Aggiunge replay YouTube temporaneo, pull registrazioni dai CPX e snapshot ingest in admin.

Così overflow Hetzner e VOD YouTube restano in archivio dopo lo spegnimento del nodo, e la colonna ingest non si svuota.

Co-authored-by: Cursor <cursoragent@cursor.com>

.cursor/rules/stream-soft-limit-scaling.mdc

@@ -0,0 +1,22 @@
+---
+description: Scalare soft limit ingest/autoscaler man mano che crescono i clienti
+alwaysApply: true
+---
+
+# Soft limit stream / autoscaler
+
+Con la crescita del numero di clienti (e delle dirette concorrenti attese), **alzare i soft limit** prima di restare a corto di capacità.
+
+Config rilevante (prod, tipicamente `infra/.env` + `StreamNode`):
+
+| Parametro | Ruolo oggi (post load test 2026-08) |
+|-----------|--------------------------------------|
+| `STREAM_NODE_HOME_MAX_PUBLISHERS` | Soft home (es. 6) |
+| `STREAM_CLOUD_MAX_PUBLISHERS` | Soft per CPX (es. 4; cpx12 ha tenuto 8 in probe) |
+| `STREAM_AUTOSCALE_MAX_OVERFLOW` / max overflow nodes | Quanti CPX in parallelo (es. 3 → tetto cluster ≈ home + N×cloud) |
+| `STREAM_AUTOSCALE_SOFT_FREE_SLOTS` | Anticipo scale-out |
+| Piano `concurrent_streams_limit` | Tetto **per club** (Premium Full = 10): indipendente dal cluster |
+
+Capienza cluster soft ≈ `home_max + max_overflow × cloud_max` (es. 6+3×4 = **18**).
+
+Quando si parla di capacity planning, deploy autoscale, o “troppe dirette”, ricordare di rivedere questi valori (e il limite piano) in base ai clienti reali — non lasciare i soft limit di collaudo/early-prod a lungo.

backend/app/controllers/admin/analytics_controller.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+module Admin
+  class AnalyticsController < Admin::BaseController
+    def index
+      @filters = {
+        from: parse_date(params[:from]) || 7.days.ago.to_date,
+        to: parse_date(params[:to]) || Time.zone.today,
+        device: params[:device].presence
+      }
+
+      scope = AnalyticsPageStat.where(day: @filters[:from]..@filters[:to])
+      scope = scope.where(device: @filters[:device]) if @filters[:device].present? && AnalyticsEvent::DEVICES.include?(@filters[:device])
+
+      cell_scope = AnalyticsPageCell.where(day: @filters[:from]..@filters[:to])
+      cell_scope = cell_scope.where(device: @filters[:device]) if @filters[:device].present? && AnalyticsEvent::DEVICES.include?(@filters[:device])
+
+      clicks_by_path = cell_scope.group(:page_path).sum(:click_count)
+      moves_by_path = cell_scope.group(:page_path).sum(:move_count)
+      pageviews_by_path = scope.group(:page_path).sum(:pageview_count)
+      scroll_samples_by_path = scope.group(:page_path).sum(:scroll_samples)
+      scroll_sum_by_path = scope.group(:page_path).sum(:scroll_sum_pct)
+      max_scroll_by_path = scope.group(:page_path).maximum(:max_scroll_pct)
+
+      paths = (pageviews_by_path.keys + clicks_by_path.keys + moves_by_path.keys).uniq
+      @pages = paths.map do |path|
+        samples = scroll_samples_by_path[path].to_i
+        {
+          page_path: path,
+          pageviews: pageviews_by_path[path].to_i,
+          clicks: clicks_by_path[path].to_i,
+          moves: moves_by_path[path].to_i,
+          scroll_samples: samples,
+          scroll_sum: scroll_sum_by_path[path].to_i,
+          max_scroll: max_scroll_by_path[path].to_i
+        }
+      end.sort_by { |r| [-r[:pageviews], -r[:moves], -r[:clicks], r[:page_path]] }
+    end
+
+    def show
+      @page_path = params[:page_path].to_s
+      redirect_to admin_analytics_path, alert: t("admin.analytics.missing_path") and return if @page_path.blank?
+
+      @filters = {
+        from: parse_date(params[:from]) || 7.days.ago.to_date,
+        to: parse_date(params[:to]) || Time.zone.today,
+        device: params[:device].presence,
+        layer: params[:layer].to_s
+      }
+
+      cells = AnalyticsPageCell.where(page_path: @page_path, day: @filters[:from]..@filters[:to])
+      cells = cells.where(device: @filters[:device]) if @filters[:device].present? && AnalyticsEvent::DEVICES.include?(@filters[:device])
+
+      @click_total = cells.sum(:click_count)
+      @move_total = cells.sum(:move_count)
+      @filters[:layer] =
+        if %w[move click].include?(@filters[:layer])
+          @filters[:layer]
+        elsif @move_total.positive?
+          "move"
+        else
+          "click"
+        end
+
+      counter = @filters[:layer] == "click" ? :click_count : :move_count
+      @cells = cells.group(:cell_x, :cell_y).sum(counter)
+      @max_weight = @cells.values.max.to_i
+      @total_points = @cells.values.sum
+
+      stats = AnalyticsPageStat.where(page_path: @page_path, day: @filters[:from]..@filters[:to])
+      stats = stats.where(device: @filters[:device]) if @filters[:device].present? && AnalyticsEvent::DEVICES.include?(@filters[:device])
+      @pageviews = stats.sum(:pageview_count)
+      @scroll_samples = stats.sum(:scroll_samples)
+      @scroll_sum = stats.sum(:scroll_sum_pct)
+      @max_scroll = stats.maximum(:max_scroll_pct).to_i
+      @avg_scroll = @scroll_samples.positive? ? (@scroll_sum.to_f / @scroll_samples).round : 0
+      @grid = AnalyticsPageCell::GRID_SIZE
+      @snapshot = find_snapshot(@page_path, @filters[:device])
+    end
+
+    private
+
+    def parse_date(value)
+      return nil if value.blank?
+
+      Date.parse(value.to_s)
+    rescue ArgumentError, TypeError
+      nil
+    end
+
+    def find_snapshot(page_path, device)
+      scope = AnalyticsPageSnapshot.where(page_path: page_path)
+      if device.present? && AnalyticsEvent::DEVICES.include?(device)
+        snap = scope.find_by(device: device)
+        return snap if snap&.image&.attached?
+      end
+
+      scope.order(captured_at: :desc).detect { |s| s.image.attached? }
+    end
+  end
+end

backend/app/controllers/admin/announcements_controller.rb

@@ -0,0 +1,76 @@
+module Admin
+  class AnnouncementsController < Admin::BaseController
+    before_action :set_announcement, only: %i[edit update destroy]
+
+    def index
+      @announcements = AppAnnouncement.newest
+    end
+
+    def new
+      @announcement = AppAnnouncement.new(
+        kind: "info",
+        severity: "info",
+        status: "draft",
+        show_on_android: true,
+        show_on_ios: true,
+        show_on_web_public: true,
+        show_on_web_private: true,
+        dismissible: true
+      )
+    end
+
+    def create
+      @announcement = AppAnnouncement.new(announcement_params)
+      @announcement.created_by_admin = current_admin_account
+      if @announcement.save
+        redirect_to admin_announcements_path, notice: t("admin.flash.announcement_created")
+      else
+        flash.now[:alert] = @announcement.errors.full_messages.join(", ")
+        render :new, status: :unprocessable_entity
+      end
+    end
+
+    def edit; end
+
+    def update
+      if @announcement.update(announcement_params)
+        redirect_to admin_announcements_path, notice: t("admin.flash.announcement_updated")
+      else
+        flash.now[:alert] = @announcement.errors.full_messages.join(", ")
+        render :edit, status: :unprocessable_entity
+      end
+    end
+
+    def destroy
+      @announcement.destroy!
+      redirect_to admin_announcements_path, notice: t("admin.flash.announcement_destroyed")
+    end
+
+    private
+
+    def set_announcement
+      @announcement = AppAnnouncement.find(params[:id])
+    end
+
+    def announcement_params
+      params.require(:app_announcement).permit(
+        :kind, :severity, :status, :title, :body,
+        :action_url, :action_label, :dismissible, :starts_at, :ends_at,
+        :show_on_android, :show_on_ios, :show_on_web_public, :show_on_web_private,
+        translations: {
+          en: AppAnnouncement::COPY_KEYS,
+          fr: AppAnnouncement::COPY_KEYS,
+          de: AppAnnouncement::COPY_KEYS,
+          es: AppAnnouncement::COPY_KEYS
+        }
+      ).tap do |permitted|
+        %i[dismissible show_on_android show_on_ios show_on_web_public show_on_web_private].each do |key|
+          permitted[key] = ActiveModel::Type::Boolean.new.cast(permitted[key])
+        end
+        %i[starts_at ends_at action_url action_label].each do |key|
+          permitted[key] = nil if permitted[key].blank?
+        end
+      end
+    end
+  end
+end

backend/app/controllers/admin/auth_controller.rb

@@ -1,6 +1,8 @@
 module Admin
   class AuthController < Admin::BaseController
     skip_before_action :require_admin_login, only: %i[new create]
+    # Same as public logout: tolerate stale CSRF after long-lived admin tabs.
+    skip_before_action :verify_authenticity_token, only: :destroy
 
     def new
       redirect_to admin_root_path if admin_logged_in?

backend/app/controllers/admin/billing_controller.rb

@@ -2,6 +2,7 @@ module Admin
   class BillingController < BaseController
     def index
       @pending_payments = pending_scope.recent
+      @pending_transfers = transfer_scope
       @completed_payments = Billing::Payment.with_invoice_pdf.includes(:club, :invoice).recent.limit(40)
       @filter_club = Club.find_by(id: params[:club_id]) if params[:club_id].present?
       @clubs = Club.order(:name)
@@ -18,6 +19,25 @@ module Admin
                   alert: e.message
     end
 
+    def confirm_transfer
+      order = Billing::TransferOrder.find(params[:id])
+      Billing::ConfirmBankTransfer.call(
+        order: order,
+        admin: current_admin_account,
+        pdf: params[:pdf]
+      )
+      redirect_to admin_billing_path(club_id: order.club_id),
+                  notice: t("admin.flash.transfer_confirmed", plan: order.plan.name, club: order.club.name)
+    rescue Billing::ConfirmBankTransfer::Error, Billing::AttachPaymentInvoice::Error, Billing::IssueInvoice::Error => e
+      redirect_to admin_billing_path, alert: e.message
+    end
+
+    def cancel_transfer
+      order = Billing::TransferOrder.find(params[:id])
+      order.cancel!
+      redirect_to admin_billing_path(club_id: order.club_id), notice: t("admin.flash.transfer_cancelled")
+    end
+
     private
 
     def pending_scope
@@ -26,6 +46,12 @@ module Admin
       scope
     end
 
+    def transfer_scope
+      scope = Billing::TransferOrder.awaiting_payment.includes(:club, :requested_by_user)
+      scope = scope.where(club_id: params[:club_id]) if params[:club_id].present?
+      scope
+    end
+
     def billing_redirect_params(payment)
       { club_id: payment.club_id, anchor: "payment-#{payment.id}" }.compact
     end

backend/app/controllers/admin/clubs_controller.rb

@@ -1,9 +1,9 @@
 module Admin
   class ClubsController < BaseController
-    before_action :set_club, only: %i[show grant_comped revoke_comped]
+    before_action :set_club, only: %i[show grant_comped revoke_comped set_quote revoke_quote]
 
     def index
-      @clubs = Club.includes(:teams, subscription: %i[plan admin_comped_by])
+      @clubs = Club.includes(:teams, :billing_quote, subscription: %i[plan admin_comped_by])
                    .order(:name)
     end
 
@@ -11,6 +11,7 @@ module Admin
       @subscription = @club.subscription || @club.build_subscription(plan: Plan["free"], status: "active")
       @plans = Plan.ordered.reject { |p| p.slug == "free" }
       @teams = @club.teams.order(:name)
+      @quote = @club.active_billing_quote
     end
 
     def grant_comped
@@ -32,6 +33,32 @@ module Admin
       redirect_back_or_club alert: e.message
     end
 
+    def set_quote
+      quote = Billing::SetClubQuote.upsert(
+        club: @club,
+        plan_slug: params.require(:plan_slug),
+        interval: params[:interval],
+        amount_euros: params[:amount_euros],
+        note: params[:note],
+        admin: current_admin_account
+      )
+      redirect_back_or_club notice: t(
+        "admin.flash.quote_saved",
+        club: @club.name,
+        plan: quote.plan.name,
+        amount: quote.formatted_amount
+      )
+    rescue Billing::SetClubQuote::Error, ActionController::ParameterMissing => e
+      redirect_back_or_club alert: e.message
+    end
+
+    def revoke_quote
+      Billing::SetClubQuote.revoke(club: @club, admin: current_admin_account)
+      redirect_back_or_club notice: t("admin.flash.quote_revoked", club: @club.name)
+    rescue Billing::SetClubQuote::Error => e
+      redirect_back_or_club alert: e.message
+    end
+
     private
 
     def set_club

backend/app/controllers/admin/dashboard_controller.rb

@@ -5,7 +5,7 @@ module Admin
       @host = HostMetrics.new.sample!
       @active_sessions = StreamSession
         .where(status: DashboardStats::ACTIVE_STATUSES)
-        .includes(match: :team)
+        .includes(:stream_node, match: :team)
         .order(started_at: :desc)
       @teams = Team.includes(:matches).order(:name).limit(8)
     end

backend/app/controllers/admin/sessions_controller.rb

@@ -1,12 +1,23 @@
 module Admin
   class SessionsController < Admin::BaseController
     def index
-      @sessions = StreamSession.includes(:match, :user).order(created_at: :desc).limit(50)
+      @filters = session_filters
+      scope = filtered_sessions
+      @total_count = scope.count
+      @sessions = scope
+        .includes(:stream_node, :user, match: { team: :club })
+        .order(Arel.sql("COALESCE(stream_sessions.started_at, stream_sessions.created_at) DESC"))
+        .limit(100)
+      @clubs = Club.order(:name)
+      @nodes = StreamNode.order(:slug)
     end
 
     def show
-      @session = StreamSession.find(params[:id])
-      @events = @session.stream_events.recent.limit(50)
+      @session = StreamSession
+        .includes(:stream_node, :user, :device_states, :recording, match: { team: :club })
+        .find(params[:id])
+      @events = @session.stream_events.recent.limit(100)
+      @club = @session.match.team.club
     end
 
     def stop
@@ -39,5 +50,73 @@ module Admin
                     regia_expires_at: @session.regia_token_expires_at&.iso8601
                   }
     end
+
+    private
+
+    def session_filters
+      {
+        q: params[:q].to_s.strip.presence,
+        status: params[:status].to_s.strip.presence,
+        platform: params[:platform].to_s.strip.presence,
+        club_id: params[:club_id].to_s.strip.presence,
+        stream_node_id: params[:stream_node_id].to_s.strip.presence,
+        from: params[:from].to_s.strip.presence,
+        to: params[:to].to_s.strip.presence
+      }
+    end
+
+    def filtered_sessions
+      scope = StreamSession.left_outer_joins(match: { team: :club })
+
+      if @filters[:q].present?
+        term = "%#{ActiveRecord::Base.sanitize_sql_like(@filters[:q])}%"
+        scope = scope.where(
+          "teams.name ILIKE :term OR matches.opponent_name ILIKE :term OR clubs.name ILIKE :term OR matches.location ILIKE :term",
+          term: term
+        )
+      end
+
+      if @filters[:status].present? && StreamSession::STATUSES.include?(@filters[:status])
+        scope = scope.where(stream_sessions: { status: @filters[:status] })
+      end
+      if @filters[:platform].present? && StreamSession::LIVE_PLATFORMS.include?(@filters[:platform])
+        scope = scope.where(stream_sessions: { platform: @filters[:platform] })
+      end
+      if @filters[:club_id].present?
+        scope = scope.where(teams: { club_id: @filters[:club_id] })
+      end
+      if @filters[:stream_node_id].present?
+        node = StreamNode.find_by(id: @filters[:stream_node_id])
+        if node
+          scope = scope.where(
+            "stream_sessions.stream_node_id = :id OR stream_sessions.ingest_slug = :slug",
+            id: node.id,
+            slug: node.slug
+          )
+        end
+      end
+      if (from_time = parse_filter_date(@filters[:from], end_of_day: false))
+        scope = scope.where(
+          "COALESCE(stream_sessions.started_at, stream_sessions.created_at) >= ?",
+          from_time
+        )
+      end
+      if (to_time = parse_filter_date(@filters[:to], end_of_day: true))
+        scope = scope.where(
+          "COALESCE(stream_sessions.started_at, stream_sessions.created_at) <= ?",
+          to_time
+        )
+      end
+      scope
+    end
+
+    def parse_filter_date(value, end_of_day:)
+      return nil if value.blank?
+
+      date = Date.parse(value)
+      end_of_day ? date.end_of_day : date.beginning_of_day
+    rescue ArgumentError, TypeError
+      nil
+    end
   end
 end

backend/app/controllers/analytics/events_controller.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Analytics
+  class EventsController < ActionController::API
+    def create
+      payload = parse_payload
+      result = Analytics::Ingest.new(events: payload, remote_ip: request.remote_ip).call
+
+      if result.rate_limited
+        return head :too_many_requests
+      end
+
+      render json: { accepted: result.accepted, rejected: result.rejected }, status: :accepted
+    end
+
+    private
+
+    def parse_payload
+      body = request.request_parameters
+      return body["events"] if body.is_a?(Hash) && body["events"].is_a?(Array)
+      return body if body.is_a?(Array)
+
+      raw = request.raw_post
+      return [] if raw.blank?
+
+      parsed = JSON.parse(raw)
+      return parsed["events"] if parsed.is_a?(Hash) && parsed["events"].is_a?(Array)
+      return parsed if parsed.is_a?(Array)
+
+      []
+    rescue JSON::ParserError
+      []
+    end
+  end
+end

backend/app/controllers/analytics/snapshots_controller.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Analytics
+  class SnapshotsController < ActionController::API
+    def create
+      result = Analytics::SnapshotIngest.new(
+        path: params[:path] || params[:page_path],
+        device: params[:device],
+        width: params[:width],
+        height: params[:height],
+        image: params[:image],
+        remote_ip: request.remote_ip
+      ).call
+
+      return head :too_many_requests if result.rate_limited
+      return render json: { ok: false, error: result.error }, status: :unprocessable_content unless result.ok
+
+      render json: { ok: true, skipped: result.skipped }, status: :accepted
+    end
+  end
+end

backend/app/controllers/api/v1/announcements_controller.rb

@@ -0,0 +1,13 @@
+module Api
+  module V1
+    class AnnouncementsController < BaseController
+      skip_before_action :authenticate_request!
+
+      def index
+        platform = params[:platform].to_s.presence
+        announcements = AppAnnouncement.for_platform(platform).newest
+        render json: announcements.map { |item| item.as_api_json(platform: platform) }
+      end
+    end
+  end
+end

backend/app/controllers/api/v1/base_controller.rb

@@ -2,6 +2,8 @@ module Api
   module V1
     class BaseController < ApplicationController
       rescue_from Teams::EntitlementError, with: :render_entitlement_error
+      rescue_from Streams::IngestUnavailableError, with: :render_ingest_unavailable
+      rescue_from BrandingAttachments::CoverUploadError, with: :render_cover_upload_error
       rescue_from Youtube::BroadcastService::Error, with: :render_youtube_error
 
       private
@@ -20,6 +22,17 @@ module Api
           billing_url: error.billing_url
         }, status: :forbidden
       end
+
+      def render_ingest_unavailable(error)
+        render json: {
+          error: error.message,
+          error_code: error.code
+        }, status: :service_unavailable
+      end
+
+      def render_cover_upload_error(error)
+        render json: { error: error.message, error_code: "cover_upload_invalid" }, status: :unprocessable_entity
+      end
     end
   end
 end

backend/app/controllers/api/v1/matches_controller.rb

@@ -2,6 +2,7 @@ module Api
   module V1
     class MatchesController < BaseController
       include Api::UrlHelper
+      include Api::CoverJson
       include BrandingAttachments
 
       before_action :set_team, only: %i[index create]
@@ -21,6 +22,7 @@ module Api
         normalize_scoring_rules!(attrs)
         match = @team.matches.create!(attrs)
         attach_opponent_logo(match)
+        attach_match_cover(match)
         render json: match_json(match), status: :created
       end
 
@@ -34,6 +36,7 @@ module Api
         normalize_opponent_color!(attrs)
         @match.update!(attrs)
         attach_opponent_logo(@match)
+        attach_match_cover(@match)
         render json: match_json(@match)
       end
 
@@ -98,6 +101,11 @@ module Api
         match.opponent_logo_file.attach(file) if file.present?
       end
 
+      def attach_match_cover(match)
+        attach_cover_image(match, entitlements: match.team.entitlements)
+        enqueue_cover_slate_generation(match)
+      end
+
       def match_json(match, detail: false)
         active = active_session_for(match)
         team = match.team
@@ -123,6 +131,7 @@ module Api
           home_logo_url: api_absolute_url(team.effective_logo_url),
           opponent_primary_color: match.effective_opponent_primary_color,
           opponent_logo_url: api_absolute_url(match.opponent_logo_url),
+          **match_cover_json(match),
           active_session_id: active&.id,
           active_session_status: active&.status,
           stream_completed: match.stream_completed?,

backend/app/controllers/api/v1/recordings_controller.rb

@@ -97,10 +97,11 @@ module Api
           replay_url: recording.replay_url,
           playback_url: recording.playback_stream_url,
           thumbnail_url: recording.thumbnail_url,
-          download_enabled: ent.phone_download_enabled?,
+          download_enabled: ent.phone_download_enabled? && recording.storage_key.present?,
           youtube_video_id: recording.youtube_video_id,
           youtube_watch_url: recording.youtube_watch_url,
-          youtube_publish_enabled: ent.premium_full? && ent.youtube_enabled?,
+          youtube_publish_enabled: ent.premium_full? && ent.youtube_enabled? && recording.storage_key.present? && recording.youtube_video_id.blank?,
+          replay_source: recording.replay_source,
           source_platform: recording.source_platform,
           source_platform_label: recording.source_platform_label,
           expires_at: recording.expires_at,

backend/app/controllers/api/v1/stream_sessions_controller.rb

@@ -77,6 +77,7 @@ module Api
           thermal_state: sanitized_thermal_state,
           last_seen_at: Time.current
         )
+        Sessions::ApplyClientInfo.call(@session, params[:client]) if params[:client].present?
         sync_publisher_when_streaming!(params[:fps].to_f)
         SessionChannel.broadcast_message(@session, state.as_cable_payload)
         head :no_content
@@ -180,7 +181,12 @@ module Api
       end
 
       def session_params
-        params.permit(:platform, :privacy_status, :quality_preset, :target_bitrate, :target_fps, :youtube_channel)
+        params.permit(
+          :platform, :privacy_status, :quality_preset, :target_bitrate, :target_fps, :youtube_channel,
+          client: %i[os client_os app_version app_build version build build_number
+                     device_manufacturer manufacturer device_model model
+                     os_version system_version carrier network_operator operator]
+        )
       end
 
       def score_sync_params

backend/app/controllers/api/v1/teams_controller.rb

@@ -137,7 +137,8 @@ module Api
           youtube_mode: ent.plan.youtube_mode,
           staff_role: current_user.staff_role_for(team),
           can_stream: current_user.can_stream_for?(team),
-          can_connect_youtube: team.club.owned_by?(current_user) && ent.premium_full? && ent.youtube_enabled?
+          can_connect_youtube: team.club.owned_by?(current_user) && ent.premium_full? && ent.youtube_enabled?,
+          custom_cover_enabled: ent.can_use_custom_cover?
         }
         if detail
           data[:members] = team.user_teams.includes(:user).where.not(role: "owner").map do |ut|
@@ -170,12 +171,13 @@ module Api
           replay_url: recording.replay_url,
           playback_url: recording.playback_stream_url,
           thumbnail_url: recording.thumbnail_url,
-          download_enabled: ent.phone_download_enabled?,
+          download_enabled: ent.phone_download_enabled? && recording.storage_key.present?,
           view_count: recording.view_count,
           views_label: recording.views_label,
           youtube_video_id: recording.youtube_video_id,
           youtube_watch_url: recording.youtube_watch_url,
-          youtube_publish_enabled: ent.premium_full? && ent.youtube_enabled?,
+          youtube_publish_enabled: ent.premium_full? && ent.youtube_enabled? && recording.storage_key.present? && recording.youtube_video_id.blank?,
+          replay_source: recording.replay_source,
           source_platform: recording.source_platform,
           source_platform_label: recording.source_platform_label,
           expires_at: recording.expires_at,

backend/app/controllers/concerns/api/cover_json.rb

@@ -0,0 +1,16 @@
+module Api
+  module CoverJson
+    extend ActiveSupport::Concern
+
+    private
+
+    def match_cover_json(match)
+      resolver = Streams::CoverResolver.new(match)
+      {
+        effective_cover_url: api_absolute_url(resolver.effective_cover_url),
+        cover_source: resolver.cover_source,
+        custom_cover_enabled: match.team.entitlements.can_use_custom_cover?
+      }
+    end
+  end
+end

backend/app/controllers/concerns/branding_attachments.rb

@@ -8,6 +8,48 @@ module BrandingAttachments
     record.logo_file.attach(file) if file.present?
   end
 
