: {},
+    run: async function () {
+      await common.pruneStaleOnboardingDevices(pool);
+    }
+  });
+}
+
+module.exports = { registerOnboardingDevicePruneTask };
@@ -33,13 +33,13 @@ function scheduleStartupDataSourceRefreshes(options) {

    (apiSourcesData.apiSources || []).forEach(function (apiSource) {
      startupSources.push(buildStartupSource('api-source', apiSource.id, apiSource.name, function () {
-        return refreshApiSource(pool, common, apiSource, null);
+        return refreshApiSource(pool, common, apiSource, null, options.notifyPlayerScreens);
      }));
    });

    (rssFeedsData.rssFeeds || []).forEach(function (rssFeed) {
      startupSources.push(buildStartupSource('rss-feed', rssFeed.id, rssFeed.name, function () {
-        return refreshRssFeed(pool, common, rssFeed.id, rssFeed.feed_url, rssFeed.item_limit, null);
+        return refreshRssFeed(pool, common, rssFeed.id, rssFeed.feed_url, rssFeed.item_limit, null, options.notifyPlayerScreens);
      }));
    });

@@ -1,16 +1,40 @@
 const { collectFontLibrarySyncOperations } = require('../../media/font-library');
+const { fetchPlayerRegistrations } = require('#src/data/player-registry');

 const TASK = {
  key: 'initial-font-sync',
  category: 'fonts'
 };

+function isRecentPlayerRegistration(player, staleSeconds) {
+  const lastSeenAt = player && player.last_seen_at;
+  const lastSeenAtValue = lastSeenAt instanceof Date ? lastSeenAt.getTime() : new Date(lastSeenAt).getTime();
+  const cutoffTime = Date.now() - Math.max(30, Number(staleSeconds || 60)) * 1000;
+
+  return Number.isFinite(lastSeenAtValue) && lastSeenAtValue >= cutoffTime;
+}
+
+function normalizePlayerMetadata(player) {
+  const playerIdentifier = String(player && player.identifier || '').trim();
+  const playerPublicBaseUrl = String(player && player.public_base_url || '').trim();
+  const playerInternalBaseUrl = String(player && player.internal_base_url || '').trim();
+
+  return {
+    playerIdentifier: playerIdentifier || null,
+    playerPublicBaseUrl: playerPublicBaseUrl || null,
+    playerInternalBaseUrl: playerInternalBaseUrl || null,
+    playerLabel: playerIdentifier || playerPublicBaseUrl || playerInternalBaseUrl || null,
+    playerActive: true
+  };
+}
+
 function registerInitialFontSyncTask(options) {
+  const pool = options && options.pool;
  const backgroundTaskQueue = options && options.backgroundTaskQueue;
  const mediaDir = String(options && options.mediaDir || '').trim();
  const uploadSyncService = options && options.uploadSyncService;

-  if (!backgroundTaskQueue || !mediaDir) {
+  if (!pool || !backgroundTaskQueue || !mediaDir) {
    throw new Error('registerInitialFontSyncTask requires the initial font sync dependencies.');
  }

@@ -18,20 +42,45 @@ function registerInitialFontSyncTask(options) {
    ? uploadSyncService.getPlayerTaskMetadata()
    : Promise.resolve({});

-  return Promise.resolve(metadataPromise).then(function (metadata) {
-    return backgroundTaskQueue.enqueueTask({
-      key: TASK.key,
-      title: 'Initial font sync',
-      category: TASK.category,
-      taskType: 'font-sync',
-      metadata: Object.assign({}, metadata || {}),
-      payload: {
-        mode: 'initial',
-        uploadDir: mediaDir,
-        operations: collectFontLibrarySyncOperations(mediaDir)
-      },
-      persist: true
-    });
+  return Promise.resolve(metadataPromise).then(async function () {
+    let players = [];
+    try {
+      players = await fetchPlayerRegistrations(pool);
+    } catch (error) {
+      console.warn('Unable to fetch player registrations for initial font sync:', error);
+      return null;
+    }
+
+    const livePlayers = Array.isArray(players)
+      ? players.filter(function (player) {
+        return isRecentPlayerRegistration(player, 60);
+      })
+      : [];
+
+    if (!livePlayers.length) {
+      return null;
+    }
+
+    const operations = collectFontLibrarySyncOperations(mediaDir);
+    return Promise.all(livePlayers.map(function (player) {
+      const metadata = normalizePlayerMetadata(player);
+      return backgroundTaskQueue.enqueueTask({
+        key: TASK.key,
+        title: 'Initial font sync',
+        category: TASK.category,
+        taskType: 'font-sync',
+        metadata: metadata,
+        payload: {
+          mode: 'initial',
+          uploadDir: mediaDir,
+          operations: operations,
+          playerIdentifier: metadata.playerIdentifier,
+          playerPublicBaseUrl: metadata.playerPublicBaseUrl,
+          playerInternalBaseUrl: metadata.playerInternalBaseUrl
+        },
+        persist: true
+      });
+    }));
  }).catch(function (error) {
    console.warn('Unable to queue initial font sync:', error);
  });
@@ -3,12 +3,37 @@ const TASK = {
  category: 'media-sync',
 };

+const { fetchPlayerRegistrations } = require('#src/data/player-registry');
+
+function isRecentPlayerRegistration(player, staleSeconds) {
+  const lastSeenAt = player && player.last_seen_at;
+  const lastSeenAtValue = lastSeenAt instanceof Date ? lastSeenAt.getTime() : new Date(lastSeenAt).getTime();
+  const cutoffTime = Date.now() - Math.max(30, Number(staleSeconds || 60)) * 1000;
+
+  return Number.isFinite(lastSeenAtValue) && lastSeenAtValue >= cutoffTime;
+}
+
+function normalizePlayerMetadata(player) {
+  const playerIdentifier = String(player && player.identifier || '').trim();
+  const playerPublicBaseUrl = String(player && player.public_base_url || '').trim();
+  const playerInternalBaseUrl = String(player && player.internal_base_url || '').trim();
+
+  return {
+    playerIdentifier: playerIdentifier || null,
+    playerPublicBaseUrl: playerPublicBaseUrl || null,
+    playerInternalBaseUrl: playerInternalBaseUrl || null,
+    playerLabel: playerIdentifier || playerPublicBaseUrl || playerInternalBaseUrl || null,
+    playerActive: true
+  };
+}
+
 function registerInitialMediaSyncTask(options) {
+  const pool = options && options.pool;
  const backgroundTaskQueue = options && options.backgroundTaskQueue;
  const mediaDir = String(options && options.mediaDir || '').trim();
  const uploadSyncService = options && options.uploadSyncService;

-  if (!backgroundTaskQueue || !mediaDir) {
+  if (!pool || !backgroundTaskQueue || !mediaDir) {
    throw new Error('registerInitialMediaSyncTask requires the initial media sync dependencies.');
  }

@@ -16,19 +41,43 @@ function registerInitialMediaSyncTask(options) {
    ? uploadSyncService.getPlayerTaskMetadata()
    : Promise.resolve({});

-  return Promise.resolve(metadataPromise).then(function (metadata) {
-    return backgroundTaskQueue.enqueueTask({
-      key: TASK.key,
-      title: 'Initial media sync',
-      category: TASK.category,
-      taskType: 'media-sync',
-      metadata: Object.assign({}, metadata || {}),
-      payload: {
-        mode: 'initial',
-        uploadDir: mediaDir
-      },
-      persist: true
-    });
+  return Promise.resolve(metadataPromise).then(async function () {
+    let players = [];
+    try {
+      players = await fetchPlayerRegistrations(pool);
+    } catch (error) {
+      console.warn('Unable to fetch player registrations for initial media sync:', error);
+      return null;
+    }
+
+    const livePlayers = Array.isArray(players)
+      ? players.filter(function (player) {
+        return isRecentPlayerRegistration(player, 60);
+      })
+      : [];
+
+    if (!livePlayers.length) {
+      return null;
+    }
+
+    return Promise.all(livePlayers.map(function (player) {
+      const metadata = normalizePlayerMetadata(player);
+      return backgroundTaskQueue.enqueueTask({
+        key: TASK.key,
+        title: 'Initial media sync',
+        category: TASK.category,
+        taskType: 'media-sync',
+        metadata: metadata,
+        payload: {
+          mode: 'initial',
+          uploadDir: mediaDir,
+          playerIdentifier: metadata.playerIdentifier,
+          playerPublicBaseUrl: metadata.playerPublicBaseUrl,
+          playerInternalBaseUrl: metadata.playerInternalBaseUrl
+        },
+        persist: true
+      });
+    }));
  }).catch(function (error) {
    console.warn('Unable to queue initial media sync:', error);
  });
@@ -5,12 +5,11 @@ function createWebConfig() {
  const uploadsDir = path.join(mediaDir, 'uploads');
  const thumbnailsDir = path.join(mediaDir, 'thumbnails');
  const assetDir = path.join(__dirname, '..', 'public');
-  const playerInternalBaseUrl = (process.env.PLAYER_INTERNAL_BASE_URL || process.env.PLAYER_BASE_URL || 'http://player:8081').replace(/\/$/, '');
-  const thinClientBaseUrl = (process.env.THIN_CLIENT_BASE_URL || 'http://player-bridge:8090').replace(/\/$/, '');
-  const webBaseUrl = (process.env.WEB_BASE_URL || `http://127.0.0.1:${Number(process.env.WEB_PORT || 8080)}`).replace(/\/$/, '');
+  const playerInternalUrl = (process.env.PLAYER_INTERNAL_URL || process.env.PLAYER_BASE_URL || 'http://player:8081').replace(/\/$/, '');
+  const bridgeInternalUrl = (process.env.BRIDGE_INTERNAL_URL || 'http://player-bridge:8090').replace(/\/$/, '');
+  const webInternalUrl = (process.env.WEB_INTERNAL_URL || `http://127.0.0.1:${Number(process.env.WEB_PORT || 8080)}`).replace(/\/$/, '');
  const sessionCookieName = 'digital_signage_session';
-  const sessionMaxAgeDays = Number(process.env.SESSION_MAX_AGE_DAYS || 14);
-  const sessionMaxAgeMs = (Number.isFinite(sessionMaxAgeDays) && sessionMaxAgeDays > 0 ? sessionMaxAgeDays : 14) * 24 * 60 * 60 * 1000;
+  const sessionMaxAgeMs = 14 * 24 * 60 * 60 * 1000;
  const port = Number(process.env.WEB_PORT || 8080);
  const dataSourceStartupRefreshStaggerMs = Math.max(100, Number(process.env.DATA_SOURCE_STARTUP_REFRESH_STAGGER_MS || 250));

@@ -20,9 +19,9 @@ function createWebConfig() {
    uploadsDir: uploadsDir,
    thumbnailsDir: thumbnailsDir,
    assetDir: assetDir,
-    playerInternalBaseUrl: playerInternalBaseUrl,
-    thinClientBaseUrl: thinClientBaseUrl,
-    webBaseUrl: webBaseUrl,
+    playerInternalUrl: playerInternalUrl,
+    bridgeInternalUrl: bridgeInternalUrl,
+    webInternalUrl: webInternalUrl,
    sessionCookieName: sessionCookieName,
    sessionMaxAgeMs: sessionMaxAgeMs,
    dataSourceStartupRefreshStaggerMs: dataSourceStartupRefreshStaggerMs
@@ -1,4 +1,112 @@
-async function refreshApiSource(pool, common, apiSourceOrId, actorId) {
+async function getAffectedScreenSlugs(connection, common, slideMatchKey, sourceId) {
+  const [slideRows] = await connection.query('SELECT id, content_json FROM c_slides WHERE content_json IS NOT NULL');
+  const slideIds = [];
+  const seenSlideIds = new Set();
+
+  slideRows.forEach(function (row) {
+    const content = typeof common.parseJsonSafe === 'function' ? common.parseJsonSafe(row.content_json) : null;
+    if (!content || typeof content !== 'object') {
+      return;
+    }
+
+    const stack = [content];
+    while (stack.length) {
+      const value = stack.pop();
+      if (!value || typeof value !== 'object') {
+        continue;
+      }
+
+      if (Array.isArray(value)) {
+        value.forEach(function (item) {
+          stack.push(item);
+        });
+        continue;
+      }
+
+      if (Object.prototype.hasOwnProperty.call(value, slideMatchKey) && Number(value[slideMatchKey]) === Number(sourceId)) {
+        const slideId = Number(row.id);
+        if (Number.isFinite(slideId) && slideId > 0 && !seenSlideIds.has(slideId)) {
+          seenSlideIds.add(slideId);
+          slideIds.push(slideId);
+        }
+        break;
+      }
+
+      Object.keys(value).forEach(function (key) {
+        stack.push(value[key]);
+      });
+    }
+  });
+
+  if (!slideIds.length) {
+    return [];
+  }
+
+  const [screenRows] = await connection.query(
+    `SELECT DISTINCT s.slug
+     FROM d_screens s
+     JOIN c_playlist_slides ps ON ps.playlist_id = s.playlist_id
+     WHERE ps.slide_id IN (?)
+       AND s.slug IS NOT NULL`,
+    [slideIds]
+  );
+
+  return screenRows.map(function (row) {
+    return String(row.slug || '').trim();
+  }).filter(Boolean);
+}
+
+async function notifyAffectedScreens(connection, common, notifyPlayerScreens, slideMatchKey, sourceId) {
+  if (typeof notifyPlayerScreens !== 'function') {
+    return;
+  }
+
+  const slugs = await getAffectedScreenSlugs(connection, common, slideMatchKey, sourceId);
+  if (!slugs.length) {
+    return;
+  }
+
+  await notifyPlayerScreens(slugs, 'refresh');
+}
+
+function normalizeSnapshotValue(value) {
+  return String(value || '').trim();
+}
+
+async function hasRssFeedChanged(connection, rssFeedId, items) {
+  const [rows] = await connection.query(
+    `SELECT item_json
+     FROM i_rss_feed_items
+     WHERE rss_feed_id = ?
+     ORDER BY position ASC, id ASC`,
+    [rssFeedId]
+  );
+
+  const currentSnapshots = (rows || []).map(function (row) {
+    return normalizeSnapshotValue(row && row.item_json);
+  });
+  const nextSnapshots = (Array.isArray(items) ? items : []).map(function (item) {
+    return normalizeSnapshotValue(JSON.stringify(item || {}));
+  });
+
+  if (currentSnapshots.length !== nextSnapshots.length) {
+    return true;
+  }
+
+  for (let index = 0; index < currentSnapshots.length; index += 1) {
+    if (currentSnapshots[index] !== nextSnapshots[index]) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+function hasApiSourceChanged(apiSource, responseDetails) {
+  return normalizeSnapshotValue(apiSource && apiSource.last_response_json) !== normalizeSnapshotValue(responseDetails && responseDetails.responseJson);
+}
+
+async function refreshApiSource(pool, common, apiSourceOrId, actorId, notifyPlayerScreens) {
  const connection = await pool.getConnection();
  try {
    const apiSource = apiSourceOrId && typeof apiSourceOrId === 'object'
@@ -25,6 +133,14 @@ async function refreshApiSource(pool, common, apiSourceOrId, actorId) {
      [new Date(), pullError || null, responseDetails ? responseDetails.responseStatus : null, responseDetails ? responseDetails.responseContentType : null, responseDetails ? responseDetails.responseJson : null, actorId, apiSource.id]
    );
    await connection.commit();
+
+    if (!pullError && hasApiSourceChanged(apiSource, responseDetails)) {
+      try {
+        await notifyAffectedScreens(connection, common, notifyPlayerScreens, 'source_id', apiSource.id);
+      } catch (notifyError) {
+        console.warn('[data-source-refresh] Unable to notify players after API source refresh ' + apiSource.id + ':', notifyError);
+      }
+    }
  } catch (error) {
    try {
      await connection.rollback();
@@ -37,7 +153,7 @@ async function refreshApiSource(pool, common, apiSourceOrId, actorId) {
  }
 }

-async function refreshRssFeed(pool, common, rssFeedId, feedUrl, itemLimit, actorId) {
+async function refreshRssFeed(pool, common, rssFeedId, feedUrl, itemLimit, actorId, notifyPlayerScreens) {
  const connection = await pool.getConnection();
  try {
    let updatedItems = [];
@@ -50,11 +166,20 @@ async function refreshRssFeed(pool, common, rssFeedId, feedUrl, itemLimit, actor
    }

    await connection.beginTransaction();
+    const rssFeedChanged = await hasRssFeedChanged(connection, rssFeedId, updatedItems);
    if (typeof common.replaceRssFeedItems === 'function') {
      await common.replaceRssFeedItems(connection, rssFeedId, updatedItems);
    }
    await connection.commit();

+    if (!pullError && rssFeedChanged) {
+      try {
+        await notifyAffectedScreens(connection, common, notifyPlayerScreens, 'feed_id', rssFeedId);
+      } catch (notifyError) {
+        console.warn('[data-source-refresh] Unable to notify players after RSS feed refresh ' + rssFeedId + ':', notifyError);
+      }
+    }
+
    if (pullError) {
      console.error('[data-source-refresh] RSS feed refresh completed with an error for feed ' + rssFeedId + ': ' + pullError);
    }
@@ -198,7 +198,6 @@ module.exports = {
  getAuditUserId: getAuditUserId,
  getCanvasSignature: getCanvasSignature,
  fetchPlaylistCanvasId: fetchPlaylistCanvasId,
-  fetchPlaylistCanvasSignature: fetchPlaylistCanvasId,
  fetchScreensByPlaylistId: fetchScreensByPlaylistId,
  fetchScreensBySlideId: fetchScreensBySlideId,
  fetchScreensByTemplateId: fetchScreensByTemplateId,
@@ -30,6 +30,43 @@ function normalizeText(value) {
  return String(value || '').replace(/\s+/g, ' ').trim();
 }

