Merge branch 'fix/review-2026-07-02-stack'

Whole-stack review round 2: repair the broken comment button (CR1) and close
the unauthenticated export-archive leak (CR2); read-only ban model + failed-
compression cleanup + live SSE eviction (H1/H2/H3); config validation, a11y,
and hygiene (medium/low). Includes re-review follow-ups: ban guard on
edit/delete handlers, KNOWN_EVENTS registration for user-hidden/comment-deleted,
and a strengthened real-export leak test (+ truncate export-dir isolation).

Verified: backend 35 unit tests; svelte-check 0 errors; full chromium e2e
143 passed / 2 skipped / 0 failed.

.env.example

@@ -32,6 +32,9 @@ EVENT_SLUG=max-maria-2026
 
 # ── Storage ───────────────────────────────────────────────────────────────────
 MEDIA_PATH=/media
+# Export archives (Gallery.zip / Memories.zip). MUST be outside MEDIA_PATH —
+# /media is publicly served, so exports here would be downloadable without auth.
+EXPORT_PATH=/exports
 
 # ── Upload limits ─────────────────────────────────────────────────────────────
 DEFAULT_MAX_IMAGE_SIZE_MB=20

.gitignore

@@ -22,6 +22,9 @@ e2e/playwright-report/
 e2e/test-results/
 e2e/.cache/
 e2e/.env.test
+# Playwright artifacts when run from the repo root instead of e2e/
+/test-results/
+/playwright-report/
 
 # OS
 .DS_Store

backend/Dockerfile

@@ -20,15 +20,17 @@ FROM alpine:3.21
 
 RUN apk add --no-cache ca-certificates ffmpeg
 
-# Run as a non-root user. Pre-create and chown the media mount path so the fresh
+# Run as a non-root user. Pre-create and chown the media + export mount paths so
-# named volume inherits the non-root ownership (Docker seeds an empty named volume
+# the fresh named volumes inherit the non-root ownership (Docker seeds an empty
-# from the image directory, preserving its uid/gid) and uploads can be written.
+# named volume from the image directory, preserving its uid/gid) and uploads +
+# export archives can be written. Exports live OUTSIDE /media on purpose so the
+# public media ServeDir can't reach them.
 RUN addgroup -S app && adduser -S app -G app
 
 WORKDIR /app
 COPY --from=builder /app/target/release/eventsnap-backend ./
 
-RUN mkdir -p /media && chown -R app:app /app /media
+RUN mkdir -p /media /exports && chown -R app:app /app /media /exports
 USER app
 
 EXPOSE 3000

backend/src/auth/middleware.rs

@@ -13,6 +13,10 @@ pub struct AuthUser {
     pub user_id: Uuid,
     pub event_id: Uuid,
     pub role: UserRole,
+    /// Live ban flag. Banned users keep *read* access (per USER_JOURNEYS §10), so
+    /// the base extractor does NOT reject them — write handlers and the
+    /// Require{Host,Admin} extractors enforce the ban instead.
+    pub is_banned: bool,
     pub token_hash: String,
 }
 
@@ -45,15 +49,13 @@ impl FromRequestParts<AppState> for AuthUser {
 
         // Trust *live* DB state, not the JWT: a role/ban stored in the token would
         // survive a demote/ban for the full session lifetime (up to 30d). Re-read
-        // the user row so a demoted host loses host powers and a banned user is
+        // the user row so a demoted host loses host powers immediately. We do NOT
-        // locked out immediately on their next request.
+        // reject banned users here — they retain read access by design; writes and
+        // host/admin actions enforce the ban downstream.
         let user = crate::models::user::User::find_by_id(&state.pool, claims.sub)
             .await
             .map_err(|e| AppError::Internal(e.into()))?
             .ok_or_else(|| AppError::Unauthorized("Benutzer nicht gefunden.".into()))?;
-        if user.is_banned {
-            return Err(AppError::Forbidden("Dein Zugang wurde gesperrt.".into()));
-        }
 
         // Update last_seen_at in the background (fire-and-forget). Failures are
         // non-fatal but worth surfacing — silent swallowing hides DB connection
@@ -70,6 +72,7 @@ impl FromRequestParts<AppState> for AuthUser {
             user_id: user.id,
             event_id: user.event_id,
             role: user.role,
+            is_banned: user.is_banned,
             token_hash,
         })
     }
@@ -86,6 +89,9 @@ impl FromRequestParts<AppState> for RequireHost {
         state: &AppState,
     ) -> Result<Self, Self::Rejection> {
         let auth = AuthUser::from_request_parts(parts, state).await?;
+        if auth.is_banned {
+            return Err(AppError::Forbidden("Du bist gesperrt.".into()));
+        }
         match auth.role {
             UserRole::Host | UserRole::Admin => Ok(Self(auth)),
             _ => Err(AppError::Forbidden("Nur für Hosts und Admins.".into())),
@@ -104,6 +110,9 @@ impl FromRequestParts<AppState> for RequireAdmin {
         state: &AppState,
     ) -> Result<Self, Self::Rejection> {
         let auth = AuthUser::from_request_parts(parts, state).await?;
+        if auth.is_banned {
+            return Err(AppError::Forbidden("Du bist gesperrt.".into()));
+        }
         match auth.role {
             UserRole::Admin => Ok(Self(auth)),
             _ => Err(AppError::Forbidden("Nur für Admins.".into())),

backend/src/config.rs

@@ -56,7 +56,13 @@ pub struct AppConfig {
     pub event_name: String,
     pub event_slug: String,
     pub media_path: PathBuf,
+    /// Where export archives are written. MUST be outside `media_path` — that
+    /// directory is served by a public `ServeDir`, so a predictable archive name
+    /// under it would leak the whole gallery to anonymous visitors.
+    pub export_path: PathBuf,
     pub app_port: u16,
+    /// Number of concurrent media compression workers (read once at boot).
+    pub compression_concurrency: usize,
 }
 
 impl AppConfig {
@@ -86,10 +92,18 @@ impl AppConfig {
             media_path: PathBuf::from(
                 std::env::var("MEDIA_PATH").unwrap_or_else(|_| "/media".to_string()),
             ),
+            export_path: PathBuf::from(
+                std::env::var("EXPORT_PATH").unwrap_or_else(|_| "/exports".to_string()),
+            ),
             app_port: std::env::var("APP_PORT")
                 .unwrap_or_else(|_| "3000".to_string())
                 .parse()
                 .context("APP_PORT must be a number")?,
+            compression_concurrency: std::env::var("COMPRESSION_WORKER_CONCURRENCY")
+                .ok()
+                .and_then(|v| v.parse().ok())
+                .filter(|&n| n >= 1)
+                .unwrap_or(2),
         })
     }
 }