+  def attach_cover_image(record, entitlements:)
+    remove_flag = params[:remove_cover].to_s == "1" || params.dig(:match, :remove_cover).to_s == "1"
+    if remove_flag
+      record.cover_image.purge if record.cover_image.attached?
+      record.cover_slate.purge if record.cover_slate.attached?
+      return
+    end
+
+    file = params.dig(:branding, :cover_image) || params[:cover_image]
+    return if file.blank?
+
+    entitlements.assert_can_upload_cover!
+    validate_cover_file!(file)
+    record.cover_slate.purge if record.cover_slate.attached?
+    record.cover_image.attach(file)
+  end
+
+  def validate_cover_file!(file)
+    allowed_types = Coverable::COVER_IMAGE_TYPES
+
+    # Rileva MIME dal contenuto (magic bytes) ignorando il declared_type del client.
+    io = file.respond_to?(:tempfile) ? file.tempfile : file
+    io.rewind if io.respond_to?(:rewind)
+    detected = Marcel::MimeType.for(io, name: file.respond_to?(:original_filename) ? file.original_filename : nil)
+    io.rewind if io.respond_to?(:rewind)
+
+    unless detected.in?(allowed_types)
+      raise CoverUploadError, I18n.t("coverable.errors.invalid_type")
+    end
+
+    byte_size = file.respond_to?(:size) ? file.size : File.size(file.path)
+    if byte_size > Coverable::MAX_COVER_BYTES
+      raise CoverUploadError, I18n.t("coverable.errors.too_large")
+    end
+  end
+
+  class CoverUploadError < StandardError; end
+
+  def enqueue_cover_slate_generation(record)
+    GenerateCoverSlateJob.enqueue_for(record) if record.cover_image.attached?
+  end
+
   def normalize_hex_color(value, fallback)
     v = value.to_s.strip
     v = "##{v}" if v.match?(/\A[0-9A-Fa-f]{6}\z/)

backend/app/controllers/concerns/mediamtx_playback.rb

@@ -4,11 +4,20 @@ module MediamtxPlayback
   private
 
   def mediamtx_paths_index
-    @mediamtx_paths_index ||= Mediamtx::Client.new.list_paths.index_by { |i| i["name"] }
+    mediamtx_paths_index_for_url(MatchLiveTv.mediamtx_api_url)
+  end
+
+  def mediamtx_paths_index_for(session)
+    mediamtx_paths_index_for_url(session.mediamtx_api_base_url)
+  end
+
+  def mediamtx_paths_index_for_url(api_url)
+    @mediamtx_paths_by_origin ||= {}
+    @mediamtx_paths_by_origin[api_url] ||= Mediamtx::Client.new(base_url: api_url).list_paths.index_by { |i| i["name"] }
   end
 
   def mediamtx_path_info(session, path_name: mediamtx_playback_path_name(session))
-    mediamtx_paths_index[path_name]
+    mediamtx_paths_index_for(session)[path_name]
   end
 
   def mediamtx_playback_path_name(session)
@@ -28,7 +37,7 @@ module MediamtxPlayback
   end
 
   def mediamtx_publisher_online?(session)
-    info = mediamtx_paths_index[session.mediamtx_path_name]
+    info = mediamtx_paths_index_for(session)[session.mediamtx_path_name]
     info && info["online"]
   end
 end

backend/app/controllers/hls_proxy_controller.rb

@@ -20,7 +20,8 @@ class HlsProxyController < ActionController::Base
   def proxy_mediamtx_path(upstream_path)
     return head :not_found if upstream_path.blank?
 
-    upstream = "#{MatchLiveTv.mediamtx_hls_url}/#{upstream_path}"
+    origin = hls_origin_for(upstream_path)
+    upstream = "#{origin}/#{upstream_path}"
     upstream = "#{upstream}?#{request.query_string}" if request.query_string.present?
     cookie = request.headers["Cookie"].presence || "cookieCheck=1"
 
@@ -30,7 +31,7 @@ class HlsProxyController < ActionController::Base
       if response.status.in?([301, 302, 307, 308])
         location = response.headers["location"].to_s
         cookie = cookie_from_set_header(response.headers["set-cookie"]).presence || cookie
-        upstream = resolve_upstream_url(location)
+        upstream = resolve_upstream_url(location, origin)
         next
       end
 
@@ -43,10 +44,21 @@ class HlsProxyController < ActionController::Base
     head :bad_gateway
   end
 
-  def resolve_upstream_url(location)
+  def hls_origin_for(upstream_path)
+    session_id = upstream_path[/\Alive\/match_([0-9a-f-]{36})/i, 1]
+    if session_id
+      session = StreamSession.find_by(id: session_id)
+      node_hls = session&.stream_node&.internal_hls_url.presence
+      return node_hls.sub(%r{/$}, "") if node_hls.present?
+    end
+
+    MatchLiveTv.mediamtx_hls_url.sub(%r{/$}, "")
+  end
+
+  def resolve_upstream_url(location, origin)
     return location if location.start_with?("http://", "https://")
 
-    base = MatchLiveTv.mediamtx_hls_url.sub(%r{/$}, "")
+    base = origin.to_s.sub(%r{/$}, "")
     location.start_with?("/") ? "#{base}#{location}" : "#{base}/#{location}"
   end
 

backend/app/controllers/public/club_billing_controller.rb

@@ -11,11 +11,15 @@ module Public
       @club.assign_attributes(billing_profile_params)
       if @club.save(context: :billing_profile)
         if premium_checkout_return_params.present? && @club.billing_profile_complete?
-          redirect_to public_club_checkout_path(
-            @club,
-            plan: premium_checkout_return_params[:plan],
-            interval: premium_checkout_return_params[:interval]
-          ), notice: t("flash.club_billing.profile_saved_proceed_payment")
+          if @club.active_billing_quote.present?
+            redirect_to public_club_billing_path(@club), notice: t("flash.club_billing.profile_updated")
+          else
+            redirect_to public_club_checkout_path(
+              @club,
+              plan: premium_checkout_return_params[:plan],
+              interval: premium_checkout_return_params[:interval]
+            ), notice: t("flash.club_billing.profile_saved_proceed_payment")
+          end
         else
           redirect_to public_club_billing_path(@club), notice: t("flash.club_billing.profile_updated")
         end
@@ -42,6 +46,29 @@ module Public
       redirect_to public_club_billing_path(@club), alert: t("flash.club_billing.stripe_error", message: e.message)
     end
 
+    def request_bank_transfer
+      if @club.subscription&.admin_comped?
+        redirect_to public_club_billing_path(@club), alert: t("flash.clubs.comped_change_denied")
+        return
+      end
+
+      unless @club.billing_profile_complete?
+        redirect_to public_club_billing_profile_path(@club, plan: params[:plan], interval: params[:interval]),
+                    alert: t("flash.clubs.complete_billing_first")
+        return
+      end
+
+      Billing::RequestBankTransfer.call(
+        club: @club,
+        user: current_user,
+        plan_slug: params[:plan],
+        interval: params[:interval]
+      )
+      redirect_to public_club_billing_path(@club), notice: t("flash.club_billing.bank_transfer_requested")
+    rescue Billing::RequestBankTransfer::Error, ArgumentError => e
+      redirect_to public_club_billing_path(@club), alert: e.message
+    end
+
     def download_invoice
       invoice = @club.billing_invoices.find(params[:invoice_id])
       unless invoice.pdf.attached?

backend/app/controllers/public/clubs_controller.rb

@@ -23,23 +23,28 @@ module Public
       ClubMembership.create!(user: current_user, club: club, role: "owner")
 
       first_team_name = params.dig(:first_team, :name).presence || t("club.new.default_first_team_name")
-      club.teams.create!(
+      first_team = club.teams.create!(
         name: first_team_name,
         sport: club.sport
       )
 
-      plan = params[:plan].presence_in(%w[free premium_light premium_full]) || "free"
-      Billing::AssignPlan.call(club: club, plan_slug: plan)
+      desired_plan = params[:plan].presence_in(%w[free premium_light premium_full]) || "free"
+      Billing::AssignPlan.call(club: club, plan_slug: "free")
+      Teams::StaffAssignment.designate_club_owner!(team: first_team, user: current_user)
 
-      if plan.in?(%w[premium_light premium_full]) && MatchLiveTv.stripe_enabled?
-        unless club.billing_profile_complete?
-          redirect_to public_club_billing_profile_path(club, plan: plan, interval: checkout_interval_param),
-                      alert: t("flash.clubs.complete_billing_first")
-          return
+      if desired_plan.in?(%w[premium_light premium_full])
+        interval = Billing::Stripe::PriceCatalog::DEFAULT_INTERVAL
+        if MatchLiveTv.stripe_enabled?
+          unless club.billing_profile_complete?
+            redirect_to public_club_billing_profile_path(club, plan: desired_plan, interval: interval),
+                        alert: t("flash.clubs.complete_billing_first")
+            return
+          end
+
+          redirect_to public_club_checkout_path(club, plan: desired_plan, interval: interval)
+        else
+          redirect_to public_club_billing_path(club), notice: t("flash.clubs.created_complete_subscription")
         end
-
-        interval = checkout_interval_param
-        redirect_to public_club_checkout_path(club, plan: plan, interval: interval)
       else
         redirect_to public_club_path(club), notice: t("flash.clubs.created")
       end
@@ -59,17 +64,26 @@ module Public
 
     def edit
       require_club_owner!(@club)
+      @entitlements = @club.teams.first&.entitlements
     end
 
     def update
       require_club_owner!(@club)
+      @entitlements = @club.teams.first!.entitlements
       @club.assign_attributes(club_params)
       attach_branding_logo(@club)
+      attach_cover_image(@club, entitlements: @entitlements)
       @club.save!
+      enqueue_cover_slate_generation(@club)
       redirect_to public_club_path(@club), notice: t("flash.clubs.updated")
     rescue ActiveRecord::RecordInvalid => e
+      @entitlements = @club.teams.first&.entitlements
       flash.now[:alert] = e.record.errors.full_messages.join(", ")
       render :edit, status: :unprocessable_entity
+    rescue Teams::EntitlementError, BrandingAttachments::CoverUploadError => e
+      @entitlements = @club.teams.first&.entitlements
+      flash.now[:alert] = e.message
+      render :edit, status: :unprocessable_entity
     end
 
     def billing
@@ -82,6 +96,8 @@ module Public
       @entitlements = @team.entitlements
       @plans = Plan.ordered
       @payments = @club.billing_payments.recent.includes(:invoice).limit(50)
+      @quote = @club.active_billing_quote
+      @pending_transfer = @club.billing_transfer_orders.awaiting_payment.first
     end
 
     def checkout
@@ -92,6 +108,12 @@ module Public
         return
       end
 
+      if @club.active_billing_quote.present?
+        redirect_to public_club_billing_path(@club),
+                    alert: t("flash.club_billing.quote_checkout_denied")
+        return
+      end
+
       unless MatchLiveTv.stripe_enabled?
         redirect_to public_club_billing_path(@club), alert: t("flash.clubs.stripe_not_configured")
         return

backend/app/controllers/public/contacts_controller.rb

@@ -0,0 +1,46 @@
+module Public
+  class ContactsController < WebBaseController
+    def show
+      @inquiry = empty_inquiry
+    end
+
+    def create
+      result = Contacts::SubmitInquiry.call(params: inquiry_params, ip: request.remote_ip)
+
+      if result.ok
+        redirect_to public_contatti_path, notice: t("flash.contacts.sent")
+        return
+      end
+
+      @inquiry = inquiry_params
+      flash.now[:alert] = t("flash.contacts.#{result.error}")
+      render :show, status: result.error == :throttled ? :too_many_requests : :unprocessable_entity
+    end
+
+    private
+
+    def inquiry_params
+      {
+        name: params[:name].to_s,
+        email: params[:email].to_s,
+        club_name: params[:club_name].to_s,
+        topic: params[:topic].to_s,
+        message: params[:message].to_s,
+        website: params[:website].to_s,
+        accept_privacy: params[:accept_privacy].to_s
+      }
+    end
+
+    def empty_inquiry
+      {
+        name: "",
+        email: "",
+        club_name: "",
+        topic: "commercial",
+        message: "",
+        website: "",
+        accept_privacy: ""
+      }
+    end
+  end
+end

backend/app/controllers/public/live_controller.rb

@@ -51,6 +51,7 @@ module Public
         @session.status.in?(%w[connecting live reconnecting paused])
       )
       @publisher_online = !@stream_closed && mediamtx_publisher_online?(@session)
+      @cover_poster_url = Streams::CoverResolver.new(@match).effective_cover_url
     end
 
     def status

backend/app/controllers/public/sessions_controller.rb

@@ -1,5 +1,9 @@
 module Public
   class SessionsController < WebBaseController
+    # Logout must succeed even with a stale CSRF token (old tab after deploy /
+    # session rotate). SameSite=Lax already blocks cross-site cookie POSTs.
+    skip_before_action :verify_authenticity_token, only: :destroy
+
     def new
       if logged_in? && current_user.primary_club
         redirect_to public_club_path(current_user.primary_club)

backend/app/controllers/public/site_base_controller.rb

@@ -9,6 +9,7 @@ module Public
 
     protect_from_forgery with: :exception
     before_action :set_site_locale
+    before_action :load_site_announcements
 
     private
 
@@ -40,5 +41,27 @@ module Public
     def logged_in?
       current_user.present?
     end
+
+    PRIVATE_WEB_CONTROLLERS = %w[
+      accounts clubs teams club_recordings club_billing
+      club_matches matches team_roster_members
+    ].freeze
+
+    def load_site_announcements
+      @site_announcements = if skip_site_announcements?
+        AppAnnouncement.none
+      else
+        channel = private_web_area? ? :web_private : :web_public
+        AppAnnouncement.for_channel(channel).newest
+      end
+    end
+
+    def skip_site_announcements?
+      controller_name == "regia"
+    end
+
+    def private_web_area?
+      PRIVATE_WEB_CONTROLLERS.include?(controller_name)
+    end
   end
 end

backend/app/controllers/public/sitemap_controller.rb

@@ -8,6 +8,7 @@ module Public
         { loc: "#{base}/prezzi", changefreq: "monthly", priority: "0.9" },
         { loc: "#{base}/pallavolo-giovanile", changefreq: "monthly", priority: "0.85" },
         { loc: "#{base}/faq", changefreq: "monthly", priority: "0.8" },
+        { loc: "#{base}/contatti", changefreq: "monthly", priority: "0.6" },
         { loc: "#{base}/live", changefreq: "hourly", priority: "0.85" },
         { loc: "#{base}/squadre", changefreq: "daily", priority: "0.85" },
         { loc: "#{base}/privacy", changefreq: "yearly", priority: "0.3" },

backend/app/controllers/public/teams_controller.rb

@@ -19,6 +19,7 @@ module Public
       require_club_owner!(@club)
       team = @club.teams.create!(team_params)
       attach_branding_logo(team)
+      Teams::StaffAssignment.designate_club_owner!(team: team, user: current_user)
       redirect_to public_club_path(@club), notice: t("flash.teams.added", name: team.name)
     rescue ActiveRecord::RecordInvalid => e
       flash.now[:alert] = e.record.errors.full_messages.join(", ")
@@ -41,19 +42,28 @@ module Public
     def edit
       require_club_owner_for_team!(@team)
       @club = @team.club
+      @entitlements = @team.entitlements
     end
 
     def update
       require_club_owner_for_team!(@team)
       @team.assign_attributes(team_params)
       attach_branding_logo(@team)
+      attach_cover_image(@team, entitlements: @team.entitlements)
       attach_team_photo(@team)
       @team.save!
+      enqueue_cover_slate_generation(@team)
       redirect_to public_team_details_path(@team), notice: t("flash.teams.updated")
     rescue ActiveRecord::RecordInvalid => e
       @club = @team.club
+      @entitlements = @team.entitlements
       flash.now[:alert] = e.record.errors.full_messages.join(", ")
       render :edit, status: :unprocessable_entity
+    rescue Teams::EntitlementError, BrandingAttachments::CoverUploadError => e
+      @club = @team.club
+      @entitlements = @team.entitlements
+      flash.now[:alert] = e.message
+      render :edit, status: :unprocessable_entity
     end
 
     def invite

backend/app/helpers/admin_helper.rb

@@ -30,6 +30,113 @@ module AdminHelper
     links
   end
 
+  def admin_session_ingest_badge_class(role_or_node)
+    role = role_or_node.respond_to?(:role) ? role_or_node.role : role_or_node
+    case role.to_s
+    when "home" then "badge--ingest-home"
+    when "lab" then "badge--ingest-lab"
+    when "cloud" then "badge--ingest-cloud"
+    else "badge--paused"
+    end
+  end
+
+  def admin_session_ingest_role_label(role_or_node)
+    role = role_or_node.respond_to?(:role) ? role_or_node.role : role_or_node
+    I18n.t("admin.sessions.ingest.role.#{role}", default: role.to_s.humanize)
+  end
+
+  def admin_session_status_badge_class(status)
+    case status.to_s
+    when "live" then "badge--live"
+    when "connecting", "reconnecting" then "badge--connecting"
+    when "paused", "idle" then "badge--paused"
+    when "ended" then "badge--ended"
+    when "error" then "badge--error"
+    else "badge--paused"
+    end
+  end
+
+  def admin_datetime(time, with_seconds: false)
+    return I18n.t("admin.common.dash") if time.blank?
+
+    format = with_seconds ? "%d/%m/%Y %H:%M:%S" : "%d/%m/%Y %H:%M"
+    time.in_time_zone.strftime(format)
+  end
+
+  def admin_session_duration_label(session)
+    secs = session.total_duration_secs.to_i
+    if secs <= 0 && session.started_at
+      end_time = session.ended_at || (session.terminal? ? session.updated_at : Time.current)
+      secs = (end_time - session.started_at).to_i if end_time
+    end
+    return I18n.t("admin.common.dash") if secs <= 0
+
+    hours = secs / 3600
+    mins = (secs % 3600) / 60
+    rem = secs % 60
+    if hours.positive?
+      format("%dh %02dm %02ds", hours, mins, rem)
+    elsif mins.positive?
+      format("%dm %02ds", mins, rem)
+    else
+      "#{rem}s"
+    end
+  end
+
+  def admin_session_client_os_label(session)
+    case session.client_os.to_s
+    when "android" then "Android"
+    when "ios" then "iOS"
+    else I18n.t("admin.common.dash")
+    end
+  end
+
+  def admin_session_client_summary(session)
+    parts = []
+    parts << admin_session_client_os_label(session) if session.client_os.present?
+    if session.app_version.present?
+      ver = session.app_version
+      ver = "#{ver} (#{session.app_build})" if session.app_build.present?
+      parts << "app #{ver}"
+    end
+    device = [session.device_manufacturer, session.device_model].compact_blank.join(" ")
+    parts << device if device.present?
+    parts << "OS #{session.os_version}" if session.os_version.present?
+    parts << session.carrier if session.carrier.present?
+    parts.presence&.join(" · ") || I18n.t("admin.common.dash")
+  end
+
+  def admin_format_event_meta(metadata)
+    return content_tag(:span, I18n.t("admin.common.dash"), class: "muted") if metadata.blank?
+
+    pairs = metadata.to_h
+    return content_tag(:span, I18n.t("admin.common.dash"), class: "muted") if pairs.empty?
+
+    content_tag(:dl, class: "admin-event-meta") do
+      safe_join(
+        pairs.map do |key, value|
+          content_tag(:div, class: "admin-event-meta__row") do
+            content_tag(:dt, key.to_s) +
+              content_tag(:dd, admin_event_meta_value(value))
+          end
+        end
+      )
+    end
+  end
+
+  def admin_event_meta_value(value)
+    case value
+    when Hash, Array
+      content_tag(:code, value.to_json)
+    when TrueClass, FalseClass
+      value ? "true" : "false"
+    when NilClass
+      I18n.t("admin.common.dash")
+    else
+      value.to_s
+    end
+  end
+
   def admin_regia_expires_label(iso_time)
     return if iso_time.blank?
 
