diff --git a/.gitignore b/.gitignore
index 30b185d..e1eaba3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,6 +34,12 @@ e2e/.env.test
 /test-results/
 /playwright-report/
 
+# Load-test sample media. The wedding sample set is ~8.7 GB of real photos and
+# videos; it is input to e2e/loadtest/event-sim.mjs, not source. Ignored by name
+# AND by extension so a stray archive can never be committed by accident.
+/wedding_sample_images.zip
+*.zip
+
 # OS
 .DS_Store
 Thumbs.db
diff --git a/e2e/Caddyfile.sim b/e2e/Caddyfile.sim
new file mode 100644
index 0000000..02834f1
--- /dev/null
+++ b/e2e/Caddyfile.sim
@@ -0,0 +1,27 @@
+# Caddyfile for the EVENT SIMULATION stack (e2e/docker-compose.sim.yml).
+# Identical in behaviour to Caddyfile.test — same compression carve-out for SSE,
+# same security headers, same export framing rules — but on :3102 so the
+# simulation can run without colliding with the :3101 Playwright stack.
+
+:3102 {
+    # Mirror prod: exclude the SSE stream from compression so buffering doesn't
+    # delay real-time events.
+    @compressible not path /api/v1/stream
+    encode @compressible zstd gzip
+
+    header {
+        X-Content-Type-Options "nosniff"
+        Referrer-Policy "strict-origin-when-cross-origin"
+    }
+
+    @framable path /api/v1/export/zip /api/v1/export/html
+    @not_framable not path /api/v1/export/zip /api/v1/export/html
+    header @framable X-Frame-Options "SAMEORIGIN"
+    header @not_framable X-Frame-Options "DENY"
+
+    reverse_proxy /api/* app:3000
+    reverse_proxy /media/* app:3000
+    reverse_proxy /health app:3000
+
+    reverse_proxy frontend:3001
+}
diff --git a/e2e/docker-compose.sim.yml b/e2e/docker-compose.sim.yml
new file mode 100644
index 0000000..d7885ab
--- /dev/null
+++ b/e2e/docker-compose.sim.yml
@@ -0,0 +1,153 @@
+# EventSnap EVENT SIMULATION stack — models the real production box, not CI.
+#
+# Difference from docker-compose.test.yml (which is tuned for fast, unconstrained
+# Playwright runs): this file reproduces the CX22 the event actually runs on —
+#   * 2 vCPU total, shared by all four services
+#   * 4 GB RAM, split by the same per-service limits production ships
+#   * a REAL 30 GB filesystem for media + exports (loopback ext4), so statvfs
+#     inside the container returns true numbers and the disk gate / 507 path is
+#     exercised for real rather than simulated.
+#
+# Why cpuset on every service: production's per-service `cpus` ceilings sum to
+# 1.5 + 1.2 + 0.6 + 0.5 = 3.8 on a box that has 2. That oversubscription is the
+# point — the ceilings only bind when something else is competing, and cpu_shares
+# decides who wins. Reproducing that on a 12-core workstation requires confining
+# every container to the SAME two cores; without cpuset each service would get its
+# ceiling simultaneously and the contention under test would never happen.
+#
+# Bring up:   docker compose -f docker-compose.sim.yml up -d --build
+# Tear down:  docker compose -f docker-compose.sim.yml down -v
+#
+# The 30 GB volume is created out-of-band (see e2e/loadtest/sim-disk.sh) because a
+# loopback device must be attached by root; it is declared `external` here.
+
+x-cpuset: &cpuset '0,1'
+
+services:
+  db:
+    image: postgres:16-alpine
+    cpuset: *cpuset
+    environment:
+      POSTGRES_USER: eventsnap_test
+      POSTGRES_PASSWORD: eventsnap_test
+      POSTGRES_DB: eventsnap_test
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U eventsnap_test -d eventsnap_test']
+      interval: 3s
+      timeout: 3s
+      retries: 30
+    ports:
+      - '55433:5432'
+    volumes:
+      # Named (not anonymous) so a `down -v` really wipes it and so its on-disk size
+      # can be measured against the 10 GB DISK_RESERVE that is meant to cover it.
+      - sim_pgdata:/var/lib/postgresql/data
+    # Production values, verbatim (docker-compose.yml db service).
+    deploy:
+      resources:
+        limits:
+          memory: 1G
+          cpus: '1.5'
+        reservations:
+          memory: 256M
+    cpu_shares: 2048
+    memswap_limit: 1152m
+
+  app:
+    # The SHIPPED release image, not a local build. Verified identical to HEAD:
+    # `git diff v0.17.5 HEAD -- backend/` is empty, and v0.17.5/v0.17.6 share one
+    # app digest on purpose (the v0.17.6 bump was frontend-only). Running the real
+    # artifact means the simulation tests what the event will actually run.
+    image: ${SIM_APP_IMAGE:-registry.mc02.dev/eventsnap/app:v0.17.5}
+    cpuset: *cpuset
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      DATABASE_URL: postgres://eventsnap_test:eventsnap_test@db:5432/eventsnap_test
+      JWT_SECRET: 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff
+      # bcrypt("admin-test-pw"), cost 4. $ doubled to escape compose interpolation.
+      ADMIN_PASSWORD_HASH: $$2b$$04$$XKJJkNX6BOi6y3S42DA5JOWwk4oxc8DHPL6.MrPfJI2vpnccZjP32
+      EVENT_SLUG: sim-wedding
+      EVENT_NAME: Hochzeit Simulation
+      APP_PORT: '3000'
+      # Both live on the SAME 30 GB filesystem, as they do on the real VPS — but in
+      # sibling directories, because config.rs::validate requires EXPORT_PATH outside
+      # MEDIA_PATH (a keepsake archive contains every photo in the event).
+      MEDIA_PATH: /disk/media
+      EXPORT_PATH: /disk/exports
+      SESSION_EXPIRY_DAYS: '30'
+      # Production pins these; the CI stack leaves them at code defaults. Sized to 2 vCPU.
+      DATABASE_MAX_CONNECTIONS: '15'
+      COMPRESSION_WORKER_CONCURRENCY: '2'
+      # Production disables comments for this event (docker-compose.yml, product decision).
+      COMMENTS_ENABLED: 'false'
+      # The ONE deviation from production: enables /admin/__truncate so the harness can
+      # reset between runs. Never set on the real box.
+      EVENTSNAP_TEST_MODE: '1'
+      RUST_LOG: eventsnap_backend=info,tower_http=warn
+    volumes:
+      - sim_disk:/disk
+    deploy:
+      resources:
+        limits:
+          memory: 1G
+          cpus: '1.2'
+        reservations:
+          memory: 256M
+    cpu_shares: 512
+    memswap_limit: 1152m
+    expose:
+      - '3000'
+
+  frontend:
+    # Shipped release image; `git diff v0.17.6 HEAD -- frontend/` is empty.
+    image: registry.mc02.dev/eventsnap/frontend:v0.17.6
+    cpuset: *cpuset
+    depends_on:
+      - app
+    environment:
+      PORT: '3001'
+      HOST: '0.0.0.0'
+      ORIGIN: 'http://localhost:3102'
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+          cpus: '0.6'
+    cpu_shares: 256
+    memswap_limit: 320m
+    expose:
+      - '3001'
+
+  caddy:
+    image: caddy:2-alpine
+    cpuset: *cpuset
+    depends_on:
+      - app
+      - frontend
+    volumes:
+      - ./Caddyfile.sim:/etc/caddy/Caddyfile:ro
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+          cpus: '0.5'
+    cpu_shares: 1024
+    memswap_limit: 320m
+    ports:
+      - '3102:3102'
+
+volumes:
+  # 30 GB loopback ext4, created by e2e/loadtest/sim-disk.sh. Holds media AND exports,
+  # exactly as one VPS disk holds both.
+  sim_disk:
+    external: true
+    name: eventsnap_sim_media
+  # Postgres data stays on the host disk, NOT on the 30 GB volume. Scoping decision:
+  # the 30 GB budget under test is the one the APP manages and measures (statvfs on
+  # MEDIA_PATH drives the disk gate). Putting PG on the same volume would test
+  # filesystem exhaustion instead, and a full disk under Postgres risks ending the run
+  # for an infrastructural reason rather than an application one. Its growth is sampled
+  # separately and reported against DISK_RESERVE_BYTES (10 GB), which exists to cover it.
+  sim_pgdata:
diff --git a/e2e/loadtest/browser-check.mjs b/e2e/loadtest/browser-check.mjs
new file mode 100644
index 0000000..7e8634e
--- /dev/null
+++ b/e2e/loadtest/browser-check.mjs
@@ -0,0 +1,214 @@
+#!/usr/bin/env node
+/**
+ * Real-browser pass over the event AFTER the load simulation has filled it.
+ *
+ * `event-sim.mjs` drives the HTTP API directly — deliberately, because 150 real
+ * browsers would bottleneck the test box rather than the server. That leaves two
+ * things unmeasured, and both are guest-visible:
+ *
+ *   1. The SvelteKit frontend container, which the API driver never touches.
+ *   2. Whether the frontend ESCAPES the XSS caption the API stored verbatim. The
+ *      backend stores captions raw by design (`upload.rs` length-checks only), so
+ *      the entire defence is the renderer. The abuse suite proved the payload is
+ *      in the database; only a browser can prove it is inert.
+ *
+ * Runs three real engines against the loaded gallery and reports load timings,
+ * console errors, and the XSS verdict.
+ *
+ *     node e2e/loadtest/browser-check.mjs
+ */
+import { chromium, firefox, webkit, devices } from '@playwright/test';
+import { writeFile, mkdir } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const BASE = process.env.SIM_BASE ?? 'http://localhost:3102';
+const API = `${BASE}/api/v1`;
+const OUT = join(__dirname, 'results', 'browser');
+
+const XSS_CAPTION = '<script>alert(document.cookie)</script><img src=x onerror=alert(1)>';
+const XSS_MARKERS = ['<script>alert(', 'onerror=alert(1)', 'onerror=alert('];
+
+async function joinGuest(name) {
+  const res = await fetch(`${API}/join`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ display_name: name }),
+  });
+  if (!res.ok) throw new Error(`join failed ${res.status}`);
+  return res.json();
+}
+
+/** Seed the guest session the way the app itself does, so we land on the gallery. */
+async function seedSession(context, acct, name) {
+  await context.addInitScript(
+    ([jwt, uid, dn]) => {
+      localStorage.setItem('eventsnap_jwt', jwt);
+      localStorage.setItem('eventsnap_user_id', uid);
+      localStorage.setItem('eventsnap_display_name', dn);
+      // Skip the first-run guide. It is a modal over the feed, and leaving it up
+      // means the feed never lazy-loads — which silently turns the XSS check into
+      // "the payload wasn't on screen", not "the payload was neutralised".