backend/src/handlers/admin.rs

@@ -121,15 +121,18 @@ pub async fn patch_config(
     // Numeric keys validated as f64; boolean keys validated as truthy strings; the
     // privacy note is free text. Splitting these explicitly is verbose but makes the
     // failure mode for typos obvious (`Unbekannter Schlüssel: ...`).
-    const NUMERIC_KEYS: &[&str] = &[
+    // (key, integer_only, min, max). Ranges reject values that `parse::<f64>` would
-        "max_image_size_mb",
+    // accept but that silently revert to the hardcoded default at read time
-        "max_video_size_mb",
+    // (get_usize/get_i64 can't parse negatives/NaN/fractionals). `compression_concurrency`
-        "upload_rate_per_hour",
+    // is intentionally absent — it's read once at boot, so a live edit was a no-op.
-        "feed_rate_per_min",
+    const NUMERIC_SPECS: &[(&str, bool, f64, f64)] = &[
-        "export_rate_per_day",
+        ("max_image_size_mb", true, 1.0, 1024.0),
-        "quota_tolerance",
+        ("max_video_size_mb", true, 1.0, 10240.0),
-        "estimated_guest_count",
+        ("upload_rate_per_hour", true, 1.0, 100_000.0),
-        "compression_concurrency",
+        ("feed_rate_per_min", true, 1.0, 100_000.0),
+        ("export_rate_per_day", true, 1.0, 100_000.0),
+        ("quota_tolerance", false, 0.0, 1.0),
+        ("estimated_guest_count", true, 1.0, 1_000_000.0),
     ];
     const BOOL_KEYS: &[&str] = &[
         "rate_limits_enabled",
@@ -150,10 +153,26 @@ pub async fn patch_config(
     // update behind — validation must fully precede any write.
     for (key, value) in &body {
         let key_str = key.as_str();
-        if NUMERIC_KEYS.contains(&key_str) {
+        if let Some(&(_, integer_only, min, max)) =
-            if value.parse::<f64>().is_err() {
+            NUMERIC_SPECS.iter().find(|(k, ..)| *k == key_str)
+        {
+            let n = value.trim().parse::<f64>().ok().filter(|n| n.is_finite());
+            let n = match n {
+                Some(n) => n,
+                None => {
+                    return Err(AppError::BadRequest(format!(
+                        "Ungültiger Wert für {key}: muss eine Zahl sein."
+                    )))
+                }
+            };
+            if integer_only && n.fract() != 0.0 {
                 return Err(AppError::BadRequest(format!(
-                    "Ungültiger Wert für {key}: muss eine Zahl sein."
+                    "Ungültiger Wert für {key}: muss eine ganze Zahl sein."
+                )));
+            }
+            if n < min || n > max {
+                return Err(AppError::BadRequest(format!(
+                    "Wert für {key} liegt außerhalb des zulässigen Bereichs ({min}–{max})."
                 )));
             }
         } else if BOOL_KEYS.contains(&key_str) {
@@ -282,7 +301,7 @@ pub async fn download_zip(
         ));
     }
 
-    let path = state.config.media_path.join("exports").join("Gallery.zip");
+    let path = state.config.export_path.join("Gallery.zip");
     if !path.exists() {
         return Err(AppError::NotFound("Exportdatei nicht gefunden.".into()));
     }
@@ -308,7 +327,7 @@ pub async fn download_html(
         ));
     }
 
-    let path = state.config.media_path.join("exports").join("Memories.zip");
+    let path = state.config.export_path.join("Memories.zip");
     if !path.exists() {
         return Err(AppError::NotFound("Exportdatei nicht gefunden.".into()));
     }

backend/src/handlers/host.rs

@@ -121,6 +121,15 @@ pub async fn ban_user(
     .execute(&state.pool)
     .await?;
 
+    // If we hid their uploads, evict them live from every feed + the diashow so a
+    // banned guest's content disappears without each viewer having to reload.
+    if body.hide_uploads {
+        let _ = state.sse_tx.send(SseEvent::new(
+            "user-hidden",
+            serde_json::json!({ "user_id": user_id }).to_string(),
+        ));
+    }
+
     tracing::info!(
         actor_user_id = %auth.user_id,
         target_user_id = %user_id,
@@ -329,6 +338,10 @@ pub async fn host_delete_comment(
     if !deleted {
         return Err(AppError::NotFound("Kommentar nicht gefunden.".into()));
     }
+    let _ = state.sse_tx.send(SseEvent::new(
+        "comment-deleted",
+        serde_json::json!({ "comment_id": comment_id }).to_string(),
+    ));
     tracing::info!(
         actor_user_id = %auth.user_id,
         event_id = %auth.event_id,
@@ -380,19 +393,33 @@ pub async fn release_gallery(
     State(state): State<AppState>,
     RequireHost(_auth): RequireHost,
 ) -> Result<StatusCode, AppError> {
+    // Atomic claim: the conditional UPDATE is the sole gate, so two concurrent
+    // release calls can't both pass a check-then-set and double-enqueue exports.
+    // rows_affected == 0 means someone already released.
+    let result = sqlx::query(
+        "UPDATE event SET export_released_at = NOW()
+         WHERE slug = $1 AND export_released_at IS NULL",
+    )
+    .bind(&state.config.event_slug)
+    .execute(&state.pool)
+    .await?;
+    if result.rows_affected() == 0 {
+        // Distinguish "no such event" from "already released" for a clean error.
+        let exists = Event::find_by_slug(&state.pool, &state.config.event_slug)
+            .await?
+            .is_some();
+        return Err(if exists {
+            AppError::BadRequest("Galerie wurde bereits freigegeben.".into())
+        } else {
+            AppError::NotFound("Event nicht gefunden.".into())
+        });
+    }
+
+    // We won the claim — load the event for its id/name to enqueue export jobs.
     let event = Event::find_by_slug(&state.pool, &state.config.event_slug)
         .await?
         .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
 