@@ -37,4 +144,31 @@ module AdminHelper
   rescue ArgumentError, TypeError
     nil
   end
+
+  def announcement_status_badge(item)
+    case item.status
+    when "published" then item.severity == "critical" ? "live" : "ready"
+    when "archived" then "paused"
+    else "connecting"
+    end
+  end
+
+  def announcement_window_label(item)
+    start_label = item.starts_at&.in_time_zone&.strftime("%d/%m %H:%M")
+    end_label = item.ends_at&.in_time_zone&.strftime("%d/%m %H:%M")
+    if start_label && end_label
+      "#{start_label} → #{end_label}"
+    elsif start_label
+      I18n.t("admin.announcements.window.from", time: start_label)
+    elsif end_label
+      I18n.t("admin.announcements.window.until", time: end_label)
+    else
+      I18n.t("admin.announcements.window.always")
+    end
+  end
+
+  def announcement_channels_label(item)
+    labels = item.selected_channels.map { |key| I18n.t("admin.announcements.channels.#{key}") }
+    labels.presence&.join(" · ") || I18n.t("admin.common.dash")
+  end
 end

backend/app/helpers/legal_helper.rb

@@ -1,6 +1,6 @@
 module LegalHelper
   def legal_last_updated
-    "3 giugno 2026"
+    "20 agosto 2026"
   end
 
   def cookie_policy_last_updated

backend/app/helpers/public/billing_helper.rb

@@ -1,6 +1,6 @@
 module Public
   module BillingHelper
-    def plan_billing_action(current_slug:, target_plan:, stripe_subscription_active:, current_interval: nil, subscription: nil)
+    def plan_billing_action(current_slug:, target_plan:, stripe_subscription_active:, current_interval: nil, subscription: nil, club: nil)
       if target_plan.slug == "free"
         return { kind: :current, label: I18n.t("billing.actions.current_plan") } if current_slug == "free"
         return { kind: :none } if stripe_subscription_active
@@ -8,17 +8,50 @@ module Public
         return { kind: :contact, label: I18n.t("billing.actions.contact_for_free") }
       end
 
+      quote = club&.active_billing_quote
+      if quote
+        if quote.plan_slug == target_plan.slug
+          if current_paid_plan?(subscription, target_plan)
+            return {
+              kind: :current,
+              label: "#{I18n.t('billing.actions.current_plan')} — #{quote.price_label}"
+            }
+          end
+
+          return { kind: :quoted, plan: target_plan, quote: quote, intervals: [quote.billing_interval] }
+        end
+
+        return { kind: :quoted_other, label: I18n.t("billing.bank_transfer.quoted_other") }
+      end
+
+      intervals = bank_transfer_intervals_for(target_plan)
       unless MatchLiveTv.stripe_enabled?
+        if current_paid_plan?(subscription, target_plan)
+          return { kind: :current, label: current_plan_label(target_plan, subscription) }
+        end
+        if MatchLiveTv.bank_transfer_configured?
+          return { kind: :bank_only, plan: target_plan, intervals: intervals }
+        end
+
         return { kind: :disabled, label: I18n.t("billing.actions.stripe_not_configured") }
       end
 
-      intervals = Billing::Stripe::PriceCatalog.available_intervals(plan_slug: target_plan.slug)
-      return { kind: :disabled, label: I18n.t("billing.actions.stripe_prices_not_configured") } if intervals.empty?
+      stripe_intervals = Billing::Stripe::PriceCatalog.available_intervals(plan_slug: target_plan.slug)
+      if stripe_intervals.empty?
+        if current_paid_plan?(subscription, target_plan)
+          return { kind: :current, label: current_plan_label(target_plan, subscription) }
+        end
+        if MatchLiveTv.bank_transfer_configured?
+          return { kind: :bank_only, plan: target_plan, intervals: intervals }
+        end
+
+        return { kind: :disabled, label: I18n.t("billing.actions.stripe_prices_not_configured") }
+      end
 
       active_interval = current_interval.presence || Billing::Stripe::PriceCatalog::DEFAULT_INTERVAL
 
       if current_slug == target_plan.slug && stripe_subscription_active && !subscription&.plan_change_pending?
-        other_intervals = intervals - [active_interval]
+        other_intervals = stripe_intervals - [active_interval]
         if other_intervals.empty?
           label = "#{I18n.t('billing.actions.current_plan')} — #{Billing::Stripe::PriceCatalog.label(plan_slug: target_plan.slug, interval: active_interval)}"
           return { kind: :current, label: label }
@@ -34,13 +67,17 @@ module Public
         }
       end
 
+      if current_paid_plan?(subscription, target_plan)
+        return { kind: :current, label: current_plan_label(target_plan, subscription) }
+      end
+
       if current_slug == "free" || !stripe_subscription_active
-        { kind: :checkout_options, plan: target_plan, intervals: intervals, subscription: subscription }
+        { kind: :checkout_options, plan: target_plan, intervals: stripe_intervals.presence || intervals, subscription: subscription }
       else
         {
           kind: :change_options,
           plan: target_plan,
-          intervals: intervals,
+          intervals: stripe_intervals,
           current_slug: current_slug,
           current_interval: active_interval,
           subscription: subscription
@@ -96,5 +133,41 @@ module Public
       I18n.t("billing.actions.profile_missing", fields: missing.join(", "))
     end
 
+    def bank_transfer_intervals_for(plan)
+      Billing::Stripe::PriceCatalog.catalog_intervals(plan_slug: plan.slug)
+    end
+
+    def bank_transfer_price_label(plan, interval, quote: nil)
+      if quote&.matches?(plan.slug, interval)
+        quote.price_label
+      else
+        Billing::Stripe::PriceCatalog.format_interval_price(
+          Billing::Stripe::PriceCatalog.amount_cents(plan_slug: plan.slug, interval: interval),
+          interval
+        )
+      end
+    end
+
+    def show_bank_transfer_for?(club:, plan:, interval:, quote: nil, pending_transfer: nil)
+      return false unless club.present? && plan.slug != "free"
+      return false unless MatchLiveTv.bank_transfer_configured?
+      return false if quote && !quote.matches?(plan.slug, interval)
+      return false if pending_transfer&.awaiting_payment?
+      return false if current_paid_plan?(club.subscription, plan)
+
+      true
+    end
+
+    def current_paid_plan?(subscription, target_plan)
+      return false unless subscription&.active? && subscription.premium?
+      return false if subscription.plan_change_pending?
+
+      subscription.plan.slug == target_plan.slug
+    end
+
+    def current_plan_label(target_plan, subscription)
+      interval = subscription&.billing_interval.presence || Billing::Stripe::PriceCatalog::DEFAULT_INTERVAL
+      "#{I18n.t('billing.actions.current_plan')} — #{Billing::Stripe::PriceCatalog.label(plan_slug: target_plan.slug, interval: interval)}"
+    end
   end
 end

backend/app/helpers/public/regia_helper.rb

@@ -52,6 +52,18 @@ module Public
         muteError: t("regia.js.mute_error"),
         closeError: t("regia.js.close_error"),
         closeConfirm: t("regia.js.close_confirm"),
+        pauseConfirmTitle: t("regia.js.pause_confirm_title"),
+        pauseConfirmBody: t("regia.js.pause_confirm_body"),
+        resumeConfirmTitle: t("regia.js.resume_confirm_title"),
+        resumeConfirmBody: t("regia.js.resume_confirm_body"),
+        muteConfirmTitle: t("regia.js.mute_confirm_title"),
+        muteConfirmBody: t("regia.js.mute_confirm_body"),
+        unmuteConfirmTitle: t("regia.js.unmute_confirm_title"),
+        unmuteConfirmBody: t("regia.js.unmute_confirm_body"),
+        advancePeriodTitle: t("regia.js.advance_period_title"),
+        advancePeriodBody: t("regia.js.advance_period_body"),
+        confirmAction: t("regia.modal.confirm_action"),
+        stopConfirmTitle: t("regia.js.stop_confirm_title"),
         linkUnavailable: t("regia.js.link_unavailable"),
         linkCopied: t("regia.js.link_copied"),
         copyPrompt: t("regia.js.copy_prompt"),

backend/app/jobs/analytics/aggregate_job.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Analytics
+  class AggregateJob < ApplicationJob
+    queue_as :default
+
+    def perform(purge: false)
+      redis = Redis.new(url: ENV.fetch("REDIS_URL", "redis://localhost:6379/0"))
+      lock_key = "analytics:aggregate:lock"
+      acquired = redis.set(lock_key, "1", nx: true, ex: 120)
+      return unless acquired
+
+      begin
+        service = Analytics::Aggregate.new
+        service.call
+        service.purge_old! if purge
+      ensure
+        redis.del(lock_key)
+      end
+    rescue StandardError => e
+      Rails.logger.error("[analytics] aggregate failed: #{e.class} #{e.message}")
+      raise
+    end
+  end
+end

backend/app/jobs/expire_ended_subscriptions_job.rb

@@ -6,12 +6,37 @@ class ExpireEndedSubscriptionsJob
     free_plan = Plan["free"]
 
     Subscription.where(cancel_at_period_end: true)
-                  .where("current_period_end <= ?", Time.current)
-                  .where.not(plan_id: free_plan.id)
-                  .find_each do |sub|
-      Billing::Stripe::FinalizeSubscription.call(club: sub.club)
+                .where("current_period_end <= ?", Time.current)
+                .where.not(plan_id: free_plan.id)
+                .where(admin_comped: false)
+                .find_each do |sub|
+      expire!(sub)
     rescue StandardError => e
       Rails.logger.warn("[ExpireEndedSubscriptions] club=#{sub.club_id} #{e.message}")
     end
   end
+
+  private
+
+  def expire!(sub)
+    if sub.stripe_subscription_id.present?
+      Billing::Stripe::FinalizeSubscription.call(club: sub.club)
+    else
+      Billing::AssignPlan.call(
+        club: sub.club,
+        plan_slug: "free",
+        status: "active",
+        stripe_attrs: {
+          stripe_subscription_id: nil,
+          stripe_schedule_id: nil,
+          current_period_start: nil,
+          current_period_end: nil,
+          cancel_at_period_end: false,
+          billing_interval: nil,
+          pending_plan_id: nil,
+          pending_billing_interval: nil
+        }
+      )
+    end
+  end
 end

backend/app/jobs/generate_cover_slate_job.rb

@@ -0,0 +1,19 @@
+class GenerateCoverSlateJob < ApplicationJob
+  queue_as :default
+
+  def self.enqueue_for(record)
+    return unless record&.cover_image&.attached?
+
+    queue = record.is_a?(Match) ? :critical : :default
+    set(queue: queue).perform_later(record.class.name, record.id)
+  end
+
+  def perform(class_name, record_id)
+    record = class_name.constantize.find_by(id: record_id)
+    return unless record&.cover_image&.attached?
+
+    Streams::GenerateCoverSlate.call(record)
+  rescue Streams::GenerateCoverSlate::Error => e
+    Rails.logger.warn("[GenerateCoverSlateJob] #{class_name}##{record_id} #{e.message}")
+  end
+end

backend/app/jobs/recordings/clear_temporary_media_job.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Recordings
+  class ClearTemporaryMediaJob
+    include Sidekiq::Job
+    sidekiq_options retry: 3, queue: "default"
+
+    def perform(recording_id, reason = "verified")
+      recording = Recording.find_by(id: recording_id)
+      return unless recording
+
+      Recordings::ClearTemporaryMedia.new(
+        recording,
+        reason: reason.to_sym,
+        force: reason.to_s == "verified"
+      ).call
+    end
+  end
+end

backend/app/jobs/recordings/post_process_job.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Recordings
   class PostProcessJob
     include Sidekiq::Job
@@ -7,10 +9,30 @@ module Recordings
       recording = Recording.find_by(id: recording_id)
       return unless recording&.ready?
 
-      Recordings::NotifyReady.new(recording).call
+      begin
+        Recordings::NotifyReady.new(recording).call
+      rescue StandardError => e
+        # SMTP/ntfy giù non deve bloccare VerifyYoutubeReplay né il resto del post-process.
+        Rails.logger.warn(
+          "[Recordings::PostProcessJob] notify_failed recording=#{recording.id} " \
+          "#{e.class}: #{e.message}"
+        )
+      end
 
+      if recording.temporary_storage?
+        grace = MatchLiveTv.youtube_replay_verify_grace_secs
+        Rails.logger.info(
+          "[Recordings::PostProcessJob] schedule VerifyYoutubeReplay " \
+          "recording=#{recording.id} grace=#{grace}s"
+        )
+        Recordings::VerifyYoutubeReplayJob.perform_in(grace.seconds, recording.id, 0)
+        return
+      end
+
+      # Solo MatchLiveTV-only: eventuale re-upload manuale/flag legacy (non per live YouTube).
       return unless recording.auto_publish_youtube?
       return if recording.youtube_video_id.present?
+      return if recording.source_platform == "youtube"
 
       Recordings::PublishToYoutubeJob.perform_async(recording.id)
     end

backend/app/jobs/recordings/purge_temporary_media_job.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Recordings
+  # Safety net: elimina copie temp scadute (anche se verify non è mai riuscito).
+  class PurgeTemporaryMediaJob
+    include Sidekiq::Job
+    sidekiq_options retry: 1, queue: "default"
+
+    def perform
+      scope = Recording.temporary_media_pending_purge
+      count = 0
+
+      scope.find_each do |recording|
+        unless recording.youtube_verified_at.present?
+          Rails.logger.warn(
+            "[Recordings::PurgeTemporaryMediaJob] anomaly_unverified_expiry " \
+            "recording=#{recording.id} session=#{recording.stream_session_id} " \
+            "youtube_video_id=#{recording.youtube_video_id.inspect} " \
+            "temp_expires_at=#{recording.temp_expires_at.inspect}"
+          )
+        end
+
+        Recordings::ClearTemporaryMedia.new(
+          recording,
+          reason: :max_retention,
+          force: true
+        ).call
+        count += 1
+      end
+
+      Rails.logger.info("[Recordings::PurgeTemporaryMediaJob] processed=#{count}")
+      count
+    end
+  end
+end

backend/app/jobs/recordings/verify_youtube_replay_job.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Recordings
+  class VerifyYoutubeReplayJob
+    include Sidekiq::Job
+    sidekiq_options retry: 0, queue: "default"
+
+    def perform(recording_id, attempt = 0)
+      recording = Recording.find_by(id: recording_id)
+      return unless recording&.temporary_storage?
+      return if recording.deleted?
+
+      attempt = attempt.to_i
+      max = MatchLiveTv.youtube_replay_verify_max_attempts
+      result = Recordings::VerifyYoutubeReplay.new(recording).call
+
+      if result.ok?
+        Recordings::ClearTemporaryMediaJob.perform_async(recording.id, "verified")
+        return
+      end
+
+      if result.retriable? && attempt + 1 < max
+        delay = backoff_secs(attempt)
+        Rails.logger.info(
+          "[Recordings::VerifyYoutubeReplayJob] retry recording=#{recording.id} " \
+          "attempt=#{attempt + 1}/#{max} in=#{delay}s msg=#{result.message}"
+        )
+        self.class.perform_in(delay.seconds, recording.id, attempt + 1)
+        return
+      end
+
+      Rails.logger.warn(
+        "[Recordings::VerifyYoutubeReplayJob] give_up recording=#{recording.id} " \
+        "attempts=#{attempt + 1} msg=#{result.message} " \
+        "temp_expires_at=#{recording.temp_expires_at.inspect}"
+      )
+    end
+
+    private
+
+    def backoff_secs(attempt)
+      base = MatchLiveTv.youtube_replay_verify_base_interval_secs
+      # 300, 600, 1200, ... capped at 1h
+      [base * (2**attempt), 3600].min
+    end
+  end
+end

backend/app/jobs/streams/autoscaler_job.rb

@@ -8,6 +8,8 @@ module Streams
 
     INTERVAL_SECS = ENV.fetch("STREAM_AUTOSCALE_INTERVAL_SECS", "60").to_i
     REDIS_CHAIN_KEY = "streams:autoscaler:chain"
+    KICK_DEBOUNCE_KEY = "streams:autoscaler:kick"
+    KICK_DEBOUNCE_SECS = ENV.fetch("STREAM_AUTOSCALE_KICK_DEBOUNCE_SECS", "5").to_i
 
     def self.ensure_chain
       return unless redis
@@ -17,6 +19,16 @@ module Streams
       perform_in(INTERVAL_SECS)
     end
 
+    # Kick immediato (es. NoCapacity / soft-free bassi). Debounce anti-flood Sidekiq.
+    def self.kick!
+      return false unless Streams::Autoscaler.enabled?
+      return false unless redis
+      return false unless redis.set(KICK_DEBOUNCE_KEY, "1", nx: true, ex: KICK_DEBOUNCE_SECS)
+
+      perform_async
+      true
+    end
+
     def self.redis
       @redis ||= Redis.new(url: ENV.fetch("REDIS_URL", "redis://localhost:6379/0"))
     rescue Redis::CannotConnectError

backend/app/jobs/youtube_relay_ensure_job.rb

@@ -1,4 +1,4 @@
-# Avvia/riavvia il relay YouTube solo sui worker con YOUTUBE_RELAY_WORKER=1 (coda youtube_relay).
+# Avvia/riavvia il relay YouTube sul worker del nodo (coda youtube_relay_<slug>).
 class YoutubeRelayEnsureJob < ApplicationJob
   queue_as Streams::YoutubeRelay::QUEUE
 

backend/app/jobs/youtube_relay_stop_job.rb

@@ -17,6 +17,7 @@ class YoutubeRelayStopJob < ApplicationJob
     return unless result == :wrong_host
     return if attempts >= 30
 
-    self.class.set(wait: 2.seconds).perform_later(session_id, attempts + 1)
+    self.class.set(wait: 2.seconds, queue: Streams::YoutubeRelay.queue_for(session))
+      .perform_later(session_id, attempts + 1)
   end
 end

backend/app/mailers/billing/bank_transfer_mailer.rb

@@ -0,0 +1,35 @@
+module Billing
+  class BankTransferMailer < ApplicationMailer
+    def instructions
+      @order = params[:order]
+      @club = @order.club
+      @iban = MatchLiveTv.bank_transfer_iban
+      @holder = MatchLiveTv.bank_transfer_account_holder
+      @bank_name = MatchLiveTv.bank_transfer_bank_name
+      @bic = MatchLiveTv.bank_transfer_bic
+      @proof_email = MatchLiveTv.bank_transfer_proof_email
+
+      mail(
+        to: recipient_email,
+        subject: t("mailers.bank_transfer.instructions.subject", plan: @order.plan.name)
+      )
+    end
+
+    def plan_activated
+      @order = params[:order]
+      @club = @order.club
+      @subscription = @club.subscription
+
+      mail(
+        to: recipient_email,
+        subject: t("mailers.bank_transfer.plan_activated.subject", plan: @order.plan.name)
+      )
+    end
+
+    private
+
+    def recipient_email
+      @club.billing_email.presence || @club.owner&.email
+    end
+  end
+end

backend/app/mailers/billing/invoice_mailer.rb

@@ -5,17 +5,37 @@ module Billing
       @club = @invoice.club
 
       I18n.with_locale(I18n.locale) do
-        prefix = t("mailers.invoice.attachment_prefix")
-        attachments["#{prefix}-#{@invoice.number.parameterize}.pdf"] = {
-          mime_type: "application/pdf",
-          content: @invoice.pdf.download
-        }
-
+        attach_invoice_pdf!
         mail(
           to: @club.billing_email,
           subject: t("mailers.invoice.subject", number: @invoice.display_number)
         )
       end
     end
+
+    def plan_activated_with_invoice
+      @invoice = params[:invoice]
+      @club = @invoice.club
+
+      I18n.with_locale(I18n.locale) do
+        attach_invoice_pdf!
+        mail(
+          to: @club.billing_email,
+          subject: t("mailers.invoice_activated.subject",
+                     plan: @club.subscription&.plan&.name || @invoice.display_number,
+                     number: @invoice.display_number)
+        )
+      end
+    end
+
+    private
+
+    def attach_invoice_pdf!
+      prefix = t("mailers.invoice.attachment_prefix")
+      attachments["#{prefix}-#{@invoice.number.parameterize}.pdf"] = {
+        mime_type: "application/pdf",
+        content: @invoice.pdf.download
+      }
+    end
   end
 end

backend/app/mailers/contact_mailer.rb

@@ -0,0 +1,25 @@
+class ContactMailer < ApplicationMailer
+  def inquiry(name:, email:, club_name:, topic:, message:)
+    @name = name
+    @email = email
+    @club_name = club_name.presence
+    @topic = topic
+    @message = message
+
+    mail(
+      to: recipient_for(topic),
+      reply_to: email,
+      subject: t("mailers.contact.subject.#{topic}", name: name)
+    )
+  end
+
+  private
+
+  def recipient_for(topic)
+    if topic == "privacy"
+      MatchLiveTv.privacy_controller_email
+    else
+      MatchLiveTv.support_email
+    end
+  end
+end

backend/app/models/admin_account.rb

@@ -2,6 +2,7 @@ class AdminAccount < ApplicationRecord
   include PasswordComplexity
 
   has_secure_password
+  has_many :app_announcements, foreign_key: :created_by_admin_id, dependent: :nullify, inverse_of: :created_by_admin
 
   validates :username, presence: true, uniqueness: true
 end

backend/app/models/analytics_event.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class AnalyticsEvent < ApplicationRecord
+  self.table_name = "analytics_events"
+
+  EVENT_TYPES = %w[click scroll pageview move].freeze
+  DEVICES = %w[mobile tablet desktop].freeze
+
+  validates :page_path, presence: true
+  validates :device, inclusion: { in: DEVICES }
+  validates :event_type, inclusion: { in: EVENT_TYPES }
+  validates :occurred_at, presence: true
+  validates :weight, numericality: { greater_than: 0, less_than_or_equal_to: 500 }
+end

backend/app/models/analytics_page_cell.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class AnalyticsPageCell < ApplicationRecord
+  self.table_name = "analytics_page_cells"
+
+  GRID_SIZE = 40
+
+  validates :day, :page_path, :device, :cell_x, :cell_y, presence: true
+  validates :device, inclusion: { in: AnalyticsEvent::DEVICES }
+  validates :cell_x, :cell_y, inclusion: { in: 0...(GRID_SIZE) }
+  validates :click_count, numericality: { greater_than_or_equal_to: 0 }
+  validates :move_count, numericality: { greater_than_or_equal_to: 0 }
+end

backend/app/models/analytics_page_snapshot.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+class AnalyticsPageSnapshot < ApplicationRecord
+  self.table_name = "analytics_page_snapshots"
+
+  has_one_attached :image
+
+  validates :page_path, presence: true
+  validates :device, inclusion: { in: AnalyticsEvent::DEVICES }
+  validates :width, :height, numericality: { greater_than: 0 }
+  validates :captured_at, presence: true
+end

backend/app/models/analytics_page_stat.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class AnalyticsPageStat < ApplicationRecord
+  self.table_name = "analytics_page_stats"
+
+  validates :day, :page_path, :device, presence: true
+  validates :device, inclusion: { in: AnalyticsEvent::DEVICES }
+
+  def avg_scroll_pct
+    return 0 if scroll_samples.to_i <= 0
+
+    (scroll_sum_pct.to_f / scroll_samples).round
+  end
+end