+      localStorage.setItem('eventsnap_guide_seen', '1');
+    },
+    [acct.jwt, acct.user_id, name]
+  );
+}
+
+/**
+ * Post a fresh XSS caption so the payload is the NEWEST item and therefore on the
+ * first page of the feed. The load test's payload is real but buried behind ~780
+ * newer uploads, and a check that never renders the payload proves nothing.
+ */
+async function seedXssUpload(jwt) {
+  const { readdir, readFile } = await import('node:fs/promises');
+  const dir = process.env.SIM_POOL_DIR ?? '/tmp/eventsnap-realpool';
+  const files = (await readdir(dir)).filter((f) => f.toLowerCase().endsWith('.jpg') || f.toLowerCase().endsWith('.jpeg'));
+  const buf = await readFile(join(dir, files[0]));
+  const form = new FormData();
+  form.append('file', new Blob([buf], { type: 'image/jpeg' }), 'x.jpg');
+  form.append('caption', XSS_CAPTION);
+  const res = await fetch(`${API}/upload`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${jwt}` },
+    body: form,
+  });
+  if (!res.ok) throw new Error(`xss seed upload failed ${res.status}: ${(await res.text()).slice(0, 200)}`);
+  return (await res.json()).id;
+}
+
+async function runEngine(engineName, launcher, deviceProfile) {
+  const result = { engine: engineName, device: deviceProfile ?? 'desktop', pages: {}, consoleErrors: [], dialogs: [], xss: null };
+  let browser;
+  try {
+    browser = await launcher.launch();
+  } catch (e) {
+    // A missing system library on the test box is not a finding about the app.
+    // Skip the engine and say so, rather than failing the whole pass.
+    result.skipped = `could not launch: ${String(e).split('\n')[0].slice(0, 120)}`;
+    return result;
+  }
+  const context = await browser.newContext(deviceProfile ? devices[deviceProfile] : {});
+  const acct = await joinGuest(`Browser ${engineName} ${Date.now() % 10000}`);
+  await seedSession(context, acct, `Browser ${engineName}`);
+  const page = await context.newPage();
+
+  // An executed payload would surface as a dialog. Nothing should ever fire.
+  page.on('dialog', async (d) => {
+    result.dialogs.push({ type: d.type(), message: d.message() });
+    await d.dismiss();
+  });
+  page.on('console', (m) => {
+    if (m.type() === 'error') result.consoleErrors.push(m.text().slice(0, 200));
+  });
+  page.on('pageerror', (e) => result.consoleErrors.push(`pageerror: ${String(e).slice(0, 200)}`));
+
+  for (const [label, path] of [
+    ['gallery', '/'],
+    ['diashow', '/diashow'],
+  ]) {
+    const t0 = Date.now();
+    try {
+      await page.goto(`${BASE}${path}`, { waitUntil: 'load', timeout: 60000 });
+      const loadMs = Date.now() - t0;
+      await page.waitForTimeout(6000); // let the feed + images settle
+      const imgCount = await page.locator('img').count();
+      const shot = join(OUT, `${engineName}-${label}.png`);
+      await page.screenshot({ path: shot, fullPage: false });
+      result.pages[label] = { loadMs, settledMs: Date.now() - t0, imgCount, screenshot: shot };
+    } catch (e) {
+      result.pages[label] = { error: String(e).slice(0, 200) };
+    }
+  }
+
+  // ── XSS verdict ───────────────────────────────────────────────────────────
+  // Walk the gallery looking for the stored payload. It must appear as TEXT and
+  // never as a live <script> element or an img with an onerror handler.
+  try {
+    await seedXssUpload(acct.jwt);
+    await page.goto(`${BASE}/`, { waitUntil: 'load', timeout: 60000 });
+    await page.waitForTimeout(6000);
+    const verdict = await page.evaluate((markers) => {
+      const bodyText = document.body.innerText ?? '';
+      const html = document.body.innerHTML ?? '';
+      const asText = markers.some((m) => bodyText.includes(m));
+      // Any script tag that isn't a real app/module script would be injected.
+      const injectedScripts = [...document.querySelectorAll('script')]
+        .filter((s) => (s.textContent ?? '').includes('alert('))
+        .map((s) => (s.textContent ?? '').slice(0, 80));
+      const onerrorImgs = [...document.querySelectorAll('img[onerror]')].map((i) => i.getAttribute('onerror'));
+      return {
+        payloadVisibleAsText: asText,
+        injectedScripts,
+        onerrorImgs,
+        // escaped entities are the positive signal that the renderer did its job
+        escapedMarkup: html.includes('&lt;script&gt;') || html.includes('&lt;img'),
+      };
+    }, XSS_MARKERS);
+    result.xss = verdict;
+  } catch (e) {
+    result.xss = { error: String(e).slice(0, 200) };
+  }
+
+  await browser.close();
+  return result;
+}
+
+const main = async () => {
+  await mkdir(OUT, { recursive: true });
+  const results = [];
+  results.push(await runEngine('chromium', chromium, 'Pixel 7'));
+  results.push(await runEngine('webkit', webkit, 'iPhone 14'));
+  results.push(await runEngine('firefox', firefox, null));
+
+  const out = join(__dirname, 'results', `browser-check-${new Date().toISOString().replace(/[:.]/g, '-')}.json`);
+  await writeFile(out, JSON.stringify(results, null, 2));
+
+  console.log('\n' + '═'.repeat(70));
+  console.log('REAL BROWSER CHECK');
+  console.log('═'.repeat(70));
+  let xssFail = false;
+  let inconclusive = false;
+  for (const r of results) {
+    console.log(`\n${r.engine} (${r.device})`);
+    if (r.skipped) {
+      console.log(`  SKIPPED — ${r.skipped}`);
+      continue;
+    }
+    for (const [k, v] of Object.entries(r.pages))
+      console.log(
+        `  ${k.padEnd(8)} ${v.error ? 'ERROR ' + v.error : `load ${v.loadMs}ms, ${v.imgCount} <img> after settle`}`
+      );
+    console.log(`  console errors: ${r.consoleErrors.length}${r.consoleErrors.length ? ' → ' + r.consoleErrors[0] : ''}`);
+    console.log(`  dialogs fired : ${r.dialogs.length}`);
+    const x = r.xss ?? {};
+    const bad = (x.injectedScripts?.length ?? 0) > 0 || (x.onerrorImgs?.length ?? 0) > 0 || r.dialogs.length > 0;
+    // Absence of an explosion only counts if the payload actually reached the DOM.
+    const rendered = !!(x.payloadVisibleAsText || x.escapedMarkup);
+    if (bad) xssFail = true;
+    if (!bad && !rendered) inconclusive = true;
+    const label = bad ? '✗ PAYLOAD LIVE' : rendered ? '✓ inert (rendered as text)' : '? INCONCLUSIVE — payload never reached the DOM';
+    console.log(
+      `  XSS           : ${label} ` +
+        `(as text: ${x.payloadVisibleAsText}, escaped markup: ${x.escapedMarkup}, ` +
+        `injected scripts: ${x.injectedScripts?.length ?? 0}, onerror imgs: ${x.onerrorImgs?.length ?? 0})`
+    );
+  }
+  console.log(
+    `\nverdict: ${
+      xssFail
+        ? '✗ stored XSS EXECUTES in a real browser'
+        : inconclusive
+          ? '? INCONCLUSIVE in at least one engine — payload never rendered, so nothing was proven'
+          : '✓ stored payload rendered as inert text in every engine that ran'
+    }`
+  );
+  console.log(`report → ${out}`);
+  console.log('═'.repeat(70));
+};
+
+main().catch((e) => {
+  console.error('browser check failed:', e);
+  process.exit(1);
+});
diff --git a/e2e/loadtest/event-sim.mjs b/e2e/loadtest/event-sim.mjs
new file mode 100644
index 0000000..233679e
--- /dev/null
+++ b/e2e/loadtest/event-sim.mjs
@@ -0,0 +1,1556 @@
+#!/usr/bin/env node
+/**
+ * EventSnap EVENT SIMULATION — a real wedding, compressed.
+ *
+ * Differs from `driver.mjs` (a pipeline benchmark) in three ways that matter:
+ *
+ *  1. REAL CONTENT. Uploads come from a pool of actual wedding photos/videos —
+ *     unedited, straight off real cameras and phones, including the HEIC files
+ *     and 25 MB RAW-ish JPEGs that the app is supposed to REFUSE. Those refusals
+ *     are part of the test, not noise to be filtered out.
+ *
+ *  2. PERSONAS, not a uniform load. ~100 viewers and ~50 uploaders, each with a
+ *     behaviour profile, a device, a join time and a session length. A casual
+ *     guest who posts four photos and leaves generates a completely different
+ *     request mix than a photographer dumping 130, and both differ from a kiosk
+ *     that holds one SSE connection for the whole night.
+ *
+ *  3. RATE LIMITS STAY ON. `driver.mjs` disabled them because it ran every guest
+ *     from one IP. Almost every limit that matters here is PER USER, not per IP
+ *     (upload 100/h/user, feed 60/min/user, social 120/min/user), and those are
+ *     exactly as real for 150 synthetic sessions as for 150 phones. Leaving them
+ *     on is what lets the abuse personas prove the defences work. The per-IP
+ *     limits (join, recover, pin-reset) ARE distorted by the single source IP —
+ *     that distortion is measured and reported rather than configured away.
+ *
+ * Nothing else is changed from the shipping config: compression concurrency 2,
+ * DB pool 15, quotas on, comments off — the same values docker-compose.yml pins.
+ *
+ * Run it pinned OFF the container's cores, or the load generator competes with
+ * the thing it is measuring:
+ *
+ *     taskset -c 2-11 node e2e/loadtest/event-sim.mjs
+ */
+
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+const execFileAsync = promisify(execFile);
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// ── Config ───────────────────────────────────────────────────────────────────
+const cfg = {
+  base: process.env.SIM_BASE ?? 'http://localhost:3102',
+  poolDir: process.env.SIM_POOL_DIR ?? '/tmp/eventsnap-realpool',
+  poolMeta: process.env.SIM_POOL_META ?? '/tmp/eventsnap-pool.json',
+  // The real event is 10 h. We compress it into this many seconds of wall clock.
+  windowSec: int('SIM_WINDOW_SEC', 1200),
+  realEventHours: 10,
+  viewers: int('SIM_VIEWERS', 100),
+  uploaders: int('SIM_UPLOADERS', 50),
+  drainTimeoutSec: int('SIM_DRAIN_TIMEOUT_SEC', 1500),
+  adminPw: process.env.SIM_ADMIN_PW ?? 'admin-test-pw',
+  truncate: process.env.SIM_TRUNCATE !== '0',
+  appContainer: process.env.SIM_APP_CONTAINER ?? 'eventsnap-sim-app-1',
+  dbContainer: process.env.SIM_DB_CONTAINER ?? 'eventsnap-sim-db-1',
+  feContainer: process.env.SIM_FE_CONTAINER ?? 'eventsnap-sim-frontend-1',
+  caddyContainer: process.env.SIM_CADDY_CONTAINER ?? 'eventsnap-sim-caddy-1',
+  outDir: process.env.SIM_OUT_DIR ?? join(__dirname, 'results'),
+  abuse: process.env.SIM_ABUSE !== '0',
+  // Smoke runs cap the pool so a 90 s rehearsal doesn't push 7 GB through the box.