-    if event.export_released_at.is_some() {
-        return Err(AppError::BadRequest("Galerie wurde bereits freigegeben.".into()));
-    }
-
-    sqlx::query("UPDATE event SET export_released_at = NOW() WHERE slug = $1")
-        .bind(&state.config.event_slug)
-        .execute(&state.pool)
-        .await?;
-
     // Enqueue export jobs
     for export_type in ["zip", "html"] {
         sqlx::query(
@@ -411,6 +438,7 @@ pub async fn release_gallery(
         event.name,
         state.pool.clone(),
         state.config.media_path.clone(),
+        state.config.export_path.clone(),
         state.sse_tx.clone(),
     );
 

backend/src/handlers/social.rs

@@ -199,6 +199,10 @@ pub async fn delete_comment(
     auth: AuthUser,
     Path(comment_id): Path<Uuid>,
 ) -> Result<StatusCode, AppError> {
+    // Banned users keep read access but cannot mutate (USER_JOURNEYS §10).
+    if auth.is_banned {
+        return Err(AppError::Forbidden("Du bist gesperrt.".into()));
+    }
     let comment = Comment::find_by_id(&state.pool, comment_id)
         .await?
         .ok_or_else(|| AppError::NotFound("Kommentar nicht gefunden.".into()))?;
@@ -213,5 +217,9 @@ pub async fn delete_comment(
     if !deleted {
         return Err(AppError::NotFound("Kommentar nicht gefunden.".into()));
     }
+    let _ = state.sse_tx.send(crate::state::SseEvent::new(
+        "comment-deleted",
+        serde_json::json!({ "comment_id": comment_id, "upload_id": comment.upload_id }).to_string(),
+    ));
     Ok(StatusCode::NO_CONTENT)
 }

backend/src/handlers/sse.rs

@@ -48,10 +48,10 @@ pub async fn stream(
         .consume(&q.ticket)
         .ok_or_else(|| AppError::Unauthorized("Ticket ungültig oder abgelaufen.".into()))?;
 
-    // NOTE: this authenticates via ticket→session, not the `AuthUser` extractor, so
+    // NOTE: this authenticates via ticket→session, not the `AuthUser` extractor. The
-    // it does not re-check `is_banned`. A user banned mid-stream keeps receiving
+    // SSE stream is read-only, and under the read-only-ban model (USER_JOURNEYS §10)
-    // events until the connection drops; they cannot reconnect (issue_ticket uses
+    // banned users retain read access — so both minting a ticket and holding a stream
-    // AuthUser, which rejects banned users). Documented in docs/SECURITY-BACKLOG.md.
+    // open are intentionally allowed for banned users; only writes are blocked.
     Session::find_by_token_hash(&state.pool, &token_hash)
         .await
         .map_err(|e| AppError::Internal(e.into()))?

backend/src/handlers/test_admin.rs

@@ -70,6 +70,12 @@ pub async fn truncate_all(
     let _ = tokio::fs::remove_dir_all(&state.config.media_path).await;
     let _ = tokio::fs::create_dir_all(&state.config.media_path).await;
 
+    // Wipe the export directory too. Exports moved OUT of media_path (CR2 fix), so
+    // the media wipe above no longer covers them — without this a real export in
+    // one test would leave Gallery.zip on disk and contaminate the next.
+    let _ = tokio::fs::remove_dir_all(&state.config.export_path).await;
+    let _ = tokio::fs::create_dir_all(&state.config.export_path).await;
+
     // The rate limiter holds an in-memory HashMap; clear it so a previous test's
     // counters don't leak into the next one.
     state.rate_limiter.clear();

backend/src/handlers/upload.rs

@@ -272,6 +272,10 @@ pub async fn edit_upload(
     Path(upload_id): Path<Uuid>,
     Json(body): Json<EditUploadRequest>,
 ) -> Result<StatusCode, AppError> {
+    // Banned users keep read access but cannot mutate (USER_JOURNEYS §10).
+    if auth.is_banned {
+        return Err(AppError::Forbidden("Du bist gesperrt.".into()));
+    }
     let upload = Upload::find_by_id_and_event(&state.pool, upload_id, auth.event_id)
         .await?
         .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
@@ -303,6 +307,10 @@ pub async fn delete_upload(
     auth: AuthUser,
     Path(upload_id): Path<Uuid>,
 ) -> Result<StatusCode, AppError> {
+    // Banned users keep read access but cannot mutate (USER_JOURNEYS §10).
+    if auth.is_banned {
+        return Err(AppError::Forbidden("Du bist gesperrt.".into()));
+    }
     let upload = Upload::find_by_id_and_event(&state.pool, upload_id, auth.event_id)
         .await?
         .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
@@ -313,6 +321,14 @@ pub async fn delete_upload(
 
     Upload::soft_delete_in_event(&state.pool, upload_id, auth.event_id).await?;
 
+    // Evict the card live on every other feed + the projector diashow — otherwise
+    // a self-deleted post lingers until each viewer manually reloads. Same event
+    // the host-delete path already emits and the frontend already handles.
+    let _ = state.sse_tx.send(crate::state::SseEvent::new(
+        "upload-deleted",
+        serde_json::json!({ "upload_id": upload_id }).to_string(),
+    ));
+
     Ok(StatusCode::NO_CONTENT)
 }
 

backend/src/services/compression.rs

@@ -42,11 +42,28 @@ impl CompressionWorker {
                 }
                 Err(e) => {
                     tracing::error!("compression failed for upload {upload_id}: {e:#}");
+                    // Auto-cleanup: a failed transcode would otherwise leave a
+                    // permanently broken feed card, silently charge the uploader's
+                    // quota, and orphan the original on disk. Refund + soft-delete
+                    // (one tx, so v_feed excludes it), remove the orphan file, then
+                    // tell the uploader (upload-error toast) and evict the card
+                    // everywhere (upload-deleted, already handled by the feed).
+                    let _ = Upload::set_compression_status(&worker.pool, upload_id, "failed").await;
+                    if let Err(del) = Upload::soft_delete(&worker.pool, upload_id).await {
+                        tracing::warn!(error = ?del, %upload_id, "failed to soft-delete after compression failure");
+                    }
+                    let orphan = worker.media_path.join(&original_path);
+                    if let Err(rm) = tokio::fs::remove_file(&orphan).await {
+                        tracing::warn!(error = ?rm, path = %orphan.display(), "failed to remove orphaned original");
+                    }
                     let _ = worker.sse_tx.send(SseEvent {
                         event_type: "upload-error".to_string(),
                         data: serde_json::json!({ "upload_id": upload_id, "error": e.to_string() }).to_string(),
                     });
-                    let _ = Upload::set_compression_status(&worker.pool, upload_id, "failed").await;
+                    let _ = worker.sse_tx.send(SseEvent {
+                        event_type: "upload-deleted".to_string(),
+                        data: serde_json::json!({ "upload_id": upload_id }).to_string(),
+                    });
                 }
             }
         });