backend/app/models/app_announcement.rb

@@ -0,0 +1,240 @@
+class AppAnnouncement < ApplicationRecord
+  KINDS = %w[info maintenance update].freeze
+  SEVERITIES = %w[info warning critical].freeze
+  STATUSES = %w[draft published archived].freeze
+  CHANNELS = {
+    android: :show_on_android,
+    ios: :show_on_ios,
+    web_public: :show_on_web_public,
+    web_private: :show_on_web_private
+  }.freeze
+  COPY_KEYS = %w[title body action_url action_label].freeze
+  URL_KEYS = %w[action_url].freeze
+  TITLE_KEYS = %w[title].freeze
+  BODY_KEYS = %w[body].freeze
+  LABEL_KEYS = %w[action_label].freeze
+  LOCALE_FALLBACKS = {
+    "it" => %w[it],
+    "en" => %w[en it],
+    "fr" => %w[fr en it],
+    "de" => %w[de en it],
+    "es" => %w[es en it]
+  }.freeze
+
+  belongs_to :created_by_admin, class_name: "AdminAccount", optional: true
+
+  validates :kind, :severity, :status, :title, :body, presence: true
+  validates :kind, inclusion: { in: KINDS }
+  validates :severity, inclusion: { in: SEVERITIES }
+  validates :status, inclusion: { in: STATUSES }
+  validates :title, length: { maximum: 120 }, allow_blank: true
+  validates :body, length: { maximum: 2000 }, allow_blank: true
+  validates :action_label, length: { maximum: 40 }, allow_blank: true
+  URL_KEYS.each do |field|
+    validates field, format: { with: /\Ahttps?:\/\/.+/i, allow_blank: true }
+  end
+  validate :ends_at_after_starts_at
+  validate :at_least_one_channel
+  validate :translations_are_valid
+  before_validation :normalize_translations
+
+  scope :newest, -> { order(created_at: :desc) }
+  scope :published, -> { where(status: "published") }
+  scope :active_now, lambda {
+    now = Time.current
+    published
+      .where("starts_at IS NULL OR starts_at <= ?", now)
+      .where("ends_at IS NULL OR ends_at > ?", now)
+  }
+
+  def self.for_channel(channel)
+    column = CHANNELS[channel.to_sym]
+    raise ArgumentError, "unknown announcement channel: #{channel}" if column.blank?
+
+    active_now.where(column => true)
+  end
+
+  def self.for_app
+    active_now.where("show_on_android = TRUE OR show_on_ios = TRUE")
+  end
+
+  def self.for_platform(platform)
+    case platform.to_s
+    when "android" then for_channel(:android)
+    when "ios" then for_channel(:ios)
+    else for_app
+    end
+  end
+
+  def published?
+    status == "published"
+  end
+
+  def selected_channels
+    CHANNELS.each_with_object([]) do |(key, column), keys|
+      keys << key if public_send(column)
+    end
+  end
+
+  def copy_values_for(locale)
+    loc = locale.to_s
+    if default_locale?(loc)
+      COPY_KEYS.index_with { |key| public_send(key).to_s.presence }
+    else
+      translation_hash(loc)
+    end
+  end
+
+  def filled_locale_codes
+    LocaleResolver.available.select { |loc| locale_has_copy?(loc) }.map(&:to_s)
+  end
+
+  def as_api_json(platform: nil, locale: I18n.locale)
+    {
+      id: id,
+      kind: kind,
+      severity: severity,
+      title: copy_for("title", locale: locale),
+      body: copy_for("body", locale: locale),
+      dismissible: dismissible,
+      action_url: resolved_action_url(platform, locale: locale),
+      action_label: copy_for("action_label", locale: locale).presence,
+      starts_at: starts_at&.iso8601,
+      ends_at: ends_at&.iso8601
+    }
+  end
+
+  def localized_title(locale: I18n.locale)
+    copy_for("title", locale: locale)
+  end
+
+  def localized_body(locale: I18n.locale)
+    copy_for("body", locale: locale)
+  end
+
+  def localized_action_label(locale: I18n.locale)
+    copy_for("action_label", locale: locale)
+  end
+
+  def resolved_action_url(platform, locale: I18n.locale)
+    url = copy_for("action_url", locale: locale)
+    return url if url.present?
+    return nil unless kind == "update"
+
+    case platform.to_s
+    when "android" then MatchLiveTv.play_store_url
+    when "ios" then MatchLiveTv.app_store_url
+    end
+  end
+
+  private
+
+  def copy_for(field, locale: I18n.locale)
+    field = field.to_s
+    locale_chain(locale).each do |loc|
+      value = value_for(loc, field)
+      return value if value.present?
+    end
+    nil
+  end
+
+  def value_for(locale, key)
+    copy_values_for(locale)[key].presence
+  end
+
+  def translation_hash(locale)
+    raw = translations.is_a?(Hash) ? translations : {}
+    values = raw.stringify_keys[locale.to_s]
+    return {} unless values.is_a?(Hash)
+
+    values.stringify_keys
+  end
+
+  def locale_chain(locale)
+    loc = (LocaleResolver.normalize(locale) || I18n.default_locale).to_s
+    LOCALE_FALLBACKS[loc] || [loc, I18n.default_locale.to_s].uniq
+  end
+
+  def locale_has_copy?(locale)
+    values = copy_values_for(locale)
+    values["title"].present? || values["body"].present?
+  end
+
+  def default_locale?(locale)
+    locale.to_s == I18n.default_locale.to_s
+  end
+
+  def normalize_translations
+    self.translations = self.class.sanitize_translations(translations)
+  end
+
+  def self.sanitize_translations(value)
+    raw = coerce_translation_hash(value)
+    LocaleResolver.available.each_with_object({}) do |loc, acc|
+      next if loc.to_s == I18n.default_locale.to_s
+
+      payload = raw[loc.to_s]
+      next unless payload.is_a?(Hash)
+
+      cleaned = COPY_KEYS.each_with_object({}) do |key, fields|
+        text = payload[key].to_s.strip
+        fields[key] = text if text.present?
+      end
+      acc[loc.to_s] = cleaned if cleaned.any?
+    end
+  end
+
+  def self.coerce_translation_hash(value)
+    hash = if value.is_a?(ActionController::Parameters)
+             value.to_unsafe_h
+           elsif value.is_a?(Hash)
+             value
+           else
+             {}
+           end
+    hash.deep_stringify_keys
+  end
+  private_class_method :coerce_translation_hash
+
+  def at_least_one_channel
+    return if show_on_android? || show_on_ios? || show_on_web_public? || show_on_web_private?
+
+    errors.add(:base, :no_channel)
+  end
+
+  def ends_at_after_starts_at
+    return if starts_at.blank? || ends_at.blank?
+    return if ends_at > starts_at
+
+    errors.add(:ends_at, :invalid)
+  end
+
+  def translations_are_valid
+    translation_entries.each do |locale, payload|
+      TITLE_KEYS.each do |key|
+        errors.add(:base, :translation_too_long, locale: locale, field: key) if payload[key].to_s.length > 120
+      end
+      BODY_KEYS.each do |key|
+        errors.add(:base, :translation_too_long, locale: locale, field: key) if payload[key].to_s.length > 2000
+      end
+      LABEL_KEYS.each do |key|
+        errors.add(:base, :translation_too_long, locale: locale, field: key) if payload[key].to_s.length > 40
+      end
+      URL_KEYS.each do |key|
+        url = payload[key].to_s
+        next if url.blank? || url.match?(/\Ahttps?:\/\/.+/i)
+
+        errors.add(:base, :translation_invalid_url, locale: locale)
+      end
+    end
+  end
+
+  def translation_entries
+    raw = translations.is_a?(Hash) ? translations : {}
+    raw.stringify_keys.filter_map do |locale, payload|
+      next unless payload.is_a?(Hash)
+
+      [locale, payload.stringify_keys]
+    end
+  end
+end

backend/app/models/billing/club_quote.rb

@@ -0,0 +1,34 @@
+module Billing
+  class ClubQuote < ApplicationRecord
+    self.table_name = "billing_club_quotes"
+
+    PLAN_SLUGS = %w[premium_light premium_full].freeze
+    INTERVALS = Billing::Stripe::PriceCatalog::INTERVALS
+
+    belongs_to :club
+    belongs_to :created_by_admin, class_name: "AdminAccount", optional: true
+
+    validates :plan_slug, inclusion: { in: PLAN_SLUGS }
+    validates :billing_interval, inclusion: { in: INTERVALS }
+    validates :amount_cents, numericality: { greater_than: 0 }
+    validates :currency, presence: true
+
+    scope :active, -> { where(active: true) }
+
+    def matches?(plan_slug, interval)
+      self.plan_slug == plan_slug.to_s && billing_interval == interval.to_s
+    end
+
+    def plan
+      Plan[plan_slug]
+    end
+
+    def formatted_amount
+      Billing::Stripe::PriceCatalog.format_eur(amount_cents)
+    end
+
+    def price_label
+      Billing::Stripe::PriceCatalog.format_interval_price(amount_cents, billing_interval)
+    end
+  end
+end

backend/app/models/billing/payment.rb

@@ -2,14 +2,17 @@ module Billing
   class Payment < ApplicationRecord
     self.table_name = "billing_payments"
 
-    STATUSES = %w[paid failed refunded].freeze
+    STATUSES = %w[pending paid failed refunded].freeze
+    PROVIDERS = %w[stripe bank_transfer].freeze
 
     belongs_to :club
     has_one :invoice, class_name: "Billing::Invoice", foreign_key: :billing_payment_id, dependent: :nullify
+    has_one :transfer_order, class_name: "Billing::TransferOrder", foreign_key: :billing_payment_id, dependent: :nullify
 
     validates :amount_cents, numericality: { greater_than: 0 }
     validates :currency, presence: true
     validates :status, inclusion: { in: STATUSES }
+    validates :provider, inclusion: { in: PROVIDERS }
     validates :stripe_invoice_id, uniqueness: true, allow_nil: true
 
     scope :recent, -> { order(paid_at: :desc, created_at: :desc) }
@@ -62,7 +65,12 @@ module Billing
     end
 
     def display_status
-      { "paid" => "Pagato", "failed" => "Non riuscito", "refunded" => "Rimborsato" }[status] || status
+      {
+        "pending" => "In attesa di bonifico",
+        "paid" => "Pagato",
+        "failed" => "Non riuscito",
+        "refunded" => "Rimborsato"
+      }[status] || status
     end
 
     def invoice_for_display

backend/app/models/billing/transfer_order.rb

@@ -0,0 +1,67 @@
+module Billing
+  class TransferOrder < ApplicationRecord
+    self.table_name = "billing_transfer_orders"
+
+    KINDS = %w[list_price commercial_quote].freeze
+    STATUSES = %w[awaiting_payment paid cancelled].freeze
+    PLAN_SLUGS = ClubQuote::PLAN_SLUGS
+    INTERVALS = ClubQuote::INTERVALS
+
+    belongs_to :club
+    belongs_to :billing_club_quote, class_name: "Billing::ClubQuote", optional: true
+    belongs_to :billing_payment, class_name: "Billing::Payment", optional: true
+    belongs_to :requested_by_user, class_name: "User", optional: true
+    belongs_to :confirmed_by_admin, class_name: "AdminAccount", optional: true
+
+    validates :plan_slug, inclusion: { in: PLAN_SLUGS }
+    validates :billing_interval, inclusion: { in: INTERVALS }
+    validates :amount_cents, numericality: { greater_than: 0 }
+    validates :kind, inclusion: { in: KINDS }
+    validates :status, inclusion: { in: STATUSES }
+    validates :reference_code, presence: true, uniqueness: true
+    validates :currency, presence: true
+
+    scope :awaiting_payment, -> { where(status: "awaiting_payment").order(created_at: :desc) }
+    scope :recent, -> { order(created_at: :desc) }
+
+    def awaiting_payment?
+      status == "awaiting_payment"
+    end
+
+    def paid?
+      status == "paid"
+    end
+
+    def quoted?
+      kind == "commercial_quote"
+    end
+
+    def plan
+      Plan[plan_slug]
+    end
+
+    def formatted_amount
+      format("%.2f €", amount_cents / 100.0)
+    end
+
+    def price_label
+      Billing::Stripe::PriceCatalog.format_interval_price(amount_cents, billing_interval)
+    end
+
+    def payment_causal
+      "MLTV #{reference_code} #{club.name}".truncate(140, omission: "")
+    end
+
+    def cancel!
+      return self unless awaiting_payment?
+
+      transaction do
+        update!(status: "cancelled", cancelled_at: Time.current)
+        if billing_payment&.status == "pending"
+          billing_payment.update!(status: "failed")
+        end
+      end
+      self
+    end
+  end
+end

backend/app/models/club.rb

@@ -1,5 +1,6 @@
 class Club < ApplicationRecord
   include Brandable
+  include Coverable
   include ClubBillingProfile
 
   has_many :club_memberships, dependent: :destroy
@@ -7,8 +8,11 @@ class Club < ApplicationRecord
   has_many :teams, dependent: :destroy
   has_one :youtube_credential, dependent: :destroy
   has_one :subscription, dependent: :destroy
+  has_one :billing_quote, -> { where(active: true) }, class_name: "Billing::ClubQuote", inverse_of: :club
+  has_many :billing_quotes, class_name: "Billing::ClubQuote", dependent: :destroy, inverse_of: :club
   has_many :billing_payments, class_name: "Billing::Payment", dependent: :destroy
   has_many :billing_invoices, class_name: "Billing::Invoice", dependent: :destroy
+  has_many :billing_transfer_orders, class_name: "Billing::TransferOrder", dependent: :destroy
 
   validates :name, presence: true
   validates :sport, presence: true
@@ -23,6 +27,14 @@ class Club < ApplicationRecord
     club_memberships.exists?(user: user, role: "owner")
   end
 
+  def active_billing_quote
+    billing_quote
+  end
+
+  def pending_transfer_order
+    billing_transfer_orders.awaiting_payment.first
+  end
+
   private
 
   def branding_parent

backend/app/models/concerns/coverable.rb

@@ -0,0 +1,50 @@
+module Coverable
+  extend ActiveSupport::Concern
+
+  COVER_IMAGE_TYPES = %w[image/png image/jpeg image/webp].freeze
+  MAX_COVER_BYTES = 5.megabytes
+
+  included do
+    has_one_attached :cover_image
+    has_one_attached :cover_slate
+
+    validate :cover_image_file_type, if: -> { cover_image.attached? }
+    validate :cover_image_file_size, if: -> { cover_image.attached? }
+  end
+
+  def cover_image_attached?
+    cover_image.attached?
+  end
+
+  def cover_url
+    return unless cover_image.attached?
+
+    Rails.application.routes.url_helpers.rails_blob_path(cover_image, only_path: true)
+  end
+
+  def effective_cover_url
+    if cover_image.attached?
+      cover_url
+    else
+      cover_parent&.effective_cover_url
+    end
+  end
+
+  private
+
+  def cover_parent
+    nil
+  end
+
+  def cover_image_file_type
+    return if cover_image.content_type.in?(COVER_IMAGE_TYPES)
+
+    errors.add(:cover_image, I18n.t("coverable.errors.invalid_type"))
+  end
+
+  def cover_image_file_size
+    return if cover_image.byte_size <= MAX_COVER_BYTES
+
+    errors.add(:cover_image, I18n.t("coverable.errors.too_large"))
+  end
+end

backend/app/models/match.rb

@@ -1,4 +1,6 @@
 class Match < ApplicationRecord
+  include Coverable
+
   belongs_to :team
   has_many :stream_sessions, dependent: :destroy
 
@@ -174,4 +176,8 @@ class Match < ApplicationRecord
   rescue ArgumentError => e
     errors.add(:scoring_rules, e.message)
   end
+
+  def cover_parent
+    nil
+  end
 end

backend/app/models/plan.rb

@@ -84,6 +84,10 @@ class Plan < ApplicationRecord
     feature("youtube_enabled") == true
   end
 
+  def custom_cover_enabled?
+    feature("custom_cover") == true
+  end
+
   def premium?
     slug.in?(PREMIUM_SLUGS)
   end

backend/app/models/recording.rb

@@ -2,6 +2,8 @@ class Recording < ApplicationRecord
   STATUSES = %w[processing ready expired failed].freeze
   PRIVACY_STATUSES = %w[public unlisted].freeze
   STORAGE_BACKENDS = %w[local s3].freeze
+  STORAGE_POLICIES = %w[temporary retained none].freeze
+  REPLAY_SOURCES = %w[youtube matchlivetv none].freeze
 
   belongs_to :stream_session
   belongs_to :team
@@ -9,6 +11,7 @@ class Recording < ApplicationRecord
   validates :status, inclusion: { in: STATUSES }
   validates :privacy_status, inclusion: { in: PRIVACY_STATUSES }
   validates :storage_backend, inclusion: { in: STORAGE_BACKENDS }
+  validates :storage_policy, inclusion: { in: STORAGE_POLICIES }
 
   scope :not_deleted, -> { where(deleted_at: nil) }
   scope :ready, lambda {
@@ -23,7 +26,16 @@ class Recording < ApplicationRecord
     ready.where(expires_at: ..days.days.from_now)
   }
   scope :expired_pending_purge, lambda {
-    not_deleted.where(status: %w[ready failed]).where("expires_at IS NOT NULL AND expires_at <= ?", Time.current)
+    not_deleted
+      .where(storage_policy: "retained")
+      .where(status: %w[ready failed])
+      .where("expires_at IS NOT NULL AND expires_at <= ?", Time.current)
+  }
+  scope :temporary_media_pending_purge, lambda {
+    not_deleted
+      .where(storage_policy: "temporary")
+      .where(local_media_purged_at: nil)
+      .where("temp_expires_at IS NOT NULL AND temp_expires_at <= ?", Time.current)
   }
   scope :search_replays, lambda { |query|
     q = query.to_s.strip
@@ -46,19 +58,30 @@ class Recording < ApplicationRecord
   end
 
   def playback_stream_url
-    return nil unless ready? && stream_session_id.present?
+    return nil unless ready? && storage_key.present? && stream_session_id.present?
 
     "#{MatchLiveTv.app_public_url.chomp('/')}/replay/#{stream_session_id}/stream"
   end
 
   def thumbnail_url
+    return youtube_thumbnail_url if thumbnail_storage_key.blank? && youtube_video_id.present?
     return nil unless thumbnail_storage_key.present? && stream_session_id.present?
 
     "#{MatchLiveTv.app_public_url.chomp('/')}/replay/#{stream_session_id}/thumbnail"
   end
 
+  def youtube_thumbnail_url
+    return nil if youtube_video_id.blank?
+    return nil if youtube_video_id.to_s.start_with?("mock_")
+
+    meta_url = metadata.is_a?(Hash) ? metadata.dig("youtube", "thumbnail_url") : nil
+    return meta_url if meta_url.present?
+
+    "https://i.ytimg.com/vi/#{youtube_video_id}/hqdefault.jpg"
+  end
+
   def download_api_path
-    return nil unless ready?
+    return nil unless ready? && storage_key.present?
 
     "/api/v1/recordings/#{id}/download"
   end
@@ -70,6 +93,30 @@ class Recording < ApplicationRecord
     "https://www.youtube.com/watch?v=#{youtube_video_id}"
   end
 
+  def temporary_storage?
+    storage_policy == "temporary"
+  end
+
+  def retained_storage?
+    storage_policy == "retained"
+  end
+
+  def local_media_purged?
+    local_media_purged_at.present?
+  end
+
+  # Sorgente fisica del player in archivio (non lo storage policy).
+  def replay_source
+    return "youtube" if youtube_watch_url.present? || (ready? && youtube_video_id.present?)
+    return "matchlivetv" if ready? && storage_key.present?
+
+    "none"
+  end
+
+  def available_in_archive?
+    ready? && (youtube_watch_url.present? || youtube_video_id.present? || storage_key.present?)
+  end
+
   def ready?
     status == "ready" && !deleted? && (expires_at.nil? || expires_at.future?)
   end
@@ -154,7 +201,7 @@ class Recording < ApplicationRecord
   end
 
   def playable_on_site?
-    ready? && storage_key.present?
+    available_in_archive?
   end
 
   def days_until_expiry

backend/app/models/stream_node.rb

@@ -35,4 +35,20 @@ class StreamNode < ApplicationRecord
   def allocatable?
     status == "ready" && free_slots.positive?
   end
+
+  # Agent ffmpeg sul CPX (cloud-init :9100). Home Sidekiq lo chiama senza worker Docker per nodo.
+  def relay_agent_url
+    return unless role == "cloud"
+
+    ip = (metadata || {})["public_ip"].presence
+    if ip.blank?
+      host = URI.parse(api_base_url.to_s).host
+      ip = host if host.present? && host != "localhost"
+    end
+    return if ip.blank? || ip == "127.0.0.1"
+
+    "http://#{ip}:#{ENV.fetch("STREAM_NODE_AGENT_PORT", "9100")}"
+  rescue URI::InvalidURIError
+    nil
+  end
 end

backend/app/models/stream_session.rb

@@ -1,7 +1,8 @@
 class StreamSession < ApplicationRecord
   include AASM
 
-  PLATFORMS = %w[matchlivetv youtube facebook twitch].freeze
+  LIVE_PLATFORMS = %w[matchlivetv youtube].freeze
+  PLATFORMS = (LIVE_PLATFORMS + %w[facebook twitch]).freeze
   STATUSES = %w[idle connecting live reconnecting paused ended error].freeze
   PRIVACY_STATUSES = %w[public unlisted private].freeze
 
@@ -10,6 +11,7 @@ class StreamSession < ApplicationRecord
   belongs_to :stream_node, optional: true
   has_many :stream_events, dependent: :destroy
   has_one :score_state, dependent: :destroy
+  has_one :recording
   has_many :device_states, dependent: :destroy
 
   validates :platform, inclusion: { in: PLATFORMS }
@@ -19,6 +21,7 @@ class StreamSession < ApplicationRecord
 
   before_validation :normalize_privacy_status
   before_validation :ensure_publish_token, on: :create
+  before_validation :snapshot_ingest_from_node, if: -> { stream_node.present? }
 
   scope :broadcasting, -> { where(status: %w[live connecting reconnecting paused]) }
   scope :publicly_listed, -> { where(privacy_status: "public") }
@@ -73,6 +76,14 @@ class StreamSession < ApplicationRecord
     end
   end
 
+  def ingest_slug_display
+    stream_node&.slug.presence || ingest_slug
+  end
+
+  def ingest_role_display
+    stream_node&.role.presence || ingest_role
+  end
+
   def rtmp_ingest_url
     # RootEncoder richiede rtmp://host:port/app/stream (due segmenti).
     # MediaMTX path = live/match_{uuid} (no ?token= nel path).
@@ -207,6 +218,11 @@ class StreamSession < ApplicationRecord
     self.privacy_status = "unlisted" if privacy_status == "private"
   end
 
+  def snapshot_ingest_from_node
+    self.ingest_slug = stream_node.slug
+    self.ingest_role = stream_node.role
+  end
+
   def record_ended_timestamps!
     now = Time.current
     update!(ended_at: now) if ended_at.nil?

backend/app/models/subscription.rb

@@ -35,4 +35,8 @@ class Subscription < ApplicationRecord
   def admin_comped?
     admin_comped
   end
+
+  def bank_transfer?
+    premium? && stripe_subscription_id.blank? && !admin_comped? && current_period_end.present?
+  end
 end

backend/app/models/team.rb

@@ -1,5 +1,6 @@
 class Team < ApplicationRecord
   include Brandable
+  include Coverable
 
   belongs_to :club
   has_many :user_teams, dependent: :destroy
@@ -99,6 +100,10 @@ class Team < ApplicationRecord
     club
   end
 