+  maxFiles: int('SIM_MAX_FILES', 0),
+};
+
+function int(name, def) {
+  const v = process.env[name];
+  return v === undefined ? def : parseInt(v, 10);
+}
+
+const API = `${cfg.base}/api/v1`;
+const now = () => Date.now();
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const rand = (a, b) => a + Math.floor(Math.random() * (b - a + 1));
+const frand = (a, b) => a + Math.random() * (b - a);
+const pick = (arr) => arr[Math.floor(Math.random() * arr.length)];
+function shuffle(a) {
+  for (let i = a.length - 1; i > 0; i--) {
+    const j = Math.floor(Math.random() * (i + 1));
+    [a[i], a[j]] = [a[j], a[i]];
+  }
+  return a;
+}
+/** Real seconds → simulated seconds. A 10 h event in a 20 min window is 30x. */
+const TIME_SCALE = () => (cfg.realEventHours * 3600) / cfg.windowSec;
+/** A think-time of `sec` real seconds, compressed. */
+const think = (sec) => sleep(Math.max(15, (sec * 1000) / TIME_SCALE()));
+
+// ── Device profiles ──────────────────────────────────────────────────────────
+// User-Agent plus the behavioural consequences of the device: a phone on party
+// wifi drops its SSE stream, a kiosk on ethernet does not.
+const DEVICES = [
+  {
+    name: 'iPhone 15 / Safari',
+    ua: 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1',
+    mobile: true,
+    dropRate: 0.06,
+    latencyMs: [40, 220],
+  },
+  {
+    name: 'Pixel 8 / Chrome',
+    ua: 'Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Mobile Safari/537.36',
+    mobile: true,
+    dropRate: 0.05,
+    latencyMs: [40, 200],
+  },
+  {
+    name: 'Galaxy S21 / Samsung Internet',
+    ua: 'Mozilla/5.0 (Linux; Android 13; SM-G991B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/23.0 Chrome/115.0.0.0 Mobile Safari/537.36',
+    mobile: true,
+    dropRate: 0.09,
+    latencyMs: [60, 400],
+  },
+  {
+    name: 'iPad / Safari',
+    ua: 'Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15',
+    mobile: true,
+    dropRate: 0.03,
+    latencyMs: [30, 150],
+  },
+  {
+    name: 'MacBook / Safari',
+    ua: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15',
+    mobile: false,
+    dropRate: 0.01,
+    latencyMs: [20, 80],
+  },
+  {
+    name: 'ThinkPad / Firefox',
+    ua: 'Mozilla/5.0 (X11; Linux x86_64; rv:127.0) Gecko/20100101 Firefox/127.0',
+    mobile: false,
+    dropRate: 0.01,
+    latencyMs: [20, 80],
+  },
+];
+const KIOSK_DEVICE = {
+  name: 'Kiosk display / Chrome',
+  ua: 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36',
+  mobile: false,
+  dropRate: 0.0,
+  latencyMs: [5, 25],
+};
+
+// ── Content ──────────────────────────────────────────────────────────────────
+const CAPTIONS = [
+  'Was für ein magischer Tag 💍',
+  'Der erste Tanz 🕺',
+  'Prost! 🥂',
+  'Die Torte war ein Traum 🍰',
+  'Feuerwerk 🎆',
+  'Beste Freunde 💕',
+  'Was für eine Stimmung! 🎉',
+  'Details 🌸',
+  'Sonnenuntergang über dem See 🌅',
+  'Die Tanzfläche brennt 🔥',
+  'Standesamt ❤️',
+  'Sektempfang im Garten',
+  'Ich heule gleich 😭',
+  'Brautstrauß-Weitwurf!',
+  'Gruppenbild — alle mal herschauen!',
+  null,
+  null,
+  null,
+  null,
+];
+const TAGS = [
+  'hochzeit',
+  'liebe',
+  'party',
+  'tanzen',
+  'natur',
+  'feier',
+  'freunde',
+  'dessert',
+  'brautpaar',
+  'sektempfang',
+  'firstdance',
+  'torte',
+];
+
+// ── Metrics ──────────────────────────────────────────────────────────────────
+const M = {
+  uploads: [], // {status, code, ms, bytes, id, persona, guest, endTs, file}
+  feed: [], // {ms, status}
+  media: [], // {ms, status, kind}
+  likes: [], // {ms, status}
+  joins: [], // {ms, status}
+  misc: [], // {op, ms, status, code}
+  abuse: [], // {name, status, code, expected, pass, note}
+  sseEvents: 0,
+  sseNewUpload: 0,
+  sseProcessed: new Map(), // upload_id -> ts first seen
+  sseErrors: 0,
+  sseReconnects: 0,
+  sseResyncs: 0,
+  resources: [],
+  serverErrors: [], // any 5xx, anywhere — each one is a finding
+  timeline: [], // notable events
+};
+const uploadEndTs = new Map();
+
+/**
+ * Terminal `upload.compression_status` values. Anything else ('pending',
+ * 'processing') is still in the worker queue. Getting this set wrong is not a
+ * cosmetic error: 'failed' counted as in-flight makes the drain loop wait out its
+ * whole timeout and report a backlog that actually cleared.
+ */
+const TERMINAL_COMPRESSION = new Set(['done', 'failed', 'error']);
+
+function note(msg) {
+  const t = ((now() - T0) / 1000).toFixed(0);
+  M.timeline.push({ tSec: +t, msg });
+  console.log(`[t+${t}s] ${msg}`);
+}
+
+// ── HTTP ─────────────────────────────────────────────────────────────────────
+async function http(path, { method = 'GET', token, json, ua, raw, signal } = {}) {
+  const headers = {};
+  if (token) headers.Authorization = `Bearer ${token}`;
+  if (ua) headers['User-Agent'] = ua;
+  if (json !== undefined) headers['Content-Type'] = 'application/json';
+  const t0 = now();
+  let res, body, err;
+  try {
+    res = await fetch(`${API}${path}`, {
+      method,
+      headers,
+      body: json !== undefined ? (raw ? json : JSON.stringify(json)) : undefined,
+      signal,
+    });
+  } catch (e) {
+    return { status: 0, ms: now() - t0, err: String(e).slice(0, 120) };
+  }
+  const ms = now() - t0;
+  if (res.status !== 204) {
+    const text = await res.text();
+    try {
+      body = text.length ? JSON.parse(text) : undefined;
+    } catch {
+      body = text;
+    }
+  }
+  const code = body && typeof body === 'object' ? (body.code ?? body.error) : undefined;
+  if (res.status >= 500) {
+    M.serverErrors.push({
+      path,
+      method,
+      status: res.status,
+      code,
+      body: JSON.stringify(body).slice(0, 300),
+      tSec: Math.round((now() - T0) / 1000),
+    });
+  }
+  return { status: res.status, ms, body, code, err };
+}
+
+/** Media fetch (preview/thumbnail/display/original) — measured, body discarded. */
+async function fetchMedia(id, kind, ua) {
+  const t0 = now();
+  try {
+    const res = await fetch(`${API}/upload/${id}/${kind}`, { headers: ua ? { 'User-Agent': ua } : {} });
+    const buf = await res.arrayBuffer();
+    const rec = { ms: now() - t0, status: res.status, kind, bytes: buf.byteLength };
+    M.media.push(rec);
+    if (res.status >= 500)
+      M.serverErrors.push({ path: `/upload/{id}/${kind}`, method: 'GET', status: res.status });
+    return rec;
+  } catch (e) {
+    const rec = { ms: now() - t0, status: 0, kind, err: String(e).slice(0, 80) };
+    M.media.push(rec);
+    return rec;
+  }
+}
+
+const adminLogin = () =>
+  http('/admin/login', { method: 'POST', json: { password: cfg.adminPw } }).then((r) => {
+    if (r.status !== 200) throw new Error(`admin login ${r.status}: ${JSON.stringify(r.body)}`);
+    return r.body.jwt;
+  });
+
+// ── Upload ───────────────────────────────────────────────────────────────────
+async function uploadFile(guest, file, { caption, hashtags, mime, filename, abortAfterMs } = {}) {
+  let buf;
+  try {
+    buf = await readFile(join(cfg.poolDir, file.name));
+  } catch (e) {
+    return { status: -1, err: `read ${file.name}: ${e}` };
+  }
+  return uploadBuffer(guest, buf, {
+    caption,
+    hashtags,
+    mime: mime ?? file.magic,
+    filename: filename ?? file.name,
+    abortAfterMs,
+    file: file.name,
+    poolBytes: file.bytes,
+  });
+}
+
+async function uploadBuffer(
+  guest,
+  buf,
+  { caption, hashtags, mime, filename, abortAfterMs, file, poolBytes, extraFields } = {}
+) {
+  const form = new FormData();
+  form.append('file', new Blob([buf], { type: mime ?? 'image/jpeg' }), filename ?? 'photo.jpg');
+  if (caption !== undefined && caption !== null) form.append('caption', caption);
+  if (hashtags) form.append('hashtags', hashtags);
+  form.append('client_upload_id', randomUUID());
+  for (const [k, v] of Object.entries(extraFields ?? {})) form.append(k, v);
+
+  const ctrl = new AbortController();
+  let aborter;
+  if (abortAfterMs) aborter = setTimeout(() => ctrl.abort(), abortAfterMs);
+
+  const t0 = now();
+  let res, body;
+  try {
+    res = await fetch(`${API}/upload`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${guest.jwt}`, 'User-Agent': guest.device.ua },
+      body: form,
+      signal: ctrl.signal,
+    });
+    const text = await res.text();
+    try {
+      body = text.length ? JSON.parse(text) : undefined;
+    } catch {
+      body = text;
+    }
+  } catch (e) {
+    if (aborter) clearTimeout(aborter);
+    return {
+      status: 0,
+      ms: now() - t0,
+      aborted: true,
+      err: String(e).slice(0, 80),
+      bytes: buf.length,
+      file,
+    };
+  }
+  if (aborter) clearTimeout(aborter);
+  const endTs = now();
+  const code = body && typeof body === 'object' ? (body.code ?? body.error) : undefined;
+  if (res.status >= 500)
+    M.serverErrors.push({
+      path: '/upload',
+      method: 'POST',
+      status: res.status,
+      code,
+      body: JSON.stringify(body).slice(0, 300),
+      file,
+      tSec: Math.round((endTs - T0) / 1000),
+    });
+  const rec = {
+    status: res.status,
+    code,
+    ms: endTs - t0,
+    endTs,
+    bytes: buf.length,
+    poolBytes,
+    id: res.status === 201 || res.status === 200 ? body?.id : undefined,
+    persona: guest.persona,
+    guest: guest.idx,
+    file,
+    msg: res.status >= 400 ? String(body?.message ?? body).slice(0, 120) : undefined,
+  };
+  if (rec.id) uploadEndTs.set(rec.id, endTs);
+  return rec;
+}
+
+// ── SSE ──────────────────────────────────────────────────────────────────────
+class Sse {
+  constructor(guest) {
+    this.g = guest;
+    this.stop = false;
+    this.ctrl = null;
+  }
+  start() {
+    this._loop();
+    return this;
+  }
+  async _loop() {
+    while (!this.stop) {
+      try {
+        const tkt = await http('/stream/ticket', { method: 'POST', token: this.g.jwt, ua: this.g.device.ua });
+        if (tkt.status !== 200) {
+          if (this.stop) return;
+          await sleep(1000);
+          continue;
+        }
+        this.ctrl = new AbortController();
+        const res = await fetch(`${API}/stream?ticket=${tkt.body.ticket}`, {
+          headers: { Accept: 'text/event-stream', 'User-Agent': this.g.device.ua },
+          signal: this.ctrl.signal,
+        });
+        if (!res.ok || !res.body) throw new Error(`stream ${res.status}`);
+        const reader = res.body.getReader();
+        const dec = new TextDecoder();
+        let buf = '';
+        while (!this.stop) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          buf += dec.decode(value, { stream: true });
+          let i;
+          while ((i = buf.indexOf('\n\n')) !== -1) {
+            this._frame(buf.slice(0, i));
+            buf = buf.slice(i + 2);
+          }
+          // Flaky devices drop the stream mid-event, like a phone losing wifi.