+function quoteFontFamilyToken(token) {
+  const normalizedToken = normalizeText(token);
+  if (!normalizedToken) {
+    return '';
+  }
+
+  if (normalizedToken === 'inherit' || /^[a-zA-Z0-9_-]+$/.test(normalizedToken)) {
+    return normalizedToken;
+  }
+
+  return `'${normalizedToken.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
+}
+
+function normalizeFontFamilyFormat(format) {
+  return String(format || '')
+    .split(',')
+    .map(quoteFontFamilyToken)
+    .filter(Boolean)
+    .join(',');
+}
+
+function normalizeFontFamilyFormatEntry(entry) {
+  const value = String(entry || '').trim();
+  if (!value) {
+    return '';
+  }
+
+  const separatorIndex = value.indexOf('=');
+  if (separatorIndex === -1) {
+    return `${value}=${normalizeFontFamilyFormat(value)}`;
+  }
+
+  const label = value.slice(0, separatorIndex).trim();
+  const format = value.slice(separatorIndex + 1).trim();
+  return `${label}=${normalizeFontFamilyFormat(format || label)}`;
+}
+
 function resolveMediaRoot(mediaRootOrUploadDir) {
  const resolved = path.resolve(String(mediaRootOrUploadDir || '').trim());
  return path.basename(resolved) === 'uploads' ? path.dirname(resolved) : resolved;
@@ -119,22 +156,19 @@ function buildFontFaceRule(entry) {

 function buildFontStylesheet(fonts) {
  const rules = (Array.isArray(fonts) ? fonts : [])
-    .filter(function (font) {
-      return font && font.enabled !== false;
-    })
    .map(buildFontFaceRule)
    .filter(Boolean);
  return rules.length ? `/* Managed fonts */\n\n${rules.join('\n\n')}\n` : '/* Managed fonts */\n';
 }

 function buildFontFamilyFormats(fonts) {
-  const formatEntries = Array.from(new Set(DEFAULT_FONT_FAMILY_FORMATS.concat((Array.isArray(fonts) ? fonts : [])
+  const formatEntries = Array.from(new Set(DEFAULT_FONT_FAMILY_FORMATS.map(normalizeFontFamilyFormatEntry).concat((Array.isArray(fonts) ? fonts : [])
    .filter(function (font) {
      return font && font.enabled !== false && normalizeText(font.family || font.name);
    })
    .map(function (font) {
      const family = normalizeText(font.family || font.name);
-      return `${family}=${family}`;
+      return `${family}=${normalizeFontFamilyFormat(family)}`;
    }))))
    .sort(function (left, right) {
      const leftLabel = String(left || '').split('=')[0];
@@ -344,7 +378,7 @@ function collectFontLibrarySyncOperations(mediaRootOrUploadDir) {
    }

    operations.push({
-      type: font.enabled === false ? 'delete' : 'put',
+      type: 'put',
      uploadPath: `/media/${FONT_LIBRARY_DIR_NAME}/${font.fileName}`
    });
  });
@@ -363,7 +397,10 @@ module.exports = {
  collectFontLibraryDirectoryUploadPaths: collectFontLibraryDirectoryUploadPaths,
  collectFontLibrarySyncOperations: collectFontLibrarySyncOperations,
  getFontStylesheetHref: getFontStylesheetHref,
+  buildFontStylesheet: buildFontStylesheet,
  buildFontFamilyFormats: buildFontFamilyFormats,
+  normalizeFontFamilyFormat: normalizeFontFamilyFormat,
+  normalizeFontFamilyFormatEntry: normalizeFontFamilyFormatEntry,
  isSupportedFontUpload: isSupportedFontUpload,
  getFontLibraryDir: getFontLibraryDir,
  getFontManifestPath: getFontManifestPath,
@@ -30,6 +30,35 @@ function resolveAssetUrl(baseUrl, value) {
  return normalizedBaseUrl + '/' + raw.replace(/^\/+/, '');
 }

+function normalizeRenderableValue(value) {
+  if (value && typeof value === 'object') {
+    if (value.value !== undefined) {
+      return normalizeRenderableValue(value.value);
+    }
+    if (value.text !== undefined) {
+      return normalizeRenderableValue(value.text);
+    }
+    if (value.html !== undefined) {
+      return normalizeRenderableValue(value.html);
+    }
+    if (value.url !== undefined) {
+      return normalizeRenderableValue(value.url);
+    }
+    if (value.href !== undefined) {
+      return normalizeRenderableValue(value.href);
+    }
+    if (value.src !== undefined) {
+      return normalizeRenderableValue(value.src);
+    }
+    if (value.content !== undefined) {
+      return normalizeRenderableValue(value.content);
+    }
+    return '';
+  }
+
+  return String(value === undefined || value === null ? '' : value);
+}
+
 function getThumbnailCanvasSize(slide) {
  const template = slide && slide.template ? slide.template : null;
  return {
@@ -53,7 +82,16 @@ function buildThumbnailRegionStyle(region, canvasWidth, canvasHeight) {
 }

 function hasVisibleContent(html) {
-  return Boolean(String(html || '').replace(/<[^>]+>/g, '').trim());
+  var raw = String(html || '').trim();
+  if (!raw) {
+    return false;
+  }
+
+  if (/<img\b/i.test(raw)) {
+    return true;
+  }
+
+  return Boolean(raw.replace(/<[^>]+>/g, '').trim());
 }

 function buildTextRegionMarkup(region, regionContent) {
@@ -70,7 +108,7 @@ function buildTextRegionMarkup(region, regionContent) {

 function buildRegionInnerHtml(region, regionContent, baseUrl) {
  const regionType = String(regionContent.type || region.region_type || 'text').trim().toLowerCase();
-  const rawValue = regionContent && regionContent.value !== undefined ? regionContent.value : '';
+  const rawValue = normalizeRenderableValue(regionContent && regionContent.value !== undefined ? regionContent.value : '');

  if (regionType === 'image') {
    const src = resolveAssetUrl(baseUrl, rawValue);
@@ -89,7 +127,7 @@ function buildRegionInnerHtml(region, regionContent, baseUrl) {
  if (regionType === 'webpage') {
    const src = resolveAssetUrl(baseUrl, rawValue);
    return src
-      ? '<div class="slide-preview-region slide-preview-webpage-region" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(src) + '" title="' + escapeHtml(region.label || region.region_key || 'webpage') + '" loading="eager" referrerpolicy="no-referrer" scrolling="no"></iframe></div>'
+      ? '<div class="slide-preview-region slide-preview-webpage-region" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(src) + '" title="' + escapeHtml(region.label || region.region_key || 'webpage') + '" loading="eager" referrerpolicy="no-referrer" scrolling="no" style="width:100%;height:100%;border:0;display:block;background:#fff;overflow:hidden;"></iframe></div>'
      : '';
  }

@@ -105,7 +143,7 @@ function buildRegionInnerHtml(region, regionContent, baseUrl) {
  if (regionType === 'html') {
    const html = String(rawValue || '').trim();
    return html
-      ? '<div class="slide-preview-region slide-preview-html-region" style="' + region.baseStyle + '"><iframe sandbox="" srcdoc="<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + escapeHtml(html) + '</body></html>" title="' + escapeHtml(region.label || region.region_key || 'html') + '" loading="eager" scrolling="no"></iframe></div>'
+      ? '<div class="slide-preview-region slide-preview-html-region" style="' + region.baseStyle + '"><iframe sandbox="" allowtransparency="true" srcdoc="' + escapeHtml('<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + html + '</body></html>') + '" title="' + escapeHtml(region.label || region.region_key || 'html') + '" loading="eager" scrolling="no" style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"></iframe></div>'
      : '';
  }

@@ -2,6 +2,8 @@

 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
+const vm = require('vm');
 const {
  escapeHtml,
  mediaKind,
@@ -10,7 +12,13 @@ const {
  sanitizeFontSize,
  sanitizeTextColor
 } = require('#src/player/render-helpers');
-const { createRequestAuthHeaders } = require('#src/request-auth');
+const { createRequestAuthHeaders, createPageAuthToken } = require('#src/request-auth');
+
+const placeholderUtils = (() => {
+  const sandbox = { window: {} };
+  vm.runInNewContext(fs.readFileSync(path.join(__dirname, '..', '..', 'public', 'js', 'shared', 'placeholder-utils.js'), 'utf8'), sandbox);
+  return sandbox.window.placeholderUtils || {};
+})();

 const SYSTEM_CHROMIUM_PATHS = [
  process.env.PUPPETEER_EXECUTABLE_PATH,
@@ -52,6 +60,35 @@ function resolveAssetUrl(baseUrl, value) {
  return normalizedBaseUrl + '/' + raw.replace(/^\/+/, '');
 }

+function normalizeRenderableValue(value) {
+  if (value && typeof value === 'object') {
+    if (value.value !== undefined) {
+      return normalizeRenderableValue(value.value);
+    }
+    if (value.text !== undefined) {
+      return normalizeRenderableValue(value.text);
+    }
+    if (value.html !== undefined) {
+      return normalizeRenderableValue(value.html);
+    }
+    if (value.url !== undefined) {
+      return normalizeRenderableValue(value.url);
+    }
+    if (value.href !== undefined) {
+      return normalizeRenderableValue(value.href);
+    }
+    if (value.src !== undefined) {
+      return normalizeRenderableValue(value.src);
+    }
+    if (value.content !== undefined) {
+      return normalizeRenderableValue(value.content);
+    }
+    return '';
+  }
+
+  return String(value === undefined || value === null ? '' : value);
+}
+
 function getCanvasSize(slide) {
  const template = slide && slide.template ? slide.template : null;
  return {
@@ -83,14 +120,63 @@ function buildThumbnailRegionStyle(region, canvasWidth, canvasHeight) {
 }

 function hasVisibleContent(html) {
-  return Boolean(String(html || '').replace(/<[^>]+>/g, '').trim());
+  var raw = String(html || '').trim();
+  if (!raw) {
+    return false;
+  }
+
+  if (/<img\b/i.test(raw)) {
+    return true;
+  }
+
+  return Boolean(raw.replace(/<[^>]+>/g, '').trim());
 }

-function buildTextRegionMarkup(region, regionContent) {
+function resolvePlaceholderPath(value, expression) {
+  const pathValue = String(expression || '').replace(/\.image\s*\([^)]*\)\s*$/i, '').trim();
+  return pathValue.split('.').reduce(function (current, segment) {
+    return current === undefined || current === null ? '' : current[segment];
+  }, value);
+}
+
+function getImagePlaceholderConfig(expression) {
+  const match = String(expression || '').match(/\.image\s*\(\s*([0-9]+)?\s*,?\s*([0-9]+)?\s*\)/i);
+  return {
+    width: match && match[1] ? Number(match[1]) : 0,
+    height: match && match[2] ? Number(match[2]) : 0
+  };
+}
+
+function substitutePlaceholders(html, regionContent, options) {
+  const source = String(html || '');
+  const type = String(regionContent && regionContent.type || '').trim().toLowerCase();
+  const item = options && typeof options.getItem === 'function' ? options.getItem(type, regionContent) : null;
+  if (!item) return source;
+  return source.replace(/\{\{\s*([^{}]+?)\s*\}\}/gi, function (_match, expression) {
+    const resolved = typeof placeholderUtils.resolvePlaceholderExpression === 'function'
+      ? placeholderUtils.resolvePlaceholderExpression(item, expression)
+      : resolvePlaceholderPath(item, expression);
+    const value = typeof placeholderUtils.formatPlaceholderValue === 'function' ? placeholderUtils.formatPlaceholderValue(resolved) : String(resolved || '');
+    if (typeof placeholderUtils.isImagePlaceholderExpression !== 'function' || !placeholderUtils.isImagePlaceholderExpression(expression)) {
+      return escapeHtml(value);
+    }
+    const remoteUrl = String(value || '').trim();
+    if (!/^https?:\/\//i.test(remoteUrl)) return '';
+    const imageConfig = typeof placeholderUtils.getImagePlaceholderConfig === 'function' ? placeholderUtils.getImagePlaceholderConfig(expression) : getImagePlaceholderConfig(expression);
+    const cacheFile = options && typeof options.getCachedImagePath === 'function' ? options.getCachedImagePath(remoteUrl) : '';
+    const imageUrl = cacheFile || remoteUrl;
+    const style = imageConfig.width && imageConfig.height
+      ? 'display:block;width:' + imageConfig.width + 'px;height:' + imageConfig.height + 'px;object-fit:contain;'
+      : 'display:block;max-width:' + (imageConfig.width || 100) + 'px;max-height:' + (imageConfig.height || 100) + 'px;width:auto;height:auto;';
+    return '<img src="' + escapeHtml(resolveAssetUrl(options && options.baseUrl, imageUrl)) + '" alt="" style="' + style + '" />';
+  });
+}
+
+function buildTextRegionMarkup(region, regionContent, options) {
  const fontFamily = sanitizeFontFamily(regionContent.font_family || region.font_family);
  const fontSize = sanitizeFontSize(regionContent.font_size || region.font_size);
  const fontColor = sanitizeTextColor(regionContent.font_color || region.font_color);
-  const renderedBody = renderEditorJsContent(regionContent.value || '');
+  const renderedBody = renderEditorJsContent(substitutePlaceholders(regionContent.value || '', regionContent, options));
  if (!hasVisibleContent(renderedBody)) {
    return '';
  }
@@ -98,9 +184,9 @@ function buildTextRegionMarkup(region, regionContent) {
  return '<div class="slide-preview-region slide-preview-text-region" style="' + region.baseStyle + '"><div class="slide-preview-text-content" style="width:' + region.pixelWidth + 'px;height:' + region.pixelHeight + 'px;overflow:hidden;' + (fontFamily ? 'font-family:' + escapeHtml(fontFamily) + ';' : '') + 'font-size:' + fontSize + 'px;color:' + escapeHtml(fontColor || '#000000') + ';">' + renderedBody + '</div></div>';
 }

-function buildRegionInnerHtml(region, regionContent, baseUrl) {
+function buildRegionInnerHtml(region, regionContent, baseUrl, options) {
  const regionType = String(regionContent.type || region.region_type || 'text').trim().toLowerCase();
-  const rawValue = regionContent && regionContent.value !== undefined ? regionContent.value : '';
+  const rawValue = normalizeRenderableValue(regionContent && regionContent.value !== undefined ? regionContent.value : '');

  if (regionType === 'image') {
    const src = resolveAssetUrl(baseUrl, rawValue);
@@ -119,7 +205,7 @@ function buildRegionInnerHtml(region, regionContent, baseUrl) {
  if (regionType === 'webpage') {
    const src = resolveAssetUrl(baseUrl, rawValue);
    return src
-      ? '<div class="slide-preview-region slide-preview-webpage-region" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(src) + '" title="' + escapeHtml(region.label || region.region_key || 'webpage') + '" loading="eager" referrerpolicy="no-referrer" scrolling="no"></iframe></div>'
+      ? '<div class="slide-preview-region slide-preview-webpage-region" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(src) + '" title="' + escapeHtml(region.label || region.region_key || 'webpage') + '" loading="eager" referrerpolicy="no-referrer" scrolling="no" style="width:100%;height:100%;border:0;display:block;background:#fff;overflow:hidden;"></iframe></div>'
      : '';
  }

@@ -135,7 +221,7 @@ function buildRegionInnerHtml(region, regionContent, baseUrl) {
  if (regionType === 'html') {
    const html = String(rawValue || '').trim();
    return html
-      ? '<div class="slide-preview-region slide-preview-html-region" style="' + region.baseStyle + '"><iframe sandbox="" srcdoc="<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + escapeHtml(html) + '</body></html>" title="' + escapeHtml(region.label || region.region_key || 'html') + '" loading="eager" scrolling="no"></iframe></div>'
+      ? '<div class="slide-preview-region slide-preview-html-region" style="' + region.baseStyle + '"><iframe sandbox="" allowtransparency="true" srcdoc="' + escapeHtml('<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + html + '</body></html>') + '" title="' + escapeHtml(region.label || region.region_key || 'html') + '" loading="eager" scrolling="no" style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"></iframe></div>'
      : '';
  }

@@ -144,7 +230,7 @@ function buildRegionInnerHtml(region, regionContent, baseUrl) {
    return '<div class="slide-preview-region slide-preview-rtmp-region" style="' + region.baseStyle + '"><div class="slide-preview-rtmp-placeholder">' + escapeHtml(label) + '</div></div>';
  }

-  return buildTextRegionMarkup(region, regionContent);
+  return buildTextRegionMarkup(region, regionContent, Object.assign({}, options, { baseUrl: baseUrl }));
 }

 async function loadChromium() {
@@ -161,7 +247,7 @@ function loadSharp() {
  return require('sharp');
 }

-function buildThumbnailPreviewMarkup(slide, baseUrl) {
+function buildThumbnailPreviewMarkup(slide, baseUrl, options) {
  const template = slide && slide.template ? slide.template : null;
  if (!template) {
    return '';
@@ -176,7 +262,7 @@ function buildThumbnailPreviewMarkup(slide, baseUrl) {
      pixelWidth: Math.max(1, Math.round(Number(region && region.width || 0) || 1)),
      pixelHeight: Math.max(1, Math.round(Number(region && region.height || 0) || 1))
    });
-    return buildRegionInnerHtml(previewRegion, regionContent, normalizedBaseUrl);
+    return buildRegionInnerHtml(previewRegion, regionContent, normalizedBaseUrl, options);
  }).join('');
 }

@@ -190,7 +276,7 @@ function buildThumbnailPreviewPayload(slide, options) {
    backgroundColor: template && template.background_color ? String(template.background_color) : '#111111',
    backgroundImagePath: template && template.background_image_path ? String(template.background_image_path) : '',
    fontStylesheetHref: String(options && options.fontStylesheetHref || '').trim(),
-    html: buildThumbnailPreviewMarkup(slide, options && options.baseUrl)
+    html: buildThumbnailPreviewMarkup(slide, options && options.baseUrl, options)
  };
 }

@@ -253,6 +339,53 @@ async function captureSlideThumbnail(options) {
    throw new Error('Slide not found.');
  }

