diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index eadda0b..02605fb 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   e2e:
-    name: Playwright E2E (chromium-desktop)
+    name: Playwright E2E (chromium + webkit)
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -25,7 +25,7 @@ jobs:
 
       - name: Install Playwright browsers
         working-directory: ./e2e
-        run: npx playwright install --with-deps chromium
+        run: npx playwright install --with-deps chromium webkit
 
       - name: Bring up the test stack
         working-directory: ./e2e
@@ -54,6 +54,22 @@ jobs:
         working-directory: ./e2e
         run: npm run test:e2e -- --project=chromium-mobile
 
+      # iOS Safari is the app's stated primary user (a wedding guest opening a QR link), and
+      # WebKit is the ONLY engine here that reproduces two of its behaviours:
+      #   - it enforces X-Frame-Options on the download iframe, so a site-wide `DENY` makes the
+      #     keepsake download silently do nothing. Blink hands attachments to the download
+      #     manager first and never notices. That shipped once already.
+      #   - it abandons a <video> load without a 206 response to its Range probe.
+      # Both regressions are invisible to every Chromium project, so running WebKit is what
+      # actually gates them on a PR rather than on someone remembering to test locally.
+      #
+      # The project is scoped in playwright.config.ts to the journeys a guest walks
+      # (01-auth, 02-upload, 03-feed, 06-export); four IndexedDB-blob tests skip themselves
+      # there — see helpers/webkit.ts for why that is the harness and not the app.
+      - name: Run E2E tests (webkit / iOS)
+        working-directory: ./e2e
+        run: npm run test:e2e -- --project=webkit-iphone
+
       - name: Upload Playwright report
         if: failure()
         uses: actions/upload-artifact@v4
diff --git a/README.md b/README.md
index 73d880c..99d9ac0 100644
--- a/README.md
+++ b/README.md
@@ -115,6 +115,45 @@ Caddy automatically obtains a Let's Encrypt certificate on first start. The app
 > docker compose -f docker-compose.yml -f docker-compose.dev.yml up
 > ```
 
+### Updating an existing deployment
+
+> **`docker compose up -d` alone will NOT deploy your changes.** `app` and `frontend` are
+> `build:` services with no published image tag, and Compose has no source-change detection:
+> if an image with that name already exists it is reused. After a `git pull` the command
+> reports `Container … Running`, changes nothing, and **exits 0** — so a deploy that shipped
+> nothing looks exactly like a successful one. `--build` is what makes it real.
+
+```bash
+cd /path/to/eventsnap
+
+# 1. Back up first — migrations run automatically on boot and are not reversible in place.
+#    (See "Backup" below; the database dump is the one that matters here.)
+
+# 2. Fetch the new code.
+git pull
+
+# 3. Rebuild and restart. --build is NOT optional.
+docker compose up -d --build
+
+# 4. Confirm the app came back up. Anything other than "ok" means check the logs.
+curl -fsS https://DOMAIN/health && echo
+
+# 5. Confirm a NEW image was actually built. Note the IMAGE ID before you start and
+#    compare — it must have changed. (Ignore the CREATED column; it reports the base
+#    layer's age, not this build's.) An unchanged ID means step 3 ran without --build
+#    and you are still serving the old code.
+docker compose images app frontend
+```
+
+Migrations are applied by the backend on startup, so step 3 covers them. If `app` stays
+unhealthy afterwards, `docker compose logs app` will name the failing migration — and note
+that a migration applied by a *newer* build is not removed by checking out an older commit,
+so rolling back code without restoring the database snapshot from step 1 leaves the schema
+ahead of the binary and the app refusing to boot.
+
+Only the two application services rebuild; `db` and `caddy` are pinned upstream images and
+are untouched, so data volumes and the TLS certificate survive.
+
 ### Generate required secrets
 
 ```bash
diff --git a/backend/migrations/019_recover_ip_rate.down.sql b/backend/migrations/019_recover_ip_rate.down.sql
new file mode 100644
index 0000000..d8b3139
--- /dev/null
+++ b/backend/migrations/019_recover_ip_rate.down.sql
@@ -0,0 +1 @@
+DELETE FROM config WHERE key = 'recover_ip_rate_per_min';
diff --git a/backend/migrations/019_recover_ip_rate.up.sql b/backend/migrations/019_recover_ip_rate.up.sql
new file mode 100644
index 0000000..38841be
--- /dev/null
+++ b/backend/migrations/019_recover_ip_rate.up.sql
@@ -0,0 +1,19 @@
+-- Per-IP flood ceiling for /recover, mirroring the one migration 017 added for /join.
+--
+-- Rationale: /recover is keyed `recover:{ip}:{name}` at 5 per 15 minutes. That is the
+-- right shape for its actual job — stopping someone who knows a display name (they are
+-- visible on the feed) from burning the victim's 3-strike PIN counter and locking them
+-- out repeatedly. But the name is attacker-chosen, so cycling names mints a fresh bucket
+-- every time and the per-IP cost is unbounded.
+--
+-- Behind that limiter sits a cost-12 bcrypt verify, including an UNCONDITIONAL throwaway
+-- verify for names that don't exist — deliberately, to close a timing oracle. So an
+-- unknown name is the cheapest possible way to make the server do ~200ms of hashing.
+-- Without a ceiling, one client can saturate the box's CPU with a name generator.
+--
+-- 30/min is far above any real recovery attempt (a guest tries their PIN a handful of
+-- times) while capping a name-cycling flood. The per-(ip, name) bucket is unchanged and
+-- remains the anti-guessing control.
+INSERT INTO config (key, value) VALUES
+    ('recover_ip_rate_per_min', '30')
+ON CONFLICT (key) DO NOTHING;
diff --git a/backend/src/auth/handlers.rs b/backend/src/auth/handlers.rs
index 74f54f0..b16e15b 100644
--- a/backend/src/auth/handlers.rs
+++ b/backend/src/auth/handlers.rs
@@ -111,7 +111,7 @@ pub async fn join(
 
     // Generate a 4-digit PIN
     let pin: String = format!("{:04}", rand::rng().random_range(0..10000u32));
-    let pin_hash = bcrypt::hash(&pin, 12).map_err(|e| AppError::Internal(anyhow::anyhow!(e)))?;
+    let pin_hash = hash_password(pin.clone(), 12).await?;
 
     // The pre-check above is racy: two simultaneous joins with the same name can both
     // pass it, and the DB's unique index then rejects the loser. Map that unique
@@ -175,6 +175,28 @@ fn dummy_pin_hash() -> &'static str {
     })
 }
 
+/// Run a bcrypt verify on the blocking pool.
+///
+/// bcrypt at cost 12 is ~200ms of deliberate CPU. Called inline on an async task it pins a
+/// tokio WORKER thread for that whole time, and the runtime only has one per core — so a
+/// flood of `/recover` or `/admin/login` attempts stalls every other request on the box,
+/// including the feed. Offloading moves that cost to the blocking pool, which is sized for
+/// exactly this and whose saturation degrades logins rather than the whole app.
+async fn verify_password(candidate: String, hash: String) -> bool {
+    tokio::task::spawn_blocking(move || bcrypt::verify(&candidate, &hash).unwrap_or(false))
+        .await
+        .unwrap_or(false)
+}
+
+/// Hash a secret on the blocking pool. Same reasoning as [`verify_password`] — and this one
+/// runs on the busiest auth path there is, since every guest who joins gets a PIN hashed.
+pub async fn hash_password(secret: String, cost: u32) -> Result<String, AppError> {
+    tokio::task::spawn_blocking(move || bcrypt::hash(&secret, cost))
+        .await
+        .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))?
+        .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))
+}
+
 pub async fn recover(
     State(state): State<AppState>,
     ConnectInfo(peer): ConnectInfo<SocketAddr>,
@@ -192,6 +214,26 @@ pub async fn recover(
     let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
     let recover_rate_on = config::get_bool(&state.config_cache, "recover_rate_enabled", true).await;
     if rate_limits_on && recover_rate_on {
+        // Coarse per-IP ceiling FIRST. The per-(ip, name) bucket below is the anti-guessing
+        // control, but the name is attacker-chosen, so cycling names mints a fresh bucket
+        // every time and leaves the per-IP cost unbounded. That matters more here than
+        // anywhere else: every call runs a cost-12 bcrypt verify, including an
+        // unconditional throwaway one for names that don't exist (see below), so an unknown
+        // name is the CHEAPEST way to make the server do ~200ms of hashing. Checked before
+        // the per-name bucket so a name generator can't walk past it.
+        let ip_ceiling =
+            config::get_usize(&state.config_cache, "recover_ip_rate_per_min", 30).await;
+        if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
+            format!("recover_ip:{ip}"),
+            ip_ceiling,
+            Duration::from_secs(60),
+        ) {
+            return Err(AppError::TooManyRequests(
+                "Zu viele Versuche. Bitte warte kurz und versuche es erneut.".into(),
+                Some(retry_after_secs),
+            ));
+        }
+
         let name_key = display_name.to_lowercase();
         if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
             format!("recover:{ip}:{name_key}"),
@@ -217,7 +259,7 @@ pub async fn recover(
         // PIN — so "no such name" and "wrong PIN" are indistinguishable by response or
         // timing. Display names are already public on the feed, but this still closes
         // the /recover enumeration + timing oracle.
-        let _ = bcrypt::verify(&body.pin, dummy_pin_hash());
+        let _ = verify_password(body.pin.clone(), dummy_pin_hash().to_string()).await;
         return Err(AppError::Unauthorized("PIN ist falsch.".into()));
     }
 
@@ -241,7 +283,7 @@ pub async fn recover(
             User::reset_pin_attempts(&state.pool, user.id).await?;
         }
 
-        let pin_matches = bcrypt::verify(&body.pin, &user.recovery_pin_hash).unwrap_or(false);
+        let pin_matches = verify_password(body.pin.clone(), user.recovery_pin_hash.clone()).await;
 
         if pin_matches {
             // Reset failed attempts on success
@@ -340,7 +382,11 @@ pub async fn admin_login(
         ));
     }
 
-    let valid = bcrypt::verify(&body.password, &state.config.admin_password_hash).unwrap_or(false);
+    let valid = verify_password(
+        body.password.clone(),
+        state.config.admin_password_hash.clone(),
+    )
+    .await;
 
     if !valid {
         tracing::warn!(ip = %ip, "admin_login: wrong password");
@@ -366,8 +412,7 @@ pub async fn admin_login(
         let dummy_pin: String = (0..32)
             .map(|_| rand::rng().random_range(b'a'..=b'z') as char)
             .collect();
-        let dummy_hash =
-            bcrypt::hash(&dummy_pin, 4).map_err(|e| AppError::Internal(anyhow::anyhow!(e)))?;
+        let dummy_hash = hash_password(dummy_pin.clone(), 4).await?;
         let user = User::create(&state.pool, event.id, admin_name, &dummy_hash).await?;
         sqlx::query("UPDATE \"user\" SET role = 'admin' WHERE id = $1")
             .bind(user.id)
diff --git a/backend/src/handlers/admin.rs b/backend/src/handlers/admin.rs
index f29fe36..cb8fb96 100644
--- a/backend/src/handlers/admin.rs
+++ b/backend/src/handlers/admin.rs
@@ -124,6 +124,9 @@ pub async fn patch_config(
         // only bounds raw volume from one source, so it must stay well above the size of a
         // party arriving at once (see migration 017).
         ("join_ip_rate_per_min", true, 1.0, 100_000.0),
+        // Same shape for /recover: the per-(ip, name) bucket is the anti-guessing control,
+        // this only bounds a name-cycling flood in front of a cost-12 bcrypt (migration 019).
+        ("recover_ip_rate_per_min", true, 1.0, 100_000.0),
         ("quota_tolerance", false, 0.0, 1.0),
         ("estimated_guest_count", true, 1.0, 1_000_000.0),
     ];
diff --git a/backend/src/handlers/host.rs b/backend/src/handlers/host.rs
index f47f474..a4a73c5 100644
--- a/backend/src/handlers/host.rs
+++ b/backend/src/handlers/host.rs
@@ -433,7 +433,7 @@ pub async fn reset_user_pin(
     }
 
     let pin: String = format!("{:04}", rand::rng().random_range(0..10000u32));
-    let pin_hash = bcrypt::hash(&pin, 12).map_err(|e| AppError::Internal(anyhow::anyhow!(e)))?;
+    let pin_hash = crate::auth::handlers::hash_password(pin.clone(), 12).await?;
 
     sqlx::query(
         "UPDATE \"user\"
diff --git a/backend/src/handlers/test_admin.rs b/backend/src/handlers/test_admin.rs
index c6f4202..362c61a 100644
--- a/backend/src/handlers/test_admin.rs
+++ b/backend/src/handlers/test_admin.rs
@@ -41,7 +41,7 @@ pub async fn truncate_all(
     .execute(&state.pool)
     .await?;
 
-    // Reseed config. The NUMERIC values mirror migrations 005/015/016; the BOOLEAN
+    // Reseed config. The NUMERIC values mirror migrations 005/015/016/017/019; the BOOLEAN
     // toggles deliberately do NOT — migration 009 seeds every one of them `true`
     // (production), and this forces them `false` so the suite isn't fighting rate limits
     // and quotas it isn't testing.