+  def cover_parent
+    club
+  end
+
   def assign_slug
     self.slug = Teams::GenerateSlug.call(self) if slug.blank?
   end

backend/app/models/youtube_credential.rb

@@ -4,19 +4,33 @@ class YoutubeCredential < ApplicationRecord
   attr_encrypted :access_token,
     key: :encryption_key,
     attribute: "access_token_encrypted",
-    mode: :single_iv_salt
+    mode: :single_iv_and_salt,
+    algorithm: "aes-256-cbc",
+    iv: :encryption_iv
   attr_encrypted :refresh_token,
     key: :encryption_key,
     attribute: "refresh_token_encrypted",
-    mode: :single_iv_salt
+    mode: :single_iv_and_salt,
+    algorithm: "aes-256-cbc",
+    iv: :encryption_iv
 
   def expired?
     expires_at.present? && expires_at < Time.current
   end
 
+  def usable?
+    refresh_token.present?
+  rescue ArgumentError, OpenSSL::Cipher::CipherError, NoMethodError
+    false
+  end
+
   private
 
   def encryption_key
     Rails.application.secret_key_base[0, 32]
   end
+
+  def encryption_iv
+    encryption_key[0, 16]
+  end
 end

backend/app/services/analytics/aggregate.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+module Analytics
+  class Aggregate
+    BATCH = 500
+    UPSERT_RETRIES = 3
+
+    def call
+      loop do
+        ids = AnalyticsEvent.order(:occurred_at).limit(BATCH).pluck(:id)
+        break if ids.empty?
+
+        events = AnalyticsEvent.where(id: ids).to_a
+        apply_points(events.select { |e| e.event_type == "click" }, :click_count)
+        apply_points(events.select { |e| e.event_type == "move" }, :move_count)
+        apply_stats(events.select { |e| %w[pageview scroll].include?(e.event_type) })
+        AnalyticsEvent.where(id: ids).delete_all
+      end
+    end
+
+    def purge_old!(retention: 30.days)
+      AnalyticsEvent.where("occurred_at < ?", retention.ago).delete_all
+      AnalyticsPageCell.where("day < ?", retention.ago.to_date).delete_all
+      AnalyticsPageStat.where("day < ?", retention.ago.to_date).delete_all
+      AnalyticsPageSnapshot.where("captured_at < ?", retention.ago).find_each do |snap|
+        snap.image.purge if snap.image.attached?
+        snap.destroy!
+      end
+    end
+
+    private
+
+    def apply_points(events, counter_attr)
+      return if events.empty?
+
+      grid = AnalyticsPageCell::GRID_SIZE
+      grouped = Hash.new(0)
+      events.each do |e|
+        next if e.x_pct.nil? || e.y_pct.nil?
+
+        cell_x = [[(e.x_pct.to_f / 100 * grid).floor, grid - 1].min, 0].max
+        cell_y = [[(e.y_pct.to_f / 100 * grid).floor, grid - 1].min, 0].max
+        key = [e.occurred_at.in_time_zone.to_date, e.page_path, e.device, cell_x, cell_y]
+        grouped[key] += e.weight.to_i.clamp(1, 500)
+      end
+
+      now = Time.current
+      grouped.each do |(day, page_path, device, cell_x, cell_y), count|
+        with_unique_retry do
+          cell = AnalyticsPageCell.find_or_initialize_by(
+            day: day, page_path: page_path, device: device, cell_x: cell_x, cell_y: cell_y
+          )
+          cell[counter_attr] = cell[counter_attr].to_i + count
+          cell.created_at ||= now
+          cell.updated_at = now
+          cell.save!
+        end
+      end
+    end
+
+    def apply_stats(events)
+      return if events.empty?
+
+      grouped = {}
+      events.each do |e|
+        day = e.occurred_at.in_time_zone.to_date
+        key = [day, e.page_path, e.device]
+        bucket = grouped[key] ||= { pageviews: 0, scroll_samples: 0, scroll_sum: 0, max_scroll: 0 }
+        case e.event_type
+        when "pageview"
+          bucket[:pageviews] += e.weight.to_i.clamp(1, 500)
+        when "scroll"
+          pct = e.scroll_pct.to_f.round
+          bucket[:scroll_samples] += 1
+          bucket[:scroll_sum] += pct
+          bucket[:max_scroll] = [bucket[:max_scroll], pct].max
+        end
+      end
+
+      now = Time.current
+      grouped.each do |(day, page_path, device), vals|
+        with_unique_retry do
+          stat = AnalyticsPageStat.find_or_initialize_by(day: day, page_path: page_path, device: device)
+          stat.pageview_count = stat.pageview_count.to_i + vals[:pageviews]
+          stat.scroll_samples = stat.scroll_samples.to_i + vals[:scroll_samples]
+          stat.scroll_sum_pct = stat.scroll_sum_pct.to_i + vals[:scroll_sum]
+          stat.max_scroll_pct = [stat.max_scroll_pct.to_i, vals[:max_scroll]].max
+          stat.created_at ||= now
+          stat.updated_at = now
+          stat.save!
+        end
+      end
+    end
+
+    def with_unique_retry
+      attempts = 0
+      begin
+        attempts += 1
+        yield
+      rescue ActiveRecord::RecordNotUnique
+        raise if attempts >= UPSERT_RETRIES
+
+        retry
+      end
+    end
+  end
+end

backend/app/services/analytics/ingest.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+module Analytics
+  class Ingest
+    MAX_BATCH = 80
+    RATE_LIMIT_PER_MINUTE = 90
+
+    Result = Struct.new(:accepted, :rejected, :rate_limited, keyword_init: true)
+
+    def initialize(events:, remote_ip:)
+      @events = Array(events)
+      @remote_ip = remote_ip.to_s.presence || "unknown"
+    end
+
+    def call
+      return Result.new(accepted: 0, rejected: 0, rate_limited: true) if rate_limited?
+
+      slice = @events.first(MAX_BATCH)
+      accepted = 0
+      rejected = 0
+      rows = []
+
+      slice.each do |raw|
+        attrs = build_attrs(raw)
+        if attrs
+          rows << attrs
+          accepted += 1
+        else
+          rejected += 1
+        end
+      end
+
+      AnalyticsEvent.insert_all(rows) if rows.any?
+      if rows.any?
+        begin
+          Analytics::Aggregate.new.call
+        rescue ActiveRecord::RecordNotUnique => e
+          # Dopo i retry interni: non far fallire la richiesta analytics.
+          Rails.logger.warn("[analytics] aggregate race after retries, enqueue job: #{e.message}")
+          Analytics::AggregateJob.perform_later
+        end
+      end
+
+      Result.new(accepted: accepted, rejected: rejected + (@events.size - slice.size), rate_limited: false)
+    end
+
+    private
+
+    def rate_limited?
+      key = "analytics:ingest:#{@remote_ip}"
+      redis = Redis.new(url: ENV.fetch("REDIS_URL", "redis://localhost:6379/0"))
+      count = redis.incr(key)
+      redis.expire(key, 60) if count == 1
+      count > RATE_LIMIT_PER_MINUTE
+    rescue StandardError => e
+      Rails.logger.warn("[analytics] rate limit unavailable: #{e.class}")
+      false
+    end
+
+    def build_attrs(raw)
+      data = raw.is_a?(Hash) ? raw.with_indifferent_access : {}
+      event_type = data[:type].to_s.presence || data[:event_type].to_s
+      return nil unless AnalyticsEvent::EVENT_TYPES.include?(event_type)
+
+      device = data[:device].to_s
+      return nil unless AnalyticsEvent::DEVICES.include?(device)
+
+      page_path = PathNormalizer.normalize(data[:path] || data[:page_path])
+      return nil if PathNormalizer.excluded?(page_path)
+      return nil if page_path.length > 200
+
+      occurred_at = parse_time(data[:ts] || data[:occurred_at]) || Time.current
+      weight = data[:n].presence || data[:weight].presence || 1
+      weight = Integer(weight)
+      weight = 1 if weight < 1
+      weight = 500 if weight > 500
+
+      attrs = {
+        page_path: page_path,
+        device: device,
+        event_type: event_type,
+        occurred_at: occurred_at,
+        weight: weight,
+        x_pct: nil,
+        y_pct: nil,
+        scroll_pct: nil,
+        created_at: Time.current,
+        updated_at: Time.current
+      }
+
+      case event_type
+      when "click", "move"
+        x = clamp_pct(data[:x] || data[:x_pct])
+        y = clamp_pct(data[:y] || data[:y_pct])
+        return nil if x.nil? || y.nil?
+
+        attrs[:x_pct] = x
+        attrs[:y_pct] = y
+      when "scroll"
+        scroll = clamp_pct(data[:scroll] || data[:scroll_pct])
+        return nil if scroll.nil?
+
+        attrs[:scroll_pct] = scroll
+      when "pageview"
+        # no extra fields
+      end
+
+      attrs
+    rescue ArgumentError, TypeError
+      nil
+    end
+
+    def clamp_pct(value)
+      return nil if value.nil?
+
+      n = Float(value)
+      return nil if n.nan? || n.infinite?
+      return nil if n.negative? || n > 100
+
+      n.round(2)
+    rescue ArgumentError, TypeError
+      nil
+    end
+
+    def parse_time(value)
+      return value if value.is_a?(Time) || value.is_a?(ActiveSupport::TimeWithZone)
+      return Time.zone.at(value.to_i / 1000.0) if value.is_a?(Numeric) || value.to_s.match?(/\A\d{10,13}\z/)
+
+      Time.zone.parse(value.to_s)
+    rescue ArgumentError, TypeError
+      nil
+    end
+  end
+end

backend/app/services/analytics/path_normalizer.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Analytics
+  class PathNormalizer
+    UUID_RE = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/i
+    NUMERIC_RE = /\A\d{6,}\z/
+    TOKENISH_RE = /\A[A-Za-z0-9_\-]{22,}\z/
+
+    EXCLUDED_PREFIXES = %w[/admin /regia /analytics /cable /api /webhooks /internal].freeze
+
+    class << self
+      def normalize(raw_path)
+        path = raw_path.to_s.split("?", 2).first.to_s
+        path = "/" if path.blank?
+        path = "/#{path}" unless path.start_with?("/")
+        path = path.gsub(%r{/{2,}}, "/").chomp("/")
+        path = "/" if path.blank?
+
+        parts = path.split("/").map do |segment|
+          next segment if segment.blank?
+          next ":id" if UUID_RE.match?(segment)
+          next ":id" if NUMERIC_RE.match?(segment)
+          next ":token" if TOKENISH_RE.match?(segment) && segment.match?(/[A-Z]/)
+
+          segment
+        end
+        normalized = parts.join("/")
+        normalized = "/" if normalized.blank?
+        normalized
+      end
+
+      def excluded?(raw_or_normalized)
+        path = normalize(raw_or_normalized)
+        return true if EXCLUDED_PREFIXES.any? { |p| path == p || path.start_with?("#{p}/") }
+        return true if path.match?(%r{\A/live/[^/]+})
+        return true if path.match?(%r{\A/replay/[^/]+})
+
+        false
+      end
+    end
+  end
+end

backend/app/services/analytics/snapshot_ingest.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module Analytics
+  class SnapshotIngest
+    MAX_BYTES = 1_800_000
+    MIN_REFRESH = 12.hours
+    RATE_LIMIT_PER_HOUR = 20
+
+    Result = Struct.new(:ok, :skipped, :rate_limited, :error, keyword_init: true)
+
+    def initialize(path:, device:, width:, height:, image:, remote_ip:)
+      @path = path
+      @device = device.to_s
+      @width = width
+      @height = height
+      @image = image
+      @remote_ip = remote_ip.to_s.presence || "unknown"
+    end
+
+    def call
+      return Result.new(ok: false, skipped: false, rate_limited: true) if rate_limited?
+
+      page_path = PathNormalizer.normalize(@path)
+      return Result.new(ok: false, skipped: true, error: "path") if PathNormalizer.excluded?(page_path)
+      return Result.new(ok: false, skipped: true, error: "device") unless AnalyticsEvent::DEVICES.include?(@device)
+      return Result.new(ok: false, skipped: true, error: "image") unless valid_image?
+
+      width = Integer(@width)
+      height = Integer(@height)
+      return Result.new(ok: false, skipped: true, error: "size") if width < 200 || height < 200 || width > 6000 || height > 20000
+
+      snap = AnalyticsPageSnapshot.find_or_initialize_by(page_path: page_path, device: @device)
+      if snap.persisted? && snap.captured_at.present? && snap.captured_at > MIN_REFRESH.ago && snap.image.attached?
+        return Result.new(ok: true, skipped: true)
+      end
+
+      snap.width = width
+      snap.height = height
+      snap.captured_at = Time.current
+      snap.save!
+      snap.image.purge if snap.image.attached?
+      snap.image.attach(
+        io: image_io,
+        filename: "analytics-#{Digest::SHA1.hexdigest(page_path)[0, 12]}-#{@device}.jpg",
+        content_type: "image/jpeg"
+      )
+
+      Result.new(ok: true, skipped: false)
+    rescue ArgumentError, TypeError, ActiveRecord::RecordInvalid => e
+      Result.new(ok: false, skipped: true, error: e.class.name)
+    end
+
+    private
+
+    def rate_limited?
+      key = "analytics:snapshot:#{@remote_ip}"
+      redis = Redis.new(url: ENV.fetch("REDIS_URL", "redis://localhost:6379/0"))
+      count = redis.incr(key)
+      redis.expire(key, 3600) if count == 1
+      count > RATE_LIMIT_PER_HOUR
+    rescue StandardError => e
+      Rails.logger.warn("[analytics] snapshot rate limit unavailable: #{e.class}")
+      false
+    end
+
+    def valid_image?
+      return false if @image.blank?
+      return false unless @image.respond_to?(:tempfile) || @image.respond_to?(:read)
+      return false if @image.respond_to?(:size) && @image.size.to_i > MAX_BYTES
+
+      content_type = @image.content_type.to_s if @image.respond_to?(:content_type)
+      content_type.blank? || content_type.start_with?("image/")
+    end
+
+    def image_io
+      if @image.respond_to?(:tempfile)
+        @image.tempfile.rewind
+        @image.tempfile
+      else
+        StringIO.new(@image.read)
+      end
+    end
+  end
+end

backend/app/services/billing/admin_comped_subscription.rb

@@ -23,6 +23,7 @@ module Billing
       raise Error, "Piano non valido" unless @plan_slug.in?(VALID_PLANS)
 
       release_stripe_schedule!
+      cancel_awaiting_transfers!
 
       AssignPlan.call(
         club: @club,
@@ -97,5 +98,9 @@ module Billing
     ensure
       sub&.update!(stripe_schedule_id: nil, pending_plan_id: nil, pending_billing_interval: nil)
     end
+
+    def cancel_awaiting_transfers!
+      @club.billing_transfer_orders.awaiting_payment.find_each(&:cancel!)
+    end
   end
 end

backend/app/services/billing/attach_payment_invoice.rb

@@ -2,13 +2,14 @@ module Billing
   class AttachPaymentInvoice
     class Error < StandardError; end
 
-    def self.call(payment:, pdf:)
-      new(payment: payment, pdf: pdf).call
+    def self.call(payment:, pdf:, mailer_action: :invoice_pdf)
+      new(payment: payment, pdf: pdf, mailer_action: mailer_action).call
     end
 
-    def initialize(payment:, pdf:)
+    def initialize(payment:, pdf:, mailer_action: :invoice_pdf)
       @payment = payment
       @pdf = pdf
+      @mailer_action = mailer_action
     end
 
     def call
@@ -17,7 +18,7 @@ module Billing
 
       club = @payment.club
       invoice = @payment.invoice || build_invoice!(club)
-      IssueInvoice.call(invoice: invoice, pdf: @pdf)
+      IssueInvoice.call(invoice: invoice, pdf: @pdf, mailer_action: @mailer_action)
     end
 
     private

backend/app/services/billing/confirm_bank_transfer.rb

@@ -0,0 +1,102 @@
+module Billing
+  class ConfirmBankTransfer
+    class Error < StandardError; end
+
+    def self.call(order:, admin:, pdf: nil)
+      new(order: order, admin: admin, pdf: pdf).call
+    end
+
+    def initialize(order:, admin:, pdf: nil)
+      @order = order
+      @admin = admin
+      @pdf = pdf
+    end
+
+    def call
+      raise Error, "Bonifico già gestito" unless @order.awaiting_payment?
+
+      club = @order.club
+      payment = @order.billing_payment
+      raise Error, "Pagamento collegato mancante" if payment.blank?
+
+      ApplicationRecord.transaction do
+        cancel_existing_stripe!(club.subscription)
+
+        period_start, period_end = period_bounds(club.subscription)
+        AssignPlan.call(
+          club: club,
+          plan_slug: @order.plan_slug,
+          status: "active",
+          stripe_attrs: {
+            stripe_subscription_id: nil,
+            stripe_schedule_id: nil,
+            pending_plan_id: nil,
+            pending_billing_interval: nil,
+            billing_interval: @order.billing_interval,
+            current_period_start: period_start,
+            current_period_end: period_end,
+            cancel_at_period_end: true,
+            admin_comped: false,
+            admin_comped_reason: nil,
+            admin_comped_at: nil,
+            admin_comped_by_id: nil
+          }
+        )
+
+        payment.update!(status: "paid", paid_at: Time.current, provider: "bank_transfer")
+        @order.update!(
+          status: "paid",
+          confirmed_by_admin: @admin,
+          confirmed_at: Time.current
+        )
+      end
+
+      deliver_activation!(payment)
+      @order.reload
+    end
+
+    private
+
+    def period_bounds(subscription)
+      start_at = Time.current
+      if subscription&.premium? &&
+         !subscription.admin_comped? &&
+         subscription.plan.slug == @order.plan_slug &&
+         subscription.current_period_end.present? &&
+         subscription.current_period_end > Time.current
+        start_at = subscription.current_period_end
+      end
+
+      end_at = @order.billing_interval == "yearly" ? start_at.advance(years: 1) : start_at.advance(months: 1)
+      [start_at, end_at]
+    end
+
+    def cancel_existing_stripe!(subscription)
+      return if subscription.blank? || subscription.stripe_subscription_id.blank?
+      return unless MatchLiveTv.stripe_enabled?
+
+      ::Stripe::Subscription.cancel(subscription.stripe_subscription_id)
+    rescue ::Stripe::InvalidRequestError => e
+      Rails.logger.warn("[BankTransfer] stripe cancel club=#{subscription.club_id} #{e.message}")
+    end
+
+    def deliver_activation!(payment)
+      if pdf_present?
+        AttachPaymentInvoice.call(
+          payment: payment.reload,
+          pdf: @pdf,
+          mailer_action: :plan_activated_with_invoice
+        )
+      else
+        MatchLiveTv.deliver_mail(BankTransferMailer.with(order: @order.reload).plan_activated)
+      end
+    end
+
+    def pdf_present?
+      return false if @pdf.blank?
+      return @pdf.present? unless @pdf.respond_to?(:tempfile)
+
+      @pdf.original_filename.present?
+    end
+  end
+end

backend/app/services/billing/euro_amount.rb

@@ -0,0 +1,26 @@
+module Billing
+  class EuroAmount
+    class Error < StandardError; end
+
+    def self.to_cents(value)
+      raw = value.to_s.strip
+      raise Error, "Indica l'importo in euro" if raw.blank?
+
+      normalized = raw.gsub(/\s+/, "")
+      if normalized.match?(/\A\d{1,3}(\.\d{3})*,\d{1,2}\z/)
+        normalized = normalized.gsub(".", "").tr(",", ".")
+      elsif normalized.match?(/\A\d+,\d{1,2}\z/)
+        normalized = normalized.tr(",", ".")
+      elsif normalized.match?(/\A\d{1,3}(,\d{3})*\.\d{1,2}\z/)
+        normalized = normalized.gsub(",", "")
+      end
+
+      raise Error, "Importo non valido" unless normalized.match?(/\A\d+(\.\d{1,2})?\z/)
+
+      cents = (BigDecimal(normalized) * 100).round
+      raise Error, "L'importo deve essere maggiore di zero" unless cents.positive?
+
+      cents.to_i
+    end
+  end
+end

backend/app/services/billing/issue_invoice.rb

@@ -2,13 +2,17 @@ module Billing
   class IssueInvoice
     class Error < StandardError; end
 
-    def self.call(invoice:, pdf: nil)
-      new(invoice: invoice, pdf: pdf).call
+    MAILER_ACTIONS = %i[invoice_pdf plan_activated_with_invoice].freeze
+
+    def self.call(invoice:, pdf: nil, mailer_action: :invoice_pdf)
+      new(invoice: invoice, pdf: pdf, mailer_action: mailer_action).call
     end
 
-    def initialize(invoice:, pdf: nil)
+    def initialize(invoice:, pdf: nil, mailer_action: :invoice_pdf)
       @invoice = invoice
       @pdf = pdf
+      @mailer_action = mailer_action.to_sym
+      raise Error, "Azione email non valida" unless MAILER_ACTIONS.include?(@mailer_action)
     end
 
     def call
@@ -22,8 +26,10 @@ module Billing
 
       @invoice.update!(status: "issued")
 
-      Billing::InvoiceMailer.with(invoice: @invoice).invoice_pdf.deliver_now
-      @invoice.update!(status: "sent", emailed_at: Time.current)
+      mail = Billing::InvoiceMailer.with(invoice: @invoice).public_send(@mailer_action)
+      if MatchLiveTv.deliver_mail(mail)
+        @invoice.update!(status: "sent", emailed_at: Time.current)
+      end
 
       @invoice
     end

backend/app/services/billing/request_bank_transfer.rb

@@ -0,0 +1,95 @@
+module Billing
+  class RequestBankTransfer
+    class Error < StandardError; end
+
+    PLAN_SLUGS = %w[premium_light premium_full].freeze
+
+    def self.call(club:, user:, plan_slug:, interval:)
+      new(club: club, user: user, plan_slug: plan_slug, interval: interval).call
+    end
+
+    def initialize(club:, user:, plan_slug:, interval:)
+      @club = club
+      @user = user
+      @plan_slug = plan_slug.to_s
+      @interval = interval
+    end
+
+    def call
+      raise Error, "Bonifico non configurato sul server" unless MatchLiveTv.bank_transfer_configured?
+      raise Error, "Piano non valido" unless @plan_slug.in?(PLAN_SLUGS)
+      raise Error, "Completa i dati di fatturazione prima di richiedere il bonifico." unless @club.billing_profile_complete?
+      raise Error, "Il piano è un abbonamento omaggio. Contatta il supporto per passarlo a pagamento." if @club.subscription&.admin_comped?
+
+      @interval = Billing::Stripe::PriceCatalog.normalize_interval(@interval)
+      quote = @club.active_billing_quote
+      amount_cents, kind = resolve_amount(quote)
+
+      existing = @club.billing_transfer_orders.awaiting_payment.first
+      if existing
+        if existing.plan_slug == @plan_slug && existing.billing_interval == @interval && existing.amount_cents == amount_cents
+          return existing
+        end
+
+        existing.cancel!
+      end
+
+      order = nil
+      ApplicationRecord.transaction do
+        payment = @club.billing_payments.create!(
+          provider: "bank_transfer",
+          amount_cents: amount_cents,
+          currency: "eur",
+          status: "pending",
+          plan_slug: @plan_slug,
+          description: payment_description(kind, amount_cents)
+        )
+        order = @club.billing_transfer_orders.create!(
+          billing_club_quote: kind == "commercial_quote" ? quote : nil,
+          billing_payment: payment,
+          plan_slug: @plan_slug,
+          billing_interval: @interval,
+          amount_cents: amount_cents,
+          currency: "eur",
+          kind: kind,
+          status: "awaiting_payment",
+          reference_code: generate_reference_code,
+          requested_by_user: @user
+        )
+      end
+
+      # Le istruzioni (IBAN/causale) le manda a mano l'admin da /admin/billing.
+      Rails.logger.info("[BankTransfer] ordine #{order.reference_code} in attesa, nessuna mail istruzioni")
+      order
+    end
+
+    private
+
+    def resolve_amount(quote)
+      if quote
+        unless quote.matches?(@plan_slug, @interval)
+          raise Error, "Per questa società è attivo un prezzo concordato su #{quote.plan.name} (#{quote.price_label})."
+        end
+
+        return [quote.amount_cents, "commercial_quote"]
+      end
+
+      [Billing::Stripe::PriceCatalog.amount_cents(plan_slug: @plan_slug, interval: @interval), "list_price"]
+    end
+
+    def payment_description(kind, amount_cents)
+      label = Billing::Stripe::PriceCatalog.format_interval_price(amount_cents, @interval)
+      suffix = kind == "commercial_quote" ? "prezzo concordato, bonifico" : "bonifico"
+      "#{Plan[@plan_slug].name} — #{label} (#{suffix})"
+    end
+
+    def generate_reference_code
+      8.times do
+        code = "MLTV-#{SecureRandom.alphanumeric(6).upcase}"
+        return code unless TransferOrder.exists?(reference_code: code)
+      end
+
+      raise Error, "Impossibile generare il riferimento del bonifico"
+    end
+  end
+end

backend/app/services/billing/set_club_quote.rb

@@ -0,0 +1,74 @@
+module Billing
+  class SetClubQuote
+    class Error < StandardError; end
+
+    PLAN_SLUGS = %w[premium_light premium_full].freeze
+
+    def self.upsert(club:, plan_slug:, interval:, amount_euros:, note:, admin:)
+      new(club: club, plan_slug: plan_slug, interval: interval, amount_euros: amount_euros, note: note, admin: admin).upsert
+    end
+
+    def self.revoke(club:, admin:)
+      new(club: club, admin: admin).revoke
+    end
+
+    def initialize(club:, plan_slug: nil, interval: nil, amount_euros: nil, note: nil, admin: nil)
+      @club = club
+      @plan_slug = plan_slug.to_s.presence
+      @interval = interval
+      @amount_euros = amount_euros
+      @note = note.to_s.strip.presence
+      @admin = admin
+    end
+
+    def upsert
+      raise Error, "Piano non valido" unless @plan_slug.in?(PLAN_SLUGS)
+
+      interval = Billing::Stripe::PriceCatalog.normalize_interval(@interval)
+      amount_cents = EuroAmount.to_cents(@amount_euros)
+      quote = @club.billing_quotes.active.first || @club.billing_quotes.build
+
+      ApplicationRecord.transaction do
+        quote.assign_attributes(
+          plan_slug: @plan_slug,
+          billing_interval: interval,
+          amount_cents: amount_cents,
+          currency: "eur",
+          note: @note,
+          active: true,
+          created_by_admin: @admin || quote.created_by_admin
+        )
+        quote.save!
+
+        cancel_incompatible_orders!(quote)
+      end
+
+      quote
+    rescue EuroAmount::Error, ArgumentError => e
+      raise Error, e.message
+    end
+
+    def revoke
+      quote = @club.active_billing_quote
+      raise Error, "Nessun prezzo concordato attivo" if quote.blank?
+
+      ApplicationRecord.transaction do
+        quote.update!(active: false)
+        @club.billing_transfer_orders.awaiting_payment.where(kind: "commercial_quote").find_each(&:cancel!)
+      end
+      quote
+    end
+
+    private
+
+    def cancel_incompatible_orders!(quote)
+      @club.billing_transfer_orders.awaiting_payment.find_each do |order|
+        next if order.plan_slug == quote.plan_slug &&
+                order.billing_interval == quote.billing_interval &&
+                order.amount_cents == quote.amount_cents
+
+        order.cancel!
+      end
+    end
+  end
+end

backend/app/services/billing/stripe/price_catalog.rb

@@ -86,6 +86,24 @@ module Billing
           end
         end
 
+        def catalog_intervals(plan_slug:)
+          INTERVALS.select { |interval| AMOUNTS.dig(plan_slug.to_s, interval, :charge).present? }
+        end
+
+        def amount_cents(plan_slug:, interval:)
+          interval = normalize_interval(interval)
+          cents = charge_cents(plan_slug, interval)
+          raise ArgumentError, "Prezzo listino non disponibile per #{plan_slug} (#{interval})" if cents.blank?
+
+          cents
+        end
+
+        def format_interval_price(cents, interval)
+          return nil if cents.blank?
+
+          I18n.t("billing.prices.#{interval}", amount: format_eur(cents))
+        end
+
         private
 
         def charge_cents(plan_slug, interval)
@@ -96,12 +114,6 @@ module Billing
           AMOUNTS.dig(plan_slug.to_s, interval, :list)
         end
 