+  const rssFeedsData = typeof common.fetchRssFeedsData === 'function' ? await common.fetchRssFeedsData(pool) : { rssFeeds: [] };
+  const rssFeeds = await Promise.all((rssFeedsData.rssFeeds || []).map(async function (feed) {
+    const items = typeof common.fetchRssFeedItemsByFeedId === 'function' ? await common.fetchRssFeedItemsByFeedId(pool, feed.id) : [];
+    return Object.assign({}, feed, { items: items });
+  }));
+  const apiSourcesData = typeof common.fetchApiSourcesData === 'function' ? await common.fetchApiSourcesData(pool) : { apiSources: [] };
+  const apiSources = (apiSourcesData.apiSources || []).map(function (source) {
+    return Object.assign({}, source, { responseJson: common.parseJsonSafe ? common.parseJsonSafe(source.last_response_json) : null });
+  });
+
+  function getApiItems(source) {
+    const response = source && source.responseJson;
+    const itemsPath = String(source && source.items_path || '').trim();
+    if (itemsPath) {
+      const selected = itemsPath.split('.').reduce(function (current, segment) {
+        return current === undefined || current === null ? '' : current[segment];
+      }, response);
+      return Array.isArray(selected) ? selected : [];
+    }
+    if (Array.isArray(response)) return response;
+    if (response && Array.isArray(response.items)) return response.items;
+    if (response && Array.isArray(response.results)) return response.results;
+    if (response && Array.isArray(response.data)) return response.data;
+    return response ? [response] : [];
+  }
+
+  function getThumbnailItem(type, regionContent) {
+    const index = Math.max(0, Math.max(1, Number(regionContent && regionContent.item_number || 1)) - 1);
+    if (type === 'api') {
+      const source = apiSources.find(function (entry) { return Number(entry.id) === Number(regionContent.source_id); });
+      return getApiItems(source)[index] || null;
+    }
+    if (type === 'rss') {
+      const feed = rssFeeds.find(function (entry) { return Number(entry.id) === Number(regionContent.feed_id); });
+      return feed && Array.isArray(feed.items) ? feed.items[index] || null : null;
+    }
+    return null;
+  }
+
+  function getCachedImagePath(remoteUrl) {
+    const hash = crypto.createHash('sha256').update(String(remoteUrl || '')).digest('hex');
+    const cacheDir = path.join(mediaDir, 'player-cache', 'remote-images');
+    const candidates = ['.png', '.jpg', '.jpeg', '.gif', '.webp', '.svg'];
+    const candidate = candidates.map(function (extension) { return path.join(cacheDir, hash + extension); }).find(function (filePath) { return fs.existsSync(filePath); });
+    return candidate ? '/media/player-cache/remote-images/' + path.basename(candidate) : '';
+  }
+
  const thumbnailDir = path.join(mediaDir, 'thumbnails');
  const thumbnailRelativePath = String(slide.thumbnail_path || '').trim() || '/media/thumbnails/slides/slide-' + slide.id + '.png';
  const filePath = path.join(mediaDir, thumbnailRelativePath.replace(/^\/+media\//, ''));
@@ -302,22 +435,29 @@ async function captureSlideThumbnail(options) {
  try {
    const page = await browser.newPage();
    try {
-      const previewPath = '/api/internal/slide-thumbnails/' + slide.id + '/popup-preview';
-      const previewUrl = baseUrl + previewPath;
      const previewPayload = buildThumbnailPreviewPayload(slide, {
        baseUrl: baseUrl,
-        fontStylesheetHref: options && options.fontStylesheetHref ? options.fontStylesheetHref : ''
+        fontStylesheetHref: options && options.fontStylesheetHref ? options.fontStylesheetHref : '',
+        getItem: getThumbnailItem,
+        getCachedImagePath: getCachedImagePath
      });
+      const previewPath = '/slides/popup-preview';
+      const previewUrl = baseUrl + previewPath + '#' + encodeURIComponent(JSON.stringify(previewPayload));
        await page.setViewport({
          width: Math.max(1, Number(previewPayload.canvasWidth || PLAYER_VIEWPORT.width)),
          height: Math.max(1, Number(previewPayload.canvasHeight || PLAYER_VIEWPORT.height)),
          deviceScaleFactor: 1
        });
-      await page.setExtraHTTPHeaders(createRequestAuthHeaders({
+      await page.setExtraHTTPHeaders(Object.assign({}, createRequestAuthHeaders({
        method: 'GET',
        pathname: previewPath
+      }), {
+        'x-pulse-page-auth': createPageAuthToken({ scope: 'thumbnail-preview', slideId: slide.id })
      }));
-      await page.goto(previewUrl, { waitUntil: 'domcontentloaded', timeout: 30000 });
+      const previewResponse = await page.goto(previewUrl, { waitUntil: 'domcontentloaded', timeout: 30000 });
+      if (!previewResponse || previewResponse.status() >= 400) {
+        throw new Error('Popup preview returned HTTP ' + (previewResponse ? previewResponse.status() : 'no response') + '.');
+      }
      await waitForThumbnailRender(page);
      const canvas = await page.$('#popup-preview-canvas');
      if (!canvas) {
@@ -36,6 +36,22 @@ function normalizeBaseUrl(value) {
  return String(value || '').trim().replace(/\/$/, '');
 }

+function appendPlayerDeviceIdToUrl(baseUrl, playerIdentifier) {
+  const targetBaseUrl = normalizeBaseUrl(baseUrl);
+  const deviceId = String(playerIdentifier || '').trim();
+  if (!targetBaseUrl || !deviceId) {
+    return targetBaseUrl;
+  }
+
+  try {
+    const url = new URL(targetBaseUrl);
+    url.searchParams.set('deviceId', deviceId);
+    return url.toString().replace(/\/$/, '');
+  } catch (_error) {
+    return targetBaseUrl;
+  }
+}
+
 function normalizePlayerRowBaseUrl(player) {
  return normalizeBaseUrl(player && player.internal_base_url);
 }
@@ -74,8 +90,8 @@ function createUploadSyncService(options) {
    throw new Error('createUploadSyncService requires the upload dependencies.');
  }

-  async function getPlayerInternalBaseUrl() {
-    const metadata = await getPlayerTaskMetadata();
+  async function getPlayerInternalBaseUrl(preferredPlayerIdentifier, preferredPlayerInternalBaseUrl) {
+    const metadata = await getPlayerTaskMetadata(preferredPlayerIdentifier, preferredPlayerInternalBaseUrl);
    if (!metadata || metadata.playerActive === false) {
      return null;
    }
@@ -83,11 +99,44 @@ function createUploadSyncService(options) {
    return metadata.playerInternalBaseUrl ? metadata.playerInternalBaseUrl : null;
  }

-  async function getPlayerTaskMetadata() {
-    if (playerTaskMetadata) {
+  async function getPlayerTaskMetadata(preferredPlayerIdentifier, preferredPlayerInternalBaseUrl) {
+    const normalizedPreferredPlayerIdentifier = String(preferredPlayerIdentifier || '').trim();
+    const normalizedPreferredPlayerInternalBaseUrl = String(preferredPlayerInternalBaseUrl || '').trim().replace(/\/$/, '');
+
+    if (normalizedPreferredPlayerIdentifier && pool && typeof fetchPlayerRegistrations === 'function') {
+      try {
+        const players = await fetchPlayerRegistrations(pool);
+        const registeredPlayers = Array.isArray(players) ? players : [];
+        const exactPlayer = registeredPlayers.find(function (player) {
+          return String(player && player.identifier || '').trim() === normalizedPreferredPlayerIdentifier;
+        }) || null;
+        if (exactPlayer) {
+          const resolvedInternalBaseUrl = normalizePlayerRowBaseUrl(exactPlayer) || normalizedPreferredPlayerInternalBaseUrl || null;
+          const resolvedPublicBaseUrl = normalizeBaseUrl(exactPlayer && exactPlayer.public_base_url);
+          const resolvedIdentifier = String(exactPlayer && exactPlayer.identifier || '').trim();
+          playerInternalBaseUrl = resolvedInternalBaseUrl || null;
+          playerTaskMetadata = {
+            playerIdentifier: resolvedIdentifier || normalizedPreferredPlayerIdentifier || null,
+            playerPublicBaseUrl: resolvedPublicBaseUrl || null,
+            playerInternalBaseUrl: resolvedInternalBaseUrl || null,
+            playerLabel: resolvedIdentifier || resolvedPublicBaseUrl || resolvedInternalBaseUrl || null,
+            playerActive: true
+          };
+          return playerTaskMetadata;
+        }
+      } catch (_error) {
+      }
+    }
+
+    if (playerTaskMetadata && playerTaskMetadata.playerActive !== false) {
      return playerTaskMetadata;
    }

+    if (playerTaskMetadata && playerTaskMetadata.playerActive === false) {
+      playerTaskMetadata = null;
+      playerInternalBaseUrl = null;
+    }
+
    if (playerTaskMetadataPromise) {
      return playerTaskMetadataPromise;
    }
@@ -383,6 +432,10 @@ function createUploadSyncService(options) {
        const nextRelativePath = relativeDir ? path.posix.join(relativeDir, entryName) : entryName;
        const nextAbsolutePath = path.join(currentDir, entryName);

+        if (!relativeDir && entryName === 'player-cache') {
+          continue;
+        }
+
        if (entry.isDirectory && entry.isDirectory()) {
          await walkDirectory(nextAbsolutePath, nextRelativePath);
          continue;
@@ -404,6 +457,23 @@ function createUploadSyncService(options) {
    return Boolean(localUploadDir);
  }

+  async function fetchLivePlayerRegistrations() {
+    if (!pool || typeof fetchPlayerRegistrations !== 'function') {
+      return [];
+    }
+
+    try {
+      const players = await fetchPlayerRegistrations(pool);
+      return Array.isArray(players)
+        ? players.filter(function (player) {
+          return isRecentPlayerRegistration(player, 60);
+        })
+        : [];
+    } catch (_error) {
+      return [];
+    }
+  }
+
  function isPlayerUnavailableError(error) {
    const code = String(error && error.cause && error.cause.code || error && error.code || '').trim().toUpperCase();
    return code === 'ENOTFOUND' || code === 'ECONNREFUSED' || code === 'EAI_AGAIN' || code === 'ETIMEDOUT';
@@ -413,15 +483,33 @@ function createUploadSyncService(options) {
    return Boolean(response) && Number(response.status) === 503;
  }

+  function buildPendingPlayerUploadSyncKey(operation) {
+    const uploadPath = normalizeUploadReference(operation && operation.uploadPath);
+    const metadata = operation && operation.metadata && typeof operation.metadata === 'object'
+      ? operation.metadata
+      : null;
+    const playerIdentifier = String((operation && operation.playerIdentifier) || (metadata && metadata.playerIdentifier) || '').trim();
+    const playerInternalBaseUrl = normalizeBaseUrl((operation && operation.playerInternalBaseUrl) || (metadata && metadata.playerInternalBaseUrl) || '');
+
+    return [uploadPath, playerIdentifier, playerInternalBaseUrl].filter(Boolean).join('|');
+  }
+
  function queuePlayerUploadSync(operation) {
    if (!operation || !operation.uploadPath) {
      return;
    }

-    pendingPlayerUploadSyncs.set(normalizeUploadReference(operation.uploadPath), {
+    const metadata = operation.metadata && typeof operation.metadata === 'object' ? operation.metadata : null;
+    const playerIdentifier = String((operation && operation.playerIdentifier) || (metadata && metadata.playerIdentifier) || '').trim();
+    const playerInternalBaseUrl = normalizeBaseUrl((operation && operation.playerInternalBaseUrl) || (metadata && metadata.playerInternalBaseUrl) || '');
+
+    pendingPlayerUploadSyncs.set(buildPendingPlayerUploadSyncKey(operation), {
      type: operation.type === 'delete' ? 'delete' : 'put',
      uploadPath: normalizeUploadReference(operation.uploadPath),
-      uploadDir: operation.uploadDir || null
+      uploadDir: operation.uploadDir || null,
+      metadata: metadata,
+      playerIdentifier: playerIdentifier || null,
+      playerInternalBaseUrl: playerInternalBaseUrl || null
    });

    schedulePendingPlayerUploadSyncFlush();
@@ -438,9 +526,12 @@ function createUploadSyncService(options) {
        console.warn('Unable to flush pending upload syncs:', error);
      });
    }, 5000);
+    if (pendingPlayerUploadSyncFlushTimer && typeof pendingPlayerUploadSyncFlushTimer.unref === 'function') {
+      pendingPlayerUploadSyncFlushTimer.unref();
+    }
  }

-  async function pushUploadFileToPlayer(uploadPath, localUploadDir, resolvedPlayerInternalBaseUrl) {
+  async function pushUploadFileToPlayer(uploadPath, localUploadDir, resolvedPlayerInternalBaseUrl, preferredPlayerIdentifier) {
    if (!uploadPath || !shouldMirrorUploads(localUploadDir)) {
      return false;
    }
@@ -450,6 +541,7 @@ function createUploadSyncService(options) {
      return false;
    }

+    const playerMetadata = await getPlayerTaskMetadata(preferredPlayerIdentifier, targetBaseUrl);
    const relativePath = getUploadRelativePath(uploadPath);
    const sourcePath = resolveUploadFilePath(localUploadDir, uploadPath);
    if (!relativePath || !sourcePath) {
@@ -471,7 +563,8 @@ function createUploadSyncService(options) {
        pathname: `/api/media/${encodeURIComponent(relativePath)}`,
        body: fileBuffer
      });
-      const response = await fetch(`${targetBaseUrl}/api/media/${encodeURIComponent(relativePath)}`, {
+      const mediaUploadUrl = appendPlayerDeviceIdToUrl(`${targetBaseUrl}/api/media/${encodeURIComponent(relativePath)}`, playerMetadata && playerMetadata.playerIdentifier);
+      const response = await fetch(mediaUploadUrl, {
        method: 'PUT',
        headers: {
          'Content-Type': 'application/octet-stream',
@@ -494,7 +587,7 @@ function createUploadSyncService(options) {
    }
  }

-  async function removeUploadFileFromPlayer(uploadPath, localUploadDir, resolvedPlayerInternalBaseUrl) {
+  async function removeUploadFileFromPlayer(uploadPath, localUploadDir, resolvedPlayerInternalBaseUrl, preferredPlayerIdentifier) {
    if (!uploadPath || !shouldMirrorUploads(localUploadDir)) {
      return false;
    }
@@ -504,6 +597,7 @@ function createUploadSyncService(options) {
      return false;
    }

+    const playerMetadata = await getPlayerTaskMetadata(preferredPlayerIdentifier, targetBaseUrl);
    const relativePath = getUploadRelativePath(uploadPath);
    if (!relativePath) {
      return false;
@@ -513,7 +607,8 @@ function createUploadSyncService(options) {
        method: 'DELETE',
        pathname: `/api/media/${encodeURIComponent(relativePath)}`
      });
-      const response = await fetch(`${targetBaseUrl}/api/media/${encodeURIComponent(relativePath)}`, {
+      const mediaDeleteUrl = appendPlayerDeviceIdToUrl(`${targetBaseUrl}/api/media/${encodeURIComponent(relativePath)}`, playerMetadata && playerMetadata.playerIdentifier);
+      const response = await fetch(mediaDeleteUrl, {
        method: 'DELETE',
        headers: {
          Accept: 'application/json',
@@ -535,20 +630,26 @@ function createUploadSyncService(options) {
    }
  }

-  async function syncUploadRefsToPlayer(uploadRefs, localUploadDir) {
+  async function syncUploadRefsToPlayer(uploadRefs, localUploadDir, preferredPlayerIdentifier, preferredPlayerInternalBaseUrl) {
    if (!shouldMirrorUploads(localUploadDir)) {
      return;
    }

-    const resolvedPlayerInternalBaseUrl = await getPlayerInternalBaseUrl();
+    const resolvedPlayerInternalBaseUrl = await getPlayerInternalBaseUrl(preferredPlayerIdentifier, preferredPlayerInternalBaseUrl);
    const uniqueRefs = Array.from(new Set((uploadRefs || []).map(normalizeUploadReference).filter(Boolean)));
    for (let i = 0; i < uniqueRefs.length; i += 1) {
-      const success = await pushUploadFileToPlayer(uniqueRefs[i], localUploadDir, resolvedPlayerInternalBaseUrl);
+      const success = await pushUploadFileToPlayer(uniqueRefs[i], localUploadDir, resolvedPlayerInternalBaseUrl, preferredPlayerIdentifier);
      if (!success) {
        queuePlayerUploadSync({
          type: 'put',
          uploadPath: uniqueRefs[i],
-          uploadDir: localUploadDir
+          uploadDir: localUploadDir,
+          playerIdentifier: preferredPlayerIdentifier,
+          playerInternalBaseUrl: preferredPlayerInternalBaseUrl,
+          metadata: preferredPlayerIdentifier || preferredPlayerInternalBaseUrl ? {
+            playerIdentifier: preferredPlayerIdentifier || null,
+            playerInternalBaseUrl: preferredPlayerInternalBaseUrl || null
+          } : null
        });
      }
    }
@@ -666,10 +767,27 @@ function createUploadSyncService(options) {
      return;
    }

-    return queueMediaSyncTask('media-sync:' + operation.key, 'Media sync', {
-      mode: 'playlist',
-      operation: operation
-    });
+    const players = await fetchLivePlayerRegistrations();
+    if (!players.length) {
+      return queueMediaSyncTask('media-sync:' + operation.key, 'Media sync', {
+        mode: 'playlist',
+        operation: operation
+      });
+    }
+
+    return Promise.all(players.map(function (player) {
+      const playerIdentifier = String(player && player.identifier || '').trim();
+      const playerInternalBaseUrl = String(player && player.internal_base_url || '').trim().replace(/\/$/, '');
+      const playerPublicBaseUrl = String(player && player.public_base_url || '').trim().replace(/\/$/, '');
+
+      return queueMediaSyncTask('media-sync:' + operation.key + (playerIdentifier ? ':' + playerIdentifier : ''), 'Media sync', {
+        mode: 'playlist',
+        operation: operation,
+        playerIdentifier: playerIdentifier || null,
+        playerInternalBaseUrl: playerInternalBaseUrl || null,
+        playerPublicBaseUrl: playerPublicBaseUrl || null
+      });
+    }));
  }

  async function flushPendingPlaylistUploadSyncs() {
@@ -677,6 +795,11 @@ function createUploadSyncService(options) {
      return pendingPlaylistUploadSyncFlushInFlight;
    }