@@ -62,6 +62,7 @@ pub async fn truncate_all(
             ('feed_rate_per_min',          '60'),
             ('export_rate_per_day',        '3'),
             ('join_ip_rate_per_min',       '60'),
+            ('recover_ip_rate_per_min',    '30'),
             ('quota_tolerance',            '0.75'),
             ('estimated_guest_count',      '100'),
             ('compression_concurrency',    '2'),
diff --git a/backend/src/handlers/upload.rs b/backend/src/handlers/upload.rs
index 7e232bb..55f6830 100644
--- a/backend/src/handlers/upload.rs
+++ b/backend/src/handlers/upload.rs
@@ -647,12 +647,95 @@ pub async fn compute_storage_quota(state: &AppState) -> QuotaEstimate {
     }
 }
 
+/// Outcome of parsing a `Range` request header against a known file length.
+#[derive(Debug, PartialEq, Eq)]
+enum RangeSpec {
+    /// No `Range` header, or one we deliberately don't honour (multi-range, non-`bytes`
+    /// unit, malformed). RFC 9110 lets a server ignore a Range it can't process and reply
+    /// 200 with the full body, which is what every one of these cases does.
+    Full,
+    /// A single satisfiable range, resolved to inclusive absolute offsets.
+    Partial { start: u64, end: u64 },
+    /// Syntactically valid but starts beyond EOF — must be answered 416, not 200, or a
+    /// player can loop re-requesting it.
+    Unsatisfiable,
+}
+
+/// Parse a single-range `bytes=` header against `len`.
+///
+/// Deliberately supports only the three forms a media element actually sends —
+/// `bytes=N-`, `bytes=N-M`, `bytes=-S` (suffix) — and treats everything else as `Full`.
+/// Multi-range responses need `multipart/byteranges`, which no `<video>` requires.
+fn parse_range(header: Option<&str>, len: u64) -> RangeSpec {
+    let Some(raw) = header else {
+        return RangeSpec::Full;
+    };
+    let Some(spec) = raw.trim().strip_prefix("bytes=") else {
+        return RangeSpec::Full;
+    };
+    // Multi-range → fall back to the whole body rather than lie about the content.
+    if spec.contains(',') {
+        return RangeSpec::Full;
+    }
+    let Some((from, to)) = spec.split_once('-') else {
+        return RangeSpec::Full;
+    };
+    let (from, to) = (from.trim(), to.trim());
+
+    // A zero-length file can satisfy no range at all.
+    if len == 0 {
+        return if from.is_empty() && to.is_empty() {
+            RangeSpec::Full
+        } else {
+            RangeSpec::Unsatisfiable
+        };
+    }
+
+    let (start, end) = if from.is_empty() {
+        // Suffix form: the last `to` bytes.
+        let Ok(suffix) = to.parse::<u64>() else {
+            return RangeSpec::Full;
+        };
+        if suffix == 0 {
+            return RangeSpec::Unsatisfiable;
+        }
+        (len.saturating_sub(suffix), len - 1)
+    } else {
+        let Ok(start) = from.parse::<u64>() else {
+            return RangeSpec::Full;
+        };
+        let end = if to.is_empty() {
+            len - 1
+        } else {
+            match to.parse::<u64>() {
+                // An end past EOF is clamped, not rejected (RFC 9110 §14.1.1).
+                Ok(end) => end.min(len - 1),
+                Err(_) => return RangeSpec::Full,
+            }
+        };
+        (start, end)
+    };
+
+    if start >= len || start > end {
+        RangeSpec::Unsatisfiable
+    } else {
+        RangeSpec::Partial { start, end }
+    }
+}
+
 /// Stream a media file from disk into an HTTP response with a fixed set of security
-/// headers. Every media response (original, preview, thumbnail) goes through here so
-/// they consistently carry `X-Content-Type-Options: nosniff` (defense-in-depth against
+/// headers. Every media response (original, preview, display, thumbnail) goes through here
+/// so they consistently carry `X-Content-Type-Options: nosniff` (defense-in-depth against
 /// content-type confusion, even if the edge proxy is bypassed) plus an explicit
 /// `Content-Disposition` and `Cache-Control`.
+///
+/// Honours a single `Range`. This is not an optimisation: iOS Safari opens every `<video>`
+/// with a `Range: bytes=0-1` probe and abandons the load unless it gets a `206` with a
+/// `Content-Range`. Without this, video is unplayable on the app's primary platform no
+/// matter what `src` the element is given. `Accept-Ranges: bytes` is advertised on every
+/// response so clients know seeking is available before they ask.
 async fn stream_media_file(
+    req_headers: &axum::http::HeaderMap,
     absolute: &std::path::Path,
     content_type: String,
     disposition: &str,
@@ -660,30 +743,60 @@ async fn stream_media_file(
 ) -> Result<axum::response::Response, AppError> {
     use axum::body::Body;
     use axum::http::{Response, StatusCode, header};
+    use tokio::io::{AsyncReadExt, AsyncSeekExt};
     use tokio_util::io::ReaderStream;
 
     if !absolute.exists() {
         return Err(AppError::NotFound("Datei nicht gefunden.".into()));
     }
 
-    let file = tokio::fs::File::open(absolute)
+    let mut file = tokio::fs::File::open(absolute)
         .await
         .map_err(|e| AppError::Internal(e.into()))?;
-    let metadata = file
+    let len = file
         .metadata()
         .await
-        .map_err(|e| AppError::Internal(e.into()))?;
-    let stream = ReaderStream::new(file);
+        .map_err(|e| AppError::Internal(e.into()))?
+        .len();
 
-    Response::builder()
-        .status(StatusCode::OK)
-        .header(header::CONTENT_TYPE, content_type)
-        .header(header::CONTENT_DISPOSITION, disposition)
-        .header(header::CONTENT_LENGTH, metadata.len())
-        .header(header::CACHE_CONTROL, cache_control)
-        .header(header::X_CONTENT_TYPE_OPTIONS, "nosniff")
-        .body(Body::from_stream(stream))
-        .map_err(|e| AppError::Internal(e.into()))
+    let range = parse_range(
+        req_headers.get(header::RANGE).and_then(|v| v.to_str().ok()),
+        len,
+    );
+
+    let base = |status: StatusCode| {
+        Response::builder()
+            .status(status)
+            .header(header::CONTENT_TYPE, content_type.clone())
+            .header(header::CONTENT_DISPOSITION, disposition)
+            .header(header::CACHE_CONTROL, cache_control)
+            .header(header::X_CONTENT_TYPE_OPTIONS, "nosniff")
+            .header(header::ACCEPT_RANGES, "bytes")
+    };
+
+    match range {
+        RangeSpec::Full => base(StatusCode::OK)
+            .header(header::CONTENT_LENGTH, len)
+            .body(Body::from_stream(ReaderStream::new(file)))
+            .map_err(|e| AppError::Internal(e.into())),
+
+        RangeSpec::Partial { start, end } => {
+            file.seek(std::io::SeekFrom::Start(start))
+                .await
+                .map_err(|e| AppError::Internal(e.into()))?;
+            let span = end - start + 1;
+            base(StatusCode::PARTIAL_CONTENT)
+                .header(header::CONTENT_LENGTH, span)
+                .header(header::CONTENT_RANGE, format!("bytes {start}-{end}/{len}"))
+                .body(Body::from_stream(ReaderStream::new(file.take(span))))
+                .map_err(|e| AppError::Internal(e.into()))
+        }
+
+        RangeSpec::Unsatisfiable => base(StatusCode::RANGE_NOT_SATISFIABLE)
+            .header(header::CONTENT_RANGE, format!("bytes */{len}"))
+            .body(Body::empty())
+            .map_err(|e| AppError::Internal(e.into())),
+    }
 }
 
 /// Streaming download of the original file behind an upload. Used by:
@@ -700,6 +813,7 @@ async fn stream_media_file(
 /// [`get_preview`] / [`get_thumbnail`]).
 pub async fn get_original(
     State(state): State<AppState>,
+    headers: axum::http::HeaderMap,
     Path(upload_id): Path<Uuid>,
 ) -> Result<axum::response::Response, AppError> {
     let media = Upload::find_visible_media(&state.pool, upload_id)
@@ -711,10 +825,22 @@ pub async fn get_original(
         .file_name()
         .and_then(|n| n.to_str())
         .unwrap_or("original");
-    let disposition = format!("attachment; filename=\"{filename}\"");
+    // `inline`, not `attachment`. This route is the only source of playable video bytes
+    // (there is no video derivative), and an attachment disposition is hostile to a
+    // `<video>` element — Safari in particular. It also matches what the UI promises:
+    // the action is labelled "Original anzeigen", i.e. view, not download.
+    let disposition = format!("inline; filename=\"{filename}\"");
 
-    // Full-res original: force download, never cache at the edge.
-    stream_media_file(&absolute, media.mime_type, &disposition, "no-store").await
+    // Full-res original: never cache at the edge, so a takedown revokes access promptly.
+    // Range requests still work under no-store; the client simply re-fetches each range.
+    stream_media_file(
+        &headers,
+        &absolute,
+        media.mime_type,
+        &disposition,
+        "no-store",
+    )
+    .await
 }
 
 /// Streaming access to an upload's compressed **preview** image. Gated exactly like
@@ -729,6 +855,7 @@ pub async fn get_original(
 /// `upload-deleted` / `user-hidden` SSE events, so this only bounds the raw-URL edge case.
 pub async fn get_preview(
     State(state): State<AppState>,
+    headers: axum::http::HeaderMap,
     Path(upload_id): Path<Uuid>,
 ) -> Result<axum::response::Response, AppError> {
     let media = Upload::find_visible_media(&state.pool, upload_id)
@@ -739,6 +866,7 @@ pub async fn get_preview(
         .ok_or_else(|| AppError::NotFound("Vorschau nicht verfügbar.".into()))?;
     let absolute = state.config.media_path.join(&rel);
     stream_media_file(
+        &headers,
         &absolute,
         "image/jpeg".to_string(),
         "inline",
@@ -753,6 +881,7 @@ pub async fn get_preview(
 /// back to the original.
 pub async fn get_display(
     State(state): State<AppState>,
+    headers: axum::http::HeaderMap,
     Path(upload_id): Path<Uuid>,
 ) -> Result<axum::response::Response, AppError> {
     let media = Upload::find_visible_media(&state.pool, upload_id)
@@ -763,6 +892,7 @@ pub async fn get_display(
         .ok_or_else(|| AppError::NotFound("Anzeige nicht verfügbar.".into()))?;
     let absolute = state.config.media_path.join(&rel);
     stream_media_file(
+        &headers,
         &absolute,
         "image/jpeg".to_string(),
         "inline",
@@ -775,6 +905,7 @@ pub async fn get_display(
 /// [`get_preview`].
 pub async fn get_thumbnail(
     State(state): State<AppState>,
+    headers: axum::http::HeaderMap,
     Path(upload_id): Path<Uuid>,
 ) -> Result<axum::response::Response, AppError> {
     let media = Upload::find_visible_media(&state.pool, upload_id)
@@ -785,6 +916,7 @@ pub async fn get_thumbnail(
         .ok_or_else(|| AppError::NotFound("Thumbnail nicht verfügbar.".into()))?;
     let absolute = state.config.media_path.join(&rel);
     stream_media_file(
+        &headers,
         &absolute,
         "image/jpeg".to_string(),
         "inline",
@@ -795,7 +927,108 @@ pub async fn get_thumbnail(
 
 #[cfg(test)]
 mod tests {
-    use super::quota_limit_bytes;
+    use super::{RangeSpec, parse_range, quota_limit_bytes};
+
+    // `Range` handling exists because iOS Safari probes every `<video>` with
+    // `Range: bytes=0-1` and abandons the load without a 206. These pin the forms a
+    // media element actually sends, plus the edges that decide 206 vs 200 vs 416.
+    #[test]
+    fn no_range_header_is_a_full_response() {
+        assert_eq!(parse_range(None, 100), RangeSpec::Full);
+    }
+
+    #[test]
+    fn open_ended_range_runs_to_eof() {
+        assert_eq!(
+            parse_range(Some("bytes=10-"), 100),
+            RangeSpec::Partial { start: 10, end: 99 }
+        );
+    }
+
+    #[test]
+    fn closed_range_is_inclusive_on_both_ends() {
+        // The iOS probe. Two bytes, 0 and 1 — an exclusive end would return one.
+        assert_eq!(
+            parse_range(Some("bytes=0-1"), 100),
+            RangeSpec::Partial { start: 0, end: 1 }
+        );
+    }
+
+    #[test]
+    fn suffix_range_returns_the_last_n_bytes() {
+        assert_eq!(
+            parse_range(Some("bytes=-20"), 100),
+            RangeSpec::Partial { start: 80, end: 99 }
+        );
+    }
+
+    #[test]
+    fn suffix_longer_than_the_file_clamps_to_the_whole_file() {
+        assert_eq!(
+            parse_range(Some("bytes=-500"), 100),
+            RangeSpec::Partial { start: 0, end: 99 }
+        );
+    }
+
+    #[test]
+    fn end_past_eof_is_clamped_not_rejected() {
+        // RFC 9110 §14.1.1 — players routinely ask for more than is there.
+        assert_eq!(
+            parse_range(Some("bytes=90-999"), 100),
+            RangeSpec::Partial { start: 90, end: 99 }
+        );
+    }
+
+    #[test]
+    fn start_past_eof_is_416_not_a_full_body() {
+        // Answering 200 here makes a player re-request forever.