backend/src/services/export.rs

@@ -87,15 +87,17 @@ pub fn spawn_export_jobs(
     event_name: String,
     pool: PgPool,
     media_path: PathBuf,
+    export_path: PathBuf,
     sse_tx: broadcast::Sender<SseEvent>,
 ) {
     let pool2 = pool.clone();
     let media_path2 = media_path.clone();
+    let export_path2 = export_path.clone();
     let sse_tx2 = sse_tx.clone();
     let event_name2 = event_name.clone();
 
     tokio::spawn(async move {
-        if let Err(e) = run_zip_export(event_id, &pool, &media_path, &sse_tx).await {
+        if let Err(e) = run_zip_export(event_id, &pool, &media_path, &export_path, &sse_tx).await {
             tracing::error!("ZIP export failed for event {event_id}: {e:#}");
             mark_failed(&pool, event_id, "zip", &e.to_string()).await;
         }
@@ -104,7 +106,7 @@ pub fn spawn_export_jobs(
 
     tokio::spawn(async move {
         if let Err(e) =
-            run_html_export(event_id, &event_name2, &pool2, &media_path2, &sse_tx2).await
+            run_html_export(event_id, &event_name2, &pool2, &media_path2, &export_path2, &sse_tx2).await
         {
             tracing::error!("HTML export failed for event {event_id}: {e:#}");
             mark_failed(&pool2, event_id, "html", &e.to_string()).await;
@@ -119,6 +121,7 @@ async fn run_zip_export(
     event_id: Uuid,
     pool: &PgPool,
     media_path: &Path,
+    export_path: &Path,
     sse_tx: &broadcast::Sender<SseEvent>,
 ) -> Result<()> {
     mark_running(pool, event_id, "zip").await;
@@ -126,7 +129,8 @@ async fn run_zip_export(
     let uploads = query_uploads(pool, event_id).await?;
     let total = uploads.len().max(1) as f32;
 
-    let exports_dir = media_path.join("exports");
+    // Written OUTSIDE media_path: the public /media ServeDir must never reach these.
+    let exports_dir = export_path.to_path_buf();
     tokio::fs::create_dir_all(&exports_dir).await?;
 
     let tmp_path = exports_dir.join("Gallery.zip.tmp");
@@ -193,6 +197,7 @@ async fn run_html_export(
     event_name: &str,
     pool: &PgPool,
     media_path: &Path,
+    export_path: &Path,
     sse_tx: &broadcast::Sender<SseEvent>,
 ) -> Result<()> {
     mark_running(pool, event_id, "html").await;
@@ -205,7 +210,8 @@ async fn run_html_export(
 
     update_progress(pool, event_id, "html", 5).await;
 
-    let exports_dir = media_path.join("exports");
+    // Written OUTSIDE media_path: the public /media ServeDir must never reach these.
+    let exports_dir = export_path.to_path_buf();
     tokio::fs::create_dir_all(&exports_dir).await?;
 
     // 2. Create temp directory for media processing

backend/src/state.rs

@@ -36,8 +36,12 @@ pub struct AppState {
 impl AppState {
     pub fn new(pool: PgPool, config: AppConfig) -> Self {
         let (sse_tx, _) = broadcast::channel(256);
-        let compression =
+        let compression = CompressionWorker::new(
-            CompressionWorker::new(pool.clone(), config.media_path.clone(), 2, sse_tx.clone());
+            pool.clone(),
+            config.media_path.clone(),
+            config.compression_concurrency,
+            sse_tx.clone(),
+        );
         Self {
             pool,
             config,

docker-compose.yml

@@ -34,6 +34,9 @@ services:
         condition: service_healthy
     volumes:
       - media_data:/media
+      # Export archives live OUTSIDE /media so the public media ServeDir can't
+      # serve them — downloads go only through the ticket-gated handler.
+      - exports_data:/exports
     expose:
       - "3000"
     healthcheck:
@@ -96,4 +99,5 @@ services:
 volumes:
   postgres_data:
   media_data:
+  exports_data:
   caddy_data:

docs/SECURITY-BACKLOG.md

@@ -64,8 +64,11 @@ decompression-bomb cap (`image::Limits` 12000×12000 / 256 MiB) lives in
   (not just the exact dev sentinel) and enforces `len ≥ 32` unconditionally in prod.
 - **Unspoofable client IP in the rate limiter** — `client_ip` now takes the right-most
   `X-Forwarded-For` entry (the hop Caddy appends), so a client-supplied left-most value is ignored.
-- **Live role/ban re-check** — the auth extractor re-reads the user row and trusts the DB role and
+- **Live role/ban re-check** — the auth extractor re-reads the user row and trusts the DB `role`
-  `is_banned` flag rather than the JWT claim, revoking demoted/banned sessions immediately.
+  and `is_banned` flag rather than the JWT claim, so a demote/ban takes effect immediately (no
+  30-day token window). Bans are enforced on write handlers + the host/admin extractors, preserving
+  the documented read-only access for banned guests (USER_JOURNEYS §10); demoted hosts lose host
+  powers at once.
 - **Container healthchecks** — `app` and `frontend` now have healthchecks and Caddy waits on
   `service_healthy`.
 - **Event-scoped `ban_user`** — the ban UPDATE is now scoped by `event_id` like its siblings.

docs/USER_JOURNEYS.md

@@ -147,12 +147,18 @@ the Host can clean up later).
 
 ## 10. Banned-guest experience
 
-1. The banned user's next authenticated request returns HTTP 403 with a clear message
+1. The ban takes effect immediately on the banned user's existing session — the auth
-   ("Du bist gesperrt.").
+   layer re-reads the live `is_banned` flag on every request rather than trusting the
-2. They can still browse the read-only feed (and download the export once it's released).
+   JWT, so there's no 30-day token-lifetime window.
-3. They cannot upload, like, or comment.
+2. Their next authenticated *write* request returns HTTP 403 with a clear message
-4. If `hide_uploads` was set on the ban, their existing uploads are filtered out of the
+   ("Du bist gesperrt."). Ban enforcement lives on the write handlers and the
-   feed for everyone (the `v_feed` view already enforces this).
+   host/admin extractors, not the base auth extractor.
+3. They can still browse the read-only feed (and download the export once it's released).
+4. They cannot upload, like, or comment; a banned host also loses all host/admin
+   actions (including unbanning themselves).
+5. If `hide_uploads` was set on the ban, their existing uploads are filtered out of the
+   feed for everyone (`v_feed` enforces this), and a live `user-hidden` SSE event evicts
+   their cards from every open feed + the diashow without a reload.
 
