docs: update and correct configuration documentation

docs/DOWNLOAD_CONFIG.md

@@ -54,7 +54,9 @@ Options:
 - `curl_impersonate` - <https://github.com/yifeikong/curl-impersonate> (via <https://github.com/yifeikong/curl_cffi>)
 - `n_m3u8dl_re` - <https://github.com/nilaoda/N_m3u8DL-RE>
 
-Note that aria2c can reach the highest speeds as it utilizes threading and more connections than the other downloaders. However, aria2c can also be one of the more unstable downloaders. It will work one day, then not another day. It also does not support HTTP(S) proxies while the other downloaders do.
+Note that aria2c can reach the highest speeds as it utilizes threading and more connections than the other downloaders. However, aria2c can also be one of the more unstable downloaders. It will work one day, then not another day. It also does not support HTTP(S) proxies natively (non-HTTP proxies are bridged via pproxy).
+
+Note that `n_m3u8dl_re` will automatically fall back to `requests` for track types it does not support, specifically: direct URL downloads, Subtitle tracks, and Attachment tracks.
 
 Example mapping:
 
@@ -72,10 +74,12 @@ The `default` entry is optional. If omitted, `requests` will be used for service
 
 ## n_m3u8dl_re (dict)
 
-Configuration for N_m3u8DL-RE downloader. This downloader is particularly useful for HLS streams.
+Configuration for N_m3u8DL-RE downloader. This downloader supports HLS, DASH, and ISM (Smooth Streaming) manifests.
+It will automatically fall back to the `requests` downloader for unsupported track types (direct URLs, subtitles, attachments).
 
 - `thread_count`
-  Number of threads to use for downloading. Default: Uses the same value as max_workers from the command.
+  Number of threads to use for downloading. Default: Uses the same value as max_workers from the command
+  (which defaults to `min(32,(cpu_count+4))`).
 - `ad_keyword`
   Keyword to identify and potentially skip advertisement segments. Default: `None`
 - `use_proxy`
@@ -83,6 +87,9 @@ Configuration for N_m3u8DL-RE downloader. This downloader is particularly useful
 - `retry_count`
   Number of times to retry failed downloads. Default: `10`
 
+N_m3u8DL-RE also respects the `decryption` config setting. When content keys are provided, it will use
+the configured decryption engine (`shaka` or `mp4decrypt`) and automatically locate the corresponding binary.
+
 For example,
 
 ```yaml
@@ -140,6 +147,57 @@ sub_format: vtt
 
 ---
 
+## subtitle (dict)
+
+Configuration for subtitle processing and conversion.
+
+- `conversion_method`
+  Method to use for converting subtitles between formats. Default: `"auto"`
+  - `"auto"` — Smart routing: uses subby for WebVTT/SAMI, pycaption for others.
+  - `"subby"` — Always use subby with advanced processing.
+  - `"pycaption"` — Use only pycaption library (no SubtitleEdit, no subby).
+  - `"subtitleedit"` — Prefer SubtitleEdit when available, fall back to pycaption.
+  - `"pysubs2"` — Use pysubs2 library (supports SRT/SSA/ASS/WebVTT/TTML/SAMI/MicroDVD/MPL2/TMP).
+- `sdh_method`
+  Method to use for SDH (hearing impaired) stripping. Default: `"auto"`
+  - `"auto"` — Try subby (SRT only), then SubtitleEdit (if available), then subtitle-filter.
+  - `"subby"` — Use subby library (SRT only).
+  - `"subtitleedit"` — Use SubtitleEdit tool (Windows only, falls back to subtitle-filter).
+  - `"filter-subs"` — Use subtitle-filter library directly.
+- `strip_sdh`
+  Automatically create stripped (non-SDH) versions of SDH subtitles. Default: `true`
+- `convert_before_strip`
+  Auto-convert VTT/other formats to SRT before using subtitle-filter for SDH stripping.
+  Ensures compatibility when subtitle-filter is used as fallback. Default: `true`
+- `preserve_formatting`
+  Preserve original subtitle formatting (tags, positioning, styling).
+  When `true`, skips pycaption processing for WebVTT files to keep tags like `<i>`, `<b>`,
+  positioning intact. Combined with no `sub_format` setting, ensures subtitles remain in
+  their original format. Default: `true`
+- `output_mode`
+  Output mode for subtitles. Default: `"mux"`
+  - `"mux"` — Embed subtitles in MKV container only.
+  - `"sidecar"` — Save subtitles as separate files only.
+  - `"both"` — Embed in MKV and save as sidecar files.
+- `sidecar_format`
+  Format for sidecar subtitle files when `output_mode` is `"sidecar"` or `"both"`. Default: `"srt"`
+  Options: `srt`, `vtt`, `ass`, `original` (keep current format).
+
+For example,
+
+```yaml
+subtitle:
+  conversion_method: auto
+  sdh_method: auto
+  strip_sdh: true
+  convert_before_strip: true
+  preserve_formatting: true
+  output_mode: mux
+  sidecar_format: srt
+```
+
+---
+
 ## decryption (str | dict)
 
 Choose what software to use to decrypt DRM-protected content throughout unshackle where needed.

docs/DRM_CONFIG.md

@@ -41,6 +41,29 @@ DSNP:
 default: chromecdm_903_l3
 ```
 