+          if (Math.random() < this.g.device.dropRate / 40) {
+            this.ctrl.abort();
+            break;
+          }
+        }
+      } catch {
+        if (this.stop) return;
+        M.sseReconnects++;
+        await sleep(300 + Math.random() * 1200);
+      }
+    }
+  }
+  _frame(frame) {
+    let event = 'message';
+    let data = '';
+    for (const line of frame.split('\n')) {
+      if (line.startsWith('event:')) event = line.slice(6).trim();
+      else if (line.startsWith('data:')) data += line.slice(5).trim();
+    }
+    M.sseEvents++;
+    if (event === 'resync') M.sseResyncs++;
+    if (!data) return;
+    let p;
+    try {
+      p = JSON.parse(data);
+    } catch {
+      return;
+    }
+    if (event === 'new-upload') M.sseNewUpload++;
+    else if (event === 'upload-processed' && p?.upload_id) {
+      if (!M.sseProcessed.has(p.upload_id)) M.sseProcessed.set(p.upload_id, now());
+    } else if (event === 'upload-error') M.sseErrors++;
+  }
+  close() {
+    this.stop = true;
+    try {
+      this.ctrl?.abort();
+    } catch {
+      /* noop */
+    }
+  }
+}
+
+// ── Guest behaviours ─────────────────────────────────────────────────────────
+async function browseFeed(g, { pages = 1 } = {}) {
+  let cursor = null;
+  const seen = [];
+  for (let p = 0; p < pages; p++) {
+    const q = cursor ? `?limit=20&cursor=${cursor}` : '?limit=20';
+    const r = await http(`/feed${q}`, { token: g.jwt, ua: g.device.ua });
+    M.feed.push({ ms: r.ms, status: r.status });
+    if (r.status !== 200 || !r.body?.uploads?.length) break;
+    seen.push(...r.body.uploads);
+    cursor = r.body.next_cursor ?? r.body.cursor;
+    if (!cursor) break;
+    await think(frand(2, 8));
+  }
+  return seen;
+}
+
+/** Opening photos is what a viewer actually does — and what costs the server. */
+async function viewPhotos(g, uploads, count) {
+  const chosen = shuffle([...uploads]).slice(0, count);
+  for (const u of chosen) {
+    await fetchMedia(u.id, g.device.mobile ? 'thumbnail' : 'preview', g.device.ua);
+    if (Math.random() < 0.35) {
+      await think(frand(1, 4));
+      await fetchMedia(u.id, 'display', g.device.ua);
+    }
+    if (Math.random() < g.likeRate) {
+      const r = await http(`/upload/${u.id}/like`, { method: 'POST', token: g.jwt, ua: g.device.ua });
+      M.likes.push({ ms: r.ms, status: r.status });
+    }
+    await think(frand(2, 10));
+  }
+}
+
+async function uploadBurst(g, files) {
+  // Phones upload 2-3 at a time from the share sheet; desktops more.
+  const conc = g.device.mobile ? rand(1, 3) : rand(2, 4);
+  for (let i = 0; i < files.length; i += conc) {
+    const chunk = files.slice(i, i + conc);
+    const results = await Promise.all(
+      chunk.map((f) => {
+        const cap = pick(CAPTIONS);
+        const tags =
+          Math.random() < 0.6 ? `${pick(TAGS)},${pick(TAGS)}` : Math.random() < 0.5 ? pick(TAGS) : undefined;
+        // The unsure persona sometimes gives up mid-upload and retries later.
+        const abortAfterMs =
+          g.persona === 'unsure' && Math.random() < 0.12 ? rand(300, 1500) : undefined;
+        return uploadFile(g, f, { caption: cap, hashtags: tags, abortAfterMs });
+      })
+    );
+    for (const r of results) M.uploads.push(r);
+    await think(frand(3, 15));
+  }
+}
+
+// ── Personas ─────────────────────────────────────────────────────────────────
+const PERSONAS = {
+  photographer: {
+    kind: 'uploader',
+    likeRate: 0.05,
+    join: [0.0, 0.08],
+    dur: [0.85, 1.0],
+    async loop(g) {
+      // Works in sets: shoots, then dumps a big batch, then shoots again.
+      while (g.queue.length && g.active()) {
+        const batch = g.queue.splice(0, rand(12, 30));
+        await uploadBurst(g, batch);
+        const feed = await browseFeed(g, { pages: 1 });
+        if (feed.length) await viewPhotos(g, feed, rand(1, 3));
+        // Shoots for another 40-100 real minutes before dumping the next card.
+        await think(frand(2400, 6000));
+      }
+    },
+  },
+  enthusiast: {
+    kind: 'uploader',
+    likeRate: 0.3,
+    join: [0.0, 0.35],
+    dur: [0.5, 0.95],
+    async loop(g) {
+      while (g.active()) {
+        if (g.queue.length && Math.random() < 0.6) {
+          await uploadBurst(g, g.queue.splice(0, rand(3, 10)));
+        }
+        const feed = await browseFeed(g, { pages: rand(1, 3) });
+        if (feed.length) await viewPhotos(g, feed, rand(3, 8));
+        await think(frand(200, 700));
+      }
+    },
+  },
+  casual: {
+    kind: 'uploader',
+    likeRate: 0.45,
+    join: [0.05, 0.8],
+    dur: [0.06, 0.3],
+    async loop(g) {
+      // Joins, looks around, posts a couple of photos, keeps scrolling, leaves.
+      const feed = await browseFeed(g, { pages: rand(1, 2) });
+      if (feed.length) await viewPhotos(g, feed, rand(2, 6));
+      if (g.queue.length) await uploadBurst(g, g.queue.splice(0, rand(1, 4)));
+      while (g.active()) {
+        const f2 = await browseFeed(g, { pages: 1 });
+        if (f2.length) await viewPhotos(g, f2, rand(2, 5));
+        await think(frand(120, 400));
+      }
+    },
+  },
+  unsure: {
+    kind: 'uploader',
+    likeRate: 0.5,
+    join: [0.1, 0.75],
+    dur: [0.15, 0.6],
+    async loop(g) {
+      // Taps everything, gets confused, retries, tries features that are off.
+      while (g.active()) {
+        const act = Math.random();
+        if (act < 0.3 && g.queue.length) {
+          await uploadBurst(g, g.queue.splice(0, rand(1, 2)));
+        } else if (act < 0.45) {
+          // Tries to comment. COMMENTS_ENABLED=false in this event → expect 403.
+          const feed = await browseFeed(g, { pages: 1 });
+          if (feed.length) {
+            const r = await http(`/upload/${pick(feed).id}/comments`, {
+              method: 'POST',
+              token: g.jwt,
+              ua: g.device.ua,
+              json: { body: 'Schön!' },
+            });
+            M.misc.push({ op: 'comment-while-disabled', ms: r.ms, status: r.status, code: r.code });
+          }
+        } else if (act < 0.55) {
+          // Double-taps like: toggles it straight back off.
+          const feed = await browseFeed(g, { pages: 1 });
+          if (feed.length) {
+            const id = pick(feed).id;
+            for (let i = 0; i < 2; i++) {
+              const r = await http(`/upload/${id}/like`, { method: 'POST', token: g.jwt, ua: g.device.ua });
+              M.likes.push({ ms: r.ms, status: r.status });
+              await sleep(rand(120, 400));
+            }
+          }
+        } else if (act < 0.65) {
+          const r = await http('/hashtags', { token: g.jwt, ua: g.device.ua });
+          M.misc.push({ op: 'hashtags', ms: r.ms, status: r.status });
+          const r2 = await http('/uploaders', { token: g.jwt, ua: g.device.ua });
+          M.misc.push({ op: 'uploaders', ms: r2.ms, status: r2.status });
+        } else if (act < 0.72) {
+          const r = await http('/me/quota', { token: g.jwt, ua: g.device.ua });
+          M.misc.push({ op: 'quota', ms: r.ms, status: r.status });
+        } else if (act < 0.78) {
+          // Hunts for a keepsake download that isn't released yet.
+          const r = await http('/export/status', { token: g.jwt, ua: g.device.ua });
+          M.misc.push({ op: 'export-status', ms: r.ms, status: r.status });
+          const r2 = await http('/export/ticket?kind=zip', { method: 'POST', token: g.jwt, ua: g.device.ua });
+          M.misc.push({ op: 'export-ticket-early', ms: r2.ms, status: r2.status, code: r2.code });
+        } else {
+          const feed = await browseFeed(g, { pages: rand(1, 3) });
+          if (feed.length) await viewPhotos(g, feed, rand(1, 4));
+        }
+        await think(frand(60, 300));
+      }
+    },
+  },
+  flaky: {
+    kind: 'uploader',
+    likeRate: 0.25,
+    join: [0.05, 0.7],
+    dur: [0.3, 0.9],
+    async loop(g) {
+      // Bad signal: uploads abort part-way and are retried, feed calls fail.