 ## 11. Admin — instance configuration
 

e2e/Caddyfile.test

@@ -4,7 +4,17 @@
 # of HTTPS/Let's Encrypt.
 
 :3101 {
-    encode zstd gzip
+    # Mirror prod: exclude the SSE stream from compression so buffering doesn't
+    # delay real-time events (and so the test stack exercises the real behavior).
+    @compressible not path /api/v1/stream
+    encode @compressible zstd gzip
+
+    # Mirror prod's security headers (minus HSTS, which is HTTPS-only).
+    header {
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "DENY"
+        Referrer-Policy "strict-origin-when-cross-origin"
+    }
 
     reverse_proxy /api/* app:3000
     reverse_proxy /media/* app:3000

e2e/helpers/seed.ts

@@ -3,11 +3,26 @@
  * flow. Centralising the API contract (routes, field names, expected statuses)
  * means an API change is a one-file edit, not a 7-file hunt.
  */
-import { uploadRaw, JPEG_MAGIC } from './upload-client';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { uploadRaw } from './upload-client';
 import { db } from '../fixtures/db';
 
 const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
 
+// A real, decodable JPEG. Magic-bytes-only fakes now get auto-cleaned by the
+// backend when compression fails (a failed transcode refunds quota + deletes the
+// row), which would delete the seeded upload out from under the test. Read lazily
+// at call time (cwd is the e2e dir at runtime, like the gallery-path spec) so test
+// collection can't trip on a module-load read.
+let sampleJpg: Buffer | null = null;
+function sampleImage(): Buffer {
+  if (!sampleJpg) {
+    sampleJpg = readFileSync(join(process.cwd(), 'fixtures', 'media', 'sample.jpg'));
+  }
+  return sampleJpg;
+}
+
 export type SeedUploadOptions = {
   caption?: string;
   /** Mark compression done so the card is fully rendered in the feed. Default true. */
@@ -16,9 +31,7 @@ export type SeedUploadOptions = {
 
 /** Seed a real, accepted upload owned by `jwt` and return its id. */
 export async function seedUpload(jwt: string, opts: SeedUploadOptions = {}): Promise<string> {
-  const body = new Uint8Array(1024);
+  const res = await uploadRaw(jwt, sampleImage(), {
-  body.set(JPEG_MAGIC, 0);
-  const res = await uploadRaw(jwt, body, {
     filename: 'a.jpg',
     contentType: 'image/jpeg',
     caption: opts.caption,

e2e/specs/03-feed/comment-ui.spec.ts

@@ -0,0 +1,53 @@
+/**
+ * Regression for the review's CR1: the LightboxModal posted comments to
+ * `/upload/{id}/comment` (singular) while the only route is `/comments` (plural),
+ * so every comment submitted through the UI 404'd and was silently lost. The
+ * earlier "comment → SSE" spec passed by posting via a fetch helper, bypassing
+ * the component — a false green. This drives the real component end-to-end.
+ */
+import { test, expect } from '../../fixtures/test';
+import { seedUpload } from '../../helpers/seed';
+
+const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+
+test.describe('Comments — UI round-trip (CR1)', () => {
+  test('a comment typed in the lightbox persists to the backend', async ({
+    page,
+    guest,
+    signIn,
+  }) => {
+    const author = await guest('CommentAuthor');
+    const commenter = await guest('Commenter');
+    const uploadId = await seedUpload(author.jwt, { caption: 'Comment target' });
+
+    await signIn(page, commenter);
+    await page.goto('/feed');
+
+    // Open the lightbox. Only one upload exists, so the first open-button is it.
+    const imageButton = page.getByRole('button', { name: 'Bild vergrößern' }).first();
+    await expect(imageButton).toBeVisible({ timeout: 15_000 });
+    await imageButton.click();
+
+    const lightbox = page.locator('[role="dialog"][aria-labelledby="lightbox-title"]');
+    await expect(lightbox).toBeVisible();
+
+    const text = `Wunderschönes Foto ${Date.now()}`;
+    await lightbox.getByPlaceholder(/kommentar/i).fill(text);
+    await lightbox.getByRole('button', { name: /senden/i }).click();
+
+    // The component appends the comment only on a 2xx — with the old singular path
+    // it threw and nothing appeared. Assert it's visible in the panel...
+    await expect(lightbox.getByText(text)).toBeVisible();
+
+    // ...and that it actually persisted server-side (the crux CR1 broke).
+    await expect
+      .poll(async () => {
+        const res = await fetch(`${BASE}/api/v1/upload/${uploadId}/comments`, {
+          headers: { Authorization: `Bearer ${commenter.jwt}` },
+        });
+        const body = await res.json();
+        return Array.isArray(body) && body.some((c: { body: string }) => c.body === text);
+      })
+      .toBe(true);
+  });
+});

e2e/specs/04-host/moderation.spec.ts

@@ -4,6 +4,7 @@
  * coverage of the buttons lives in a separate UI-focused spec.
  */
 import { test, expect } from '../../fixtures/test';
+import { seedUpload, seedComment } from '../../helpers/seed';
 