+        assert_eq!(
+            parse_range(Some("bytes=100-"), 100),
+            RangeSpec::Unsatisfiable
+        );
+        assert_eq!(
+            parse_range(Some("bytes=200-300"), 100),
+            RangeSpec::Unsatisfiable
+        );
+    }
+
+    #[test]
+    fn inverted_range_is_unsatisfiable() {
+        assert_eq!(
+            parse_range(Some("bytes=50-10"), 100),
+            RangeSpec::Unsatisfiable
+        );
+    }
+
+    #[test]
+    fn unsupported_or_malformed_forms_fall_back_to_the_full_body() {
+        // Ignoring a Range we can't process and sending 200 is explicitly allowed, and
+        // safer than guessing. Multi-range would need multipart/byteranges, which no
+        // <video> asks for.
+        for header in [
+            "bytes=0-10,20-30", // multi-range
+            "items=0-10",       // non-bytes unit
+            "bytes=abc-def",    // garbage
+            "bytes=",           // empty spec
+            "nonsense",         // no unit at all
+        ] {
+            assert_eq!(parse_range(Some(header), 100), RangeSpec::Full, "{header}");
+        }
+    }
+
+    #[test]
+    fn last_byte_is_reachable() {
+        assert_eq!(
+            parse_range(Some("bytes=99-99"), 100),
+            RangeSpec::Partial { start: 99, end: 99 }
+        );
+    }
+
+    #[test]
+    fn empty_file_satisfies_no_range() {
+        assert_eq!(parse_range(Some("bytes=0-"), 0), RangeSpec::Unsatisfiable);
+        assert_eq!(parse_range(None, 0), RangeSpec::Full);
+    }
 
     #[test]
     fn divides_free_space_by_uploaders_with_tolerance() {
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 569ee17..bf5a3b9 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -70,6 +70,7 @@ async fn main() -> Result<()> {
         pool,
         state.rate_limiter.clone(),
         state.sse_tickets.clone(),
+        config.media_path.clone(),
     );
 
     // Ensure media directories exist
diff --git a/backend/src/models/upload.rs b/backend/src/models/upload.rs
index bcfb153..d27fbd7 100644
--- a/backend/src/models/upload.rs
+++ b/backend/src/models/upload.rs
@@ -150,11 +150,7 @@ impl Upload {
 
     /// Stamp which revision of the derivative pipeline produced this row's preview/display,
     /// so the startup backfill can find rows generated by an older one exactly once.
-    pub async fn set_derivatives_rev(
-        pool: &PgPool,
-        id: Uuid,
-        rev: i16,
-    ) -> Result<(), sqlx::Error> {
+    pub async fn set_derivatives_rev(pool: &PgPool, id: Uuid, rev: i16) -> Result<(), sqlx::Error> {
         sqlx::query("UPDATE upload SET derivatives_rev = $2 WHERE id = $1")
             .bind(id)
             .bind(rev)
diff --git a/backend/src/services/compression.rs b/backend/src/services/compression.rs
index ff74358..0ad11d7 100644
--- a/backend/src/services/compression.rs
+++ b/backend/src/services/compression.rs
@@ -3,7 +3,6 @@ use std::sync::Arc;
 use std::sync::atomic::{AtomicU64, Ordering};
 
 use anyhow::{Context, Result};
-use image::ImageDecoder;
 use sqlx::PgPool;
 use tokio::sync::{Semaphore, broadcast};
 use uuid::Uuid;
@@ -87,8 +86,7 @@ impl CompressionWorker {
                             error = ?e, %upload_id, attempt,
                             "compression attempt failed; retrying"
                         );
-                        tokio::time::sleep(std::time::Duration::from_secs(2u64.pow(attempt)))
-                            .await;
+                        tokio::time::sleep(std::time::Duration::from_secs(2u64.pow(attempt))).await;
                         attempt += 1;
                         // The data may have been reset while we slept (e2e TRUNCATE).
                         if worker.generation.load(Ordering::SeqCst) != born_at {
@@ -205,38 +203,9 @@ impl CompressionWorker {
 
         // Run blocking image operations in a spawn_blocking task
         tokio::task::spawn_blocking(move || -> Result<()> {
-            // Reject decompression bombs *before* fully decoding: the upload body
-            // cap bounds the file size on disk, but a small file can still decode to
-            // enormous dimensions (e.g. a ~1 MB image expanding to 50k×50k px →
-            // gigabytes), OOM-ing the box during decode/resize. 12000×12000 covers
-            // any real phone photo; max_alloc hard-caps the decode allocation.
-            let mut reader = image::ImageReader::open(&original)
-                .context("failed to open image")?
-                .with_guessed_format()
-                .context("failed to read image header")?;
-            let mut limits = image::Limits::default();
-            limits.max_image_width = Some(12_000);
-            limits.max_image_height = Some(12_000);
-            limits.max_alloc = Some(256 * 1024 * 1024);
-            reader.limits(limits);
-
-            // Apply the EXIF orientation. Phones do not rotate the sensor data — they record
-            // the physical camera orientation in a tag and store the pixels as shot. `decode()`
-            // hands back those raw pixels, and the JPEG re-encode below writes no EXIF at all,
-            // so skipping this stores EVERY portrait photo sideways in the feed preview, the
-            // 2048px diashow display and the keepsake — while the untouched original still
-            // renders upright, which is why it looks like a viewer bug rather than a pipeline
-            // one. `into_decoder` carries the limits set above through to the decoder, so the
-            // decompression-bomb guard is unaffected.
-            let mut decoder = reader.into_decoder().context("failed to decode image")?;
-            // A missing or malformed tag is not a failure: most images simply have none.
-            let orientation = decoder
-                .orientation()
-                .unwrap_or(image::metadata::Orientation::NoTransforms);
-            let mut img =
-                image::DynamicImage::from_decoder(decoder).context("failed to decode image")?;
-            img.apply_orientation(orientation);
-            let img = img;
+            // Decompression-bomb limits + EXIF orientation, both in one place — see
+            // services::imaging for why neither may be skipped.
+            let img = crate::services::imaging::decode_oriented(&original)?;
 
             // Preview: max 800px, preserving aspect ratio (data-saver feed).
             img.resize(
@@ -332,12 +301,9 @@ impl CompressionWorker {
                     Ok((preview_rel, display_rel)) => {
                         let _ = Upload::set_preview_path(&worker.pool, id, &preview_rel).await;
                         let _ = Upload::set_display_path(&worker.pool, id, &display_rel).await;
-                        let _ = Upload::set_derivatives_rev(
-                            &worker.pool,
-                            id,
-                            Self::DERIVATIVES_REV,
-                        )
-                        .await;
+                        let _ =
+                            Upload::set_derivatives_rev(&worker.pool, id, Self::DERIVATIVES_REV)
+                                .await;
                         tracing::info!("derivatives regenerated for upload {id}");
                     }
                     Err(e) => {
diff --git a/backend/src/services/export.rs b/backend/src/services/export.rs
index 850658f..3abea0f 100644
--- a/backend/src/services/export.rs
+++ b/backend/src/services/export.rs
@@ -720,10 +720,11 @@ async fn run_html_export_inner(
         let src = media_path.join(&row.original_path);
         // Stat ONCE, up front, and skip this upload if the source is gone. The old code probed with
         // `exists()` here and then did `metadata(&src).await?` further down — a TOCTOU whose `?`
-        // aborted the ENTIRE keepsake if the file vanished in between. It genuinely can: the
-        // compression worker hard-deletes an original when its transcode fails, and it can still be
-        // running when the gallery is released. A missing source must degrade one entry, never the
-        // whole archive (which, once released, the host cannot rebuild without reopening uploads).
+        // aborted the ENTIRE keepsake if the file vanished in between. It can still happen: the
+        // compression worker no longer deletes originals on failure, but the hourly sweep reclaims
+        // them once past the retention window, and an owner or host delete can land mid-export. A
+        // missing source must degrade one entry, never the whole archive (which, once released, the
+        // host cannot rebuild without reopening uploads).
         let src_meta = match tokio::fs::metadata(&src).await {
             Ok(m) => m,
             Err(e) => {
@@ -790,7 +791,12 @@ async fn run_html_export_inner(
             let thumb_path_clone = thumb_path.clone();
 
             let thumb_result = tokio::task::spawn_blocking(move || -> Result<()> {
-                let img = image::open(&src_clone).context("failed to open image for thumbnail")?;
+                // `decode_oriented`, not `image::open`: the latter ignores the EXIF
+                // orientation tag AND applies no decode limits. Using it here is why every
+                // portrait photo came out sideways in the keepsake's HTML viewer grid — the
+                // re-encode below drops the tag, so the viewer cannot recover it.
+                let img = crate::services::imaging::decode_oriented(&src_clone)
+                    .context("failed to open image for thumbnail")?;
                 let resized = img.resize(400, 400, image::imageops::FilterType::Lanczos3);
                 resized
                     .save_with_format(&thumb_path_clone, image::ImageFormat::Jpeg)
@@ -811,8 +817,12 @@ async fn run_html_export_inner(
                 let full_path_clone = full_path.clone();
 
                 let compress_result = tokio::task::spawn_blocking(move || -> Result<()> {
-                    let img =
-                        image::open(&src_clone).context("failed to open image for compression")?;
+                    // Same reason as the thumbnail above. This branch only runs for originals
+                    // over 5 MB, which is why the viewer's full image looked correct for small
+                    // photos and sideways for large ones — an inconsistency that reads as a
+                    // viewer bug rather than an export one.
+                    let img = crate::services::imaging::decode_oriented(&src_clone)
+                        .context("failed to open image for compression")?;
                     let resized = img.resize(2000, 2000, image::imageops::FilterType::Lanczos3);
                     resized
                         .save_with_format(&full_path_clone, image::ImageFormat::Jpeg)
@@ -953,9 +963,9 @@ async fn run_html_export_inner(
 
         for (name, source) in &media_manifest {
             let path = source.path();
-            // Open-first: a source that disappeared between the manifest being built and now (the
-            // compression worker deletes originals on transcode failure) must skip this entry, not
-            // fail the whole viewer. Opening collapses the check and the use into one operation.
+            // Open-first: a source that disappeared between the manifest being built and now (a
+            // delete, or the hourly sweep reclaiming a long-failed original) must skip this entry,
+            // not fail the whole viewer. Opening collapses the check and the use into one operation.
             let src_file = match tokio::fs::File::open(path).await {
                 Ok(f) => f,
                 Err(e) => {
diff --git a/backend/src/services/imaging.rs b/backend/src/services/imaging.rs
new file mode 100644
index 0000000..94dcdab
--- /dev/null
+++ b/backend/src/services/imaging.rs
@@ -0,0 +1,52 @@
+//! Shared image decoding.
+//!
+//! Exists so there is exactly ONE way to turn a file on disk into a `DynamicImage` in this
+//! codebase. Two properties have to hold everywhere an image is decoded, and both were
+//! previously re-derived per call site — which is how they drifted apart:
+//!
+//! - **EXIF orientation must be applied.** Phones do not rotate sensor data; they record how
+//!   the camera was held in a tag and store the pixels as shot. `image::open` and
+//!   `ImageReader::decode` both hand back the raw pixels and ignore that tag, and re-encoding
+//!   to JPEG writes no EXIF, so the derivative is permanently sideways while the untouched
+//!   original still renders upright. The compression worker was fixed; the export worker was
+//!   not, so every portrait photo came out sideways in the keepsake's HTML viewer.
+//! - **Decode limits must be set.** The upload body cap bounds the file on disk, but a small
+//!   file can decode to enormous dimensions (a ~1 MB image expanding to 50k×50k px), OOM-ing
+//!   the box. `image::open` applies NO limits at all, so the export path was also decoding
+//!   arbitrary user-supplied images unbounded.
+
+use anyhow::{Context, Result};
+use image::{DynamicImage, ImageDecoder};
+use std::path::Path;
+
+/// Bounds for any decode of user-supplied image data. 12000×12000 covers any real phone
+/// photo; `max_alloc` hard-caps the decode allocation.
+fn decode_limits() -> image::Limits {
+    let mut limits = image::Limits::default();
+    limits.max_image_width = Some(12_000);
+    limits.max_image_height = Some(12_000);
+    limits.max_alloc = Some(256 * 1024 * 1024);
+    limits
+}
+
+/// Decode an image from disk with decompression-bomb limits applied and its EXIF
+/// orientation baked into the pixels.
+///
+/// Blocking — call inside `spawn_blocking`.
+pub fn decode_oriented(path: &Path) -> Result<DynamicImage> {
+    let mut reader = image::ImageReader::open(path)
+        .context("failed to open image")?
+        .with_guessed_format()
+        .context("failed to read image header")?;
+    reader.limits(decode_limits());
+
+    // `into_decoder` carries the limits above through, so reading the tag costs nothing in
+    // safety. A missing or malformed tag is not an error — most images simply have none.