+      while (g.active()) {
+        if (g.queue.length) {
+          const batch = g.queue.splice(0, rand(2, 6));
+          for (const f of batch) {
+            if (Math.random() < 0.3) {
+              // Connection dies mid-upload.
+              const r = await uploadFile(g, f, {
+                caption: pick(CAPTIONS),
+                abortAfterMs: rand(200, 2000),
+              });
+              M.uploads.push(r);
+              await think(frand(10, 40));
+              // …and the guest tries again.
+              const r2 = await uploadFile(g, f, { caption: pick(CAPTIONS) });
+              M.uploads.push(r2);
+            } else {
+              M.uploads.push(await uploadFile(g, f, { caption: pick(CAPTIONS) }));
+            }
+            await think(frand(5, 25));
+          }
+        }
+        const feed = await browseFeed(g, { pages: 1 });
+        if (feed.length) await viewPhotos(g, feed, rand(1, 4));
+        await think(frand(100, 400));
+      }
+    },
+  },
+  lurker: {
+    kind: 'viewer',
+    likeRate: 0.08,
+    join: [0.0, 0.85],
+    dur: [0.05, 0.7],
+    async loop(g) {
+      while (g.active()) {
+        const feed = await browseFeed(g, { pages: rand(1, 3) });
+        if (feed.length) await viewPhotos(g, feed, rand(2, 7));
+        await think(frand(180, 900));
+      }
+    },
+  },
+  social: {
+    kind: 'viewer',
+    likeRate: 0.7,
+    join: [0.0, 0.7],
+    dur: [0.2, 0.95],
+    async loop(g) {
+      while (g.active()) {
+        const feed = await browseFeed(g, { pages: rand(2, 4) });
+        if (feed.length) await viewPhotos(g, feed, rand(5, 12));
+        // Filters by hashtag, like a guest hunting for the first-dance photos.
+        if (Math.random() < 0.4) {
+          const r = await http(`/feed?limit=20&hashtag=${pick(TAGS)}`, { token: g.jwt, ua: g.device.ua });
+          M.feed.push({ ms: r.ms, status: r.status });
+        }
+        await think(frand(90, 400));
+      }
+    },
+  },
+  kiosk: {
+    kind: 'viewer',
+    likeRate: 0,
+    join: [0.0, 0.0],
+    dur: [1.0, 1.0],
+    async loop(g) {
+      // The projector: never sleeps, always pulling the newest photos at display
+      // size. This is the guest-visible "does the slideshow keep up" path.
+      while (g.active()) {
+        const r = await http('/feed?limit=20', { token: g.jwt, ua: g.device.ua });
+        M.feed.push({ ms: r.ms, status: r.status });
+        if (r.status === 200 && r.body?.uploads?.length) {
+          for (const u of r.body.uploads.slice(0, 6)) {
+            await fetchMedia(u.id, 'display', g.device.ua);
+            await think(frand(6, 12));
+          }
+        }
+        await think(frand(10, 20));
+      }
+    },
+  },
+};
+
+// ── Guest ────────────────────────────────────────────────────────────────────
+class Guest {
+  constructor(idx, persona, device) {
+    this.idx = idx;
+    this.persona = persona;
+    this.spec = PERSONAS[persona];
+    this.device = device;
+    this.likeRate = this.spec.likeRate;
+    this.queue = [];
+    this.jwt = null;
+    this.pin = null;
+    this.sse = null;
+    this.joinAtMs = Math.floor(frand(...this.spec.join) * cfg.windowSec * 1000);
+    const dur = frand(...this.spec.dur) * cfg.windowSec * 1000;
+    this.leaveAtMs = Math.min(cfg.windowSec * 1000, this.joinAtMs + dur);
+  }
+  active() {
+    return now() - T0 < this.leaveAtMs && !HALT;
+  }
+  async run() {
+    await sleep(this.joinAtMs);
+    if (HALT) return;
+    const name = `${pick(FIRST)} ${pick(LAST)} ${this.idx}`;
+    const r = await http('/join', {
+      method: 'POST',
+      json: { display_name: name },
+      ua: this.device.ua,
+    });
+    M.joins.push({ ms: r.ms, status: r.status });
+    if (r.status !== 201) {
+      M.misc.push({ op: 'join-failed', status: r.status, code: r.code });
+      return;
+    }
+    this.jwt = r.body.jwt;
+    this.pin = r.body.pin;
+    this.name = name;
+    this.sse = new Sse(this).start();
+    // First thing every real guest does: look at the event and the feed.
+    await http('/event', { ua: this.device.ua });
+    await http('/me/context', { token: this.jwt, ua: this.device.ua });
+    try {
+      await this.spec.loop(this);
+    } catch (e) {
+      M.misc.push({ op: `persona-${this.persona}-crash`, note: String(e).slice(0, 160) });
+    }
+    this.sse?.close();
+    // Some guests actually log out; most just close the tab.
+    if (Math.random() < 0.2) await http('/session', { method: 'DELETE', token: this.jwt, ua: this.device.ua });
+  }
+}
+
+const FIRST = ['Anna','Ben','Clara','David','Emma','Felix','Greta','Hannes','Ida','Jonas','Katrin','Lukas','Marie','Noah','Olivia','Paul','Quirin','Rosa','Simon','Tessa','Ulrich','Vera','Wolf','Xenia','Yannick','Zoe'];
+const LAST = ['Müller','Schmidt','Schneider','Fischer','Weber','Meyer','Wagner','Becker','Hoffmann','Schäfer','Koch','Bauer','Richter','Klein','Wolf','Neumann'];
+
+// ── Abuse suite ──────────────────────────────────────────────────────────────
+// Every case declares what the server SHOULD do. A 5xx is always a failure; so is
+// a payload that gets accepted when it should have been refused.
+function jpegHeader(sizeBytes) {
+  const b = Buffer.alloc(sizeBytes, 0x41);
+  Buffer.from([0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10, 0x4a, 0x46, 0x49, 0x46]).copy(b, 0);
+  return b;
+}
+
+async function runAbuse(admin, poolFiles) {
+  note('abuse suite starting');
+  const dev = pick(DEVICES);
+  const j = await http('/join', { method: 'POST', json: { display_name: `Mallory ${rand(100, 999)}` }, ua: dev.ua });
+  if (j.status !== 201) {
+    M.abuse.push({ name: 'abuse-join', status: j.status, pass: false, note: 'could not join' });
+    return;
+  }
+  const g = { idx: -1, persona: 'abuser', jwt: j.body.jwt, device: dev };
+  const attackerId = j.body.user_id;
+  const smallReal = poolFiles.find((f) => f.bytes < 3e6 && f.magic === 'image/jpeg') ?? poolFiles[0];
+  const realBuf = await readFile(join(cfg.poolDir, smallReal.name));
+
+  const rec = (name, r, expectStatuses, note_) => {
+    const status = r.status;
+    const pass = expectStatuses.includes(status);
+    M.abuse.push({
+      name,
+      status,
+      code: r.code,
+      expected: expectStatuses.join('/'),
+      pass,
+      is5xx: status >= 500,
+      note: note_ ?? (r.msg ?? (typeof r.body === 'object' ? r.body?.message : undefined)),
+    });
+    return r;
+  };
+
+  // ── Malicious file payloads ────────────────────────────────────────────────
+  rec(
+    'html-disguised-as-jpg',
+    await uploadBuffer(g, Buffer.from('<html><script>alert(1)</script></html>'), {
+      mime: 'image/jpeg',
+      filename: 'photo.jpg',
+    }),
+    [400],
+    'polyglot/HTML upload must be refused by magic-byte sniff'
+  );
+  rec(
+    'svg-with-script',
+    await uploadBuffer(
+      g,
+      Buffer.from('<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>'),
+      { mime: 'image/svg+xml', filename: 'x.svg' }
+    ),
+    [400]
+  );
+  rec(
+    'php-webshell-as-jpg',
+    await uploadBuffer(g, Buffer.from('<?php system($_GET["c"]); ?>'), {
+      mime: 'image/jpeg',
+      filename: 'shell.php.jpg',
+    }),
+    [400]
+  );
+  rec(
+    'elf-binary-as-jpg',
+    await uploadBuffer(g, Buffer.from([0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, 0, 0, 0]), {
+      mime: 'image/jpeg',
+      filename: 'a.jpg',
+    }),
+    [400]
+  );
+  rec(
+    'zero-byte-file',
+    await uploadBuffer(g, Buffer.alloc(0), { mime: 'image/jpeg', filename: 'empty.jpg' }),
+    [400]
+  );
+  rec(
+    'jpeg-magic-but-garbage-body',
+    await uploadBuffer(g, jpegHeader(2 * 1024 * 1024), { mime: 'image/jpeg', filename: 'fake.jpg' }),
+    [201, 400],
+    'valid JPEG magic, undecodable body. 201 is acceptable only if the worker then ' +
+      'marks it compression_status=error and emits upload-error — checked against the DB below'
+  );
+  rec(
+    'oversize-image-30mb',
+    await uploadBuffer(g, jpegHeader(30 * 1024 * 1024), { mime: 'image/jpeg', filename: 'huge.jpg' }),
+    [400],
+    'over max_image_size_mb=20'
+  );
+  rec(
+    'declared-video-to-smuggle-60mb-image',
+    await uploadBuffer(g, jpegHeader(60 * 1024 * 1024), {
+      mime: 'video/quicktime',
+      filename: 'clip.mov',
+    }),
+    [400],
+    'declaring video/quicktime buys the 500 MB streaming cap; magic bytes are JPEG, so ' +
+      'the 20 MB image cap must still apply to the stored object'
+  );
+
+  // ── Injection / malformed text on an otherwise valid image ─────────────────
+  rec(
+    'xss-caption',
+    await uploadBuffer(g, realBuf, {
+      mime: 'image/jpeg',
+      caption: '<script>alert(document.cookie)</script><img src=x onerror=alert(1)>',
+      filename: 'x.jpg',
+    }),
+    [201],
+    'server stores raw by design; escaping is the frontend contract'
+  );
+  rec(
+    'nul-byte-caption',
+    await uploadBuffer(g, realBuf, {
+      mime: 'image/jpeg',
+      caption: `Schoen\u0000 boom`,
+      filename: 'x.jpg',
+    }),
+    [201, 400],
+    'a NUL in TEXT makes Postgres reject the INSERT — 500 here would be a real bug'
+  );
+  rec(
+    'sql-injection-caption',
+    await uploadBuffer(g, realBuf, {
+      mime: 'image/jpeg',
+      caption: `'); DROP TABLE upload; --`,
+      filename: 'x.jpg',
+    }),
+    [201]
+  );
+  rec(
+    'caption-over-2000-chars',
+    await uploadBuffer(g, realBuf, { mime: 'image/jpeg', caption: 'ä'.repeat(2500), filename: 'x.jpg' }),
+    [400]
+  );
+  rec(
+    'hashtag-flood-60-tags',
+    await uploadBuffer(g, realBuf, {
+      mime: 'image/jpeg',
+      hashtags: Array.from({ length: 60 }, (_, i) => `tag${i}`).join(','),
+      filename: 'x.jpg',
+    }),
+    [201, 400]
+  );
+  rec(
+    'path-traversal-filename',
+    await uploadBuffer(g, realBuf, {
+      mime: 'image/jpeg',
+      filename: '../../../../etc/passwd.jpg',
+      caption: 'traversal',
+    }),
+    [201],
+    'filename must not influence the stored path'
+  );
+  rec(
+    'rtl-override-caption',
+    await uploadBuffer(g, realBuf, { mime: 'image/jpeg', caption: 'photo‮gnp.exe', filename: 'x.jpg' }),
+    [201]
+  );
+
+  // ── Auth / authorisation ───────────────────────────────────────────────────
+  const parts = g.jwt.split('.');
+  const tamperedPayload = Buffer.from(
+    JSON.stringify({ ...JSON.parse(Buffer.from(parts[1], 'base64url').toString()), role: 'admin' })
+  ).toString('base64url');
+  rec(
+    'jwt-role-escalation',
+    await http('/admin/stats', { token: `${parts[0]}.${tamperedPayload}.${parts[2]}`, ua: dev.ua }),
+    [401, 403]
+  );
+  rec('jwt-alg-none', await http('/admin/stats', { token: `${parts[0]}.${parts[1]}.`, ua: dev.ua }), [401, 403]);
+  rec('garbage-jwt', await http('/feed', { token: 'not.a.jwt', ua: dev.ua }), [401]);
+  rec('guest-hits-admin-stats', await http('/admin/stats', { token: g.jwt, ua: dev.ua }), [401, 403]);
+  rec(
+    'guest-hits-admin-config-patch',
+    await http('/admin/config', { method: 'PATCH', token: g.jwt, ua: dev.ua, json: { quota_enabled: 'false' } }),
+    [401, 403]
+  );
+  rec(
+    'guest-hits-truncate',
+    await http('/admin/__truncate', { method: 'POST', token: g.jwt, ua: dev.ua }),
+    [401, 403],
+    'CRITICAL: a guest must never be able to wipe the event'
+  );
+  rec('guest-hits-host-users', await http('/host/users', { token: g.jwt, ua: dev.ua }), [401, 403]);
+  rec(
+    'guest-bans-another-user',
+    await http(`/host/users/${randomUUID()}/ban`, { method: 'POST', token: g.jwt, ua: dev.ua }),
+    [401, 403]
+  );
+
+  // ── Cross-user tampering ───────────────────────────────────────────────────
+  // Must be SOMEONE ELSE's upload. The abuse suite has posted several of its own
+  // by now, and they sort to the top of the feed — deleting one of those would be
+  // a 204 that looks like a broken authorisation check but is simply correct.
