chore: raise the db memory limit and rate-limit social writes

Two smaller operational items.

POSTGRES 512M -> 1G. DATABASE_MAX_CONNECTIONS is 30 for a ~100-guest event (feed
polling + SSE + uploads at once), and 30 backends plus Postgres 16's default
shared_buffers leaves very little headroom at 512M. An OOM here doesn't degrade one
feature -- every request path touches the database, so it takes the event down.
Memory is the cheaper knob than shrinking the pool back and reintroducing the
queueing it was raised to fix. .env.example now names the pairing explicitly, the way
it already does for COMPRESSION_WORKER_CONCURRENCY.

SOCIAL WRITES WERE UNTHROTTLED. toggle_like, add_comment and delete_comment were the
only mutating endpoints in the app with no limit at all -- upload, join, recover,
export and admin login all carry one. Asymmetric coverage rather than a deliberate
decision.

Low severity, and honestly so: a like fans an SSE broadcast to every client, but the
export regeneration a comment deletion triggers is contained (REGEN_DEBOUNCE 20s,
workers born with their epoch, superseded ones inert). So the ceiling is 120/min --
far above anything a real guest produces. This bounds a script, not an enthusiastic
double-tapper.

ONE bucket across all three actions: separate buckets would let a caller triple the
aggregate write rate by alternating between them. Keyed per USER, matching the feed
and upload limits -- at a venue every guest is behind one NAT, and an IP key is what
made the /join and /feed limits turn guests away in the first place.

Migration 020 seeds both keys, and both are wired into the admin allowlist, the
config UI and the e2e reseed -- the step two earlier per-area toggles missed, which
left switches that existed in code and could never be flipped.

Tests: 4 e2e, including that the shared bucket really is shared (the part most likely
to be lost in a refactor) and that one guest hitting the ceiling doesn't block
another behind the same IP.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.claude/settings.json

@@ -0,0 +1,9 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(cargo check *)",
+      "Bash(cargo clippy *)",
+      "Bash(git --no-pager diff *)"
+    ]
+  }
+}

.env.example

@@ -16,6 +16,13 @@ DATABASE_URL=postgres://eventsnap:CHANGE_ME_use_a_strong_password@db:5432/events
 POSTGRES_USER=eventsnap
 POSTGRES_PASSWORD=CHANGE_ME_use_a_strong_password
 POSTGRES_DB=eventsnap
+# Connection pool size. Default 10. For a busy event (~100 guests polling the feed
+# + SSE + uploads at once) raise to ~30 so requests don't queue on a pool permit.
+# PAIRED WITH THE DB CONTAINER'S MEMORY LIMIT: 30 backends plus Postgres 16's default
+# shared_buffers is already snug in the 1G that docker-compose.yml allots the `db`
+# service. If you raise this, raise `db.deploy.resources.limits.memory` with it — an
+# OOM in Postgres doesn't degrade one feature, it takes the whole event down.
+DATABASE_MAX_CONNECTIONS=30
 
 # ── Authentication ────────────────────────────────────────────────────────────
 # Generate with: openssl rand -hex 64
@@ -24,7 +31,11 @@ SESSION_EXPIRY_DAYS=30
 
 # Admin dashboard password (bcrypt hash).
 # Generate with: htpasswd -bnBC 12 "" yourpassword | tr -d ':\n'
-ADMIN_PASSWORD_HASH=$2y$12$placeholder_replace_me
+# IMPORTANT: keep the SINGLE QUOTES. A bcrypt hash is full of `$` (e.g. $2b$12$…$…),
+# and both Docker Compose's env_file interpolation and dotenvy's variable substitution
+# would otherwise eat the `$…` segments (reading them as unset vars) and corrupt the
+# hash — every admin login then 401s. Single quotes make both read it literally.
+ADMIN_PASSWORD_HASH='$2y$12$placeholder_replace_me'
 
 # ── Event ─────────────────────────────────────────────────────────────────────
 EVENT_NAME=Max & Maria's Wedding
@@ -36,19 +47,43 @@ MEDIA_PATH=/media
 # /media is publicly served, so exports here would be downloadable without auth.
 EXPORT_PATH=/exports
 
-# ── Upload limits ─────────────────────────────────────────────────────────────
-DEFAULT_MAX_IMAGE_SIZE_MB=20
-DEFAULT_MAX_VIDEO_SIZE_MB=500
-
-# ── Rate limiting ─────────────────────────────────────────────────────────────
-DEFAULT_UPLOAD_RATE_PER_HOUR=10
-DEFAULT_FEED_RATE_PER_MIN=60
-DEFAULT_EXPORT_RATE_PER_DAY=3
-
-# ── Capacity ──────────────────────────────────────────────────────────────────
-DEFAULT_ESTIMATED_GUEST_COUNT=100
-# Fraction of total storage that triggers the "low storage" warning (0.0–1.0)
-DEFAULT_QUOTA_TOLERANCE=0.75
+# ── Runtime settings (upload limits, rate limits, capacity) ───────────────────
+# NOTE: These are NOT environment variables. Upload size caps, rate limits, guest
+# count and quota tolerance are stored in the database `config` table (seeded once
+# at first boot) and changed at runtime from the ADMIN DASHBOARD — the backend does
+# not read them from .env. Setting them here has no effect. Current seeded defaults:
+#   upload rate      100 / hour / guest   (raised from 10 by migration 015)
+#   feed rate         60 / minute
+#   export rate        3 / day
+#   max image size    20 MB
+#   max video size   500 MB
+#   estimated guests 100
+#   quota tolerance  0.75  (see below — NOT a warning threshold)
+# Adjust these in the admin UI before the event if needed.
+#
+# quota_tolerance is the MULTIPLIER IN THE PER-USER QUOTA FORMULA, not the point at
+# which anything warns you:
+#
+#     per_user_limit = floor(free_disk * quota_tolerance / active_uploaders)
+#
+# It is recomputed against LIVE free space on every upload, so it self-throttles: guests
+# converge on a fixed point at tolerance/(1+tolerance) of the free space you started
+# with — 43% at 0.75, i.e. ~30 GB of a fresh 70 GB.
+#
+# Raising it therefore AUTHORISES GUESTS TO FILL MORE OF THE DISK. Setting 0.95 in the
+# belief that it means "warn me later" moves the fixed point to ~49% and eats the
+# headroom the keepsake needs — and the keepsake needs a lot, because Gallery.zip and
+# Memories.zip are each roughly a second copy of every original (both store media
+# uncompressed). Budget for media + 2x media, or move exports to their own volume.
+#
+# 0.75 is the tested default. Lower it if the box is tight; raise it only if you have
+# provisioned export headroom separately.
 
 # ── Workers ───────────────────────────────────────────────────────────────────
+# Number of parallel image/video compression workers. Default 2. This is the main
+# throughput bottleneck: with 2 workers a burst of uploads can take ~5s to appear.
+# For a large event (100+ guests) 4 is a good target — but each worker can run an
+# ffmpeg transcode, so if you raise this ALSO raise the app container's memory limit
+# in docker-compose.yml (`app.deploy.resources.limits.memory`) from 1G to ~2G, or a
+# burst of large videos can OOM the box and take Postgres down with it.
 COMPRESSION_WORKER_CONCURRENCY=2

.github/workflows/e2e.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   e2e:
-    name: Playwright E2E (chromium-desktop)
+    name: Playwright E2E (chromium + webkit)
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -25,7 +25,7 @@ jobs:
 
       - name: Install Playwright browsers
         working-directory: ./e2e
-        run: npx playwright install --with-deps chromium
+        run: npx playwright install --with-deps chromium webkit
 
       - name: Bring up the test stack
         working-directory: ./e2e
@@ -54,6 +54,22 @@ jobs:
         working-directory: ./e2e
         run: npm run test:e2e -- --project=chromium-mobile
 
+      # iOS Safari is the app's stated primary user (a wedding guest opening a QR link), and
+      # WebKit is the ONLY engine here that reproduces two of its behaviours:
+      #   - it enforces X-Frame-Options on the download iframe, so a site-wide `DENY` makes the
+      #     keepsake download silently do nothing. Blink hands attachments to the download
+      #     manager first and never notices. That shipped once already.
+      #   - it abandons a <video> load without a 206 response to its Range probe.
+      # Both regressions are invisible to every Chromium project, so running WebKit is what
+      # actually gates them on a PR rather than on someone remembering to test locally.
+      #
+      # The project is scoped in playwright.config.ts to the journeys a guest walks
+      # (01-auth, 02-upload, 03-feed, 06-export); four IndexedDB-blob tests skip themselves
+      # there — see helpers/webkit.ts for why that is the harness and not the app.
+      - name: Run E2E tests (webkit / iOS)
+        working-directory: ./e2e
+        run: npm run test:e2e -- --project=webkit-iphone
+
       - name: Upload Playwright report
         if: failure()
         uses: actions/upload-artifact@v4

.gitignore

@@ -29,3 +29,6 @@ e2e/.env.test
 # OS
 .DS_Store
 Thumbs.db
+
+# Claude Code personal (per-user) settings — shared settings.json IS committed
+.claude/settings.local.json

Caddyfile

@@ -9,34 +9,63 @@
 	header {
 		Strict-Transport-Security "max-age=31536000; includeSubDomains"
 		X-Content-Type-Options "nosniff"
-		X-Frame-Options "DENY"
 		Referrer-Policy "strict-origin-when-cross-origin"
 	}
 
+	# X-Frame-Options: DENY everywhere EXCEPT the keepsake download endpoints, which
+	# are navigated in a HIDDEN, SAME-ORIGIN iframe so a 404/429 can't unload the PWA
+	# (see frontend/src/routes/export/+page.svelte). WebKit enforces XFO *before*
+	# honouring Content-Disposition, so a blanket DENY makes the download silently do
+	# nothing on iOS Safari — the app's primary platform. SAMEORIGIN still blocks
+	# cross-origin framing.
+	#
+	# Split into two disjoint matchers rather than an override: Caddy applies the
+	# FIRST header directive outermost, so it wins on write — a later, more specific
+	# `header` would be silently ignored.
+	@framable path /api/v1/export/zip /api/v1/export/html
+	@not_framable not path /api/v1/export/zip /api/v1/export/html
+	header @framable X-Frame-Options "SAMEORIGIN"
+	header @not_framable X-Frame-Options "DENY"
+
 	# SvelteKit frontend — static assets with long-lived cache (content-hashed filenames)
 	@hashed_assets path_regexp hashed /_app/immutable/.*\.[a-f0-9]{8,}\.(js|css|woff2)$
 	header @hashed_assets Cache-Control "public, max-age=31536000, immutable"
 
-	# Preview/thumbnail images. These are now served by the app through a
-	# visibility-checked alias (/api/v1/upload/{id}/{preview,thumbnail}) so moderation
-	# can revoke access; direct /media/previews|thumbnails is 404-blocked at the app.
+	# Preview/thumbnail images. These are served by the app through a visibility-checked
+	# alias (/api/v1/upload/{id}/{preview,thumbnail}) so moderation can revoke access;
+	# the app serves no /media route at all, so there is no direct path to the bytes.
 	# Privately cacheable for a short window (the app sets the same header; this is the
 	# edge carve-out from the blanket no-store below). Kept short so a moderated image
 	# stops being served to a direct-URL holder promptly.
 	@media_api path /api/v1/upload/*/preview /api/v1/upload/*/thumbnail
 	header @media_api Cache-Control "private, max-age=300"
 
-	# API — never cache, EXCEPT the gated image routes above.
+	# API and health — never cache, EXCEPT the gated image routes above. A cached health
+	# response would report the last known state rather than the current one.
 	@api {
-		path /api/*
+		path /api/* /health
 		not path /api/v1/upload/*/preview /api/v1/upload/*/thumbnail
 	}
 	header @api Cache-Control "no-store"
 
-	# Route API and media requests to the Rust backend
+	# Route API and media requests to the Rust backend.
+	#
+	# The app serves no /media route at all (see the note in backend/src/main.rs) — media
+	# bytes are reachable only through the visibility-checked /api/v1/upload aliases, so
+	# /media/* forwards to a plain 404. The proxy line is kept deliberately: it means the
+	# edge faithfully hands /media to the app, so if a future change ever re-introduces a
+	# static media route the e2e gating specs see it here exactly as production would,
+	# instead of being masked by the SvelteKit 404 page.
 	reverse_proxy /api/* app:3000
 	reverse_proxy /media/* app:3000
 
+	# The backend registers /health on its ROOT router, not under /api/v1, so it needs its
+	# own line — without it the catch-all below hands /health to SvelteKit, which has no
+	# such route and returns its 404 page. That made the documented post-deploy check
+	# (`curl -fsS https://DOMAIN/health`) fail 100% of the time on a perfectly healthy
+	# stack. e2e/Caddyfile.test has always carried this line; production never did.
+	reverse_proxy /health app:3000
+
 	# Everything else goes to SvelteKit frontend
 	reverse_proxy frontend:3001
 }

PROJECT.md

@@ -709,7 +709,7 @@ CREATE TABLE config (
 INSERT INTO config (key, value) VALUES
     ('max_image_size_mb',       '20'),
     ('max_video_size_mb',       '500'),
-    ('upload_rate_per_hour',    '10'),
+    ('upload_rate_per_hour',    '100'),  -- raised from 10 in migration 015 (guests upload bursts of 10-20)
     ('feed_rate_per_min',       '60'),
     ('export_rate_per_day',     '3'),
     ('quota_tolerance',         '0.75'),
@@ -1133,16 +1133,19 @@ eventsnap/
 
 ### Backup Strategy
 
-```bash
-# Daily (e.g. as a separate Compose service or cron on the VPS)
-pg_dump $DATABASE_URL | gzip > /media/backups/db_$(date +%Y-%m-%d).sql.gz
+Three artefacts in three places: the database, the `media_data` volume
+(originals + derivatives), and the **separate** `exports_data` volume. See
+[README.md](README.md#backup) for the exact commands.
 
-# Weekly: rsync /media volume to Hetzner Storage Box
-rsync -az /opt/eventsnap/media/ \
-  user@u123456.your-storagebox.de:backup/eventsnap/
-```
+Everything runs through `docker compose` / `docker run`, because `DATABASE_URL`
+and the `/media` and `/exports` paths only exist inside the compose network —
+they are not host paths, and `DATABASE_URL` is never exported into an operator's
+shell.
 
-The `/media` volume contains originals, previews, thumbnails, generated exports, and DB backups — a single volume to back up.
+Export archives are deliberately outside `MEDIA_PATH` (`EXPORT_PATH=/exports`): a
+keepsake contains every photo in the event, and keeping it off the media tree is
+what stops it being reachable except through the ticket-gated handler. A backup
+of the media volume alone silently loses every generated keepsake.
 
 ---
 

README.md

@@ -34,7 +34,6 @@ A guest scans the QR code on their way in, types their name, and is immediately
 ### Planned (v1.x)
 
 - Individual file download button
-- Low-disk alert (< 10 GB free)
 - Event banner / cover image
 - Chunked resumable upload for large videos
 - Host-curated story highlights
@@ -115,6 +114,65 @@ Caddy automatically obtains a Let's Encrypt certificate on first start. The app
 > docker compose -f docker-compose.yml -f docker-compose.dev.yml up
 > ```
 
+### Updating an existing deployment
+
+> **`docker compose up -d` alone will NOT deploy your changes.** `app` and `frontend` are
+> `build:` services with no published image tag, and Compose has no source-change detection:
+> if an image with that name already exists it is reused. After a `git pull` the command
+> reports `Container … Running`, changes nothing, and **exits 0** — so a deploy that shipped
+> nothing looks exactly like a successful one. `--build` is what makes it real.
+
+```bash
+cd /path/to/eventsnap
+
+# 1. Back up first — migrations run automatically on boot and are not reversible in place.
+#    (See "Backup" below; the database dump is the one that matters here.)
+
+# 2. Fetch the new code.
+git pull
+
+# 3. Rebuild and restart the application services. --build is NOT optional.
+docker compose up -d --build
+
+# 4. Apply any Caddyfile change. Step 3 does NOT do this — see the warning below.
+docker compose up -d --force-recreate caddy
+
+# 5. Confirm the app came back up. Anything other than "ok" means check the logs.
+curl -fsS https://DOMAIN/health && echo
+
+# 6. Confirm a NEW image was actually built. Note the IMAGE ID before you start and
+#    compare — it must have changed. (Ignore the CREATED column; it reports the base
+#    layer's age, not this build's.) An unchanged ID means step 3 ran without --build
+#    and you are still serving the old code.
+docker compose images app frontend
+```
+
+Migrations are applied by the backend on startup, so step 3 covers them. If `app` stays
+unhealthy afterwards, `docker compose logs app` will name the failing migration — and note
+that a migration applied by a *newer* build is not removed by checking out an older commit,
+so rolling back code without restoring the database snapshot from step 1 leaves the schema
+ahead of the binary and the app refusing to boot.
+
+> **Why step 4 exists.** `--build` only rebuilds services that have a `build:` section, and
+> `caddy` is a pinned upstream image. Compose decides whether to recreate a container from its
+> *config hash*, which covers the mount **specification** (`./Caddyfile:/etc/caddy/Caddyfile:ro`)
+> but **not the file's contents** — so a `git pull` that changes `./Caddyfile` produces no
+> delta, Compose reports `Running`, and Caddy keeps serving its old config indefinitely. Exit
+> code 0 throughout.
+>
+> That is not hypothetical: the fix that made the keepsake download work on iOS
+> (`137c4ee`) touched the Caddyfile and four e2e files and nothing else, so **all** of its
+> production effect lives in that one file. Without step 4 you deploy it, watch both image IDs
+> change, and iOS downloads stay broken.
+>
+> `--force-recreate` rather than `restart` or `caddy reload`: the bind mount is resolved to an
+> **inode** when the container is created, and `git pull` replaces the file instead of editing
+> it in place, so the container can still be bound to the old, now-unlinked inode. A restart
+> then re-reads the stale content. Recreating the container re-resolves the path.
+
+`db` is never touched, and recreating `caddy` does not disturb the `caddy_data` volume, so the
+TLS certificate and all data volumes survive.
+
 ### Generate required secrets
 
 ```bash
@@ -162,23 +220,176 @@ See [.env.example](.env.example) for the full list with descriptions and default
 └────────┘
 ```
 
-- `/api/*` and `/media/*` → Rust backend
+- `/api/*` → Rust backend
 - Everything else → SvelteKit frontend (`adapter-node`)
-- Named volumes: `postgres_data`, `media_data`, `caddy_data`
+- Named volumes: `postgres_data`, `media_data`, `exports_data`, `caddy_data`
+
+Media is **not** served as static files. Every image goes through a
+visibility-checked alias (`/api/v1/upload/{id}/{preview,display,thumbnail,original}`)
+so a host takedown or a ban actually revokes access to the bytes.
+
+---
+
+## Sizing the disk
+
+`postgres_data`, `media_data` and `exports_data` are all Docker named volumes under
+`/var/lib/docker/volumes`, so **they share one filesystem**. Filling it does not
+degrade one subsystem — Postgres stops being able to write and the whole event goes
+down.
+
+Uploads are self-limiting. `per_user_limit = free_disk × quota_tolerance ÷
+active_uploaders` is recomputed against live free space on every upload, so guests
+converge on a fixed point at `tolerance / (1 + tolerance)` of the free space you
+started with — **43%** at the default 0.75. On an 80 GB box with ~70 GB free after
+the OS and images, media settles at ~30 GB and stops.
+
+**The keepsake is what the 80 GB baseline does not cover.** `Gallery.zip` and
+`Memories.zip` are built concurrently and each is roughly a second copy of every
+original: both write their media `Compression::Stored`, and `Memories.zip` streams the
+untouched original for every video and for every image at or under 5 MB. So a release
+wants room for **two more copies of the gallery** on top of the gallery itself.
+
+| Stage | Used | Free (80 GB box) |
+|---|---|---|
+| Fresh box (OS + images) | ~10 GB | ~70 GB |
+| Guests reach the quota fixed point | ~40 GB | ~40 GB |
+| Host releases → both archives | ~100 GB | **ENOSPC** |
+
+Two ways to size for it:
+
+- **Provision ~3× your expected media** on one volume (media + two archives), or
+- **give `exports_data` its own volume** so a full export cannot reach Postgres, and
+  size that one at ~2× expected media.
+
+This is no longer silent. The export refuses up front with the two numbers rather than
+hitting ENOSPC halfway through a multi-GB write, a rebuild reclaims the superseded
+generation before it starts (so peak is one generation, not two), and the host
+dashboard warns as soon as the keepsake would not fit — which is the only point at
+which anyone can still do something about it.
 
 ---
 
 ## Backup
 
-```bash
-# Database snapshot
-pg_dump $DATABASE_URL | gzip > /media/backups/db_$(date +%Y-%m-%d).sql.gz
+There are **three** things to back up, and they live in three different places.
+`DATABASE_URL` and the container paths (`/media`, `/exports`) are meaningful only
+*inside* the compose network — they are not host paths, and `DATABASE_URL` is
+never exported into an operator's shell — so every command below runs through
+`docker compose` from the repo directory.
 
