A draft is validated against the live fleet before it can go out. Every check must pass — that gate is what §11.3 calls “what prevents a single admin mistake from destroying your business”.
The profile decides what a browser can play; the weights decide what we prefer among the things it can. Weights only reorder streams inside a tier, so no number here can put a black screen first. Watch the Tier-3 share on Analytics and retune — that is the §7.2 lever, and it costs nothing to pull.
§14.3 calls this the strongest monetization lever: a free viewer resolves through addon instances with no debrid account, so their play costs no TorBox slot and takes as long as the download takes. Premium resolves through the TorBox shard and starts in seconds. The offer arrives while they are watching the difference.
The discount is issued as a single-use row bound to that viewer and expiring on the clock above — not a percentage the browser could edit. 90% is the ceiling the pricing code enforces; a higher number here would be clamped and mislead you.
Filters remove streams, unlike the codec weights above which reorder. §7 is explicit that an empty list is worse than a degraded one, so a filter set that excludes everything returns everything and logs it rather than blanking the page.
JSON pointers to values that must not change. Enforced at the publish gate: a version that changes a locked field is refused, and one that unlocks and changes in the same publish is refused too — otherwise the click that removes the lock is the same click it was protecting against. Unlock, publish, then change.
Health, slot saturation, priority and tier. Quarantining an instance takes it out of rotation without deleting it — §18.4 says add capacity once saturation passes 0.70.
§5.4’s scaling story is “add capacity by adding a row”. This is the row. A free-tier instance carries no debrid account — that is what makes §14.2’s “free users must not consume TorBox slots” true, and it is refused if you try.
New instances start amber. The health prober promotes them once it has reached the manifest — routing traffic to something nobody has confirmed works is how one bad row becomes an outage.
§5.4 needs one distinct account per Comet instance. Keys are never shown here — the console lists the Vault path they live behind.
The record lives here; the key lives in the Vault. Two pages for one job on purpose — an account is a record and a key is a secret, and a form that holds both is a form someone screenshots.
Paths, sizes, who references them, when they were last rotated. No endpoint in this service can return a secret’s value, and there is a test that fails the build if one is ever added.
This is how a key gets onto the box — the TorBox key, a debrid key, an Xtream
username:password, a payment provider’s API key. Write-only: once
stored, no endpoint in this service can show it again, which is what makes rotating a
compromised key one Vault update instead of an incident.
A plan is what grants playback: capabilities are resolved from it at token mint (§10.1). Vouchers, resellers and payment collection are Phase 4.
§23 decision 4 makes vouchers the primary channel — no processor, no chargebacks, no compliance team that can switch them off. Codes are shown once: only a peppered hash is stored, so a lost response means voiding the batch and minting again.
Every admin action and every config diff. Rows outlive the accounts that made them.
Playlists and credentials live here, never in a browser. A client gets a
channelRef and the Gateway resolves it at play time — exposing the real
URL would mean one user extracting the subscription and reselling it.
For Xtream, store username:password at that Vault path. Never put
credentials in the URL — that is the thing §8 moved server-side.
Your own broadcasts. The only media path with zero codec risk — OBS emits H.264 and AAC. Stream keys are hashed at rest and shown once; saving a channel rotates its key.
Prepaid. Minting debits the balance in the same transaction that cuts the codes, so a reseller can never mint more than they have paid for. Daily caps come from the wholesale tier.
Every provider is independently switchable and every key is a Vault path — this page never sees a key. §14.6 calls Stripe “the fragile leg — an optimization, not a dependency”: vouchers keep working whatever happens here.
The §15.2 inventory map. Every slot ships disabled; the caps are the specification, not a dial. Free tier only — a paying customer is never eligible, and that is checked server-side from the signed token.
House and affiliate ads are the bottom rung that always fills (§15.3), which is what lets the broker have no error path a user can see.
§15.4 expects tier-1 networks to refuse this content category, so these are the revenue line rather than the fallback — a debrid or VPN affiliate is aimed at exactly this audience. A click goes through our own domain, so an ad-blocker lets it through and the click data is ours.
A click URL must be a path on this site or an https:// address. Anything
else is refused: this redirect runs from our domain, and an open one is worth more to
a phisher than the ad is to us.
Entered or imported, never computed from our own impressions — a house ad earns nothing directly and an affiliate earns on conversion, so a count is not money. Both numbers are kept: the gap between what we counted and what the provider paid for is ad-blocking and viewability filtering, and it is invisible if only one is stored.
§13 lists thirteen pages. All thirteen are here. This is what remains unbuilt behind one of them, so it are not here. An empty table would read as “the feature works and nobody has used it”; the truth is that it is not built.
| OBS ingest | MediaMTX, LL-HLS packaging, CDN pull. The control plane — channels, keys, kill switch — is on the OBS tab; what is missing is the ingest server itself | needs infrastructure |
Standing up MediaMTX and a CDN is blocked on the egress-economics decision in ADR 0004, not on code.