+  const victimFeed = await http('/feed?limit=100', { token: g.jwt, ua: dev.ua });
+  const victim = victimFeed.body?.uploads?.find((u) => u.id && u.user_id && u.user_id !== attackerId);
+  if (!victim)
+    M.abuse.push({
+      name: 'cross-user-tampering',
+      status: 0,
+      expected: 'another guest to exist',
+      pass: false,
+      note: 'no upload from a different user was visible yet — cases skipped',
+    });
+  if (victim) {
+    rec(
+      'delete-another-users-upload',
+      await http(`/upload/${victim.id}`, { method: 'DELETE', token: g.jwt, ua: dev.ua }),
+      [403, 404]
+    );
+    rec(
+      'edit-another-users-caption',
+      await http(`/upload/${victim.id}`, {
+        method: 'PATCH',
+        token: g.jwt,
+        ua: dev.ua,
+        json: { caption: 'defaced' },
+      }),
+      [403, 404]
+    );
+  }
+
+  // ── Enumeration & malformed requests ───────────────────────────────────────
+  let enumHits = 0;
+  for (let i = 0; i < 15; i++) {
+    const r = await fetchMedia(randomUUID(), 'original', dev.ua);
+    if (r.status === 200) enumHits++;
+  }
+  M.abuse.push({
+    name: 'media-uuid-enumeration',
+    status: enumHits === 0 ? 404 : 200,
+    expected: '404',
+    pass: enumHits === 0,
+    note: `${enumHits}/15 random UUIDs resolved`,
+  });
+  rec('malformed-json-body', await http('/join', { method: 'POST', json: '{"display_name":', raw: true, ua: dev.ua }), [400, 422]);
+  rec('non-uuid-path-segment', await http('/upload/not-a-uuid/like', { method: 'POST', token: g.jwt, ua: dev.ua }), [400, 404, 422]);
+  rec('feed-delta-missing-since', await http('/feed/delta', { token: g.jwt, ua: dev.ua }), [400, 422]);
+  rec('feed-negative-limit', await http('/feed?limit=-5', { token: g.jwt, ua: dev.ua }), [200, 400, 422]);
+  rec('feed-huge-limit', await http('/feed?limit=999999', { token: g.jwt, ua: dev.ua }), [200, 400, 422]);
+  rec('reserved-display-name', await http('/join', { method: 'POST', json: { display_name: 'admin' }, ua: dev.ua }), [409]);
+  rec('control-chars-display-name', await http('/join', { method: 'POST', json: { display_name: 'evil\u0000name' }, ua: dev.ua }), [400]);
+  rec('overlong-display-name', await http('/join', { method: 'POST', json: { display_name: 'A'.repeat(500) }, ua: dev.ua }), [400]);
+
+  // ── Rate-limit probes ──────────────────────────────────────────────────────
+  if (victim) {
+    let limited = 0;
+    for (let i = 0; i < 160; i++) {
+      const r = await http(`/upload/${victim.id}/like`, { method: 'POST', token: g.jwt, ua: dev.ua });
+      if (r.status === 429) limited++;
+      if (r.status >= 500) break;
+    }
+    M.abuse.push({
+      name: 'like-spam-160x (social_rate_per_min=120)',
+      status: limited > 0 ? 429 : 200,
+      expected: '429',
+      pass: limited > 0,
+      note: `${limited} of 160 refused`,
+    });
+  }
+  let loginLimited = 0;
+  for (let i = 0; i < 12; i++) {
+    const r = await http('/admin/login', { method: 'POST', json: { password: `wrong-${i}` }, ua: dev.ua });
+    if (r.status === 429) loginLimited++;
+  }
+  M.abuse.push({
+    name: 'admin-password-bruteforce-12x',
+    status: loginLimited > 0 ? 429 : 401,
+    expected: '429',
+    pass: loginLimited > 0,
+    note: `${loginLimited} of 12 refused`,
+  });
+
+  // ── Quota-divisor abuse: throwaway accounts to shrink everyone's ceiling ───
+  const quotaBefore = await http('/me/quota', { token: g.jwt, ua: dev.ua });
+  let sybils = 0;
+  let sybilLimited = 0;
+  for (let i = 0; i < 60; i++) {
+    const r = await http('/join', { method: 'POST', json: { display_name: `Sybil ${randomUUID().slice(0, 8)}` }, ua: dev.ua });
+    if (r.status === 201) sybils++;
+    else if (r.status === 429) sybilLimited++;
+  }
+  const quotaAfter = await http('/me/quota', { token: g.jwt, ua: dev.ua });
+  // The documented mitigation is that the quota divisor is max(active_uploaders,
+  // estimated_guest_count) — accounts that never upload must not move it. So the
+  // pass condition is "active_uploaders did not rise", not "limit_bytes held":
+  // limit_bytes legitimately falls all evening as the disk fills.
+  const upBefore = quotaBefore.body?.active_uploaders;
+  const upAfter = quotaAfter.body?.active_uploaders;
+  M.abuse.push({
+    name: 'sybil-join-flood-60x (quota-divisor abuse)',
+    status: sybilLimited > 0 ? 429 : 201,
+    expected: 'active_uploaders unchanged by non-uploading accounts',
+    pass: upAfter !== undefined && upAfter <= upBefore + 1,
+    note:
+      `${sybils} throwaway accounts created, ${sybilLimited} throttled; ` +
+      `active_uploaders ${upBefore} → ${upAfter}; ` +
+      `limit_bytes ${quotaBefore.body?.limit_bytes} → ${quotaAfter.body?.limit_bytes}`,
+  });
+
+  note(`abuse suite done (${M.abuse.length} cases)`);
+}
+
+// ── Resource sampling ────────────────────────────────────────────────────────
+async function sample() {
+  const out = { tSec: Math.round((now() - T0) / 1000) };
+  try {
+    const { stdout } = await execFileAsync('docker', [
+      'stats',
+      '--no-stream',
+      '--format',
+      '{{.Name}};{{.CPUPerc}};{{.MemUsage}};{{.MemPerc}}',
+      cfg.appContainer,
+      cfg.dbContainer,
+      cfg.feContainer,
+      cfg.caddyContainer,
+    ]);
+    out.containers = {};
+    for (const line of stdout.trim().split('\n')) {
+      const [name, cpu, mem, memp] = line.split(';');
+      out.containers[name.replace('eventsnap-sim-', '').replace('-1', '')] = {
+        cpu: parseFloat(cpu),
+        mem,
+        memPct: parseFloat(memp),
+      };
+    }
+  } catch (e) {
+    out.dockerErr = String(e).slice(0, 100);
+  }
+  // Disk comes from the app's OWN view (statvfs on MEDIA_PATH) rather than a
+  // `df` in the container — the app image is minimal and has no df, and this is
+  // the exact number the upload gate makes its decision on.
+  if (ADMIN_JWT) {
+    const s = await http('/admin/stats', { token: ADMIN_JWT });
+    if (s.status === 200 && s.body) {
+      out.disk = {
+        size: s.body.disk_total_bytes,
+        used: s.body.disk_used_bytes,
+        avail: s.body.disk_free_bytes,
+      };
+      out.uploadCount = s.body.upload_count;
+      out.userCount = s.body.user_count;
+    }
+  }
+  try {
+    const { stdout } = await psql(
+      `select compression_status, count(*) from upload where deleted_at is null group by 1`
+    );
+    out.compression = {};
+    for (const l of stdout.trim().split('\n')) {
+      if (!l) continue;
+      const [k, v] = l.split('|');
+      out.compression[k] = +v;
+    }
+  } catch (e) {
+    out.compressionErr = String(e).slice(0, 100);
+  }
+  try {
+    const { stdout } = await psql(`select count(*) from pg_stat_activity where datname='eventsnap_test'`);
+    out.dbConns = parseInt(stdout.trim(), 10);
+  } catch {
+    /* ignore */
+  }
+  M.resources.push(out);
+  return out;
+}
+
+function psql(sql) {
+  return execFileAsync('docker', [
+    'exec',
+    cfg.dbContainer,
+    'psql',
+    '-U',
+    'eventsnap_test',
+    '-d',
+    'eventsnap_test',
+    '-tAc',
+    sql,
+  ]);
+}
+
+// ── Stats ────────────────────────────────────────────────────────────────────
+function summarize(nums) {
+  if (!nums.length) return null;
+  const s = [...nums].sort((a, b) => a - b);
+  const at = (p) => s[Math.min(s.length - 1, Math.floor((p / 100) * s.length))];
+  return {
+    n: s.length,
+    min: s[0],
+    p50: at(50),
+    p95: at(95),
+    p99: at(99),
+    max: s[s.length - 1],
+    mean: Math.round(s.reduce((a, b) => a + b, 0) / s.length),
+  };
+}
+/**
+ * Scale a persona mix to a target headcount, keeping the proportions and never
+ * dropping a persona entirely (a smoke run still has to exercise every code path).