-# Weekly offsite sync (Hetzner Storage Box or similar)
-rsync -az /opt/eventsnap/media/ user@storagebox.example.com:backup/eventsnap/
+```bash
+# 1. Database snapshot. Runs pg_dump inside the db container (the app image has no
+#    postgres client), reading credentials from the compose environment.
+#    --clean --if-exists makes the dump SELF-CLEANING: without it the restore below
+#    aborts on the first "already exists" against a database that has ever booted,
+#    which is every database you would actually want to restore over.
+mkdir -p ./backups
+docker compose exec -T db \
+  sh -c 'pg_dump --clean --if-exists -U "$POSTGRES_USER" "$POSTGRES_DB"' \
+  | gzip > ./backups/db_$(date +%Y-%m-%d).sql.gz
+
+# 2. Uploaded media (originals + derivatives) out of the named volume.
+#    NOTE the mountpoint is /src, not /media: if the volume is ever empty, Docker
+#    pre-populates a fresh mount from the image's own directory, and alpine ships a
+#    /media containing cdrom/floppy/usb. Mounting somewhere the image has nothing
+#    avoids silently tarring (and polluting the volume with) those.
+docker run --rm \
+  -v eventsnap_media_data:/src:ro -v "$PWD/backups":/backup \
+  alpine tar czf /backup/media_$(date +%Y-%m-%d).tar.gz -C /src .
+
+# 3. Export archives — a SEPARATE volume (see the security note below).
+docker run --rm \
+  -v eventsnap_exports_data:/src:ro -v "$PWD/backups":/backup \
+  alpine tar czf /backup/exports_$(date +%Y-%m-%d).tar.gz -C /src .
+
+# Offsite sync of the three artefacts above.
+rsync -az ./backups/ user@storagebox.example.com:backup/eventsnap/
 ```
 
-The `/media` volume holds originals, previews, thumbnails, exports, and DB backups — a single path to back up.
+Volume names are prefixed with the compose project name — `eventsnap_` if you run
+from a directory called `eventsnap`. Confirm yours with `docker volume ls`.
+
+> **Exports are deliberately NOT under `/media`.** They live on their own
+> `exports_data` volume (`EXPORT_PATH=/exports`) because a keepsake archive
+> contains every photo in the event; keeping it outside the media tree is what
+> stops it being reachable except through the ticket-gated download handler.
+> Backing up only the media volume therefore loses every generated keepsake.
+
+### When to run it
+
+**A nightly cron is the wrong shape for this app.** Every irreplaceable byte is
+created inside one eight-hour window, and nobody can retake a wedding. Run the three
+commands above:
+
+1. **The night of the event**, once uploads have stopped. This is the backup that
+   matters; everything else is a formality.
+2. **After the host releases the gallery**, so the generated keepsake is captured too.
+3. Weekly thereafter, until the event is archived and torn down.
+
+Take the DB dump and the media tarball **back to back**, without uploads in flight
+between them. Upload rows reference files by path — a database from 22:00 and a media
+volume from 23:00 gives you rows pointing at files the dump doesn't know about, and
+rows whose files aren't in the tarball. Locking uploads from the host dashboard first
+(**Uploads sperren**) makes the pair genuinely consistent.
+
+---
+
+## Restore
+
+An untested backup is not a backup. Run this once against a scratch host **before**
+the event — it is roughly ten minutes, and it is the only way to find out that your
+tarball is empty or your dump is truncated while that is still a small problem.
+
+```bash
+# 0. Stop the app FIRST. Migrations run on boot and a live pool will fight the
+#    restore — a booting app against a half-restored schema can leave the migration
+#    table and the schema disagreeing, which is its own recovery problem.
+#    Leave `db` running: the dump is restored through it.
+docker compose stop app caddy
+
+# 1. Database. The dump carries its own DROPs (step 1 of Backup), so this replaces
+#    rather than collides. A dump taken WITHOUT --clean --if-exists will abort here
+#    on the first "already exists" — restore that one into a fresh empty database
+#    instead.
+gunzip -c ./backups/db_2026-07-29.sql.gz \
+  | docker compose exec -T db \
+      sh -c 'psql -U "$POSTGRES_USER" -d "$POSTGRES_DB" --set ON_ERROR_STOP=1'
+
+# 2. Media. NOTE the `--numeric-owner` and the chown: the app runs as a
+#    NON-ROOT user (uid 100, gid 101 — `addgroup -S app && adduser -S app`), and a
+#    restore that lands root-owned files makes every upload fail with EACCES deep in
+#    the write path, surfacing to the guest as a generic 500 with nothing in the UI
+#    to suggest permissions. The explicit chown is what guarantees it — BusyBox tar
+#    (which is what `alpine` ships) has no --same-owner, and restores ownership only
+#    because it runs as root here.
+docker run --rm \
+  -v eventsnap_media_data:/dst -v "$PWD/backups":/backup:ro \
+  alpine sh -c 'tar xzf /backup/media_2026-07-29.tar.gz -C /dst \
+                    --numeric-owner && chown -R 100:101 /dst'
+
+# 3. Exports. Same volume-name caveat, same ownership rules.
+docker run --rm \
+  -v eventsnap_exports_data:/dst -v "$PWD/backups":/backup:ro \
+  alpine sh -c 'tar xzf /backup/exports_2026-07-29.tar.gz -C /dst \
+                    --numeric-owner && chown -R 100:101 /dst'
+
+# 4. Back up. Migrations run, then export recovery re-arms any keepsake whose file
+#    didn't come back with the volume.
+docker compose up -d app caddy
+docker compose logs -f app        # watch for "migrations applied"
+
+# 5. Verify — all three, not just the first.
+curl -fsS https://DOMAIN/health && echo            # → ok
+#   … then sign in as host and confirm the feed renders images (proves the media
+#   volume restored AND is readable by uid 100), and that the keepsake downloads.
+```
+
+If the media volume restored but images 404 while the feed lists them, the paths are
+there and the bytes aren't — check `docker compose exec app ls -ln /media/originals`
+and confirm both the files and the `100:101` ownership.
+
+The restore is deliberately **not** automated. It is rare, destructive, and the one
+operation where a script that half-works is worse than a checklist someone reads.
 
 ---
 
@@ -254,7 +465,7 @@ Open:
 - [ ] SSE delta-fetch on foreground reconnect (scaffolded in [sse.ts](frontend/src/lib/sse.ts), not wired)
 - [ ] Live diashow / slideshow mode — see [docs/CONCEPT_DIASHOW.md](docs/CONCEPT_DIASHOW.md)
 - [ ] Individual file download button per post
-- [ ] Low-disk alert (< 10 GB free)
+- [x] Low-disk alert — host dashboard warns below 10 GB free, or whenever the keepsake would not fit
 - [ ] Event banner / cover image
 - [ ] Chunked resumable upload for files > 100 MB
 - [ ] Shared Tailwind config between main app and export-viewer

backend/migrations/015_raise_upload_rate.down.sql

@@ -0,0 +1,3 @@
+-- Revert the default upload rate to 10/hour for installs still on the raised
+-- default (preserves any explicit admin override at another value).
+UPDATE config SET value = '10' WHERE key = 'upload_rate_per_hour' AND value = '100';

backend/migrations/015_raise_upload_rate.up.sql

@@ -0,0 +1,10 @@
+-- Raise the default per-guest upload rate from 10/hour to 100/hour.
+--
+-- Rationale: guests routinely upload a burst of 10-20 photos at once (phone
+-- multi-select). At the old default of 10/hour a real guest's first burst was
+-- throttled — surfaced by the 2026-07-18 load test. 100/hour comfortably covers
+-- several bursts across an event while still bounding abuse.
+--
+-- Only bump installs still on the old default; an admin who deliberately set a
+-- different value keeps it (migration 005 seeded 10; this UPDATE is scoped to '10').
+UPDATE config SET value = '100' WHERE key = 'upload_rate_per_hour' AND value = '10';

backend/migrations/016_display_derivative.down.sql

@@ -0,0 +1,28 @@
+-- Drop the view (frees the column dependency), remove the column, then restore the
+-- pre-016 view definition (matches migration 011).
+DROP VIEW IF EXISTS v_feed;
+ALTER TABLE upload DROP COLUMN display_path;
+
+CREATE VIEW v_feed AS
+SELECT
+    u.id,
+    u.event_id,
+    u.user_id,
+    usr.display_name             AS uploader_name,
+    usr.is_banned,
+    usr.uploads_hidden,
+    u.preview_path,
+    u.thumbnail_path,
+    u.mime_type,
+    u.caption,
+    u.created_at,
+    COUNT(DISTINCT l.user_id)    AS like_count,
+    COUNT(DISTINCT c.id)         AS comment_count
+FROM upload u
+JOIN "user" usr ON u.user_id = usr.id
+LEFT JOIN "like" l  ON l.upload_id = u.id
+LEFT JOIN comment c ON c.upload_id = u.id AND c.deleted_at IS NULL
+WHERE u.deleted_at IS NULL
+  AND usr.uploads_hidden = FALSE
+  AND usr.is_banned = FALSE
+GROUP BY u.id, usr.display_name, usr.is_banned, usr.uploads_hidden;

backend/migrations/016_display_derivative.up.sql

@@ -0,0 +1,34 @@
+-- Display derivative: a big-screen-quality image (~2048px long edge) for the diashow.
+-- The 800px `preview_path` is sized for phone feeds (data saver); upscaled on a projector
+-- it looks soft. The diashow uses `display_path` instead — bounded in size (safe to decode
+-- on weak kiosk hardware) yet sharp on 1080p/4K. NULL until the compression worker (or the
+-- one-time backfill) generates it; consumers fall back to the original when absent.
+ALTER TABLE upload ADD COLUMN display_path TEXT;
+
+-- Recreate (not CREATE OR REPLACE, which only allows appending columns at the end) so the
+-- new column can sit alongside preview_path/thumbnail_path.
+DROP VIEW IF EXISTS v_feed;
+CREATE VIEW v_feed AS
+SELECT
+    u.id,
+    u.event_id,
+    u.user_id,
+    usr.display_name             AS uploader_name,
+    usr.is_banned,
+    usr.uploads_hidden,
+    u.preview_path,
+    u.thumbnail_path,
+    u.display_path,
+    u.mime_type,
+    u.caption,
+    u.created_at,
+    COUNT(DISTINCT l.user_id)    AS like_count,
+    COUNT(DISTINCT c.id)         AS comment_count
+FROM upload u
+JOIN "user" usr ON u.user_id = usr.id
+LEFT JOIN "like" l  ON l.upload_id = u.id
+LEFT JOIN comment c ON c.upload_id = u.id AND c.deleted_at IS NULL
+WHERE u.deleted_at IS NULL
+  AND usr.uploads_hidden = FALSE
+  AND usr.is_banned = FALSE
+GROUP BY u.id, usr.display_name, usr.is_banned, usr.uploads_hidden;

backend/migrations/017_join_ip_rate.down.sql

@@ -0,0 +1 @@
+DELETE FROM config WHERE key IN ('join_ip_rate_per_min', 'admin_login_rate_enabled');

backend/migrations/017_join_ip_rate.up.sql

@@ -0,0 +1,18 @@
+-- Per-IP flood ceiling for /join, and the `admin_login_rate_enabled` toggle that
+-- every prior migration forgot to seed.
+--
+-- Rationale: /join was throttled at 5 requests per 60s keyed on the client IP. At a
+-- venue every guest is behind one NAT, so the whole party shared a single bucket —
+-- 12 guests scanning the QR code within a few seconds meant 5 got in and 7 were
+-- turned away. The handler now keys the real anti-spam bucket per (ip, name), the
+-- same shape as `recover:{ip}:{name}`, and keeps only a loose per-IP ceiling to bound
+-- raw volume. 60/min comfortably covers a whole wedding arriving at once while still
+-- capping a flood from a single source.
+--
+-- `admin_login_rate_enabled` is read by auth::handlers::admin_login with a code
+-- default of `true`, but no migration ever inserted it, so it was invisible to the
+-- admin config UI and to the e2e reseed. Seed it explicitly.
+INSERT INTO config (key, value) VALUES
+    ('join_ip_rate_per_min',     '60'),
+    ('admin_login_rate_enabled', 'true')
+ON CONFLICT (key) DO NOTHING;

backend/migrations/018_derivatives_rev.down.sql

@@ -0,0 +1,2 @@
+DROP INDEX IF EXISTS idx_upload_derivatives_rev;
+ALTER TABLE upload DROP COLUMN IF EXISTS derivatives_rev;

backend/migrations/018_derivatives_rev.up.sql

@@ -0,0 +1,18 @@
+-- Track which revision of the derivative pipeline produced an upload's preview/display.
+--
+-- Rev 1 applies the EXIF orientation tag. Everything generated before it decoded the raw
+-- sensor pixels and re-encoded to JPEG (which writes no EXIF), so every portrait phone photo
+-- was stored sideways in the feed preview, the diashow display and the keepsake — while the
+-- untouched original still rendered upright.
+--
+-- Existing rows default to 0 so the startup backfill can find and re-generate them exactly
+-- once; bump the constant in services/compression.rs if the pipeline ever changes again.
+ALTER TABLE upload ADD COLUMN IF NOT EXISTS derivatives_rev SMALLINT NOT NULL DEFAULT 0;
+
+-- Only image derivatives are affected — video thumbnails are extracted by ffmpeg, which
+-- already honours the rotation matrix. Mark them current so the backfill skips them.
+UPDATE upload SET derivatives_rev = 1 WHERE mime_type NOT LIKE 'image/%';
+
+CREATE INDEX IF NOT EXISTS idx_upload_derivatives_rev
+    ON upload (derivatives_rev)
+    WHERE deleted_at IS NULL;

backend/migrations/019_recover_ip_rate.down.sql

@@ -0,0 +1 @@
+DELETE FROM config WHERE key = 'recover_ip_rate_per_min';

backend/migrations/019_recover_ip_rate.up.sql

@@ -0,0 +1,19 @@
+-- Per-IP flood ceiling for /recover, mirroring the one migration 017 added for /join.
+--
+-- Rationale: /recover is keyed `recover:{ip}:{name}` at 5 per 15 minutes. That is the
+-- right shape for its actual job — stopping someone who knows a display name (they are
+-- visible on the feed) from burning the victim's 3-strike PIN counter and locking them
+-- out repeatedly. But the name is attacker-chosen, so cycling names mints a fresh bucket
+-- every time and the per-IP cost is unbounded.
+--
+-- Behind that limiter sits a cost-12 bcrypt verify, including an UNCONDITIONAL throwaway
+-- verify for names that don't exist — deliberately, to close a timing oracle. So an
+-- unknown name is the cheapest possible way to make the server do ~200ms of hashing.
+-- Without a ceiling, one client can saturate the box's CPU with a name generator.
+--
+-- 30/min is far above any real recovery attempt (a guest tries their PIN a handful of
+-- times) while capping a name-cycling flood. The per-(ip, name) bucket is unchanged and
+-- remains the anti-guessing control.
+INSERT INTO config (key, value) VALUES
+    ('recover_ip_rate_per_min', '30')
+ON CONFLICT (key) DO NOTHING;

backend/migrations/020_social_rate.down.sql

@@ -0,0 +1 @@
+DELETE FROM config WHERE key IN ('social_rate_per_min', 'social_rate_enabled');

backend/migrations/020_social_rate.up.sql

@@ -0,0 +1,16 @@
+-- Per-user rate limit for social writes (likes, comments, comment deletions).
+--
+-- These were the only writes in the app with no limit at all. Every other mutating
+-- path -- upload, join, recover, export, admin login -- carries one; social.rs
+-- carried none, so the coverage was asymmetric rather than deliberately open.
+--
+-- Severity is genuinely low for an invited-guest event, and the amplification worry
+-- turned out to be contained: a like fans an SSE broadcast to ~100 clients, but the
+-- export regeneration it could otherwise trigger is debounced (REGEN_DEBOUNCE 20s)
+-- and superseded workers are inert. So this closes the gap for symmetry, not urgency,
+-- and the ceiling is set high enough that no real guest will ever meet it -- a
+-- double-tapping enthusiast at a wedding is not the thing being defended against.
+INSERT INTO config (key, value) VALUES
+    ('social_rate_per_min',  '120'),
+    ('social_rate_enabled',  'true')
+ON CONFLICT (key) DO NOTHING;

backend/src/auth/handlers.rs

@@ -1,11 +1,12 @@
 use std::time::Duration;
 
 use axum::Json;
-use axum::extract::State;
+use axum::extract::{ConnectInfo, State};
 use axum::http::{HeaderMap, StatusCode};
 use chrono::Utc;
 use rand::Rng;
 use serde::{Deserialize, Serialize};
+use std::net::SocketAddr;
 use uuid::Uuid;
 
 use crate::auth::jwt;
@@ -33,22 +34,32 @@ pub struct JoinResponse {
 
 pub async fn join(
     State(state): State<AppState>,
+    ConnectInfo(peer): ConnectInfo<SocketAddr>,
     headers: HeaderMap,
     Json(body): Json<JoinRequest>,
 ) -> Result<(StatusCode, Json<JoinResponse>), AppError> {
-    let ip = client_ip(&headers, "unknown");
+    let ip = client_ip(&headers, &peer.ip().to_string());
     let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
     let join_rate_on = config::get_bool(&state.config_cache, "join_rate_enabled", true).await;
-    if rate_limits_on
-        && join_rate_on
-        && !state
-            .rate_limiter
-            .check(format!("join:{ip}"), 5, Duration::from_secs(60))
-    {
-        return Err(AppError::TooManyRequests(
-            "Zu viele Anfragen. Bitte warte kurz und versuche es erneut.".into(),
-            None,
-        ));
+
+    // Coarse per-IP flood ceiling. `/join` is pre-auth so there is no user to key on, and
+    // at a venue EVERY guest arrives from one public IP — a tight per-IP bucket meant the
+    // 6th person through the door was turned away by the 5 ahead of them. So the per-IP
+    // limit here only bounds raw volume; the real anti-spam bucket is per-name below.
+    // Cheap enough to run before validation, which keeps a flood of malformed bodies from
+    // being free.
+    if rate_limits_on && join_rate_on {
+        let ip_ceiling = config::get_usize(&state.config_cache, "join_ip_rate_per_min", 60).await;
+        if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
+            format!("join_ip:{ip}"),
+            ip_ceiling,
+            Duration::from_secs(60),
+        ) {
+            return Err(AppError::TooManyRequests(
+                "Zu viele Anfragen. Bitte warte kurz und versuche es erneut.".into(),
+                Some(retry_after_secs),
+            ));
+        }
     }
 
     let display_name = body.display_name.trim();
@@ -66,6 +77,23 @@ pub async fn join(
         ));
     }
 
+    // Per-guest bucket, keyed like the `recover:{ip}:{name}` limiter below. This carries
+    // the original 5/60s anti-spam intent, but one guest retrying can no longer consume
+    // the allowance of everyone else sharing the venue's NAT.
+    if rate_limits_on && join_rate_on {
+        let name_key = display_name.to_lowercase();
+        if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
+            format!("join:{ip}:{name_key}"),
+            5,
+            Duration::from_secs(60),
+        ) {
+            return Err(AppError::TooManyRequests(
+                "Zu viele Anfragen. Bitte warte kurz und versuche es erneut.".into(),
+                Some(retry_after_secs),
+            ));
+        }
+    }
+
     let event = Event::find_or_create(
         &state.pool,
         &state.config.event_slug,
@@ -83,7 +111,7 @@ pub async fn join(
 
     // Generate a 4-digit PIN
     let pin: String = format!("{:04}", rand::rng().random_range(0..10000u32));
-    let pin_hash = bcrypt::hash(&pin, 12).map_err(|e| AppError::Internal(anyhow::anyhow!(e)))?;
+    let pin_hash = hash_password(pin.clone(), 12).await?;
 
     // The pre-check above is racy: two simultaneous joins with the same name can both
     // pass it, and the DB's unique index then rejects the loser. Map that unique
@@ -147,8 +175,31 @@ fn dummy_pin_hash() -> &'static str {
     })
 }
 
+/// Run a bcrypt verify on the blocking pool.
+///
+/// bcrypt at cost 12 is ~200ms of deliberate CPU. Called inline on an async task it pins a
+/// tokio WORKER thread for that whole time, and the runtime only has one per core — so a
+/// flood of `/recover` or `/admin/login` attempts stalls every other request on the box,
+/// including the feed. Offloading moves that cost to the blocking pool, which is sized for
+/// exactly this and whose saturation degrades logins rather than the whole app.
+async fn verify_password(candidate: String, hash: String) -> bool {
+    tokio::task::spawn_blocking(move || bcrypt::verify(&candidate, &hash).unwrap_or(false))
+        .await
+        .unwrap_or(false)
+}
+
+/// Hash a secret on the blocking pool. Same reasoning as [`verify_password`] — and this one
+/// runs on the busiest auth path there is, since every guest who joins gets a PIN hashed.
+pub async fn hash_password(secret: String, cost: u32) -> Result<String, AppError> {
+    tokio::task::spawn_blocking(move || bcrypt::hash(&secret, cost))
+        .await
+        .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))?
+        .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))
+}
+
 pub async fn recover(
     State(state): State<AppState>,
+    ConnectInfo(peer): ConnectInfo<SocketAddr>,
     headers: HeaderMap,
     Json(body): Json<RecoverRequest>,
 ) -> Result<Json<RecoverResponse>, AppError> {
@@ -159,19 +210,39 @@ pub async fn recover(
     // burn through 3 wrong PINs and lock the victim for 15 minutes — repeated
     // every 15 minutes, indefinitely. 5 attempts per 15 minutes per (IP, name)
     // softens that into a real cost.
-    let ip = client_ip(&headers, "unknown");
+    let ip = client_ip(&headers, &peer.ip().to_string());
     let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
     let recover_rate_on = config::get_bool(&state.config_cache, "recover_rate_enabled", true).await;
     if rate_limits_on && recover_rate_on {
+        // Coarse per-IP ceiling FIRST. The per-(ip, name) bucket below is the anti-guessing
+        // control, but the name is attacker-chosen, so cycling names mints a fresh bucket
+        // every time and leaves the per-IP cost unbounded. That matters more here than
+        // anywhere else: every call runs a cost-12 bcrypt verify, including an
+        // unconditional throwaway one for names that don't exist (see below), so an unknown
+        // name is the CHEAPEST way to make the server do ~200ms of hashing. Checked before
+        // the per-name bucket so a name generator can't walk past it.
+        let ip_ceiling =
+            config::get_usize(&state.config_cache, "recover_ip_rate_per_min", 30).await;
+        if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
+            format!("recover_ip:{ip}"),
+            ip_ceiling,
+            Duration::from_secs(60),
+        ) {
+            return Err(AppError::TooManyRequests(
+                "Zu viele Versuche. Bitte warte kurz und versuche es erneut.".into(),
+                Some(retry_after_secs),
+            ));
+        }
+
         let name_key = display_name.to_lowercase();
-        if !state.rate_limiter.check(
+        if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
             format!("recover:{ip}:{name_key}"),
             5,
             Duration::from_secs(15 * 60),
         ) {
             return Err(AppError::TooManyRequests(
                 "Zu viele Versuche. Bitte warte kurz und versuche es erneut.".into(),
-                None,
+                Some(retry_after_secs),
             ));
         }
     }
@@ -188,7 +259,7 @@ pub async fn recover(
         // PIN — so "no such name" and "wrong PIN" are indistinguishable by response or
         // timing. Display names are already public on the feed, but this still closes
         // the /recover enumeration + timing oracle.
-        let _ = bcrypt::verify(&body.pin, dummy_pin_hash());
+        let _ = verify_password(body.pin.clone(), dummy_pin_hash().to_string()).await;
         return Err(AppError::Unauthorized("PIN ist falsch.".into()));
     }
 
@@ -200,16 +271,19 @@ pub async fn recover(
         // is effectively permanently fragile.
         if let Some(locked_until) = user.pin_locked_until {
             if Utc::now() < locked_until {
+                // The exact deadline is known, so surface it as Retry-After instead of
+                // making the client guess at the "15 Minuten" in the copy.
+                let retry_after_secs = (locked_until - Utc::now()).num_seconds().max(1) as u64;
                 return Err(AppError::TooManyRequests(
                     "Zu viele Versuche. Bitte warte 15 Minuten.".into(),
-                    None,
+                    Some(retry_after_secs),
                 ));
             }
             // Lockout window expired — wipe the counter and the timestamp.
             User::reset_pin_attempts(&state.pool, user.id).await?;
         }
 
-        let pin_matches = bcrypt::verify(&body.pin, &user.recovery_pin_hash).unwrap_or(false);
+        let pin_matches = verify_password(body.pin.clone(), user.recovery_pin_hash.clone()).await;
 
         if pin_matches {
             // Reset failed attempts on success
@@ -274,6 +348,7 @@ pub struct AdminLoginResponse {
 
 pub async fn admin_login(
     State(state): State<AppState>,
+    ConnectInfo(peer): ConnectInfo<SocketAddr>,
     headers: HeaderMap,
     Json(body): Json<AdminLoginRequest>,
 ) -> Result<Json<AdminLoginResponse>, AppError> {
@@ -287,23 +362,31 @@ pub async fn admin_login(
     // verify) but with no IP-level limit a determined attacker can still mount
     // a long-running guess campaign. 5 attempts / minute / IP is plenty for
     // honest typos.
-    let ip = client_ip(&headers, "unknown");
+    let ip = client_ip(&headers, &peer.ip().to_string());
     let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
     let admin_rate_on =
         config::get_bool(&state.config_cache, "admin_login_rate_enabled", true).await;
+    // Stays keyed by IP on purpose: this guards a single shared credential, so a per-user
+    // or per-name key would just hand an attacker a fresh bucket per guess.
     if rate_limits_on
         && admin_rate_on
-        && !state
-            .rate_limiter
-            .check(format!("admin_login:{ip}"), 5, Duration::from_secs(60))
+        && let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
+            format!("admin_login:{ip}"),
+            5,
+            Duration::from_secs(60),
+        )
     {
         return Err(AppError::TooManyRequests(
             "Zu viele Anmeldeversuche. Bitte warte kurz und versuche es erneut.".into(),
-            None,
+            Some(retry_after_secs),
         ));
     }
 
-    let valid = bcrypt::verify(&body.password, &state.config.admin_password_hash).unwrap_or(false);
+    let valid = verify_password(
+        body.password.clone(),
+        state.config.admin_password_hash.clone(),
+    )
+    .await;
 
     if !valid {
         tracing::warn!(ip = %ip, "admin_login: wrong password");
@@ -329,8 +412,7 @@ pub async fn admin_login(
         let dummy_pin: String = (0..32)
             .map(|_| rand::rng().random_range(b'a'..=b'z') as char)
             .collect();
-        let dummy_hash =
-            bcrypt::hash(&dummy_pin, 4).map_err(|e| AppError::Internal(anyhow::anyhow!(e)))?;
+        let dummy_hash = hash_password(dummy_pin.clone(), 4).await?;
         let user = User::create(&state.pool, event.id, admin_name, &dummy_hash).await?;
         sqlx::query("UPDATE \"user\" SET role = 'admin' WHERE id = $1")
             .bind(user.id)
@@ -390,22 +472,23 @@ pub struct PinResetRequestBody {
 /// feed already exposes.
 pub async fn request_pin_reset(
     State(state): State<AppState>,
+    ConnectInfo(peer): ConnectInfo<SocketAddr>,
     headers: HeaderMap,
     Json(body): Json<PinResetRequestBody>,
 ) -> Result<StatusCode, AppError> {
     let display_name = body.display_name.trim();
-    let ip = client_ip(&headers, "unknown");
+    let ip = client_ip(&headers, &peer.ip().to_string());
     let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
     if rate_limits_on {
         let name_key = display_name.to_lowercase();
-        if !state.rate_limiter.check(
+        if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
             format!("pin_reset_req:{ip}:{name_key}"),
             3,
             Duration::from_secs(15 * 60),
         ) {
             return Err(AppError::TooManyRequests(
                 "Zu viele Anfragen. Bitte warte kurz und versuche es erneut.".into(),
-                None,
+                Some(retry_after_secs),
             ));
         }
     }

backend/src/config.rs

@@ -63,8 +63,25 @@ pub struct AppConfig {
     pub app_port: u16,
     /// Number of concurrent media compression workers (read once at boot).
     pub compression_concurrency: usize,
+    /// Master switch for the comment feature (env `COMMENTS_ENABLED`, default true).
+    /// When false the backend rejects new comments and the frontend hides the whole
+    /// comment UI. Existing comments stay in the DB (hidden), so flipping it back
+    /// restores them. Boot-time immutable, like `compression_concurrency`.
+    pub comments_enabled: bool,
+    /// Default colour theme, used as the fallback when the DB config keys are unset.
+    /// Runtime overrides live in the `config` table (admin UI); these env vars only
+    /// seed the initial default. `preset` is an id the frontend knows (e.g.
+    /// "champagne-gold", "rose", … or "custom"); the two seeds are `#rrggbb` brand +
+    /// accent colours the whole palette is derived from.
+    pub default_theme_preset: String,
+    pub default_theme_primary: String,
+    pub default_theme_accent: String,
 }
 
+/// The shipped default brand/accent seed (champagne gold — matches the hand-tuned
+/// ramp in tailwind-theme.css). Kept here so an unset env still yields the current look.
+const DEFAULT_THEME_SEED: &str = "#8a6a2b";
+
 impl AppConfig {
     pub fn from_env() -> Result<Self> {
         let app_env = std::env::var("APP_ENV").unwrap_or_else(|_| "development".to_string());
@@ -100,6 +117,20 @@ impl AppConfig {
                 .and_then(|v| v.parse().ok())
                 .filter(|&n| n >= 1)
                 .unwrap_or(2),
+            comments_enabled: std::env::var("COMMENTS_ENABLED")
+                .map(|v| {
+                    !matches!(
+                        v.trim().to_ascii_lowercase().as_str(),
+                        "false" | "0" | "no" | "off"
+                    )
+                })
+                .unwrap_or(true),
+            default_theme_preset: std::env::var("THEME_PRESET")
+                .unwrap_or_else(|_| "champagne-gold".to_string()),
+            default_theme_primary: std::env::var("THEME_PRIMARY")
+                .unwrap_or_else(|_| DEFAULT_THEME_SEED.to_string()),
+            default_theme_accent: std::env::var("THEME_ACCENT")
+                .unwrap_or_else(|_| DEFAULT_THEME_SEED.to_string()),
         })
     }
 }

backend/src/handlers/admin.rs

@@ -3,13 +3,13 @@ use std::time::Duration;
 
 use axum::Json;
 use axum::extract::{Query, State};
-use axum::http::{HeaderMap, StatusCode};
+use axum::http::StatusCode;
 use serde::{Deserialize, Serialize};
+use uuid::Uuid;
 
 use crate::auth::middleware::RequireAdmin;
 use crate::error::AppError;
 use crate::services::config;
-use crate::services::rate_limiter::client_ip;
 use crate::state::AppState;
 
 // ── DTOs ─────────────────────────────────────────────────────────────────────
@@ -120,6 +120,16 @@ pub async fn patch_config(
         ("upload_rate_per_hour", true, 1.0, 100_000.0),
         ("feed_rate_per_min", true, 1.0, 100_000.0),
         ("export_rate_per_day", true, 1.0, 100_000.0),
+        // Loose per-IP ceiling on /join. The real anti-spam bucket is per (ip, name); this
+        // only bounds raw volume from one source, so it must stay well above the size of a
+        // party arriving at once (see migration 017).
+        ("join_ip_rate_per_min", true, 1.0, 100_000.0),
+        // Same shape for /recover: the per-(ip, name) bucket is the anti-guessing control,
+        // this only bounds a name-cycling flood in front of a cost-12 bcrypt (migration 019).
+        ("recover_ip_rate_per_min", true, 1.0, 100_000.0),
+        // Aggregate ceiling on likes + comments + comment deletions, per user per minute.
+        // These were the only mutating endpoints with no limit at all (migration 020).