+    let mut decoder = reader.into_decoder().context("failed to decode image")?;
+    let orientation = decoder
+        .orientation()
+        .unwrap_or(image::metadata::Orientation::NoTransforms);
+    let mut img = DynamicImage::from_decoder(decoder).context("failed to decode image")?;
+    img.apply_orientation(orientation);
+    Ok(img)
+}
diff --git a/backend/src/services/maintenance.rs b/backend/src/services/maintenance.rs
index 0460d59..2cd07eb 100644
--- a/backend/src/services/maintenance.rs
+++ b/backend/src/services/maintenance.rs
@@ -9,10 +9,12 @@
 //!    users staring at a spinner. Resetting them on startup recovers gracefully.
 //!
 //! 2. **Periodic tasks** — pruning that should happen "every hour" rather than per
-//!    request: expired sessions (otherwise the table grows unboundedly), and the
+//!    request: expired sessions (otherwise the table grows unboundedly), the
 //!    rate-limiter's in-memory windows (so keys for IPs that left long ago don't
-//!    accumulate).
+//!    accumulate), and the originals of uploads whose compression permanently failed
+//!    (which are deliberately retained for a recovery window, then reclaimed).
 
+use std::path::PathBuf;
 use std::time::Duration;
 
 use sqlx::PgPool;
@@ -20,6 +22,21 @@ use sqlx::PgPool;
 use crate::services::rate_limiter::RateLimiter;
 use crate::services::sse_tickets::SseTicketStore;
 
+/// How long a permanently-failed upload's original is kept on disk before it is
+/// reclaimed.
+///
+/// The compression worker stops deleting originals on failure — a transient error must
+/// never destroy the guest's only copy of a photo they can't retake. But the row is
+/// soft-deleted and the uploader's quota IS refunded, so without a sweep those bytes are
+/// invisible, unowned, and free: a reproducible codec failure lets one guest accumulate
+/// orphans at no personal cost, and because `active_uploaders` counts only users with
+/// non-deleted uploads, dropping out of that count actually RAISES everyone's per-user
+/// ceiling while the disk gets fuller.
+///
+/// Two weeks is comfortably longer than any single event, so an operator investigating a
+/// failed upload still has the file, while the leak stays bounded.
+const FAILED_ORIGINAL_RETENTION_DAYS: i64 = 14;
+
 /// Reset rows left in flight by a previous crashed instance. Run once on startup,
 /// before the HTTP server starts taking requests, so users never observe the
 /// half-state.
@@ -87,7 +104,12 @@ pub async fn startup_recovery(pool: &PgPool) {
 /// - drops expired SSE tickets (30s TTL but the map keeps the slot until pruned)
 ///
 /// Cadence is 1h — fine for both jobs at our scale.
-pub fn spawn_periodic_tasks(pool: PgPool, rate_limiter: RateLimiter, sse_tickets: SseTicketStore) {
+pub fn spawn_periodic_tasks(
+    pool: PgPool,
+    rate_limiter: RateLimiter,
+    sse_tickets: SseTicketStore,
+    media_path: PathBuf,
+) {
     tokio::spawn(async move {
         let mut tick = tokio::time::interval(Duration::from_secs(3600));
         // Fire the first tick immediately, then hourly.
@@ -95,12 +117,76 @@ pub fn spawn_periodic_tasks(pool: PgPool, rate_limiter: RateLimiter, sse_tickets
         loop {
             tick.tick().await;
             cleanup_sessions(&pool).await;
+            cleanup_failed_originals(&pool, &media_path).await;
             rate_limiter.prune();
             sse_tickets.prune();
         }
     });
 }
 
+/// Reclaim the originals of uploads whose compression permanently failed, once they are
+/// past [`FAILED_ORIGINAL_RETENTION_DAYS`].
+///
+/// Deliberately narrow. It only touches rows that are BOTH `compression_status = 'failed'`
+/// AND soft-deleted — i.e. the exact state the compression worker's give-up path leaves
+/// behind — so it can never reach a live upload or one whose preview works. `original_path`
+/// is cleared in the same pass, which makes the sweep idempotent and stops a later run
+/// re-reporting a file that is already gone. The row itself is kept: it is the audit trail
+/// for the failure, and it costs a few hundred bytes.
+async fn cleanup_failed_originals(pool: &PgPool, media_path: &std::path::Path) {
+    let rows = sqlx::query_as::<_, (uuid::Uuid, String)>(
+        "SELECT id, original_path FROM upload
+         WHERE compression_status = 'failed'
+           AND deleted_at IS NOT NULL
+           AND deleted_at < NOW() - ($1 || ' days')::interval
+           AND original_path <> ''",
+    )
+    .bind(FAILED_ORIGINAL_RETENTION_DAYS.to_string())
+    .fetch_all(pool)
+    .await;
+
+    let rows = match rows {
+        Ok(r) => r,
+        Err(e) => {
+            tracing::warn!(error = ?e, "failed-original sweep query failed");
+            return;
+        }
+    };
+    if rows.is_empty() {
+        return;
+    }
+
+    let mut reclaimed = 0usize;
+    for (id, original_path) in rows {
+        let absolute = media_path.join(&original_path);
+        match tokio::fs::remove_file(&absolute).await {
+            Ok(()) => reclaimed += 1,
+            // Already gone (manual cleanup, restored backup) — still clear the column so
+            // the row stops being re-selected every hour.
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+            Err(e) => {
+                tracing::warn!(error = ?e, %id, path = %absolute.display(),
+                    "could not reclaim failed original; leaving the row for the next sweep");
+                continue;
+            }
+        }
+        if let Err(e) = sqlx::query("UPDATE upload SET original_path = '' WHERE id = $1")
+            .bind(id)
+            .execute(pool)
+            .await
+        {
+            tracing::warn!(error = ?e, %id, "reclaimed the file but could not clear original_path");
+        }
+    }
+
+    if reclaimed > 0 {
+        tracing::info!(
+            "reclaimed {reclaimed} original(s) from uploads that failed compression more than \
+             {FAILED_ORIGINAL_RETENTION_DAYS} days ago"
+        );
+    }
+}
+
 async fn cleanup_sessions(pool: &PgPool) {
     match sqlx::query("DELETE FROM session WHERE expires_at < NOW() - INTERVAL '1 day'")
         .execute(pool)
diff --git a/backend/src/services/mod.rs b/backend/src/services/mod.rs
index 08a97b2..8f6a126 100644
--- a/backend/src/services/mod.rs
+++ b/backend/src/services/mod.rs
@@ -2,6 +2,7 @@ pub mod compression;
 pub mod config;
 pub mod disk;
 pub mod export;
+pub mod imaging;
 pub mod maintenance;
 pub mod rate_limiter;
 pub mod sse_tickets;
diff --git a/backend/tests/failed_original_sweep.rs b/backend/tests/failed_original_sweep.rs
new file mode 100644
index 0000000..96840df
--- /dev/null
+++ b/backend/tests/failed_original_sweep.rs
@@ -0,0 +1,215 @@
+//! DB-backed tests for the failed-original sweep (`services/maintenance.rs`).
+//!
+//! Context: the compression worker deliberately no longer deletes an upload's original when
+//! its transcode fails — a transient ENOSPC or a codec panic must never destroy the only
+//! copy of a photo a guest cannot retake. But the row is soft-deleted and the uploader's
+//! quota IS refunded, so those bytes become invisible, unowned and free. A guest hitting a
+//! reproducible codec failure could accumulate orphans at no personal cost, and since
+//! `active_uploaders` counts only users with non-deleted uploads, dropping out of that count
+//! actually RAISES everyone's per-user ceiling while the disk fills.
+//!
+//! The sweep reclaims them after a retention window. Its selection predicate is the whole
+//! safety argument — it must reach the give-up path's leftovers and nothing else — so that
+//! is what these tests pin, following the same "reproduce the SQL verbatim" pattern as
+//! `upload_concurrency.rs`.
+//!
+//! `#[sqlx::test]` gives each test a fresh database with the real migrations applied.
+
+mod common;
+
+use common::*;
+use sqlx::PgPool;
+use uuid::Uuid;
+
+/// SRC: `services/maintenance.rs::cleanup_failed_originals` — the selection, verbatim.
+async fn sweep_selects(pool: &PgPool, retention_days: i64) -> Vec<Uuid> {
+    sqlx::query_as::<_, (Uuid, String)>(
+        "SELECT id, original_path FROM upload
+         WHERE compression_status = 'failed'
+           AND deleted_at IS NOT NULL
+           AND deleted_at < NOW() - ($1 || ' days')::interval
+           AND original_path <> ''",
+    )
+    .bind(retention_days.to_string())
+    .fetch_all(pool)
+    .await
+    .expect("sweep query")
+    .into_iter()
+    .map(|(id, _)| id)
+    .collect()
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn seed_upload(
+    pool: &PgPool,
+    event_id: Uuid,
+    user_id: Uuid,
+    status: &str,
+    deleted_days_ago: Option<i64>,
+    original_path: &str,
+) -> Uuid {
+    let id: Uuid = sqlx::query_scalar(
+        "INSERT INTO upload (event_id, user_id, original_path, mime_type, original_size_bytes,
+                             compression_status, deleted_at)
+         VALUES ($1, $2, $3, 'image/jpeg', 1000, $4,
+                 CASE WHEN $5::bigint IS NULL THEN NULL
+                      ELSE NOW() - ($5::text || ' days')::interval END)
+         RETURNING id",
+    )
+    .bind(event_id)
+    .bind(user_id)
+    .bind(original_path)
+    .bind(status)
+    .bind(deleted_days_ago)
+    .fetch_one(pool)
+    .await
+    .expect("seed upload");
+    id
+}
+
+#[sqlx::test]
+async fn sweeps_only_long_failed_soft_deleted_uploads(pool: PgPool) {
+    let event_id = seed_event(&pool, "sweep-event").await;
+    let user_id = seed_user(&pool, event_id, "Sweeper").await;
+
+    // The one and only thing the sweep may touch: the exact state the compression worker's
+    // give-up path leaves behind, aged past the window.
+    let target = seed_upload(
+        &pool,
+        event_id,
+        user_id,
+        "failed",
+        Some(30),
+        "originals/e/target.jpg",
+    )
+    .await;
+
+    // Everything below is a near-miss that must survive.
+    // A healthy live upload — the catastrophic case if the predicate were ever loosened.
+    let live = seed_upload(
+        &pool,
+        event_id,
+        user_id,
+        "done",
+        None,
+        "originals/e/live.jpg",
+    )
+    .await;
+    // Failed but still inside the retention window: the recovery window is the entire point
+    // of keeping the file, so reclaiming it early would defeat the fix it protects.
+    let recent = seed_upload(
+        &pool,
+        event_id,
+        user_id,
+        "failed",
+        Some(1),
+        "originals/e/recent.jpg",
+    )
+    .await;
+    // Failed but NOT soft-deleted — not the give-up path; something else set this status.
+    let failed_live = seed_upload(
+        &pool,
+        event_id,
+        user_id,
+        "failed",
+        None,
+        "originals/e/failed-live.jpg",
+    )
+    .await;
+    // Soft-deleted by the OWNER, compression fine. Its file is already gone; this row must
+    // never be re-processed.
+    let owner_deleted = seed_upload(
+        &pool,
+        event_id,
+        user_id,
+        "done",
+        Some(30),
+        "originals/e/owner.jpg",
+    )
+    .await;
+    // Already swept: `original_path` cleared. Re-selecting it every hour would log a
+    // phantom reclaim forever.
+    let already_swept = seed_upload(&pool, event_id, user_id, "failed", Some(30), "").await;
+
+    let selected = sweep_selects(&pool, 14).await;
+
+    assert_eq!(
+        selected,
+        vec![target],
+        "the sweep must select exactly the aged give-up-path leftovers"
+    );
+    for (id, what) in [
+        (live, "a live upload"),
+        (recent, "a failure still inside the retention window"),
+        (failed_live, "a failed but not soft-deleted upload"),
+        (owner_deleted, "an owner-deleted upload"),
+        (already_swept, "an already-swept row"),
+    ] {
+        assert!(!selected.contains(&id), "the sweep must not touch {what}");
+    }
+}
+
+#[sqlx::test]
+async fn retention_window_is_honoured_at_the_boundary(pool: PgPool) {
+    let event_id = seed_event(&pool, "sweep-boundary").await;
+    let user_id = seed_user(&pool, event_id, "Boundary").await;
+
+    let inside = seed_upload(
+        &pool,
+        event_id,
+        user_id,
+        "failed",
+        Some(13),
+        "originals/e/inside.jpg",
+    )
+    .await;
+    let outside = seed_upload(
+        &pool,
+        event_id,
+        user_id,
+        "failed",
+        Some(15),
+        "originals/e/outside.jpg",
+    )
+    .await;
+
+    let selected = sweep_selects(&pool, 14).await;
+    assert!(
+        selected.contains(&outside),
+        "15 days old must be past a 14-day window"
+    );
+    assert!(
+        !selected.contains(&inside),
+        "13 days old must still be retained"
+    );
+}
+
+#[sqlx::test]
+async fn clearing_original_path_makes_the_sweep_idempotent(pool: PgPool) {
+    // The sweep clears `original_path` after reclaiming the file. Without that, a row whose
+    // file is already gone is re-selected on every hourly tick forever.