+    if (pendingPlaylistUploadSyncFlushTimer) {
+      clearTimeout(pendingPlaylistUploadSyncFlushTimer);
+      pendingPlaylistUploadSyncFlushTimer = null;
+    }
+
    if (!pendingPlaylistUploadSyncs.size) {
      return null;
    }
@@ -715,49 +838,59 @@ function createUploadSyncService(options) {
      return pendingPlayerUploadSyncFlushInFlight;
    }

+    if (pendingPlayerUploadSyncFlushTimer) {
+      clearTimeout(pendingPlayerUploadSyncFlushTimer);
+      pendingPlayerUploadSyncFlushTimer = null;
+    }
+
    if (!pendingPlayerUploadSyncs.size) {
      return null;
    }

    pendingPlayerUploadSyncFlushInFlight = (async function () {
-      const pendingEntries = Array.from(pendingPlayerUploadSyncs.values());
-      const playerMetadata = pendingEntries.length && pendingEntries[0] && pendingEntries[0].metadata
-        ? pendingEntries[0].metadata
-        : await getPlayerTaskMetadata();
-      if (playerMetadata && playerMetadata.playerActive === false) {
-        pendingPlayerUploadSyncs.clear();
-        pendingPlayerUploadSyncRetryLogAt = 0;
-        return;
-      }
-      const resolvedPlayerInternalBaseUrl = playerMetadata && playerMetadata.playerInternalBaseUrl
-        ? playerMetadata.playerInternalBaseUrl
-        : await getPlayerInternalBaseUrl();
+      const pendingEntries = Array.from(pendingPlayerUploadSyncs.entries());
+      const firstOperation = pendingEntries.length && pendingEntries[0] ? pendingEntries[0][1] : null;
+      const summaryPlayerMetadata = firstOperation && firstOperation.metadata
+        ? firstOperation.metadata
+        : await getPlayerTaskMetadata(firstOperation && firstOperation.playerIdentifier, firstOperation && firstOperation.playerInternalBaseUrl);
      let successCount = 0;
      let failureCount = 0;
      for (let i = 0; i < pendingEntries.length; i += 1) {
-        const operation = pendingEntries[i];
+        const entry = pendingEntries[i];
+        const pendingKey = entry[0];
+        const operation = entry[1];
+        const playerMetadata = operation && operation.metadata
+          ? operation.metadata
+          : await getPlayerTaskMetadata(operation && operation.playerIdentifier, operation && operation.playerInternalBaseUrl);
+        if (playerMetadata && playerMetadata.playerActive === false) {
+          pendingPlayerUploadSyncs.delete(pendingKey);
+          continue;
+        }
+        const resolvedPlayerInternalBaseUrl = playerMetadata && playerMetadata.playerInternalBaseUrl
+          ? playerMetadata.playerInternalBaseUrl
+          : await getPlayerInternalBaseUrl(playerMetadata && playerMetadata.playerIdentifier, playerMetadata && playerMetadata.playerInternalBaseUrl);
        let success = false;
        if (operation.type === 'delete') {
-          success = await removeUploadFileFromPlayer(operation.uploadPath, operation.uploadDir, resolvedPlayerInternalBaseUrl);
+          success = await removeUploadFileFromPlayer(operation.uploadPath, operation.uploadDir, resolvedPlayerInternalBaseUrl, playerMetadata && playerMetadata.playerIdentifier);
        } else {
-          success = await pushUploadFileToPlayer(operation.uploadPath, operation.uploadDir, resolvedPlayerInternalBaseUrl);
+          success = await pushUploadFileToPlayer(operation.uploadPath, operation.uploadDir, resolvedPlayerInternalBaseUrl, playerMetadata && playerMetadata.playerIdentifier);
        }
        if (success) {
          successCount += 1;
-          pendingPlayerUploadSyncs.delete(operation.uploadPath);
+          pendingPlayerUploadSyncs.delete(pendingKey);
        } else {
          failureCount += 1;
        }
      }

      if (successCount) {
-        logMediaSyncSummary('info', `Media sync completed ${successCount} upload${successCount === 1 ? '' : 's'}`, playerMetadata);
+        logMediaSyncSummary('info', `Media sync completed ${successCount} upload${successCount === 1 ? '' : 's'}`, summaryPlayerMetadata);
      }
      if (failureCount) {
        const now = Date.now();
        if (!pendingPlayerUploadSyncRetryLogAt || now - pendingPlayerUploadSyncRetryLogAt >= PLAYER_UPLOAD_SYNC_RETRY_LOG_INTERVAL_MS) {
          pendingPlayerUploadSyncRetryLogAt = now;
-          logMediaSyncSummary('warn', `Player unavailable, retry queued for ${failureCount} upload${failureCount === 1 ? '' : 's'}`, playerMetadata);
+          logMediaSyncSummary('warn', `Player unavailable, retry queued for ${failureCount} upload${failureCount === 1 ? '' : 's'}`, summaryPlayerMetadata);
        }
      } else if (!pendingPlayerUploadSyncs.size) {
        pendingPlayerUploadSyncRetryLogAt = 0;
@@ -782,6 +915,8 @@ function createUploadSyncService(options) {
        return;
      }

+      const playerMetadata = await getPlayerTaskMetadata(taskPayload.playerIdentifier, taskPayload.playerInternalBaseUrl);
+
      const data = await common.fetchAdminData(pool);
      const uploadRefs = new Set();
      (data.slides || []).forEach(function (slide) {
@@ -799,7 +934,8 @@ function createUploadSyncService(options) {
        queuePlayerUploadSync({
          type: 'put',
          uploadPath: uploadPath,
-          uploadDir: uploadDir
+          uploadDir: uploadDir,
+          metadata: playerMetadata
        });
      });
      fontLibraryOperations.forEach(function (operation) {
@@ -810,7 +946,8 @@ function createUploadSyncService(options) {
        queuePlayerUploadSync({
          type: String(operation.type || 'put').trim().toLowerCase() === 'delete' ? 'delete' : 'put',
          uploadPath: operation.uploadPath,
-          uploadDir: uploadDir
+          uploadDir: uploadDir,
+          metadata: playerMetadata
        });
      });
      await flushPendingPlayerUploadSyncs();
@@ -821,14 +958,34 @@ function createUploadSyncService(options) {
      const operation = normalizePlaylistUploadSyncOperation(taskPayload.operation || taskPayload);

      if (operation.nextUploadRefs.length) {
-        await syncUploadRefsToPlayer(operation.nextUploadRefs, operation.localUploadDir);
+        await syncUploadRefsToPlayer(operation.nextUploadRefs, operation.localUploadDir, taskPayload.playerIdentifier, taskPayload.playerInternalBaseUrl);
      }

      if (operation.previousUploadRefs.length) {
        const nextUploadRefSet = new Set(operation.nextUploadRefs);
-        await removeUnusedUploadFiles(pool, operation.localUploadDir, operation.previousUploadRefs.filter(function (reference) {
+        const removedUploadRefs = operation.previousUploadRefs.filter(function (reference) {
          return !nextUploadRefSet.has(reference);
-        }));
+        });
+        for (let i = 0; i < removedUploadRefs.length; i += 1) {
+          const removedUploadRef = removedUploadRefs[i];
+          const referenceCount = await countUploadReferences(pool, removedUploadRef);
+          if (referenceCount > 0) {
+            continue;
+          }
+
+          const deleted = await removeUploadFileFromPlayer(removedUploadRef, operation.localUploadDir, taskPayload.playerInternalBaseUrl, taskPayload.playerIdentifier);
+          if (!deleted) {
+            queuePlayerUploadSync({
+              type: 'delete',
+              uploadPath: removedUploadRef,
+              uploadDir: operation.localUploadDir,
+              playerIdentifier: taskPayload.playerIdentifier,
+              playerInternalBaseUrl: taskPayload.playerInternalBaseUrl,
+              metadata: playerMetadata
+            });
+          }
+        }
+        await removeUnusedUploadFiles(pool, operation.localUploadDir, removedUploadRefs);
      }

      if (operation.refreshScreenSlugs.length) {
@@ -857,7 +1014,7 @@ function createUploadSyncService(options) {
      safePayload.operation = Object.assign({}, safePayload.operation);
      delete safePayload.operation.pool;
    }
-    const playerMetadata = await getPlayerTaskMetadata();
+    const playerMetadata = await getPlayerTaskMetadata(safePayload.playerIdentifier, safePayload.playerInternalBaseUrl);

    const definition = {
      key: taskKey,
@@ -1,5 +1,5 @@
 const { createRequestAuthHeaders } = require('#src/request-auth');
-const { fetchPlayerRegistrations, getConfiguredPlayerIdentifier } = require('#src/data/player-registry');
+const { getConfiguredPlayerIdentifier } = require('#src/data/player-registry');

 function isLocalLikeBaseUrl(value) {
  let host = '';
@@ -33,24 +33,10 @@ function isRecentPlayerRegistration(player, staleSeconds) {
  return Number.isFinite(lastSeenAtValue) && lastSeenAtValue >= cutoffTime;
 }

-async function fetchRecentPlayerRegistrations(pool) {
-  if (!pool || typeof fetchPlayerRegistrations !== 'function') {
-    return [];
-  }
-
-  try {
-    const players = await fetchPlayerRegistrations(pool);
-    return (Array.isArray(players) ? players : []).filter(function (player) {
-      return isRecentPlayerRegistration(player, 60);
-    });
-  } catch (_error) {
-    return [];
-  }
-}
-
 function createPlayerActionService(options) {
  const pool = options && options.pool;
  const configuredPlayerInternalBaseUrl = String(options && options.playerInternalBaseUrl || '').replace(/\/$/, '');
+  const configuredBridgeInternalBaseUrl = String(options && options.bridgeInternalBaseUrl || '').trim().replace(/\/$/, '');
  const common = options && options.common;

  if (!common) {
@@ -151,6 +137,79 @@ function createPlayerActionService(options) {
    });
  }

+  async function fetchScreenConnectionsFromBaseUrl(baseUrl, slug) {
+    const targetBaseUrl = normalizeBaseUrl(baseUrl);
+    if (!targetBaseUrl) {
+      return null;
+    }
+
+    const authHeaders = createRequestAuthHeaders({
+      method: 'GET',
+      pathname: `/api/screens/${encodeURIComponent(slug)}/connections`
+    });
+
+    const response = await fetch(`${targetBaseUrl}/api/screens/${encodeURIComponent(slug)}/connections`, {
+      method: 'GET',
+      headers: {
+        Accept: 'application/json',
+        ...authHeaders
+      }
+    });
+
+    if (!response.ok) {
+      const errorText = await response.text().catch(function () { return ''; });
+      const error = new Error(errorText || `Unable to fetch connections for player ${slug}.`);
+      error.statusCode = response.status;
+      throw error;
+    }
+
+    return response.json().catch(function () {
+      return null;
+    });
+  }
+
+  async function forwardPlayerCommandToDevice(deviceId, commandOrPayload) {
+    const targetDeviceId = String(deviceId || '').trim();
+    const targetBridgeBaseUrl = normalizeBaseUrl(configuredBridgeInternalBaseUrl);
+    if (!targetDeviceId) {
+      throw new Error('Device ID is required.');
+    }
+    if (!targetBridgeBaseUrl) {
+      throw new Error('Unable to resolve the player bridge base URL.');
+    }
+
+    const payload = typeof commandOrPayload === 'object' && commandOrPayload !== null
+      ? Object.assign({}, commandOrPayload)
+      : { command: commandOrPayload };
+
+    const authHeaders = createRequestAuthHeaders({
+      method: 'POST',
+      pathname: `/api/players/${encodeURIComponent(targetDeviceId)}/commands`,
+      body: payload
+    });
+
+    const response = await fetch(`${targetBridgeBaseUrl}/api/players/${encodeURIComponent(targetDeviceId)}/commands`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        ...authHeaders
+      },
+      body: JSON.stringify(payload)
+    });
+
+    if (!response.ok) {
+      const errorText = await response.text().catch(function () { return ''; });
+      const error = new Error(errorText || `Unable to send command to player ${targetDeviceId}.`);
+      error.statusCode = response.status;
+      throw error;
+    }
+
+    return response.json().catch(function () {
+      return { ok: true };
+    });
+  }
+
  async function forwardPlayerCommand(slug, commandOrPayload, connectionId) {
    const resolvedPlayerInternalBaseUrl = await getPlayerInternalBaseUrl();
    return forwardPlayerCommandToBaseUrl(resolvedPlayerInternalBaseUrl, slug, commandOrPayload, connectionId);
@@ -190,69 +249,62 @@ function createPlayerActionService(options) {
  }

  async function getScreenConnections(slug) {
-    const authHeaders = createRequestAuthHeaders({
-      method: 'GET',
-      pathname: `/api/screens/${encodeURIComponent(slug)}/connections`
-    });
-    const recentPlayers = await fetchRecentPlayerRegistrations(pool);
-    const targetBaseUrls = Array.from(new Set((recentPlayers.length ? recentPlayers : []).map(function (player) {
-      return normalizeBaseUrl(player && player.public_base_url);
-    }).filter(Boolean)));
-
-    if (!targetBaseUrls.length) {
-      const resolvedPlayerInternalBaseUrl = await getPlayerInternalBaseUrl();
-      if (resolvedPlayerInternalBaseUrl) {
-        targetBaseUrls.push(resolvedPlayerInternalBaseUrl);
-      }
-    }
-
+    const bridgeBaseUrl = normalizeBaseUrl(configuredBridgeInternalBaseUrl);
+    const playerBaseUrl = await getPlayerInternalBaseUrl();
+    const targetBaseUrls = Array.from(new Set([bridgeBaseUrl, playerBaseUrl].map(normalizeBaseUrl).filter(Boolean)));
    if (!targetBaseUrls.length) {
      throw new Error('Unable to resolve the player internal base URL.');
    }

-    const results = await Promise.all(targetBaseUrls.map(async function (baseUrl) {
-      const response = await fetch(`${baseUrl}/api/screens/${encodeURIComponent(slug)}/connections`, {
-        method: 'GET',
-        headers: {
-          Accept: 'application/json',
-          ...authHeaders
-        }
-      });
-
-      if (!response.ok) {
-        return null;
-      }
-
-      return response.json().catch(function () {
-        return null;
-      });
+    const results = await Promise.allSettled(targetBaseUrls.map(function (baseUrl) {
+      return fetchScreenConnectionsFromBaseUrl(baseUrl, slug);
    }));

+    const successfulResults = results.filter(function (result) {
+      return result.status === 'fulfilled' && result.value;
+    }).map(function (result) {
+      return result.value;
+    });
+
+    if (!successfulResults.length) {
+      const rejection = results.find(function (result) {
+        return result.status === 'rejected';
+      });
+      throw rejection ? rejection.reason : new Error(`Unable to fetch connections for player ${slug}.`);
+    }
+
    const mergedConnections = [];
-    let screen = null;
-    let degraded = false;
-    results.forEach(function (result) {
-      if (!result) {
-        degraded = true;
-        return;
-      }
-      if (!screen && result.screen) {
-        screen = result.screen;
-      }
-      if (Array.isArray(result.connections)) {
-        mergedConnections.push.apply(mergedConnections, result.connections);
-      }
-      if (result.degraded) {
-        degraded = true;
-      }
+    const seenKeys = new Set();
+
+    successfulResults.forEach(function (result) {
+      const connections = Array.isArray(result && result.connections) ? result.connections : [];
+      connections.forEach(function (connection) {
+        const key = [
+          String(connection && connection.id || '').trim(),
+          String(connection && connection.clientId || '').trim(),
+          String(connection && connection.deviceId || '').trim(),
+          String(connection && connection.playerPublicBaseUrl || '').trim()
+        ].join('|');
+        if (!key || seenKeys.has(key)) {
+          return;
+        }
+        seenKeys.add(key);
+        mergedConnections.push(connection);
+      });
    });

    return {
-      screen: screen,
+      screen: successfulResults.find(function (result) {
+        return Boolean(result && result.screen);
+      }) ? successfulResults.find(function (result) {
+        return Boolean(result && result.screen);
+      }).screen : null,
      screenSlug: slug,
      count: mergedConnections.length,
      connections: mergedConnections,
-      degraded: degraded
+      degraded: results.some(function (result) {
+        return result.status === 'fulfilled' && Boolean(result.value && result.value.degraded);
+      })
    };
  }