+        ("social_rate_per_min", true, 1.0, 100_000.0),
         ("quota_tolerance", false, 0.0, 1.0),
         ("estimated_guest_count", true, 1.0, 1_000_000.0),
     ];
@@ -134,14 +144,32 @@ pub async fn patch_config(
         // missing from this allowlist — so the switch existed in code and could never be flipped.
         "admin_login_rate_enabled",
         "recover_rate_enabled",
+        "social_rate_enabled",
         "quota_enabled",
         "storage_quota_enabled",
         "upload_count_quota_enabled",
     ];
-    const TEXT_KEYS: &[&str] = &["privacy_note"];
+    const TEXT_KEYS: &[&str] = &[
+        "privacy_note",
+        "theme_preset",
+        "theme_primary",
+        "theme_accent",
+    ];
     const PRIVACY_NOTE_MAX_LEN: usize = 16 * 1024; // 16 KiB free text is plenty
+    // Preset ids the frontend knows how to render (mirror of PRESETS in
+    // frontend/src/lib/theme/palette.ts). "custom" means "use the theme_primary/accent
+    // seeds verbatim". Kept in sync by hand — a new preset must be added in both places.
+    const THEME_PRESETS: &[&str] = &[
+        "champagne-gold",
+        "rose",
+        "sage",
+        "dusk-blue",
+        "classic-silver",
+        "custom",
+    ];
 
     let mut privacy_note_changed = false;
+    let mut theme_changed = false;
 
     // Validate every key first so a bad value in the batch can't leave a partial
     // update behind — validation must fully precede any write.
@@ -186,8 +214,23 @@ pub async fn patch_config(
                     "Wert für {key} ist zu lang (max. {PRIVACY_NOTE_MAX_LEN} Zeichen)."
                 )));
             }
-            if key_str == "privacy_note" {
-                privacy_note_changed = true;
+            match key_str {
+                "privacy_note" => privacy_note_changed = true,
+                "theme_preset" => {
+                    if !THEME_PRESETS.contains(&value.trim()) {
+                        return Err(AppError::BadRequest(format!("Ungültiges Theme: {value}.")));
+                    }
+                    theme_changed = true;
+                }
+                "theme_primary" | "theme_accent" => {
+                    if !is_hex_color(value.trim()) {
+                        return Err(AppError::BadRequest(format!(
+                            "Ungültige Farbe für {key}: muss #rrggbb sein."
+                        )));
+                    }
+                    theme_changed = true;
+                }
+                _ => {}
             }
         } else {
             return Err(AppError::BadRequest(format!(
@@ -217,16 +260,30 @@ pub async fn patch_config(
 
     // Notify all clients that a publicly-readable config value changed so their stores
     // (e.g. the privacy note in My Account) refresh without a manual reload.
-    if privacy_note_changed {
+    if privacy_note_changed || theme_changed {
+        let mut keys: Vec<&str> = Vec::new();
+        if privacy_note_changed {
+            keys.push("privacy_note");
+        }
+        if theme_changed {
+            keys.push("theme");
+        }
         let _ = state.sse_tx.send(crate::state::SseEvent::new(
             "event-updated",
-            serde_json::json!({ "keys": ["privacy_note"] }).to_string(),
+            serde_json::json!({ "keys": keys }).to_string(),
         ));
     }
 
     Ok(StatusCode::NO_CONTENT)
 }
 
+/// A strict `#rrggbb` hex-colour check (6 hex digits, leading `#`). Deliberately not
+/// accepting shorthand/`#rgba` so the value is safe to drop straight into CSS.
+fn is_hex_color(s: &str) -> bool {
+    let bytes = s.as_bytes();
+    bytes.len() == 7 && bytes[0] == b'#' && bytes[1..].iter().all(|b| b.is_ascii_hexdigit())
+}
+
 pub async fn get_export_jobs(
     State(state): State<AppState>,
     RequireAdmin(_auth): RequireAdmin,
@@ -274,25 +331,26 @@ pub async fn export_ticket(
 }
 
 /// Validate a download ticket (single-use) and confirm its session still exists.
-async fn authenticate_download_ticket(state: &AppState, ticket: &str) -> Result<(), AppError> {
+/// Resolve a single-use download ticket to the user who minted it. The caller needs the
+/// id to key the export rate limit per-user (see `enforce_export_rate`).
+async fn authenticate_download_ticket(state: &AppState, ticket: &str) -> Result<Uuid, AppError> {
     let token_hash = state
         .sse_tickets
         .consume(ticket)
         .ok_or_else(|| AppError::Unauthorized("Ticket ungültig oder abgelaufen.".into()))?;
-    crate::models::session::Session::find_by_token_hash(&state.pool, &token_hash)
+    let session = crate::models::session::Session::find_by_token_hash(&state.pool, &token_hash)
         .await
         .map_err(|e| AppError::Internal(e.into()))?
         .ok_or_else(|| AppError::Unauthorized("Sitzung nicht gefunden.".into()))?;
-    Ok(())
+    Ok(session.user_id)
 }
 
 pub async fn download_zip(
     State(state): State<AppState>,
     Query(q): Query<DownloadQuery>,
-    headers: HeaderMap,
 ) -> Result<axum::response::Response, AppError> {
-    authenticate_download_ticket(&state, &q.ticket).await?;
-    enforce_export_rate(&state, &headers).await?;
+    let user_id = authenticate_download_ticket(&state, &q.ticket).await?;
+    enforce_export_rate(&state, user_id).await?;
 
     let path =
         resolve_export_file(&state, "zip", "Der ZIP-Export ist noch nicht verfügbar.").await?;
@@ -343,10 +401,9 @@ async fn resolve_export_file(
 pub async fn download_html(
     State(state): State<AppState>,
     Query(q): Query<DownloadQuery>,
-    headers: HeaderMap,
 ) -> Result<axum::response::Response, AppError> {
-    authenticate_download_ticket(&state, &q.ticket).await?;
-    enforce_export_rate(&state, &headers).await?;
+    let user_id = authenticate_download_ticket(&state, &q.ticket).await?;
+    enforce_export_rate(&state, user_id).await?;
 
     let path =
         resolve_export_file(&state, "html", "Der HTML-Export ist noch nicht verfügbar.").await?;
@@ -403,8 +460,13 @@ pub async fn export_status(
     // worker superseded mid-run) is meaningless — surfacing its frozen `running`/77% would show a
     // progress bar that never moves for a keepsake nobody is building. It reads as "locked" (no
     // current job), which is exactly what it is.
-    let jobs: Vec<(String, String, i16)> = sqlx::query_as(
-        "SELECT j.type::text, j.status::text, j.progress_pct
+    // `error_message` is carried here, not just on the admin dashboard's job list. The host is the
+    // one who releases the keepsake and the one who owns the "Erneut versuchen" button, but this
+    // endpoint used to hand them a bare `failed` — so a fully actionable reason (notably the disk
+    // preflight's "needs X GB, Y GB free") was written to the row and then shown to nobody who
+    // could act on it. An admin-only diagnostic is not a diagnostic for the person on the spot.
+    let jobs: Vec<(String, String, i16, Option<String>)> = sqlx::query_as(
+        "SELECT j.type::text, j.status::text, j.progress_pct, j.error_message
            FROM export_job j
            JOIN event e ON e.id = j.event_id
           WHERE e.id = $1 AND j.epoch = e.export_epoch",
@@ -415,9 +477,21 @@ pub async fn export_status(
 
     let job_status = |type_name: &str| {
         jobs.iter()
-            .find(|(t, _, _)| t == type_name)
-            .map(|(_, status, pct)| serde_json::json!({ "status": status, "progress_pct": pct }))
-            .unwrap_or_else(|| serde_json::json!({ "status": "locked", "progress_pct": 0 }))
+            .find(|(t, _, _, _)| t == type_name)
+            .map(|(_, status, pct, err)| {
+                serde_json::json!({
+                    "status": status,
+                    "progress_pct": pct,
+                    // Only on a failure. A stale message left on a row that has since been re-armed
+                    // would otherwise show an error next to a running progress bar.
+                    "error_message": if status == "failed" { err.clone() } else { None },
+                })
+            })
+            .unwrap_or_else(|| {
+                serde_json::json!({
+                    "status": "locked", "progress_pct": 0, "error_message": null,
+                })
+            })
     };
 
     Ok(Json(serde_json::json!({
@@ -430,21 +504,24 @@ pub async fn export_status(
 /// Centralised guard for the export rate limit. Same pattern as upload/feed: master
 /// switch + per-endpoint switch + numeric value, all stored in `config` and read on
 /// each request.
-async fn enforce_export_rate(state: &AppState, headers: &HeaderMap) -> Result<(), AppError> {
+async fn enforce_export_rate(state: &AppState, user_id: Uuid) -> Result<(), AppError> {
     let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
     let export_rate_on = config::get_bool(&state.config_cache, "export_rate_enabled", true).await;
     if !(rate_limits_on && export_rate_on) {
         return Ok(());
     }
-    let ip = client_ip(headers, "unknown");
     let limit = config::get_usize(&state.config_cache, "export_rate_per_day", 3).await;
-    if !state
-        .rate_limiter
-        .check(format!("export:{ip}"), limit, Duration::from_secs(86400))
-    {
+    // Keyed per-user. This was the worst of the IP-keyed limiters: 3 downloads per DAY
+    // shared across every guest behind the venue's public IP, so the fourth person to
+    // fetch their keepsake was locked out until the next day.
+    if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
+        format!("export:{user_id}"),
+        limit,
+        Duration::from_secs(86400),
+    ) {
         return Err(AppError::TooManyRequests(
             "Zu viele Anfragen. Bitte warte kurz und versuche es erneut.".into(),
-            None,
+            Some(retry_after_secs),
         ));
     }
     Ok(())

backend/src/handlers/feed.rs

@@ -2,7 +2,6 @@ use std::time::Duration;
 
 use axum::Json;
 use axum::extract::{Query, State};
-use axum::http::HeaderMap;
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use uuid::Uuid;
@@ -10,7 +9,6 @@ use uuid::Uuid;
 use crate::auth::middleware::AuthUser;
 use crate::error::AppError;
 use crate::services::config;
-use crate::services::rate_limiter::client_ip;
 use crate::state::AppState;
 
 #[derive(Deserialize)]
@@ -27,6 +25,8 @@ pub struct FeedUpload {
     pub uploader_name: String,
     pub preview_url: Option<String>,
     pub thumbnail_url: Option<String>,
+    /// Big-screen (~2048px) variant for the diashow. Absent until the derivative exists.
+    pub display_url: Option<String>,
     pub mime_type: String,
     pub caption: Option<String>,
     pub like_count: i64,
@@ -48,6 +48,7 @@ struct FeedRow {
     uploader_name: String,
     preview_path: Option<String>,
     thumbnail_path: Option<String>,
+    display_path: Option<String>,
     mime_type: String,
     caption: Option<String>,
     like_count: i64,
@@ -58,21 +59,23 @@ struct FeedRow {
 pub async fn feed(
     State(state): State<AppState>,
     auth: AuthUser,
-    headers: HeaderMap,
     Query(q): Query<FeedQuery>,
 ) -> Result<Json<FeedResponse>, AppError> {
-    let ip = client_ip(&headers, "unknown");
     let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
     let feed_rate_on = config::get_bool(&state.config_cache, "feed_rate_enabled", true).await;
     if rate_limits_on && feed_rate_on {
         let rate_limit = config::get_usize(&state.config_cache, "feed_rate_per_min", 60).await;
-        if !state
-            .rate_limiter
-            .check(format!("feed:{ip}"), rate_limit, Duration::from_secs(60))
-        {
+        // Keyed per-user, exactly like `feed_delta` below: at a venue every guest shares
+        // one public IP, so an IP key gave the whole party a single 60/min bucket and the
+        // fastest scroller starved everyone else.
+        if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
+            format!("feed:{}", auth.user_id),
+            rate_limit,
+            Duration::from_secs(60),
+        ) {
             return Err(AppError::TooManyRequests(
                 "Zu viele Anfragen. Bitte warte kurz und versuche es erneut.".into(),
-                None,
+                Some(retry_after_secs),
             ));
         }
     }
@@ -94,7 +97,8 @@ pub async fn feed(
         let tag = hashtag.trim().trim_start_matches('#').to_lowercase();
         sqlx::query_as::<_, FeedRow>(
             "SELECT v.id, v.user_id, v.uploader_name, v.preview_path, v.thumbnail_path,
-                    v.mime_type, v.caption, v.like_count, v.comment_count, v.created_at
+                    v.display_path, v.mime_type, v.caption, v.like_count, v.comment_count,
+                    v.created_at
              FROM v_feed v
              JOIN upload_hashtag uh ON uh.upload_id = v.id
              JOIN hashtag h ON h.id = uh.hashtag_id AND h.tag = $1
@@ -113,7 +117,7 @@ pub async fn feed(
     } else {
         sqlx::query_as::<_, FeedRow>(
             "SELECT id, user_id, uploader_name, preview_path, thumbnail_path,
-                    mime_type, caption, like_count, comment_count, created_at
+                    display_path, mime_type, caption, like_count, comment_count, created_at
              FROM v_feed
              WHERE event_id = $1
                AND ($2::timestamptz IS NULL OR (created_at, id) < ($2, $3))
@@ -154,6 +158,10 @@ pub async fn feed(
                 .thumbnail_path
                 .as_ref()
                 .map(|_| format!("/api/v1/upload/{}/thumbnail", r.id));
+            let display_url = r
+                .display_path
+                .as_ref()
+                .map(|_| format!("/api/v1/upload/{}/display", r.id));
             FeedUpload {
                 liked_by_me: liked_set.contains(&r.id),
                 id: r.id,
@@ -161,6 +169,7 @@ pub async fn feed(
                 uploader_name: r.uploader_name,
                 preview_url,
                 thumbnail_url,
+                display_url,
                 mime_type: r.mime_type,
                 caption: r.caption,
                 like_count: r.like_count,
@@ -216,14 +225,14 @@ pub async fn feed_delta(
     let feed_rate_on = config::get_bool(&state.config_cache, "feed_rate_enabled", true).await;
     if rate_limits_on && feed_rate_on {
         let rate_limit = config::get_usize(&state.config_cache, "feed_rate_per_min", 60).await;
-        if !state.rate_limiter.check(
+        if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
             format!("feed_delta:{}", auth.user_id),
             rate_limit,
             Duration::from_secs(60),
         ) {
             return Err(AppError::TooManyRequests(
                 "Zu viele Anfragen. Bitte warte kurz und versuche es erneut.".into(),
-                None,
+                Some(retry_after_secs),
             ));
         }
     }
@@ -247,7 +256,7 @@ pub async fn feed_delta(
     // response's `server_time`, so this doesn't re-fetch on every subsequent delta.
     let rows = sqlx::query_as::<_, FeedRow>(
         "SELECT id, user_id, uploader_name, preview_path, thumbnail_path,
-                mime_type, caption, like_count, comment_count, created_at
+                display_path, mime_type, caption, like_count, comment_count, created_at
          FROM v_feed
          WHERE event_id = $1 AND created_at >= $2
          ORDER BY created_at DESC, id DESC
@@ -304,6 +313,10 @@ pub async fn feed_delta(
                 .thumbnail_path
                 .as_ref()
                 .map(|_| format!("/api/v1/upload/{}/thumbnail", r.id)),
+            display_url: r
+                .display_path
+                .as_ref()
+                .map(|_| format!("/api/v1/upload/{}/display", r.id)),
             mime_type: r.mime_type,
             caption: r.caption,
             like_count: r.like_count,

backend/src/handlers/host.rs

@@ -35,6 +35,32 @@ pub struct EventStatus {
     pub is_active: bool,
     pub uploads_locked: bool,
     pub export_released: bool,
+    /// Free space on the volume the keepsake is written to. `None` when the mount can't be
+    /// resolved — the UI hides the widget rather than rendering a confident zero.
+    pub disk_free_bytes: Option<u64>,
+    /// What a full keepsake build would need right now (both halves).
+    pub keepsake_required_bytes: u64,
+    /// Whether the host should be warned. See [`disk_is_low`].
+    pub disk_low: bool,
+}
+
+/// Absolute floor below which free space is worth surfacing regardless of gallery size — the
+/// threshold the README has carried on the roadmap since v1.
+const LOW_DISK_FLOOR_BYTES: u64 = 10_000_000_000;
+
+/// Is free space low enough that the host needs to know?
+///
+/// Two triggers, because a fixed threshold answers the wrong question. `postgres_data`,
+/// `media_data` and `exports_data` are all Docker named volumes on one filesystem, so a full disk
+/// does not degrade one subsystem — it stops Postgres writing and takes the event down. That is
+/// what the absolute floor is for.
+///
+/// The second trigger is the one that actually earns its place: the keepsake needs room for two
+/// gallery-sized archives, and the only moment a host can do anything about that is BEFORE they
+/// release. Warning at "you could not build the keepsake right now" turns a post-event dead end
+/// into a decision someone can still make.
+fn disk_is_low(free: u64, keepsake_required: u64) -> bool {
+    free < LOW_DISK_FLOOR_BYTES || free < keepsake_required
 }
 
 /// Count non-banned hosts/admins in the event OTHER than `excluding` — the operators
@@ -72,11 +98,29 @@ pub async fn get_event_status(
         .await?
         .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
 
+    // Measured on the EXPORT volume, not the media one: that is where the cliff is, and it is a
+    // distinct mount point even when both are backed by the same filesystem. The cached reading is
+    // right here — this is advisory, polled on every dashboard load, and a 15s-stale number costs
+    // nothing (unlike the export preflight, which reads uncached because it is about to write).
+    let free = state
+        .disk_cache
+        .snapshot(&state.config.export_path)
+        .map(|d| d.free);
+    let keepsake_required_bytes =
+        crate::services::export::keepsake_space_required(&state.pool, event.id)
+            .await
+            .unwrap_or(0);
+
     Ok(Json(EventStatus {
         name: event.name,
         is_active: event.is_active,
         uploads_locked: event.uploads_locked_at.is_some(),
         export_released: event.export_released_at.is_some(),
+        disk_free_bytes: free,
+        keepsake_required_bytes,
+        // Unknown free space is NOT low. Fails open, exactly as the upload quota and the export
+        // preflight do: a scary banner on an unreadable mount would train the host to ignore it.
+        disk_low: free.is_some_and(|f| disk_is_low(f, keepsake_required_bytes)),
     }))
 }
 
@@ -302,6 +346,7 @@ pub async fn rebuild_export(
         r.event_id,
         r.event_name,
         r.epoch,
+        state.config.comments_enabled,
         std::time::Duration::ZERO,
         state.pool.clone(),
         state.config.media_path.clone(),
@@ -432,7 +477,7 @@ pub async fn reset_user_pin(
     }
 
     let pin: String = format!("{:04}", rand::rng().random_range(0..10000u32));
-    let pin_hash = bcrypt::hash(&pin, 12).map_err(|e| AppError::Internal(anyhow::anyhow!(e)))?;
+    let pin_hash = crate::auth::handlers::hash_password(pin.clone(), 12).await?;
 
     sqlx::query(
         "UPDATE \"user\"
@@ -549,6 +594,7 @@ pub fn start_regen(state: &AppState, regen: crate::services::export::PendingRege
         regen.event_id,
         regen.event_name,
         regen.epoch,
+        state.config.comments_enabled,
         // Debounced: a takedown pass is a burst, and each request retires the last generation. The
         // delay lets superseded workers fail their claim and do zero work instead of each building
         // a full archive. See export::REGEN_DEBOUNCE.
@@ -753,6 +799,7 @@ pub async fn release_gallery(
         event_id,
         event_name,
         epoch,
+        state.config.comments_enabled,
         std::time::Duration::ZERO,
         state.pool.clone(),
         state.config.media_path.clone(),
@@ -762,3 +809,45 @@ pub async fn release_gallery(
 
     Ok(StatusCode::NO_CONTENT)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{LOW_DISK_FLOOR_BYTES, disk_is_low};
+
+    const GB: u64 = 1_000_000_000;
+
+    #[test]
+    fn a_healthy_disk_with_room_for_the_keepsake_is_not_low() {
+        assert!(!disk_is_low(40 * GB, 25 * GB));
+    }
+
+    #[test]
+    fn the_absolute_floor_fires_even_when_the_gallery_is_tiny() {
+        // All three volumes share one filesystem, so running out doesn't degrade one subsystem —
+        // Postgres stops being able to write and the event goes down. A 1 GB gallery would clear
+        // the keepsake test comfortably; the floor is what catches this.
+        assert!(disk_is_low(5 * GB, GB));
+        assert!(disk_is_low(LOW_DISK_FLOOR_BYTES - 1, 0));
+        assert!(!disk_is_low(LOW_DISK_FLOOR_BYTES, 0));
+    }
+
+    #[test]
+    fn plenty_of_space_is_still_low_when_the_keepsake_would_not_fit() {
+        // THE case the fixed threshold misses, and the one that matters: 30 GB free is nowhere near
+        // any floor, but a 30 GB gallery needs room for TWO archives. The host can act on this
+        // before releasing; after releasing, they cannot.
+        assert!(disk_is_low(30 * GB, 66 * GB));
+    }
+
+    #[test]
+    fn the_keepsake_trigger_is_exact_at_the_boundary() {
+        assert!(!disk_is_low(66 * GB, 66 * GB), "exactly enough is enough");
+        assert!(disk_is_low(66 * GB - 1, 66 * GB));
+    }
+
+    #[test]
+    fn an_empty_gallery_needs_nothing_and_only_the_floor_applies() {
+        assert!(!disk_is_low(11 * GB, 0));
+        assert!(disk_is_low(9 * GB, 0));
+    }
+}

backend/src/handlers/me.rs

@@ -14,7 +14,7 @@ use serde::Serialize;
 use crate::auth::middleware::AuthUser;
 use crate::error::AppError;
 use crate::handlers::upload::compute_storage_quota;
-use crate::models::user::User;
+use crate::models::user::{User, UserRole};
 use crate::services::config;
 use crate::state::AppState;
 
@@ -37,12 +37,26 @@ pub async fn get_quota(
 
     let estimate = compute_storage_quota(&state).await;
 
+    // Raw server telemetry (free disk, concurrent uploader count) is staff-only — it
+    // must never reach a guest, even though the guest upload UI no longer renders it.
+    // A guest still gets their own `used`/`limit` so enforcement stays transparent to
+    // the code paths that consume it; only the server-wide fields are zeroed.
+    let is_staff = matches!(auth.role, UserRole::Host | UserRole::Admin);
+
     Ok(Json(QuotaDto {
         enabled: estimate.limit_bytes.is_some(),
         used_bytes: user.total_upload_bytes,
         limit_bytes: estimate.limit_bytes,
-        active_uploaders: estimate.active_uploaders,
-        free_disk_bytes: estimate.free_disk_bytes,
+        active_uploaders: if is_staff {
+            estimate.active_uploaders
+        } else {
+            0
+        },
+        free_disk_bytes: if is_staff {
+            estimate.free_disk_bytes
+        } else {
+            0
+        },
     }))
 }
 

backend/src/handlers/public.rs

@@ -4,21 +4,41 @@ use axum::Json;
 use axum::extract::State;
 use serde::Serialize;
 
+use crate::services::config;
 use crate::state::AppState;
 
 #[derive(Serialize)]
 pub struct PublicEventDto {
     pub name: String,
     pub slug: String,
+    /// Whether the comment feature is on (env `COMMENTS_ENABLED`). The frontend hides
+    /// the whole comment UI when false; exposed here so even the pre-auth shell knows.
+    pub comments_enabled: bool,
+    /// Active colour theme. `preset` is an id the frontend maps to a palette (or
+    /// "custom"); `primary`/`accent` are the `#rrggbb` seeds the ramps derive from.
+    /// Resolved as DB-config override → env default. Public so the theme applies on
+    /// the very first (pre-auth) paint without a flash.
+    pub theme_preset: String,
+    pub theme_primary: String,
+    pub theme_accent: String,
 }
 
-/// Public event identity, used by the pre-auth join/recover screens so a guest can
-/// see *which* event they're joining. Only the display name and slug are exposed —
-/// nothing user-scoped — so this is safe without a token. Served straight from the
-/// instance config (no DB round-trip needed).
+/// Public event identity + presentation config, used by the pre-auth join/recover
+/// screens (which event am I joining, what does it look like). Only non-user-scoped
+/// fields are exposed, so this is safe without a token. Identity comes straight from
+/// instance config; the theme is resolved from the runtime `config` table (admin UI)
+/// falling back to the env-seeded default.
 pub async fn get_public_event(State(state): State<AppState>) -> Json<PublicEventDto> {
+    let cache = &state.config_cache;
     Json(PublicEventDto {
         name: state.config.event_name.clone(),
         slug: state.config.event_slug.clone(),
+        comments_enabled: state.config.comments_enabled,
+        theme_preset: config::get_str(cache, "theme_preset", &state.config.default_theme_preset)
+            .await,
+        theme_primary: config::get_str(cache, "theme_primary", &state.config.default_theme_primary)
+            .await,
+        theme_accent: config::get_str(cache, "theme_accent", &state.config.default_theme_accent)
+            .await,
     })
 }

backend/src/handlers/social.rs

@@ -10,8 +10,40 @@ use crate::error::AppError;
 use crate::models::comment::{Comment, CommentDto};
 use crate::models::hashtag::{self, Hashtag};
 use crate::models::upload::Upload;
+use crate::services::config;
 use crate::state::AppState;
 
+/// Throttle a social write. Keyed PER USER, like the feed and upload limits and for the same
+/// reason: at a venue every guest sits behind one NAT, so an IP key hands the whole party a
+/// single bucket and the most active guest starves everyone else.
+///
+/// These were the only mutating endpoints in the app with no limit at all — the coverage was
+/// asymmetric, not deliberately open. The ceiling is set well above anything a real guest
+/// produces; this bounds a script, not an enthusiastic double-tapper.
+async fn check_social_rate(state: &AppState, user_id: Uuid) -> Result<(), AppError> {
+    let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
+    let social_rate_on = config::get_bool(&state.config_cache, "social_rate_enabled", true).await;
+    if !(rate_limits_on && social_rate_on) {
+        return Ok(());
+    }
+    let rate_limit = config::get_usize(&state.config_cache, "social_rate_per_min", 120).await;
+    // ONE bucket across likes, comments and comment deletions. Separate buckets would let a
+    // caller triple the aggregate write rate just by alternating between them.
+    state
+        .rate_limiter
+        .check_with_retry(
+            format!("social:{user_id}"),
+            rate_limit,
+            std::time::Duration::from_secs(60),
+        )
+        .map_err(|retry_after_secs| {
+            AppError::TooManyRequests(
+                "Zu viele Aktionen. Bitte warte kurz und versuche es erneut.".into(),
+                Some(retry_after_secs),
+            )
+        })
+}
+
 #[derive(Serialize)]
 pub struct LikeResponse {
     /// The caller's like state *after* this toggle. The client sets `liked_by_me` from
@@ -35,6 +67,7 @@ pub async fn toggle_like(
     if user.is_banned {
         return Err(AppError::Forbidden("Du bist gesperrt.".into()));
     }
+    check_social_rate(&state, auth.user_id).await?;
 
     // Event-scope: the upload must belong to the caller's event (404 otherwise),
     // matching the host handlers' find_by_id_and_event pattern.
@@ -129,12 +162,19 @@ pub async fn add_comment(
     Path(upload_id): Path<Uuid>,
     Json(body): Json<AddCommentRequest>,
 ) -> Result<(StatusCode, Json<CommentDto>), AppError> {
+    // Comments can be disabled instance-wide (env COMMENTS_ENABLED). The frontend hides
+    // the UI, but gate the API too so a stale client or direct call can't slip one in.
+    if !state.config.comments_enabled {
+        return Err(AppError::Forbidden("Kommentare sind deaktiviert.".into()));
+    }
+
     let user = crate::models::user::User::find_by_id(&state.pool, auth.user_id)
         .await?
         .ok_or_else(|| AppError::NotFound("Benutzer nicht gefunden.".into()))?;
     if user.is_banned {
         return Err(AppError::Forbidden("Du bist gesperrt.".into()));
     }
+    check_social_rate(&state, auth.user_id).await?;
 
     // Event-scope: only comment on an upload that belongs to the caller's event.
     Upload::find_by_id_and_event(&state.pool, upload_id, auth.event_id)
@@ -210,6 +250,7 @@ pub async fn delete_comment(
     if auth.is_banned {
         return Err(AppError::Forbidden("Du bist gesperrt.".into()));
     }
+    check_social_rate(&state, auth.user_id).await?;
     let comment = Comment::find_by_id(&state.pool, comment_id)
         .await?
         .ok_or_else(|| AppError::NotFound("Kommentar nicht gefunden.".into()))?;

backend/src/handlers/test_admin.rs

@@ -13,9 +13,10 @@ use crate::auth::middleware::RequireAdmin;
 use crate::error::AppError;
 use crate::state::AppState;
 
-/// Truncates every event-scoped table, wipes media on disk, and reseeds the
-/// `config` table from migration defaults. Requires an admin JWT — even with
-/// `EVENTSNAP_TEST_MODE=1` it cannot be hit anonymously.
+/// Truncates every event-scoped table, wipes media on disk, and reseeds the `config`
+/// table: numeric values from the migration defaults, but every feature toggle forced
+/// OFF (production seeds them ON — see the note at the reseed below). Requires an admin
+/// JWT — even with `EVENTSNAP_TEST_MODE=1` it cannot be hit anonymously.
 pub async fn truncate_all(
     State(state): State<AppState>,
     RequireAdmin(_auth): RequireAdmin,
@@ -40,15 +41,29 @@ pub async fn truncate_all(
     .execute(&state.pool)
     .await?;
 
-    // Reseed config — mirrors migrations 005 and 009. Kept in sync by hand
-    // because pulling SQL out of the migration files at runtime is fragile.
+    // Reseed config. The NUMERIC values mirror migrations 005/015/016/017/019; the BOOLEAN
+    // toggles deliberately do NOT — migration 009 seeds every one of them `true`
+    // (production), and this forces them `false` so the suite isn't fighting rate limits
+    // and quotas it isn't testing.
+    //
+    // Be aware of what that costs: this runs as an auto-fixture before EVERY test, so no
+    // test starts from production's config unless it explicitly turns a toggle back on
+    // (02-upload/rate-limit, 07-adversarial/ddos, 01-auth/rate-limit-nat, …). That blind
+    // spot is exactly why an entire class of per-IP limiter bugs went unnoticed: the
+    // limiters were simply off. When adding a limiter or quota, add a spec that enables it.
+    //
+    // Kept in sync by hand because pulling SQL out of the migration files at runtime is
+    // fragile — if you add a config key in a migration, add it here too.
     sqlx::query(
         r#"INSERT INTO config (key, value) VALUES
             ('max_image_size_mb',          '20'),
             ('max_video_size_mb',          '500'),
-            ('upload_rate_per_hour',       '10'),
+            ('upload_rate_per_hour',       '100'),
             ('feed_rate_per_min',          '60'),
             ('export_rate_per_day',        '3'),