+    let event_id = seed_event(&pool, "sweep-idempotent").await;
+    let user_id = seed_user(&pool, event_id, "Idem").await;
+    let id = seed_upload(
+        &pool,
+        event_id,
+        user_id,
+        "failed",
+        Some(30),
+        "originals/e/once.jpg",
+    )
+    .await;
+
+    assert_eq!(sweep_selects(&pool, 14).await, vec![id]);
+
+    sqlx::query("UPDATE upload SET original_path = '' WHERE id = $1")
+        .bind(id)
+        .execute(&pool)
+        .await
+        .expect("clear path");
+
+    assert!(
+        sweep_selects(&pool, 14).await.is_empty(),
+        "a swept row must not come back"
+    );
+}
diff --git a/e2e/loadtest/README.md b/e2e/loadtest/README.md
index e78c810..77f70ba 100644
--- a/e2e/loadtest/README.md
+++ b/e2e/loadtest/README.md
@@ -9,12 +9,12 @@ acting as the showcase display.
 
 **Validate the shipping config.** We run at the real production defaults —
 compression concurrency (`COMPRESSION_WORKER_CONCURRENCY`, default **2**), DB
-pool (default **10**), quotas **on** — and answer: *does the app survive the
-event, and how far behind real-time does the diashow fall?*
+pool (default **10**), quotas **on** — and answer: _does the app survive the
+event, and how far behind real-time does the diashow fall?_
 
 The headline metric is **pipeline latency**: time from an upload succeeding to
-its preview being ready (`upload-processed` SSE event) — i.e. *how long until the
-photo appears on the diashow*. A backlog that builds is fine; a backlog that
+its preview being ready (`upload-processed` SSE event) — i.e. _how long until the
+photo appears on the diashow_. A backlog that builds is fine; a backlog that
 **never drains** is a fail for a live event.
 
 ## Methodology: what we change vs. shipping
@@ -86,13 +86,13 @@ compression backlog to drain** before reporting.
 
 ## What the flags mean
 
-| Flag | Meaning |
-|------|---------|
-| `✗ 5xx` | server errored under load — hard fail |
-| `✗ 507` | quota rejected uploads — disk/quota misconfig for the event size |
+| Flag                      | Meaning                                                                      |
+| ------------------------- | ---------------------------------------------------------------------------- |
+| `✗ 5xx`                   | server errored under load — hard fail                                        |
+| `✗ 507`                   | quota rejected uploads — disk/quota misconfig for the event size             |
 | `✗ backlog did not drain` | compression can't keep up even after uploads stop — diashow never catches up |
-| `⚠ pipeline p95 > 60s` | photos take >1 min to appear on the diashow at peak |
-| `⚠ SSE resyncs` | live consumers lagged the broadcast channel |
+| `⚠ pipeline p95 > 60s`    | photos take >1 min to appear on the diashow at peak                          |
+| `⚠ SSE resyncs`           | live consumers lagged the broadcast channel                                  |
 
 ## Knobs
 
@@ -101,7 +101,7 @@ All via env (see header of `driver.mjs`): `LT_GUESTS`, `LT_IMAGES`,
 `LT_TRUNCATE`, `LT_DRAIN_TIMEOUT_SEC`, `LT_KEEP_RATELIMITS`, `LT_BASE`,
 `LT_APP_CONTAINER`, `LT_DB_CONTAINER`.
 
-To later answer *"what config should I deploy?"*, re-run with a rebuilt stack
+To later answer _"what config should I deploy?"_, re-run with a rebuilt stack
 that sets `COMPRESSION_WORKER_CONCURRENCY` higher (boot-time env var in
 `docker-compose.test.yml`) and compare the pipeline-latency / drain numbers.
 
diff --git a/e2e/loadtest/confirm-diashow-fix.mjs b/e2e/loadtest/confirm-diashow-fix.mjs
index 522f54b..4d01184 100644
--- a/e2e/loadtest/confirm-diashow-fix.mjs
+++ b/e2e/loadtest/confirm-diashow-fix.mjs
@@ -10,17 +10,40 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 const j = (r) => r.json();
 
 const adminLogin = () =>
-  fetch(`${BASE}/api/v1/admin/login`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ password: 'admin-test-pw' }) }).then(j).then((b) => b.jwt);
+  fetch(`${BASE}/api/v1/admin/login`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ password: 'admin-test-pw' }),
+  })
+    .then(j)
+    .then((b) => b.jwt);
 const join = (name) =>
-  fetch(`${BASE}/api/v1/join`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ display_name: name }) }).then(j);
+  fetch(`${BASE}/api/v1/join`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ display_name: name }),
+  }).then(j);
 async function truncate(admin) {
-  await fetch(`${BASE}/api/v1/admin/__truncate`, { method: 'POST', headers: { Authorization: `Bearer ${admin}` } });
+  await fetch(`${BASE}/api/v1/admin/__truncate`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${admin}` },
+  });
 }
 async function upload(jwt) {
   const form = new FormData();
-  form.append('file', new Blob([readFileSync('/tmp/eventsnap-loadtest/photos/photo_000.jpg')], { type: 'image/jpeg' }), 'live.jpg');
+  form.append(
+    'file',
+    new Blob([readFileSync('/tmp/eventsnap-loadtest/photos/photo_000.jpg')], {
+      type: 'image/jpeg',
+    }),
+    'live.jpg'
+  );
   form.append('caption', 'LIVE-PROBE');
-  const r = await fetch(`${BASE}/api/v1/upload`, { method: 'POST', headers: { Authorization: `Bearer ${jwt}` }, body: form });
+  const r = await fetch(`${BASE}/api/v1/upload`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${jwt}` },
+    body: form,
+  });
   return (await r.json()).id;
 }
 
@@ -35,7 +58,9 @@ const browser = await chromium.launch();
 const ctx = await browser.newContext({ viewport: { width: 1280, height: 800 } });
 const page = await ctx.newPage();
 const streamReqs = [];
-page.on('request', (req) => { if (req.url().includes('/stream')) streamReqs.push(req.url().replace(BASE, '')); });
+page.on('request', (req) => {
+  if (req.url().includes('/stream')) streamReqs.push(req.url().replace(BASE, ''));
+});
 
 await page.goto(`${BASE}/join`, { waitUntil: 'domcontentloaded' });
 await page.evaluate((g) => {
@@ -53,7 +78,9 @@ const emptyBefore = (await page.locator('text=Noch keine Beiträge').count()) >
 const streamOpened = streamReqs.length > 0;
 console.log(`\n1) direct /diashow on empty event:`);
 console.log(`   "Noch keine Beiträge" shown: ${emptyBefore}  (expected: true)`);
-console.log(`   SSE stream opened: ${streamOpened}  ${streamOpened ? '('+streamReqs.join(', ')+')' : ''}  (expected: true — this is the fix)`);
+console.log(
+  `   SSE stream opened: ${streamOpened}  ${streamOpened ? '(' + streamReqs.join(', ') + ')' : ''}  (expected: true — this is the fix)`
+);
 
 // Now a guest uploads a photo while the display is open.
 console.log(`\n2) guest uploads a photo (display already open)…`);
@@ -65,7 +92,11 @@ for (let i = 0; i < 15; i++) {
   await sleep(1000);
   const stillEmpty = (await page.locator('text=Noch keine Beiträge').count()) > 0;
   const imgs = await page.locator('img').count();
-  if (!stillEmpty && imgs > 0) { appeared = true; console.log(`   photo appeared live after ~${i + 1}s (img rendered, placeholder gone)`); break; }
+  if (!stillEmpty && imgs > 0) {
+    appeared = true;
+    console.log(`   photo appeared live after ~${i + 1}s (img rendered, placeholder gone)`);
+    break;
+  }
 }
 if (!appeared) console.log(`   ✗ photo did NOT appear within 15s`);
 
diff --git a/e2e/loadtest/driver.mjs b/e2e/loadtest/driver.mjs
index 2276c89..22c197e 100644
--- a/e2e/loadtest/driver.mjs
+++ b/e2e/loadtest/driver.mjs
@@ -132,9 +132,19 @@ const truncate = (adminJwt) =>
   api('/admin/__truncate', { method: 'POST', token: adminJwt, expect: [204] });
 
 const CAPTIONS = [
-  'Was für ein magischer Tag 💍', 'Der erste Tanz 🕺', 'Prost! 🥂', 'Die Torte 🍰',
-  'Feuerwerk 🎆', 'Beste Freunde 💕', 'Was für eine Stimmung! 🎉', 'Details 🌸',
-  'Sonnenuntergang 🌅', 'Tanzfläche brennt 🔥', null, null, null,
+  'Was für ein magischer Tag 💍',
+  'Der erste Tanz 🕺',
+  'Prost! 🥂',
+  'Die Torte 🍰',
+  'Feuerwerk 🎆',
+  'Beste Freunde 💕',
+  'Was für eine Stimmung! 🎉',
+  'Details 🌸',
+  'Sonnenuntergang 🌅',
+  'Tanzfläche brennt 🔥',
+  null,
+  null,
+  null,
 ];
 const TAGS = ['hochzeit', 'liebe', 'party', 'tanzen', 'natur', 'feier', 'freunde', 'dessert'];
 
@@ -238,9 +248,12 @@ async function sampleResources() {
   const out = { ts: now() };
   try {
     const { stdout } = await execFileAsync('docker', [
-      'stats', '--no-stream', '--format',
+      'stats',
+      '--no-stream',
+      '--format',
       '{{.Name}}|{{.CPUPerc}}|{{.MemUsage}}',
-      cfg.appContainer, cfg.dbContainer,
+      cfg.appContainer,
+      cfg.dbContainer,
     ]);
     out.docker = stdout.trim();
   } catch (e) {
@@ -259,8 +272,15 @@ async function sampleResources() {
 
 function psql(sql) {
   return execFileAsync('docker', [
-    'exec', cfg.dbContainer, 'psql', '-U', 'eventsnap_test', '-d', 'eventsnap_test',
-    '-tAc', sql,
+    'exec',
+    cfg.dbContainer,
+    'psql',
+    '-U',
+    'eventsnap_test',
+    '-d',
+    'eventsnap_test',
+    '-tAc',
+    sql,
   ]);
 }
 
@@ -292,8 +312,13 @@ function summarize(nums) {
   const s = [...nums].sort((a, b) => a - b);
   const sum = s.reduce((a, b) => a + b, 0);
   return {
-    n: s.length, min: s[0], max: s[s.length - 1], mean: Math.round(sum / s.length),
-    p50: pct(s, 50), p95: pct(s, 95), p99: pct(s, 99),
+    n: s.length,
+    min: s[0],
+    max: s[s.length - 1],
+    mean: Math.round(sum / s.length),
+    p50: pct(s, 50),
+    p95: pct(s, 95),
+    p99: pct(s, 99),
   };
 }
 
@@ -490,7 +515,9 @@ async function main() {
   await sleep(cfg.windowSec * 1000 + 500);
   await Promise.all(burstPromises);
   clearInterval(ticker);
-  console.log(`[run] all bursts issued. uploaded ${done}, ok ${uploads.filter((u) => u.status === 201).length}`);
+  console.log(
+    `[run] all bursts issued. uploaded ${done}, ok ${uploads.filter((u) => u.status === 201).length}`
+  );
 
   // Drain: wait for compression backlog to clear (SSE processed ⊇ successful ids)
   console.log('[drain] waiting for compression backlog to clear…');
@@ -589,21 +616,28 @@ async function main() {
   console.log('\n' + '━'.repeat(72));
   console.log('RESULTS');
   console.log('━'.repeat(72));
-  console.log(`uploads: ${okUploads.length}/${uploads.length} ok — byStatus ${JSON.stringify(byStatus)}`);
+  console.log(
+    `uploads: ${okUploads.length}/${uploads.length} ok — byStatus ${JSON.stringify(byStatus)}`
+  );
   console.log(`upload latency ms: ${JSON.stringify(uploadLatency)}`);
   console.log(`pipeline latency ms (upload→preview ready): ${JSON.stringify(pipelineLatency)}`);
   console.log(`backlog drain: ${(drainMs / 1000).toFixed(1)}s, cleared=${report.drain.cleared}`);
   console.log(`final db compression status: ${JSON.stringify(finalCounts)}`);
-  console.log(`sse: ${sseClients.length} conns, ${totalReconnects} reconnects, ${totalResyncs} resyncs`);
+  console.log(
+    `sse: ${sseClients.length} conns, ${totalReconnects} reconnects, ${totalResyncs} resyncs`
+  );
   console.log(`\nfull report → ${outPath}`);
 
   // Heuristic pass/fail flags (validate shipping config)
   const flags = [];
-  const err5xx = Object.entries(byStatus).filter(([s]) => +s >= 500).reduce((a, [, n]) => a + n, 0);
+  const err5xx = Object.entries(byStatus)
+    .filter(([s]) => +s >= 500)
+    .reduce((a, [, n]) => a + n, 0);
   if (err5xx > 0) flags.push(`✗ ${err5xx} server errors (5xx)`);
   if (byStatus['507']) flags.push(`✗ ${byStatus['507']} quota rejections (507)`);
   if (byStatus['413']) flags.push(`⚠ ${byStatus['413']} too-large (413)`);
-  if (byStatus['429']) flags.push(`⚠ ${byStatus['429']} rate-limited (429) — unexpected with limits off`);