+ * Largest-remainder, so the counts sum to exactly `target`.
+ */
+function scaleMix(mix, target) {
+  // Fewer seats than personas: keep the biggest ones rather than inventing a
+  // fractional guest. Only happens in smoke runs.
+  if (target <= mix.length) {
+    return [...mix]
+      .sort((a, b) => b[1] - a[1])
+      .slice(0, Math.max(1, target))
+      .map(([p]) => [p, 1]);
+  }
+  const base = mix.reduce((a, [, n]) => a + n, 0);
+  const exact = mix.map(([p, n]) => [p, (n / base) * target]);
+  const out = exact.map(([p, v]) => [p, Math.max(1, Math.floor(v))]);
+  const order = exact
+    .map(([, v], i) => [i, v - Math.floor(v)])
+    .sort((a, b) => b[1] - a[1])
+    .map(([i]) => i);
+  // Largest-remainder settle. Each pass must change something or we stop, so a
+  // mix that cannot absorb the difference can never spin forever.
+  let diff = target - out.reduce((a, [, n]) => a + n, 0);
+  while (diff > 0) {
+    for (const i of order) {
+      if (diff <= 0) break;
+      out[i][1]++;
+      diff--;
+    }
+  }
+  while (diff < 0) {
+    let moved = false;
+    for (let k = order.length - 1; k >= 0 && diff < 0; k--) {
+      const i = order[k];
+      if (out[i][1] > 1) {
+        out[i][1]--;
+        diff++;
+        moved = true;
+      }
+    }
+    if (!moved) break;
+  }
+  return out;
+}
+
+function countBy(arr, fn) {
+  const m = {};
+  for (const x of arr) {
+    const k = fn(x);
+    m[k] = (m[k] ?? 0) + 1;
+  }
+  return m;
+}
+
+// ── Main ─────────────────────────────────────────────────────────────────────
+let T0 = now();
+let HALT = false;
+/** Set once at startup; lets the resource sampler read the app's own disk view. */
+let ADMIN_JWT = null;
+
+async function main() {
+  console.log('═'.repeat(78));
+  console.log('EventSnap EVENT SIMULATION — real content, 2 vCPU / 4 GB / 30 GB box');
+  console.log('═'.repeat(78));
+
+  const poolMeta = JSON.parse(await readFile(cfg.poolMeta, 'utf8'));
+  const usable = poolMeta.filter((f) => f.magic !== 'unknown');
+  console.log(
+    `[pool] ${poolMeta.length} real files, ${(poolMeta.reduce((a, f) => a + f.bytes, 0) / 1e9).toFixed(2)} GB ` +
+      `(uploaded as-is — the app decides what it refuses)`
+  );
+
+  const admin = await adminLogin();
+  if (cfg.truncate) {
+    console.log('[setup] truncating event data…');
+    const t = await http('/admin/__truncate', { method: 'POST', token: admin });
+    if (t.status !== 204) throw new Error(`truncate failed ${t.status} ${JSON.stringify(t.body)}`);
+  }
+  const admin2 = await adminLogin();
+  ADMIN_JWT = admin2;
+  const cfgNow = await http('/admin/config', { token: admin2 });
+  // The truncate handler reseeds config with every toggle OFF. Restore the SHIPPING
+  // defaults, because running with rate limits and quotas off would test a system
+  // nobody deploys — and would make the abuse suite meaningless.
+  const shipping = {
+    rate_limits_enabled: 'true',
+    upload_rate_enabled: 'true',
+    feed_rate_enabled: 'true',
+    join_rate_enabled: 'true',
+    recover_rate_enabled: 'true',
+    social_rate_enabled: 'true',
+    export_rate_enabled: 'true',
+    admin_login_rate_enabled: 'true',
+    upload_edit_rate_enabled: 'true',
+    quota_enabled: 'true',
+    storage_quota_enabled: 'true',
+    upload_count_quota_enabled: 'true',
+  };
+  const patch = await http('/admin/config', { method: 'PATCH', token: admin2, json: shipping });
+  console.log(`[setup] shipping config restored (rate limits + quotas ON): ${patch.status === 204 ? 'ok' : 'FAILED ' + patch.status}`);
+  const cfgAfter = await http('/admin/config', { token: admin2 });
+
+  // ── Build the cast ─────────────────────────────────────────────────────────
+  // 50 uploaders + 100 viewers. The mix is chosen so the request profile matches a
+  // real event: a few people take most of the photos, most people mostly look.
+  const uploaderMix = scaleMix(
+    [
+      ['photographer', 4],
+      ['enthusiast', 12],
+      ['casual', 18],
+      ['unsure', 8],
+      ['flaky', 8],
+    ],
+    cfg.uploaders
+  );
+  const viewerMix = scaleMix(
+    [
+      ['lurker', 67],
+      ['social', 30],
+      ['kiosk', 3],
+    ],
+    cfg.viewers
+  );
+  const guests = [];
+  let idx = 0;
+  for (const [p, n] of uploaderMix)
+    for (let i = 0; i < n; i++) guests.push(new Guest(idx++, p, pick(DEVICES)));
+  const uploaderCount = guests.length;
+  for (const [p, n] of viewerMix)
+    for (let i = 0; i < n; i++)
+      guests.push(new Guest(idx++, p, p === 'kiosk' ? KIOSK_DEVICE : pick(DEVICES)));
+
+  // ── Hand the real photos out ───────────────────────────────────────────────
+  // Weighted so the four photographers carry the bulk, exactly like a real wedding.
+  // One photographer is deliberately given more than upload_rate_per_hour (100) to
+  // find out what the shipping limiter does to a pro dumping a card.
+  const files = shuffle([...usable]).slice(0, cfg.maxFiles > 0 ? cfg.maxFiles : usable.length);
+  const uploaders = guests.filter((g) => g.spec.kind === 'uploader');
+  const weights = uploaders.map((g) =>
+    g.persona === 'photographer' ? 90 : g.persona === 'flaky' ? 22 : g.persona === 'enthusiast' ? 25 : g.persona === 'unsure' ? 6 : 4
+  );
+  weights[0] = 130; // the pro with the full card
+  const total = weights.reduce((a, b) => a + b, 0);
+  let cursor = 0;
+  uploaders.forEach((g, i) => {
+    const share = Math.round((weights[i] / total) * files.length);
+    g.queue = files.slice(cursor, cursor + share);
+    cursor += share;
+  });
+  if (cursor < files.length) uploaders[0].queue.push(...files.slice(cursor));
+
+  console.log(
+    `[cast] ${guests.length} sessions: ${uploaderCount} uploaders / ${guests.length - uploaderCount} viewers`
+  );
+  console.log(`       ${JSON.stringify(countBy(guests, (g) => g.persona))}`);
+  console.log(`       devices ${JSON.stringify(countBy(guests, (g) => g.device.name))}`);
+  console.log(
+    `[time] ${cfg.realEventHours} h event compressed into ${cfg.windowSec}s (${TIME_SCALE().toFixed(0)}x)`
+  );
+  console.log('═'.repeat(78));
+
+  // ── Go ─────────────────────────────────────────────────────────────────────
+  T0 = now();
+  const sampler = setInterval(sample, 5000);
+  await sample();
+
+  const ticker = setInterval(() => {
+    const ok = M.uploads.filter((u) => u.status === 201).length;
+    const last = M.resources[M.resources.length - 1] ?? {};
+    const d = last.disk ? `disk ${(last.disk.used / 1e9).toFixed(1)}/${(last.disk.size / 1e9).toFixed(0)}GB` : '';
+    const c = last.containers?.app ? `app ${last.containers.app.cpu.toFixed(0)}%/${last.containers.app.memPct.toFixed(0)}%mem` : '';
+    console.log(
+      `[t+${Math.round((now() - T0) / 1000)}s] up ${M.uploads.length} (ok ${ok}) · ` +
+        `processed ${M.sseProcessed.size} · feed ${M.feed.length} · media ${M.media.length} · ` +
+        `likes ${M.likes.length} · ${c} · ${d} · 5xx ${M.serverErrors.length}`
+    );
+  }, 15000);
+
+  const runs = guests.map((g) => g.run());
+  // The abuse personas start once there is real content to attack.
+  const abuseRun = cfg.abuse
+    ? sleep(cfg.windowSec * 250).then(() => runAbuse(admin2, usable).catch((e) => note(`abuse crash: ${e}`)))
+    : Promise.resolve();
+
+  await Promise.all([...runs, abuseRun]);
+  clearInterval(ticker);
+  note('all guest sessions finished — uploads closed');
+
+  // ── Drain ──────────────────────────────────────────────────────────────────
+  note('waiting for the compression backlog to drain (this is the diashow catching up)');
+  const drainStart = now();
+  let drainReason = 'timeout';
+  const okIds = new Set(M.uploads.filter((u) => u.id).map((u) => u.id));
+  let dbBlind = 0;
+  while (now() - drainStart < cfg.drainTimeoutSec * 1000) {
+    const s = await sample();
+    const pendingDb = Object.entries(s.compression ?? {})
+      .filter(([k]) => !TERMINAL_COMPRESSION.has(k))
+      .reduce((a, [, n]) => a + n, 0);
+    const pendingSse = [...okIds].filter((id) => !M.sseProcessed.has(id)).length;
+    if (s.compression && pendingDb === 0) {
+      drainReason = 'db-complete';
+      note(`backlog cleared per DB: ${JSON.stringify(s.compression)}`);
+      break;
+    }
+    // If the DB ground truth is unreadable, fall back to what the diashow saw
+    // rather than spinning until the timeout on a broken query.