+            ('join_ip_rate_per_min',       '60'),
+            ('recover_ip_rate_per_min',    '30'),
+            ('social_rate_per_min',        '120'),
             ('quota_tolerance',            '0.75'),
             ('estimated_guest_count',      '100'),
             ('compression_concurrency',    '2'),
@@ -57,6 +72,8 @@ pub async fn truncate_all(
             ('feed_rate_enabled',          'false'),
             ('export_rate_enabled',        'false'),
             ('join_rate_enabled',          'false'),
+            ('social_rate_enabled',        'false'),
+            ('admin_login_rate_enabled',   'false'),
             ('quota_enabled',              'false'),
             ('storage_quota_enabled',      'false'),
             ('upload_count_quota_enabled', 'false'),

backend/src/handlers/upload.rs

@@ -48,7 +48,7 @@ pub async fn upload(
     let upload_rate_on = config::get_bool(&state.config_cache, "upload_rate_enabled", true).await;
     if rate_limits_on && upload_rate_on {
         let upload_rate =
-            config::get_i64(&state.config_cache, "upload_rate_per_hour", 10).await as usize;
+            config::get_i64(&state.config_cache, "upload_rate_per_hour", 100).await as usize;
         if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
             format!("upload:{}", auth.user_id),
             upload_rate,
@@ -233,6 +233,26 @@ pub async fn upload(
         )));
     }
 
+    // Images only: refuse anything the compression worker could never decode, reading just
+    // the header. Without this the upload is accepted with a 201 and then silently
+    // soft-deleted minutes later when the worker gives up — the guest sees the photo
+    // vanish with, at best, a vague "could not be processed". Rejecting here gives them a
+    // reason at the door that they can act on, and it uses the SAME budget the worker
+    // enforces, so admission and processing cannot disagree.
+    if mime.starts_with("image/") && crate::services::imaging::exceeds_decode_budget(&temp_abs) {
+        let mp = crate::services::imaging::megapixels(&temp_abs);
+        tracing::info!(
+            %mime, megapixels = ?mp,
+            "rejecting an image that exceeds the decode budget at admission"
+        );
+        let _ = tokio::fs::remove_file(&temp_abs).await;
+        let detail = mp.map_or(String::new(), |mp| format!(" (ca. {mp:.0} Megapixel)"));
+        return Err(AppError::BadRequest(format!(
+            "Bild hat zu viele Bildpunkte{detail} und kann nicht verarbeitet werden. \
+             Bitte verkleinere es und lade es erneut hoch."
+        )));
+    }
+
     // Per-user storage quota — dynamic formula based on available disk space and the
     // number of active uploaders. Gated by master + per-area toggles so the admin can
     // disable it on trusted instances.
@@ -647,12 +667,95 @@ pub async fn compute_storage_quota(state: &AppState) -> QuotaEstimate {
     }
 }
 
+/// Outcome of parsing a `Range` request header against a known file length.
+#[derive(Debug, PartialEq, Eq)]
+enum RangeSpec {
+    /// No `Range` header, or one we deliberately don't honour (multi-range, non-`bytes`
+    /// unit, malformed). RFC 9110 lets a server ignore a Range it can't process and reply
+    /// 200 with the full body, which is what every one of these cases does.
+    Full,
+    /// A single satisfiable range, resolved to inclusive absolute offsets.
+    Partial { start: u64, end: u64 },
+    /// Syntactically valid but starts beyond EOF — must be answered 416, not 200, or a
+    /// player can loop re-requesting it.
+    Unsatisfiable,
+}
+
+/// Parse a single-range `bytes=` header against `len`.
+///
+/// Deliberately supports only the three forms a media element actually sends —
+/// `bytes=N-`, `bytes=N-M`, `bytes=-S` (suffix) — and treats everything else as `Full`.
+/// Multi-range responses need `multipart/byteranges`, which no `<video>` requires.
+fn parse_range(header: Option<&str>, len: u64) -> RangeSpec {
+    let Some(raw) = header else {
+        return RangeSpec::Full;
+    };
+    let Some(spec) = raw.trim().strip_prefix("bytes=") else {
+        return RangeSpec::Full;
+    };
+    // Multi-range → fall back to the whole body rather than lie about the content.
+    if spec.contains(',') {
+        return RangeSpec::Full;
+    }
+    let Some((from, to)) = spec.split_once('-') else {
+        return RangeSpec::Full;
+    };
+    let (from, to) = (from.trim(), to.trim());
+
+    // A zero-length file can satisfy no range at all.
+    if len == 0 {
+        return if from.is_empty() && to.is_empty() {
+            RangeSpec::Full
+        } else {
+            RangeSpec::Unsatisfiable
+        };
+    }
+
+    let (start, end) = if from.is_empty() {
+        // Suffix form: the last `to` bytes.
+        let Ok(suffix) = to.parse::<u64>() else {
+            return RangeSpec::Full;
+        };
+        if suffix == 0 {
+            return RangeSpec::Unsatisfiable;
+        }
+        (len.saturating_sub(suffix), len - 1)
+    } else {
+        let Ok(start) = from.parse::<u64>() else {
+            return RangeSpec::Full;
+        };
+        let end = if to.is_empty() {
+            len - 1
+        } else {
+            match to.parse::<u64>() {
+                // An end past EOF is clamped, not rejected (RFC 9110 §14.1.1).
+                Ok(end) => end.min(len - 1),
+                Err(_) => return RangeSpec::Full,
+            }
+        };
+        (start, end)
+    };
+
+    if start >= len || start > end {
+        RangeSpec::Unsatisfiable
+    } else {
+        RangeSpec::Partial { start, end }
+    }
+}
+
 /// Stream a media file from disk into an HTTP response with a fixed set of security
-/// headers. Every media response (original, preview, thumbnail) goes through here so
-/// they consistently carry `X-Content-Type-Options: nosniff` (defense-in-depth against
+/// headers. Every media response (original, preview, display, thumbnail) goes through here
+/// so they consistently carry `X-Content-Type-Options: nosniff` (defense-in-depth against
 /// content-type confusion, even if the edge proxy is bypassed) plus an explicit
 /// `Content-Disposition` and `Cache-Control`.
+///
+/// Honours a single `Range`. This is not an optimisation: iOS Safari opens every `<video>`
+/// with a `Range: bytes=0-1` probe and abandons the load unless it gets a `206` with a
+/// `Content-Range`. Without this, video is unplayable on the app's primary platform no
+/// matter what `src` the element is given. `Accept-Ranges: bytes` is advertised on every
+/// response so clients know seeking is available before they ask.
 async fn stream_media_file(
+    req_headers: &axum::http::HeaderMap,
     absolute: &std::path::Path,
     content_type: String,
     disposition: &str,
@@ -660,30 +763,60 @@ async fn stream_media_file(
 ) -> Result<axum::response::Response, AppError> {
     use axum::body::Body;
     use axum::http::{Response, StatusCode, header};
+    use tokio::io::{AsyncReadExt, AsyncSeekExt};
     use tokio_util::io::ReaderStream;
 
     if !absolute.exists() {
         return Err(AppError::NotFound("Datei nicht gefunden.".into()));
     }
 
-    let file = tokio::fs::File::open(absolute)
+    let mut file = tokio::fs::File::open(absolute)
         .await
         .map_err(|e| AppError::Internal(e.into()))?;
-    let metadata = file
+    let len = file
         .metadata()
         .await
-        .map_err(|e| AppError::Internal(e.into()))?;
-    let stream = ReaderStream::new(file);
+        .map_err(|e| AppError::Internal(e.into()))?
+        .len();
 
-    Response::builder()
-        .status(StatusCode::OK)
-        .header(header::CONTENT_TYPE, content_type)
-        .header(header::CONTENT_DISPOSITION, disposition)
-        .header(header::CONTENT_LENGTH, metadata.len())
-        .header(header::CACHE_CONTROL, cache_control)
-        .header(header::X_CONTENT_TYPE_OPTIONS, "nosniff")
-        .body(Body::from_stream(stream))
-        .map_err(|e| AppError::Internal(e.into()))
+    let range = parse_range(
+        req_headers.get(header::RANGE).and_then(|v| v.to_str().ok()),
+        len,
+    );
+
+    let base = |status: StatusCode| {
+        Response::builder()
+            .status(status)
+            .header(header::CONTENT_TYPE, content_type.clone())
+            .header(header::CONTENT_DISPOSITION, disposition)
+            .header(header::CACHE_CONTROL, cache_control)
+            .header(header::X_CONTENT_TYPE_OPTIONS, "nosniff")
+            .header(header::ACCEPT_RANGES, "bytes")
+    };
+
+    match range {
+        RangeSpec::Full => base(StatusCode::OK)
+            .header(header::CONTENT_LENGTH, len)
+            .body(Body::from_stream(ReaderStream::new(file)))
+            .map_err(|e| AppError::Internal(e.into())),
+
+        RangeSpec::Partial { start, end } => {
+            file.seek(std::io::SeekFrom::Start(start))
+                .await
+                .map_err(|e| AppError::Internal(e.into()))?;
+            let span = end - start + 1;
+            base(StatusCode::PARTIAL_CONTENT)
+                .header(header::CONTENT_LENGTH, span)
+                .header(header::CONTENT_RANGE, format!("bytes {start}-{end}/{len}"))
+                .body(Body::from_stream(ReaderStream::new(file.take(span))))
+                .map_err(|e| AppError::Internal(e.into()))
+        }
+
+        RangeSpec::Unsatisfiable => base(StatusCode::RANGE_NOT_SATISFIABLE)
+            .header(header::CONTENT_RANGE, format!("bytes */{len}"))
+            .body(Body::empty())
+            .map_err(|e| AppError::Internal(e.into())),
+    }
 }
 
 /// Streaming download of the original file behind an upload. Used by:
@@ -700,6 +833,7 @@ async fn stream_media_file(
 /// [`get_preview`] / [`get_thumbnail`]).
 pub async fn get_original(
     State(state): State<AppState>,
+    headers: axum::http::HeaderMap,
     Path(upload_id): Path<Uuid>,
 ) -> Result<axum::response::Response, AppError> {
     let media = Upload::find_visible_media(&state.pool, upload_id)
@@ -711,10 +845,22 @@ pub async fn get_original(
         .file_name()
         .and_then(|n| n.to_str())
         .unwrap_or("original");
-    let disposition = format!("attachment; filename=\"{filename}\"");
+    // `inline`, not `attachment`. This route is the only source of playable video bytes
+    // (there is no video derivative), and an attachment disposition is hostile to a
+    // `<video>` element — Safari in particular. It also matches what the UI promises:
+    // the action is labelled "Original anzeigen", i.e. view, not download.
+    let disposition = format!("inline; filename=\"{filename}\"");
 
-    // Full-res original: force download, never cache at the edge.
-    stream_media_file(&absolute, media.mime_type, &disposition, "no-store").await
+    // Full-res original: never cache at the edge, so a takedown revokes access promptly.
+    // Range requests still work under no-store; the client simply re-fetches each range.
+    stream_media_file(
+        &headers,
+        &absolute,
+        media.mime_type,
+        &disposition,
+        "no-store",
+    )
+    .await
 }
 
 /// Streaming access to an upload's compressed **preview** image. Gated exactly like
@@ -729,6 +875,7 @@ pub async fn get_original(
 /// `upload-deleted` / `user-hidden` SSE events, so this only bounds the raw-URL edge case.
 pub async fn get_preview(
     State(state): State<AppState>,
+    headers: axum::http::HeaderMap,
     Path(upload_id): Path<Uuid>,
 ) -> Result<axum::response::Response, AppError> {
     let media = Upload::find_visible_media(&state.pool, upload_id)
@@ -739,6 +886,33 @@ pub async fn get_preview(
         .ok_or_else(|| AppError::NotFound("Vorschau nicht verfügbar.".into()))?;
     let absolute = state.config.media_path.join(&rel);
     stream_media_file(
+        &headers,
+        &absolute,
+        "image/jpeg".to_string(),
+        "inline",
+        "private, max-age=300",
+    )
+    .await
+}
+
+/// Streaming access to an upload's big-screen **display** derivative (~2048px), used by the
+/// diashow. Gated identically to [`get_preview`]. 404s when the derivative doesn't exist yet
+/// (still compressing, or an old upload the backfill hasn't reached) — the diashow then falls
+/// back to the original.
+pub async fn get_display(
+    State(state): State<AppState>,
+    headers: axum::http::HeaderMap,
+    Path(upload_id): Path<Uuid>,
+) -> Result<axum::response::Response, AppError> {
+    let media = Upload::find_visible_media(&state.pool, upload_id)
+        .await?
+        .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
+    let rel = media
+        .display_path
+        .ok_or_else(|| AppError::NotFound("Anzeige nicht verfügbar.".into()))?;
+    let absolute = state.config.media_path.join(&rel);
+    stream_media_file(
+        &headers,
         &absolute,
         "image/jpeg".to_string(),
         "inline",
@@ -751,6 +925,7 @@ pub async fn get_preview(
 /// [`get_preview`].
 pub async fn get_thumbnail(
     State(state): State<AppState>,
+    headers: axum::http::HeaderMap,
     Path(upload_id): Path<Uuid>,
 ) -> Result<axum::response::Response, AppError> {
     let media = Upload::find_visible_media(&state.pool, upload_id)
@@ -761,6 +936,7 @@ pub async fn get_thumbnail(
         .ok_or_else(|| AppError::NotFound("Thumbnail nicht verfügbar.".into()))?;
     let absolute = state.config.media_path.join(&rel);
     stream_media_file(
+        &headers,
         &absolute,
         "image/jpeg".to_string(),
         "inline",
@@ -771,7 +947,108 @@ pub async fn get_thumbnail(
 
 #[cfg(test)]
 mod tests {
-    use super::quota_limit_bytes;
+    use super::{RangeSpec, parse_range, quota_limit_bytes};
+
+    // `Range` handling exists because iOS Safari probes every `<video>` with
+    // `Range: bytes=0-1` and abandons the load without a 206. These pin the forms a
+    // media element actually sends, plus the edges that decide 206 vs 200 vs 416.
+    #[test]
+    fn no_range_header_is_a_full_response() {
+        assert_eq!(parse_range(None, 100), RangeSpec::Full);
+    }
+
+    #[test]
+    fn open_ended_range_runs_to_eof() {
+        assert_eq!(
+            parse_range(Some("bytes=10-"), 100),
+            RangeSpec::Partial { start: 10, end: 99 }
+        );
+    }
+
+    #[test]
+    fn closed_range_is_inclusive_on_both_ends() {
+        // The iOS probe. Two bytes, 0 and 1 — an exclusive end would return one.
+        assert_eq!(
+            parse_range(Some("bytes=0-1"), 100),
+            RangeSpec::Partial { start: 0, end: 1 }
+        );
+    }
+
+    #[test]
+    fn suffix_range_returns_the_last_n_bytes() {
+        assert_eq!(
+            parse_range(Some("bytes=-20"), 100),
+            RangeSpec::Partial { start: 80, end: 99 }
+        );
+    }
+
+    #[test]
+    fn suffix_longer_than_the_file_clamps_to_the_whole_file() {
+        assert_eq!(
+            parse_range(Some("bytes=-500"), 100),
+            RangeSpec::Partial { start: 0, end: 99 }
+        );
+    }
+
+    #[test]
+    fn end_past_eof_is_clamped_not_rejected() {
+        // RFC 9110 §14.1.1 — players routinely ask for more than is there.
+        assert_eq!(
+            parse_range(Some("bytes=90-999"), 100),
+            RangeSpec::Partial { start: 90, end: 99 }
+        );
+    }
+
+    #[test]
+    fn start_past_eof_is_416_not_a_full_body() {
+        // Answering 200 here makes a player re-request forever.
+        assert_eq!(
+            parse_range(Some("bytes=100-"), 100),
+            RangeSpec::Unsatisfiable
+        );
+        assert_eq!(
+            parse_range(Some("bytes=200-300"), 100),
+            RangeSpec::Unsatisfiable
+        );
+    }
+
+    #[test]
+    fn inverted_range_is_unsatisfiable() {
+        assert_eq!(
+            parse_range(Some("bytes=50-10"), 100),
+            RangeSpec::Unsatisfiable
+        );
+    }
+
+    #[test]
+    fn unsupported_or_malformed_forms_fall_back_to_the_full_body() {
+        // Ignoring a Range we can't process and sending 200 is explicitly allowed, and
+        // safer than guessing. Multi-range would need multipart/byteranges, which no
+        // <video> asks for.
+        for header in [
+            "bytes=0-10,20-30", // multi-range
+            "items=0-10",       // non-bytes unit
+            "bytes=abc-def",    // garbage
+            "bytes=",           // empty spec
+            "nonsense",         // no unit at all
+        ] {
+            assert_eq!(parse_range(Some(header), 100), RangeSpec::Full, "{header}");
+        }
+    }
+
+    #[test]
+    fn last_byte_is_reachable() {
+        assert_eq!(
+            parse_range(Some("bytes=99-99"), 100),
+            RangeSpec::Partial { start: 99, end: 99 }
+        );
+    }
+
+    #[test]
+    fn empty_file_satisfies_no_range() {
+        assert_eq!(parse_range(Some("bytes=0-"), 0), RangeSpec::Unsatisfiable);
+        assert_eq!(parse_range(None, 0), RangeSpec::Full);
+    }
 
     #[test]
     fn divides_free_space_by_uploaders_with_tolerance() {

backend/src/main.rs

@@ -2,7 +2,6 @@ use anyhow::Result;
 use axum::Router;
 use axum::extract::DefaultBodyLimit;
 use axum::routing::{delete, get, patch, post};
-use tower_http::services::ServeDir;
 use tower_http::trace::TraceLayer;
 use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
 
@@ -45,6 +44,13 @@ async fn main() -> Result<()> {
 
     let state = AppState::new(pool.clone(), config.clone());
 
+    // Regenerate image derivatives an older pipeline produced: the big-screen display for
+    // uploads processed before it existed (v0.17.x), and anything predating the current
+    // DERIVATIVES_REV (rev 1 applies the EXIF orientation, without which every portrait
+    // phone photo is stored sideways). Fire-and-forget behind the compression semaphore;
+    // originals are never touched, so a failure just retries on the next start.
+    state.compression.backfill_stale_derivatives().await;
+
     // Re-spawn exports for events that were released but whose keepsake never finished
     // (crash mid-export). Needs the media/export paths + SSE sender, so it runs here
     // rather than inside `startup_recovery`. Fire-and-forget: the workers run in the
@@ -53,6 +59,7 @@ async fn main() -> Result<()> {
         pool.clone(),
         config.media_path.clone(),
         config.export_path.clone(),
+        config.comments_enabled,
         state.sse_tx.clone(),
     )
     .await;
@@ -63,6 +70,7 @@ async fn main() -> Result<()> {
         pool,
         state.rate_limiter.clone(),
         state.sse_tickets.clone(),
+        config.media_path.clone(),
     );
 
     // Ensure media directories exist
@@ -106,6 +114,10 @@ async fn main() -> Result<()> {
             "/api/v1/upload/{id}/preview",
             get(handlers::upload::get_preview),
         )
+        .route(
+            "/api/v1/upload/{id}/display",
+            get(handlers::upload::get_display),
+        )
         .route(
             "/api/v1/upload/{id}/thumbnail",
             get(handlers::upload::get_thumbnail),
@@ -219,41 +231,39 @@ async fn main() -> Result<()> {
         api
     };
 
-    // Serve media files from disk
-    let media_service = ServeDir::new(&config.media_path);
-
+    // NOTE: media is deliberately NOT served over HTTP.
+    //
+    // Files live under `media_path` so the compression worker and the export job can read
+    // them off disk, but nothing may pull them straight from `/media/**` — that bypasses
+    // the visibility checks (soft-delete + ban-hide) that make a host takedown stick.
+    // Every legitimate fetch goes through `/api/v1/upload/{id}/{original,preview,display,
+    // thumbnail}`, which filter via `find_visible_media`; those are the only media URLs the
+    // backend ever emits (see `handlers::feed`).
+    //
+    // This used to be a `ServeDir` on `/media` with four `nest_service` blockers on the
+    // subtrees above it. That was bypassable: axum routes on the RAW path while `ServeDir`
+    // percent-decodes afterwards, so `/media/%70reviews/{id}.jpg` missed every blocker,
+    // fell through to the `ServeDir`, and was decoded back to `previews/` on disk — serving
+    // a taken-down photo to anyone, unauthenticated. Any single escaped byte worked, in all
+    // four subtrees. Deleting the route removes the vector outright rather than racing the
+    // decoder; `/media/**` now 404s regardless of encoding.
     let router = Router::new()
         .route("/health", get(|| async { "ok" }))
         .merge(api)
-        // Block direct HTTP access to ALL media subtrees. The files live under
-        // `media_path` (so the compression worker and export can read them off disk) but
-        // must NOT be pullable straight from `/media/**` — that bypasses the visibility
-        // checks (soft-delete + ban-hide) in the gated handlers. Every legitimate fetch
-        // goes through `/api/v1/upload/{id}/{original,preview,thumbnail}`, which filter
-        // via `find_visible_media`. The more specific nests take precedence over the
-        // `/media` ServeDir below (which, with all three subtrees blocked, now serves
-        // nothing — kept as a backstop).
-        .nest_service(
-            "/media/originals",
-            get(|| async { axum::http::StatusCode::NOT_FOUND }),
-        )
-        .nest_service(
-            "/media/previews",
-            get(|| async { axum::http::StatusCode::NOT_FOUND }),
-        )
-        .nest_service(
-            "/media/thumbnails",
-            get(|| async { axum::http::StatusCode::NOT_FOUND }),
-        )
-        .nest_service("/media", media_service)
         .layer(TraceLayer::new_for_http())
         .with_state(state);
 
     let listener = tokio::net::TcpListener::bind(("0.0.0.0", config.app_port)).await?;
     tracing::info!("listening on {}", listener.local_addr()?);
-    axum::serve(listener, router)
-        .with_graceful_shutdown(shutdown_signal())
-        .await?;
+    // `into_make_service_with_connect_info` is required by the pre-auth handlers, which
+    // extract `ConnectInfo<SocketAddr>` to use the peer address as the rate-limit key when
+    // X-Forwarded-For is absent. Without it those extractors fail at runtime.
+    axum::serve(
+        listener,
+        router.into_make_service_with_connect_info::<std::net::SocketAddr>(),
+    )
+    .with_graceful_shutdown(shutdown_signal())
+    .await?;
 
     Ok(())
 }

backend/src/models/upload.rs

@@ -46,6 +46,7 @@ pub struct VisibleMedia {
     pub original_path: String,
     pub preview_path: Option<String>,
     pub thumbnail_path: Option<String>,
+    pub display_path: Option<String>,
     pub mime_type: String,
 }
 
@@ -93,7 +94,7 @@ impl Upload {
         id: Uuid,
     ) -> Result<Option<VisibleMedia>, sqlx::Error> {
         sqlx::query_as::<_, VisibleMedia>(
-            "SELECT up.original_path, up.preview_path, up.thumbnail_path, up.mime_type
+            "SELECT up.original_path, up.preview_path, up.thumbnail_path, up.display_path, up.mime_type
              FROM upload up
              JOIN \"user\" u ON u.id = up.user_id
              WHERE up.id = $1 AND up.deleted_at IS NULL
@@ -134,6 +135,30 @@ impl Upload {
         Ok(())
     }
 
+    pub async fn set_display_path(
+        pool: &PgPool,
+        id: Uuid,
+        display_path: &str,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query("UPDATE upload SET display_path = $2 WHERE id = $1")
+            .bind(id)
+            .bind(display_path)
+            .execute(pool)
+            .await?;
+        Ok(())
+    }
+
+    /// Stamp which revision of the derivative pipeline produced this row's preview/display,
+    /// so the startup backfill can find rows generated by an older one exactly once.
+    pub async fn set_derivatives_rev(pool: &PgPool, id: Uuid, rev: i16) -> Result<(), sqlx::Error> {
+        sqlx::query("UPDATE upload SET derivatives_rev = $2 WHERE id = $1")
+            .bind(id)
+            .bind(rev)
+            .execute(pool)
+            .await?;
+        Ok(())
+    }
+
     pub async fn set_thumbnail_path(
         pool: &PgPool,
         id: Uuid,

backend/src/services/compression.rs

@@ -48,6 +48,16 @@ impl CompressionWorker {
         self.generation.fetch_add(1, Ordering::SeqCst);
     }
 
+    /// How many times `do_process` is attempted before an upload is given up on. The
+    /// give-up path is user-visible (the photo disappears), so transient infrastructure
+    /// errors must not reach it.
+    const MAX_PROCESS_ATTEMPTS: u32 = 3;
+
+    /// Revision of the image-derivative pipeline. Bump this whenever a change makes existing
+    /// previews/displays wrong, so `backfill_stale_derivatives` regenerates them once on the
+    /// next start. Rev 1 = EXIF orientation is applied.
+    const DERIVATIVES_REV: i16 = 1;
+
     /// Spawn a background task to process an uploaded file.
     pub fn process(&self, upload_id: Uuid, original_path: String, mime_type: String) {
         let worker = self.clone();
@@ -60,10 +70,42 @@ impl CompressionWorker {
             if worker.generation.load(Ordering::SeqCst) != born_at {
                 return;
             }
-            match worker
-                .do_process(upload_id, &original_path, &mime_type)
-                .await
-            {
+            // Retry before giving up. Most failures here are transient and self-clearing —
+            // an ENOSPC spike while several guests upload at once, a momentary DB-pool
+            // exhaustion, a panic inside the image codec — and the give-up path is
+            // user-visible data loss, so it is worth a few seconds to avoid entering it.
+            //
+            // But only for failures that CAN clear. An image that exceeds the decode budget,
+            // is corrupt, or is in an unsupported format fails identically on every attempt,
+            // so retrying it just burns 2s + 4s of backoff and writes three near-identical
+            // warnings before reaching the same conclusion. Give up on those immediately.
+            let mut attempt = 1u32;
+            let outcome = loop {
+                match worker
+                    .do_process(upload_id, &original_path, &mime_type)
+                    .await
+                {
+                    Ok(v) => break Ok(v),
+                    Err(e)
+                        if attempt < Self::MAX_PROCESS_ATTEMPTS
+                            && !crate::services::imaging::is_permanent_image_error(&e) =>
+                    {
+                        tracing::warn!(
+                            error = ?e, %upload_id, attempt,
+                            "compression attempt failed; retrying"
+                        );
+                        tokio::time::sleep(std::time::Duration::from_secs(2u64.pow(attempt))).await;
+                        attempt += 1;
+                        // The data may have been reset while we slept (e2e TRUNCATE).
+                        if worker.generation.load(Ordering::SeqCst) != born_at {
+                            return;
+                        }
+                    }
+                    Err(e) => break Err(e),
+                }
+            };
+
+            match outcome {
                 Ok(_) => {
                     tracing::info!("compression completed for upload {upload_id}");
                     let _ = worker.sse_tx.send(SseEvent {
@@ -72,21 +114,31 @@ impl CompressionWorker {
                     });
                 }
                 Err(e) => {
-                    tracing::error!("compression failed for upload {upload_id}: {e:#}");
-                    // Auto-cleanup: a failed transcode would otherwise leave a
-                    // permanently broken feed card, silently charge the uploader's
-                    // quota, and orphan the original on disk. Refund + soft-delete
-                    // (one tx, so v_feed excludes it), remove the orphan file, then
-                    // tell the uploader (upload-error toast) and evict the card
-                    // everywhere (upload-deleted, already handled by the feed).
+                    tracing::error!(
+                        "compression failed for upload {upload_id} after {attempt} attempt(s): {e:#}"
+                    );
+                    // Refund + soft-delete (one tx, so v_feed excludes it) so a failed
+                    // transcode doesn't leave a permanently broken feed card or silently
+                    // charge the uploader's quota. Then tell the uploader (upload-error
+                    // toast) and evict the card everywhere (upload-deleted).
+                    //
+                    // The ORIGINAL IS DELIBERATELY KEPT. This path used to `remove_file` it
+                    // unconditionally, which meant any transient error — a disk-full blip
+                    // while saving a derivative, a pool hiccup, a panic in the image codec —
+                    // irreversibly destroyed the guest's only copy of a photo they can never
+                    // retake. The row is only soft-deleted, so keeping the bytes makes the
+                    // upload fully recoverable; the file is orphaned rather than lost, and
+                    // the path is logged so it can be found. `backfill_stale_derivatives`
+                    // already refuses to destroy data on error for exactly this reason.
                     let _ = Upload::set_compression_status(&worker.pool, upload_id, "failed").await;
                     if let Err(del) = Upload::soft_delete(&worker.pool, upload_id).await {
                         tracing::warn!(error = ?del, %upload_id, "failed to soft-delete after compression failure");
                     }
-                    let orphan = worker.media_path.join(&original_path);
-                    if let Err(rm) = tokio::fs::remove_file(&orphan).await {
-                        tracing::warn!(error = ?rm, path = %orphan.display(), "failed to remove orphaned original");
-                    }
+                    tracing::warn!(
+                        %upload_id,
+                        path = %worker.media_path.join(&original_path).display(),
+                        "original retained for recovery after compression failure"
+                    );
                     let _ = worker.sse_tx.send(SseEvent {
                         event_type: "upload-error".to_string(),
                         data: serde_json::json!({ "upload_id": upload_id, "error": e.to_string() })
@@ -112,11 +164,13 @@ impl CompressionWorker {
         let original = self.media_path.join(original_path);
 
         if mime_type.starts_with("image/") {
-            let preview_rel = self
-                .generate_image_preview(upload_id, &original, mime_type)
+            let (preview_rel, display_rel) = self
+                .generate_image_derivatives(upload_id, &original, mime_type)
                 .await?;
             Upload::set_preview_path(&self.pool, upload_id, &preview_rel).await?;
-            tracing::info!("preview generated for upload {upload_id}");
+            Upload::set_display_path(&self.pool, upload_id, &display_rel).await?;
+            Upload::set_derivatives_rev(&self.pool, upload_id, Self::DERIVATIVES_REV).await?;
+            tracing::info!("preview + display generated for upload {upload_id}");
         } else if mime_type.starts_with("video/") {
             let thumb_rel = self.generate_video_thumbnail(upload_id, &original).await?;
             Upload::set_thumbnail_path(&self.pool, upload_id, &thumb_rel).await?;