+  if (byStatus['429'])
+    flags.push(`⚠ ${byStatus['429']} rate-limited (429) — unexpected with limits off`);
   if (!report.drain.cleared) flags.push(`✗ backlog did NOT drain within ${cfg.drainTimeoutSec}s`);
   if (totalResyncs > sseClients.length) flags.push(`⚠ ${totalResyncs} SSE resyncs (consumer lag)`);
   if (pipelineLatency && pipelineLatency.p95 > 60000)
diff --git a/e2e/shots.mjs b/e2e/shots.mjs
index dcf2b6d..a2a19e5 100644
--- a/e2e/shots.mjs
+++ b/e2e/shots.mjs
@@ -4,24 +4,44 @@ import { chromium, devices } from '@playwright/test';
 import { Client } from 'pg';
 import { readFileSync, mkdirSync } from 'node:fs';
 
-
 const BASE = 'http://localhost:3101';
 const PHOTOS = '/tmp/eventsnap-shots/photos';
 const OUT = '/tmp/eventsnap-shots';
 mkdirSync(OUT, { recursive: true });
 
 const api = (path, opts = {}) =>
-  fetch(`${BASE}/api/v1${path}`, opts).then(async (r) => ({ status: r.status, body: await r.text().then((t) => { try { return JSON.parse(t); } catch { return t; } }) }));
+  fetch(`${BASE}/api/v1${path}`, opts).then(async (r) => ({
+    status: r.status,
+    body: await r.text().then((t) => {
+      try {
+        return JSON.parse(t);
+      } catch {
+        return t;
+      }
+    }),
+  }));
 
-const authHeaders = (jwt, json = true) => ({ Authorization: `Bearer ${jwt}`, ...(json ? { 'Content-Type': 'application/json' } : {}) });
+const authHeaders = (jwt, json = true) => ({
+  Authorization: `Bearer ${jwt}`,
+  ...(json ? { 'Content-Type': 'application/json' } : {}),
+});
 
 async function adminLogin() {
-  const r = await api('/admin/login', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ password: 'admin-test-pw' }) });
+  const r = await api('/admin/login', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ password: 'admin-test-pw' }),
+  });
   return r.body.jwt;
 }
 async function joinGuest(name) {
-  const r = await api('/join', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ display_name: name }) });
-  if (r.status !== 201) throw new Error('join failed ' + name + ' ' + r.status + ' ' + JSON.stringify(r.body));
+  const r = await api('/join', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ display_name: name }),
+  });
+  if (r.status !== 201)
+    throw new Error('join failed ' + name + ' ' + r.status + ' ' + JSON.stringify(r.body));
   return r.body; // {jwt,pin,user_id}
 }
 async function upload(jwt, file, caption, hashtags) {
@@ -29,7 +49,11 @@ async function upload(jwt, file, caption, hashtags) {
   form.append('file', new Blob([readFileSync(file)], { type: 'image/jpeg' }), 'photo.jpg');
   if (caption) form.append('caption', caption);
   if (hashtags) form.append('hashtags', hashtags);
-  const r = await fetch(`${BASE}/api/v1/upload`, { method: 'POST', headers: authHeaders(jwt, false), body: form });
+  const r = await fetch(`${BASE}/api/v1/upload`, {
+    method: 'POST',
+    headers: authHeaders(jwt, false),
+    body: form,
+  });
   if (r.status !== 201) throw new Error('upload failed ' + r.status + ' ' + (await r.text()));
   return (await r.json()).id;
 }
@@ -37,16 +61,34 @@ async function like(jwt, id) {
   await fetch(`${BASE}/api/v1/upload/${id}/like`, { method: 'POST', headers: authHeaders(jwt) });
 }
 async function comment(jwt, id, body) {
-  await fetch(`${BASE}/api/v1/upload/${id}/comments`, { method: 'POST', headers: authHeaders(jwt), body: JSON.stringify({ body }) });
+  await fetch(`${BASE}/api/v1/upload/${id}/comments`, {
+    method: 'POST',
+    headers: authHeaders(jwt),
+    body: JSON.stringify({ body }),
+  });
 }
 
-const pg = () => new Client({ host: 'localhost', port: 55432, user: 'eventsnap_test', password: 'eventsnap_test', database: 'eventsnap_test' });
+const pg = () =>
+  new Client({
+    host: 'localhost',
+    port: 55432,
+    user: 'eventsnap_test',
+    password: 'eventsnap_test',
+    database: 'eventsnap_test',
+  });
 
 async function truncate(adminJwt) {
-  await fetch(`${BASE}/api/v1/admin/__truncate`, { method: 'POST', headers: authHeaders(adminJwt) });
+  await fetch(`${BASE}/api/v1/admin/__truncate`, {
+    method: 'POST',
+    headers: authHeaders(adminJwt),
+  });
 }
 async function patchConfig(adminJwt, patch) {
-  await fetch(`${BASE}/api/v1/admin/config`, { method: 'PATCH', headers: authHeaders(adminJwt), body: JSON.stringify(patch) });
+  await fetch(`${BASE}/api/v1/admin/config`, {
+    method: 'PATCH',
+    headers: authHeaders(adminJwt),
+    body: JSON.stringify(patch),
+  });
 }
 
 // ---- SEED ----
@@ -54,9 +96,27 @@ console.log('[seed] admin login + reset');
 let admin = await adminLogin();
 await truncate(admin);
 admin = await adminLogin();
-await patchConfig(admin, { rate_limits_enabled: 'false', upload_rate_enabled: 'false', feed_rate_enabled: 'false', export_rate_enabled: 'false', join_rate_enabled: 'false', quota_enabled: 'false', storage_quota_enabled: 'false', upload_count_quota_enabled: 'false' });
+await patchConfig(admin, {
+  rate_limits_enabled: 'false',
+  upload_rate_enabled: 'false',
+  feed_rate_enabled: 'false',
+  export_rate_enabled: 'false',
+  join_rate_enabled: 'false',
+  quota_enabled: 'false',
+  storage_quota_enabled: 'false',
+  upload_count_quota_enabled: 'false',
+});
 
-const guests = ['Anna Bauer', 'Lukas Weber', 'Mia Schulz', 'Jonas Fischer', 'Emma Wagner', 'Ben Hoffmann', 'Sophie Klein', 'Paul Richter'];
+const guests = [
+  'Anna Bauer',
+  'Lukas Weber',
+  'Mia Schulz',
+  'Jonas Fischer',
+  'Emma Wagner',
+  'Ben Hoffmann',
+  'Sophie Klein',
+  'Paul Richter',
+];
 const accounts = {};
 for (const g of guests) accounts[g] = await joinGuest(g);
 console.log('[seed] joined', guests.length, 'guests');
@@ -94,13 +154,23 @@ await comment(accounts['Ben Hoffmann'].jwt, ids[1], 'Was ein Abend!');
 console.log('[seed] likes + comments done');
 
 // Make one guest a host so /host renders populated
-await fetch(`${BASE}/api/v1/host/users/${accounts['Anna Bauer'].user_id}/role`, { method: 'PATCH', headers: authHeaders(admin), body: JSON.stringify({ role: 'host' }) });
+await fetch(`${BASE}/api/v1/host/users/${accounts['Anna Bauer'].user_id}/role`, {
+  method: 'PATCH',
+  headers: authHeaders(admin),
+  body: JSON.stringify({ role: 'host' }),
+});
 
 // Wait for compression to finish so previews render
-const c = pg(); await c.connect();
+const c = pg();
+await c.connect();
 for (let t = 0; t < 40; t++) {
-  const r = await c.query(`SELECT COUNT(*)::int AS n FROM upload WHERE compression_status <> 'done' AND deleted_at IS NULL`);
-  if (r.rows[0].n === 0) { console.log('[seed] compression done'); break; }
+  const r = await c.query(
+    `SELECT COUNT(*)::int AS n FROM upload WHERE compression_status <> 'done' AND deleted_at IS NULL`
+  );
+  if (r.rows[0].n === 0) {
+    console.log('[seed] compression done');
+    break;
+  }
   await new Promise((res) => setTimeout(res, 500));
 }
 await c.end();
@@ -113,17 +183,20 @@ const shot = async (label, theme, who, route, prep) => {
   const page = await ctx.newPage();
   // Seed localStorage on the origin
   await page.goto(`${BASE}/join`, { waitUntil: 'domcontentloaded' });
-  await page.evaluate(({ jwt, pin, uid, name, theme, mode }) => {
-    localStorage.setItem('eventsnap_theme', theme);
-    localStorage.setItem('eventsnap_data_mode', mode);
-    if (jwt) {
-      localStorage.setItem('eventsnap_jwt', jwt);
-      localStorage.setItem('eventsnap_pin', pin);
-      localStorage.setItem('eventsnap_user_id', uid);
-      localStorage.setItem('eventsnap_display_name', name);
-    }
-    localStorage.setItem('eventsnap_guide_seen', '1');
-  }, { jwt: who?.jwt, pin: who?.pin, uid: who?.user_id, name: who?.name, theme, mode: 'saver' });
+  await page.evaluate(
+    ({ jwt, pin, uid, name, theme, mode }) => {
+      localStorage.setItem('eventsnap_theme', theme);
+      localStorage.setItem('eventsnap_data_mode', mode);
+      if (jwt) {
+        localStorage.setItem('eventsnap_jwt', jwt);
+        localStorage.setItem('eventsnap_pin', pin);
+        localStorage.setItem('eventsnap_user_id', uid);
+        localStorage.setItem('eventsnap_display_name', name);
+      }
+      localStorage.setItem('eventsnap_guide_seen', '1');
+    },
+    { jwt: who?.jwt, pin: who?.pin, uid: who?.user_id, name: who?.name, theme, mode: 'saver' }
+  );
   await page.goto(`${BASE}${route}`, { waitUntil: 'domcontentloaded' });
   await page.waitForTimeout(1200);
   if (prep) await prep(page);
@@ -141,10 +214,17 @@ for (const theme of ['light', 'dark']) {
   await shot('01-join', theme, null, '/join');
   await shot('02-feed-list', theme, hostWho, '/feed');
   await shot('03-feed-grid', theme, hostWho, '/feed', async (p) => {
-    await p.getByLabel('Rasteransicht').click().catch(() => {});
+    await p
+      .getByLabel('Rasteransicht')
+      .click()
+      .catch(() => {});
   });
   await shot('04-lightbox', theme, hostWho, '/feed', async (p) => {
-    await p.locator('img').first().click().catch(() => {});
+    await p
+      .locator('img')
+      .first()
+      .click()
+      .catch(() => {});
     await p.waitForTimeout(500);
   });
   await shot('05-account', theme, hostWho, '/account');
diff --git a/e2e/specs/01-auth/rate-limit-shared-nat.spec.ts b/e2e/specs/01-auth/rate-limit-shared-nat.spec.ts
index f025b30..744188b 100644
--- a/e2e/specs/01-auth/rate-limit-shared-nat.spec.ts
+++ b/e2e/specs/01-auth/rate-limit-shared-nat.spec.ts
@@ -142,3 +142,65 @@ test.describe('Rate limits — guests behind a shared NAT', () => {
     expect((await mintAndFetch(host.jwt)).status).not.toBe(429);
   });
 });
+
+test.describe('Rate limits — /recover name cycling', () => {
+  test('cycling names from one IP hits the ceiling, while one name is still throttled', async ({
+    api,
+    adminToken,
+  }) => {
+    // /recover is keyed `recover:{ip}:{name}` — right for its job (stopping someone who
+    // knows a display name from burning the victim's 3-strike PIN counter), but the name is
+    // ATTACKER-CHOSEN, so cycling names minted a fresh bucket every time. Behind it sits a
+    // cost-12 bcrypt verify, including an unconditional throwaway one for unknown names, so
+    // a name generator was the cheapest way to make the server hash forever.
+    //
+    // Squeeze the ceiling so the flood is reproducible without firing 30+ requests.
+    await api.patchConfig(adminToken, {
+      rate_limits_enabled: 'true',
+      recover_rate_enabled: 'true',
+      recover_ip_rate_per_min: '5',
+    });
+
+    const attempt = (name: string) =>
+      fetch(`${BASE}/api/v1/recover`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ display_name: name, pin: '0000' }),
+      });
+
+    // Every name is distinct, so the per-name bucket can never fire — only the ceiling can.
+    const codes: number[] = [];
+    for (let i = 0; i < 12; i++) codes.push((await attempt(`Unbekannt${i}_${Date.now()}`)).status);
+
+    expect(
+      codes.filter((c) => c === 429).length,
+      'name cycling must be capped by the per-IP ceiling'
+    ).toBeGreaterThan(0);
+
+    const throttled = await attempt(`Unbekannt99_${Date.now()}`);
+    expect(throttled.status).toBe(429);
+    expect(Number(throttled.headers.get('retry-after'))).toBeGreaterThan(0);
+  });
+
+  test('the per-name bucket still protects a real account', async ({ api, adminToken, guest }) => {
+    // The ceiling must not have REPLACED the anti-guessing control. With a generous ceiling,
+    // repeated wrong PINs against ONE name must still be shut down by the per-name bucket.