+You can also select CDMs based on video resolution using comparison operators (`>=`, `>`, `<=`, `<`)
+or exact match on the resolution height.
+
+For example,
+
+```yaml
+EXAMPLE:
+  "<=1080": generic_android_l3   # Use L3 for 1080p and below
+  ">1080": nexus_5_l1            # Use L1 for above 1080p (1440p, 2160p)
+  default: generic_android_l3    # Fallback if no quality match
+```
+
+You can mix profiles and quality thresholds in the same service:
+
+```yaml
+NETFLIX:
+  john: netflix_l3_profile       # Profile-based selection
+  "<=720": netflix_mobile_l3     # Quality-based selection
+  "1080": netflix_standard_l3    # Exact match for 1080p
+  ">=1440": netflix_premium_l1   # Quality-based selection
+  default: netflix_standard_l3   # Fallback
+```
+
 ---
 
 ## remote_cdm (list\[dict])
@@ -113,8 +136,10 @@ remote_cdm:
 - Support for both Widevine and PlayReady
 - Multiple security levels (L1, L2, L3, SL2000, SL3000)
 
-**Note:** The `device_type` and `security_level` fields are optional metadata. They don't affect API communication
+**Note:** The `device_type` field determines whether the CDM operates in PlayReady or Widevine mode.
-but are used for internal device identification.
+Setting `device_type: PLAYREADY` (or using `device_name: SL2` / `SL3`) activates PlayReady mode.
+The `security_level` field is auto-computed from `device_name` when not specified (e.g., SL2 defaults
+to 2000, SL3 to 3000, and Widevine devices default to 3). You can override these if needed.
 
 ### Custom API Remote CDM
 
@@ -171,7 +196,7 @@ remote_cdm:
       header_name: X-API-Key
       key: YOUR_SECRET_KEY
       custom_headers:
-        User-Agent: Unshackle/2.0.0
+        User-Agent: Unshackle/3.1.0
         X-Client-Version: "1.0"
 
     # Endpoint configuration
@@ -224,6 +249,7 @@ remote_cdm:
 - `header` - Custom header authentication
 - `basic` - HTTP Basic authentication
 - `body` - Credentials in request body
+- `query` - Authentication added to query string parameters
 
 ### Legacy PyWidevine Serve Format
 
@@ -266,6 +292,58 @@ used as a fallback.
 
 ---
 
+## decryption (str|dict)
+
+Configure which decryption tool to use for DRM-protected content. Default: `shaka`.
+
+Supported values:
+- `shaka` - Shaka Packager (default)
+- `mp4decrypt` - Bento4 mp4decrypt
+
+You can specify a single decrypter for all services:
+
+```yaml
+decryption: shaka
+```
+
+Or configure per-service with a `DEFAULT` fallback:
+
+```yaml
+decryption:
+  DEFAULT: shaka
+  AMZN: mp4decrypt
+  NF: shaka
+```
+
+Service keys are case-insensitive (normalized to uppercase internally).
+
+---
+
+## MonaLisa DRM
+
+MonaLisa is a WASM-based DRM system that uses local key extraction and two-stage segment decryption.
+Unlike Widevine and PlayReady, MonaLisa does not use a challenge/response flow with a license server.
+Instead, the PSSH value (ticket) is provided directly by the service API, and keys are extracted
+locally via a WASM module.
+
+### Requirements
+
+- **ML-Worker binary**: Must be available on your system `PATH` (discovered via `binaries.ML_Worker`).
+  This is the binary that performs stage-1 decryption.
+
+### Decryption stages
+
+1. **ML-Worker binary**: Removes MonaLisa encryption layer (bbts -> ents). The key is passed via command-line argument.
+2. **AES-ECB decryption**: Final decryption with service-provided key.
+
+MonaLisa uses per-segment decryption during download (not post-download like Widevine/PlayReady),
+so segments are decrypted as they are downloaded.
+
+**Note:** MonaLisa is configured per-service rather than through global config options. Services
+that use MonaLisa handle ticket/key retrieval and CDM initialization internally.
+
+---
+
 ## key_vaults (list\[dict])
 