-        def format_interval_price(cents, interval)
-          return nil if cents.blank?
-
-          I18n.t("billing.prices.#{interval}", amount: format_eur(cents))
-        end
-
         def price_id_for(plan_slug, interval)
           case [plan_slug, interval]
           when %w[premium_light monthly]

backend/app/services/contacts/submit_inquiry.rb

@@ -0,0 +1,102 @@
+module Contacts
+  class SubmitInquiry
+    TOPICS = %w[commercial support privacy].freeze
+    LIMIT = 5
+    WINDOW = 1.hour
+    NAME_MAX = 120
+    CLUB_MAX = 160
+    MESSAGE_MIN = 10
+    MESSAGE_MAX = 4_000
+
+    Result = Struct.new(:ok, :error, keyword_init: true)
+
+    def self.call(params:, ip:)
+      new(params: params, ip: ip).call
+    end
+
+    def initialize(params:, ip:)
+      @params = params
+      @ip = ip.to_s.presence || "unknown"
+    end
+
+    def call
+      if honeypot_filled?
+        record_attempt
+        return Result.new(ok: true, error: nil)
+      end
+
+      return Result.new(ok: false, error: :throttled) if throttled?
+
+      error = validate
+      return Result.new(ok: false, error: error) if error
+
+      record_attempt
+      deliver
+      Result.new(ok: true, error: nil)
+    end
+
+    private
+
+    def honeypot_filled?
+      @params[:website].to_s.strip.present?
+    end
+
+    def throttled?
+      current_count >= LIMIT
+    end
+
+    def validate
+      return :privacy_required unless @params[:accept_privacy].to_s == "1"
+      return :invalid if name.blank? || name.length > NAME_MAX
+      return :invalid_email if email.blank? || email !~ URI::MailTo::EMAIL_REGEXP
+      return :invalid if club_name.length > CLUB_MAX
+      return :invalid unless TOPICS.include?(topic)
+      return :invalid_message if message.length < MESSAGE_MIN || message.length > MESSAGE_MAX
+
+      nil
+    end
+
+    def deliver
+      mail = ContactMailer.inquiry(
+        name: name,
+        email: email,
+        club_name: club_name,
+        topic: topic,
+        message: message
+      )
+      MatchLiveTv.deliver_mail(mail)
+    end
+
+    def record_attempt
+      Rails.cache.write(cache_key, current_count + 1, expires_in: WINDOW, raw: true)
+    end
+
+    def current_count
+      Rails.cache.read(cache_key, raw: true).to_i
+    end
+
+    def cache_key
+      "contacts:inquiry:#{@ip}"
+    end
+
+    def name
+      @params[:name].to_s.strip
+    end
+
+    def email
+      @params[:email].to_s.strip.downcase
+    end
+
+    def club_name
+      @params[:club_name].to_s.strip
+    end
+
+    def topic
+      @params[:topic].to_s.strip
+    end
+
+    def message
+      @params[:message].to_s.strip
+    end
+  end
+end

backend/app/services/mediamtx/client.rb

@@ -4,6 +4,9 @@ module Mediamtx
   class Client
     class Error < StandardError; end
 
+    CREATE_PATH_RETRIES = -> { ENV.fetch("MEDIAMTX_CREATE_RETRIES", "5").to_i }
+    CREATE_PATH_RETRY_BASE_SECS = -> { ENV.fetch("MEDIAMTX_CREATE_RETRY_BASE_SECS", "0.4").to_f }
+
     def self.for_session(session)
       new(base_url: session.mediamtx_api_base_url)
     end
@@ -19,19 +22,33 @@ module Mediamtx
 
     attr_reader :base_url
 
+    # Health probe for CPX readiness (GET /v3/paths/list).
+    def reachable?(timeout: 2)
+      conn = Faraday.new(url: @base_url) do |f|
+        f.adapter Faraday.default_adapter
+        f.options.open_timeout = timeout
+        f.options.timeout = timeout
+      end
+      response = conn.get("/v3/paths/list")
+      response.success?
+    rescue Faraday::Error
+      false
+    end
+
     def create_path(session)
       path = session.mediamtx_path_name
       # record: false finché non c'è publisher — con alwaysAvailable MediaMTX registrerebbe
-      # solo la slate (schermo nero) in pausa/attesa.
-      # YouTube: niente slate sul path camera (maschera il video al relay ffmpeg).
+      # solo la slate in pausa/attesa. Slate resta accesa anche su YouTube (copertina se l'app cade).
       body = recording_body(session, enabled: false).merge(
         source: "publisher",
         overridePublisher: true
       )
       body[:alwaysAvailable] = true
-      body[:alwaysAvailableFile] = slate_file_path
+      body[:alwaysAvailableFile] = slate_file_path(session)
       # YouTube: telefono → MediaMTX; relay copy verso RTMPS in sidekiq.
-      response = @conn.post("/v3/config/paths/add/#{CGI.escape(path)}", body)
+      response = with_connection_retries("create_path #{path}") do
+        @conn.post("/v3/config/paths/add/#{CGI.escape(path)}", body)
+      end
       unless response.success?
         err = response.body.is_a?(Hash) ? response.body["error"] : response.body
         raise Error, "MediaMTX path create failed: #{response.status} #{err}"
@@ -75,14 +92,55 @@ module Mediamtx
       set_always_available(session, enabled: true)
     end
 
-      # Slate alwaysAvailable: copertina sullo stesso path quando il telefono è offline.
-    # Disattivare quando il publisher è in onda; riattivare in pausa/disconnessione.
+    # Garantisce path config + slate: se MediaMTX ha perso la config (restart → all_others),
+    # in pausa non resterebbe nessuno stream verso HLS/YouTube.
+    def ensure_path_with_slate!(session)
+      path = session.mediamtx_path_name
+      response = @conn.get("/v3/config/paths/get/#{CGI.escape(path)}")
+      missing = response.status == 404 ||
+        (response.body.is_a?(Hash) && response.body["error"].present?)
+
+      if missing
+        forget_always_available(path)
+        begin
+          create_path(session)
+        rescue Error
+          # Path creato in parallelo o già presente: forza solo la slate.
+          forget_always_available(path)
+          set_always_available(session, enabled: true)
+        end
+        return true
+      end
+
+      conf = response.body.is_a?(Hash) ? response.body : {}
+      desired = slate_file_path(session)
+      if conf["alwaysAvailable"] == true && conf["alwaysAvailableFile"].to_s == desired.to_s
+        remember_always_available(path, enabled: true)
+        return true
+      end
+
+      forget_always_available(path)
+      set_always_available(session, enabled: true)
+    end
+
+    # Spegnere record solo se attivo: ogni PATCH path ricarica MediaMTX e distrugge i muxer HLS.
+    def disable_recording_if_active!(session)
+      path = session.mediamtx_path_name
+      response = @conn.get("/v3/config/paths/get/#{CGI.escape(path)}")
+      return true unless response.success?
+      return true unless response.body.is_a?(Hash) && response.body["record"] == true
+
+      set_path_recording(session, enabled: false)
+    end
+
+    # Slate alwaysAvailable: copertina sullo stesso path quando il telefono è offline.
+    # Resta accesa anche con publisher in onda (MediaMTX usa il publisher se presente).
     def set_always_available(session, enabled:)
       path = session.mediamtx_path_name
       return true if always_available_remembered?(path, enabled: enabled)
 
       body = if enabled
-               { alwaysAvailable: true, alwaysAvailableFile: slate_file_path }
+               { alwaysAvailable: true, alwaysAvailableFile: slate_file_path(session) }
              else
                { alwaysAvailable: false }
              end
@@ -121,6 +179,23 @@ module Mediamtx
 
     private
 
+    def with_connection_retries(label)
+      attempts = [CREATE_PATH_RETRIES.call, 1].max
+      base = CREATE_PATH_RETRY_BASE_SECS.call
+      try = 0
+      begin
+        try += 1
+        yield
+      rescue Faraday::ConnectionFailed, Faraday::TimeoutError => e
+        raise if try >= attempts
+
+        sleep_secs = base * (2**(try - 1))
+        Rails.logger.warn("[Mediamtx::Client] #{label} retry #{try}/#{attempts} after #{e.class}: #{e.message} (sleep #{sleep_secs}s)")
+        sleep(sleep_secs)
+        retry
+      end
+    end
+
     def recording_body(session, enabled:)
       ent = session.match.team.entitlements
       can_record = ent.recording_enabled_for_mediamtx?
@@ -174,7 +249,13 @@ module Mediamtx
       SCRIPT
     end
 
-    def slate_file_path
+    def slate_file_path(session)
+      return default_slate_file_path if session.blank?
+
+      Streams::SlateDistributor.slate_path_for_session(session)
+    end
+
+    def default_slate_file_path
       ENV.fetch("MEDIAMTX_SLATE_FILE", "/slates/offline.mp4")
     end
 

backend/app/services/mediamtx/publisher_sync.rb

@@ -19,7 +19,6 @@ module Mediamtx
         if @session.paused?
           # RTMP ancora connesso in pausa: non forzare live/reconnect.
         else
-          enable_live_path_once!(@session)
           if @session.may_go_live?
             @session.go_live!
             @session.reload
@@ -75,27 +74,13 @@ module Mediamtx
       @session.update!(timeout_job_id: job)
     end
 
-    # Compatibilità con webhook / controller.
     def self.schedule_youtube_pipeline!(session, force: false)
       Youtube::LivePipeline.schedule!(session, force: force)
     end
 
-    def enable_live_path_once!(session)
-      return unless session.platform == "youtube"
-
-      key = format("youtube:slate_disabled:%s", session.id)
-      return unless redis.set(key, "1", nx: true, ex: 48.hours.to_i)
-
-      Client.for_session(session).set_always_available(session, enabled: false)
-    rescue Client::Error => e
-      redis.del(format("youtube:slate_disabled:%s", session.id))
-      Rails.logger.warn("[PublisherSync] disable slate session=#{session.id}: #{e.message}")
-    end
-
     def restore_slate_path!(session)
-      return if session.platform == "matchlivetv"
-
-      Client.for_session(session).set_always_available(session, enabled: true)
+      # Anche su matchlivetv: dopo restart MediaMTX la path può cadere su all_others senza slate.
+      Client.for_session(session).ensure_path_with_slate!(session)
     rescue Client::Error => e
       Rails.logger.warn("[PublisherSync] enable slate session=#{session.id}: #{e.message}")
     end
@@ -160,6 +145,14 @@ module Mediamtx
       nil
     end
 
+    def self.remember_recording_off!(session_id)
+      redis = Redis.new(url: ENV.fetch("REDIS_URL", "redis://localhost:6379/0"))
+      redis.set("mediamtx:recording:#{session_id}", "0", ex: 48.hours.to_i)
+      redis.set(format("mediamtx:recording:patched_at:%s", session_id), Time.current.to_i, ex: 48.hours.to_i)
+    rescue Redis::BaseError
+      nil
+    end
+
     def recording_state_key(session_id)
       "mediamtx:recording:#{session_id}"
     end
@@ -183,7 +176,7 @@ module Mediamtx
       key = format("youtube_relay:sched:%s", session.id)
       return unless redis.set(key, "1", nx: true, ex: 10)
 
-      YoutubeRelayEnsureJob.set(queue: Streams::YoutubeRelay::QUEUE).perform_later(session.id)
+      Streams::YoutubeRelay.enqueue_ensure!(session)
     end
 
     def redis

backend/app/services/recordings/clear_temporary_media.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module Recordings
+  # Rimuove solo l'MP4 temporaneo su object storage. Non soft-delete, non tocca YouTube.
+  class ClearTemporaryMedia
+    def initialize(recording, reason: :verified, force: false)
+      @recording = recording
+      @reason = reason
+      @force = force
+    end
+
+    def call
+      unless @recording.temporary_storage?
+        Rails.logger.info(
+          "[Recordings::ClearTemporaryMedia] skip recording=#{@recording.id} not_temporary"
+        )
+        return @recording
+      end
+
+      if @recording.local_media_purged?
+        Rails.logger.info(
+          "[Recordings::ClearTemporaryMedia] already_purged recording=#{@recording.id}"
+        )
+        return @recording
+      end
+
+      unless allowed?
+        Rails.logger.info(
+          "[Recordings::ClearTemporaryMedia] skip recording=#{@recording.id} " \
+          "reason=not_verified_and_not_expired force=#{@force}"
+        )
+        return @recording
+      end
+
+      delete_video_object!
+      @recording.update!(
+        storage_key: nil,
+        byte_size: nil,
+        local_media_purged_at: Time.current
+      )
+
+      Rails.logger.info(
+        "[Recordings::ClearTemporaryMedia] purged recording=#{@recording.id} " \
+        "reason=#{@reason} youtube_verified=#{@recording.youtube_verified_at.present?} " \
+        "youtube_video_id=#{@recording.youtube_video_id.inspect}"
+      )
+      @recording
+    end
+
+    private
+
+    def allowed?
+      return true if @force
+      return true if @recording.youtube_verified_at.present?
+      return true if @recording.temp_expires_at.present? && @recording.temp_expires_at <= Time.current
+
+      false
+    end
+
+    def delete_video_object!
+      key = @recording.storage_key
+      return if key.blank?
+
+      Recordings::Storage.new.delete(key: key)
+    rescue Recordings::Storage::Error => e
+      # File già assente → ok (idempotente)
+      Rails.logger.info(
+        "[Recordings::ClearTemporaryMedia] storage delete recording=#{@recording.id}: #{e.message}"
+      )
+    end
+  end
+end

backend/app/services/recordings/finalize_session.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Recordings
   class FinalizeSession
     def initialize(session)
@@ -5,29 +7,69 @@ module Recordings
     end
 
     def call
-      team = @session.match.team
-      return unless team.entitlements.can_create_recordings?
+      policy = Recordings::StoragePolicy.call(@session)
+      return if policy == Recordings::StoragePolicy::NONE
 
-      retention_days = team.entitlements.recording_retention_days
-      expires_at = retention_days.positive? ? retention_days.days.from_now : nil
+      team = @session.match.team
+      attrs = attributes_for(policy, team)
 
       recording = Recording.find_or_initialize_by(stream_session: @session)
-      recording.assign_attributes(
+      if skip_reinitialize?(recording)
+        Rails.logger.info(
+          "[Recordings::FinalizeSession] skip already-finalized " \
+          "recording=#{recording.id} status=#{recording.status}"
+        )
+        return recording
+      end
+      recording.assign_attributes(attrs)
+      recording.save!
+
+      Rails.logger.info(
+        "[Recordings::FinalizeSession] session=#{@session.id} recording=#{recording.id} " \
+        "storage_policy=#{policy} expires_at=#{recording.expires_at.inspect} " \
+        "temp_expires_at=#{recording.temp_expires_at.inspect}"
+      )
+      recording
+    end
+
+    private
+
+    def skip_reinitialize?(recording)
+      return false unless recording.persisted?
+
+      recording.ready? ||
+        recording.status == "processing" ||
+        recording.storage_key.present?
+    end
+
+    def attributes_for(policy, team)
+      {
         team: team,
         status: "processing",
         title: default_title,
         privacy_status: privacy_from_session,
         storage_path: @session.mediamtx_path_name,
         recorded_at: @session.ended_at || Time.current,
-        expires_at: expires_at,
+        storage_policy: policy,
+        expires_at: archive_expires_at(policy, team),
+        temp_expires_at: temp_expires_at_for(policy),
         error_message: nil,
-        metadata: initial_metadata(team)
-      )
-      recording.save!
-      recording
+        metadata: initial_metadata(policy, team)
+      }
     end
 
-    private
+    def archive_expires_at(policy, team)
+      return nil if policy == Recordings::StoragePolicy::TEMPORARY
+
+      retention_days = team.entitlements.recording_retention_days
+      retention_days.positive? ? retention_days.days.from_now : nil
+    end
+
+    def temp_expires_at_for(policy)
+      return nil unless policy == Recordings::StoragePolicy::TEMPORARY
+
+      MatchLiveTv.youtube_temp_replay_retention_hours.hours.from_now
+    end
 
     def default_title
       match = @session.match
@@ -38,12 +80,13 @@ module Recordings
       @session.privacy_status == "public" ? "public" : "unlisted"
     end
 
-    def initial_metadata(team)
-      ent = team.entitlements
+    def initial_metadata(policy, team)
       {
         "source_platform" => @session.platform,
         "session_privacy" => @session.privacy_status,
-        "auto_publish_youtube" => ent.premium_full? && ent.youtube_enabled? && @session.platform == "youtube",
+        # Re-upload automatico disabilitato: le live YouTube usano VerifyYoutubeReplay.
+        "auto_publish_youtube" => false,
+        "storage_policy" => policy,
         "ai" => {}
       }
     end

backend/app/services/recordings/pull_from_cloud_node.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require "cgi"
+require "fileutils"
+require "net/http"
+require "uri"
+
+module Recordings
+  # Recupera i segmenti MediaMTX dal disco del CPX (agent :9100) verso un tmpdir locale.
+  class PullFromCloudNode
+    class Error < StandardError; end
+
+    def initialize(session)
+      @session = session
+    end
+
+    def applicable?
+      node = @session.stream_node
+      node.present? && node.role == "cloud" && agent_url.present?
+    end
+
+    # @return [String, nil] directory con i file, o nil se il nodo non è cloud / 404
+    def fetch
+      return unless applicable?
+
+      dest = Dir.mktmpdir("mltv-cpx-rec-")
+      uri = recordings_uri
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.open_timeout = 5
+      http.read_timeout = ENV.fetch("STREAM_NODE_RECORDINGS_PULL_TIMEOUT", "180").to_i
+      req = Net::HTTP::Get.new(uri)
+      req["Authorization"] = "Bearer #{agent_secret}" if agent_secret.present?
+      res = http.request(req)
+      if res.is_a?(Net::HTTPNotFound)
+        FileUtils.remove_entry(dest)
+        return nil
+      end
+      unless res.is_a?(Net::HTTPSuccess) && res.body.present?
+        FileUtils.remove_entry(dest)
+        raise Error, "agent GET recordings HTTP #{res.code} #{res.body.to_s.truncate(200)}"
+      end
+
+      tar_path = File.join(dest, "recordings.tar.gz")
+      File.binwrite(tar_path, res.body)
+      unpack!(tar_path, dest)
+      FileUtils.rm_f(tar_path)
+      dest
+    rescue StandardError
+      FileUtils.remove_entry(dest) if dest && Dir.exist?(dest)
+      raise
+    end
+
+    def cleanup_remote!
+      return unless applicable?
+
+      uri = recordings_uri
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.open_timeout = 5
+      http.read_timeout = 15
+      req = Net::HTTP::Delete.new(uri)
+      req["Authorization"] = "Bearer #{agent_secret}" if agent_secret.present?
+      res = http.request(req)
+      return if res.is_a?(Net::HTTPSuccess) || res.is_a?(Net::HTTPNotFound)
+
+      Rails.logger.warn(
+        "[Recordings::PullFromCloudNode] delete HTTP #{res.code} session=#{@session.id}"
+      )
+    rescue StandardError => e
+      Rails.logger.warn("[Recordings::PullFromCloudNode] delete #{e.class}: #{e.message}")
+    end
+
+    private
+
+    def recordings_uri
+      path = @session.mediamtx_path_name.to_s
+      URI.parse("#{agent_url.chomp('/')}/recordings/#{CGI.escape(path)}")
+    end
+
+    def agent_url
+      ENV["STREAM_NODE_RELAY_AGENT_URL"].presence || @session.stream_node&.relay_agent_url
+    end
+
+    def agent_secret
+      ENV["STREAM_NODE_AGENT_SECRET"].presence || "mediamtx_webhook_dev_secret"
+    end
+
+    def unpack!(tar_path, dest)
+      ok = system("tar", "-xzf", tar_path, "-C", dest, out: File::NULL, err: File::NULL)
+      raise Error, "tar extract failed" unless ok
+    end
+  end
+end

backend/app/services/recordings/storage_policy.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Recordings
+  # Decisione centralizzata: temporary (YouTube) | retained (HLS) | none.
+  class StoragePolicy
+    TEMPORARY = "temporary"
+    RETAINED = "retained"
+    NONE = "none"
+    POLICIES = [TEMPORARY, RETAINED, NONE].freeze
+
+    def self.call(session)
+      new(session).call
+    end
+
+    def initialize(session)
+      @session = session
+    end
+
+    def call
+      team = @session.match.team
+      ent = team.entitlements
+
+      return NONE unless ent.can_create_recordings?
+
+      if youtube_destination?
+        TEMPORARY
+      else
+        RETAINED
+      end
+    end
+
+    def youtube_destination?
+      @session.platform.to_s == "youtube"
+    end
+  end
+end

backend/app/services/recordings/upload_from_session.rb

@@ -9,8 +9,9 @@ module Recordings
     def call
       recording = Recording.find_by(stream_session: @session)
       return unless recording&.status == "processing"
+      return if recording.storage_key.present?
 