@@ -127,44 +181,63 @@ impl CompressionWorker {
         Ok(())
     }
 
-    async fn generate_image_preview(
+    /// Longest edge of the big-screen "display" derivative used by the diashow. Sized to be
+    /// sharp on 1080p/4K while staying bounded (a ~2048px JPEG decodes to ~16 MB — trivial
+    /// for any kiosk, unlike a raw multi-thousand-pixel original).
+    const DISPLAY_MAX_EDGE: u32 = 2048;
+    /// Longest edge of the phone-feed "preview" (data-saver default).
+    const PREVIEW_MAX_EDGE: u32 = 800;
+
+    /// Decode the image ONCE and emit both derivatives — the 800px `preview` (phone feed)
+    /// and the 2048px `display` (diashow). Returns `(preview_rel, display_rel)`.
+    async fn generate_image_derivatives(
         &self,
         upload_id: Uuid,
         original: &Path,
         mime_type: &str,
-    ) -> Result<String> {
+    ) -> Result<(String, String)> {
         let previews_dir = self.media_path.join("previews");
+        let displays_dir = self.media_path.join("displays");
         tokio::fs::create_dir_all(&previews_dir).await?;
+        tokio::fs::create_dir_all(&displays_dir).await?;
 
-        let preview_filename = format!("{upload_id}.jpg");
-        let preview_path = previews_dir.join(&preview_filename);
+        let filename = format!("{upload_id}.jpg");
+        let preview_path = previews_dir.join(&filename);
+        let display_path = displays_dir.join(&filename);
         let original = original.to_path_buf();
-        let preview_path_clone = preview_path.clone();
         let mime_owned = mime_type.to_string();
+        let preview_max = Self::PREVIEW_MAX_EDGE;
+        let display_max = Self::DISPLAY_MAX_EDGE;
 
         // Run blocking image operations in a spawn_blocking task
         tokio::task::spawn_blocking(move || -> Result<()> {
-            // Reject decompression bombs *before* fully decoding: the upload body
-            // cap bounds the file size on disk, but a small file can still decode to
-            // enormous dimensions (e.g. a ~1 MB image expanding to 50k×50k px →
-            // gigabytes), OOM-ing the box during decode/resize. 12000×12000 covers
-            // any real phone photo; max_alloc hard-caps the decode allocation.
-            let mut reader = image::ImageReader::open(&original)
-                .context("failed to open image")?
-                .with_guessed_format()
-                .context("failed to read image header")?;
-            let mut limits = image::Limits::default();
-            limits.max_image_width = Some(12_000);
-            limits.max_image_height = Some(12_000);
-            limits.max_alloc = Some(256 * 1024 * 1024);
-            reader.limits(limits);
-            let img = reader.decode().context("failed to decode image")?;
+            // Decompression-bomb limits + EXIF orientation, both in one place — see
+            // services::imaging for why neither may be skipped.
+            let img = crate::services::imaging::decode_oriented(&original)?;
 
-            // Resize to max 800px wide, preserving aspect ratio
-            let preview = img.resize(800, 800, image::imageops::FilterType::Lanczos3);
-            preview
-                .save_with_format(&preview_path_clone, image::ImageFormat::Jpeg)
-                .context("failed to save preview")?;
+            // Preview: max 800px, preserving aspect ratio (data-saver feed).
+            img.resize(
+                preview_max,
+                preview_max,
+                image::imageops::FilterType::Lanczos3,
+            )
+            .save_with_format(&preview_path, image::ImageFormat::Jpeg)
+            .context("failed to save preview")?;
+
+            // Display: max 2048px for the diashow. Only DOWNSCALE — never upscale a smaller
+            // original (that adds bytes with no quality gain); re-encode it as JPEG as-is.
+            let display = if img.width() > display_max || img.height() > display_max {
+                img.resize(
+                    display_max,
+                    display_max,
+                    image::imageops::FilterType::Lanczos3,
+                )
+            } else {
+                img
+            };
+            display
+                .save_with_format(&display_path, image::ImageFormat::Jpeg)
+                .context("failed to save display")?;
 
             // If the original is PNG, try lossless compression in-place
             if mime_owned == "image/png" {
@@ -183,7 +256,73 @@ impl CompressionWorker {
         })
         .await??;
 
-        Ok(format!("previews/{preview_filename}"))
+        Ok((
+            format!("previews/{filename}"),
+            format!("displays/{filename}"),
+        ))
+    }
+
+    /// Regenerate image derivatives that an older pipeline produced. Fire-and-forget from
+    /// startup; picks up two cases, both of which leave the ORIGINAL untouched:
+    ///
+    /// - uploads processed before the `display` derivative existed (preview but no
+    ///   `display_path`), and
+    /// - uploads whose derivatives predate `DERIVATIVES_REV` — currently rev 1, which applies
+    ///   the EXIF orientation. Everything generated before it is stored sideways for any
+    ///   portrait phone photo.
+    ///
+    /// Unlike the failure path in `process`, a backfill error is logged and skipped — it must
+    /// NEVER destroy or soft-delete an upload that already has a working preview.
+    pub async fn backfill_stale_derivatives(&self) {
+        let rows = sqlx::query_as::<_, (Uuid, String, String)>(
+            "SELECT id, original_path, mime_type FROM upload
+             WHERE deleted_at IS NULL AND mime_type LIKE 'image/%'
+               AND original_path IS NOT NULL
+               AND (
+                     (display_path IS NULL AND preview_path IS NOT NULL)
+                  OR derivatives_rev < $1
+               )",
+        )
+        .bind(Self::DERIVATIVES_REV)
+        .fetch_all(&self.pool)
+        .await;
+        let rows = match rows {
+            Ok(r) => r,
+            Err(e) => {
+                tracing::warn!(error = ?e, "derivative backfill query failed");
+                return;
+            }
+        };
+        if rows.is_empty() {
+            return;
+        }
+        tracing::info!("regenerating derivatives for {} upload(s)", rows.len());
+        for (id, original_path, mime_type) in rows {
+            let worker = self.clone();
+            tokio::spawn(async move {
+                let _permit = worker.semaphore.acquire().await;
+                let original = worker.media_path.join(&original_path);
+                match worker
+                    .generate_image_derivatives(id, &original, &mime_type)
+                    .await
+                {
+                    Ok((preview_rel, display_rel)) => {
+                        let _ = Upload::set_preview_path(&worker.pool, id, &preview_rel).await;
+                        let _ = Upload::set_display_path(&worker.pool, id, &display_rel).await;
+                        let _ =
+                            Upload::set_derivatives_rev(&worker.pool, id, Self::DERIVATIVES_REV)
+                                .await;
+                        tracing::info!("derivatives regenerated for upload {id}");
+                    }
+                    Err(e) => {
+                        // Leave the existing derivatives and the original intact; this row is
+                        // simply retried on the next start. The rev stays behind, which is the
+                        // marker that it still needs doing.
+                        tracing::warn!(error = ?e, %id, "derivative backfill failed; leaving as-is");
+                    }
+                }
+            });
+        }
     }
 
     async fn generate_video_thumbnail(&self, upload_id: Uuid, original: &Path) -> Result<String> {

backend/src/services/disk.rs

@@ -76,6 +76,17 @@ impl Default for DiskCache {
     }
 }
 
+/// UNCACHED free-space reading for the filesystem backing `path`.
+///
+/// Deliberately bypasses [`DiskCache`]. The cache exists for the quota poll, where a 15s-stale
+/// number is fine because it is only ever advisory. The export preflight is the opposite case: it
+/// decides whether to start writing a multi-GB archive, and the sibling export worker running
+/// concurrently can move free space by tens of gigabytes well inside the TTL. A stale reading there
+/// would authorise exactly the write that fills the disk.
+pub fn free_bytes(path: &Path) -> Option<u64> {
+    read_disk_for_path(path).map(|d| d.free)
+}
+
 /// Resolve the filesystem backing `media_path` and read its total/free bytes.
 ///
 /// Snapshots the mount table via `sysinfo`, then delegates the selection to the pure

backend/src/services/export.rs

@@ -53,6 +53,9 @@ struct ViewerData {
 struct ViewerEvent {
     name: String,
     exported_at: String,
+    // Mirrors the live COMMENTS_ENABLED flag so the offline keepsake hides all comment
+    // UI (buttons, counts, sections) when the feature was off for the event.
+    comments_enabled: bool,
 }
 
 #[derive(Serialize)]
@@ -238,6 +241,7 @@ pub async fn recover_exports(
     pool: PgPool,
     media_path: PathBuf,
     export_path: PathBuf,
+    comments_enabled: bool,
     sse_tx: broadcast::Sender<SseEvent>,
 ) {
     let rows = match sqlx::query_as::<_, (Uuid, String, i64)>(
@@ -297,6 +301,7 @@ pub async fn recover_exports(
             event_id,
             event_name,
             epoch,
+            comments_enabled,
             Duration::ZERO,
             pool.clone(),
             media_path.clone(),
@@ -403,6 +408,7 @@ pub fn spawn_export_jobs(
     event_id: Uuid,
     event_name: String,
     epoch: i64,
+    comments_enabled: bool,
     delay: Duration,
     pool: PgPool,
     media_path: PathBuf,
@@ -439,6 +445,7 @@ pub fn spawn_export_jobs(
             event_id,
             epoch,
             &event_name2,
+            comments_enabled,
             &pool2,
             &media_path2,
             &export_path2,
@@ -469,6 +476,15 @@ async fn run_zip_export(
         return Ok(());
     }
 
+    // Reclaim BEFORE measuring: the superseded archive is already unreachable, and the space it
+    // holds is very often exactly the space this rebuild needs.
+    prune_superseded_archives(pool, export_path, "Gallery", event_id, epoch).await;
+    // AFTER the claim, not before. A preflight that bailed before claiming would leave the row
+    // `pending` with no worker and no error — the spinner-forever state `mark_failed`'s status
+    // guard was widened to prevent. Failing here goes through the caller's `mark_failed`, so the
+    // host gets the reason.
+    ensure_export_space(pool, event_id, export_path).await?;
+
     // On error, mark THIS generation failed — a no-op if we've since been superseded (the
     // caller in `spawn_export_jobs` does it, epoch-guarded). Temp artifacts are cleaned up
     // here so a failing export can't leak them (which is what fills the disk in the first place).
@@ -635,10 +651,12 @@ impl MediaSource {
     }
 }
 
+#[allow(clippy::too_many_arguments)]
 async fn run_html_export(
     event_id: Uuid,
     epoch: i64,
     event_name: &str,
+    comments_enabled: bool,
     pool: &PgPool,
     media_path: &Path,
     export_path: &Path,
@@ -649,10 +667,16 @@ async fn run_html_export(
         return Ok(());
     }
 
+    // See run_zip_export: reclaim the superseded generation first, then refuse at the door rather
+    // than ENOSPC mid-write.
+    prune_superseded_archives(pool, export_path, "Memories", event_id, epoch).await;
+    ensure_export_space(pool, event_id, export_path).await?;
+
     let res = run_html_export_inner(
         epoch,
         event_id,
         event_name,
+        comments_enabled,
         pool,
         media_path,
         export_path,
@@ -672,10 +696,12 @@ async fn run_html_export(
     abandon_if_superseded("HTML", event_id, epoch, res)
 }
 
+#[allow(clippy::too_many_arguments)]
 async fn run_html_export_inner(
     epoch: i64,
     event_id: Uuid,
     event_name: &str,
+    comments_enabled: bool,
     pool: &PgPool,
     media_path: &Path,
     export_path: &Path,
@@ -708,10 +734,11 @@ async fn run_html_export_inner(
         let src = media_path.join(&row.original_path);
         // Stat ONCE, up front, and skip this upload if the source is gone. The old code probed with
         // `exists()` here and then did `metadata(&src).await?` further down — a TOCTOU whose `?`
-        // aborted the ENTIRE keepsake if the file vanished in between. It genuinely can: the
-        // compression worker hard-deletes an original when its transcode fails, and it can still be
-        // running when the gallery is released. A missing source must degrade one entry, never the
-        // whole archive (which, once released, the host cannot rebuild without reopening uploads).
+        // aborted the ENTIRE keepsake if the file vanished in between. It can still happen: the
+        // compression worker no longer deletes originals on failure, but the hourly sweep reclaims
+        // them once past the retention window, and an owner or host delete can land mid-export. A
+        // missing source must degrade one entry, never the whole archive (which, once released, the
+        // host cannot rebuild without reopening uploads).
         let src_meta = match tokio::fs::metadata(&src).await {
             Ok(m) => m,
             Err(e) => {
@@ -778,7 +805,12 @@ async fn run_html_export_inner(
             let thumb_path_clone = thumb_path.clone();
 
             let thumb_result = tokio::task::spawn_blocking(move || -> Result<()> {
-                let img = image::open(&src_clone).context("failed to open image for thumbnail")?;
+                // `decode_oriented`, not `image::open`: the latter ignores the EXIF
+                // orientation tag AND applies no decode limits. Using it here is why every
+                // portrait photo came out sideways in the keepsake's HTML viewer grid — the
+                // re-encode below drops the tag, so the viewer cannot recover it.
+                let img = crate::services::imaging::decode_oriented(&src_clone)
+                    .context("failed to open image for thumbnail")?;
                 let resized = img.resize(400, 400, image::imageops::FilterType::Lanczos3);
                 resized
                     .save_with_format(&thumb_path_clone, image::ImageFormat::Jpeg)
@@ -799,8 +831,12 @@ async fn run_html_export_inner(
                 let full_path_clone = full_path.clone();
 
                 let compress_result = tokio::task::spawn_blocking(move || -> Result<()> {
-                    let img =
-                        image::open(&src_clone).context("failed to open image for compression")?;
+                    // Same reason as the thumbnail above. This branch only runs for originals
+                    // over 5 MB, which is why the viewer's full image looked correct for small
+                    // photos and sideways for large ones — an inconsistency that reads as a
+                    // viewer bug rather than an export one.
+                    let img = crate::services::imaging::decode_oriented(&src_clone)
+                        .context("failed to open image for compression")?;
                     let resized = img.resize(2000, 2000, image::imageops::FilterType::Lanczos3);
                     resized
                         .save_with_format(&full_path_clone, image::ImageFormat::Jpeg)
@@ -882,12 +918,17 @@ async fn run_html_export_inner(
         event: ViewerEvent {
             name: event_name.to_string(),
             exported_at: Utc::now().to_rfc3339(),
+            comments_enabled,
         },
         posts: viewer_posts,
     };
     let data_json =
         serde_json::to_string_pretty(&viewer_data).context("failed to serialize data.json")?;
 
+    // Match the live app's colour theme in the offline keepsake.
+    let (theme_primary, theme_accent) = resolve_theme_seeds(pool).await;
+    let theme_css = theme_override_css(&theme_primary, &theme_accent);
+
     let _ = update_progress(pool, event_id, "html", epoch, 72).await;
 
     // 5. Create ZIP (per-generation paths — see run_zip_export)
@@ -899,8 +940,11 @@ async fn run_html_export_inner(
         let file = tokio::fs::File::create(&tmp_path).await?;
         let mut zip = ZipFileWriter::with_tokio(file);
 
-        // Write embedded viewer assets (index.html, _app/*, etc.)
-        write_dir_to_zip(&VIEWER_DIR, &mut zip).await?;
+        // Write the embedded single-file viewer, injecting the export data as a
+        // `window.__EXPORT_DATA__` global into index.html. Guests double-click
+        // index.html (file://), where a cross-origin fetch() of a sibling file is
+        // blocked — so the data must be inlined rather than fetched from data.json.
+        write_viewer_with_data(&VIEWER_DIR, &mut zip, &data_json, theme_css.as_deref()).await?;
 
         let _ = update_progress(pool, event_id, "html", epoch, 75).await;
 
@@ -933,9 +977,9 @@ async fn run_html_export_inner(
 
         for (name, source) in &media_manifest {
             let path = source.path();
-            // Open-first: a source that disappeared between the manifest being built and now (the
-            // compression worker deletes originals on transcode failure) must skip this entry, not
-            // fail the whole viewer. Opening collapses the check and the use into one operation.
+            // Open-first: a source that disappeared between the manifest being built and now (a
+            // delete, or the hourly sweep reclaiming a long-failed original) must skip this entry,
+            // not fail the whole viewer. Opening collapses the check and the use into one operation.
             let src_file = match tokio::fs::File::open(path).await {
                 Ok(f) => f,
                 Err(e) => {
@@ -1131,6 +1175,196 @@ fn parse_gen_seq(name: &str, prefix: &str, suffix: &str) -> Option<i64> {
         .ok()
 }
 
+/// Filenames a live (current-epoch, `done`) job row still points at — OFF LIMITS to every prune,
+/// regardless of the epoch encoded in the name.
+///
+/// A ViewerOnly regeneration carries the finished ZIP forward by re-stamping its row to the new
+/// epoch WITHOUT renaming the file, so `Gallery.<event>.<older>.zip` is still the served archive and
+/// deleting it by filename-epoch would 404 the download.
+async fn protected_files(pool: &PgPool, event_id: Uuid) -> Vec<String> {
+    sqlx::query_scalar::<_, String>(
+        "SELECT split_part(j.file_path, '/', -1) FROM export_job j
+          JOIN event e ON e.id = j.event_id
+         WHERE j.event_id = $1 AND j.epoch = e.export_epoch
+           AND j.status = 'done' AND j.file_path IS NOT NULL",
+    )
+    .bind(event_id)
+    .fetch_all(pool)
+    .await
+    .unwrap_or_default()
+}
+
+/// Reclaim superseded FINAL archives BEFORE this generation starts writing its own.
+///
+/// Peak disk usage used to be two full generations, because the only prune ran after the new archive
+/// was written, renamed and finalised. That ordering reads as durability ("don't delete the good
+/// keepsake before the replacement is safe") but it buys nothing: readiness is derived from
+/// `job.epoch = event.export_epoch AND status = 'done'`, so the moment `invalidate_and_arm` bumps
+/// the epoch the old archive is ALREADY unreachable — `GET /export/zip` 404s whether the file is on
+/// disk or not. Keeping it only reserves gigabytes for a download nobody can perform, and for
+/// `Affects::Both` (a takedown) it is content someone has explicitly asked to have removed. So a
+/// rebuild reclaims first and peaks at one generation.
+///
+/// Narrower than [`prune_stale_export_files`] on purpose: FINAL archives only. Those are inert — a
+/// superseded worker either already renamed its file (and will delete it itself when its guarded
+/// `finalize_job` fails) or never will. `.tmp` files and `viewer_tmp_` staging dirs are NOT touched
+/// here: a superseded worker can still be streaming into those, and at build START it is far more
+/// likely to be alive than at finalize time.
+async fn prune_superseded_archives(
+    pool: &PgPool,
+    exports_dir: &Path,
+    prefix: &str,
+    event_id: Uuid,
+    keep_seq: i64,
+) {
+    let protected = protected_files(pool, event_id).await;
+    let final_prefix = format!("{prefix}.{event_id}.");
+    let mut rd = match tokio::fs::read_dir(exports_dir).await {
+        Ok(rd) => rd,
+        Err(_) => return,
+    };
+    let mut reclaimed = 0u64;
+    while let Ok(Some(entry)) = rd.next_entry().await {
+        let name = entry.file_name();
+        let name = name.to_string_lossy();
+        if !is_superseded_archive(&name, &final_prefix, keep_seq, &protected) {
+            continue;
+        }
+        let len = entry.metadata().await.map(|m| m.len()).unwrap_or(0);
+        if tokio::fs::remove_file(entry.path()).await.is_ok() {
+            reclaimed += len;
+        }
+    }
+    if reclaimed > 0 {
+        tracing::info!(
+            "reclaimed {reclaimed} bytes of superseded {prefix} archives before rebuilding \
+             event {event_id} @ epoch {keep_seq}"
+        );
+    }
+}
+
+/// Is `name` a FINAL archive of a strictly-older generation that no live row points at?
+///
+/// Pure so the two dangerous cases can be pinned without a filesystem: the carried-forward archive
+/// (protected despite an older epoch in its name) and the in-flight `.tmp` (never matched at all).
+fn is_superseded_archive(
+    name: &str,
+    final_prefix: &str,
+    keep_seq: i64,
+    protected: &[String],
+) -> bool {
+    if protected.iter().any(|p| p == name) {
+        return false;
+    }
+    parse_gen_seq(name, final_prefix, ".zip").is_some_and(|n| n < keep_seq)
+}
+
+/// Bytes the media in this event's keepsake will occupy, as an UPPER BOUND per archive.
+///
+/// Both archives write their media entries `Compression::Stored`, so an archive is essentially a
+/// byte-for-byte second copy of the originals: `Gallery.zip` always, and `Memories.zip` for every
+/// video ([`MediaSource::Original`]) and every image at or under 5 MB. Images over 5 MB are
+/// downscaled to 2000px first, which only makes this estimate more conservative — the direction we
+/// want, since being wrong low means ENOSPC halfway through.
+///
+/// Matches [`query_uploads`]' visibility filter exactly, so hidden/banned uploads aren't counted.
+pub async fn estimate_export_bytes(pool: &PgPool, event_id: Uuid) -> Result<u64> {
+    let (bytes,): (i64,) = sqlx::query_as(
+        "SELECT COALESCE(SUM(u.original_size_bytes), 0)::bigint
+           FROM upload u
+           JOIN \"user\" usr ON usr.id = u.user_id
+          WHERE u.event_id = $1 AND u.deleted_at IS NULL
+            AND usr.uploads_hidden = FALSE AND usr.is_banned = FALSE",
+    )
+    .bind(event_id)
+    .fetch_one(pool)
+    .await
+    .context("estimating the export size")?;
+    Ok(bytes.max(0) as u64)
+}
+
+/// Headroom multiplier over the raw media sum: ZIP central directory, per-entry headers, the
+/// embedded viewer, and the HTML export's temp staging.
+const EXPORT_SIZE_OVERHEAD_PCT: u64 = 110;
+
+/// Bytes this export must have available, given the raw media sum and how many jobs are competing.
+///
+/// `armed` is the multiplier that keeps two concurrent workers honest. `spawn_export_jobs` starts
+/// the ZIP and the HTML halves at the same instant and both are gallery-sized, so a worker that
+/// reserved only for itself would see "it fits", its sibling would independently see the same, and
+/// together they would not fit — which is precisely the ENOSPC this preflight exists to prevent.
+/// Computed in `u128` and clamped, NOT with `saturating_mul`: saturating first and then dividing by
+/// 100 quietly turns an overflow into a number ~100x too small, which is the one direction that
+/// matters here — an under-estimate authorises the very write the preflight exists to refuse.
+fn required_free_bytes(media_bytes: u64, armed: i64) -> u64 {
+    let needed = media_bytes as u128 * EXPORT_SIZE_OVERHEAD_PCT as u128 / 100
+        * armed.max(1).min(i64::from(u32::MAX)) as u128;
+    needed.min(u64::MAX as u128) as u64
+}
+
+/// Free bytes a full keepsake build would need RIGHT NOW, both halves included.
+///
+/// The same arithmetic the preflight uses, exposed so the host dashboard can warn BEFORE the
+/// release rather than reporting a failure after it. The preflight can only ever say "this didn't
+/// fit"; at that point the gallery is full, the event is over, and the remedies (ask guests to stop
+/// uploading, grow the volume) are all much harder. Hard-codes both halves because that is what a
+/// release arms.
+pub async fn keepsake_space_required(pool: &PgPool, event_id: Uuid) -> Result<u64> {
+    Ok(required_free_bytes(
+        estimate_export_bytes(pool, event_id).await?,
+        2,
+    ))
+}
+
+/// Refuse to start an export that cannot fit, with a reason the host can act on.
+///
+/// Without this the failure mode is ENOSPC halfway through a multi-GB write, and the wreckage
+/// outlives it: the epoch has already moved, so the job row is `failed` at the CURRENT generation
+/// and `GET /export/zip` 404s, while the last good archive sits on disk unreferenced. The host's
+/// only escape (`POST /host/export/rebuild`) needs the very space that isn't there. Failing at the
+/// door instead leaves the disk untouched and puts a number in front of the operator.
+///
+/// Both halves are spawned concurrently and both are gallery-sized, so a worker must reserve for
+/// its live sibling too — otherwise each independently sees "it fits", and together they don't.
+async fn ensure_export_space(pool: &PgPool, event_id: Uuid, export_path: &Path) -> Result<()> {
+    let media_bytes = estimate_export_bytes(pool, event_id).await?;
+
+    // Every job armed at any epoch for this event that hasn't finished is competing for this disk.
+    let (armed,): (i64,) = sqlx::query_as(
+        "SELECT COUNT(*) FROM export_job
+          WHERE event_id = $1 AND status IN ('pending', 'running')",
+    )
+    .bind(event_id)
+    .fetch_one(pool)
+    .await
+    .context("counting armed export jobs")?;
+    let needed = required_free_bytes(media_bytes, armed);
+
+    // `None` = the mount couldn't be resolved. Fail OPEN, exactly as the upload quota does: refusing
+    // to build the keepsake because we can't read a number would be a worse failure than trying.
+    let Some(free) = crate::services::disk::free_bytes(export_path) else {
+        tracing::warn!("export preflight: disk snapshot unavailable; proceeding without the check");
+        return Ok(());
+    };
+
+    if free < needed {
+        let gb = |b: u64| b as f64 / 1_000_000_000.0;
+        tracing::error!(
+            needed,
+            free,
+            armed,
+            "export preflight: not enough free space to build the keepsake for event {event_id}"
+        );
+        anyhow::bail!(
+            "Nicht genug Speicherplatz für das Keepsake: benötigt ca. {:.1} GB, frei sind {:.1} GB. \
+             Bitte Speicher freigeben und das Keepsake anschließend neu erstellen.",
+            gb(needed),
+            gb(free)
+        );
+    }
+    Ok(())
+}
+
 /// Best-effort removal of stale per-generation export artifacts for one export type. Deletes
 /// ONLY strictly-older generations (`n < keep_seq`) — never `keep_seq`'s own current file,
 /// and never a NEWER generation that a concurrent re-release may already be producing (that
@@ -1147,20 +1381,7 @@ async fn prune_stale_export_files(
     event_id: Uuid,
     keep_seq: i64,
 ) {
-    // Files still referenced by a live (current-epoch) job row are OFF LIMITS regardless of the
-    // epoch in their name. A ViewerOnly regeneration carries the finished ZIP forward by re-stamping
-    // its row to the new epoch WITHOUT renaming the file — so `Gallery.<event>.<older>.zip` is still
-    // the served archive, and deleting it by filename-epoch would 404 the download.
-    let protected: Vec<String> = sqlx::query_scalar::<_, String>(
-        "SELECT split_part(j.file_path, '/', -1) FROM export_job j
-          JOIN event e ON e.id = j.event_id
-         WHERE j.event_id = $1 AND j.epoch = e.export_epoch
-           AND j.status = 'done' AND j.file_path IS NOT NULL",
-    )
-    .bind(event_id)
-    .fetch_all(pool)
-    .await
-    .unwrap_or_default();
+    let protected = protected_files(pool, event_id).await;
 
     // EVERY shape is event-scoped. All events share one exports volume, so a name keyed only by
     // generation would let event A's prune delete event B's live keepsake (and let two events
@@ -1301,26 +1522,146 @@ async fn maybe_broadcast_complete(
     }
 }
 
-/// Recursively write all files from an embedded `include_dir::Dir` into a ZIP.
-async fn write_dir_to_zip(
+/// Write the embedded viewer into the ZIP, injecting the export data as a
+/// `window.__EXPORT_DATA__` global into `index.html`. The keepsake is opened by
+/// double-clicking `index.html` (file://), where browsers block a cross-origin
+/// `fetch()` of a sibling `data.json` — so the data is inlined into the page.
+/// (`data.json` is still written separately for the http-served case.)
+async fn write_viewer_with_data(
     dir: &include_dir::Dir<'_>,
     zip: &mut ZipFileWriter<tokio::fs::File>,
+    data_json: &str,
+    theme_css: Option<&str>,
 ) -> Result<()> {
     for file in dir.files() {
         let path = file.path().to_string_lossy().to_string();
-        let contents = file.contents();
-        let builder = ZipEntryBuilder::new(path.into(), Compression::Deflate);
-        let mut entry = zip.write_entry_stream(builder).await?;
-        let mut cursor = AllowStdIo::new(std::io::Cursor::new(contents));
-        fcopy(&mut cursor, &mut entry).await?;
-        entry.close().await?;
+        if path == "index.html" {
+            let html = std::str::from_utf8(file.contents())
+                .context("export-viewer index.html is not valid UTF-8")?;
+            // Escape `</` so a caption containing `</script>` can't break out of the tag.
+            let safe = data_json.replace("</", "<\\/");
+            // Match the live app's colour theme: inject the same `:root:root{…}` override
+            // the app builds at runtime so a rose/sage/custom event exports a rose/sage
+            // keepsake (not the embedded default gold). The CSS is generated purely from
+            // hex seeds (theme_override_css), so there's nothing to escape.
+            let mut head_inject = String::new();
+            if let Some(css) = theme_css {
+                head_inject.push_str(&format!("<style id=\"es-theme\">{css}</style>"));
+            }
+            head_inject.push_str(&format!("<script>window.__EXPORT_DATA__={safe};</script>"));
+            let injected = match html.find("</head>") {
+                Some(idx) => format!("{}{}{}", &html[..idx], head_inject, &html[idx..]),
+                None => format!("{head_inject}{html}"),
+            };
+            let builder = ZipEntryBuilder::new(path.into(), Compression::Deflate);
+            let mut entry = zip.write_entry_stream(builder).await?;
+            let mut cursor = AllowStdIo::new(std::io::Cursor::new(injected.as_bytes()));
+            fcopy(&mut cursor, &mut entry).await?;
+            entry.close().await?;
+        } else {
+            let builder = ZipEntryBuilder::new(path.into(), Compression::Deflate);
+            let mut entry = zip.write_entry_stream(builder).await?;