 test.describe('Host — moderation API', () => {
   test('ban with hide_uploads=true sets the right flags', async ({ api, host, guest }) => {
@@ -97,4 +98,59 @@ test.describe('Host — live role/ban revocation (H1)', () => {
       api.unbanUser(host.jwt, host.userId, { expectedStatus: [204] })
     ).rejects.toThrow(/→ 403/);
   });
+
+  // H1 / USER_JOURNEYS §10: a banned user keeps *read* access but every write is
+  // rejected with 403. The ban is enforced on write handlers + Require{Host,Admin},
+  // NOT in the base extractor (which would wrongly block reads too).
+  test('a banned user keeps read access but is blocked from writes', async ({ api, host, guest }) => {
+    const base = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+    const target = await guest('BannedRW');
+    const auth = (jwt: string) => ({ Authorization: `Bearer ${jwt}` });
+
+    // Seed content the target OWNS *before* the ban, so the delete/edit paths get
+    // past the ownership check and it's genuinely the ban guard being exercised.
+    const ownUpload = await seedUpload(target.jwt, { caption: 'mine' });
+    const ownComment = await seedComment(target.jwt, ownUpload, 'my comment');
+
+    await api.banUser(host.jwt, target.userId, false);
+
+    // Reads still succeed.
+    const read = await fetch(base + '/api/v1/me/context', { headers: auth(target.jwt) });
+    expect(read.status).toBe(200);
+
+    // Every write is rejected — cover ALL guest-reachable mutations, not just
+    // /upload. delete_upload / delete_comment / edit_upload previously skipped the
+    // ban guard (a banned owner could still delete/edit their own content).
+    const create = await fetch(base + '/api/v1/upload', {
+      method: 'POST',
+      headers: auth(target.jwt),
+      body: new FormData(),
+    });
+    expect(create.status).toBe(403);
+
+    const delUpload = await fetch(base + `/api/v1/upload/${ownUpload}`, {
+      method: 'DELETE',
+      headers: auth(target.jwt),
+    });
+    expect(delUpload.status).toBe(403);
+
+    const editUpload = await fetch(base + `/api/v1/upload/${ownUpload}`, {
+      method: 'PATCH',
+      headers: { ...auth(target.jwt), 'Content-Type': 'application/json' },
+      body: JSON.stringify({ caption: 'edited while banned' }),
+    });
+    expect(editUpload.status).toBe(403);
+
+    const delComment = await fetch(base + `/api/v1/comment/${ownComment}`, {
+      method: 'DELETE',
+      headers: auth(target.jwt),
+    });
+    expect(delComment.status).toBe(403);
+
+    // The upload survived every blocked write (still fetchable via the feed).
+    const feed = await fetch(base + '/api/v1/feed', { headers: auth(host.jwt) });
+    const body = await feed.json();
+    const rows = body.uploads ?? body.items ?? body;
+    expect(Array.isArray(rows) && rows.some((u: any) => u.id === ownUpload)).toBe(true);
+  });
 });

e2e/specs/04-host/sse-eviction.spec.ts

@@ -0,0 +1,75 @@
+/**
+ * Regression for the review's H3: self-deleting an upload and banning a user with
+ * hide_uploads mutated visibility server-side but broadcast nothing, so the
+ * content lingered on every other viewer's feed (and the projector diashow) until
+ * a manual reload. Both now emit SSE so clients evict live.
+ */
+import { test, expect } from '../../fixtures/test';
+import { seedUpload } from '../../helpers/seed';
+import { SseListener } from '../../helpers/sse-listener';
+
+const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+
+test.describe('Host — live SSE eviction (H3)', () => {
+  test('self-deleting an upload broadcasts upload-deleted', async ({ guest }) => {
+    const g = await guest('SelfDeleter');
+    const uploadId = await seedUpload(g.jwt, { caption: 'delete me' });
+
+    const sse = new SseListener();
+    await sse.start(g.jwt);
+
+    const res = await fetch(`${BASE}/api/v1/upload/${uploadId}`, {
+      method: 'DELETE',
+      headers: { Authorization: `Bearer ${g.jwt}` },
+    });
+    expect(res.status).toBe(204);
+
+    await sse.waitForEvent(
+      'upload-deleted',
+      (e) => e.data.upload_id === uploadId
+    );
+  });
+
+  test('banning a user with hide_uploads broadcasts user-hidden', async ({
+    api,
+    host,
+    guest,
+  }) => {
+    const target = await guest('HideTarget');
+    await seedUpload(target.jwt, { caption: 'should vanish' });
+
+    const sse = new SseListener();
+    await sse.start(host.jwt);
+
+    await api.banUser(host.jwt, target.userId, true);
+
+    await sse.waitForEvent(
+      'user-hidden',
+      (e) => e.data.user_id === target.userId
+    );
+  });
+
+  // Frontend regression: the broadcasts above are inert if the client never
+  // registers the event name (the KNOWN_EVENTS gap that shipped both eviction
+  // handlers as dead code). Drive a real browser feed and assert LIVE eviction —
+  // this fails if 'user-hidden' is missing from KNOWN_EVENTS, unlike the
+  // backend-only SseListener checks above.
+  test('a hidden user is evicted from an open feed without reload (frontend)', async ({
+    page,
+    api,
+    host,
+    guest,
+    signIn,
+  }) => {
+    const viewer = await guest('LiveEvictViewer');
+    const target = await guest('LiveEvictTarget');
+    await seedUpload(target.jwt, { caption: 'evict-me-live-xyz' });
+
+    await signIn(page, viewer); // lands on the event-wide /feed
+    await expect(page.getByText('evict-me-live-xyz').first()).toBeVisible();
+
+    // Host hides the target — the viewer's feed must drop the card via SSE, no reload.
+    await api.banUser(host.jwt, target.userId, true);
+    await expect(page.getByText('evict-me-live-xyz')).toHaveCount(0, { timeout: 15_000 });
+  });
+});

e2e/specs/06-export/export-leak.spec.ts

@@ -0,0 +1,60 @@
+/**
+ * Regression for the review's CR2: export archives (Gallery.zip / Memories.zip)
+ * were written under media_path/exports, and /media is a public ServeDir — so
+ * anyone could GET /media/exports/Gallery.zip and download the whole gallery,
+ * bypassing the ticket + export_*_ready gate. Exports now live OUTSIDE media_path
+ * and are reachable only via the gated /api/v1/export/{zip,html} handlers.
+ *
+ * This drives a REAL export (release → job runs → archive on disk) and then
+ * asserts the archive is NOT public but IS gated. Asserting a 404 on an empty
+ * stack would pass even if exports were still under /media (the file just wouldn't
+ * exist yet) — so we produce a real file first, then prove it can't leak.
+ */
+import { test, expect } from '../../fixtures/test';
+import { seedUpload } from '../../helpers/seed';
+
+const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+
+test.describe('Export — no public leak (CR2)', () => {
+  test('a real export is downloadable only via the gated endpoint, never via /media', async ({
+    host,
+  }) => {
+    test.setTimeout(60_000);
+    const bearer = { Authorization: `Bearer ${host.jwt}` };
+
+    // Seed content so the archive actually contains a file.
+    await seedUpload(host.jwt, { caption: 'in the export' });
+
+    // Host releases the gallery → spawns the real zip/html export jobs.
+    const rel = await fetch(`${BASE}/api/v1/host/gallery/release`, { method: 'POST', headers: bearer });
+    expect(rel.status).toBe(204);
+
+    // Wait for the real zip job to finish writing the archive to disk.
+    await expect
+      .poll(
+        async () => {
+          const res = await fetch(`${BASE}/api/v1/export/status`, { headers: bearer });
+          return (await res.json()).zip?.status;
+        },
+        { timeout: 45_000, intervals: [500] }
+      )
+      .toBe('done');
+
+    // The archive now EXISTS on disk. It must NOT be reachable via public /media…
+    for (const name of ['Gallery.zip', 'Memories.zip']) {
+      const leak = await fetch(`${BASE}/media/exports/${name}`);
+      // A 200 here = the whole-gallery archive is downloadable with no auth (CR2).
+      expect(leak.status, `${name} must not be served from public /media`).toBe(404);
+    }
+
+    // …but IS retrievable via the gated single-use ticket endpoint. This proves the
+    // 404 above means "not public", not merely "no file was produced".
+    const ticketRes = await fetch(`${BASE}/api/v1/export/ticket`, { method: 'POST', headers: bearer });
+    const { ticket } = await ticketRes.json();
+    const dl = await fetch(`${BASE}/api/v1/export/zip?ticket=${encodeURIComponent(ticket)}`);
+    expect(dl.status).toBe(200);
+    // Real ZIP payload: the archive starts with the PK local-file-header magic.
+    const head = new Uint8Array(await dl.arrayBuffer()).subarray(0, 2);
+    expect(Array.from(head)).toEqual([0x50, 0x4b]); // "PK"
+  });
+});