+    const victim = await guest('PinVictim');
+    await api.patchConfig(adminToken, {
+      rate_limits_enabled: 'true',
+      recover_rate_enabled: 'true',
+      recover_ip_rate_per_min: '1000',
+    });
+
+    const attempt = () =>
+      fetch(`${BASE}/api/v1/recover`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ display_name: victim.displayName, pin: '9999' }),
+      });
+
+    const codes: number[] = [];
+    for (let i = 0; i < 7; i++) codes.push((await attempt()).status);
+    expect(codes.at(-1), 'guessing one name must still be throttled').toBe(429);
+  });
+});
diff --git a/e2e/specs/03-feed/video-playback.spec.ts b/e2e/specs/03-feed/video-playback.spec.ts
new file mode 100644
index 0000000..dbbd6a4
--- /dev/null
+++ b/e2e/specs/03-feed/video-playback.spec.ts
@@ -0,0 +1,172 @@
+/**
+ * Regression guard — videos must actually play.
+ *
+ * Two independent defects made every video unplayable, and nothing in the suite covered
+ * either one (no test anywhere played media or asserted a `<video>` src):
+ *
+ *  1. The lightbox fed `<video>` the URL from `pickMediaUrl`, which is mime-agnostic.
+ *     Compression only ever produces a *thumbnail* for a video — one ffmpeg frame — so in
+ *     the DEFAULT saver mode the element's src was `/api/v1/upload/{id}/thumbnail`: a JPEG,
+ *     served as image/jpeg with nosniff so the browser can't even sniff its way out.
+ *     Chromium reported DEMUXER_ERROR_COULD_NOT_OPEN.
+ *
+ *  2. `stream_media_file` ignored `Range` entirely — always 200 with the whole body, never
+ *     an Accept-Ranges or Content-Range. iOS Safari opens every `<video>` with a
+ *     `Range: bytes=0-1` probe and abandons the load without a 206, so video failed on the
+ *     app's primary platform even in `original` data mode.
+ *
+ * Fixing either alone still leaves video broken, so both are asserted here.
+ */
+import { test, expect } from '../../fixtures/test';
+import { uploadRaw } from '../../helpers/upload-client';
+import { BASE } from '../../helpers/env';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const SAMPLE_MP4 = join(process.cwd(), 'fixtures', 'media', 'sample.mp4');
+
+async function seedVideo(jwt: string): Promise<string> {
+  const res = await uploadRaw(jwt, readFileSync(SAMPLE_MP4), {
+    filename: 'clip.mp4',
+    contentType: 'video/mp4',
+    caption: 'ein Video',
+  });
+  if (res.status !== 201) throw new Error(`video seed failed: ${res.status}`);
+  return ((await res.json()) as { id: string }).id;
+}
+
+test.describe('Video — the lightbox plays it', () => {
+  test('the <video> src is the original, not the thumbnail JPEG', async ({
+    page,
+    guest,
+    signIn,
+  }) => {
+    const g = await guest('VideoWatcher');
+    const id = await seedVideo(g.jwt);
+
+    await signIn(page, g);
+    await page.goto('/feed');
+
+    const card = page.locator('article').first();
+    await expect(card).toBeVisible({ timeout: 15_000 });
+    await card.getByRole('button', { name: 'Bild vergrößern' }).click();
+
+    const video = page.locator('video');
+    await expect(video).toBeVisible({ timeout: 10_000 });
+
+    // The bug in one assertion: this was `/thumbnail` in the default data mode.
+    await expect(video).toHaveAttribute('src', `/api/v1/upload/${id}/original`);
+
+    // The poster SHOULD still be the thumbnail — that's what it's for.
+    await expect(video).toHaveAttribute('poster', `/api/v1/upload/${id}/thumbnail`);
+
+    // And the browser must accept the bytes as media. preload="none" means nothing is
+    // fetched until we ask, so drive a load explicitly and wait for metadata.
+    const readyState = await video.evaluate(async (el: HTMLVideoElement) => {
+      el.preload = 'metadata';
+      el.load();
+      await new Promise<void>((resolve) => {
+        if (el.readyState > 0) return resolve();
+        el.addEventListener('loadedmetadata', () => resolve(), { once: true });
+        el.addEventListener('error', () => resolve(), { once: true });
+        setTimeout(resolve, 15_000);
+      });
+      return { ready: el.readyState, err: el.error?.message ?? null };
+    });
+    expect(readyState.err, `the browser rejected the media: ${readyState.err}`).toBeNull();
+    expect(readyState.ready, 'video metadata must load').toBeGreaterThan(0);
+  });
+
+  test('the video body is not downloaded before the user presses play', async ({
+    page,
+    guest,
+    signIn,
+  }) => {
+    // saver mode exists to protect a guest's mobile data, and there is no smaller video
+    // derivative to fall back to — so opening the lightbox must not pull the file down.
+    //
+    // Asserting "no request at all" would be wrong: WebKit opens a connection for a
+    // preload="none" <video> and immediately ABORTS it (observed: GET with no Range,
+    // response status 0, nothing transferred), whereas Chromium issues nothing. The
+    // portable guarantee — and the one that actually protects the data plan — is that no
+    // response carrying the body ever completes. Dropping preload="none" fails this.
+    const g = await guest('VideoThrifty');
+    const id = await seedVideo(g.jwt);
+
+    await signIn(page, g);
+    const delivered: string[] = [];
+    page.on('response', (r) => {
+      if (!r.url().includes(`/upload/${id}/original`)) return;
+      // status 0 = aborted before any bytes landed.
+      if (r.status() === 200 || r.status() === 206) {
+        delivered.push(`${r.status()} len=${r.headers()['content-length'] ?? '?'}`);
+      }
+    });
+
+    await page.goto('/feed');
+    const card = page.locator('article').first();
+    await expect(card).toBeVisible({ timeout: 15_000 });
+    await card.getByRole('button', { name: 'Bild vergrößern' }).click();
+    await expect(page.locator('video')).toBeVisible({ timeout: 10_000 });
+    await page.waitForTimeout(2000);
+
+    expect(delivered, 'no video bytes may be delivered before play').toEqual([]);
+  });
+});
+
+test.describe('Media — HTTP Range', () => {
+  test('a range request is answered 206 with the right slice', async ({ guest }) => {
+    const g = await guest('RangeReader');
+    const id = await seedVideo(g.jwt);
+    const url = `${BASE}/api/v1/upload/${id}/original`;
+
+    const full = await fetch(url);
+    expect(full.status).toBe(200);
+    expect(full.headers.get('accept-ranges'), 'clients must be told seeking works').toBe('bytes');
+    const total = Number(full.headers.get('content-length'));
+    expect(total).toBeGreaterThan(0);
+
+    // The exact probe iOS Safari opens a <video> with. Two bytes, inclusive.
+    const probe = await fetch(url, { headers: { Range: 'bytes=0-1' } });
+    expect(probe.status, 'iOS abandons the load without a 206').toBe(206);
+    expect(probe.headers.get('content-range')).toBe(`bytes 0-1/${total}`);
+    expect(Number(probe.headers.get('content-length'))).toBe(2);
+    expect((await probe.arrayBuffer()).byteLength).toBe(2);
+
+    // A mid-file seek must return the matching slice, not the whole body.
+    const mid = await fetch(url, { headers: { Range: 'bytes=10-19' } });
+    expect(mid.status).toBe(206);
+    expect(mid.headers.get('content-range')).toBe(`bytes 10-19/${total}`);
+    const midBytes = Buffer.from(await mid.arrayBuffer());
+    expect(midBytes.byteLength).toBe(10);
+    expect(midBytes).toEqual(Buffer.from(await full.arrayBuffer()).subarray(10, 20));
+
+    // Open-ended range runs to EOF.
+    const tail = await fetch(url, { headers: { Range: `bytes=${total - 5}-` } });
+    expect(tail.status).toBe(206);
+    expect(Number(tail.headers.get('content-length'))).toBe(5);
+
+    // Past EOF must be 416 — answering 200 makes a player re-request forever.
+    const bad = await fetch(url, { headers: { Range: `bytes=${total + 10}-` } });
+    expect(bad.status).toBe(416);
+    expect(bad.headers.get('content-range')).toBe(`bytes */${total}`);
+  });
+
+  test('image derivatives are range-capable too', async ({ guest, db }) => {
+    // Same helper serves all four media routes, so the guarantee is uniform.
+    const g = await guest('RangeImages');
+    const res = await uploadRaw(
+      g.jwt,
+      readFileSync(join(process.cwd(), 'fixtures', 'media', 'sample.jpg')),
+      { filename: 'r.jpg', contentType: 'image/jpeg' }
+    );
+    const { id } = (await res.json()) as { id: string };
+    await expect.poll(() => db.compressionStatus(id), { timeout: 30_000 }).toBe('done');
+
+    const preview = await fetch(`${BASE}/api/v1/upload/${id}/preview`, {
+      headers: { Range: 'bytes=0-9' },
+    });
+    expect(preview.status).toBe(206);
+    expect(Number(preview.headers.get('content-length'))).toBe(10);
+  });
+});
diff --git a/e2e/specs/04-host/role-identity-reset.spec.ts b/e2e/specs/04-host/role-identity-reset.spec.ts
new file mode 100644
index 0000000..ee8140f
--- /dev/null
+++ b/e2e/specs/04-host/role-identity-reset.spec.ts
@@ -0,0 +1,102 @@
+/**
+ * Regression guard — the role must follow the identity, not the tab.
+ *
+ * The `role` store is a module-level singleton seeded ONCE at import. `goto()` is a
+ * client-side navigation, so leaving and re-joining in the same tab re-imports nothing and
+ * re-runs no `onMount` — the previous user's role simply stayed. A host who left and a
+ * guest who then joined kept `isStaff === true` and were offered "🚫 Beitrag entfernen" on
+ * other people's photos. The backend 403s the delete, so it was a false affordance rather
+ * than a privilege escalation, but `/feed` never fetched `/me/context`, so it never
+ * self-corrected either — it survived until a hard reload.
+ *
+ * The mirror case matters just as much and is easier to forget: a guest who recovers into a
+ * host account must GAIN the affordance without a reload.
+ */
+import { test, expect } from '../../fixtures/test';
+import { seedUpload } from '../../helpers/seed';
+import { JoinPage } from '../../page-objects';
+
+const REMOVE = /beitrag entfernen/i;
+
+test.describe('Role — follows the identity across a same-tab switch', () => {
+  test('a guest joining after a host leaves does NOT inherit host actions', async ({
+    page,
+    host,
+    guest,
+    signIn,
+  }) => {
+    // Someone else's photo — the only kind the removal action is offered on.
+    const author = await guest('RoleAuthor');
+    await seedUpload(author.jwt);
+
+    // 1. Host is signed in and DOES see the moderation action. Establishing this first is
+    //    what makes the negative assertion below meaningful.
+    await signIn(page, host);
+    await page.goto('/feed');
+    const card = page.locator('article').filter({ hasText: author.displayName }).first();
+    await expect(card).toBeVisible({ timeout: 15_000 });
+    await card.getByRole('button', { name: 'Mehr Aktionen' }).click();
+    await expect(page.getByRole('button', { name: REMOVE })).toBeVisible();
+    await page.keyboard.press('Escape');
+
+    // 2. Host leaves, in-app — no reload. This is the path "Event verlassen" takes.
+    await page.goto('/account');
+    await page.getByRole('button', { name: /event verlassen/i }).click();
+    const confirm = page.getByTestId('confirm-sheet-confirm');
+    if (await confirm.isVisible().catch(() => false)) await confirm.click();
+    await page.waitForURL('**/join', { timeout: 10_000 });
+
+    // 3. A brand-new guest joins in the same tab — the real flow, PIN modal and all.
+    const join = new JoinPage(page);
+    await join.joinAs(`Nachzuegler${Date.now() % 100000}`);
+    await join.continueToFeed();
+    await expect(page).toHaveURL(/\/feed$/, { timeout: 15_000 });
+
+    // 4. They must NOT be offered moderation on someone else's photo.
+    const card2 = page.locator('article').filter({ hasText: author.displayName }).first();
+    await expect(card2).toBeVisible({ timeout: 15_000 });
+    await card2.getByRole('button', { name: 'Mehr Aktionen' }).click();
+    await expect(
+      page.getByRole('button', { name: REMOVE }),
+      'a fresh guest must not inherit the previous user’s role'
+    ).toHaveCount(0);
+  });
+
+  test('a guest who recovers into a host account GAINS host actions without a reload', async ({
+    page,
+    api,
+    adminToken,
+    guest,
+    signIn,
+  }) => {
+    // The mirror. If the fix only cleared the role it would pass the test above and still
+    // leave a real host with no moderation until they reloaded.
+    const author = await guest('RoleAuthor2');
+    await seedUpload(author.jwt);
+
+    const futureHost = await guest('WillBeHost');
+    await signIn(page, futureHost);
+    await page.goto('/feed');
+    const card = page.locator('article').filter({ hasText: author.displayName }).first();
+    await expect(card).toBeVisible({ timeout: 15_000 });
+    await card.getByRole('button', { name: 'Mehr Aktionen' }).click();
+    await expect(page.getByRole('button', { name: REMOVE })).toHaveCount(0);
+    await page.keyboard.press('Escape');
+
+    // Promote them server-side. Their resident JWT still claims `role: guest`.
+    await api.setRole(adminToken, futureHost.userId, 'host');
+    const claim = JSON.parse(Buffer.from(futureHost.jwt.split('.')[1], 'base64').toString());
+    expect(claim.role, 'the token must still be stale for this to prove anything').toBe('guest');
+
+    // A plain in-app navigation back to the feed must pick up the live role.