+            let mut cursor = AllowStdIo::new(std::io::Cursor::new(file.contents()));
+            fcopy(&mut cursor, &mut entry).await?;
+            entry.close().await?;
+        }
     }
     for sub_dir in dir.dirs() {
-        Box::pin(write_dir_to_zip(sub_dir, zip)).await?;
+        Box::pin(write_viewer_with_data(sub_dir, zip, data_json, theme_css)).await?;
     }
     Ok(())
 }
 
+/// Default champagne-gold seed — matches the hand-tuned ramp already embedded in the
+/// viewer, so a default-themed event injects no override.
+const KEEPSAKE_DEFAULT_SEED: &str = "#8a6a2b";
+
+// stop → color-mix instruction. MIRRORS `LADDER` in frontend/src/lib/theme/palette.ts —
+// keep the two in sync so an exported keepsake matches the live app pixel-for-pixel.
+const THEME_LADDER: &[(u16, Option<&str>)] = &[
+    (50, Some("white 90%")),
+    (100, Some("white 80%")),
+    (200, Some("white 62%")),
+    (300, Some("white 42%")),
+    (400, Some("white 22%")),
+    (500, Some("white 9%")),
+    (600, None),
+    (700, Some("black 15%")),
+    (800, Some("black 30%")),
+    (900, Some("black 45%")),
+    (950, Some("black 63%")),
+];
+
+fn theme_stop_value(seed: &str, mix: Option<&str>) -> String {
+    match mix {
+        Some(m) => format!("color-mix(in oklab, {seed}, {m})"),
+        None => seed.to_string(),
+    }
+}
+
+fn theme_ramp(families: &[&str], seed: &str) -> String {
+    let mut out = String::new();
+    for (stop, mix) in THEME_LADDER {
+        let val = theme_stop_value(seed, *mix);
+        for fam in families {
+            out.push_str(&format!("--color-{fam}-{stop}:{val};"));
+        }
+    }
+    out
+}
+
+fn is_hex_color(s: &str) -> bool {
+    let b = s.as_bytes();
+    b.len() == 7 && b[0] == b'#' && b[1..].iter().all(|c| c.is_ascii_hexdigit())
+}
+
+/// Build the keepsake's `:root:root{…}` colour override from two seed colours, or None
+/// for the default gold (viewer already carries that ramp) or an invalid seed (fall back
+/// to the embedded default rather than emit unsafe CSS). MIRRORS `buildPaletteCss` in
+/// frontend/src/lib/theme/palette.ts.
+fn theme_override_css(primary: &str, accent: &str) -> Option<String> {
+    if !is_hex_color(primary) || !is_hex_color(accent) {
+        return None;
+    }
+    if primary.eq_ignore_ascii_case(KEEPSAKE_DEFAULT_SEED)
+        && accent.eq_ignore_ascii_case(KEEPSAKE_DEFAULT_SEED)
+    {
+        return None;
+    }
+    let accent500 = theme_stop_value(accent, Some("white 9%"));
+    let mut css = String::from(":root:root{");
+    css.push_str(&theme_ramp(&["blue", "primary"], primary));
+    css.push_str(&theme_ramp(&["purple"], accent));
+    css.push_str(&format!(
+        "--color-violet-500:{accent500};--color-violet-600:{accent};"
+    ));
+    css.push_str(&format!(
+        "--color-accent-500:{accent500};--color-accent-600:{accent};"
+    ));
+    css.push('}');
+    Some(css)
+}
+
+/// Read the active theme seeds from the runtime `config` table (set by the admin UI),
+/// falling back to the default gold. NOTE: an env-only default (THEME_PRIMARY set but
+/// never saved via the admin UI) isn't stored in this table, so such a keepsake would
+/// use gold; admin-set themes — the normal path — match the app exactly.
+async fn resolve_theme_seeds(pool: &PgPool) -> (String, String) {
+    async fn read(pool: &PgPool, key: &str) -> String {
+        sqlx::query_scalar::<_, String>("SELECT value FROM config WHERE key = $1")
+            .bind(key)
+            .fetch_optional(pool)
+            .await
+            .ok()
+            .flatten()
+            .unwrap_or_else(|| KEEPSAKE_DEFAULT_SEED.to_string())
+    }
+    (
+        read(pool, "theme_primary").await,
+        read(pool, "theme_accent").await,
+    )
+}
+
 fn ext_from_path(path: &str) -> &str {
     path.rsplit('.').next().unwrap_or("bin")
 }
@@ -1354,3 +1695,131 @@ So geht's:\n\
    Alles ist lokal auf deinem Gerät gespeichert.\n\
 \n\
 Viel Freude mit den Erinnerungen!\n";
+
+// ── Tests ────────────────────────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const EVT: &str = "11111111-1111-1111-1111-111111111111";
+
+    fn gallery_prefix() -> String {
+        format!("Gallery.{EVT}.")
+    }
+
+    #[test]
+    fn a_strictly_older_archive_is_reclaimed() {
+        // The whole point: at the start of a rebuild at epoch 5, generation 4's archive is dead
+        // weight — readiness is derived from `epoch = event.export_epoch`, so it is already
+        // unreachable — and its bytes are very often exactly the bytes the rebuild needs.
+        assert!(is_superseded_archive(
+            &format!("Gallery.{EVT}.4.zip"),
+            &gallery_prefix(),
+            5,
+            &[]
+        ));
+    }
+
+    #[test]
+    fn our_own_and_newer_generations_are_never_touched() {
+        // `keep_seq` is OUR generation; a NEWER one belongs to a re-release that has already
+        // superseded us, and deleting it would let a lagging worker nuke a live keepsake.
+        for seq in [5, 6] {
+            assert!(
+                !is_superseded_archive(
+                    &format!("Gallery.{EVT}.{seq}.zip"),
+                    &gallery_prefix(),
+                    5,
+                    &[]
+                ),
+                "generation {seq} must survive a prune keeping 5"
+            );
+        }
+    }
+
+    #[test]
+    fn a_carried_forward_archive_survives_despite_an_older_epoch_in_its_name() {
+        // THE dangerous case. A ViewerOnly regeneration (a moderated comment) re-stamps the
+        // finished ZIP's row to the new epoch WITHOUT renaming the file, so the SERVED archive
+        // legitimately carries an older generation number. Pruning it by filename-epoch would 404
+        // the photo download to change nothing in it. The protected set is what stops that, and
+        // moving the prune to build-start makes this case reachable far more often.
+        let carried = format!("Gallery.{EVT}.4.zip");
+        assert!(!is_superseded_archive(
+            &carried,
+            &gallery_prefix(),
+            5,
+            std::slice::from_ref(&carried)
+        ));
+    }
+
+    #[test]
+    fn temps_and_staging_dirs_are_out_of_scope_for_the_early_prune() {
+        // A superseded worker may still be streaming into these, and at build START it is much
+        // more likely to be alive than at finalize time. Only inert FINAL archives are reclaimed
+        // here; `prune_stale_export_files` still handles the rest after we win.
+        for name in [
+            format!("Gallery.{EVT}.4.tmp"),
+            format!("viewer_tmp_{EVT}_4"),
+            format!("Memories.{EVT}.4.zip"),
+        ] {
+            assert!(
+                !is_superseded_archive(&name, &gallery_prefix(), 5, &[]),
+                "{name} must not be reclaimed by the pre-build prune"
+            );
+        }
+    }
+
+    #[test]
+    fn another_events_archive_is_never_reclaimed() {
+        // All events share one exports volume, so the prefix carries the event id.
+        let other = "22222222-2222-2222-2222-222222222222";
+        assert!(!is_superseded_archive(
+            &format!("Gallery.{other}.4.zip"),
+            &gallery_prefix(),
+            5,
+            &[]
+        ));
+    }
+
+    #[test]
+    fn unrelated_files_are_left_alone() {
+        for name in ["Gallery.zip", "notes.txt", "Gallery..4.zip"] {
+            assert!(!is_superseded_archive(name, &gallery_prefix(), 5, &[]));
+        }
+    }
+
+    #[test]
+    fn a_lone_armed_job_reserves_for_one_archive() {
+        // A ViewerOnly regeneration re-arms only the HTML half — reserving for two would refuse
+        // a rebuild that fits perfectly well.
+        assert_eq!(required_free_bytes(1_000, 1), 1_100);
+    }
+
+    #[test]
+    fn two_concurrent_halves_reserve_for_both() {
+        // The bug this exists to prevent: each worker independently sees "it fits", and together
+        // they don't. Both halves are gallery-sized, so the reservation must be for the pair.
+        assert_eq!(required_free_bytes(1_000, 2), 2_200);
+    }
+
+    #[test]
+    fn a_zero_count_still_reserves_for_one() {
+        // Defensive: a racing status transition must never yield a zero requirement, which would
+        // wave through an export of any size onto a full disk.
+        assert_eq!(required_free_bytes(1_000, 0), 1_100);
+    }
+
+    #[test]
+    fn an_empty_gallery_needs_nothing() {
+        assert_eq!(required_free_bytes(0, 2), 0);
+    }
+
+    #[test]
+    fn a_pathological_size_saturates_instead_of_wrapping() {
+        // u64 overflow would wrap to a TINY requirement and authorise the exact write we're
+        // guarding against — the failure mode must be "refuse", never "wrap and allow".
+        assert_eq!(required_free_bytes(u64::MAX, 2), u64::MAX);
+    }
+}

backend/src/services/imaging.rs

@@ -0,0 +1,263 @@
+//! Shared image decoding.
+//!
+//! Exists so there is exactly ONE way to turn a file on disk into a `DynamicImage` in this
+//! codebase. Two properties have to hold everywhere an image is decoded, and both were
+//! previously re-derived per call site — which is how they drifted apart:
+//!
+//! - **EXIF orientation must be applied.** Phones do not rotate sensor data; they record how
+//!   the camera was held in a tag and store the pixels as shot. `image::open` and
+//!   `ImageReader::decode` both hand back the raw pixels and ignore that tag, and re-encoding
+//!   to JPEG writes no EXIF, so the derivative is permanently sideways while the untouched
+//!   original still renders upright. The compression worker was fixed; the export worker was
+//!   not, so every portrait photo came out sideways in the keepsake's HTML viewer.
+//! - **Decode limits must be set.** The upload body cap bounds the file on disk, but a small
+//!   file can decode to enormous dimensions (a ~1 MB image expanding to 50k×50k px), OOM-ing
+//!   the box. `image::open` applies NO limits at all, so the export path was also decoding
+//!   arbitrary user-supplied images unbounded.
+
+use anyhow::{Context, Result};
+use image::{DynamicImage, ImageDecoder};
+use std::path::Path;
+
+/// Bounds for any decode of user-supplied image data. The per-axis cap covers any real phone
+/// photo; `max_alloc` bounds the decoded buffer — but only because `decode_oriented` reserves
+/// against it explicitly, see there.
+///
+/// Sized against the deployment: the app container is capped at 1 GiB and the compression
+/// worker runs `compression_concurrency` decodes at once (default 2), so 256 MiB per decode
+/// leaves headroom for the resize buffers and the runtime.
+fn decode_limits() -> image::Limits {
+    let mut limits = image::Limits::default();
+    limits.max_image_width = Some(12_000);
+    limits.max_image_height = Some(12_000);
+    limits.max_alloc = Some(256 * 1024 * 1024);
+    limits
+}
+
+/// True when re-running the exact same work on the exact same bytes cannot possibly
+/// succeed, so retrying only burns wall-clock and log noise.
+///
+/// Deliberately narrow. Only the `ImageError` variants that are a property of the *input*
+/// count: the file will not shrink, gain codec support, or un-corrupt itself between
+/// attempts. `IoError` is excluded on purpose — an ENOSPC while writing a derivative, or
+/// EMFILE under load, is exactly the transient case the retry exists for.
+pub fn is_permanent_image_error(err: &anyhow::Error) -> bool {
+    err.chain().any(|cause| {
+        matches!(
+            cause.downcast_ref::<image::ImageError>(),
+            Some(
+                image::ImageError::Limits(_)
+                    | image::ImageError::Unsupported(_)
+                    | image::ImageError::Decoding(_)
+            )
+        )
+    })
+}
+
+/// Build a decoder for `path` with the budget enforced, WITHOUT reading any pixels.
+///
+/// Single source of truth for "may this image be decoded at all": both the upload
+/// admission check and the compression worker go through here, so they cannot disagree
+/// about what is acceptable.
+fn decoder_within_budget(path: &Path) -> Result<impl image::ImageDecoder> {
+    let mut reader = image::ImageReader::open(path)
+        .context("failed to open image")?
+        .with_guessed_format()
+        .context("failed to read image header")?;
+    let mut limits = decode_limits();
+    reader.limits(limits.clone());
+
+    // We need `into_decoder` rather than `decode()` to read the EXIF orientation tag before
+    // the pixels are consumed. But the two are NOT equivalent on safety: `decode()` performs
+    //
+    //     limits.reserve(decoder.total_bytes())?;
+    //
+    // between building the decoder and reading the image, and `into_decoder()` skips it (the
+    // crate's own FIXME concedes `from_decoder` doesn't compensate). Nothing else enforces
+    // `max_alloc` — the JPEG decoder's `set_limits` only checks support and dimensions — so
+    // without the line below the budget is inert and the ONLY bound is the per-axis cap. That
+    // leaves 12000x12000 decodable at 412 MiB, and two concurrent at 824 MiB against a 1 GiB
+    // container. Re-add it, exactly as `decode()` does.
+    let mut decoder = reader.into_decoder().context("failed to decode image")?;
+    limits
+        .reserve(decoder.total_bytes())
+        .context("image too large to decode within the memory budget")?;
+    decoder
+        .set_limits(limits)
+        .context("image too large to decode within the memory budget")?;
+    Ok(decoder)
+}
+
+/// Megapixels an image would decode to, or `None` if its header can't be read. Used only
+/// to put a concrete number in the message the guest sees.
+pub fn megapixels(path: &Path) -> Option<f64> {
+    let reader = image::ImageReader::open(path)
+        .ok()?
+        .with_guessed_format()
+        .ok()?;
+    let (w, h) = reader.into_dimensions().ok()?;
+    Some(f64::from(w) * f64::from(h) / 1_000_000.0)
+}
+
+/// True when an image cannot be decoded specifically because it would exceed the memory
+/// budget — read from the header, no pixels touched.
+///
+/// Called at upload admission so a guest who sends a 100 MP photo is told at the door, with
+/// a reason they can act on, instead of the upload being accepted with a 201 and then
+/// silently soft-deleted minutes later when the worker gives up on it.
+///
+/// Deliberately narrow: ONLY the budget. A corrupt, truncated or unsupported file also
+/// fails to build a decoder, but rejecting those here would change a contract the
+/// adversarial suite pins on purpose — acceptance follows the magic bytes, and a payload
+/// with a valid JPEG header is accepted regardless of what follows it. Those go to the
+/// compression worker as before, which handles them gracefully and (since the retry
+/// classifier) no longer burns backoff on them.
+pub fn exceeds_decode_budget(path: &Path) -> bool {
+    match decoder_within_budget(path) {
+        Ok(_) => false,
+        Err(e) => e.chain().any(|cause| {
+            matches!(
+                cause.downcast_ref::<image::ImageError>(),
+                Some(image::ImageError::Limits(_))
+            )
+        }),
+    }
+}
+
+/// Decode an image from disk with decompression-bomb limits applied and its EXIF
+/// orientation baked into the pixels.
+///
+/// Blocking — call inside `spawn_blocking`.
+pub fn decode_oriented(path: &Path) -> Result<DynamicImage> {
+    let mut decoder = decoder_within_budget(path)?;
+
+    // Cheap, and it happens BEFORE any pixels are read: an oversized image costs a header
+    // parse, not an allocation.
+    let orientation = decoder
+        .orientation()
+        .unwrap_or(image::metadata::Orientation::NoTransforms);
+    let mut img = DynamicImage::from_decoder(decoder).context("failed to decode image")?;
+    img.apply_orientation(orientation);
+    Ok(img)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Shared with the e2e suite rather than duplicating 568 KiB of binary: the same file
+    /// drives `02-upload/oversized-image` so both layers assert on one artefact.
+    const HUGE: &str = concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../e2e/fixtures/media/huge-99mp.jpg"
+    );
+
+    #[test]
+    fn rejects_an_image_that_would_blow_the_allocation_budget() {
+        // 11000x9000 = 99 MP. Deliberately UNDER the 12000px per-axis cap, so the axis check
+        // cannot reject it — the allocation budget is the only thing that can, which is
+        // exactly what makes this a regression test rather than a restatement of the axis cap.
+        // 283 MiB decoded as RGB8 against a 256 MiB budget, from 568 KiB on disk.
+        //
+        // This failed before the guard was restored: `ImageReader::decode` performs
+        // `limits.reserve(decoder.total_bytes())`, and `into_decoder()` — which we need for
+        // the EXIF tag — skips it, so `max_alloc` was inert and this decoded happily.
+        // Map the Ok arm to its dimensions first: on failure `expect_err` Debug-prints the
+        // value, and Debug on a DynamicImage dumps every pixel — 283 MiB of output.
+        let err = decode_oriented(Path::new(HUGE))
+            .map(|img| (img.width(), img.height()))
+            .expect_err("a 99 MP image must be refused, not allocated");
+        let msg = format!("{err:#}");
+        assert!(
+            msg.to_lowercase().contains("limit") || msg.to_lowercase().contains("memory"),
+            "expected a limits error, got: {msg}"
+        );
+    }
+
+    #[test]
+    fn an_oversized_image_is_a_permanent_failure() {
+        // The retry loop must not burn 2s + 4s of backoff on this: the file will not shrink
+        // between attempts, so all three attempts reach the identical conclusion.
+        let err = decode_oriented(Path::new(HUGE))
+            .map(|img| (img.width(), img.height()))
+            .expect_err("fixture must exceed the budget");
+        assert!(
+            is_permanent_image_error(&err),
+            "a Limits error can never succeed on retry: {err:#}"
+        );
+    }
+
+    #[test]
+    fn a_plain_io_error_is_not_permanent() {
+        // The mirror that keeps the classifier honest. ENOSPC while writing a derivative, or
+        // EMFILE under load, is exactly what the retry exists for — misclassifying those as
+        // permanent would turn a transient blip back into the data loss round 1 fixed.
+        let err = decode_oriented(Path::new("/nonexistent/definitely-not-here.jpg"))
+            .map(|img| (img.width(), img.height()))
+            .expect_err("a missing file must error");
+        assert!(
+            !is_permanent_image_error(&err),
+            "an IO error must stay retryable: {err:#}"
+        );
+    }
+
+    #[test]
+    fn admission_rejects_only_the_over_budget_case() {
+        // Admission and processing must agree about SIZE — a photo accepted at the door and
+        // then rejected by the worker for being too big is the failure this pair prevents.
+        assert!(
+            exceeds_decode_budget(Path::new(HUGE)),
+            "admission must reject what the decoder rejects for size"
+        );
+        let ordinary = concat!(
+            env!("CARGO_MANIFEST_DIR"),
+            "/../e2e/fixtures/media/portrait-exif6.jpg"
+        );
+        assert!(
+            !exceeds_decode_budget(Path::new(ordinary)),
+            "admission must accept an ordinary photo"
+        );
+    }
+
+    #[test]
+    fn admission_does_not_reject_a_merely_undecodable_file() {
+        // The narrowing that keeps the adversarial contract intact: a payload with valid
+        // JPEG magic bytes and nothing behind them cannot be decoded, but acceptance follows
+        // the magic bytes by design (07-adversarial/file-upload-attacks). It is the worker's
+        // job to fail it, not admission's — admission is only the resource guard.
+        let dir = std::env::temp_dir().join("eventsnap-imaging-test");
+        std::fs::create_dir_all(&dir).expect("tmp dir");
+        let stub = dir.join("magic-only.jpg");
+        let mut bytes = vec![0u8; 1024];
+        bytes[..3].copy_from_slice(&[0xFF, 0xD8, 0xFF]);
+        std::fs::write(&stub, &bytes).expect("write stub");
+
+        assert!(
+            !exceeds_decode_budget(&stub),
+            "a corrupt file is not an over-budget file"
+        );
+        assert!(
+            decode_oriented(&stub)
+                .map(|i| (i.width(), i.height()))
+                .is_err(),
+            "...but it must still fail in the worker"
+        );
+        let _ = std::fs::remove_file(&stub);
+    }
+
+    #[test]
+    fn still_decodes_an_ordinary_photo_and_applies_orientation() {
+        // The guard must not have become a blanket refusal. This fixture is 40x20 stored with
+        // EXIF Orientation=6, so a correct decode returns it rotated to 20x40 portrait.
+        let path = concat!(
+            env!("CARGO_MANIFEST_DIR"),
+            "/../e2e/fixtures/media/portrait-exif6.jpg"
+        );
+        let img = decode_oriented(Path::new(path)).expect("an ordinary photo must decode");
+        assert_eq!(
+            (img.width(), img.height()),
+            (20, 40),
+            "EXIF orientation must still be applied after restoring the guard"
+        );
+    }
+}

backend/src/services/maintenance.rs

@@ -9,10 +9,13 @@
 //!    users staring at a spinner. Resetting them on startup recovers gracefully.
 //!
 //! 2. **Periodic tasks** — pruning that should happen "every hour" rather than per
-//!    request: expired sessions (otherwise the table grows unboundedly), and the
+//!    request: expired sessions (otherwise the table grows unboundedly), the
 //!    rate-limiter's in-memory windows (so keys for IPs that left long ago don't
-//!    accumulate).
+//!    accumulate), and the media of soft-deleted uploads — both the ones whose compression
+//!    permanently failed and the ones a guest or host deliberately removed — which are
+//!    retained for a recovery window and then reclaimed.
 
+use std::path::PathBuf;
 use std::time::Duration;
 
 use sqlx::PgPool;
@@ -20,6 +23,42 @@ use sqlx::PgPool;
 use crate::services::rate_limiter::RateLimiter;
 use crate::services::sse_tickets::SseTicketStore;
 
+/// How long a permanently-failed upload's original is kept on disk before it is
+/// reclaimed.
+///
+/// The compression worker stops deleting originals on failure — a transient error must
+/// never destroy the guest's only copy of a photo they can't retake. But the row is
+/// soft-deleted and the uploader's quota IS refunded, so without a sweep those bytes are
+/// invisible, unowned, and free: a reproducible codec failure lets one guest accumulate
+/// orphans at no personal cost, and because `active_uploaders` counts only users with
+/// non-deleted uploads, dropping out of that count actually RAISES everyone's per-user
+/// ceiling while the disk gets fuller.
+///
+/// Two weeks is comfortably longer than any single event, so an operator investigating a
+/// failed upload still has the file, while the leak stays bounded.
+const FAILED_ORIGINAL_RETENTION_DAYS: i64 = 14;
+
+/// How long a DELIBERATELY deleted upload's files are kept before they are reclaimed.
+///
+/// The same leak, reached by the ordinary path rather than the exceptional one.
+/// `soft_delete_in_event` stamps `deleted_at` and refunds `total_upload_bytes`, but nothing ever
+/// removed the bytes — so the quota stopped bounding the disk. Upload 500 MB, delete, quota is back
+/// to zero, upload another 500 MB: not an attack, just a guest curating their camera roll, which is
+/// what people do. The host then sees guests hitting "Du hast dein Upload-Limit erreicht" while the
+/// admin widget shows a disk full of files no upload row points at, and the quota message is
+/// actively misleading because the space really is gone — just not to anyone the accounting can
+/// name.
+///
+/// Much shorter than the failure window on purpose. Fourteen days outlives the whole event, so a
+/// deliberate delete would never reclaim anything while it mattered. A day still gives an operator
+/// a recovery window for a mis-tap.
+///
+/// NOTE what this does NOT do: within the window the bytes are still spent and still unaccounted,
+/// so a guest deleting and re-uploading through an eight-hour event can outrun the sweep. Bounding
+/// that would mean holding the quota until the file is actually reclaimed rather than refunding at
+/// `deleted_at` — a deliberate trade, and the reason the low-disk warning exists.
+const DELETED_UPLOAD_RETENTION_HOURS: i64 = 24;
+
 /// Reset rows left in flight by a previous crashed instance. Run once on startup,
 /// before the HTTP server starts taking requests, so users never observe the
 /// half-state.
@@ -87,7 +126,12 @@ pub async fn startup_recovery(pool: &PgPool) {
 /// - drops expired SSE tickets (30s TTL but the map keeps the slot until pruned)
 ///
 /// Cadence is 1h — fine for both jobs at our scale.
-pub fn spawn_periodic_tasks(pool: PgPool, rate_limiter: RateLimiter, sse_tickets: SseTicketStore) {
+pub fn spawn_periodic_tasks(
+    pool: PgPool,
+    rate_limiter: RateLimiter,
+    sse_tickets: SseTicketStore,
+    media_path: PathBuf,
+) {
     tokio::spawn(async move {
         let mut tick = tokio::time::interval(Duration::from_secs(3600));
         // Fire the first tick immediately, then hourly.
@@ -95,12 +139,117 @@ pub fn spawn_periodic_tasks(pool: PgPool, rate_limiter: RateLimiter, sse_tickets
         loop {
             tick.tick().await;
             cleanup_sessions(&pool).await;
+            cleanup_deleted_media(&pool, &media_path).await;
             rate_limiter.prune();
             sse_tickets.prune();
         }
     });
 }
 
+/// Reclaim the media of soft-deleted uploads once they are past their retention window.
+///
+/// ONLY ever touches rows with `deleted_at IS NOT NULL`, so it can never reach a live upload. Two
+/// classes, two windows, because the two deletes mean different things:
+///
+/// - a compression failure the guest didn't ask for and may want investigated —
+///   [`FAILED_ORIGINAL_RETENTION_DAYS`];
+/// - a deliberate removal by the guest or the host — [`DELETED_UPLOAD_RETENTION_HOURS`].
+///
+/// ALL FOUR paths are reclaimed, not just the original. The previous version cleared
+/// `original_path` alone, which was right for its only case (a failed compression produces no
+/// derivatives) but wrong the moment the sweep reaches a successfully processed upload: preview,
+/// display and thumbnail are each a separate file on disk, none of them counted in
+/// `original_size_bytes`, and nothing else ever removed them.
+///
+/// Every column is cleared in the same pass, which makes the sweep idempotent and stops a later run
+/// re-reporting files that are already gone. The ROW is kept: it is the audit trail, it costs a few
+/// hundred bytes, and `backfill_stale_derivatives` is guarded on `deleted_at IS NULL` so a nulled
+/// `preview_path` can never make it regenerate what was just reclaimed.
+async fn cleanup_deleted_media(pool: &PgPool, media_path: &std::path::Path) {
+    type Row = (
+        uuid::Uuid,
+        String,
+        Option<String>,
+        Option<String>,
+        Option<String>,
+    );
+    let rows = sqlx::query_as::<_, Row>(
+        "SELECT id, original_path, preview_path, display_path, thumbnail_path FROM upload
+         WHERE deleted_at IS NOT NULL
+           AND CASE WHEN compression_status = 'failed'
+                    THEN deleted_at < NOW() - ($1 || ' days')::interval
+                    ELSE deleted_at < NOW() - ($2 || ' hours')::interval
+               END
+           AND (original_path <> '' OR preview_path IS NOT NULL
+                OR display_path IS NOT NULL OR thumbnail_path IS NOT NULL)",
+    )
+    .bind(FAILED_ORIGINAL_RETENTION_DAYS.to_string())
+    .bind(DELETED_UPLOAD_RETENTION_HOURS.to_string())
+    .fetch_all(pool)
+    .await;
+
+    let rows = match rows {
+        Ok(r) => r,
+        Err(e) => {
+            tracing::warn!(error = ?e, "deleted-media sweep query failed");
+            return;
+        }
+    };
+    if rows.is_empty() {
+        return;
+    }
+
+    let mut reclaimed = 0usize;
+    for (id, original, preview, display, thumbnail) in rows {
+        let paths: Vec<String> = std::iter::once(original)
+            .filter(|p| !p.is_empty())
+            .chain([preview, display, thumbnail].into_iter().flatten())
+            .collect();
+
+        // All-or-nothing per row: the columns are only cleared once every file for that upload is
+        // gone. Clearing after a partial success would strand the survivors with nothing pointing
+        // at them — the same unowned-bytes state this sweep exists to drain.
+        let mut all_gone = true;
+        for rel in &paths {
+            let absolute = media_path.join(rel);
+            match tokio::fs::remove_file(&absolute).await {
+                Ok(()) => reclaimed += 1,
+                // Already gone (manual cleanup, restored backup) — still counts as reclaimed for
+                // the purpose of clearing the columns, or the row is re-selected every hour forever.
+                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+                Err(e) => {
+                    tracing::warn!(error = ?e, %id, path = %absolute.display(),
+                        "could not reclaim deleted media; leaving the row for the next sweep");
+                    all_gone = false;
+                }
+            }
+        }
+        if !all_gone {
+            continue;
+        }
+
+        if let Err(e) = sqlx::query(
+            "UPDATE upload SET original_path = '', preview_path = NULL,
+                    display_path = NULL, thumbnail_path = NULL
+             WHERE id = $1",
+        )
+        .bind(id)
+        .execute(pool)
+        .await
+        {
+            tracing::warn!(error = ?e, %id, "reclaimed the files but could not clear the paths");
+        }
+    }
+
+    if reclaimed > 0 {
+        tracing::info!(
+            "reclaimed {reclaimed} file(s) from soft-deleted uploads (deliberate deletes after \
+             {DELETED_UPLOAD_RETENTION_HOURS}h, compression failures after \
+             {FAILED_ORIGINAL_RETENTION_DAYS}d)"
+        );
+    }
+}
+
 async fn cleanup_sessions(pool: &PgPool) {
     match sqlx::query("DELETE FROM session WHERE expires_at < NOW() - INTERVAL '1 day'")
         .execute(pool)

backend/src/services/mod.rs

@@ -2,6 +2,7 @@ pub mod compression;
 pub mod config;
 pub mod disk;
 pub mod export;
+pub mod imaging;
 pub mod maintenance;
 pub mod rate_limiter;
 pub mod sse_tickets;

backend/src/services/rate_limiter.rs

@@ -17,13 +17,14 @@ impl RateLimiter {
         }
     }
 
-    /// Returns `true` if the request is allowed, `false` if rate-limited.
-    pub fn check(&self, key: impl Into<String>, max: usize, window: Duration) -> bool {
-        self.check_with_retry(key, max, window).is_ok()
-    }
-
     /// Returns `Ok(())` if allowed, `Err(retry_after_secs)` if rate-limited.
     /// `retry_after_secs` is how long until the oldest slot in the window expires.
+    ///
+    /// This is deliberately the ONLY entry point. There used to be a `check()` wrapper
+    /// returning a plain bool, and 7 of the 8 call sites used it and then hard-coded
+    /// `None` for the response's `Retry-After` — so a throttled client was told to back
+    /// off but never for how long. Forcing every caller through the `Result` makes the