 Key Vaults store your obtained Content Encryption Keys (CEKs) and Key IDs per-service.

docs/GLUETUN.md

@@ -47,7 +47,7 @@ Format: `gluetun:provider:region`
 
 **OpenVPN (Recommended)**: Most providers support OpenVPN with just `username` and `password` - the simplest setup.
 
-**WireGuard**: Requires private keys and varies by provider. See the [Gluetun Wiki](https://github.com/qdm12/gluetun-wiki/tree/main/setup/providers) for provider-specific requirements.
+**WireGuard**: Requires private keys and varies by provider. See the [Gluetun Wiki](https://github.com/qdm12/gluetun-wiki/tree/main/setup/providers) for provider-specific requirements. Note that `vpn_type` defaults to `wireguard` if not specified.
 
 ## Getting Your Credentials
 
@@ -104,6 +104,13 @@ providers:
     credentials:
       private_key: YOUR_PRIVATE_KEY
 
+# Surfshark/Mullvad/IVPN (private_key AND addresses required)
+  surfshark:
+    vpn_type: wireguard
+    credentials:
+      private_key: YOUR_PRIVATE_KEY
+      addresses: 10.x.x.x/32
+
 # Windscribe (all three credentials required)
   windscribe:
     vpn_type: wireguard
@@ -124,6 +131,46 @@ Most providers use `SERVER_COUNTRIES`, but some use `SERVER_REGIONS`:
 
 Unshackle handles this automatically - just use 2-letter country codes.
 
+### Per-Provider Server Mapping
+
+You can explicitly map region codes to country names, cities, or hostnames per provider:
+
+```yaml
+providers:
+  nordvpn:
+    vpn_type: openvpn
+    credentials:
+      username: YOUR_USERNAME
+      password: YOUR_PASSWORD
+    server_countries:
+      us: "United States"
+      uk: "United Kingdom"
+    server_cities:
+      us: "New York"
+    server_hostnames:
+      us: "us1239.nordvpn.com"
+```
+
+### Specific Server Selection
+
+Use `--proxy gluetun:nordvpn:us1239` for specific server selection. Unshackle builds the hostname
+automatically based on the provider (e.g., `us1239.nordvpn.com` for NordVPN).
+
+### Extra Environment Variables
+
+You can pass additional Gluetun environment variables per provider using `extra_env`:
+
+```yaml
+providers:
+  nordvpn:
+    vpn_type: openvpn
+    credentials:
+      username: YOUR_USERNAME
+      password: YOUR_PASSWORD
+    extra_env:
+      LOG_LEVEL: debug
+```
+
 ## Global Settings
 
 ```yaml
@@ -133,17 +180,19 @@ proxy_providers:
     base_port: 8888           # Starting port (default: 8888)
     auto_cleanup: true        # Remove containers on exit (default: true)
     verify_ip: true           # Verify IP matches region (default: true)
-    container_prefix: "unshackle-gluetun"
+    container_prefix: "unshackle-gluetun"  # Docker container name prefix (default: "unshackle-gluetun")
     auth_user: username       # Proxy auth (optional)
-    auth_password: password
+    auth_password: password   # Proxy auth (optional)
 ```
 
 ## Features
 
-- **Container Reuse**: First request takes 10-30s; subsequent requests are instant
+- **Container Reuse**: First request takes 10-30s; subsequent requests are instant. Containers from other sessions are also detected and reused.
-- **IP Verification**: Automatically verifies VPN exit IP matches requested region
+- **IP Verification**: Automatically verifies VPN exit IP matches requested region (configurable via `verify_ip`)
 - **Concurrent Sessions**: Multiple downloads share the same container
 - **Specific Servers**: Use `--proxy gluetun:nordvpn:us1239` for specific server selection
+- **Automatic Image Pull**: The Gluetun Docker image (`qmcgaw/gluetun:latest`) is pulled automatically on first use
+- **Secure Credentials**: Credentials are passed via temporary env files (mode 0600) rather than command-line arguments
 