-      source_files = local_source_files
+      source_files = collect_source_files
       if source_files.empty?
         fail_recording!(recording, "Nessun file di registrazione trovato")
         cleanup_mediamtx_path
@@ -35,23 +36,52 @@ module Recordings
         error_message: nil
       )
 
+      Rails.logger.info(
+        "[Recordings::UploadFromSession] ready recording=#{recording.id} " \
+        "storage_policy=#{recording.storage_policy} key=#{storage_key} bytes=#{byte_size}"
+      )
+
       cleanup_local_sources(source_files, merged_path)
+      cleanup_cloud_pull!
+      cleanup_remote_recordings!
       cleanup_mediamtx_path
       Recordings::PostProcessJob.perform_async(recording.id)
       recording
-    rescue Error, Recordings::Storage::Error => e
+    rescue Error, Recordings::Storage::Error, Recordings::PullFromCloudNode::Error => e
       recording = Recording.find_by(stream_session: @session)
       fail_recording!(recording, e.message) if recording
       raise
     ensure
       FileUtils.rm_f(@merged_temp_path) if @merged_temp_path && File.exist?(@merged_temp_path)
+      cleanup_cloud_pull! unless recording_ready?
     end
 
     private
 
+    def collect_source_files
+      files = local_source_files
+      return files if files.any?
+
+      puller = Recordings::PullFromCloudNode.new(@session)
+      return [] unless puller.applicable?
+
+      3.times do |i|
+        cleanup_cloud_pull!
+        @cloud_pull_dir = puller.fetch
+        files = scan_recording_files(@cloud_pull_dir)
+        return files if files.any?
+
+        sleep 2 if i < 2
+      end
+      []
+    end
+
     def local_source_files
-      base = File.join(MatchLiveTv.recordings_local_path, @session.mediamtx_path_name)
-      return [] unless Dir.exist?(base)
+      scan_recording_files(File.join(MatchLiveTv.recordings_local_path, @session.mediamtx_path_name))
+    end
+
+    def scan_recording_files(base)
+      return [] if base.blank? || !Dir.exist?(base)
 
       Dir.glob(File.join(base, "**", "*"))
          .select { |path| File.file?(path) && path.match?(/\.(mp4|fmp4|m4s|ts)$/i) }
@@ -83,7 +113,11 @@ module Recordings
     end
 
     def object_key(recording)
-      "teams/#{recording.team_id}/sessions/#{@session.id}/replay.mp4"
+      if recording.temporary_storage?
+        "temporary_replays/teams/#{recording.team_id}/sessions/#{@session.id}/replay.mp4"
+      else
+        "teams/#{recording.team_id}/sessions/#{@session.id}/replay.mp4"
+      end
     end
 
     def cleanup_local_sources(source_files, merged_path)
@@ -100,6 +134,24 @@ module Recordings
       Rails.logger.warn("[Recordings::UploadFromSession] delete_path: #{e.message}")
     end
 
+    def cleanup_cloud_pull!
+      return if @cloud_pull_dir.blank? || !Dir.exist?(@cloud_pull_dir)
+
+      FileUtils.remove_entry(@cloud_pull_dir)
+      @cloud_pull_dir = nil
+    rescue StandardError
+      nil
+    end
+
+    def cleanup_remote_recordings!
+      Recordings::PullFromCloudNode.new(@session).cleanup_remote!
+    end
+
+    def recording_ready?
+      rec = Recording.find_by(stream_session: @session)
+      rec&.status == "ready"
+    end
+
     def fail_recording!(recording, message)
       recording.update!(status: "failed", error_message: message)
       cleanup_mediamtx_path

backend/app/services/recordings/verify_youtube_replay.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+module Recordings
+  # Collega la live YouTube (broadcast_id) al VOD e aggiorna metadata recording.
+  class VerifyYoutubeReplay
+    class Error < StandardError; end
+
+    Result = Struct.new(:status, :message, keyword_init: true) do
+      def ok?
+        status == :ok
+      end
+
+      def retriable?
+        status == :pending
+      end
+    end
+
+    def initialize(recording)
+      @recording = recording
+    end
+
+    def call
+      unless @recording.temporary_storage?
+        return Result.new(status: :skipped, message: "not_temporary")
+      end
+
+      if @recording.youtube_verified_at.present? && @recording.youtube_video_id.present?
+        return Result.new(status: :ok, message: "already_verified")
+      end
+
+      session = @recording.stream_session
+      broadcast_id = session&.youtube_broadcast_id
+      if broadcast_id.blank?
+        Rails.logger.warn(
+          "[Recordings::VerifyYoutubeReplay] missing broadcast_id recording=#{@recording.id}"
+        )
+        return Result.new(status: :failed, message: "missing_broadcast_id")
+      end
+
+      info = Youtube::VodStatus.new(@recording.team, channel: "team").fetch(broadcast_id)
+      unless info.ready
+        Rails.logger.info(
+          "[Recordings::VerifyYoutubeReplay] not_ready recording=#{@recording.id} " \
+          "video=#{broadcast_id} upload_status=#{info.upload_status.inspect}"
+        )
+        return Result.new(status: :pending, message: "vod_not_ready")
+      end
+
+      apply_verified!(info)
+      Rails.logger.info(
+        "[Recordings::VerifyYoutubeReplay] ok recording=#{@recording.id} " \
+        "youtube_video_id=#{info.video_id}"
+      )
+      Result.new(status: :ok, message: "verified")
+    rescue Youtube::VodStatus::Error => e
+      Rails.logger.warn(
+        "[Recordings::VerifyYoutubeReplay] api_error recording=#{@recording.id}: #{e.message}"
+      )
+      Result.new(status: :pending, message: e.message)
+    end
+
+    private
+
+    def apply_verified!(info)
+      meta = @recording.metadata.is_a?(Hash) ? @recording.metadata.deep_dup : {}
+      yt = meta.fetch("youtube", {}).merge(
+        "broadcast_id" => @recording.stream_session.youtube_broadcast_id,
+        "thumbnail_url" => info.thumbnail_url,
+        "privacy_status" => info.privacy_status,
+        "upload_status" => info.upload_status,
+        "verified_via" => "live_broadcast"
+      ).compact
+
+      attrs = {
+        youtube_video_id: info.video_id,
+        youtube_verified_at: Time.current,
+        youtube_published_at: @recording.youtube_published_at || Time.current,
+        metadata: meta.merge("youtube" => yt)
+      }
+      attrs[:duration_secs] = info.duration_secs if info.duration_secs.to_i.positive?
+      attrs[:title] = info.title if info.title.present? && @recording.title.blank?
+
+      @recording.update!(attrs)
+    end
+  end
+end

backend/app/services/sessions/apply_client_info.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module Sessions
+  # Normalizza e applica fingerprint del client (OS, app, device, operatore)
+  # sulla sessione, a create e/o a ogni telemetry.
+  class ApplyClientInfo
+    OS_VALUES = %w[android ios].freeze
+    MAX_LEN = 80
+
+    ATTRS = %i[
+      client_os app_version app_build device_manufacturer device_model os_version carrier
+    ].freeze
+
+    def self.call(session, raw)
+      new(session, raw).call
+    end
+
+    def initialize(session, raw)
+      @session = session
+      @raw = normalize_hash(raw)
+    end
+
+    def call
+      attrs = extract_attrs
+      return @session if attrs.empty?
+
+      @session.assign_attributes(attrs)
+      @session.save! if @session.persisted? && @session.changed?
+      @session
+    end
+
+    private
+
+    def normalize_hash(raw)
+      return {} if raw.blank?
+
+      data = raw.respond_to?(:to_unsafe_h) ? raw.to_unsafe_h : raw
+      data = data.to_h if data.respond_to?(:to_h)
+      data.with_indifferent_access
+    rescue StandardError
+      {}
+    end
+
+    def extract_attrs
+      attrs = {}
+
+      os = @raw[:os].presence || @raw[:client_os].presence
+      os = os.to_s.downcase.strip
+      attrs[:client_os] = os if OS_VALUES.include?(os)
+
+      {
+        app_version: %i[app_version version],
+        app_build: %i[app_build build build_number],
+        device_manufacturer: %i[device_manufacturer manufacturer],
+        device_model: %i[device_model model],
+        os_version: %i[os_version system_version],
+        carrier: %i[carrier network_operator operator]
+      }.each do |column, keys|
+        value = keys.map { |k| @raw[k] }.find(&:present?)
+        next if value.blank?
+
+        attrs[column] = truncate(value.to_s.strip)
+      end
+
+      attrs
+    end
+
+    def truncate(value)
+      value.bytesize <= MAX_LEN ? value : value.byteslice(0, MAX_LEN)
+    end
+  end
+end

backend/app/services/sessions/create.rb

@@ -26,6 +26,7 @@ module Sessions
         target_fps: @params[:target_fps] || 30,
         status: "idle"
       )
+      Sessions::ApplyClientInfo.call(session, @params[:client])
 
       youtube_channel = nil
       if session.platform == "youtube"
@@ -37,6 +38,8 @@ module Sessions
         session.stream_node = Streams::NodeRegistry.allocate!
         session.save!
         Scoring::Engine.ensure_score_for(session)
+        Streams::CoverSlateEnsurer.ensure_for!(@match)
+        Streams::SlateDistributor.ensure_for!(session)
         Mediamtx::Client.for_session(session).create_path(session)
         log_event(
           session,
@@ -44,22 +47,56 @@ module Sessions
           {
             created: true,
             platform: session.platform,
-            stream_node: session.stream_node&.slug
-          }
+            stream_node: session.stream_node&.slug,
+            client_os: session.client_os,
+            app_version: session.app_version,
+            device_model: session.device_model
+          }.compact
         )
       end
 
+      kick_autoscaler_if_soft_limit!
+
       if session.platform == "youtube"
         YoutubeBroadcastSetupJob.perform_later(session.id, youtube_channel)
       end
 
       session
     rescue Streams::NodeRegistry::NoCapacityError => e
-      raise Teams::EntitlementError.new(e.message, code: "stream_capacity_exhausted")
+      raise_no_capacity!(e)
+    rescue Faraday::ConnectionFailed, Faraday::TimeoutError => e
+      raise Streams::IngestUnavailableError, "Ingest temporaneamente non disponibile (#{e.class})"
+    rescue Mediamtx::Client::Error => e
+      if e.message.to_s.match?(/failed to open|Connection refused|Timeout|timed out/i)
+        raise Streams::IngestUnavailableError, e.message
+      end
+      raise
     end
 
     private
 
+    def raise_no_capacity!(error)
+      if Streams::Autoscaler.enabled?
+        Streams::AutoscalerJob.kick!
+        raise Teams::EntitlementError.new(
+          "Capacità streaming in espansione. Riprova tra poco.",
+          code: "stream_capacity_scaling"
+        )
+      end
+
+      raise Teams::EntitlementError.new(error.message, code: "stream_capacity_exhausted")
+    end
+
+    def kick_autoscaler_if_soft_limit!
+      return unless Streams::Autoscaler.enabled?
+
+      free = Streams::Autoscaler.metrics[:free_slots].to_i
+      return if free > Streams::Autoscaler.soft_free_slots
+
+      Streams::AutoscalerJob.kick!
+    end
+
+
     def assert_youtube_channel!(youtube_channel)
       resolver = Youtube::CredentialResolver.new(@match.team, channel: youtube_channel)
       if resolver.resolve.blank?

backend/app/services/sessions/pause.rb

@@ -7,11 +7,13 @@ module Sessions
     def call
       cancel_timeout_job
       @session.pause! if @session.may_pause?
-      Mediamtx::PublisherSync.forget_recording_state!(@session.id)
       begin
         mtx = Mediamtx::Client.for_session(@session)
-        mtx.set_path_recording(@session, enabled: false)
-        mtx.set_always_available(@session, enabled: true)
+        # Ricrea/riallinea slate prima di spegnere l'RTMP del telefono.
+        mtx.ensure_path_with_slate!(@session)
+        # PATCH recording solo se era attivo (evita kill muxer HLS a ogni pausa).
+        mtx.disable_recording_if_active!(@session)
+        Mediamtx::PublisherSync.remember_recording_off!(@session.id)
       rescue Mediamtx::Client::Error => e
         Rails.logger.warn("[Sessions::Pause] MediaMTX: #{e.message}")
       end

backend/app/services/sessions/stop.rb

@@ -12,7 +12,7 @@ module Sessions
       complete_youtube_broadcast! if @session.youtube_broadcast_id.present?
 
       recording = Recordings::FinalizeSession.new(@session).call
-      Recordings::UploadJob.perform_async(@session.id) if recording
+      Recordings::UploadJob.perform_async(@session.id) if recording&.status == "processing"
       remove_mediamtx_paths!
 
       log_event("ended")

backend/app/services/streams/autoscaler.rb

@@ -136,6 +136,8 @@ module Streams
 
     def reconcile!
       actions = []
+      actions.concat(promote_provisioning_nodes!)
+      actions.concat(reclaim_stuck_provisioning!)
       m = self.class.metrics
 
       if need_capacity?(m) && can_provision?(m)
@@ -170,6 +172,30 @@ module Streams
 
     private
 
+    def promote_provisioning_nodes!
+      actions = []
+      StreamNode.where(status: "provisioning").find_each do |node|
+        next unless Streams::NodeHealth.promote_if_healthy!(node)
+
+        actions << :"ready_#{node.slug}"
+        Rails.logger.info("[Streams::Autoscaler] promoted #{node.slug} to ready")
+      end
+      actions
+    end
+
+    def reclaim_stuck_provisioning!
+      actions = []
+      stuck_after = ENV.fetch("STREAM_NODE_PROVISIONING_STUCK_MINUTES", "15").to_i.minutes.ago
+      StreamNode.where(status: "provisioning").where("created_at < ?", stuck_after).find_each do |node|
+        @provisioner.decommission!(node)
+        actions << :"reclaim_#{node.slug}"
+        Rails.logger.warn("[Streams::Autoscaler] decommissioned stuck provisioning #{node.slug}")
+      rescue NodeProvisioner::BusyError, NodeProvisioner::Error => e
+        Rails.logger.warn("[Streams::Autoscaler] reclaim #{node.slug}: #{e.message}")
+      end
+      actions
+    end
+
     def need_capacity?(m)
       m[:free_slots] <= self.class.soft_free_slots
     end

backend/app/services/streams/cloud_providers/hetzner.rb

@@ -139,11 +139,20 @@ module Streams
       end
 
       def get(path, params = {})
-        response = conn.get(path) do |req|
-          req.headers.update(auth_headers)
-          req.params.update(params)
+        tries = 0
+        begin
+          response = conn.get(path) do |req|
+            req.headers.update(auth_headers)
+            req.params.update(params)
+          end
+          unwrap!(response)
+        rescue Faraday::SSLError, Faraday::ConnectionFailed, Faraday::TimeoutError
+          tries += 1
+          raise if tries >= 5
+
+          sleep 2
+          retry
         end
-        unwrap!(response)
       end
 
       def post(path, body)

backend/app/services/streams/cover_resolver.rb

@@ -0,0 +1,77 @@
+module Streams
+  # Catena effective cover: partita → squadra → società → default Match Live TV.
+  class CoverResolver
+    Result = Struct.new(:record, :source, :cover_url, :slate_local_path, keyword_init: true)
+
+    DEFAULT_COVER_URL = "/images/copertina-canale.png".freeze
+
+    def initialize(match)
+      @match = match
+      @team = match.team
+      @club = @team.club
+      @entitlements = @team.entitlements
+    end
+
+    def effective_cover_url
+      resolve&.cover_url || default_cover_url
+    end
+
+    def cover_source
+      resolve&.source || "default"
+    end
+
+    def resolve
+      return nil unless @entitlements.can_use_custom_cover?
+
+      candidates.each do |record, source|
+        next unless record.cover_image.attached?
+        next unless record.cover_slate.attached?
+
+        path = CoverSlatePaths.local_path_for(record)
+        next if path.blank?
+
+        return Result.new(
+          record: record,
+          source: source,
+          cover_url: blob_path(record.cover_image),
+          slate_local_path: path
+        )
+      end
+
+      nil
+    end
+
+    # Restituisce il record con cover_image nella catena anche se la slate non è ancora su disco.
+    # Usato da CoverSlateEnsurer per sapere cosa generare al go-live.
+    def pending_cover_record
+      return nil unless @entitlements.can_use_custom_cover?
+
+      candidates.each do |record, _source|
+        return record if record.cover_image.attached?
+      end
+      nil
+    end
+
+    def default_cover_url
+      DEFAULT_COVER_URL
+    end
+
+    def default_slate_path
+      ENV.fetch("MEDIAMTX_SLATE_FILE", "/slates/offline.mp4")
+    end
+
+    private
+
+    def candidates
+      [
+        [@match, "match"],
+        [@team, "team"],
+        [@club, "club"]
+      ]
+    end
+
+    def blob_path(attachment)
+      Rails.application.routes.url_helpers.rails_blob_path(attachment, only_path: true)
+    end
+  end
+end

backend/app/services/streams/cover_slate_ensurer.rb

@@ -0,0 +1,39 @@
+module Streams
+  # Garantisce che la slate MP4 esista per il record effettivo della partita (sync al go-live).
+  class CoverSlateEnsurer
+    def self.ensure_for!(match)
+      new(match).ensure!
+    end
+
+    def initialize(match)
+      @match = match
+      @resolver = CoverResolver.new(match)
+    end
+
+    def ensure!
+      record = find_pending_cover_record
+      return unless record
+      return if slate_ready?(record)
+
+      GenerateCoverSlate.call(record)
+    rescue GenerateCoverSlate::Error => e
+      Rails.logger.warn("[CoverSlateEnsurer] match=#{@match.id} #{e.message}")
+      nil
+    end
+
+    private
+
+    # Cerca il record con cover_image nella catena di ereditarietà,
+    # anche se la slate non è ancora pronta (a differenza di resolve che richiede la slate su disco).
+    def find_pending_cover_record
+      @resolver.pending_cover_record
+    end
+
+    def slate_ready?(record)
+      return false unless record.cover_slate.attached?
+
+      path = CoverSlatePaths.local_path_for(record)
+      path.present? && File.exist?(path)
+    end
+  end
+end

backend/app/services/streams/cover_slate_paths.rb

@@ -0,0 +1,35 @@
+module Streams
+  class CoverSlatePaths
+    def self.slates_custom_root
+      ENV.fetch("MEDIAMTX_SLATES_CUSTOM_DIR", "/slates/custom")
+    end
+
+    # ActiveStorage checksum is base64 e può contenere "/", "+", "=" — non usabile come path.
+    def self.safe_digest(checksum)
+      checksum.to_s.tr("+/", "-_").delete("=")
+    end
+
+    def self.filename_for(record)
+      return nil unless record.cover_slate.attached?
+
+      digest = safe_digest(record.cover_slate.blob.checksum)
+      prefix = record.class.name.underscore
+      "#{prefix}-#{record.id}-#{digest}.mp4"
+    end
+
+    def self.expected_path(record)
+      name = filename_for(record)
+      return nil if name.blank?
+
+      File.join(slates_custom_root, name)
+    end
+
+    def self.local_path_for(record)
+      path = expected_path(record)
+      return nil if path.blank?
+      return path if File.exist?(path)
+
+      nil
+    end
+  end
+end

backend/app/services/streams/generate_cover_slate.rb

@@ -0,0 +1,121 @@
+require "open3"
+
+module Streams
+  # Converte cover_image in MP4 slate (H.264 720p + AAC mono), allineato a infra/scripts/generate_slate.sh.
+  class GenerateCoverSlate
+    class Error < StandardError; end
+
+    SLATE_DURATION_SECS = 30
+    VIDEO_FILTER = "scale=1280:720:force_original_aspect_ratio=decrease,pad=1280:720:(ow-iw)/2:(oh-ih)/2:color=0x0a0a0e".freeze
+
+    def self.call(record)
+      new(record).call
+    end
+
+    def initialize(record)
+      @record = record
+    end
+
+    def call
+      return @record unless @record.cover_image.attached?
+
+      @image_temp = download_cover_image
+      @mp4_temp = encode_slate(@image_temp)
+      attach_slate(@mp4_temp)
+      write_to_slates_dir(@mp4_temp)
+      @record
+    rescue Error
+      raise
+    rescue StandardError => e
+      raise Error, e.message
+    ensure
+      cleanup_tempfiles
+    end
+
+    private
+
+    def download_cover_image
+      ext = extension_for(@record.cover_image.content_type)
+      path = temp_path("cover-in", ext)
+      @record.cover_image.blob.open(tmpdir: Dir.tmpdir) do |file|
+        FileUtils.cp(file.path, path)
+      end
+      path
+    end
+
+    def encode_slate(image_path)
+      out = temp_path("cover-slate", ".mp4")
+      cmd = ffmpeg_args(image_path, out)
+      stdout, stderr, status = Open3.capture3(*cmd)
+      unless status.success? && File.exist?(out) && File.size(out).positive?
+        detail = stderr.to_s.strip.presence || stdout.to_s.strip
+        raise Error, "ffmpeg slate failed: #{detail}"
+      end
+
+      out
+    end
+
+    def ffmpeg_args(input, output)
+      [
+        "ffmpeg", "-nostdin", "-hide_banner", "-loglevel", "error",
+        "-loop", "1", "-framerate", "30", "-i", input,
+        "-f", "lavfi", "-i", "anullsrc=r=48000:cl=mono",
+        "-filter:v", VIDEO_FILTER,
+        "-map", "0:v", "-map", "1:a",
+        "-t", SLATE_DURATION_SECS.to_s,
+        "-c:v", "libx264", "-pix_fmt", "yuv420p", "-profile:v", "baseline", "-level", "3.1",
+        "-x264-params", "keyint=30:min-keyint=30:scenecut=0:bframes=0",
+        "-g", "30", "-keyint_min", "30", "-force_key_frames", "expr:gte(t,n_forced*1)",
+        "-preset", "fast",
+        "-c:a", "aac", "-b:a", "128k", "-ac", "1", "-shortest", "-y", output
+      ]
+    end
+
+    def attach_slate(mp4_path)
+      @record.cover_slate.purge if @record.cover_slate.attached?
+      File.open(mp4_path, "rb") do |io|
+        @record.cover_slate.attach(
+          io: io,
+          filename: slate_filename,
+          content_type: "video/mp4"
+        )
+      end
+      @record.reload
+    end
+
+    def write_to_slates_dir(mp4_path)
+      dest = CoverSlatePaths.expected_path(@record)
+      return unless dest
+
+      FileUtils.mkdir_p(File.dirname(dest))
+      FileUtils.cp(mp4_path, dest)
+    rescue Errno::EACCES, Errno::EROFS => e
+      Rails.logger.info("[GenerateCoverSlate] skip disk copy #{dest}: #{e.class}")
+    end
+
+    def slate_filename
+      "#{@record.class.name.underscore}-#{@record.id}.mp4"
+    end
+
+    def extension_for(content_type)
+      case content_type
+      when "image/png" then ".png"
+      when "image/webp" then ".webp"
+      else ".jpg"
+      end
+    end
+
+    def temp_path(prefix, ext)
+      path = File.join(Dir.tmpdir, "#{prefix}-#{@record.class.name}-#{@record.id}-#{SecureRandom.hex(4)}#{ext}")
+      @tempfiles ||= []
+      @tempfiles << path
+      path
+    end
+
+    def cleanup_tempfiles
+      Array(@tempfiles).each do |path|
+        FileUtils.rm_f(path)
+      end
+    end
+  end
+end

backend/app/services/streams/ingest_unavailable_error.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Streams
+  # Ingest MediaMTX non raggiungibile (es. CPX ancora in bootstrap). API → 503 retryable.
+  class IngestUnavailableError < StandardError
+    attr_reader :code
+
+    def initialize(message = "Ingest temporaneamente non disponibile", code: "stream_ingest_unavailable")
+      super(message)
+      @code = code
+    end
+  end
+end

backend/app/services/streams/node_health.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Streams
+  # Probe reachability of MediaMTX API on a stream node (:9997).
+  class NodeHealth
+    def self.mediamtx_up?(node, timeout: 2)
+      new(node, timeout: timeout).mediamtx_up?
+    end
+
+    def self.promote_if_healthy!(node, timeout: 2)
+      return false unless node.status == "provisioning"
+      return false unless mediamtx_up?(node, timeout: timeout)
+
+      node.update!(status: "ready", last_health_at: Time.current)
+      true
+    end
+
+    def initialize(node, timeout: 2)
+      @node = node
+      @timeout = timeout
+    end
+
+    def mediamtx_up?
+      Mediamtx::Client.new(base_url: @node.api_base_url).reachable?(timeout: @timeout)
+    end
+  end
+end

backend/app/services/streams/node_provisioner.rb

@@ -77,22 +77,25 @@ module Streams
       dns.upsert_a(hostname, ip)
 
       simulated = instance.raw.is_a?(Hash) && (instance.raw[:simulated] || instance.raw["simulated"])
-      api_base = simulated ? home.api_base_url : "http://#{private_ip}:9997"
-      internal_rtmp = simulated ? home.internal_rtmp_url : "rtmp://#{private_ip}:1935"
-      internal_hls = simulated ? home.internal_hls_url : "http://#{private_ip}:8888"
+      urls = urls_for_node(role: role, home: home, hostname: hostname, simulated: simulated,
+                           private_ip: private_ip, public_ip: ip, use_node_hostname: use_node_hostname)
 