+    /// retry delay impossible to discard by accident.
     pub fn check_with_retry(
         &self,
         key: impl Into<String>,
@@ -84,6 +85,11 @@ impl RateLimiter {
 /// appends is the real client. A client can prepend arbitrary spoofed values to
 /// the left of XFF to dodge throttles — those are ignored here. This assumes
 /// exactly one trusted proxy (Caddy); revisit if that changes.
+///
+/// Pass the peer address as `fallback`, never a constant. Every caller used to pass
+/// the literal `"unknown"`, so any request that arrived without XFF — i.e. anything
+/// reaching the app directly rather than through Caddy — shared ONE bucket with every
+/// other such request, turning the limiter into a self-inflicted global throttle.
 pub fn client_ip(headers: &axum::http::HeaderMap, fallback: &str) -> String {
     headers
         .get("x-forwarded-for")
@@ -104,29 +110,35 @@ mod tests {
     #[test]
     fn allows_up_to_max_then_blocks() {
         let rl = RateLimiter::new();
-        assert!(rl.check("k", 3, MIN));
-        assert!(rl.check("k", 3, MIN));
-        assert!(rl.check("k", 3, MIN));
-        assert!(!rl.check("k", 3, MIN), "the 4th request must be blocked");
+        assert!(rl.check_with_retry("k", 3, MIN).is_ok());
+        assert!(rl.check_with_retry("k", 3, MIN).is_ok());
+        assert!(rl.check_with_retry("k", 3, MIN).is_ok());
+        assert!(
+            rl.check_with_retry("k", 3, MIN).is_err(),
+            "the 4th request must be blocked"
+        );
     }
 
     #[test]
     fn keys_are_independent() {
         let rl = RateLimiter::new();
-        assert!(rl.check("a", 1, MIN));
-        assert!(!rl.check("a", 1, MIN));
-        assert!(rl.check("b", 1, MIN), "a different key has its own window");
+        assert!(rl.check_with_retry("a", 1, MIN).is_ok());
+        assert!(rl.check_with_retry("a", 1, MIN).is_err());
+        assert!(
+            rl.check_with_retry("b", 1, MIN).is_ok(),
+            "a different key has its own window"
+        );
     }
 
     #[test]
     fn window_slides_and_allows_again_after_expiry() {
         let rl = RateLimiter::new();
         let w = Duration::from_millis(40);
-        assert!(rl.check("k", 1, w));
-        assert!(!rl.check("k", 1, w));
+        assert!(rl.check_with_retry("k", 1, w).is_ok());
+        assert!(rl.check_with_retry("k", 1, w).is_err());
         std::thread::sleep(Duration::from_millis(55));
         assert!(
-            rl.check("k", 1, w),
+            rl.check_with_retry("k", 1, w).is_ok(),
             "the slot should expire once the window passes"
         );
     }
@@ -191,10 +203,13 @@ mod tests {
     #[test]
     fn clear_resets_every_window() {
         let rl = RateLimiter::new();
-        assert!(rl.check("k", 1, MIN));
-        assert!(!rl.check("k", 1, MIN));
+        assert!(rl.check_with_retry("k", 1, MIN).is_ok());
+        assert!(rl.check_with_retry("k", 1, MIN).is_err());
         rl.clear();
-        assert!(rl.check("k", 1, MIN), "clear() must free the window");
+        assert!(
+            rl.check_with_retry("k", 1, MIN).is_ok(),
+            "clear() must free the window"
+        );
     }
 
     /// `prune()` is a memory-leak guard: without it a long-lived process keeps one HashMap
@@ -216,7 +231,7 @@ mod tests {
             .insert("stale".to_string(), vec![ancient]);
 
         // ...alongside a key that is still inside its window.
-        assert!(rl.check("live", 5, MIN));
+        assert!(rl.check_with_retry("live", 5, MIN).is_ok());
         assert_eq!(rl.windows.lock().unwrap().len(), 2);
 
         rl.prune();
@@ -239,13 +254,13 @@ mod tests {
         // prune() dropped live keys, every background sweep would hand attackers a fresh
         // budget.
         let rl = RateLimiter::new();
-        assert!(rl.check("k", 1, MIN));
-        assert!(!rl.check("k", 1, MIN));
+        assert!(rl.check_with_retry("k", 1, MIN).is_ok());
+        assert!(rl.check_with_retry("k", 1, MIN).is_err());
 
         rl.prune();
 
         assert!(
-            !rl.check("k", 1, MIN),
+            rl.check_with_retry("k", 1, MIN).is_err(),
             "prune() must not clear a window that is still active"
         );
     }

backend/static/export-viewer/_app/env.js

@@ -1 +0,0 @@
-export const env={}

backend/static/export-viewer/_app/immutable/chunks/BJ__EZ0W.js

@@ -1 +0,0 @@
-import{u as o,n as t,o as c}from"./CcONa1Mr.js";function u(e){throw new Error("https://svelte.dev/e/lifecycle_outside_component")}function r(e){t===null&&u(),o(()=>{const n=c(e);if(typeof n=="function")return n})}export{r as o};

backend/static/export-viewer/_app/immutable/chunks/BRDva_z9.js

@@ -1 +0,0 @@
-import{f as l,g as o,p as u,i as n,j as d,k as m,h as p,e as _,m as v,l as k}from"./CcONa1Mr.js";class w{anchor;#t=new Map;#s=new Map;#e=new Map;#i=new Set;#f=!0;constructor(t,s=!0){this.anchor=t,this.#f=s}#a=t=>{if(this.#t.has(t)){var s=this.#t.get(t),e=this.#s.get(s);if(e)l(e),this.#i.delete(s);else{var f=this.#e.get(s);f&&(this.#s.set(s,f.effect),this.#e.delete(s),f.fragment.lastChild.remove(),this.anchor.before(f.fragment),e=f.effect)}for(const[i,a]of this.#t){if(this.#t.delete(i),i===t)break;const r=this.#e.get(a);r&&(o(r.effect),this.#e.delete(a))}for(const[i,a]of this.#s){if(i===s||this.#i.has(i))continue;const r=()=>{if(Array.from(this.#t.values()).includes(i)){var c=document.createDocumentFragment();v(a,c),c.append(n()),this.#e.set(i,{effect:a,fragment:c})}else o(a);this.#i.delete(i),this.#s.delete(i)};this.#f||!e?(this.#i.add(i),u(a,r,!1)):r()}}};#r=t=>{this.#t.delete(t);const s=Array.from(this.#t.values());for(const[e,f]of this.#e)s.includes(e)||(o(f.effect),this.#e.delete(e))};ensure(t,s){var e=m,f=k();if(s&&!this.#s.has(t)&&!this.#e.has(t))if(f){var i=document.createDocumentFragment(),a=n();i.append(a),this.#e.set(t,{effect:d(()=>s(a)),fragment:i})}else this.#s.set(t,d(()=>s(this.anchor)));if(this.#t.set(e,t),f){for(const[r,h]of this.#s)r===t?e.unskip_effect(h):e.skip_effect(h);for(const[r,h]of this.#e)r===t?e.unskip_effect(h.effect):e.skip_effect(h.effect);e.oncommit(this.#a),e.ondiscard(this.#r)}else p&&(this.anchor=_),this.#a(e)}}export{w as B};

backend/static/export-viewer/_app/immutable/chunks/Bxn6SmGf.js

@@ -1 +0,0 @@
-import{b as c,h as o,a as l,E as b,r as p,s as v,c as g,d,e as m}from"./CcONa1Mr.js";import{B as y}from"./BRDva_z9.js";function k(f,h,_=!1){var n;o&&(n=m,l());var s=new y(f),u=_?b:0;function t(a,r){if(o){var e=p(n);if(a!==parseInt(e.substring(1))){var i=v();g(i),s.anchor=i,d(!1),s.ensure(a,r),d(!0);return}}s.ensure(a,r)}c(()=>{var a=!1;h((r,e=0)=>{a=!0,t(e,r)}),a||t(-1,null)},u)}export{k as i};

backend/static/export-viewer/_app/immutable/chunks/RsTAN2PN.js

@@ -1 +0,0 @@
-import{A as v,i as d,B as l,C as u,D as T,T as p,F as h,h as i,e as s,R as E,a as y,G as g,c as w,H as N}from"./CcONa1Mr.js";const A=globalThis?.window?.trustedTypes&&globalThis.window.trustedTypes.createPolicy("svelte-trusted-html",{createHTML:t=>t});function M(t){return A?.createHTML(t)??t}function x(t){var r=v("template");return r.innerHTML=M(t.replaceAll("<!>","<!---->")),r.content}function n(t,r){var e=l;e.nodes===null&&(e.nodes={start:t,end:r,a:null,t:null})}function b(t,r){var e=(r&p)!==0,f=(r&h)!==0,a,_=!t.startsWith("<!>");return()=>{if(i)return n(s,null),s;a===void 0&&(a=x(_?t:"<!>"+t),e||(a=u(a)));var o=f||T?document.importNode(a,!0):a.cloneNode(!0);if(e){var c=u(o),m=o.lastChild;n(c,m)}else n(o,o);return o}}function C(t=""){if(!i){var r=d(t+"");return n(r,r),r}var e=s;return e.nodeType!==g?(e.before(e=d()),w(e)):N(e),n(e,e),e}function O(){if(i)return n(s,null),s;var t=document.createDocumentFragment(),r=document.createComment(""),e=d();return t.append(r,e),n(r,e),t}function P(t,r){if(i){var e=l;((e.f&E)===0||e.nodes.end===null)&&(e.nodes.end=s),y();return}t!==null&&t.before(r)}const L="5";typeof window<"u"&&((window.__svelte??={}).v??=new Set).add(L);export{P as a,n as b,O as c,b as f,C as t};

backend/static/export-viewer/_app/immutable/entry/start.YjNZv4co.js

@@ -1 +0,0 @@
-import{l as o,a as r}from"../chunks/eAGLaJx1.js";export{o as load_css,r as start};

backend/static/export-viewer/_app/immutable/nodes/0.DLesTSIe.js

@@ -1 +0,0 @@
-import{c as s,a as c}from"../chunks/RsTAN2PN.js";import{b as l,E as p,t as i}from"../chunks/CcONa1Mr.js";import{B as m}from"../chunks/BRDva_z9.js";function u(n,r,...e){var o=new m(n);l(()=>{const t=r()??null;o.ensure(t,t&&(a=>t(a,...e)))},p)}const f=!0,_=!1,g=Object.freeze(Object.defineProperty({__proto__:null,prerender:f,ssr:_},Symbol.toStringTag,{value:"Module"}));function h(n,r){var e=s(),o=i(e);u(o,()=>r.children),c(n,e)}export{h as component,g as universal};

backend/static/export-viewer/_app/immutable/nodes/1.D6Kk4lDA.js

@@ -1 +0,0 @@
-import{a as i,f as h}from"../chunks/RsTAN2PN.js";import{q as g,t as v,v as d,w as l,x as s,y as a,z as x}from"../chunks/CcONa1Mr.js";import{s as o}from"../chunks/Bb9JxzU7.js";import{s as _,p}from"../chunks/eAGLaJx1.js";const $={get error(){return p.error},get status(){return p.status}};_.updated.check;const m=$;var k=h("<h1> </h1> <p> </p>",1);function z(c,f){g(f,!0);var t=k(),r=v(t),n=s(r,!0);a(r);var e=x(r,2),u=s(e,!0);a(e),d(()=>{o(n,m.status),o(u,m.error?.message)}),i(c,t),l()}export{z as component};

backend/static/export-viewer/_app/version.json

@@ -1 +0,0 @@
-{"version":"1778876725548"}

backend/tests/common/mod.rs

@@ -255,3 +255,85 @@ pub async fn downloadable(pool: &PgPool, event_id: Uuid, export_type: &str) -> O
     .expect("downloadable")
     .flatten()
 }
+
+/// Insert an upload of `size` bytes, optionally already soft-deleted.
+pub async fn seed_upload(
+    pool: &PgPool,
+    event_id: Uuid,
+    user_id: Uuid,
+    size: i64,
+    deleted: bool,
+) -> Uuid {
+    sqlx::query_scalar(
+        "INSERT INTO upload (event_id, user_id, original_path, mime_type,
+                             original_size_bytes, deleted_at)
+         VALUES ($1, $2, 'originals/x.jpg', 'image/jpeg', $3,
+                 CASE WHEN $4 THEN NOW() ELSE NULL END)
+         RETURNING id",
+    )
+    .bind(event_id)
+    .bind(user_id)
+    .bind(size)
+    .bind(deleted)
+    .fetch_one(pool)
+    .await
+    .expect("seed upload")
+}
+
+/// Flip the moderation flags a ban sets.
+pub async fn set_user_moderation(pool: &PgPool, user_id: Uuid, banned: bool, hidden: bool) {
+    sqlx::query("UPDATE \"user\" SET is_banned = $2, uploads_hidden = $3 WHERE id = $1")
+        .bind(user_id)
+        .bind(banned)
+        .bind(hidden)
+        .execute(pool)
+        .await
+        .expect("set moderation");
+}
+
+/// SRC: `services/export.rs::query_uploads` — the visibility filter, verbatim, projected down to
+/// `(id, original_size_bytes)`. This is the row set that ACTUALLY lands in the archives.
+pub async fn export_visible_uploads(pool: &PgPool, event_id: Uuid) -> Vec<(Uuid, i64)> {
+    sqlx::query_as(
+        "SELECT u.id, u.original_size_bytes
+         FROM upload u
+         JOIN \"user\" usr ON usr.id = u.user_id
+         WHERE u.event_id = $1 AND u.deleted_at IS NULL
+           AND usr.uploads_hidden = FALSE AND usr.is_banned = FALSE
+         GROUP BY u.id, usr.display_name
+         ORDER BY u.created_at ASC",
+    )
+    .bind(event_id)
+    .fetch_all(pool)
+    .await
+    .expect("export_visible_uploads")
+}
+
+/// SRC: `services/export.rs::estimate_export_bytes` — verbatim.
+pub async fn estimate_export_bytes(pool: &PgPool, event_id: Uuid) -> i64 {
+    let (bytes,): (i64,) = sqlx::query_as(
+        "SELECT COALESCE(SUM(u.original_size_bytes), 0)::bigint
+           FROM upload u
+           JOIN \"user\" usr ON usr.id = u.user_id
+          WHERE u.event_id = $1 AND u.deleted_at IS NULL
+            AND usr.uploads_hidden = FALSE AND usr.is_banned = FALSE",
+    )
+    .bind(event_id)
+    .fetch_one(pool)
+    .await
+    .expect("estimate_export_bytes");
+    bytes
+}
+
+/// SRC: `services/export.rs::ensure_export_space` — the armed-job count, verbatim.
+pub async fn armed_job_count(pool: &PgPool, event_id: Uuid) -> i64 {
+    let (n,): (i64,) = sqlx::query_as(
+        "SELECT COUNT(*) FROM export_job
+          WHERE event_id = $1 AND status IN ('pending', 'running')",
+    )
+    .bind(event_id)
+    .fetch_one(pool)
+    .await
+    .expect("armed_job_count");
+    n
+}

backend/tests/export_preflight.rs

@@ -0,0 +1,154 @@
+//! DB-backed tests for the export disk preflight.
+//!
+//! The keepsake used to be built with NO free-space check at all, and the failure that produced was
+//! not "the export failed" but "the deliverable is stuck and the escape hatch needs the space that
+//! isn't there":
+//!
+//!   1. A takedown bumps the epoch and re-arms both halves.
+//!   2. The ZIP hits ENOSPC partway through a multi-GB write.
+//!   3. The job row is now `failed` at the CURRENT epoch, so readiness
+//!      (`epoch = event.export_epoch AND status = 'done'`) is false and `GET /export/zip` 404s —
+//!      while the last good archive sits on disk, unreferenced and unreachable.
+//!   4. `POST /host/export/rebuild` re-arms the same doomed write.
+//!
+//! Two changes close it: reclaim the superseded generation BEFORE building (so peak usage is one
+//! generation, not two) and refuse up front with a number the host can act on.
+//!
+//! What these tests pin is the ESTIMATE — the part that decides. The arithmetic on top of it lives
+//! in `services/export.rs`'s unit tests; the filesystem selection lives in `is_superseded_archive`.
+//! The risk here is drift: if `query_uploads` ever gains or loses a visibility predicate and
+//! `estimate_export_bytes` doesn't, the preflight silently sizes the wrong gallery. So rather than
+//! restating the filter, these assert the estimate against the row set the archive actually
+//! contains.
+
+mod common;
+
+use common::*;
+use sqlx::PgPool;
+
+/// The estimate must equal the sum over EXACTLY the rows `query_uploads` returns — computed from
+/// that row set, not from a restatement of its WHERE clause.
+///
+/// PREVENTS: the two queries drifting apart. An estimate that counts rows the archive skips is
+/// merely pessimistic; one that MISSES rows the archive writes under-reserves, which is the whole
+/// failure being guarded against.
+#[sqlx::test]
+async fn the_estimate_sums_exactly_the_rows_the_archive_will_contain(pool: PgPool) {
+    let event_id = seed_event(&pool, "wedding").await;
+
+    let visible = seed_user(&pool, event_id, "Anna").await;
+    let banned = seed_user(&pool, event_id, "Ben").await;
+    let hidden = seed_user(&pool, event_id, "Cara").await;
+
+    seed_upload(&pool, event_id, visible, 1_000, false).await;
+    seed_upload(&pool, event_id, visible, 2_500, false).await;
+    // Each of these is excluded from the archive by a DIFFERENT predicate.
+    seed_upload(&pool, event_id, visible, 9_000, true).await; // soft-deleted
+    seed_upload(&pool, event_id, banned, 9_000, false).await; // uploader banned
+    seed_upload(&pool, event_id, hidden, 9_000, false).await; // uploads hidden
+
+    set_user_moderation(&pool, banned, true, true).await;
+    set_user_moderation(&pool, hidden, false, true).await;
+
+    let rows = export_visible_uploads(&pool, event_id).await;
+    let expected: i64 = rows.iter().map(|(_, bytes)| bytes).sum();
+
+    assert_eq!(rows.len(), 2, "only Anna's two live uploads are archived");
+    assert_eq!(
+        estimate_export_bytes(&pool, event_id).await,
+        expected,
+        "the preflight must size the gallery the export will actually write"
+    );
+    assert_eq!(expected, 3_500);
+}
+
+/// An event with nothing to archive estimates zero rather than NULL.
+///
+/// PREVENTS: `SUM()` over no rows returning NULL and the decode blowing up — which would abort the
+/// export with a type error instead of building an (entirely legitimate) empty keepsake.
+#[sqlx::test]
+async fn an_empty_gallery_estimates_zero_not_null(pool: PgPool) {
+    let event_id = seed_event(&pool, "wedding").await;
+    assert_eq!(estimate_export_bytes(&pool, event_id).await, 0);
+
+    // And with a user who has uploaded nothing.
+    seed_user(&pool, event_id, "Anna").await;
+    assert_eq!(estimate_export_bytes(&pool, event_id).await, 0);
+}
+
+/// A release arms both halves, so the preflight sees a count of 2 and reserves for the pair.
+///
+/// PREVENTS: the concurrency under-reservation. `spawn_export_jobs` starts the ZIP and HTML workers
+/// at the same instant, and BOTH are gallery-sized (`Memories.zip` streams the original for every
+/// video and every image at or under 5 MB, all `Compression::Stored`). A worker reserving only for
+/// itself would see "it fits", its sibling would independently see the same, and together they
+/// would ENOSPC — which is why `required_free_bytes` multiplies by this count.
+#[sqlx::test]
+async fn a_release_arms_both_halves_so_the_preflight_reserves_for_two(pool: PgPool) {
+    let event_id = seed_event(&pool, "wedding").await;
+    let user = seed_user(&pool, event_id, "Anna").await;
+    seed_upload(&pool, event_id, user, 1_000, false).await;
+
+    assert_eq!(
+        armed_job_count(&pool, event_id).await,
+        0,
+        "nothing is armed before the release"
+    );
+
+    let epoch = release_gallery(&pool, "wedding").await.expect("released");
+    assert_eq!(
+        armed_job_count(&pool, event_id).await,
+        2,
+        "a release arms zip AND html — both compete for the same disk"
+    );
+
+    // A worker that has claimed its half is still competing; `running` must keep counting.
+    assert!(claim_job(&pool, event_id, "zip", epoch).await);
+    assert_eq!(
+        armed_job_count(&pool, event_id).await,
+        2,
+        "claiming moves pending -> running, which must not drop out of the reservation"
+    );
+
+    // Only a FINISHED half stops competing.
+    assert!(finalize_job(&pool, event_id, "zip", epoch, "exports/Gallery.zip").await);
+    assert_eq!(
+        armed_job_count(&pool, event_id).await,
+        1,
+        "a done half no longer needs space reserved for it"
+    );
+}
+
+/// A ViewerOnly regeneration re-arms only the HTML half, so the preflight reserves for one.
+///
+/// PREVENTS: over-reservation refusing a rebuild that fits perfectly well. Moderating a comment
+/// carries the finished ZIP forward untouched; demanding room for a second copy of it would fail
+/// the one operation that needs no new gallery-sized write at all.
+#[sqlx::test]
+async fn a_viewer_only_regeneration_reserves_for_one_half(pool: PgPool) {
+    let event_id = seed_event(&pool, "wedding").await;
+    let user = seed_user(&pool, event_id, "Anna").await;
+    seed_upload(&pool, event_id, user, 1_000, false).await;
+
+    let epoch = release_gallery(&pool, "wedding").await.expect("released");
+    for t in ["zip", "html"] {
+        assert!(claim_job(&pool, event_id, t, epoch).await);
+        assert!(finalize_job(&pool, event_id, t, epoch, &format!("exports/{t}")).await);
+    }
+    assert_eq!(armed_job_count(&pool, event_id).await, 0);
+
+    // A moderated comment: bump the epoch, carry the ZIP forward, re-arm only the viewer.
+    let (_, _, next) = bump_epoch(&pool, "wedding").await.expect("bumped");
+    assert!(
+        carry_zip_forward(&pool, event_id, next).await,
+        "the finished ZIP is re-stamped, not rebuilt"
+    );
+    let mut conn = pool.acquire().await.expect("acquire");
+    enqueue_types_at_epoch(&mut conn, event_id, next, &["html"]).await;
+
+    assert_eq!(
+        armed_job_count(&pool, event_id).await,
+        1,
+        "only the viewer is being rebuilt, so only one archive's worth of space is needed"
+    );
+}

backend/tests/failed_original_sweep.rs

@@ -0,0 +1,352 @@
+//! DB-backed tests for the deleted-media sweep (`services/maintenance.rs`).
+//!
+//! Context, in two halves.
+//!
+//! The compression worker deliberately no longer deletes an upload's original when its transcode
+//! fails — a transient ENOSPC or a codec panic must never destroy the only copy of a photo a guest
+//! cannot retake. But the row is soft-deleted and the uploader's quota IS refunded, so those bytes
+//! become invisible, unowned and free.
+//!
+//! The SAME hole was reachable by the ordinary path, and that one is not an edge case at all:
+//! `soft_delete_in_event` refunds `total_upload_bytes` on every guest or host delete and nothing
+//! removed the files, so the quota stopped bounding the disk. Upload 500 MB, delete, quota back to
+//! zero, upload another 500 MB — a guest curating their camera roll, which is what people do. The
+//! sweep used to reach only `compression_status = 'failed'`, so it never touched this case; the
+//! test below that now asserts an owner-deleted upload IS reclaimed is the one that used to assert
+//! the opposite.
+//!
+//! Two windows, because the two deletes mean different things: 14 days for a failure an operator
+//! may want to investigate, 24 hours for a removal someone asked for (14 days outlives the whole
+//! event, so a deliberate delete would never reclaim anything while it mattered).
+//!
+//! The selection predicate is the whole safety argument — it must reach both leftovers and never a
+//! live upload — so that is what these pin, following the same "reproduce the SQL verbatim" pattern
+//! as `upload_concurrency.rs`. `#[sqlx::test]` gives each test a fresh, migrated database.
+
+mod common;
+
+use common::*;
+use sqlx::PgPool;
+use uuid::Uuid;
+
+const FAILED_DAYS: i64 = 14;
+const DELETED_HOURS: i64 = 24;
+
+/// SRC: `services/maintenance.rs::cleanup_deleted_media` — the selection, verbatim.
+async fn sweep_selects(pool: &PgPool, failed_days: i64, deleted_hours: i64) -> Vec<Uuid> {
+    type Row = (Uuid, String, Option<String>, Option<String>, Option<String>);
+    sqlx::query_as::<_, Row>(
+        "SELECT id, original_path, preview_path, display_path, thumbnail_path FROM upload
+         WHERE deleted_at IS NOT NULL
+           AND CASE WHEN compression_status = 'failed'
+                    THEN deleted_at < NOW() - ($1 || ' days')::interval
+                    ELSE deleted_at < NOW() - ($2 || ' hours')::interval
+               END
+           AND (original_path <> '' OR preview_path IS NOT NULL
+                OR display_path IS NOT NULL OR thumbnail_path IS NOT NULL)",
+    )
+    .bind(failed_days.to_string())
+    .bind(deleted_hours.to_string())
+    .fetch_all(pool)
+    .await
+    .expect("sweep query")
+    .into_iter()
+    .map(|(id, ..)| id)
+    .collect()
+}
+
+/// Seed an upload aged `deleted_hours_ago` (None = live), with optional derivative paths.
+async fn seed_aged_upload(
+    pool: &PgPool,
+    event_id: Uuid,
+    user_id: Uuid,
+    status: &str,
+    deleted_hours_ago: Option<i64>,
+    original_path: &str,
+    derivatives: bool,
+) -> Uuid {
+    sqlx::query_scalar(
+        "INSERT INTO upload (event_id, user_id, original_path, mime_type, original_size_bytes,
+                             compression_status, deleted_at,
+                             preview_path, display_path, thumbnail_path)
+         VALUES ($1, $2, $3, 'image/jpeg', 1000, $4,
+                 CASE WHEN $5::bigint IS NULL THEN NULL
+                      ELSE NOW() - ($5::text || ' hours')::interval END,
+                 CASE WHEN $6 THEN 'previews/p.jpg' END,
+                 CASE WHEN $6 THEN 'displays/d.jpg' END,
+                 CASE WHEN $6 THEN 'thumbs/t.jpg' END)
+         RETURNING id",
+    )
+    .bind(event_id)
+    .bind(user_id)
+    .bind(original_path)
+    .bind(status)
+    .bind(deleted_hours_ago)
+    .bind(derivatives)
+    .fetch_one(pool)
+    .await
+    .expect("seed upload")
+}
+
+/// A live upload is untouchable no matter how the windows are configured.
+///
+/// PREVENTS: the catastrophic loosening. Everything else here is about reclaiming more; this is the
+/// one assertion that must never bend.
+#[sqlx::test]
+async fn a_live_upload_is_never_selected(pool: PgPool) {
+    let event_id = seed_event(&pool, "sweep-live").await;
+    let user_id = seed_user(&pool, event_id, "Sweeper").await;
+
+    for status in ["done", "failed", "processing", "pending"] {
+        let live = seed_aged_upload(
+            &pool,
+            event_id,
+            user_id,
+            status,
+            None,
+            "originals/e/live.jpg",
+            true,
+        )
+        .await;
+        assert!(
+            !sweep_selects(&pool, FAILED_DAYS, DELETED_HOURS)
+                .await
+                .contains(&live),
+            "a non-deleted upload with status {status} must never be swept"
+        );
+    }
+}
+
+/// THE FIX. An upload a guest or host deliberately deleted is reclaimed once past 24 hours.
+///
+/// PREVENTS: the regression back to a sweep scoped to `compression_status = 'failed'`, which is
+/// what let the quota stop bounding the disk. This assertion is the inverse of the one this file
+/// used to make.
+#[sqlx::test]
+async fn a_deliberately_deleted_upload_is_reclaimed_after_a_day(pool: PgPool) {
+    let event_id = seed_event(&pool, "sweep-deleted").await;
+    let user_id = seed_user(&pool, event_id, "Curator").await;
+
+    let deleted = seed_aged_upload(
+        &pool,
+        event_id,
+        user_id,
+        "done",
+        Some(48),
+        "originals/e/owner.jpg",
+        true,
+    )
+    .await;
+    // Still inside the window — a mis-tap is recoverable for a day.
+    let recent = seed_aged_upload(
+        &pool,
+        event_id,
+        user_id,
+        "done",
+        Some(2),
+        "originals/e/recent.jpg",
+        true,
+    )
+    .await;
+
+    let selected = sweep_selects(&pool, FAILED_DAYS, DELETED_HOURS).await;
+    assert!(
+        selected.contains(&deleted),
+        "a deliberate delete past the window must be reclaimed — this is the leak"
+    );
+    assert!(
+        !selected.contains(&recent),
+        "a delete inside the window keeps its recovery grace"
+    );
+}
+
+/// The two windows are independent: a failure is retained far longer than a deliberate delete.
+///
+/// PREVENTS: collapsing them into one. Applying 24h to failures would destroy the recovery window
+/// the retained-original fix exists to provide; applying 14 days to deliberate deletes would mean
+/// nothing is ever reclaimed during an event.
+#[sqlx::test]
+async fn the_two_retention_windows_do_not_bleed_into_each_other(pool: PgPool) {
+    let event_id = seed_event(&pool, "sweep-windows").await;
+    let user_id = seed_user(&pool, event_id, "Windows").await;
+
+    // 48h old: past the deliberate window, nowhere near the failure window.
+    let failed_recent = seed_aged_upload(
+        &pool,
+        event_id,
+        user_id,
+        "failed",
+        Some(48),
+        "originals/e/f-recent.jpg",
+        false,
+    )
+    .await;
+    let deleted_same_age = seed_aged_upload(
+        &pool,
+        event_id,
+        user_id,
+        "done",
+        Some(48),
+        "originals/e/d-same.jpg",
+        false,
+    )
+    .await;
+    // 30 days old: past both.
+    let failed_old = seed_aged_upload(
+        &pool,
+        event_id,
+        user_id,
+        "failed",
+        Some(30 * 24),
+        "originals/e/f-old.jpg",
+        false,
+    )
+    .await;
+
+    let selected = sweep_selects(&pool, FAILED_DAYS, DELETED_HOURS).await;
+    assert!(
+        !selected.contains(&failed_recent),
+        "a 2-day-old compression failure is still inside its 14-day recovery window"
+    );
+    assert!(
+        selected.contains(&deleted_same_age),
+        "a deliberate delete of the same age is past its 24-hour window"
+    );
+    assert!(
+        selected.contains(&failed_old),
+        "a 30-day-old failure is past both windows"
+    );
+}
+
+/// Boundary behaviour on both windows.
+#[sqlx::test]
+async fn retention_windows_are_honoured_at_the_boundary(pool: PgPool) {
+    let event_id = seed_event(&pool, "sweep-boundary").await;
+    let user_id = seed_user(&pool, event_id, "Boundary").await;
+
+    let cases = [
+        ("failed", 13 * 24, false, "13 days"),
+        ("failed", 15 * 24, true, "15 days"),
+        ("done", 23, false, "23 hours"),
+        ("done", 25, true, "25 hours"),
+    ];
+    for (status, hours, expected, label) in cases {
+        let id = seed_aged_upload(
+            &pool,
+            event_id,
+            user_id,
+            status,
+            Some(hours),
+            "originals/e/b.jpg",
+            false,
+        )
+        .await;
+        assert_eq!(
+            sweep_selects(&pool, FAILED_DAYS, DELETED_HOURS)
+                .await
+                .contains(&id),
+            expected,
+            "a {status} upload deleted {label} ago: expected swept={expected}"
+        );
+        sqlx::query("DELETE FROM upload WHERE id = $1")
+            .bind(id)
+            .execute(&pool)
+            .await
+            .expect("clean up");
+    }
+}
+
+/// A row is re-selected until EVERY one of its paths is cleared.
+///
+/// PREVENTS: two failures at once. The sweep used to clear `original_path` alone, which was right
+/// for its only case (a failed compression produces no derivatives) but leaves preview, display and
+/// thumbnail on disk the moment it reaches a successfully processed upload — three files per
+/// upload, none of them counted in `original_size_bytes`, that nothing else ever removes. And a row
+/// whose paths are all cleared must stop coming back, or every hourly tick logs a phantom reclaim
+/// forever.
+#[sqlx::test]
+async fn a_row_is_reselected_until_every_path_is_cleared(pool: PgPool) {
+    let event_id = seed_event(&pool, "sweep-idempotent").await;
+    let user_id = seed_user(&pool, event_id, "Idem").await;
+    let id = seed_aged_upload(
+        &pool,
+        event_id,
+        user_id,
+        "done",
+        Some(48),
+        "originals/e/once.jpg",
+        true,
+    )
+    .await;
+
+    assert_eq!(sweep_selects(&pool, FAILED_DAYS, DELETED_HOURS).await, [id]);
+
+    // Clearing only the original is NOT enough — the derivatives are still on disk.
+    sqlx::query("UPDATE upload SET original_path = '' WHERE id = $1")
+        .bind(id)
+        .execute(&pool)
+        .await
+        .expect("clear original");
+    assert_eq!(
+        sweep_selects(&pool, FAILED_DAYS, DELETED_HOURS).await,
+        [id],
+        "derivatives left behind must keep the row selected"
+    );
+
+    sqlx::query(
+        "UPDATE upload SET preview_path = NULL, display_path = NULL, thumbnail_path = NULL
+         WHERE id = $1",
+    )
+    .bind(id)
+    .execute(&pool)
+    .await
+    .expect("clear derivatives");
+    assert!(
+        sweep_selects(&pool, FAILED_DAYS, DELETED_HOURS)
+            .await
+            .is_empty(),
+        "a fully swept row must not come back"
+    );
+}
+
+/// The derivative backfill must never resurrect what the sweep just reclaimed.
+///
+/// PREVENTS: an interaction, not a bug in either piece. The sweep nulls `preview_path`, and
+/// `backfill_stale_derivatives` selects on `display_path IS NULL AND preview_path IS NOT NULL` —
+/// close enough that a future edit to either could have the backfill re-decode an original that is
+/// no longer on disk, on every boot. `deleted_at IS NULL` is what keeps them apart.
+#[sqlx::test]
+async fn the_backfill_ignores_swept_rows(pool: PgPool) {
+    let event_id = seed_event(&pool, "sweep-backfill").await;
+    let user_id = seed_user(&pool, event_id, "Backfill").await;
+    seed_aged_upload(
+        &pool,
+        event_id,
+        user_id,
+        "done",
+        Some(48),
+        "originals/e/gone.jpg",