+    if (!s.compression) {
+      dbBlind++;
+      if (dbBlind >= 3 && pendingSse === 0) {
+        drainReason = 'sse-complete (db unreadable)';
+        note(`DB counts unavailable (${s.compressionErr ?? '?'}); every upload got an SSE upload-processed`);
+        break;
+      }
+    } else {
+      dbBlind = 0;
+    }
+    console.log(
+      `[drain +${Math.round((now() - drainStart) / 1000)}s] pending(db) ${pendingDb} pending(sse) ${pendingSse} ` +
+        `${JSON.stringify(s.compression ?? {})} app ${s.containers?.app?.cpu?.toFixed(0)}%`
+    );
+    await sleep(5000);
+  }
+  const drainMs = now() - drainStart;
+  clearInterval(sampler);
+  HALT = true;
+  guests.forEach((g) => g.sse?.close());
+
+  // ── Ground truth from the DB ───────────────────────────────────────────────
+  const truth = {};
+  for (const [k, sql] of Object.entries({
+    users: 'select count(*) from "user"',
+    uploads: 'select count(*) from upload where deleted_at is null',
+    byStatus: `select string_agg(s||'='||n, ' ') from (select compression_status s, count(*) n from upload where deleted_at is null group by 1 order by 1) t`,
+    derivativeErrors: `select coalesce(string_agg(distinct left(derivative_last_error,60), ' | '),'none') from upload where derivative_last_error is not null`,
+    likes: 'select count(*) from "like"',
+    comments: 'select count(*) from comment',
+    hashtags: 'select count(*) from hashtag',
+    softDeleted: 'select count(*) from upload where deleted_at is not null',
+    mediaBytes: 'select coalesce(sum(original_size_bytes),0) from upload where deleted_at is null',
+  })) {
+    try {
+      truth[k] = (await psql(sql)).stdout.trim();
+    } catch (e) {
+      truth[k] = `err: ${String(e).slice(0, 80)}`;
+    }
+  }
+  const stats = await http('/admin/stats', { token: await adminLogin() });
+  const finalSample = await sample();
+  const pgSize = await execFileAsync('docker', ['system', 'df', '-v'])
+    .then(({ stdout }) => stdout.split('\n').find((l) => l.includes('sim_pgdata'))?.trim())
+    .catch(() => null);
+
+  // ── Report ─────────────────────────────────────────────────────────────────
+  const okUploads = M.uploads.filter((u) => u.status === 201);
+  const pipeline = [...M.sseProcessed.entries()]
+    .filter(([id]) => uploadEndTs.has(id))
+    .map(([id, ts]) => ts - uploadEndTs.get(id));
+  const firstQuota = M.uploads.filter((u) => u.status === 413).sort((a, b) => a.endTs - b.endTs)[0];
+  const bytesBeforeQuota = firstQuota
+    ? okUploads.filter((u) => u.endTs < firstQuota.endTs).reduce((a, u) => a + u.bytes, 0)
+    : null;
+
+  const report = {
+    meta: {
+      startedAt: new Date(T0).toISOString(),
+      durationSec: Math.round((now() - T0) / 1000),
+      windowSec: cfg.windowSec,
+      timeCompression: `${TIME_SCALE().toFixed(0)}x (${cfg.realEventHours}h → ${cfg.windowSec}s)`,
+      box: '2 vCPU (cpuset 0,1) / 4 GB / 30 GB media volume',
+      images: { app: 'registry.mc02.dev/eventsnap/app:v0.17.5', frontend: 'registry.mc02.dev/eventsnap/frontend:v0.17.6' },
+      rateLimits: 'SHIPPING DEFAULTS — on',
+    },
+    cast: {
+      sessions: guests.length,
+      uploaders: uploaderCount,
+      viewers: guests.length - uploaderCount,
+      personas: countBy(guests, (g) => g.persona),
+      devices: countBy(guests, (g) => g.device.name),
+    },
+    uploads: {
+      attempted: M.uploads.length,
+      ok: okUploads.length,
+      byStatus: countBy(M.uploads, (u) => u.status),
+      byErrorCode: countBy(M.uploads.filter((u) => u.status >= 400), (u) => `${u.status} ${u.code ?? '?'}`),
+      rejectionMessages: countBy(
+        M.uploads.filter((u) => u.status >= 400 && u.msg),
+        (u) => u.msg
+      ),
+      byPersona: countBy(M.uploads, (u) => `${u.persona}:${u.status}`),
+      okBytes: okUploads.reduce((a, u) => a + u.bytes, 0),
+      latencyMs: summarize(okUploads.map((u) => u.ms)),
+    },
+    pipeline: {
+      processedEvents: M.sseProcessed.size,
+      latencyMs: summarize(pipeline),
+      drainMs,
+      drainCleared: drainReason !== 'timeout',
+      drainReason,
+    },
+    diskGate: {
+      firstQuotaRejectAtSec: firstQuota ? Math.round((firstQuota.endTs - T0) / 1000) : null,
+      uploadsAcceptedBeforeGate: firstQuota ? okUploads.filter((u) => u.endTs < firstQuota.endTs).length : null,
+      bytesAcceptedBeforeGate: bytesBeforeQuota,
+      totalQuotaRejections: M.uploads.filter((u) => u.status === 413).length,
+      finalDisk: finalSample.disk,
+      pgVolume: pgSize,
+    },
+    viewers: {
+      feedRequests: M.feed.length,
+      feedLatencyMs: summarize(M.feed.filter((f) => f.status === 200).map((f) => f.ms)),
+      feedByStatus: countBy(M.feed, (f) => f.status),
+      mediaRequests: M.media.length,
+      mediaLatencyMs: summarize(M.media.filter((m) => m.status === 200 || m.status === 206).map((m) => m.ms)),
+      mediaByStatus: countBy(M.media, (m) => m.status),
+      likeRequests: M.likes.length,
+      likeByStatus: countBy(M.likes, (l) => l.status),
+      joinLatencyMs: summarize(M.joins.filter((j) => j.status === 201).map((j) => j.ms)),
+      joinByStatus: countBy(M.joins, (j) => j.status),
+      miscByOp: countBy(M.misc, (m) => `${m.op}:${m.status ?? '-'}`),
+    },
+    sse: {
+      totalEvents: M.sseEvents,
+      newUpload: M.sseNewUpload,
+      processed: M.sseProcessed.size,
+      uploadErrors: M.sseErrors,
+      reconnects: M.sseReconnects,
+      resyncs: M.sseResyncs,
+    },
+    abuse: M.abuse,
+    serverErrors: M.serverErrors,
+    dbTruth: truth,
+    adminStats: stats.body,
+    configAfterSetup: cfgAfter.body,
+    configAtTruncate: cfgNow.body,
+    resources: M.resources,
+    timeline: M.timeline,
+  };
+
+  await mkdir(cfg.outDir, { recursive: true });
+  const stamp = new Date(T0).toISOString().replace(/[:.]/g, '-');
+  const out = join(cfg.outDir, `sim-${stamp}.json`);
+  await writeFile(out, JSON.stringify(report, null, 2));
+
+  // ── Verdict ────────────────────────────────────────────────────────────────
+  const L = (s) => console.log(s);
+  L('\n' + '═'.repeat(78));
+  L('RESULTS');
+  L('═'.repeat(78));
+  L(`duration          ${report.meta.durationSec}s  (${report.meta.timeCompression})`);
+  L(`sessions          ${report.cast.sessions} (${report.cast.uploaders} uploaders / ${report.cast.viewers} viewers)`);
+  L(`uploads           ${report.uploads.ok}/${report.uploads.attempted} accepted, ${(report.uploads.okBytes / 1e9).toFixed(2)} GB`);
+  L(`  by status       ${JSON.stringify(report.uploads.byStatus)}`);
+  L(`  by error code   ${JSON.stringify(report.uploads.byErrorCode)}`);
+  L(`upload latency    ${JSON.stringify(report.uploads.latencyMs)}`);
+  L(`pipeline latency  ${JSON.stringify(report.pipeline.latencyMs)}`);
+  L(`backlog drain     ${(drainMs / 1000).toFixed(0)}s cleared=${report.pipeline.drainCleared} (${drainReason})`);
+  L(`feed latency      ${JSON.stringify(report.viewers.feedLatencyMs)}`);
+  L(`media latency     ${JSON.stringify(report.viewers.mediaLatencyMs)}`);
+  L(`sse               ${M.sseEvents} events, ${M.sseReconnects} reconnects, ${M.sseResyncs} resyncs`);
+  L(`db truth          ${JSON.stringify(truth)}`);
+  L(`disk              ${finalSample.disk ? `${(finalSample.disk.used / 1e9).toFixed(2)} GB used of ${(finalSample.disk.size / 1e9).toFixed(1)} GB` : 'n/a'}`);
+  if (firstQuota)
+    L(
+      `disk gate closed  after ${report.diskGate.uploadsAcceptedBeforeGate} uploads / ` +
+        `${(bytesBeforeQuota / 1e9).toFixed(2)} GB at t+${report.diskGate.firstQuotaRejectAtSec}s ` +
+        `(${report.diskGate.totalQuotaRejections} rejections total)`
+    );
+
+  const abuseFail = M.abuse.filter((a) => !a.pass);
+  L(`\nabuse suite       ${M.abuse.length - abuseFail.length}/${M.abuse.length} behaved as specified`);
+  for (const a of abuseFail) L(`  ✗ ${a.name}: got ${a.status} (${a.code ?? '-'}), expected ${a.expected} — ${a.note ?? ''}`);
+
+  L('\nflags:');
+  const flags = [];
+  if (M.serverErrors.length) flags.push(`✗ ${M.serverErrors.length} server errors (5xx) — see report.serverErrors`);
+  if (!report.pipeline.drainCleared) flags.push(`✗ compression backlog never drained in ${cfg.drainTimeoutSec}s`);
+  if (abuseFail.some((a) => a.is5xx)) flags.push(`✗ abuse input caused a 5xx`);
+  if (abuseFail.length) flags.push(`⚠ ${abuseFail.length} abuse cases deviated from spec`);
+  if (report.pipeline.latencyMs?.p95 > 60000)
+    flags.push(`⚠ pipeline p95 ${(report.pipeline.latencyMs.p95 / 1000).toFixed(0)}s — photos lag the diashow`);
+  if (report.viewers.feedLatencyMs?.p95 > 1000)
+    flags.push(`⚠ feed p95 ${report.viewers.feedLatencyMs.p95}ms — the app feels slow to guests`);
+  if (report.diskGate.totalQuotaRejections)
+    flags.push(`⚠ ${report.diskGate.totalQuotaRejections} uploads refused for disk (413 quota_exceeded)`);
+  if (M.uploads.filter((u) => u.status === 429).length)
+    flags.push(`⚠ ${M.uploads.filter((u) => u.status === 429).length} uploads rate-limited (429)`);
+  if (flags.length) flags.forEach((f) => L('  ' + f));
+  else L('  ✓ clean run');
+  L(`\nfull report → ${out}`);
+  L('═'.repeat(78));
+}
+
+main().catch((e) => {
+  console.error('\n✗ simulation failed:', e);
+  process.exit(1);
+});