@@ -302,6 +354,7 @@ function createPlayerActionService(options) {
    forwardAnnouncementRefresh: forwardAnnouncementRefresh,
    getScreenConnections: getScreenConnections,
    forwardPlayerCommandToBaseUrl: forwardPlayerCommandToBaseUrl,
+    forwardPlayerCommandToDevice: forwardPlayerCommandToDevice,
    getScreenDeleteBlockMessage: getScreenDeleteBlockMessage,
    getSlideDeleteBlockMessage: getSlideDeleteBlockMessage,
    getTemplateDeleteBlockMessage: getTemplateDeleteBlockMessage,
@@ -4,7 +4,7 @@ const path = require('path');
 const PUBLIC_JS_ROOT = path.join(__dirname, '..', 'public', 'js');
 const REGION_ROOT_DIR = path.join(PUBLIC_JS_ROOT, 'regions');
 const REGION_TYPE_DIR = path.join(REGION_ROOT_DIR, 'type');
-const REGION_CORE_SCRIPTS = ['js/shared/placeholder-utils.js', 'js/shared/placeholder-chips.js', 'js/shared/time-date-placeholders.js', 'js/regions/region-utils.js', 'js/regions/region-types.js'];
+const REGION_CORE_SCRIPTS = ['js/shared/placeholder-utils.js', 'js/shared/placeholder-chips.js', 'js/shared/placeholder-info.js', 'js/shared/time-date-placeholders.js', 'js/regions/region-utils.js', 'js/regions/region-types.js'];

 function withAssetVersion(scriptPath, assetVersion) {
  if (!assetVersion) {
@@ -22,6 +22,7 @@ async function initializeWebServer(options) {
    pool: pool,
    common: common,
    backgroundTaskQueue: backgroundTaskQueue,
+    notifyPlayerScreens: options && options.notifyPlayerScreens ? options.notifyPlayerScreens : null,
    uploadSyncService: webBootstrap.uploadSyncService,
    captureSlideThumbnail: captureSlideThumbnail,
    mediaDir: mediaDir,
@@ -29,10 +29,15 @@ module.exports = function registerMiddleware(app, deps) {
  });

  app.use(function (req, res, next) {
-    if (req.path === '/' || req.path === '/login' || req.path === '/logout' || req.path.indexOf('/api/internal/slide-thumbnails/') === 0 || req.path === '/api/internal/sync/player-media') {
+    if (req.path === '/' || req.path === '/login' || req.path === '/logout' || req.path === '/slides/popup-preview' || req.path.indexOf('/api/internal/slide-thumbnails/') === 0 || req.path === '/api/internal/sync/player-media' || req.path === '/api/internal/sync/player-font') {
      return next();
    }

-    return requireAuth(req, res, next);
+    return requireAuth(req, res, function () {
+      if (req.currentUser && req.currentUser.mustChangePassword && req.path !== '/account' && req.path !== '/account/password' && req.path !== '/account/sessions/revoke' && req.path !== '/logout') {
+        return res.redirect('/account?message=' + encodeURIComponent('Please change your password before continuing.'));
+      }
+      next();
+    });
  });
 };
@@ -0,0 +1,9 @@
+// Forward unmatched requests to the shared error-page handler.
+
+module.exports = function registerNotFoundHandler(app) {
+  app.use(function (_req, _res, next) {
+    const error = new Error('Page not found.');
+    error.statusCode = 404;
+    next(error);
+  });
+};
@@ -9,6 +9,8 @@ function routePath(...segments) {
 module.exports = {
  renderLoginPage: require(routePath('auth', 'login')),
  renderAccountPage: require(routePath('account', 'password')),
+  renderSettingsPage: require(routePath('settings', 'index')),
+  renderAboutPage: require(routePath('settings', 'about', 'index')),
  renderUsersPage: require(routePath('settings', 'users', 'list')),
  renderUsersAddPage: require(routePath('settings', 'users', 'add')),
  renderUsersEditPage: require(routePath('settings', 'users', 'edit')),
@@ -163,6 +163,37 @@
  opacity: 0.8;
 }

+.settings-nav-card {
+  position: sticky;
+  top: 1rem;
+}
+
+.settings-section-card h4.text-uppercase {
+  color: var(--bs-emphasis-color) !important;
+  font-size: 0.86rem;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  margin-top: 0.25rem;
+}
+
+.settings-audit-retention-input {
+  max-width: 18rem;
+}
+
+.settings-audit-category-label {
+  color: var(--bs-secondary-color);
+  font-size: 0.75rem;
+  font-weight: 600;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+}
+
+@media (max-width: 991.98px) {
+  .settings-nav-card {
+    position: static;
+  }
+}
+
 .card {
  box-shadow: none;
 }
@@ -224,6 +255,39 @@
 .template-preview-card .btn-group {
  display: grid;
  grid-template-columns: repeat(3, minmax(0, 1fr));
+.audit-change-list {
+  display: grid;
+  padding: 0.08rem 0.3rem;
+  border-radius: 0.2rem;
+  gap: 0.2rem;
+  min-width: 18rem;
+}
+.audit-change-row {
+  display: grid;
+  grid-template-columns: minmax(8rem, 0.7fr) minmax(5rem, 1fr) auto minmax(5rem, 1fr);
+  background: var(--bs-danger-bg-subtle);
+  gap: 0.35rem;
+  align-items: baseline;
+  font-size: 0.78rem;
+}
+  background: var(--bs-success-bg-subtle);
+.audit-change-to {
+  overflow-wrap: anywhere;
+  white-space: pre-wrap;
+}
+.audit-change-from {
+  color: var(--bs-danger-text-emphasis);
+}
+.audit-change-to {
+  color: var(--bs-success-text-emphasis);
+}
+.audit-change-from del,
+.audit-change-to ins {
+  text-decoration-thickness: 2px;
+}
+.audit-change-arrow {
+  color: var(--bs-secondary-color);
+}
  gap: 0.5rem;
 }

@@ -263,6 +327,12 @@
  border-bottom-width: 0;
 }

+.rbac-permissions-table > thead > tr > * {
+  background-color: var(--bs-tertiary-bg) !important;
+  color: var(--bs-emphasis-color) !important;
+  border-bottom-color: var(--bs-border-color) !important;
+}
+
 .template-designer-form--previewing .region-item [disabled],
 .template-designer-form--previewing .template-details-card [disabled],
 .template-designer-form--previewing .template-options-card [disabled],
@@ -405,6 +475,11 @@
  border-radius: 1rem;
  background: var(--bs-body-bg);
  box-shadow: 0 1rem 2rem rgba(15, 23, 42, 0.18);
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+  max-height: min(32rem, calc(100vh - 3rem));
+  overflow: hidden;
 }

 .announcement-type-picker__menu {
@@ -437,15 +512,61 @@
  align-items: center;
  justify-content: space-between;
  gap: 0.75rem;
-  margin-bottom: 0.75rem;
  font-size: 0.875rem;
  font-weight: 700;
 }

+.announcement-icon-picker__search {
+  flex: 0 0 auto;
+}
+
+.announcement-icon-picker__search .input-group-text {
+  background: var(--bs-body-bg);
+  color: var(--bs-secondary-color);
+}
+
+.announcement-icon-picker__section {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  min-height: 0;
+}
+
+.announcement-icon-picker__section-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  color: var(--bs-secondary-color);
+  font-size: 0.75rem;
+  font-weight: 700;
+  letter-spacing: 0.05em;
+  text-transform: uppercase;
+}
+
+.announcement-icon-picker__section-count {
+  font-size: 0.7rem;
+  letter-spacing: 0;
+  text-transform: none;
+}
+
 .announcement-icon-picker__grid {
  display: grid;
  grid-template-columns: repeat(auto-fill, minmax(2.75rem, 1fr));
  gap: 0.5rem;
+  align-content: start;
+}
+
+.announcement-icon-picker__search-grid {
+  max-height: none;
+  overflow: hidden;
+  padding-right: 0;
+}
+
+.announcement-icon-picker__search-empty {
+  color: var(--bs-secondary-color);
+  font-size: 0.875rem;
+  line-height: 1.35;
 }

 .announcement-type-picker__grid {
@@ -742,6 +863,10 @@
  overflow: auto;
 }

+[data-table-pagination-card] > .card-header {
+  flex: 0 0 auto;
+}
+
 [data-table-pagination-card] > .card-footer {
  margin-top: auto;
  background: var(--bs-body-bg);
@@ -752,10 +877,54 @@
  box-shadow: none;
 }

+.account-lock-label-locked {
+  display: none;
+}
+
+.btn-check:checked + label .account-lock-label-unlocked {
+  display: none;
+}
+
+.btn-check:checked + label .account-lock-label-locked {
+  display: inline;
+}
+
 .admin-form-card .card-header {
  background: var(--bs-tertiary-bg);
 }

+.timetable-entries-table-shell {
+  overflow: hidden;
+  border-bottom-left-radius: calc(var(--bs-border-radius) - 1px);
+  border-bottom-right-radius: calc(var(--bs-border-radius) - 1px);
+}
+
+.timetable-entries-table-shell > .table-responsive {
+  margin-bottom: 0;
+}
+
+.timetable-entries-table {
+  border-collapse: collapse;
+}
+
+.timetable-entries-table > thead > tr:first-child > * {
+  border-top-width: 0;
+}
+
+.timetable-entries-table > :not(caption) > * > :first-child {
+  border-left-width: 0;
+  padding-left: 0;
+}
+
+.timetable-entries-table > :not(caption) > * > :last-child {
+  border-right-width: 0;
+  padding-right: 0;
+}
+
+.timetable-entries-table > tbody > tr:last-child > * {
+  border-bottom-width: 0;
+}
+
 .api-source-section-heading {
  display: flex;
  align-items: center;
@@ -1620,6 +1789,31 @@ html[data-bs-theme='dark'] .template-field-card .tox .tox-collection {
  background: var(--bs-body-bg);
 }

+.slide-image-cropper-frame.is-loading > :not(.slide-image-cropper-loading-overlay) {
+  opacity: 0.22;
+  filter: saturate(0.8);
+}
+
+.slide-image-cropper-loading-overlay {
+  position: absolute;
+  inset: 0;
+  z-index: 3;
+  display: none;
+  align-items: center;
+  justify-content: center;
+  background: rgba(var(--bs-body-bg-rgb, 255, 255, 255), 0.72);
+  backdrop-filter: blur(1px);
+}
+
+.slide-image-cropper-frame.is-loading .slide-image-cropper-loading-overlay {
+  display: flex;
+}
+
+.slide-image-cropper-loading-spinner {
+  width: 2.5rem;
+  height: 2.5rem;
+}
+
 .slide-image-cropper-frame img {
  display: block;
  max-width: 100%;
@@ -1657,6 +1851,10 @@ html[data-bs-theme='dark'] .template-field-card .tox .tox-collection {
  white-space: nowrap;
 }

+#slide-image-cropper-status:empty {
+  display: none;
+}
+
 .slide-image-region-preview-box {
  display: grid;
  gap: 0;
@@ -2107,10 +2305,21 @@ html[data-bs-theme='dark'] .template-field-card .tox .tox-collection {
 .template-field-actions {
  display: inline-flex;
  align-items: center;
+  flex-wrap: wrap;
+  justify-content: flex-end;
  gap: 0.5rem;
  margin-left: auto;
 }

+.template-editor-size-controls {
+  flex-shrink: 0;
+}
+
+.template-editor-size-controls .btn {
+  min-width: 2rem;
+  padding-inline: 0.45rem;
+}
+
 .template-field-head strong {
  font-size: 0.95rem;
  min-width: 0;
@@ -2189,6 +2398,14 @@ html[data-bs-theme='dark'] .template-field-card .tox .tox-collection {
  min-width: 0;
 }

+.template-field-card .editor-holder[data-editor-height] {
+  overflow: hidden;
+}
+
+.template-field-card .editor-holder .tox.tox-tinymce {
+  height: 100% !important;
+}
+
 .announcement-color-preview {
  display: flex;
  align-items: center;
@@ -2316,6 +2533,13 @@ html[data-bs-theme='dark'] .template-field-card .tox .tox-collection {
  text-transform: uppercase;
 }

+.api-region-placeholder-title-help {
+  font-size: 0.9rem;
+  font-weight: 800;
+  letter-spacing: normal;
+  text-transform: none;
+}
+
 .api-region-sample-accordion {
  padding: 0.85rem 1rem 1rem;
  margin-bottom: 0.75rem;
@@ -423,19 +423,6 @@
        return true;
      }

-      if (submitterValue === 'close' || submitterValue === 'new') {
-        var redirectUrl = submitterValue === 'close'
-          ? String(response.url || form.dataset.asyncSaveCloseUrl || window.location.href)
-          : String(response.url || form.dataset.asyncSaveNewUrl || window.location.href);
-        window.location.replace(redirectUrl);
-        return true;
-      }
-
-      if (form.dataset && form.dataset.asyncSaveNewRedirect === 'response-url') {
-        window.location.replace(String(response.url || form.dataset.asyncSaveNewUrl || window.location.href));
-        return true;
-      }
-
      var responseText = await response.text();
      var responseDocument = null;
      try {
@@ -454,8 +441,36 @@
        });
      }

+      try {
+        form.dispatchEvent(new CustomEvent('web-async-save:success', {
+          bubbles: true,
+          detail: {
+            form: form,
+            response: response,
+            responseText: responseText,
+            responseDocument: responseDocument,
+            submitterValue: submitterValue
+          }
+        }));
+      } catch (_error) {
+        // Ignore event dispatch failures and continue the save flow.
+      }
+
      clearFormDirty(form);

+      if (submitterValue === 'close' || submitterValue === 'new') {
+        var redirectUrl = submitterValue === 'close'
+          ? String(response.url || form.dataset.asyncSaveCloseUrl || window.location.href)
+          : String(response.url || form.dataset.asyncSaveNewUrl || window.location.href);
+        window.location.replace(redirectUrl);
+        return true;
+      }
+
+      if (form.dataset && form.dataset.asyncSaveNewRedirect === 'response-url') {
+        window.location.replace(String(response.url || form.dataset.asyncSaveNewUrl || window.location.href));
+        return true;
+      }
+
      var successMessage = typeof settings.getSuccessMessage === 'function'
        ? settings.getSuccessMessage({
            form: form,
@@ -539,6 +554,39 @@
      return true;
    }

+    function updateFontToggleRow(form) {
+      if (!form) {
+        return false;
+      }
+
+      var row = form.closest ? form.closest('tr[data-font-toggle-row]') : null;
+      if (!row) {
+        return false;
+      }
+
+      var enabledInput = form.querySelector('input[name="enabled"]');
+      var toggleButton = form.querySelector('button[type="submit"]');
+      var statusBadge = row.querySelector('[data-font-status-badge]');
+      var isCurrentlyEnabled = String(row.getAttribute('data-font-enabled') || '').trim() === 'true';
+      var willEnable = !isCurrentlyEnabled;
+
+      if (enabledInput) {
+        enabledInput.value = isCurrentlyEnabled ? '0' : '1';
+      }
+
+      if (toggleButton) {
+        toggleButton.textContent = willEnable ? 'Disable' : 'Enable';
+      }
+
+      if (statusBadge) {
+        statusBadge.className = statusBadge.className.replace(/text-bg-(success|secondary)/g, willEnable ? 'text-bg-success' : 'text-bg-secondary');
+        statusBadge.textContent = willEnable ? 'Enabled' : 'Disabled';
+      }
+
+      row.setAttribute('data-font-enabled', willEnable ? 'true' : 'false');
+      return true;
+    }
+
    document.addEventListener('submit', function (event) {
      var form = event.target;
      if (!form || !form.hasAttribute || !form.hasAttribute('data-async-command')) {
@@ -584,6 +632,15 @@
        body: body.toString(),
        credentials: 'same-origin'
      }).then(function (response) {
+        if (!response || Number(response.status) >= 400) {
+          return;
+        }
+
+        if (/^\/settings\/fonts\/[^/]+\/toggle$/.test(actionPath)) {
+          updateFontToggleRow(form);
+          return;
+        }
+
        if (shouldReloadAfterSuccess && response && response.ok) {
          window.location.reload();
          return;
@@ -39,6 +39,63 @@ function setAnnouncementScreenSelection(isSelected) {
  });
 }

+function getAnnouncementActionButtonState() {
+  var actionForm = document.getElementById('announcement-action-form');
+  var visibleButton = document.querySelector('button[form="announcement-action-form"]');
+  var actionPath = actionForm ? String(actionForm.getAttribute('action') || '').trim() : '';
+  var isPlay = /\/play$/.test(actionPath);
+  var isActive = !isPlay;
+  var selectedScreenCount = document.querySelectorAll('input[name="screen_ids[]"]:checked').length;
+
+  return {
+    visibleButton: visibleButton,
+    actionForm: actionForm,
+    isActive: isActive,
+    hasTargets: selectedScreenCount > 0,
+    actionDisabled: !isActive && selectedScreenCount === 0,
+    actionLabel: isActive ? 'Stop' : 'Play',
+    actionIcon: isActive ? 'bi-stop-fill' : 'bi-play-fill',
+    actionClassName: !isActive && selectedScreenCount === 0
+      ? 'btn-outline-info'
+      : (isActive ? 'btn-outline-warning' : 'btn-info'),
+    actionDisabledTitle: !isActive && selectedScreenCount === 0
+      ? 'Select at least one screen group to play this announcement.'
+      : '',
+    actionConfirmMessage: isActive
+      ? 'Stop this announcement on the selected screens now?'
+      : 'Send this announcement to the selected screens now?'
+  };
+}
+
+function updateAnnouncementActionButtonState() {
+  var state = getAnnouncementActionButtonState();
+  if (!state.visibleButton) {
+    return;
+  }
+
+  state.visibleButton.className = state.visibleButton.className.replace(/btn-outline-(info|warning|success)|btn-info/g, state.actionClassName);
+  state.visibleButton.disabled = state.actionDisabled;
+  state.visibleButton.setAttribute('aria-disabled', state.actionDisabled ? 'true' : 'false');
+  state.visibleButton.setAttribute('title', state.actionDisabled ? state.actionDisabledTitle : state.actionConfirmMessage);
+  state.visibleButton.setAttribute('aria-label', state.actionLabel);
+
+  var icon = state.visibleButton.querySelector('i.bi');
+  if (icon) {
+    icon.className = 'bi ' + state.actionIcon + ' me-1';
+  }
+
+  var label = state.visibleButton.childNodes.length > 1 ? state.visibleButton.childNodes[state.visibleButton.childNodes.length - 1] : null;
+  if (label && label.nodeType === Node.TEXT_NODE) {
+    label.textContent = state.actionLabel;
+  } else {
+    state.visibleButton.textContent = state.actionLabel;
+  }
+
+  if (state.actionForm) {
+    state.actionForm.setAttribute('data-confirm-message', state.actionConfirmMessage);
+  }
+}
+
 function positionAnnouncementTypePicker() {
  var picker = document.querySelector('[data-announcement-type-picker]');
  var toggle = document.querySelector('[data-announcement-type-picker-toggle]');
@@ -141,125 +198,6 @@ function setAnnouncementTypeValue(typeKey) {
  updateAnnouncementTypePickerSelection();
 }