frontend/src/lib/api.ts

@@ -68,6 +68,9 @@ async function request<T>(
 	}
 
 	if (!res.ok) {
+		// An expired/invalid token (401) clears the dead session. Banned users are
+		// NOT logged out — they keep read access by design (USER_JOURNEYS §10) and
+		// simply get a 403 "gesperrt" toast on writes.
 		if (res.status === 401) {
 			clearAuth();
 		}

frontend/src/lib/auth.ts

@@ -83,6 +83,9 @@ export function clearAuth(): void {
 	if (!browser) return;
 	localStorage.removeItem(TOKEN_KEY);
 	localStorage.removeItem(USER_ID_KEY);
+	// Clear the display name too — on a shared device the next user shouldn't see
+	// the previous guest's name pre-filled on /join.
+	localStorage.removeItem(DISPLAY_NAME_KEY);
 	// PIN is intentionally kept so the user can recover
 	isAuthenticated.set(false);
 	// Hooks fire in registration order. Keep them dependency-free of each other —

frontend/src/lib/components/LightboxModal.svelte

@@ -2,6 +2,7 @@
 	import { onDestroy } from 'svelte';
 	import type { FeedUpload } from '$lib/types';
 	import { api } from '$lib/api';
+	import { onSseEvent } from '$lib/sse';
 	import { getUserId } from '$lib/auth';
 	import { dataMode, pickMediaUrl } from '$lib/data-mode-store';
 	import { doubletap } from '$lib/actions/doubletap';
@@ -48,8 +49,18 @@
 		burstTimer = setTimeout(() => (heartBurst = false), 700);
 	}
 
+	// Drop a comment live when it's deleted elsewhere (host moderation or the
+	// author on another device), so the open panel doesn't show a ghost comment.
+	const unsubCommentDeleted = onSseEvent('comment-deleted', (data) => {
+		try {
+			const { comment_id } = JSON.parse(data) as { comment_id: string };
+			comments = comments.filter((c) => c.id !== comment_id);
+		} catch { /* ignore */ }
+	});
+
 	onDestroy(() => {
 		if (burstTimer) clearTimeout(burstTimer);
+		unsubCommentDeleted();
 	});
 
 	// Only refetch when a *different* upload is shown. The feed reassigns the
@@ -74,7 +85,7 @@
 		if (!newComment.trim()) return;
 		loading = true;
 		try {
-			const comment = await api.post<CommentDto>(`/upload/${upload.id}/comment`, {
+			const comment = await api.post<CommentDto>(`/upload/${upload.id}/comments`, {
 				body: newComment.trim()
 			});
 			comments = [...comments, comment];

frontend/src/lib/diashow/queue.ts

@@ -73,6 +73,23 @@ export class SlideQueue {
 		return { wasCurrent: currentId === id };
 	}
 
+	/**
+	 * Remove every slide belonging to a user (banned with hide_uploads). Returns
+	 * true if the current head was one of them so the caller advances immediately.
+	 */
+	removeByUser(userId: string, currentId: string | null): { wasCurrent: boolean } {
+		let wasCurrent = false;
+		for (const [id, slide] of this.allKnown) {
+			if (slide.user_id === userId) {
+				if (id === currentId) wasCurrent = true;
+				this.allKnown.delete(id);
+			}
+		}
+		this.liveQueue = this.liveQueue.filter((s) => s.user_id !== userId);
+		this.shuffleQueue = this.shuffleQueue.filter((s) => s.user_id !== userId);
+		return { wasCurrent };
+	}
+
 	/** Look up a slide by id — for the diashow page to render the current slide. */
 	get(id: string): FeedUpload | undefined {
 		return this.allKnown.get(id);

frontend/src/lib/sse.ts

@@ -38,6 +38,8 @@ const KNOWN_EVENTS = [
 	'upload-deleted',
 	'like-update',
 	'new-comment',
+	'comment-deleted',
+	'user-hidden',
 	'event-closed',
 	'event-opened',
 	'event-updated',

frontend/src/routes/admin/+page.svelte

@@ -57,8 +57,9 @@
 			title: 'Limits & Größen',
 			fields: [
 				{ key: 'max_image_size_mb',       label: 'Max. Bildgröße (MB)',     kind: 'number' },
-				{ key: 'max_video_size_mb',       label: 'Max. Videogröße (MB)',    kind: 'number' },
+				{ key: 'max_video_size_mb',       label: 'Max. Videogröße (MB)',    kind: 'number' }
-				{ key: 'compression_concurrency', label: 'Kompressions-Worker',     kind: 'number' }
+				// compression_concurrency is set via COMPRESSION_WORKER_CONCURRENCY at
+				// boot, not live — omitted so it isn't a dead no-op control.
 			]
 		},
 		{
@@ -157,8 +158,22 @@
 
 	onMount(async () => {
 		const token = getToken();
-		const role = getRole();
+		if (!token) {
-		if (!token || role !== 'admin') {
+			goto('/admin/login');
+			return;
+		}
+		// Trust the *live* role, not the JWT claim: a mid-session demote leaves a
+		// stale 'admin' in the token, but the backend now 403s every admin call.
+		// Bounce a demoted admin to the feed instead of leaving them on a dashboard
+		// that errors on load (mirrors the host page).
+		try {
+			const ctx = await api.get<{ role: string }>('/me/context');
+			if (ctx.role !== 'admin') {
+				goto('/feed');
+				return;
+			}
+		} catch {
+			// Expired/invalid session (api.ts cleared it) — send them to re-auth.
 			goto('/admin/login');
 			return;
 		}