 ## Container Management
 
@@ -174,8 +223,9 @@ docker logs unshackle-gluetun-nordvpn-us
 
 Common issues:
 - Invalid/missing credentials
-- Windscribe requires `preshared_key` (can be empty string)
+- Windscribe WireGuard requires `preshared_key` (can be empty string, but must be set in credentials)
 - VPN provider server issues
+- Container startup timeout (default 60 seconds)
 
 ## Resources
 

docs/NETWORK_CONFIG.md

@@ -36,6 +36,8 @@ system where required.
 You can also specify specific servers to use per-region with the `server_map` key.
 Sometimes a specific server works best for a service than others, so hard-coding one for a day or two helps.
 
+You can also select servers by city using the format `--proxy nordvpn:us:seattle` or `--proxy nordvpn:ca:calgary`.
+
 For example,
 
 ```yaml
@@ -48,8 +50,8 @@ server_map:
 The username and password should NOT be your normal NordVPN Account Credentials.
 They should be the `Service credentials` which can be found on your Nord Account Dashboard.
 
-Once set, you can also specifically opt in to use a NordVPN proxy by specifying `--proxy=gb` or such.
+Once set, you can also specifically opt in to use a NordVPN proxy by specifying `--proxy nordvpn:gb` or such.
-You can even set a specific server number this way, e.g., `--proxy=gb2366`.
+You can even set a specific server number this way, e.g., `--proxy nordvpn:gb2366`.
 
 Note that `gb` is used instead of `uk` to be more consistent across regional systems.
 
@@ -58,6 +60,8 @@ Note that `gb` is used instead of `uk` to be more consistent across regional sys
 Enable Surfshark VPN proxy service using Surfshark Service credentials (not your login password).
 You may pin specific server IDs per region using `server_map`.
 
+You can also select servers by city using the format `--proxy surfsharkvpn:us:seattle`.
+
 ```yaml
 username: your_surfshark_service_username # https://my.surfshark.com/vpn/manual-setup/main/openvpn
 password: your_surfshark_service_password # service credentials, not account password
@@ -67,16 +71,13 @@ server_map:
   au: 4621 # force AU server #4621
 ```
 
-### hola (dict)
+### hola
 
 Enable Hola VPN proxy service. Requires the `hola-proxy` binary to be installed and available in your PATH.
+No configuration is needed under `proxy_providers`. Hola is loaded automatically when the `hola-proxy` binary
+is detected.
 
-```yaml
+Once available, use `--proxy hola:us` or similar to connect through Hola.
-proxy_providers:
-  hola: {}
-```
-
-Once configured, use `--proxy hola:us` or similar to connect through Hola.
 
 ### windscribevpn (dict)
 
@@ -105,32 +106,28 @@ proxy_providers:
       gb: uk-london-001.totallyacdn.com   # Force specific UK server
 ```
 
-Once configured, use `--proxy windscribe:us` or `--proxy windscribe:gb` etc. to connect through Windscribe.
+Once configured, use `--proxy windscribevpn:us` or `--proxy windscribevpn:gb` etc. to connect through Windscribe.
 
-### Legacy nordvpn Configuration
+You can also select specific servers by number (e.g., `--proxy windscribevpn:sg007`) or filter by city
+(e.g., `--proxy windscribevpn:ca:toronto`).
 
-**Legacy configuration. Use `proxy_providers.nordvpn` instead.**
+### gluetun (dict)
 
-Set your NordVPN Service credentials with `username` and `password` keys to automate the use of NordVPN as a Proxy
+Docker-managed VPN proxy supporting 50+ VPN providers via Gluetun. See [GLUETUN.md](GLUETUN.md) for full
-system where required.
+configuration and usage details.
-
-You can also specify specific servers to use per-region with the `server_map` key.
-Sometimes a specific server works best for a service than others, so hard-coding one for a day or two helps.
-
-For example,
 
 ```yaml
-nordvpn:
+proxy_providers:
-  username: zxqsR7C5CyGwmGb6KSvk8qsZ # example of the login format
+  gluetun:
-  password: wXVHmht22hhRKUEQ32PQVjCZ
+    providers:
-  server_map:
+      windscribe:
-    us: 12 # force US server #12 for US proxies
+        vpn_type: openvpn
+        credentials:
+          username: "YOUR_OPENVPN_USERNAME"
+          password: "YOUR_OPENVPN_PASSWORD"
 ```
 
-The username and password should NOT be your normal NordVPN Account Credentials.
+Usage: `--proxy gluetun:windscribe:us`
-They should be the `Service credentials` which can be found on your Nord Account Dashboard.
-
-Note that `gb` is used instead of `uk` to be more consistent across regional systems.
 