-function updateAnnouncementIconPreview() {
-  var iconSelect = document.getElementById('announcement-icon');
-  var preview = document.querySelector('[data-announcement-icon-preview]');
-  if (!iconSelect || !preview) {
-    return;
-  }
-
-  var selectedOption = iconSelect.options[iconSelect.selectedIndex] || null;
-  var iconKey = selectedOption ? String(selectedOption.value || '').trim().toLowerCase() : '';
-  var label = selectedOption ? String(selectedOption.textContent || selectedOption.label || iconKey).trim() : iconKey;
-
-  preview.className = 'announcement-icon-preview';
-  preview.innerHTML = '<i class="bi bi-' + iconKey + '" aria-hidden="true"></i>';
-  preview.setAttribute('aria-label', label);
-  preview.setAttribute('title', label);
-}
-
-function positionAnnouncementIconPicker() {
-  var picker = document.querySelector('[data-announcement-icon-picker]');
-  var toggle = document.querySelector('[data-announcement-icon-picker-toggle]');
-  var shell = document.querySelector('[data-announcement-icon-picker-shell]');
-  if (!picker || picker.hidden || !toggle || !shell) {
-    return;
-  }
-
-  var padding = 8;
-  var toggleRect = toggle.getBoundingClientRect();
-  var menuRect = picker.getBoundingClientRect();
-  var viewportHeight = window.innerHeight || document.documentElement.clientHeight || toggleRect.bottom;
-  var placementAbove = false;
-  var spaceBelow = viewportHeight - toggleRect.bottom - padding;
-  var spaceAbove = toggleRect.top - padding;
-
-  if (menuRect.height > spaceBelow && spaceAbove > spaceBelow) {
-    placementAbove = true;
-  }
-
-  picker.classList.toggle('is-open-above', placementAbove);
-}
-
-function closeAnnouncementIconPicker() {
-  var picker = document.querySelector('[data-announcement-icon-picker]');
-  var toggle = document.querySelector('[data-announcement-icon-picker-toggle]');
-  if (!picker) {
-    return;
-  }
-
-  picker.hidden = true;
-  picker.classList.remove('is-open-above');
-  if (toggle) {
-    toggle.setAttribute('aria-expanded', 'false');
-  }
-}
-
-function openAnnouncementIconPicker() {
-  var picker = document.querySelector('[data-announcement-icon-picker]');
-  var toggle = document.querySelector('[data-announcement-icon-picker-toggle]');
-  if (!picker) {
-    return;
-  }
-
-  picker.hidden = false;
-  if (toggle) {
-    toggle.setAttribute('aria-expanded', 'true');
-  }
-
-  if (typeof window !== 'undefined' && window.requestAnimationFrame) {
-    window.requestAnimationFrame(positionAnnouncementIconPicker);
-  } else {
-    positionAnnouncementIconPicker();
-  }
-}
-
-function updateAnnouncementIconPickerSelection() {
-  var iconSelect = document.getElementById('announcement-icon');
-  var previewButton = document.querySelector('[data-announcement-icon-picker-toggle]');
-  var picker = document.querySelector('[data-announcement-icon-picker]');
-  if (!iconSelect || !previewButton || !picker) {
-    return;
-  }
-
-  var selectedOption = iconSelect.options[iconSelect.selectedIndex] || null;
-  var selectedValue = selectedOption ? String(selectedOption.value || '').trim().toLowerCase() : '';
-  var label = selectedOption ? String(selectedOption.textContent || selectedOption.label || selectedValue).trim() : selectedValue;
-  var icon = previewButton.querySelector('[data-announcement-icon-picker-icon]');
-  var text = previewButton.querySelector('[data-announcement-icon-picker-label]');
-
-  previewButton.setAttribute('aria-label', label);
-  previewButton.setAttribute('title', label);
-  if (icon) {
-    icon.className = 'bi bi-' + selectedValue;
-  }
-  if (text) {
-    text.textContent = label;
-  }
-
-  picker.querySelectorAll('[data-announcement-icon-option]').forEach(function (button) {
-    var isSelected = String(button.getAttribute('data-icon-key') || '').trim().toLowerCase() === selectedValue;
-    button.classList.toggle('is-selected', isSelected);
-    button.setAttribute('aria-pressed', isSelected ? 'true' : 'false');
-  });
-}
-
-function setAnnouncementIconValue(iconKey) {
-  var iconSelect = document.getElementById('announcement-icon');
-  if (!iconSelect) {
-    return;
-  }
-
-  var normalized = String(iconKey || '').trim().toLowerCase();
-  if (!normalized) {
-    return;
-  }
-
-  iconSelect.value = normalized;
-  updateAnnouncementIconPreview();
-  updateAnnouncementIconPickerSelection();
-}
-
 function initAnnouncementForm() {
  var typeInput = document.getElementById('announcement-type');
  var typePickerToggle = document.querySelector('[data-announcement-type-picker-toggle]');
@@ -270,10 +208,6 @@ function initAnnouncementForm() {
  var colorPicker = document.querySelector('[data-announcement-color-picker-shell]');
  var screenSelectAll = document.querySelector('[data-announcement-screen-select-all]');
  var screenSelectNone = document.querySelector('[data-announcement-screen-select-none]');
-  var iconSelect = document.getElementById('announcement-icon');
-  var iconPickerToggle = document.querySelector('[data-announcement-icon-picker-toggle]');
-  var iconPicker = document.querySelector('[data-announcement-icon-picker]');
-  var iconPickerClose = document.querySelector('[data-announcement-icon-picker-close]');

  if (typeInput) {
    updateAnnouncementTypePickerSelection();
@@ -347,44 +281,16 @@ function initAnnouncementForm() {
    });
  }

-  if (iconSelect) {
-    iconSelect.addEventListener('change', updateAnnouncementIconPreview);
-    updateAnnouncementIconPreview();
-  }
+  document.addEventListener('web-async-save:success', function (event) {
+    var detail = event && event.detail ? event.detail : null;
+    var form = detail && detail.form ? detail.form : null;
+    if (!form || form.id !== 'announcement-form') {
+      return;
+    }

-  if (iconPickerToggle) {
-    iconPickerToggle.addEventListener('click', function (event) {
-      event.preventDefault();
-      var isExpanded = iconPicker && !iconPicker.hidden;
-      if (isExpanded) {
-        closeAnnouncementIconPicker();
-      } else {
-        openAnnouncementIconPicker();
-      }
-    });
-  }
+    updateAnnouncementActionButtonState();
+  });

-  if (iconPickerClose) {
-    iconPickerClose.addEventListener('click', function (event) {
-      event.preventDefault();
-      closeAnnouncementIconPicker();
-    });
-  }
-
-  if (iconPicker) {
-    iconPicker.addEventListener('click', function (event) {
-      var button = event.target && event.target.closest ? event.target.closest('[data-announcement-icon-option]') : null;
-      if (!button) {
-        return;
-      }
-
-      event.preventDefault();
-      setAnnouncementIconValue(button.getAttribute('data-icon-key'));
-      closeAnnouncementIconPicker();
-    });
-  }
-
-  window.addEventListener('resize', positionAnnouncementIconPicker);
  window.addEventListener('resize', positionAnnouncementTypePicker);

  document.addEventListener('click', function (event) {
@@ -396,20 +302,9 @@ function initAnnouncementForm() {
      }
    }

-    var picker = document.querySelector('[data-announcement-icon-picker]');
-    var toggle = document.querySelector('[data-announcement-icon-picker-toggle]');
-    if (!picker || picker.hidden) {
-      return;
-    }
-
-    if (picker.contains(event.target) || (toggle && toggle.contains(event.target))) {
-      return;
-    }
-
-    closeAnnouncementIconPicker();
  });

-  updateAnnouncementIconPickerSelection();
+  updateAnnouncementActionButtonState();
 }

 if (typeof document !== 'undefined') {
@@ -8,8 +8,6 @@
  var normalizeDisplayIp = webUiHelpers.normalizeDisplayIp;
  var LIST_PAGE_SIZE = 25;
  var latestDashboardState = null;
-  var ALL_SCREENS_SLUG = '__all__';
-  var ALL_SCREENS_LABEL = 'All screens';

  function getClientSearchInput() {
    var table = document.getElementById('dashboard-clients-table');
@@ -20,6 +18,152 @@
    return container && container.querySelector ? container.querySelector('[data-table-search]') : document.querySelector('[data-table-search]');
  }

+  function getScreenCommandSelect() {
+    return document.querySelector('[data-screen-command-select]');
+  }
+
+  function getScreenCommandForms() {
+    if (!document.querySelectorAll) {
+      return [];
+    }
+
+    return Array.prototype.slice.call(document.querySelectorAll('[data-screen-command-form]'));
+  }
+
+  function getSelectedScreenClients(state) {
+    var select = getScreenCommandSelect();
+    var selectedSlug = select ? String(select.value || '').trim() : '';
+    var clients = Array.isArray(state && state.clients) ? state.clients : [];
+
+    if (!selectedSlug || selectedSlug === '__all__') {
+      return clients;
+    }
+
+    return clients.filter(function (client) {
+      return String(client && client.screen_slug || '').trim() === selectedSlug;
+    });
+  }
+
+  function getSelectedScreenLabel() {
+    var select = getScreenCommandSelect();
+    if (!select) {
+      return '';
+    }
+
+    var selectedOption = select.options && select.selectedIndex >= 0 ? select.options[select.selectedIndex] : null;
+    return selectedOption ? String(selectedOption.getAttribute('data-screen-name') || selectedOption.textContent || '').trim() : '';
+  }
+
+  function updateToggleButton(button, form, state) {
+    if (!button) {
+      return;
+    }
+
+    var action = String(form && form.getAttribute('data-screen-command-action') || '').trim();
+    var selectedLabel = getSelectedScreenLabel() || 'selected screen group';
+    var isAllScreens = String(getScreenCommandSelect() && getScreenCommandSelect().value || '').trim() === '__all__';
+    var clients = getSelectedScreenClients(state);
+    var hasClients = clients.length > 0;
+    var allPaused = hasClients && clients.every(function (client) {
+      return Boolean(client && client.paused);
+    });
+    var allBlackout = hasClients && clients.every(function (client) {
+      return Boolean(client && client.blackout);
+    });
+
+    if (action === 'pause') {
+      var pauseLabel = allPaused ? 'Resume ' + (isAllScreens ? 'all clients' : 'screen') : 'Pause ' + (isAllScreens ? 'all clients' : 'screen');
+      var pauseConfirm = allPaused ? 'Resume ' + (isAllScreens ? 'all connected clients' : selectedLabel) + '?' : 'Pause ' + (isAllScreens ? 'all connected clients' : selectedLabel) + '?';
+      var pauseIcon = allPaused ? 'bi-play-fill' : 'bi-pause-fill';
+      button.innerHTML = '<i class="bi ' + pauseIcon + ' me-1" aria-hidden="true"></i>' + escapeHtml(pauseLabel);
+      setButtonVariant(button, ['btn-success', 'btn-secondary', 'btn-outline-secondary', 'btn-outline-dark'], allPaused ? 'btn-success' : 'btn-info');
+      button.setAttribute('aria-label', pauseLabel);
+      button.setAttribute('title', pauseLabel);
+      if (form) {
+        var pauseInput = form.querySelector('input[name="paused"]');
+        if (pauseInput) {
+          pauseInput.value = allPaused ? 'false' : 'true';
+        }
+        form.setAttribute('data-confirm-message', pauseConfirm);
+      }
+      return;
+    }
+
+    if (action === 'blackout') {
+      var blackoutLabel = allBlackout ? 'Restore ' + (isAllScreens ? 'all clients' : 'screen') : 'Blackout ' + (isAllScreens ? 'all clients' : 'screen');
+      var blackoutConfirm = allBlackout ? 'Restore ' + (isAllScreens ? 'all connected clients' : selectedLabel) + '?' : 'Blackout ' + (isAllScreens ? 'all connected clients' : selectedLabel) + '?';
+      var blackoutIcon = allBlackout ? 'bi-eye' : 'bi-eye-slash';
+      button.innerHTML = '<i class="bi ' + blackoutIcon + ' me-1" aria-hidden="true"></i>' + escapeHtml(blackoutLabel);
+      setButtonVariant(button, ['btn-success', 'btn-danger', 'btn-secondary', 'btn-outline-secondary', 'btn-outline-dark'], allBlackout ? 'btn-success' : 'btn-secondary');
+      button.setAttribute('aria-label', blackoutLabel);
+      button.setAttribute('title', blackoutLabel);
+      if (form) {
+        var blackoutInput = form.querySelector('input[name="blackout"]');
+        if (blackoutInput) {
+          blackoutInput.value = allBlackout ? 'false' : 'true';
+        }
+        form.setAttribute('data-confirm-message', blackoutConfirm);
+      }
+    }
+  }
+
+  function updateScreenCommandControls() {
+    var select = getScreenCommandSelect();
+    if (!select) {
+      return;
+    }
+
+    var selectedSlug = String(select.value || '').trim();
+    var hasSelectedGroup = Boolean(selectedSlug);
+    var actionTarget = '/clients/' + encodeURIComponent(selectedSlug || '__all__') + '/commands';
+    var selectedName = getSelectedScreenLabel();
+    var selectedClients = getSelectedScreenClients(latestDashboardState);
+    var allPaused = selectedClients.length > 0 && selectedClients.every(function (client) {
+      return Boolean(client && client.paused);
+    });
+    var allBlackout = selectedClients.length > 0 && selectedClients.every(function (client) {
+      return Boolean(client && client.blackout);
+    });
+
+    getScreenCommandForms().forEach(function (form) {
+      if (!form) {
+        return;
+      }
+
+      form.setAttribute('action', actionTarget);
+
+      var action = String(form.getAttribute('data-screen-command-action') || '').trim();
+      var button = form.querySelector('button[type="submit"]');
+
+      if (button) {
+        button.disabled = !hasSelectedGroup;
+      }
+
+      if (action === 'pause' || action === 'blackout') {
+        updateToggleButton(button, form, latestDashboardState);
+        return;
+      }
+
+      if (button) {
+        button.setAttribute('aria-label', selectedName ? selectedName : 'Selected screen group');
+      }
+    });
+  }
+
+  function initScreenCommandControls() {
+    var select = getScreenCommandSelect();
+    if (!select || (select.dataset && select.dataset.bound === 'true')) {
+      return;
+    }
+
+    if (select.dataset) {
+      select.dataset.bound = 'true';
+    }
+
+    select.addEventListener('change', updateScreenCommandControls);
+    updateScreenCommandControls();
+  }
+
  function getClientListQueryState() {
    var searchParams = new URLSearchParams(String(window.location && window.location.search || ''));
    var searchInput = getClientSearchInput();
@@ -101,8 +245,6 @@
        client && client.slug,
        client && client.screen_slug,
        client && client.screen_name,
-        client && client.ipAddress,
-        client && client.clientIp,
        client && client.status,
        client && client.currentSlideTitle
      ];
@@ -120,7 +262,6 @@
      client: function (client) { return String(client && (getClientDisplayName(client) || client.client_name || client.name || client.clientId) || '').trim(); },
      screen: function (client) { return String(client && (client.screen_name || client.screen_slug) || '').trim(); },
      slide: function (client) { return String(client && client.currentSlideTitle || '').trim(); },
-      ip: function (client) { return String(client && client.clientIp || '').trim(); },
      viewport: function (client) {
        var viewport = client && client.viewport;
        if (!viewport || !viewport.width || !viewport.height) {
@@ -139,12 +280,6 @@
      ? [normalizedSortKey]
      : ['client'];

-    if (sortKeys[0] === 'client') {
-      sortKeys.push('ip');
-    } else if (sortKeys[0] === 'ip') {
-      sortKeys.push('client');
-    }
-
    return (Array.isArray(clients) ? clients.slice() : []).sort(function (leftClient, rightClient) {
      for (var index = 0; index < sortKeys.length; index += 1) {
        var sortKeyName = sortKeys[index];
@@ -170,77 +305,6 @@
    return clients.slice((query.page - 1) * LIST_PAGE_SIZE, ((query.page - 1) * LIST_PAGE_SIZE) + LIST_PAGE_SIZE);
  }