frontend/src/routes/diashow/+page.svelte

@@ -99,6 +99,16 @@
 		}
 	}
 
+	function handleUserHidden(data: string) {
+		try {
+			const payload = JSON.parse(data) as { user_id: string };
+			const result = queue.removeByUser(payload.user_id, current?.id ?? null);
+			if (result.wasCurrent) advance();
+		} catch {
+			// ignore
+		}
+	}
+
 	function revealOverlay() {
 		showOverlay = true;
 		if (overlayHideTimer) clearTimeout(overlayHideTimer);
@@ -145,6 +155,7 @@
 		void acquireWakeLock();
 		unsubs.push(onSseEvent('upload-processed', handleUploadProcessed));
 		unsubs.push(onSseEvent('upload-deleted', handleUploadDeleted));
+		unsubs.push(onSseEvent('user-hidden', handleUserHidden));
 		void loadInitial();
 	});
 

frontend/src/routes/feed/+page.svelte

@@ -27,6 +27,9 @@
 	let refreshing = $state(false);
 	let pullProgress = $state(0); // 0–1+ during the drag, 0 when idle
 	let selectedUpload = $state<FeedUpload | null>(null);
+	// Set when a truncated feed-delta means we missed too much to merge — shows a
+	// tap-to-refresh pill instead of yanking the user's scroll to page 1.
+	let feedStale = $state(false);
 	let sentinel: HTMLDivElement;
 	let feedObserver: IntersectionObserver | null = null;
 	let inPlaceRefreshTimer: ReturnType<typeof setTimeout> | null = null;
@@ -196,6 +199,28 @@
 					if (selectedUpload?.id === payload.upload_id) selectedUpload = null;
 				} catch { /* ignore */ }
 			}),
+			// A background transcode failed: the backend already cleaned up (refunded
+			// quota, removed the row) and an upload-deleted evicts the card. Only the
+			// uploader gets a toast — registered before upload-deleted so the card is
+			// still present to check ownership.
+			onSseEvent('upload-error', (data) => {
+				try {
+					const { upload_id } = JSON.parse(data) as { upload_id: string };
+					const mine = uploads.find((u) => u.id === upload_id && u.user_id === myUserId);
+					if (mine) {
+						toast('Ein Upload konnte nicht verarbeitet werden.', 'error');
+						void refreshQuota();
+					}
+				} catch { /* ignore */ }
+			}),
+			// A banned user's uploads were hidden — drop all their cards live.
+			onSseEvent('user-hidden', (data) => {
+				try {
+					const { user_id } = JSON.parse(data) as { user_id: string };
+					uploads = uploads.filter((u) => u.user_id !== user_id);
+					if (selectedUpload && selectedUpload.user_id === user_id) selectedUpload = null;
+				} catch { /* ignore */ }
+			}),
 			// Patch the single affected card in place from the SSE payload instead of
 			// refetching page 1 — a busy event fires these constantly and a full reload
 			// would yank every scrolled-down user back to the top on each reaction.
@@ -210,7 +235,9 @@
 						// Missed more than the backend delta cap while backgrounded — the
 						// delta is only the newest slice, so merging would leave a silent gap
 						// of older-but-still-new uploads. Resync from page 1 instead.
-						void loadFeed(true);
+						// Rather than involuntarily yank the user to page 1, surface a
+						// tap-to-refresh pill so they keep scroll until they resync.
+						feedStale = true;
 						return;
 					}
 					if (delta.uploads.length) {
@@ -290,6 +317,10 @@
 	}
 
 	async function loadFeed(refresh = false) {
+		// Any full refresh (pill tap, pull-to-refresh, filter change) resyncs page 1,
+		// so the "new posts" pill is no longer relevant — clear it here rather than
+		// only in the pill's own onclick, or a pull-to-refresh leaves it stranded.
+		if (refresh) feedStale = false;
 		try {
 			const params = new URLSearchParams();
 			if (!refresh && nextCursor) params.set('cursor', nextCursor);
@@ -440,6 +471,17 @@
 			</div>
 		</div>
 	{/if}
+	{#if feedStale}
+		<div class="pointer-events-none fixed left-0 right-0 top-[calc(env(safe-area-inset-top)+0.5rem)] z-40 flex justify-center">
+			<button
+				type="button"
+				class="pointer-events-auto rounded-full bg-blue-600 px-4 py-1.5 text-xs font-semibold text-white shadow-lg hover:bg-blue-700"
+				onclick={() => { feedStale = false; void loadFeed(true); }}
+			>
+				Neue Beiträge – tippen zum Aktualisieren
+			</button>
+		</div>
+	{/if}
 	<!-- Sticky header — opaque fallback for browsers without backdrop-filter. -->
 	<div class="sticky top-0 z-30 border-b border-gray-200 bg-white/95 pt-[env(safe-area-inset-top)] backdrop-blur supports-[not(backdrop-filter:blur(0))]:bg-white dark:border-gray-800 dark:bg-gray-900/95 dark:supports-[not(backdrop-filter:blur(0))]:bg-gray-900">
 		<div class="mx-auto flex max-w-2xl items-center justify-between px-4 py-3">

frontend/src/routes/host/+page.svelte

@@ -2,6 +2,7 @@
 	import { goto } from '$app/navigation';
 	import { getToken, getRole } from '$lib/auth';
 	import { api } from '$lib/api';
+	import type { MeContextDto } from '$lib/types';
 	import { onMount } from 'svelte';
 	import { toast, toastError } from '$lib/toast-store';
 	import ConfirmSheet from '$lib/components/ConfirmSheet.svelte';
@@ -86,8 +87,22 @@
 
 	onMount(async () => {
 		const token = getToken();
-		const role = getRole();
+		if (!token) {
-		if (!token || (role !== 'host' && role !== 'admin')) {
+			goto('/join');
+			return;
+		}
+		// Trust the *live* role, not the JWT claim: a mid-session demote leaves a
+		// stale 'host' in the token, but the backend now 403s every host call. Fetch
+		// the current role and bounce a demoted host to the feed instead of leaving
+		// them on a dashboard that errors on load.
+		try {
+			const ctx = await api.get<MeContextDto>('/me/context');
+			if (ctx.role !== 'host' && ctx.role !== 'admin') {
+				goto('/feed');
+				return;
+			}
+		} catch {
+			// Expired/invalid session (api.ts cleared it) — send them to re-auth.
 			goto('/join');
 			return;
 		}