+    await page.goto('/account');
+    await page.goto('/feed');
+    const card2 = page.locator('article').filter({ hasText: author.displayName }).first();
+    await expect(card2).toBeVisible({ timeout: 15_000 });
+    await card2.getByRole('button', { name: 'Mehr Aktionen' }).click();
+    await expect(
+      page.getByRole('button', { name: REMOVE }),
+      'the live role from /me/context must reach the feed'
+    ).toBeVisible({ timeout: 10_000 });
+  });
+});
diff --git a/e2e/specs/06-export/exif-orientation.spec.ts b/e2e/specs/06-export/exif-orientation.spec.ts
new file mode 100644
index 0000000..56cccc9
--- /dev/null
+++ b/e2e/specs/06-export/exif-orientation.spec.ts
@@ -0,0 +1,117 @@
+/**
+ * Regression guard — the keepsake must not be sideways.
+ *
+ * Round 1 taught the compression worker to apply EXIF orientation, which fixed the live app
+ * (feed preview + diashow display). The export worker was missed: it does NOT reuse those
+ * derivatives — it re-decodes the originals itself with `image::open`, which ignores the
+ * orientation tag — and then re-encodes to JPEG, which drops the tag, so the viewer has no
+ * way to recover it.
+ *
+ * The resulting damage was oddly shaped, which is what made it read as a viewer bug:
+ *   - Gallery.zip originals            → correct (byte-copied, EXIF intact)
+ *   - Memories viewer grid thumbnails  → ALWAYS sideways
+ *   - Memories viewer full image >5 MB → sideways (re-encoded at 2000px)
+ *   - Memories viewer full image ≤5 MB → correct (streamed byte-for-byte)
+ *
+ * So clicking a small photo silently "fixed" it and a large one didn't. This pins the
+ * thumbnail, which is the path every photo takes.
+ */
+import { test, expect } from '../../fixtures/test';
+import { uploadRaw } from '../../helpers/upload-client';
+import { BASE } from '../../helpers/env';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// 40x20 landscape pixels tagged Orientation=6 ("rotate 90° CW to display"), so anything
+// that honours the tag emits a PORTRAIT derivative.
+const EXIF_FIXTURE = join(process.cwd(), 'fixtures', 'media', 'portrait-exif6.jpg');
+
+/** Pixel dimensions from a JPEG's SOF marker — avoids an image dep for one assertion. */
+function jpegSize(buf: Buffer): { width: number; height: number } {
+  let i = 2;
+  while (i < buf.length) {
+    if (buf[i] !== 0xff) {
+      i++;
+      continue;
+    }
+    const marker = buf[i + 1];
+    if (marker >= 0xc0 && marker <= 0xcf && marker !== 0xc4 && marker !== 0xc8 && marker !== 0xcc) {
+      return { height: buf.readUInt16BE(i + 5), width: buf.readUInt16BE(i + 7) };
+    }
+    i += 2 + buf.readUInt16BE(i + 2);
+  }
+  throw new Error('no SOF marker found — not a JPEG?');
+}
+
+test.describe('Export — EXIF orientation in the keepsake', () => {
+  test('the Memories viewer thumbnail of a rotated photo is upright', async ({ host, db }) => {
+    test.setTimeout(90_000);
+    const bearer = { Authorization: `Bearer ${host.jwt}` };
+
+    const src = readFileSync(EXIF_FIXTURE);
+    // Sanity: the SOURCE really is stored landscape, or this test proves nothing.
+    const srcSize = jpegSize(src);
+    expect(srcSize.width).toBeGreaterThan(srcSize.height);
+
+    const up = await uploadRaw(host.jwt, src, {
+      filename: 'hochkant.jpg',
+      contentType: 'image/jpeg',
+      caption: 'hochkant',
+    });
+    expect(up.status).toBe(201);
+    const { id } = (await up.json()) as { id: string };
+    await expect.poll(() => db.compressionStatus(id), { timeout: 30_000 }).toBe('done');
+
+    const rel = await fetch(`${BASE}/api/v1/host/gallery/release`, {
+      method: 'POST',
+      headers: bearer,
+    });
+    expect(rel.status).toBe(204);
+
+    await expect
+      .poll(
+        async () => {
+          const res = await fetch(`${BASE}/api/v1/export/status`, { headers: bearer });
+          return (await res.json()).html?.status;
+        },
+        { timeout: 60_000, intervals: [500] }
+      )
+      .toBe('done');
+
+    const ticketRes = await fetch(`${BASE}/api/v1/export/ticket`, {
+      method: 'POST',
+      headers: bearer,
+    });
+    const { ticket } = (await ticketRes.json()) as { ticket: string };
+    const dl = await fetch(`${BASE}/api/v1/export/html?ticket=${encodeURIComponent(ticket)}`);
+    expect(dl.status).toBe(200);
+
+    const dir = mkdtempSync(join(tmpdir(), 'eventsnap-exif-'));
+    try {
+      const zipPath = join(dir, 'Memories.zip');
+      writeFileSync(zipPath, Buffer.from(await dl.arrayBuffer()));
+
+      const entries = execFileSync('unzip', ['-Z1', zipPath], { encoding: 'utf8' })
+        .split('\n')
+        .filter(Boolean);
+      const thumbEntry = entries.find((e) => e.includes(`${id}_thumb`));
+      expect(thumbEntry, `no thumbnail for ${id} in Memories.zip`).toBeTruthy();
+
+      // `-p` streams the entry to stdout. Extracting to disk instead fails with EACCES:
+      // the archive preserves the container's file mode, which the test user can't read.
+      const thumb = execFileSync('unzip', ['-p', zipPath, thumbEntry!], {
+        maxBuffer: 64 * 1024 * 1024,
+      });
+      const { width, height } = jpegSize(thumb);
+
+      expect(
+        height,
+        `the keepsake grid thumbnail is ${width}x${height} — EXIF orientation was not applied`
+      ).toBeGreaterThan(width);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/frontend/src/lib/auth.ts b/frontend/src/lib/auth.ts
index d02e8e1..48bfded 100644
--- a/frontend/src/lib/auth.ts
+++ b/frontend/src/lib/auth.ts
@@ -86,6 +86,7 @@ export function setAuth(
 	localStorage.setItem(USER_ID_KEY, userId);
 	if (displayName) localStorage.setItem(DISPLAY_NAME_KEY, displayName);
 	isAuthenticated.set(true);
+	fireSetAuthHooks();
 }
 
 /**
@@ -106,6 +107,7 @@ export function setAdminAuth(jwt: string, userId: string, displayName?: string):
 	sessionStorage.setItem(USER_ID_KEY, userId);
 	if (displayName) sessionStorage.setItem(DISPLAY_NAME_KEY, displayName);
 	isAuthenticated.set(true);
+	fireSetAuthHooks();
 }
 
 // Hook registry: cross-cutting stores (export-status, etc.) register a callback
@@ -118,6 +120,26 @@ export function onClearAuth(fn: () => void): void {
 	clearAuthHooks.push(fn);
 }
 
+// The mirror of `onClearAuth`, for stores that must be RE-SEEDED when a new identity
+// arrives rather than merely cleared. Without it, anything derived from the token
+// survives a logout→login in the same tab: `goto()` is a client-side navigation, so no
+// module is re-imported and no `onMount` re-runs, and the previous user's value simply
+// stays. Fires after the new token is resident, so hooks can read it.
+const setAuthHooks: Array<() => void> = [];
+export function onSetAuth(fn: () => void): void {
+	setAuthHooks.push(fn);
+}
+
+function fireSetAuthHooks(): void {
+	for (const fn of setAuthHooks) {
+		try {
+			fn();
+		} catch {
+			/* hook failure is non-fatal */
+		}
+	}
+}
+
 export function clearAuth(): void {
 	if (!browser) return;
 	// Clear from BOTH stores — a guest token lives in localStorage, an admin token in
diff --git a/frontend/src/lib/components/LightboxModal.svelte b/frontend/src/lib/components/LightboxModal.svelte
index 8c76170..3db4eae 100644
--- a/frontend/src/lib/components/LightboxModal.svelte
+++ b/frontend/src/lib/components/LightboxModal.svelte
@@ -41,7 +41,20 @@
 	let heartBurst = $state(false);
 	let burstTimer: ReturnType<typeof setTimeout> | null = null;
 
-	const mediaSrc = $derived(pickMediaUrl($dataMode, upload));
+	// Videos always play the ORIGINAL. `pickMediaUrl` is mime-agnostic and compression only
+	// ever produces a *thumbnail* for a video (one ffmpeg frame), so in the default saver
+	// mode it hands back `/thumbnail` — a JPEG, served as image/jpeg with nosniff. Feeding
+	// that to <video> is why every video failed with DEMUXER_ERROR_COULD_NOT_OPEN. There is
+	// no smaller video derivative to offer, so `preload="none"` keeps saver-mode users on
+	// cellular from fetching anything until they actually press play; the poster is the
+	// thumbnail, which is what they saw in the feed anyway.
+	// Fixed here rather than in `pickMediaUrl` because FeedListCard shares that helper and
+	// legitimately wants the thumbnail for its <img>. Same rule as the diashow.
+	const mediaSrc = $derived(
+		isVideo(upload.mime_type)
+			? `/api/v1/upload/${upload.id}/original`
+			: pickMediaUrl($dataMode, upload)
+	);
 
 	function triggerHeartBurst() {
 		heartBurst = true;
@@ -177,6 +190,8 @@
 					<video
 						src={mediaSrc}
 						controls
+						preload="none"
+						playsinline
 						class="max-h-[60vh] w-full object-contain"
 						poster={upload.thumbnail_url ?? undefined}
 					></video>
diff --git a/frontend/src/lib/role-store.ts b/frontend/src/lib/role-store.ts
index 5f665ef..dba7a01 100644
--- a/frontend/src/lib/role-store.ts
+++ b/frontend/src/lib/role-store.ts
@@ -1,5 +1,5 @@
 import { derived, writable } from 'svelte/store';
-import { getRole } from './auth';
+import { getRole, onClearAuth, onSetAuth } from './auth';
 
 export type Role = 'guest' | 'host' | 'admin';
 
@@ -32,3 +32,14 @@ export function setRole(next: Role | null): void {
 export function syncRoleFromToken(): void {
 	role.set(getRole());
 }
+
+// Bind the store to the identity lifecycle. The store is a module-level singleton seeded
+// ONCE at import, and `goto()` navigations re-import nothing — so without these hooks the
+// previous user's role survives a logout→login in the same tab. A host who left and a guest
+// who then joined kept `isStaff === true` and were offered "Beitrag entfernen" on other
+// people's photos (the backend 403s it, so it was a false affordance rather than an
+// escalation — but the feed never fetches /me/context, so it never self-corrected either).
+// The mirror case is just as wrong: a guest recovering into a host account got no host
+// affordances at all.
+onClearAuth(() => role.set(null));
+onSetAuth(syncRoleFromToken);
diff --git a/frontend/src/lib/ui-store.ts b/frontend/src/lib/ui-store.ts
index 08ef004..3346c80 100644
--- a/frontend/src/lib/ui-store.ts
+++ b/frontend/src/lib/ui-store.ts
@@ -11,12 +11,14 @@ export const uploadSheetOpen = writable(false);
 // states on purpose: counting only pending/uploading meant a rejected upload decremented
 // the badge exactly as if it had succeeded, so the failure was indistinguishable from a
 // completed upload. 'blocked' and 'error' stay counted until the user clears or retries them.
-export const uploadBadgeCount = derived(queueItems, ($items) =>
-	$items.filter(
-		(i) =>
-			i.status === 'pending' ||
-			i.status === 'uploading' ||
-			i.status === 'error' ||
-			i.status === 'blocked'
-	).length
+export const uploadBadgeCount = derived(
+	queueItems,
+	($items) =>
+		$items.filter(
+			(i) =>
+				i.status === 'pending' ||
+				i.status === 'uploading' ||
+				i.status === 'error' ||
+				i.status === 'blocked'
+		).length
 );
diff --git a/frontend/src/routes/feed/+page.svelte b/frontend/src/routes/feed/+page.svelte
index 240a16e..b663aed 100644
--- a/frontend/src/routes/feed/+page.svelte
+++ b/frontend/src/routes/feed/+page.svelte
@@ -18,6 +18,7 @@
 	import { pullToRefresh } from '$lib/actions/pull-to-refresh';
 	import { vibrate } from '$lib/haptics';
 	import { filterUploads } from '$lib/feed-filter';
+	import { refreshEventState } from '$lib/event-state-store';
 	import type { FeedUpload, FeedResponse, HashtagCount, DeltaResponse } from '$lib/types';
 
 	let uploads = $state<FeedUpload[]>([]);
@@ -233,6 +234,15 @@
 			}
 		}
 
+		// Pull the authoritative role/event state. The root layout does this on a full page
+		// load, but arriving here from /join or /recover is a client-side navigation, so its
+		// onMount never re-runs — and the feed is the one route that gates a destructive
+		// action (host "Beitrag entfernen") on the role. Without this the feed would run on
+		// whatever the JWT claim said, which is frozen for the token's 30-day lifetime and so
+		// misses a promotion or demotion entirely. Cheap, and it refreshes the lock/release
+		// state in the same request.
+		void refreshEventState();
+
 		await Promise.all([loadFeed(), loadHashtags()]);
 		connectSse();