-  function getClientMoveModalElements() {
-    return {
-      modal: document.getElementById('client-move-screen-modal'),
-      form: document.getElementById('client-move-screen-form'),
-      targetSelect: document.getElementById('client-move-screen-target'),
-      connectionInput: document.querySelector('[data-client-move-connection-id]'),
-      deviceInput: document.querySelector('[data-client-move-device-id]'),
-      clientNameInput: document.querySelector('[data-client-move-client-name]'),
-      playerBaseUrlInput: document.querySelector('[data-client-move-player-base-url]')
-    };
-  }
-
-  function getClientMoveScreens() {
-    if (latestDashboardState && Array.isArray(latestDashboardState.screens) && latestDashboardState.screens.length) {
-      return latestDashboardState.screens.slice().sort(compareScreensByConnectedClients);
-    }
-
-    var select = document.getElementById('client-move-screen-target');
-    if (!select || !select.options) {
-      return [];
-    }
-
-    return Array.prototype.slice.call(select.options).map(function (option) {
-      return {
-        slug: String(option.value || '').trim(),
-        name: String(option.textContent || option.value || '').trim()
-      };
-    }).filter(function (screen) {
-      return Boolean(screen && screen.slug);
-    });
-  }
-
-  function updateClientMoveModalFromRow(row) {
-    var elements = getClientMoveModalElements();
-    if (!elements.form || !elements.targetSelect || !row) {
-      return;
-    }
-
-    var currentScreenSlug = String(row.getAttribute('data-client-screen-slug') || '').trim();
-    var connectionId = String(row.getAttribute('data-client-key') || '').trim();
-    var deviceId = String(row.getAttribute('data-client-device-id') || '').trim();
-    var playerBaseUrl = String(row.getAttribute('data-client-player-base-url') || '').trim();
-    var clientNameCell = row.querySelector('td[data-label="Client"] > div');
-    var clientName = String(clientNameCell && clientNameCell.textContent || '').trim();
-    var options = Array.prototype.slice.call(elements.targetSelect.options || []);
-
-    options.forEach(function (option) {
-      option.disabled = false;
-      if (String(option.value || '').trim() === currentScreenSlug) {
-        option.disabled = true;
-      }
-    });
-
-    elements.form.action = currentScreenSlug ? '/clients/' + encodeURIComponent(currentScreenSlug) + '/commands' : '#';
-    if (elements.connectionInput) {
-      elements.connectionInput.value = connectionId;
-    }
-    if (elements.deviceInput) {
-      elements.deviceInput.value = deviceId;
-    }
-    if (elements.clientNameInput) {
-      elements.clientNameInput.value = clientName;
-    }
-    if (elements.playerBaseUrlInput) {
-      elements.playerBaseUrlInput.value = playerBaseUrl;
-    }
-    elements.targetSelect.value = '';
-    if (elements.form.querySelector('button[type="submit"]')) {
-      elements.form.querySelector('button[type="submit"]').disabled = false;
-    }
-  }
  function renderClientActionCell(client) {
    var paused = Boolean(client.paused);
    var pauseButtonClass = 'btn btn-sm btn-info';
@@ -257,7 +321,7 @@
    return [
      '<div class="actions justify-content-end">',
      '<form method="post" action="/clients/' + encodeURIComponent(client.screen_slug) + '/commands" class="d-inline-block m-0" data-confirm-message="' + escapeHtml(reloadConfirmMessage) + '" data-async-command><input type="hidden" name="command" value="reload" /><input type="hidden" name="connectionId" value="' + escapeHtml(client.id) + '" /><input type="hidden" name="playerBaseUrl" value="' + escapeHtml(client.player_url || '') + '" /><button type="submit" class="btn btn-sm btn-danger" data-action="reload" aria-label="Reload client" title="Reload client"><i class="bi bi-arrow-repeat" aria-hidden="true"></i></button></form>',
-      '<button type="button" class="btn btn-sm btn-danger" data-action="move-screen" data-bs-toggle="modal" data-bs-target="#client-move-screen-modal" aria-label="Move client to another screen" title="Move client to another screen"><i class="bi bi-display" aria-hidden="true"></i></button>',
+      '<button type="button" class="btn btn-sm btn-danger" data-action="move-screen" aria-label="Move client to another screen" title="Move client to another screen"><i class="bi bi-display" aria-hidden="true"></i></button>',
      '<form method="post" action="/clients/' + encodeURIComponent(client.screen_slug) + '/commands" class="d-inline-block m-0" data-async-command><input type="hidden" name="command" value="previous" /><input type="hidden" name="connectionId" value="' + escapeHtml(client.id) + '" /><input type="hidden" name="playerBaseUrl" value="' + escapeHtml(client.player_url || '') + '" /><button type="submit" class="btn btn-sm btn-warning" data-action="previous" aria-label="Previous slide" title="Previous slide"><i class="bi bi-skip-backward-fill" aria-hidden="true"></i></button></form>',
      '<form method="post" action="/clients/' + encodeURIComponent(client.screen_slug) + '/commands" class="d-inline-block m-0" data-async-command><input type="hidden" name="command" value="next" /><input type="hidden" name="connectionId" value="' + escapeHtml(client.id) + '" /><input type="hidden" name="playerBaseUrl" value="' + escapeHtml(client.player_url || '') + '" /><button type="submit" class="btn btn-sm btn-warning" data-action="next" aria-label="Next slide" title="Next slide"><i class="bi bi-skip-forward-fill" aria-hidden="true"></i></button></form>',
      '<form method="post" action="/clients/' + encodeURIComponent(client.screen_slug) + '/commands" class="d-inline-block m-0" data-async-command><input type="hidden" name="command" value="pause" /><input type="hidden" name="connectionId" value="' + escapeHtml(client.id) + '" /><input type="hidden" name="playerBaseUrl" value="' + escapeHtml(client.player_url || '') + '" /><button type="submit" class="' + pauseButtonClass + '" data-action="pause" aria-label="' + pauseButtonLabel + '" title="' + pauseButtonLabel + '"><i class="bi ' + pauseButtonIcon + ' me-1" aria-hidden="true"></i>' + pauseButtonText + '</button></form>',
@@ -266,6 +330,60 @@
    ].join('');
  }

+  function getClientMoveModalElements() {
+    return {
+      modal: document.getElementById('client-move-screen-modal'),
+      form: document.getElementById('client-move-screen-form'),
+      targetSelect: document.getElementById('client-move-screen-target'),
+      connectionInput: document.querySelector('[data-client-move-connection-id]'),
+      deviceInput: document.querySelector('[data-client-move-device-id]'),
+      clientNameInput: document.querySelector('[data-client-move-client-name]'),
+      playerBaseUrlInput: document.querySelector('[data-client-move-player-base-url]')
+    };
+  }
+
+  function updateClientMoveModalFromRow(row) {
+    var elements = getClientMoveModalElements();
+    if (!elements.form || !elements.targetSelect || !row) {
+      return;
+    }
+
+    var currentScreenSlug = String(row.getAttribute('data-client-screen-slug') || '').trim();
+    var connectionId = String(row.getAttribute('data-client-id') || '').trim();
+    var deviceId = String(row.getAttribute('data-client-device-id') || '').trim();
+    var playerBaseUrl = String(row.getAttribute('data-client-player-base-url') || '').trim();
+    var clientNameCell = row.querySelector('td[data-label="Client"] > div');
+    var clientName = String(clientNameCell && clientNameCell.textContent || '').trim();
+    var options = Array.prototype.slice.call(elements.targetSelect.options || []);
+
+    options.forEach(function (option) {
+      if (!option) {
+        return;
+      }
+      option.disabled = String(option.value || '').trim() === currentScreenSlug;
+    });
+
+    elements.form.action = currentScreenSlug ? '/clients/' + encodeURIComponent(currentScreenSlug) + '/commands' : '#';
+    if (elements.connectionInput) {
+      elements.connectionInput.value = connectionId;
+    }
+    if (elements.deviceInput) {
+      elements.deviceInput.value = deviceId;
+    }
+    if (elements.clientNameInput) {
+      elements.clientNameInput.value = clientName;
+    }
+    if (elements.playerBaseUrlInput) {
+      elements.playerBaseUrlInput.value = playerBaseUrl;
+    }
+    if (elements.targetSelect) {
+      elements.targetSelect.value = '';
+    }
+    if (elements.form.querySelector('button[type="submit"]')) {
+      elements.form.querySelector('button[type="submit"]').disabled = false;
+    }
+  }
+
  function updateClientActionCell(cell, client) {
    if (!cell) {
      return;
@@ -412,13 +530,13 @@
    }

    if (!hasActionsColumn) {
-      if (row.cells.length > 6) {
+      if (row.cells.length > 5) {
        row.deleteCell(row.cells.length - 1);
      }
      return;
    }

-    var actionCell = row.cells.length > 6 ? row.cells[6] : null;
+    var actionCell = row.cells.length > 5 ? row.cells[5] : null;
    if (!actionCell) {
      actionCell = row.insertCell(-1);
      actionCell.setAttribute('data-label', 'Actions');
@@ -430,8 +548,6 @@

  function renderClientRow(client, hasActionsColumn) {
    var connectedAt = client.connectedAt ? '<div>' + escapeHtml(client.connectedAtLabel || formatDashboardDate(client.connectedAt) || client.connectedAt) + '</div>' + (client.lastSeenAt ? '<div class="subtle connected-updated-secondary">' + escapeHtml(client.lastSeenAtLabel || formatDashboardDate(client.lastSeenAt) || client.lastSeenAt) + '</div>' : '') : '<span class="empty">Unknown</span>';
-    var clientIpValue = normalizeDisplayIp(client.clientIp);
-    var clientIp = clientIpValue ? escapeHtml(clientIpValue) : '<span class="empty">Unknown</span>';
    var viewport = client.viewport && client.viewport.width && client.viewport.height ? escapeHtml(client.viewport.width + 'x' + client.viewport.height) : '<span class="empty">Unknown</span>';
    var clientNameValue = getClientDisplayName(client);
    var clientName = clientNameValue ? escapeHtml(clientNameValue) : '<span class="empty">Unknown</span>';
@@ -440,11 +556,10 @@
    var actionCell = hasActionsColumn ? '<td data-label="Actions">' + renderClientActionCell(client) + '</td>' : '';

    return [
-      '<tr data-client-key="' + escapeHtml(getClientRowKey(client)) + '" data-client-id="' + escapeHtml(client.clientId || '') + '" data-client-device-id="' + escapeHtml(client.deviceId || '') + '" data-client-screen-slug="' + escapeHtml(client.screen_slug || '') + '" data-client-player-base-url="' + escapeHtml(client.player_url || '') + '">',
+      '<tr data-client-key="' + escapeHtml(getClientRowKey(client)) + '" data-client-id="' + escapeHtml(client.id || '') + '" data-client-client-id="' + escapeHtml(client.clientId || '') + '" data-client-device-id="' + escapeHtml(client.deviceId || '') + '" data-client-screen-slug="' + escapeHtml(client.screen_slug || '') + '" data-client-player-base-url="' + escapeHtml(client.player_url || '') + '">',
      '<td data-label="Client"><div>' + clientName + '</div></td>',
      '<td data-label="Current Screen"><div>' + screenName + '</div></td>',
      '<td data-label="Current Slide">' + currentSlide + '</td>',
-      '<td data-label="IP">' + clientIp + '</td>',
      '<td data-label="Viewport">' + viewport + '</td>',
      '<td data-label="Connected/Updated">' + connectedAt + '</td>',
      actionCell,
@@ -453,13 +568,11 @@
  }

  function updateClientRowCells(row, client, hasActionsColumn) {
-    if (!row || !row.cells || row.cells.length < 6) {
+    if (!row || !row.cells || row.cells.length < 5) {
      return;
    }

    var connectedAt = client.connectedAt ? '<div>' + escapeHtml(client.connectedAtLabel || formatDashboardDate(client.connectedAt) || client.connectedAt) + '</div>' + (client.lastSeenAt ? '<div class="subtle connected-updated-secondary">' + escapeHtml(client.lastSeenAtLabel || formatDashboardDate(client.lastSeenAt) || client.lastSeenAt) + '</div>' : '') : '<span class="empty">Unknown</span>';
-    var clientIpValue = normalizeDisplayIp(client.clientIp);
-    var clientIp = clientIpValue ? escapeHtml(clientIpValue) : '<span class="empty">Unknown</span>';
    var viewport = client.viewport && client.viewport.width && client.viewport.height ? escapeHtml(client.viewport.width + 'x' + client.viewport.height) : '<span class="empty">Unknown</span>';
    var clientNameValue = getClientDisplayName(client);
    var clientName = clientNameValue ? escapeHtml(clientNameValue) : '<span class="empty">Unknown</span>';
@@ -467,7 +580,8 @@
    var currentSlide = client.currentSlideTitle ? escapeHtml(client.currentSlideTitle) : '<span class="empty">No slide currently showing</span>';

    row.setAttribute('data-client-key', escapeHtml(getClientRowKey(client)));
-    row.setAttribute('data-client-id', escapeHtml(client.clientId || ''));
+    row.setAttribute('data-client-id', escapeHtml(client.id || ''));
+    row.setAttribute('data-client-client-id', escapeHtml(client.clientId || ''));
    row.setAttribute('data-client-device-id', escapeHtml(client.deviceId || ''));
    row.setAttribute('data-client-screen-slug', escapeHtml(client.screen_slug || ''));
    row.setAttribute('data-client-player-base-url', escapeHtml(client.player_url || ''));
@@ -475,9 +589,8 @@
    setCellHtml(row.cells[0], '<div>' + clientName + '</div>');
    setCellHtml(row.cells[1], '<div>' + screenName + '</div>');
    setCellHtml(row.cells[2], currentSlide);
-    setCellHtml(row.cells[3], clientIp);
-    setCellHtml(row.cells[4], viewport);
-    setCellHtml(row.cells[5], connectedAt);
+    setCellHtml(row.cells[3], viewport);
+    setCellHtml(row.cells[4], connectedAt);

    syncClientActionCell(row, client, hasActionsColumn);
  }
@@ -627,6 +740,112 @@
    updateClientTable(latestDashboardState, true);
  }