 ---
 
@@ -141,14 +138,14 @@ All requests will use these unless changed explicitly or implicitly via a Server
 These should be sane defaults and anything that would only be useful for some Services should not
 be put here.
 
-Avoid headers like 'Accept-Encoding' as that would be a compatibility header that Python-requests will
+Avoid headers like 'Accept-Encoding' as that would be a compatibility header that curl_cffi will
 set for you.
 
 I recommend using,
 
 ```yaml
 Accept-Language: "en-US,en;q=0.8"
-User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.75 Safari/537.36"
+User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
 ```
 
 ---

docs/OUTPUT_CONFIG.md

@@ -37,6 +37,19 @@ Set scene-style naming for titles. When `true` uses scene naming patterns (e.g.,
 
 ---
 
+## dash_naming (bool)
+
+Use dash-separated naming convention for output files. Default: `false`.
+
+---
+
+## unicode_filenames (bool)
+
+Allow Unicode characters in output filenames. When `false`, Unicode characters are transliterated
+to ASCII equivalents. Default: `false`.
+
+---
+
 ## series_year (bool)
 
 Whether to include the series year in series names for episodes and folders. Default: `true`.
@@ -67,6 +80,14 @@ Enable/disable tagging downloaded files with IMDB/TMDB/TVDB identifiers (when av
 
 - `set_title`
   Set the container title to `Show SXXEXX Episode Name` or `Movie (Year)`. Default: `true`
+- `merge_audio`
+  Merge all audio tracks into each output file. Default: `true`
+  - `true`: All selected audio tracks are muxed into one MKV per quality.
+  - `false`: Separate MKV per (quality, audio_codec) combination.
+    For example: `Title.1080p.AAC.mkv`, `Title.1080p.EC3.mkv`.
+
+  Note: The `--split-audio` CLI flag overrides this setting. When `--split-audio` is passed,
+  `merge_audio` is effectively set to `false` for that run.
 
 ---
 
@@ -114,6 +135,7 @@ Notes:
 For example,
 
 ```yaml
+directories:
   downloads: "D:/Downloads/unshackle"
   temp: "D:/Temp/unshackle"
 ```

docs/SERVICE_CONFIG.md

@@ -4,12 +4,12 @@ This document covers service-specific configuration, authentication, and metadat
 
 ## services (dict)
 
-Configuration data for each Service. The Service will have the data within this section merged into the `config.yaml`
+Configuration data for each Service. The Service will have the data within this section merged into the per-service
-before provided to the Service class.
+`config.yaml` (located in the service's directory) before being provided to the Service class.
 
 Think of this config to be used for more sensitive configuration data, like user or device-specific API keys, IDs,
-device attributes, and so on. A `config.yaml` file is typically shared and not meant to be modified, so use this for
+device attributes, and so on. A per-service `config.yaml` file is typically shared and not meant to be modified,
-any sensitive configuration data.
+so use this for any sensitive configuration data.
 