-      StreamNode.create!(
+      # Simulated/lab che riusa MediaMTX home: subito ready. Cloud reale: provisioning
+      # finché :9997 risponde (evita allocate → Faraday Connection refused → 500).
+      initial_status = simulated ? "ready" : "provisioning"
+
+      node = StreamNode.create!(
         slug: slug,
         hostname: hostname,
         role: role,
-        status: "ready",
+        status: initial_status,
         provider: provider_name_for(cloud, role: role),
         provider_instance_id: instance.id,
-        rtmp_base_url: use_node_hostname ? "rtmp://#{hostname}:1935" : home.rtmp_base_url,
-        hls_base_url: use_node_hostname ? "https://#{hostname}/hls" : home.hls_base_url,
-        api_base_url: api_base,
-        internal_rtmp_url: internal_rtmp,
-        internal_hls_url: internal_hls,
+        rtmp_base_url: urls.fetch(:rtmp_base_url),
+        hls_base_url: urls.fetch(:hls_base_url),
+        api_base_url: urls.fetch(:api_base_url),
+        internal_rtmp_url: urls.fetch(:internal_rtmp_url),
+        internal_hls_url: urls.fetch(:internal_hls_url),
         max_publishers: max,
         max_relays: max,
         last_health_at: Time.current,
@@ -103,6 +106,67 @@ module Streams
           "cloud_raw" => instance.raw
         }
       )
+
+      wait_until_mediamtx_ready!(node) unless simulated
+      node.reload
+    end
+
+    def wait_until_mediamtx_ready!(node, timeout: nil, interval: nil)
+      timeout ||= ENV.fetch("STREAM_NODE_READY_TIMEOUT_SECS", "180").to_i
+      interval ||= ENV.fetch("STREAM_NODE_READY_POLL_SECS", "3").to_f
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
+
+      loop do
+        if Streams::NodeHealth.promote_if_healthy!(node)
+          Rails.logger.info("[Streams::NodeProvisioner] #{node.slug} MediaMTX ready")
+          return node
+        end
+
+        remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        if remaining <= 0
+          Rails.logger.warn(
+            "[Streams::NodeProvisioner] #{node.slug} ancora provisioning dopo #{timeout}s " \
+            "(api=#{node.api_base_url}); autoscaler continuerà a promuovere"
+          )
+          return node
+        end
+
+        sleep([interval, remaining].min)
+        node.reload
+      end
+    end
+
+    def urls_for_node(role:, home:, hostname:, simulated:, private_ip:, public_ip: nil, use_node_hostname:)
+      if role == "lab" && ENV["MEDIAMTX_LAB_API_URL"].present?
+        return {
+          api_base_url: ENV.fetch("MEDIAMTX_LAB_API_URL"),
+          internal_rtmp_url: ENV.fetch("MEDIAMTX_LAB_INTERNAL_RTMP_URL", "rtmp://mediamtx_lab:1935"),
+          internal_hls_url: ENV.fetch("MEDIAMTX_LAB_HLS_URL", "http://mediamtx_lab:8888"),
+          rtmp_base_url: ENV.fetch("MEDIAMTX_LAB_RTMP_URL", "rtmp://127.0.0.1:11935"),
+          # HLS pubblico resta sul proxy del sito: il controller instrada al MediaMTX del nodo.
+          hls_base_url: home.hls_base_url
+        }
+      end
+
+      control_ip = control_ip_for(role: role, private_ip: private_ip, public_ip: public_ip)
+      {
+        api_base_url: simulated ? home.api_base_url : "http://#{control_ip}:9997",
+        internal_rtmp_url: simulated ? home.internal_rtmp_url : "rtmp://#{control_ip}:1935",
+        internal_hls_url: simulated ? home.internal_hls_url : "http://#{control_ip}:8888",
+        rtmp_base_url: use_node_hostname ? "rtmp://#{hostname}:1935" : home.rtmp_base_url,
+        # Player del sito: proxy Rails/edge. HTTPS diretto sul nodo arriva dopo TLS/Caddy.
+        hls_base_url: home.hls_base_url
+      }
+    end
+
+    # Senza WireGuard/network privata Rails deve parlare con l'IPv4 pubblico (API+HLS).
+    def control_ip_for(role:, private_ip:, public_ip:)
+      public_ip = public_ip.presence
+      return private_ip if role != "cloud" || public_ip.blank?
+      return public_ip if ENV["STREAM_CLOUD_PUBLIC_CONTROL"] == "1"
+      return public_ip if private_ip.blank? || private_ip == public_ip
+
+      private_ip
     end
 
     def next_slug(prefix)

backend/app/services/streams/slate_distributor.rb

@@ -0,0 +1,105 @@
+module Streams
+  # Assicura che la slate MP4 custom sia sul nodo assegnato (home/lab locale, CPX via agent).
+  class SlateDistributor
+    class Error < StandardError; end
+
+    def self.slate_path_for_session(session)
+      new(session).mediamtx_slate_path
+    end
+
+    def self.ensure_for!(session)
+      new(session).ensure!
+    end
+
+    def initialize(session)
+      @session = session
+      @match = session.match
+      @node = session.stream_node
+      @resolver = CoverResolver.new(@match)
+    end
+
+    def mediamtx_slate_path
+      ensure! unless defined?(@mediamtx_path)
+      @mediamtx_path
+    end
+
+    def ensure!
+      result = @resolver.resolve
+      unless result
+        @mediamtx_path = default_slate_path
+        return @mediamtx_path
+      end
+
+      host_path = result.slate_local_path
+      filename = CoverSlatePaths.filename_for(result.record)
+      raise Error, "slate filename missing" if filename.blank?
+
+      # Path completo (non File.basename): il checksum AS può contenere "/" e spezzerebbe il path.
+      mediamtx_path = CoverSlatePaths.expected_path(result.record)
+
+      if cloud_node?
+        push_to_agent!(filename, result.record, host_path)
+      else
+        verify_local_slate!(host_path)
+      end
+
+      @mediamtx_path = mediamtx_path
+    rescue StandardError => e
+      # Agent cloud down / timeout / disk missing: non bloccare il go-live, usa slate default.
+      Rails.logger.warn("[SlateDistributor] session=#{@session.id} #{e.class}: #{e.message}")
+      @mediamtx_path = default_slate_path
+    end
+
+    private
+
+    def cloud_node?
+      @node&.role == "cloud" && agent_url.present?
+    end
+
+    def agent_url
+      ENV["STREAM_NODE_RELAY_AGENT_URL"].presence || @node&.relay_agent_url
+    end
+
+    def agent_secret
+      ENV["STREAM_NODE_AGENT_SECRET"].presence || "mediamtx_webhook_dev_secret"
+    end
+
+    def push_to_agent!(filename, record, host_path)
+      bytes = read_slate_bytes(record, host_path)
+      raise Error, "slate bytes missing for #{filename}" if bytes.blank?
+
+      uri = URI.parse("#{agent_url.chomp('/')}/slates/#{CGI.escape(filename)}")
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.open_timeout = 5
+      http.read_timeout = 120
+      req = Net::HTTP::Put.new(uri)
+      req["Authorization"] = "Bearer #{agent_secret}" if agent_secret.present?
+      req["Content-Type"] = "video/mp4"
+      req.body = bytes
+      res = http.request(req)
+      return if res.is_a?(Net::HTTPSuccess)
+
+      raise Error, "agent PUT /slates/#{filename} HTTP #{res.code} #{res.body.to_s.truncate(200)}"
+    end
+
+    def read_slate_bytes(record, host_path)
+      return File.binread(host_path) if host_path.present? && File.exist?(host_path)
+
+      return unless record.cover_slate.attached?
+
+      record.cover_slate.blob.open(tmpdir: Dir.tmpdir) do |file|
+        return File.binread(file.path)
+      end
+    end
+
+    def verify_local_slate!(host_path)
+      return if host_path.present? && File.exist?(host_path)
+
+      raise Error, "slate missing on disk: #{host_path}"
+    end
+
+    def default_slate_path
+      ENV.fetch("MEDIAMTX_SLATE_FILE", "/slates/offline.mp4")
+    end
+  end
+end

backend/app/services/streams/youtube_relay.rb

@@ -1,6 +1,10 @@
+require "json"
+require "net/http"
+require "uri"
+
 module Streams
-  # Relay verso YouTube: legge RTMP/HLS da MediaMTX e inoltra su RTMPS (-c copy). Nessun overlay.
-  # ffmpeg gira solo sui worker Sidekiq con YOUTUBE_RELAY_WORKER=1 (coda youtube_relay).
+  # Relay verso YouTube: legge HLS da MediaMTX e inoltra su RTMPS (-c copy).
+  # Sul nodo cloud ffmpeg è avviato dall'agent locale (immagine CPX) all'avvio diretta.
   class YoutubeRelay
     class Error < StandardError; end
 
@@ -8,6 +12,7 @@ module Streams
     OWNER_KEY = "youtube_relay:owner:%s"
     OWNED_SET = "youtube_relay:owned:%s"
     QUEUE = :youtube_relay
+    QUEUE_PREFIX = "youtube_relay"
 
     class << self
       def worker?
@@ -18,18 +23,63 @@ module Streams
         ENV.fetch("RELAY_MAX_CONCURRENT", "4").to_i
       end
 
+      def local_node_slug
+        ENV["STREAM_NODE_SLUG"].presence || NodeRegistry::HOME_SLUG
+      end
+
+      def assigned_node_slug(session)
+        session.stream_node&.slug.presence || NodeRegistry::HOME_SLUG
+      end
+
+      def node_matches?(session)
+        assigned_node_slug(session) == local_node_slug
+      end
+
+      # Home può avviare ffmpeg sull'agent del CPX (niente worker Docker per nodo).
+      def can_process?(session)
+        return false unless worker?
+        return true if node_matches?(session)
+
+        cloud_home_dispatch?(session)
+      end
+
+      def cloud_home_dispatch?(session)
+        local_node_slug == NodeRegistry::HOME_SLUG &&
+          session.stream_node&.role == "cloud" &&
+          session.stream_node.relay_agent_url.present?
+      end
+
+      def queue_for(session)
+        node = session.stream_node
+        if node&.role == "cloud" && node.relay_agent_url.present?
+          return "#{QUEUE_PREFIX}_cloud"
+        end
+
+        "#{QUEUE_PREFIX}_#{assigned_node_slug(session)}"
+      end
+
+      def enqueue_ensure!(session, wait: nil)
+        opts = { queue: queue_for(session) }
+        opts[:wait] = wait if wait
+        YoutubeRelayEnsureJob.set(**opts).perform_later(session.id)
+      end
+
+      def enqueue_stop!(session)
+        YoutubeRelayStopJob.set(queue: queue_for(session)).perform_later(session.id)
+      end
+
       def start(session)
-        return unless worker?
+        return enqueue_ensure!(session) unless can_process?(session)
 
         start_on_worker!(session)
       end
 
       # Non cancella owner/pid qui: solo il worker owner deve killare ffmpeg.
       def stop(session)
-        if worker? && owner_is_local?(session.id)
+        if worker? && owner_is_local?(session.id) && can_process?(session)
           stop_on_worker!(session)
         else
-          YoutubeRelayStopJob.set(queue: QUEUE).perform_later(session.id)
+          enqueue_stop!(session)
         end
         true
       end
@@ -41,7 +91,7 @@ module Streams
         return false if pid.blank? && owner.present? && owner != worker_id && redis.ttl(format(OWNER_KEY, session_id)) <= 30
         return false if pid.blank?
 
-        return process_alive?(pid) if owner.blank? || owner == worker_id
+        return process_alive?(pid, session_id: session_id) if owner.blank? || owner == worker_id
 
         # Relay su altro host: attivo se lock owner ancora fresco.
         redis.ttl(format(OWNER_KEY, session_id)) > 30
@@ -52,15 +102,22 @@ module Streams
         return if session.terminal?
         return if session.stream_key.blank?
 
-        if worker?
+        if can_process?(session)
           ensure_on_worker!(session)
         else
-          YoutubeRelayEnsureJob.set(queue: QUEUE).perform_later(session.id)
+          enqueue_ensure!(session)
         end
       end
 
       def ensure_on_worker!(session)
         return :not_worker unless worker?
+        unless can_process?(session)
+          enqueue_ensure!(session, wait: 2.seconds)
+          Rails.logger.info(
+            "[YoutubeRelay] wrong_node local=#{local_node_slug} assigned=#{assigned_node_slug(session)} session=#{session.id}"
+          )
+          return :wrong_host
+        end
         return unless session.platform == "youtube"
         return if session.terminal?
         return if session.stream_key.blank?
@@ -68,7 +125,7 @@ module Streams
         return unless intake_available?(session)
 
         pid = pid_for(session.id)
-        if pid.present? && !process_alive?(pid.to_i)
+        if pid.present? && !process_alive?(pid.to_i, session_id: session.id)
           clear_local_ownership(session.id)
         end
 
@@ -77,9 +134,9 @@ module Streams
           return :already_running
         end
 
-        if at_capacity?
-          YoutubeRelayEnsureJob.set(wait: 5.seconds, queue: QUEUE).perform_later(session.id)
-          Rails.logger.info("[YoutubeRelay] at capacity worker=#{worker_id} session=#{session.id} requeue")
+        if at_capacity_for?(session)
+          enqueue_ensure!(session, wait: 5.seconds)
+          Rails.logger.info("[YoutubeRelay] at capacity worker=#{worker_id} node=#{local_node_slug} session=#{session.id} requeue")
           return :at_capacity
         end
 
@@ -91,6 +148,7 @@ module Streams
         :started
       rescue Error => e
         Rails.logger.warn("[YoutubeRelay] ensure_on_worker session=#{session.id}: #{e.message}")
+        enqueue_ensure!(session, wait: 5.seconds) unless session.terminal?
         :error
       end
 
@@ -109,7 +167,7 @@ module Streams
           return :noop
         end
 
-        terminate_pid(pid)
+        terminate_pid(pid, session_id: session.id)
         clear_local_ownership(session.id)
         Rails.logger.info("[YoutubeRelay] stopped pid=#{pid} session=#{session.id} worker=#{worker_id}")
         :stopped
@@ -123,6 +181,13 @@ module Streams
         local_owned_count >= max_concurrent
       end
 
+      # I relay sull'agent CPX non consumano ffmpeg locale: non applicare il cap del worker home.
+      def at_capacity_for?(session)
+        return false if cloud_home_dispatch?(session)
+
+        at_capacity?
+      end
+
       def owner_is_local?(session_id)
         owner = redis.get(format(OWNER_KEY, session_id))
         owner.blank? || owner == worker_id
@@ -140,26 +205,94 @@ module Streams
 
         stop_on_worker!(session) if pid_for(session.id).present? && owner_is_local?(session.id)
 
+        # Due EnsureJob concorrenti (concurrency Sidekiq > 1) non devono spawnare due ffmpeg.
+        unless redis.set(format("youtube_relay:startlock:%s", session.id), worker_id, nx: true, ex: 20)
+          return pid_for(session.id).to_i
+        end
+
         log_path = log_file(session)
         FileUtils.mkdir_p(File.dirname(log_path))
         intake_source = mediamtx_intake_source(session)
         output = "rtmps://a.rtmps.youtube.com/live2/#{session.stream_key}"
 
-        pid = Process.spawn(
-          *youtube_ffmpeg_args(intake_source, output),
-          %i[out err] => log_path,
-          pgroup: true
-        )
-        Process.detach(pid)
+        pid = if agent_dispatch?(session)
+                start_via_agent!(session)
+              else
+                spawn_ffmpeg!(youtube_ffmpeg_args(intake_source, output), log_path)
+              end
         store_pid(session.id, pid)
         claim_ownership!(session.id)
-        Rails.logger.info("[YoutubeRelay] started pid=#{pid} session=#{session.id} intake=#{intake_source.join(":")} worker=#{worker_id}")
+        Rails.logger.info(
+          "[YoutubeRelay] started pid=#{pid} session=#{session.id} intake=#{intake_source.join(':')} " \
+          "worker=#{worker_id} agent=#{agent_base_url(session) || '-'}"
+        )
         schedule_youtube_activate(session)
         pid
       rescue Errno::ENOENT => e
         raise Error, "ffmpeg non disponibile: #{e.message}"
       end
 
+      def agent_base_url(session)
+        return if session.blank?
+
+        ENV["STREAM_NODE_RELAY_AGENT_URL"].presence || session.stream_node&.relay_agent_url
+      end
+
+      def agent_dispatch?(session)
+        agent_base_url(session).present?
+      end
+
+      def relay_agent_secret
+        ENV["STREAM_NODE_AGENT_SECRET"].presence || "mediamtx_webhook_dev_secret"
+      end
+
+      def spawn_ffmpeg!(args, log_path)
+        pid = Process.spawn(*args, %i[out err] => log_path, pgroup: true)
+        Process.detach(pid)
+        pid
+      end
+
+      def start_via_agent!(session)
+        payload = {
+          "session_id" => session.id,
+          "path" => session.mediamtx_path_name,
+          "rtmps" => "rtmps://a.rtmps.youtube.com/live2/#{session.stream_key}"
+        }
+        res = agent_request(Net::HTTP::Post, "/relays", payload, session: session)
+        pid = res["pid"].to_i
+        raise Error, "relay agent spawn failed: #{res.inspect}" if pid <= 0
+
+        File.write(
+          log_file(session),
+          "agent=#{agent_base_url(session)} pid=#{pid} path=#{session.mediamtx_path_name}\n"
+        )
+        pid
+      end
+
+      def agent_request(http_class, path, payload = nil, session: nil, session_id: nil)
+        session ||= StreamSession.find_by(id: session_id) if session_id.present?
+        base = agent_base_url(session)
+        raise Error, "relay agent URL mancante" if base.blank?
+
+        uri = URI.parse("#{base.chomp('/')}#{path}")
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.open_timeout = 5
+        http.read_timeout = 10
+        req = http_class.new(uri)
+        req["Authorization"] = "Bearer #{relay_agent_secret}" if relay_agent_secret.present?
+        req["Content-Type"] = "application/json"
+        req.body = JSON.generate(payload) if payload
+        res = http.request(req)
+        body = res.body.present? ? JSON.parse(res.body) : {}
+        unless res.is_a?(Net::HTTPSuccess)
+          raise Error, "relay agent #{path} HTTP #{res.code} #{body.inspect}"
+        end
+
+        body
+      rescue JSON::ParserError => e
+        raise Error, "relay agent JSON: #{e.message}"
+      end
+
       # Remux verso YouTube: video+audio copy (AAC già da app/slate a 48k mono).
       # HLS (ADTS) → FLV richiede -bsf:a aac_adtstoasc; RTMP ha già ASC in FLV tags.
       def youtube_ffmpeg_args(intake_source, output)
@@ -179,6 +312,9 @@ module Streams
         end
 
         common_head + [
+          "-reconnect", "1",
+          "-reconnect_streamed", "1",
+          "-reconnect_delay_max", "2",
           "-rw_timeout", "15000000",
           "-live_start_index", "-1",
           "-i", url,
@@ -190,14 +326,29 @@ module Streams
       end
 
       def mediamtx_intake_source(session)
-        base = session.mediamtx_internal_rtmp_url
+        rtmp_base, hls_base = intake_bases(session)
         if Mediamtx::PublisherOnline.active?(session)
-          return [:rtmp, "#{base.chomp('/')}/#{session.mediamtx_path_name}"]
+          return [:rtmp, "#{rtmp_base.chomp('/')}/#{session.mediamtx_path_name}"]
         end
 
         path = session.mediamtx_path_name
-        hls = session.mediamtx_internal_hls_url.chomp("/")
-        [:hls, "#{hls}/#{path}/index.m3u8"]
+        [:hls, "#{hls_base.chomp('/')}/#{path}/index.m3u8"]
+      end
+
+      # Sul nodo assegnato ffmpeg legge MediaMTX in loopback (o hostname Docker locale).
+      def intake_bases(session)
+        if agent_dispatch?(session) && (node_matches?(session) || cloud_home_dispatch?(session))
+          return ["rtmp://127.0.0.1:1935", "http://127.0.0.1:8888"]
+        end
+
+        if node_matches?(session)
+          [
+            ENV["STREAM_NODE_LOCAL_RTMP_URL"].presence || session.mediamtx_internal_rtmp_url,
+            ENV["STREAM_NODE_LOCAL_HLS_URL"].presence || session.mediamtx_internal_hls_url
+          ]
+        else
+          [session.mediamtx_internal_rtmp_url, session.mediamtx_internal_hls_url]
+        end
       end
 
       def intake_available?(session)
@@ -257,7 +408,10 @@ module Streams
         redis.get(format(REDIS_KEY, session_id))
       end
 
-      def process_alive?(pid)
+      def process_alive?(pid, session_id: nil)
+        session = session_id.present? ? StreamSession.find_by(id: session_id) : nil
+        return agent_session_running?(session) if session && agent_dispatch?(session)
+
         stat = File.read("/proc/#{pid.to_i}/stat")
         return false if stat.split[2] == "Z"
 
@@ -267,12 +421,27 @@ module Streams
         false
       end
 
-      def terminate_pid(pid)
+      def agent_session_running?(session)
+        res = agent_request(Net::HTTP::Get, "/relays/#{session.id}", session: session)
+        res["running"] == true
+      rescue Error
+        false
+      end
+
+      def terminate_pid(pid, session_id: nil)
+        session = session_id.present? ? StreamSession.find_by(id: session_id) : nil
+        if session && agent_dispatch?(session)
+          agent_request(Net::HTTP::Delete, "/relays/#{session_id}", session: session)
+          return
+        end
+
         Process.kill("TERM", -pid.to_i)
         sleep 0.5
       rescue Errno::ESRCH
         nil
       else
+        return if session && agent_dispatch?(session)
+
         begin
           Process.kill("KILL", -pid.to_i)
         rescue Errno::ESRCH