+  function initClientMoveHandler() {
+    var elements = getClientMoveModalElements();
+    if (!elements.modal || !elements.form || !elements.targetSelect) {
+      return;
+    }
+
+    if (typeof elements.modal.addEventListener === 'function') {
+      elements.modal.addEventListener('show.bs.modal', function (event) {
+        var trigger = event && event.relatedTarget ? event.relatedTarget : null;
+        var row = trigger && trigger.closest ? trigger.closest('tr[data-client-key]') : null;
+        if (row) {
+          updateClientMoveModalFromRow(row);
+        }
+      });
+    }
+
+    document.addEventListener('click', function (event) {
+      var moveButton = event.target && event.target.closest ? event.target.closest('button[data-action="move-screen"]') : null;
+      if (!moveButton) {
+        return;
+      }
+
+      if (event && typeof event.preventDefault === 'function') {
+        event.preventDefault();
+      }
+
+      var row = moveButton.closest ? moveButton.closest('tr[data-client-key]') : null;
+      if (!row) {
+        return;
+      }
+
+      updateClientMoveModalFromRow(row);
+
+      if (window.pulseModal && typeof window.pulseModal.show === 'function') {
+        window.pulseModal.show(elements.modal);
+        return;
+      }
+
+      if (window.bootstrap && window.bootstrap.Modal) {
+        window.bootstrap.Modal.getOrCreateInstance(elements.modal).show();
+      }
+    });
+
+    elements.form.addEventListener('submit', function (event) {
+      if (elements.form.dataset && elements.form.dataset.busy === 'true') {
+        event.preventDefault();
+        return;
+      }
+
+      var targetScreenSlug = String(elements.targetSelect.value || '').trim();
+      if (!targetScreenSlug) {
+        event.preventDefault();
+        window.alert('Choose a target screen.');
+        return;
+      }
+
+      event.preventDefault();
+      elements.form.dataset.busy = 'true';
+
+      var formData = new FormData(elements.form);
+      var body = new URLSearchParams();
+      formData.forEach(function (value, key) {
+        body.append(key, value);
+      });
+
+      fetch(elements.form.action, {
+        method: (elements.form.method || 'POST').toUpperCase(),
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8',
+          'X-Requested-With': 'XMLHttpRequest',
+          'Accept': 'application/json, text/plain, */*'
+        },
+        body: body.toString(),
+        credentials: 'same-origin'
+      }).then(function (response) {
+        if (!response.ok) {
+          return response.text().then(function (text) {
+            var error = new Error(text || 'Unable to move client.');
+            try {
+              var payload = JSON.parse(text);
+              if (payload && (payload.error || payload.message)) {
+                error = new Error(String(payload.error || payload.message));
+              }
+            } catch (_error) {
+              // fall back to the raw text body
+            }
+            throw error;
+          });
+        }
+
+        if (window.pulseModal && typeof window.pulseModal.hide === 'function') {
+          window.pulseModal.hide(elements.modal);
+        } else if (window.bootstrap && window.bootstrap.Modal) {
+          window.bootstrap.Modal.getOrCreateInstance(elements.modal).hide();
+        }
+        return response.json().catch(function () {
+          return { ok: true };
+        });
+      }).catch(function (error) {
+        window.alert(error && error.message ? error.message : 'Unable to move client.');
+      }).finally(function () {
+        delete elements.form.dataset.busy;
+      });
+    });
+  }
+
  function updateKioskLauncherModal(state) {
    var modal = document.getElementById('dashboard-kiosk-launcher-modal');
    if (!modal) {
@@ -696,163 +915,6 @@
    }
    grid.innerHTML = screens.map(renderScreenTile).join('');
  }
-
-  function updateScreenCommandControls(state) {
-    var select = document.getElementById('screen-command-select');
-    if (!select) {
-      return;
-    }
-
-    var forms = Array.prototype.slice.call(document.querySelectorAll('[data-screen-command-form]'));
-    var pill = document.querySelector('[data-screen-command-pill]');
-    var nameNode = document.querySelector('[data-screen-command-name]');
-    var metaNode = document.querySelector('[data-screen-command-meta]');
-    var screens = Array.isArray(state && state.screens) ? state.screens : [];
-    var screenBySlug = {};
-
-    screens.forEach(function (screen) {
-      if (screen && screen.slug) {
-        screenBySlug[String(screen.slug)] = screen;
-      }
-    });
-
-    if (!screens.length) {
-      select.value = '';
-      select.disabled = true;
-      forms.forEach(function (form) {
-        form.querySelectorAll('button, input').forEach(function (control) {
-          control.disabled = true;
-        });
-      });
-      if (pill) {
-        pill.classList.remove('is-live');
-        pill.classList.add('is-idle');
-        pill.textContent = 'No screens';
-      }
-      if (nameNode) {
-        nameNode.textContent = 'No target available';
-      }
-      if (metaNode) {
-        metaNode.textContent = 'Create a screen before using screen-level commands.';
-      }
-      return;
-    }
-
-    select.disabled = false;
-
-    var selectedOption = select.options && select.selectedIndex >= 0 ? select.options[select.selectedIndex] : null;
-    var isAllSelected = Boolean(selectedOption && String(selectedOption.getAttribute('data-screen-target-all') || '').toLowerCase() === 'true') || select.value === ALL_SCREENS_SLUG;
-    var selectedScreen = isAllSelected
-      ? {
-        slug: ALL_SCREENS_SLUG,
-        name: String(selectedOption && selectedOption.textContent || ALL_SCREENS_LABEL).trim() || ALL_SCREENS_LABEL
-      }
-      : screenBySlug[select.value] || null;
-    var selectedSlug = isAllSelected
-      ? ALL_SCREENS_SLUG
-      : String(selectedScreen && selectedScreen.slug || '').trim();
-    var selectedClients = Array.isArray(state && state.clients) ? state.clients.filter(function (client) {
-      if (isAllSelected) {
-        return true;
-      }
-      return String(client && client.screen_slug || '').trim() === selectedSlug;
-    }) : [];
-    var connectionCount = selectedClients.length;
-    var hasClients = connectionCount > 0;
-    var allPaused = hasClients && selectedClients.every(function (client) {
-      return Boolean(client && client.paused);
-    });
-    var allBlackout = hasClients && selectedClients.every(function (client) {
-      return Boolean(client && client.blackout);
-    });
-    var connectionLabel = hasClients ? connectionCount + ' connected client' + (connectionCount === 1 ? '' : 's') : 'No clients connected';
-
-    if (pill) {
-      pill.classList.toggle('is-live', hasClients);
-      pill.classList.toggle('is-idle', !hasClients);
-      pill.textContent = connectionLabel;
-    }
-    if (nameNode) {
-      nameNode.textContent = selectedScreen
-        ? String(selectedScreen.name || 'Selected screen')
-        : 'Select a target screen group';
-    }
-    if (metaNode) {
-      metaNode.textContent = !selectedSlug
-        ? 'Choose a screen group before sending commands.'
-        : isAllSelected
-        ? 'Commands sent here target every client across every screen group.'
-        : 'Commands sent here target every client currently using this screen.';
-    }
-
-    var commandTargetSlug = selectedSlug || '';
-
-    forms.forEach(function (form) {
-      var command = String(form.getAttribute('data-screen-command-action') || '').trim().toLowerCase();
-      var commandInput = form.querySelector('input[name="command"]');
-      var button = form.querySelector('button[type="submit"]');
-      if (commandInput) {
-        if (command === 'pause') {
-          commandInput.value = allPaused ? 'pause' : 'pause';
-          var pauseStateInput = form.querySelector('input[name="paused"]');
-          if (pauseStateInput) {
-            pauseStateInput.value = allPaused ? 'false' : 'true';
-          }
-          if (button) {
-            button.innerHTML = '<i class="bi ' + (allPaused ? 'bi-play-fill' : 'bi-pause-fill') + ' me-1" aria-hidden="true"></i>' + (allPaused ? (isAllSelected ? 'Resume all screens' : 'Resume screen') : (isAllSelected ? 'Pause all screens' : 'Pause screen'));
-          }
-          setButtonVariant(button, ['btn-success', 'btn-info', 'btn-secondary', 'btn-outline-secondary', 'btn-outline-dark'], allPaused ? 'btn-success' : 'btn-info');
-          form.setAttribute('data-confirm-message', allPaused
-            ? (isAllSelected ? 'Resume all connected clients on all screens?' : 'Resume all connected clients on this screen?')
-            : (isAllSelected ? 'Pause all connected clients on all screens?' : 'Pause all connected clients on this screen?'));
-        } else if (command === 'blackout') {
-          commandInput.value = 'blackout';
-          var blackoutStateInput = form.querySelector('input[name="blackout"]');
-          if (blackoutStateInput) {
-            blackoutStateInput.value = allBlackout ? 'false' : 'true';
-          }
-          if (button) {
-            button.innerHTML = '<i class="bi ' + (allBlackout ? 'bi-eye' : 'bi-eye-slash') + ' me-1" aria-hidden="true"></i>' + (allBlackout ? (isAllSelected ? 'Restore all screens' : 'Restore screen') : (isAllSelected ? 'Blackout all screens' : 'Blackout screen'));
-          }
-          setButtonVariant(button, ['btn-success', 'btn-secondary', 'btn-danger', 'btn-outline-secondary', 'btn-outline-dark'], allBlackout ? 'btn-success' : 'btn-secondary');
-          form.setAttribute('data-confirm-message', allBlackout
-            ? (isAllSelected ? 'Restore all connected clients on all screens?' : 'Restore all connected clients on this screen?')
-            : (isAllSelected ? 'Blackout all connected clients on all screens?' : 'Blackout all connected clients on this screen?'));
-        } else {
-          commandInput.value = command || commandInput.value || '';
-        }
-      }
-      form.action = commandTargetSlug ? '/clients/' + encodeURIComponent(commandTargetSlug) + '/commands' : '#';
-      if (command === 'reload') {
-        form.setAttribute('data-confirm-message', isAllSelected ? 'Reload all screens?' : 'Reload selected screen?');
-        if (button) {
-          button.innerHTML = '<i class="bi bi-arrow-repeat me-1" aria-hidden="true"></i>' + (isAllSelected ? 'Reload all screens' : 'Reload screen');
-        }
-      }
-      Array.prototype.slice.call(form.querySelectorAll('button, input')).forEach(function (control) {
-        control.disabled = !commandTargetSlug;
-      });
-    });
-  }
-
-  function readScreenCommandStateFromDom() {
-    var select = document.getElementById('screen-command-select');
-    if (!select) {
-      return { screens: [] };
-    }
-
-    return {
-      screens: Array.prototype.slice.call(select.options || []).map(function (option) {
-        return {
-          slug: String(option.value || '').trim(),
-          name: String(option.getAttribute('data-screen-name') || option.textContent || option.value || '').trim(),
-          player_connection_count: Number(option.getAttribute('data-player-connection-count') || 0),
-          playlist_name: String(option.getAttribute('data-playlist-name') || '').trim()
-        };
-      })
-    };
-  }
-
  function updateDashboardQuickActions(state) {
    var pauseButton = document.getElementById('dashboard-pause-all-button');
    var blackoutButton = document.getElementById('dashboard-blackout-all-button');
@@ -889,7 +951,7 @@
    var blackoutButtonIcon = allBlackout ? 'bi-eye' : 'bi-eye-slash';

    blackoutButton.innerHTML = '<i class="bi ' + blackoutButtonIcon + ' me-1" aria-hidden="true"></i>' + escapeHtml(label);
-    setButtonVariant(blackoutButton, ['btn-success', 'btn-danger', 'btn-secondary', 'btn-outline-secondary', 'btn-outline-dark'], 'btn-secondary');
+    setButtonVariant(blackoutButton, ['btn-success', 'btn-danger', 'btn-secondary', 'btn-outline-secondary', 'btn-outline-dark'], allBlackout ? 'btn-success' : 'btn-secondary');
    if (blackoutInput) {
      blackoutInput.value = allBlackout ? 'false' : 'true';
    }
@@ -907,10 +969,10 @@
    window.webLatestDashboardState = latestDashboardState;
    updateStats(state);
    updateScreenGrid(state);
-    updateScreenCommandControls(state);
    updateClientTable(state);
    updateKioskLauncherModal(state);
    updateDashboardQuickActions(state);
+    updateScreenCommandControls();
  }

  function sendClientRename(screenSlug, connectionId, clientId, deviceId, clientName) {
@@ -967,8 +1029,8 @@
        return;
      }

-      var connectionId = String(row.getAttribute('data-client-key') || '').trim();
-      var clientId = String(row.getAttribute('data-client-id') || '').trim();
+      var connectionId = String(row.getAttribute('data-client-id') || '').trim();
+      var clientId = String(row.getAttribute('data-client-client-id') || '').trim();
      var deviceId = String(row.getAttribute('data-client-device-id') || '').trim();
      var screenSlug = String(row.getAttribute('data-client-screen-slug') || '').trim();
      var currentName = String(cell.textContent || '').trim();
@@ -1003,18 +1065,41 @@
      return;
    }

+    if (typeof elements.modal.addEventListener === 'function') {
+      elements.modal.addEventListener('show.bs.modal', function (event) {
+        var trigger = event && event.relatedTarget ? event.relatedTarget : null;
+        var row = trigger && trigger.closest ? trigger.closest('tr[data-client-key]') : null;
+        if (row) {
+          updateClientMoveModalFromRow(row);
+        }
+      });
+    }
+
    document.addEventListener('click', function (event) {
      var moveButton = event.target && event.target.closest ? event.target.closest('button[data-action="move-screen"]') : null;
      if (!moveButton) {
        return;
      }

+      if (event && typeof event.preventDefault === 'function') {
+        event.preventDefault();
+      }
+
      var row = moveButton.closest ? moveButton.closest('tr[data-client-key]') : null;
      if (!row) {
        return;
      }

      updateClientMoveModalFromRow(row);
+
+      if (window.pulseModal && typeof window.pulseModal.show === 'function') {
+        window.pulseModal.show(elements.modal);
+        return;
+      }
+
+      if (window.bootstrap && window.bootstrap.Modal) {
+        window.bootstrap.Modal.getOrCreateInstance(elements.modal).show();
+      }
    });

    elements.form.addEventListener('submit', function (event) {
@@ -1131,11 +1216,5 @@
  initClientRenameHandler();
  initClientMoveHandler();
  initKioskLauncherModal();
-  var screenCommandSelect = document.getElementById('screen-command-select');
-  if (screenCommandSelect) {
-    updateScreenCommandControls(latestDashboardState || readScreenCommandStateFromDom());
-    screenCommandSelect.addEventListener('change', function () {
-      updateScreenCommandControls(latestDashboardState || readScreenCommandStateFromDom());
-    });
-  }
+  initScreenCommandControls();
 }());
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
lzstealth	bbd517abbb	Fix scheduled task run notification Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile, web, pulse-signage-web) (push) Successful in 1m14s Details Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile.player, player, pulse-signage-player) (push) Successful in 32s Details	2026-08-17 00:54:13 +01:00
lzstealth	403a928b9e	Release 2.8.4 Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile, web, pulse-signage-web) (push) Successful in 1m14s Details Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile.player, player, pulse-signage-player) (push) Successful in 35s Details	2026-08-17 00:46:07 +01:00
lzstealth	7bb34f40fe	Release 2.8.3 Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile, web, pulse-signage-web) (push) Successful in 1m14s Details Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile.player, player, pulse-signage-player) (push) Successful in 32s Details	2026-08-17 00:08:05 +01:00
lzstealth	ea72747822	Release 2.8.2 Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile, web, pulse-signage-web) (push) Successful in 1m12s Details Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile.player, player, pulse-signage-player) (push) Successful in 34s Details	2026-08-16 22:41:39 +01:00
lzstealth	a5bf8e6f7f	Release 2.8.1 Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile, web, pulse-signage-web) (push) Successful in 1m16s Details Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile.player, player, pulse-signage-player) (push) Successful in 33s Details	2026-08-16 22:08:32 +01:00
lzstealth	203d0bfc01	Release 2.8.0 Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile, web, pulse-signage-web) (push) Successful in 1m49s Details Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile.player, player, pulse-signage-player) (push) Successful in 32s Details	2026-08-16 17:15:31 +01:00
lzstealth	1bdc122995	Target Node 26 Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile, web, pulse-signage-web) (push) Successful in 1m17s Details Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile.player, player, pulse-signage-player) (push) Successful in 33s Details	2026-08-15 15:02:28 +01:00
lzstealth	2d748458d0	Remove GHCR publish path	2026-08-15 14:21:54 +01:00
lzstealth	bb8cd98e61	Publish Docker images to both registries Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile, web, pulse-signage-web) (push) Successful in 1m25s Details Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile.player, player, pulse-signage-player) (push) Successful in 32s Details Publish Docker Image / build-and-push-ghcr (./build/Dockerfile, web, pulse-signage-web) (push) Failing after 1m8s Details Publish Docker Image / build-and-push-ghcr (./build/Dockerfile.player, player, pulse-signage-player) (push) Failing after 31s Details	2026-08-15 14:13:49 +01:00
lzstealth	aafe112c36	Release 2.7.5 Publish Docker Image / build-and-push (./build/Dockerfile, git.lzstealth.com/lzstealth/pulse-signage-web, web) (push) Successful in 1m18s Details Publish Docker Image / build-and-push (./build/Dockerfile.player, git.lzstealth.com/lzstealth/pulse-signage-player, player) (push) Successful in 32s Details	2026-08-15 13:06:46 +01:00
lzstealth	1f1ad5d61f	Release 2.7.4 Publish Docker Image / build-and-push (./build/Dockerfile, git.lzstealth.com/lzstealth/pulse-signage-web, web) (push) Successful in 1m15s Details Publish Docker Image / build-and-push (./build/Dockerfile.player, git.lzstealth.com/lzstealth/pulse-signage-player, player) (push) Successful in 32s Details	2026-08-15 12:30:31 +01:00
lzstealth	f0177e6628	Release 2.7.3 Publish Docker Image / build-and-push (./build/Dockerfile, git.lzstealth.com/lzstealth/pulse-signage-web, web) (push) Successful in 1m15s Details Publish Docker Image / build-and-push (./build/Dockerfile.player, git.lzstealth.com/lzstealth/pulse-signage-player, player) (push) Successful in 32s Details	2026-08-15 11:43:07 +01:00
lzstealth	15dc6eb7f2	Release 2.7.2 Publish Docker Image / build-and-push (./build/Dockerfile, git.lzstealth.com/lzstealth/pulse-signage-web, web) (push) Successful in 1m16s Details Publish Docker Image / build-and-push (./build/Dockerfile.player, git.lzstealth.com/lzstealth/pulse-signage-player, player) (push) Successful in 32s Details	2026-08-14 23:51:38 +01:00
lzstealth	75b5cb5a6b	Add player keyboard controls and release 2.7.1 Publish Docker Image / build-and-push (./build/Dockerfile, git.lzstealth.com/lzstealth/pulse-signage-web, web) (push) Successful in 1m17s Details Publish Docker Image / build-and-push (./build/Dockerfile.player, git.lzstealth.com/lzstealth/pulse-signage-player, player) (push) Successful in 32s Details	2026-08-14 13:50:40 +01:00
lzstealth	e7ec276317	Release v2.7.0 Publish Docker Image / build-and-push (./build/Dockerfile, git.lzstealth.com/lzstealth/pulse-signage-web, web) (push) Successful in 1m18s Details Publish Docker Image / build-and-push (./build/Dockerfile.player, git.lzstealth.com/lzstealth/pulse-signage-player, player) (push) Successful in 33s Details	2026-08-14 13:36:47 +01:00
lzstealth	30f5ed11b8	Format scheduled task intervals Publish Docker Image / build-and-push (./build/Dockerfile, git.lzstealth.com/lzstealth/pulse-signage-web, web) (push) Successful in 1m25s Details Publish Docker Image / build-and-push (./build/Dockerfile.player, git.lzstealth.com/lzstealth/pulse-signage-player, player) (push) Successful in 32s Details	2026-08-14 00:20:48 +01:00
lzstealth	d6a8b45357	Fresh initial commit Publish Docker Image / build-and-push (./build/Dockerfile, git.lzstealth.com/lzstealth/pulse-signage-web, web) (push) Successful in 1m12s Details Publish Docker Image / build-and-push (./build/Dockerfile.player, git.lzstealth.com/lzstealth/pulse-signage-player, player) (push) Successful in 30s Details	2026-08-12 02:41:31 +01:00
lzstealth	f9425fc640	Release 2.6.25 Publish Docker Image / build-and-push (./build/Dockerfile, git.lzstealth.com/lzstealth/pulse-signage-web, web) (push) Successful in 1m12s Details Publish Docker Image / build-and-push (./build/Dockerfile.player, git.lzstealth.com/lzstealth/pulse-signage-player, player) (push) Successful in 30s Details	2026-08-10 01:04:49 +01:00
lzstealth	4491c15215	Release 2.6.24	2026-08-10 00:32:28 +01:00
lzstealth	08b06941a4	Adjust dashboard card spacing	2026-08-09 13:53:38 +01:00
lzstealth	c0c05f76e3	Make API and RSS refresh notifications change-only	2026-08-09 13:44:17 +01:00
lzstealth	78a34e4105	Release 2.6.23	2026-08-09 13:38:30 +01:00
lzstealth	3c3864e6ac	Sync build package versions	2026-08-09 13:06:55 +01:00
lzstealth	6d8bf0f5f0	Release v2.6.22	2026-08-09 13:06:02 +01:00
lzstealth	c36b9122c9	Release v2.6.21	2026-08-09 12:30:22 +01:00
lzstealth	39f2098ffe	Release v2.6.20	2026-08-09 12:18:44 +01:00
lzstealth	459f84ed94	Release v2.6.19	2026-08-09 11:57:40 +01:00
lzstealth	49c72923b4	Release 2.6.15	2026-08-08 23:15:04 +01:00
lzstealth	6c28a1c028	Release 2.6.14	2026-08-08 21:49:22 +01:00
lzstealth	c5172af62d	Release 2.6.13	2026-08-08 21:11:34 +01:00
lzstealth	cd8e333afd	Restore Docker tag fan-out	2026-08-08 20:48:36 +01:00
lzstealth	c3b5a0053c	Split web and player build artifacts	2026-08-08 20:38:44 +01:00
lzstealth	38565a533d	Wire remote player reconnect delay	2026-08-08 16:29:38 +01:00
lzstealth	5a08ccddbb	Release v2.6.11	2026-08-08 15:11:11 +01:00
lzstealth	2c97fe81d1	Release v2.6.10	2026-08-08 14:14:52 +01:00
lzstealth	ee3b1b51bf	Release v2.6.9	2026-08-08 14:08:16 +01:00
lzstealth	4e5a1bc393	Release 2.6.8	2026-08-08 13:18:52 +01:00
lzstealth	7e46fffc34	Release 2.6.7	2026-08-08 13:02:31 +01:00
lzstealth	b20beb250b	update env files	2026-08-08 00:13:23 +01:00
lzstealth	9d93634382	Readme, addition of changelog.	2026-08-08 00:09:56 +01:00
lzstealth	3cba68e256	Fix compose network service placement	2026-08-08 00:05:09 +01:00
lzstealth	bcae4bb318	Add timetable end-time validation	2026-08-08 00:00:51 +01:00