 The Key is the Service Tag, but can take any arbitrary form for its value. It's expected to begin as either a list or
 a dictionary.
@@ -23,6 +23,29 @@ NOW:
     # ... more sensitive data
 ```
 
+### Per-Service Configuration Overrides
+
+You can override many global configuration options on a per-service basis by nesting them under the
+service tag in the `services` section. Supported override keys include: `dl`, `aria2c`, `n_m3u8dl_re`,
+`curl_impersonate`, `subtitle`, `muxing`, `headers`, and more.
+
+Overrides are merged with global config (not replaced) -- only specified keys are overridden, others
+use global defaults. CLI arguments always take priority over service-specific config.
+
+For example,
+
+```yaml
+services:
+  RATE_LIMITED_SERVICE:
+    dl:
+      downloads: 2       # Limit concurrent track downloads
+      workers: 4          # Reduce workers to avoid rate limits
+    n_m3u8dl_re:
+      thread_count: 4     # Very low thread count
+    aria2c:
+      max_concurrent_downloads: 1
+```
+
 ---
 
 ## credentials (dict[str, str|list|dict])
@@ -114,3 +137,28 @@ Maximum retention time in seconds for serving slightly stale cached title metada
 Default: `86400` (24 hours). Effective retention is `min(title_cache_time + grace, title_cache_max_retention)`.
 
 ---
+
+## debug (bool)
+
+Enable structured JSON debug logging for troubleshooting and service development. Default: `false`.
+
+When enabled (via config or the `--debug` CLI flag):
+- Creates JSON Lines (`.jsonl`) log files with complete debugging context
+- Logs: session info, CLI params, service config, CDM details, authentication, titles, tracks metadata,
+  DRM operations, vault queries, errors with stack traces
+- File location: `logs/unshackle_debug_{service}_{timestamp}.jsonl`
+
+---
+
+## debug_keys (bool)
+
+Log decryption keys in debug logs. Default: `false`.
+
+When `true`, actual content encryption keys (CEKs) are included in debug log output. Useful for
+debugging key retrieval and decryption issues.
+
+**Security note:** Passwords, tokens, cookies, and session tokens are always redacted regardless
+of this setting. Only content keys (`content_key`, `key` fields) are affected. Key IDs (`kid`),
+key counts, and other metadata are always logged.
+
+---

docs/SUBTITLE_CONFIG.md

@@ -6,8 +6,8 @@ This document covers subtitle processing and formatting options.
 
 Control subtitle conversion and SDH (hearing-impaired) stripping behavior.
 
-- `conversion_method`: How to convert subtitles between formats. Default: `pysubs2`.
+- `conversion_method`: How to convert subtitles between formats. Default: `auto`.
-  - `auto`: Use subby for WebVTT/SAMI, standard for others.
+  - `auto`: Smart routing - use subby for WebVTT/SAMI, pycaption for others.
   - `subby`: Always use subby with CommonIssuesFixer.
   - `subtitleedit`: Prefer SubtitleEdit when available; otherwise fallback to standard conversion.
   - `pycaption`: Use only the pycaption library (no SubtitleEdit, no subby).
@@ -23,17 +23,30 @@ Control subtitle conversion and SDH (hearing-impaired) stripping behavior.
 
 - `convert_before_strip`: When using `filter-subs` SDH method, automatically convert subtitles to SRT format first for better compatibility. Default: `true`.
 
-- `preserve_formatting`: Keep original subtitle tags and positioning during conversion. Default: `true`.
+- `preserve_formatting`: Keep original subtitle tags and positioning during conversion. When true, skips pycaption processing for WebVTT files to keep tags like `<i>`, `<b>`, and positioning intact. Default: `true`.
+
+- `output_mode`: Controls how subtitles are included in the output. Default: `mux`.
+  - `mux`: Embed subtitles in the MKV container only.
+  - `sidecar`: Save subtitles as separate files only (not muxed into the container).
+  - `both`: Embed subtitles in the MKV container and save as sidecar files.
+
+- `sidecar_format`: Format for sidecar subtitle files (used when `output_mode` is `sidecar` or `both`). Default: `srt`.
+  - `srt`: SubRip format.
+  - `vtt`: WebVTT format.
+  - `ass`: Advanced SubStation Alpha format.
+  - `original`: Keep the subtitle in its current format without conversion.
 
 Example:
 
 ```yaml
 subtitle:
-  conversion_method: pysubs2
+  conversion_method: auto
   sdh_method: auto
   strip_sdh: true
   convert_before_strip: true
   preserve_formatting: true
+  output_mode: mux
+  sidecar_format: srt
 ```
 
 ---

unshackle/core/session.py

@@ -150,7 +150,7 @@ def session(
         browser: Browser to impersonate (e.g. "chrome124", "firefox", "safari") OR
                  fingerprint preset name (e.g. "okhttp4").
                  Uses the configured default from curl_impersonate.browser if not specified.
-                 Available presets: okhttp4
+                 Available presets: okhttp4, okhttp5
                  See https://github.com/lexiforest/curl_cffi#sessions for browser options.
         ja3: Custom JA3 TLS fingerprint string (format: "SSLVersion,Ciphers,Extensions,Curves,PointFormats").
              When provided, curl_cffi will use this exact TLS fingerprint instead of the browser's default.
@@ -172,7 +172,7 @@ def session(
                   - cert: Client certificate (str or tuple)
 
                   Extra arguments for retry handler:
-                  - max_retries: Maximum number of retries (int, default 10)
+                  - max_retries: Maximum number of retries (int, default 5)
                   - backoff_factor: Backoff factor (float, default 0.2)
                   - max_backoff: Maximum backoff time (float, default 60.0)
                   - status_forcelist: List of status codes to force retry (list, default [429, 500, 502, 503, 504])