+        true,
+    )
+    .await;
+
+    // SRC: `services/compression.rs::backfill_stale_derivatives` — the selection, verbatim.
+    let backfilled: Vec<(Uuid, String, String)> = sqlx::query_as(
+        "SELECT id, original_path, mime_type FROM upload
+             WHERE deleted_at IS NULL AND mime_type LIKE 'image/%'
+               AND original_path IS NOT NULL
+               AND (
+                     (display_path IS NULL AND preview_path IS NOT NULL)
+                  OR derivatives_rev < $1
+               )",
+    )
+    .bind(1i16)
+    .fetch_all(&pool)
+    .await
+    .expect("backfill query");
+
+    assert!(
+        backfilled.is_empty(),
+        "a soft-deleted row must be invisible to the backfill, before or after sweeping"
+    );
+}

docker-compose.dev.yml

@@ -11,3 +11,31 @@ services:
     # is tolerated (warned) rather than rejected.
     environment:
       APP_ENV: development
+      # `.env` sets DATABASE_URL to @localhost for the run-backend-natively workflow
+      # (the db port is published above for that). When the app runs IN a container,
+      # localhost is the app itself — point it at the `db` service instead. Creds are
+      # interpolated from .env so nothing is hardcoded.
+      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
+      # `.env` sets MEDIA_PATH to a HOST path (/home/fabi/EventSnap/media) for the
+      # run-backend-natively workflow. In a container that path doesn't exist and the
+      # app user can't create it from `/`, so every upload 500s with EACCES. The media
+      # volume is mounted at /media (see docker-compose.yml) — point the app there.
+      MEDIA_PATH: /media
+      # Recent Docker Compose interpolates env_file values, so the `$` segments of the
+      # bcrypt ADMIN_PASSWORD_HASH in .env get eaten (the salt reads as an unset var) —
+      # every admin login then 401s. Re-supply it here with `$` doubled to `$$` so Compose
+      # passes the literal hash. NOTE: production (docker-compose.yml + .env) has the SAME
+      # bug — escape the hash as `$$` in .env, or set it via `environment:` there too.
+      ADMIN_PASSWORD_HASH: "$$2b$$12$$PAteqCNpsbm6d0HTJcywfOaUovjAU.iNVlsL7EDYaRC/z4P/xv7ye"
+      # Smoke-testing the comment kill-switch: boot-time flag, so it needs a restart
+      # (not an admin-UI toggle). Backend rejects new comments (403) and the frontend
+      # hides the whole comment UI. Flip back to true (or drop this line) to restore.
+      COMMENTS_ENABLED: "false"
+
+  caddy:
+    # The prod caddy service has no env_file, so the Caddyfile's `{$DOMAIN}` expands
+    # to empty and the site block collapses into a malformed global block. Supply it
+    # for local dev (from .env → localhost, which Caddy serves with a local self-signed
+    # cert). NOTE: the prod compose likely needs DOMAIN wired to caddy too.
+    environment:
+      DOMAIN: ${DOMAIN}

docker-compose.yml

@@ -17,7 +17,15 @@ services:
     deploy:
       resources:
         limits:
-          memory: 512M
+          # 1G, not 512M. DATABASE_MAX_CONNECTIONS defaults to 30 for a ~100-guest event
+          # (feed polling + SSE + uploads at once), and 30 backends plus Postgres 16's
+          # default shared_buffers leaves very little headroom at 512M. An OOM here does
+          # not degrade one feature — it takes the event down, because every request
+          # path touches the database. Memory is the cheaper knob than shrinking the
+          # pool back and reintroducing the queueing it was raised to fix.
+          #
+          # Raising DATABASE_MAX_CONNECTIONS further means raising this too.
+          memory: 1G
 
   app:
     build:
@@ -29,6 +37,12 @@ services:
       # Activates the production secret guard in config.rs — refuses to boot with
       # placeholder JWT_SECRET / ADMIN_PASSWORD_HASH.
       APP_ENV: production
+      # The media volume is mounted at /media (below), so the app MUST write there.
+      # Pin it here rather than trusting .env: if MEDIA_PATH in .env points elsewhere
+      # (e.g. a host path used for running the backend natively) the container can't
+      # create it and every upload 500s with EACCES. `environment` overrides `env_file`,
+      # so this is authoritative for the container.
+      MEDIA_PATH: /media
     depends_on:
       db:
         condition: service_healthy
@@ -40,7 +54,11 @@ services:
     expose:
       - "3000"
     healthcheck:
-      test: ["CMD-SHELL", "wget -q -O- http://localhost:3000/health || exit 1"]
+      # Use 127.0.0.1, NOT localhost: the app binds IPv4 (0.0.0.0) but `localhost`
+      # resolves to ::1 (IPv6) first inside the container, so a localhost probe gets
+      # "connection refused" and the container never turns healthy — which would leave
+      # Caddy (gated on `condition: service_healthy` below) blocked forever on boot.
+      test: ["CMD-SHELL", "wget -q -O- http://127.0.0.1:3000/health || exit 1"]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -67,7 +85,9 @@ services:
     expose:
       - "3001"
     healthcheck:
-      test: ["CMD-SHELL", "wget -q -O- http://localhost:3001/ >/dev/null 2>&1 || exit 1"]
+      # 127.0.0.1, not localhost — see the app healthcheck note above (IPv4 bind vs
+      # ::1 resolution would leave this container permanently unhealthy).
+      test: ["CMD-SHELL", "wget -q -O- http://127.0.0.1:3001/ >/dev/null 2>&1 || exit 1"]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -80,6 +100,12 @@ services:
   caddy:
     image: caddy:2-alpine
     restart: unless-stopped
+    environment:
+      # The Caddyfile's site address is `{$DOMAIN}`, read from THIS container's env.
+      # Without it, `{$DOMAIN}` expands to empty, the site block collapses, and Caddy
+      # serves nothing / fails to obtain a TLS cert. `env_file` alone wouldn't help —
+      # Caddy needs it in `environment`, and this keeps the Caddyfile the single source.
+      DOMAIN: ${DOMAIN}
     ports:
       - "80:80"
       - "443:443"

e2e/Caddyfile.test

@@ -12,10 +12,17 @@
     # Mirror prod's security headers (minus HSTS, which is HTTPS-only).
     header {
         X-Content-Type-Options "nosniff"
-        X-Frame-Options "DENY"
         Referrer-Policy "strict-origin-when-cross-origin"
     }
 
+    # Mirror prod's export carve-out: the keepsake download targets a hidden
+    # same-origin iframe, and WebKit enforces XFO before Content-Disposition.
+    # Two disjoint matchers, not an override — see the comment in ../Caddyfile.
+    @framable path /api/v1/export/zip /api/v1/export/html
+    @not_framable not path /api/v1/export/zip /api/v1/export/html
+    header @framable X-Frame-Options "SAMEORIGIN"
+    header @not_framable X-Frame-Options "DENY"
+
     reverse_proxy /api/* app:3000
     reverse_proxy /media/* app:3000
     reverse_proxy /health app:3000

e2e/docker-compose.test.yml

@@ -42,11 +42,29 @@ services:
       EVENT_NAME: E2E Test Event
       APP_PORT: '3000'
       MEDIA_PATH: /media
+      # Exports MUST live outside MEDIA_PATH — see the note on the volume below and
+      # config.rs::validate. Omitting this left exports on the container's writable
+      # layer at the /exports default, so the test stack diverged from the prod layout
+      # it claims to mirror, and export-leak/export-video wrote real archives into
+      # ephemeral storage.
+      EXPORT_PATH: /exports
       SESSION_EXPIRY_DAYS: '30'
       EVENTSNAP_TEST_MODE: '1' # ENABLES /admin/__truncate — never set in prod
       RUST_LOG: eventsnap_backend=info,tower_http=warn
     volumes:
       - media_data:/media
+      # Separate volume, exactly as in production: a keepsake archive contains every
+      # photo in the event, so it is kept off the media tree.
+      - exports_data:/exports
+    # Mirror production's cap (docker-compose.yml). The test stack having NO memory limit is
+    # why an unbounded image decode was invisible here: a 99 MP upload that would OOM-kill the
+    # 1 GiB production container simply succeeded in CI. A test environment more generous than
+    # production cannot catch a resource bug — the same shape as WebKit being absent from CI
+    # and /health existing only in Caddyfile.test.
+    deploy:
+      resources:
+        limits:
+          memory: 1G
     expose:
       - '3000'
 
@@ -75,3 +93,4 @@ services:
 
 volumes:
   media_data:
+  exports_data:

e2e/fixtures/db.ts

@@ -54,6 +54,27 @@ export const db = {
     );
   },
 
+  async compressionStatus(uploadId: string): Promise<string | null> {
+    return withClient(async (c) => {
+      const r = await c.query<{ compression_status: string }>(
+        `SELECT compression_status FROM upload WHERE id = $1`,
+        [uploadId]
+      );
+      return r.rows[0]?.compression_status ?? null;
+    });
+  },
+
+  /** Which revision of the derivative pipeline produced this row's preview/display. */
+  async derivativesRev(uploadId: string): Promise<number | null> {
+    return withClient(async (c) => {
+      const r = await c.query<{ derivatives_rev: number }>(
+        `SELECT derivatives_rev FROM upload WHERE id = $1`,
+        [uploadId]
+      );
+      return r.rows[0]?.derivatives_rev ?? null;
+    });
+  },
+
   async countUploadsForUser(userId: string): Promise<number> {
     return withClient(async (c) => {
       const r = await c.query<{ count: string }>(
@@ -84,6 +105,20 @@ export const db = {
     });
   },
 
+  /**
+   * Overstate an upload's recorded size.
+   *
+   * The keepsake size estimate and the low-disk threshold are pure SQL over
+   * `original_size_bytes` — no file is read — so this is the lever for driving "the keepsake
+   * would not fit" without a genuinely full disk. The bytes on disk are unchanged; only the
+   * accounting the warning reads from moves.
+   */
+  async setUploadSizeBytes(uploadId: string, bytes: number) {
+    await withClient((c) =>
+      c.query(`UPDATE upload SET original_size_bytes = $2 WHERE id = $1`, [uploadId, bytes])
+    );
+  },
+
   async setExportReleased(slug: string, released: boolean) {
     await withClient((c) =>
       c.query(`UPDATE event SET export_released_at = $2 WHERE slug = $1`, [
@@ -121,7 +156,8 @@ export const db = {
   async fakeExportJob(
     eventSlug: string,
     type: 'zip' | 'html',
-    status: 'pending' | 'running' | 'done'
+    status: 'pending' | 'running' | 'done' | 'failed',
+    errorMessage: string | null = null
   ) {
     await withClient(async (c) => {
       const ev = await c.query<{ id: string; export_epoch: string }>(
@@ -130,11 +166,12 @@ export const db = {
       );
       if (ev.rows.length === 0) throw new Error(`No event with slug ${eventSlug}`);
       await c.query(
-        `INSERT INTO export_job (event_id, type, status, progress_pct, completed_at, epoch)
-         VALUES ($1, $2::export_type, $3::export_status, $4, $5, $6)
+        `INSERT INTO export_job (event_id, type, status, progress_pct, completed_at, epoch,
+                                 error_message)
+         VALUES ($1, $2::export_type, $3::export_status, $4, $5, $6, $7)
          ON CONFLICT (event_id, type) DO UPDATE
            SET status = EXCLUDED.status, progress_pct = EXCLUDED.progress_pct,
-               epoch = EXCLUDED.epoch`,
+               epoch = EXCLUDED.epoch, error_message = EXCLUDED.error_message`,
         [
           ev.rows[0].id,
           type,
@@ -142,6 +179,7 @@ export const db = {
           status === 'done' ? 100 : 0,
           status === 'done' ? new Date() : null,
           ev.rows[0].export_epoch,
+          errorMessage,
         ]
       );
     });

e2e/helpers/webkit.ts

@@ -0,0 +1,29 @@
+import { test } from '@playwright/test';
+
+/**
+ * Skip a test that depends on persisting a Blob/File in IndexedDB when running on
+ * Playwright's WebKit.
+ *
+ * The client upload queue (`frontend/src/lib/upload-queue.ts`) stores the file itself in
+ * IndexedDB so a backgrounded or reloaded phone can resume the upload. Playwright's Linux
+ * WebKit build cannot store Blobs in IndexedDB at all — `put()` fails with
+ * "UnknownError: Error preparing Blob/File data to be stored in object store". Verified to
+ * be the harness, not the app: a Blob constructed in-page with `new Blob([bytes])` fails
+ * exactly the same way, while Chromium stores both that and a `setInputFiles` File fine.
+ * Real iOS Safari supports Blobs in IndexedDB, so this is NOT evidence of a bug on the
+ * platform these tests exist to protect.
+ *
+ * Any test that drives the composer (FAB → UploadSheet → /upload → submit) hits this,
+ * because `handleSubmit` awaits `addToQueue`, which throws before it can navigate.
+ *
+ * This is deliberately narrow. WebKit still runs every API-driven upload test, the whole of
+ * 01-auth, 03-feed and 06-export — including the keepsake download, which only WebKit can
+ * meaningfully verify. If Playwright's WebKit ever gains IndexedDB Blob support, delete this
+ * helper and the four call sites.
+ */
+export function skipIfNoIdbBlobs(browserName: string) {
+  test.skip(
+    browserName === 'webkit',
+    "Playwright's Linux WebKit cannot store Blobs in IndexedDB (harness limitation, not an iOS one) — the client upload queue can't be exercised there"
+  );
+}

e2e/loadtest/.gitignore

@@ -0,0 +1,4 @@
+results/
+__pycache__/
+*.pyc
+*.log

e2e/loadtest/README.md

@@ -0,0 +1,112 @@
+# EventSnap load / stress test
+
+Simulates a real event: **~100 guests** joining and uploading **~1000 images** in
+bursts (10–20 at a time) spread across a compressed time window, a pool of
+**viewers** holding live SSE connections, and **one real browser** on `/diashow`
+acting as the showcase display.
+
+## Goal (this harness is tuned for it)
+
+**Validate the shipping config.** We run at the real production defaults —
+compression concurrency (`COMPRESSION_WORKER_CONCURRENCY`, default **2**), DB
+pool (default **10**), quotas **on** — and answer: _does the app survive the
+event, and how far behind real-time does the diashow fall?_
+
+The headline metric is **pipeline latency**: time from an upload succeeding to
+its preview being ready (`upload-processed` SSE event) — i.e. _how long until the
+photo appears on the diashow_. A backlog that builds is fine; a backlog that
+**never drains** is a fail for a live event.
+
+## Methodology: what we change vs. shipping
+
+We **only disable rate limits**. They're per-IP / per-user anti-abuse guards; a
+synthetic test from one IP trips them in a way real guests (distinct IPs, phones)
+never would — leaving them on would measure the limiter, not the pipeline.
+Everything else (compression concurrency, DB pool, quotas) stays at the real
+default so the result is honest.
+
+> **Standalone finding to remember:** the shipping `upload_rate_per_hour` default
+> is **10**. A real guest uploading a burst of 10–20 photos would be throttled by
+> the shipping config too. That's a genuine event-day issue worth surfacing
+> separately from this pipeline test.
+
+## Prereqs
+
+- The isolated test stack up: `cd e2e && npm run stack:up` (Caddy on `:3101`,
+  `EVENTSNAP_TEST_MODE=1`, `/admin/__truncate` live).
+- Node 24+ (global `fetch`/`FormData`/`Blob`), Python 3 + Pillow, Docker CLI
+  access (used for `docker stats` + `docker exec psql` ground-truth sampling).
+- `@playwright/test` (already an e2e dep) for the diashow watcher.
+
+## 1. Generate the image pool (once)
+
+Realistic phone-sized JPEGs (~2–4 MB, 12 MP, high entropy). The driver reuses
+this pool at random across all 1000 uploads — real load is byte size + decode
+cost, not file uniqueness.
+
+```bash
+python3 e2e/loadtest/gen-images.py 40      # → /tmp/eventsnap-loadtest/photos
+```
+
+~40 images ≈ 120 MB pool; projects to **~3–4 GB** of originals for 1000 uploads
+(previews/thumbnails add more). The generator prints the projection; check disk.
+
+## 2. Smoke run first (~1 min)
+
+Proves the wiring — join, upload, SSE correlation, drain, metrics — before the
+real thing:
+
+```bash
+LT_GUESTS=5 LT_IMAGES=50 LT_WINDOW_SEC=60 node e2e/loadtest/driver.mjs
+```
+
+## 3. Full run (~15 min + drain)
+
+Two terminals. Start the showcase display first, then the driver:
+
+```bash
+# terminal A — the showcase device
+node e2e/loadtest/diashow-watch.mjs
+
+# terminal B — 100 guests / 1000 images / 15-min window (defaults)
+node e2e/loadtest/driver.mjs
+```
+
+The driver truncates event data first (`LT_TRUNCATE=0` to keep), disables rate
+limits, joins guests, opens SSE, runs the burst schedule, then **waits for the
+compression backlog to drain** before reporting.
+
+## Output
+
+- Console: live progress every 10 s, then a RESULTS block with pass/fail flags.
+- `e2e/loadtest/results/run-<timestamp>.json`: full metrics — upload latency
+  percentiles, pipeline latency percentiles, drain time, per-status counts, SSE
+  reconnect/resync counts, and a `docker stats` + DB-connection time series.
+- `e2e/loadtest/results/diashow/`: periodic screenshots of the live display.
+
+## What the flags mean
+
+| Flag                      | Meaning                                                                      |
+| ------------------------- | ---------------------------------------------------------------------------- |
+| `✗ 5xx`                   | server errored under load — hard fail                                        |
+| `✗ 507`                   | quota rejected uploads — disk/quota misconfig for the event size             |
+| `✗ backlog did not drain` | compression can't keep up even after uploads stop — diashow never catches up |
+| `⚠ pipeline p95 > 60s`    | photos take >1 min to appear on the diashow at peak                          |
+| `⚠ SSE resyncs`           | live consumers lagged the broadcast channel                                  |
+
+## Knobs
+
+All via env (see header of `driver.mjs`): `LT_GUESTS`, `LT_IMAGES`,
+`LT_WINDOW_SEC`, `LT_BURST_MIN/MAX`, `LT_BURST_CONC`, `LT_VIEWERS`,
+`LT_TRUNCATE`, `LT_DRAIN_TIMEOUT_SEC`, `LT_KEEP_RATELIMITS`, `LT_BASE`,
+`LT_APP_CONTAINER`, `LT_DB_CONTAINER`.
+
+To later answer _"what config should I deploy?"_, re-run with a rebuilt stack
+that sets `COMPRESSION_WORKER_CONCURRENCY` higher (boot-time env var in
+`docker-compose.test.yml`) and compare the pipeline-latency / drain numbers.
+
+## Teardown
+
+```bash
+cd e2e && npm run stack:down     # wipes volumes (media + db)
+```

e2e/loadtest/confirm-diashow-fix.mjs

@@ -0,0 +1,109 @@
+// End-to-end confirmation of the diashow SSE fix, reproducing the ORIGINAL failure:
+// kiosk opens /diashow directly BEFORE any photos exist, then a guest uploads.
+// Pre-fix: stream never opens, display stuck on "Noch keine Beiträge" forever.
+// Post-fix: stream opens on mount, the uploaded photo appears live.
+import { chromium } from '@playwright/test';
+import { readFileSync } from 'node:fs';
+
+const BASE = 'http://localhost:3101';
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const j = (r) => r.json();
+
+const adminLogin = () =>
+  fetch(`${BASE}/api/v1/admin/login`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ password: 'admin-test-pw' }),
+  })
+    .then(j)
+    .then((b) => b.jwt);
+const join = (name) =>
+  fetch(`${BASE}/api/v1/join`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ display_name: name }),
+  }).then(j);
+async function truncate(admin) {
+  await fetch(`${BASE}/api/v1/admin/__truncate`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${admin}` },
+  });
+}
+async function upload(jwt) {
+  const form = new FormData();
+  form.append(
+    'file',
+    new Blob([readFileSync('/tmp/eventsnap-loadtest/photos/photo_000.jpg')], {
+      type: 'image/jpeg',
+    }),
+    'live.jpg'
+  );
+  form.append('caption', 'LIVE-PROBE');
+  const r = await fetch(`${BASE}/api/v1/upload`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${jwt}` },
+    body: form,
+  });
+  return (await r.json()).id;
+}
+
+// Reproduce the failing scenario: empty event, then open /diashow directly.
+let admin = await adminLogin();
+await truncate(admin);
+admin = await adminLogin();
+const showcase = await join('Showcase Display');
+const guest = await join('Uploading Guest');
+
+const browser = await chromium.launch();
+const ctx = await browser.newContext({ viewport: { width: 1280, height: 800 } });
+const page = await ctx.newPage();
+const streamReqs = [];
+page.on('request', (req) => {
+  if (req.url().includes('/stream')) streamReqs.push(req.url().replace(BASE, ''));
+});
+
+await page.goto(`${BASE}/join`, { waitUntil: 'domcontentloaded' });
+await page.evaluate((g) => {
+  localStorage.setItem('eventsnap_jwt', g.jwt);
+  localStorage.setItem('eventsnap_pin', g.pin);
+  localStorage.setItem('eventsnap_user_id', g.user_id);
+  localStorage.setItem('eventsnap_display_name', 'Showcase');
+  localStorage.setItem('eventsnap_guide_seen', '1');
+}, showcase);
+
+// Open /diashow DIRECTLY (never via /feed) on an EMPTY event.
+await page.goto(`${BASE}/diashow`, { waitUntil: 'domcontentloaded' });
+await sleep(2500);
+const emptyBefore = (await page.locator('text=Noch keine Beiträge').count()) > 0;
+const streamOpened = streamReqs.length > 0;
+console.log(`\n1) direct /diashow on empty event:`);
+console.log(`   "Noch keine Beiträge" shown: ${emptyBefore}  (expected: true)`);
+console.log(
+  `   SSE stream opened: ${streamOpened}  ${streamOpened ? '(' + streamReqs.join(', ') + ')' : ''}  (expected: true — this is the fix)`
+);
+
+// Now a guest uploads a photo while the display is open.
+console.log(`\n2) guest uploads a photo (display already open)…`);
+await upload(guest.jwt);
+
+// Wait for compression → upload-processed SSE → debounced refresh → slide appears.
+let appeared = false;
+for (let i = 0; i < 15; i++) {
+  await sleep(1000);
+  const stillEmpty = (await page.locator('text=Noch keine Beiträge').count()) > 0;
+  const imgs = await page.locator('img').count();
+  if (!stillEmpty && imgs > 0) {
+    appeared = true;
+    console.log(`   photo appeared live after ~${i + 1}s (img rendered, placeholder gone)`);
+    break;
+  }
+}
+if (!appeared) console.log(`   ✗ photo did NOT appear within 15s`);
+
+await page.screenshot({ path: 'results/diashow-fix-confirm.png' });
+await browser.close();
+
+console.log(`\n════ VERDICT ════`);
+console.log(`SSE opens on direct /diashow: ${streamOpened ? 'YES ✓' : 'NO ✗'}`);
+console.log(`Live photo appears on showcase: ${appeared ? 'YES ✓' : 'NO ✗'}`);
+console.log(streamOpened && appeared ? 'FIX CONFIRMED' : 'FIX NOT confirmed');

e2e/loadtest/diashow-watch.mjs

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+/**
+ * The showcase display. Opens ONE real Chromium browser on /diashow (as a
+ * logged-in guest) for the duration of a load run, so we validate the real
+ * SSE → render path a projector/TV would use — not just the protocol.
+ *
+ * Run it alongside driver.mjs (separate terminal), started first:
+ *     node diashow-watch.mjs
+ *     # then in another terminal:
+ *     node driver.mjs
+ *
+ * It captures:
+ *   - periodic screenshots (so you can eyeball that new photos actually appear)
+ *   - browser console errors / page crashes / SSE disconnects surfaced in console
+ *   - a final count of slides rendered
+ *
+ * Env:
+ *   LT_BASE            http://localhost:3101
+ *   LT_WATCH_SEC       960              how long to keep the display open
+ *   LT_SHOT_EVERY_SEC  30               screenshot cadence
+ *   LT_OUT_DIR         ./results/diashow
+ */
+
+import { chromium, devices } from '@playwright/test';
+import { mkdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const BASE = process.env.LT_BASE ?? 'http://localhost:3101';
+const WATCH_SEC = parseInt(process.env.LT_WATCH_SEC ?? '960', 10);
+const SHOT_EVERY = parseInt(process.env.LT_SHOT_EVERY_SEC ?? '30', 10);
+const OUT = process.env.LT_OUT_DIR ?? join(__dirname, 'results', 'diashow');
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+async function joinGuest(name) {
+  const res = await fetch(`${BASE}/api/v1/join`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ display_name: name }),
+  });
+  if (res.status !== 201) throw new Error(`join failed ${res.status}`);
+  return res.json();
+}
+
+async function main() {
+  mkdirSync(OUT, { recursive: true });
+  const guest = await joinGuest('Showcase Display');
+  console.log('[diashow] joined showcase guest, launching browser…');
+
+  const browser = await chromium.launch();
+  // A TV/projector is landscape; use a desktop-ish large viewport.
+  const ctx = await browser.newContext({ viewport: { width: 1920, height: 1080 } });
+  const page = await ctx.newPage();
+
+  let consoleErrors = 0;
+  page.on('console', (msg) => {
+    if (msg.type() === 'error') {
+      consoleErrors++;
+      console.log('[diashow][console.error]', msg.text().slice(0, 200));
+    }
+  });
+  page.on('pageerror', (e) => console.log('[diashow][pageerror]', String(e).slice(0, 200)));
+  page.on('crash', () => console.log('[diashow][CRASH] page crashed'));
+
+  // Seed auth in localStorage on the origin, then open /diashow.
+  await page.goto(`${BASE}/join`, { waitUntil: 'domcontentloaded' });
+  await page.evaluate((g) => {
+    localStorage.setItem('eventsnap_theme', 'dark');
+    localStorage.setItem('eventsnap_jwt', g.jwt);
+    localStorage.setItem('eventsnap_pin', g.pin);
+    localStorage.setItem('eventsnap_user_id', g.user_id);
+    localStorage.setItem('eventsnap_display_name', 'Showcase Display');
+    localStorage.setItem('eventsnap_guide_seen', '1');
+  }, guest);
+  await page.goto(`${BASE}/diashow`, { waitUntil: 'domcontentloaded' });
+  console.log(`[diashow] on /diashow, watching for ${WATCH_SEC}s (shots every ${SHOT_EVERY}s)`);
+
+  const start = Date.now();
+  let shot = 0;
+  while ((Date.now() - start) / 1000 < WATCH_SEC) {
+    await sleep(SHOT_EVERY * 1000);
+    const elapsed = Math.round((Date.now() - start) / 1000);
+    // best-effort slide count (diashow renders <img>; adjust selector if markup changes)
+    let imgs = -1;
+    try {
+      imgs = await page.locator('img').count();
+    } catch {
+      /* ignore */
+    }
+    const path = join(OUT, `diashow-t${String(elapsed).padStart(4, '0')}.png`);
+    await page.screenshot({ path }).catch(() => {});
+    console.log(`[diashow][t+${elapsed}s] imgs≈${imgs} consoleErrors=${consoleErrors} → ${path}`);
+    shot++;
+  }
+
+  console.log(`[diashow] done. ${shot} screenshots, ${consoleErrors} console errors total.`);
+  await browser.close();
+}
+
+main().catch((e) => {
+  console.error('[diashow] failed:', e);
+  process.exit(1);
+});

e2e/loadtest/driver.mjs

@@ -0,0 +1,654 @@
+#!/usr/bin/env node
+/**
+ * EventSnap load / stress driver.
+ *
+ * Simulates ~100 guests joining an event and uploading ~1000 images in bursts
+ * (10-20 at a time) spread across a compressed time window, plus a pool of
+ * viewers holding live SSE connections (like phones with the feed open) and one
+ * "diashow" connection (the showcase display). Measures the metrics that matter
+ * for a live event — especially the *pipeline backlog*: how long between an
+ * upload succeeding and its preview being ready (SSE `upload-processed`), which
+ * is exactly "how long until the photo shows up on the diashow".
+ *
+ * This is an HTTP-level driver on purpose: 100 real browsers would bottleneck
+ * the test box, not the server. One real browser watches /diashow separately
+ * (see diashow-watch.mjs).
+ *
+ * METHODOLOGY NOTE — what we change vs. the shipping config:
+ *   We ONLY disable rate limits. They are per-IP/per-user anti-abuse guards; a
+ *   synthetic test from one IP would trip them in a way real guests (distinct
+ *   IPs, phones) never would, so leaving them on would measure the rate limiter
+ *   instead of the pipeline. We DELIBERATELY leave compression concurrency,
+ *   DB pool size and quotas at their real defaults — validating those is the
+ *   whole point. (Runtime can't change compression concurrency anyway; it's a
+ *   boot-time env var.)
+ *
+ *   Related real-world finding to keep in mind: the default upload_rate_per_hour
+ *   is 10, so a real guest uploading a burst of 10-20 would be throttled by the
+ *   SHIPPING config too. That's a genuine event-day issue worth its own report,
+ *   independent of this pipeline test.
+ *
+ * Usage:
+ *   node driver.mjs                      # full run (100 guests / 1000 imgs / 15 min)
+ *   LT_GUESTS=5 LT_IMAGES=50 LT_WINDOW_SEC=60 node driver.mjs   # smoke
+ *
+ * Env knobs (all optional; defaults target the full run):
+ *   LT_BASE            http://localhost:3101   frontend/caddy base URL
+ *   LT_GUESTS          100                     number of virtual guests
+ *   LT_IMAGES          1000                    total uploads to perform
+ *   LT_WINDOW_SEC      900                     spread uploads over this window
+ *   LT_BURST_MIN/MAX   10 / 20                 images per burst
+ *   LT_BURST_CONC      3                       parallel uploads within one burst (phone-like)
+ *   LT_VIEWERS         20                      extra guests holding SSE + polling feed
+ *   LT_PHOTOS_DIR      /tmp/eventsnap-loadtest/photos
+ *   LT_TRUNCATE        1                       wipe event data before the run
+ *   LT_DRAIN_TIMEOUT_SEC 600                   max wait for compression backlog to drain
+ *   LT_APP_CONTAINER   e2e-app-1               docker container for CPU/mem sampling
+ *   LT_DB_CONTAINER    e2e-db-1                docker container for psql ground-truth
+ *   LT_ADMIN_PW        admin-test-pw
+ *   LT_KEEP_RATELIMITS 0                       set 1 to NOT disable rate limits
+ *   LT_OUT_DIR         ./results
+ */
+
+import { readFileSync, readdirSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const execFileAsync = promisify(execFile);
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// ── Config ──────────────────────────────────────────────────────────────────
+const cfg = {
+  base: process.env.LT_BASE ?? 'http://localhost:3101',
+  guests: int('LT_GUESTS', 100),
+  images: int('LT_IMAGES', 1000),
+  windowSec: int('LT_WINDOW_SEC', 900),
+  burstMin: int('LT_BURST_MIN', 10),
+  burstMax: int('LT_BURST_MAX', 20),
+  burstConc: int('LT_BURST_CONC', 3),
+  viewers: int('LT_VIEWERS', 20),
+  photosDir: process.env.LT_PHOTOS_DIR ?? '/tmp/eventsnap-loadtest/photos',
+  truncate: process.env.LT_TRUNCATE !== '0',
+  drainTimeoutSec: int('LT_DRAIN_TIMEOUT_SEC', 600),
+  appContainer: process.env.LT_APP_CONTAINER ?? 'e2e-app-1',
+  dbContainer: process.env.LT_DB_CONTAINER ?? 'e2e-db-1',
+  adminPw: process.env.LT_ADMIN_PW ?? 'admin-test-pw',
+  keepRateLimits: process.env.LT_KEEP_RATELIMITS === '1',
+  outDir: process.env.LT_OUT_DIR ?? join(__dirname, 'results'),
+};
+
+function int(name, def) {
+  const v = process.env[name];
+  return v === undefined ? def : parseInt(v, 10);
+}
+
+const API = `${cfg.base}/api/v1`;
+const now = () => Date.now();
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const rand = (min, max) => min + Math.floor(Math.random() * (max - min + 1));
+const pick = (arr) => arr[Math.floor(Math.random() * arr.length)];
+
+// ── HTTP helpers ──────────────────────────────────────────────────────────────
+async function api(path, { method = 'GET', token, json, expect } = {}) {
+  const headers = {};
+  if (token) headers.Authorization = `Bearer ${token}`;
+  if (json !== undefined) headers['Content-Type'] = 'application/json';
+  const res = await fetch(`${API}${path}`, {
+    method,
+    headers,
+    body: json !== undefined ? JSON.stringify(json) : undefined,
+  });
+  let body;
+  if (res.status !== 204) {
+    const text = await res.text();
+    try {
+      body = text.length ? JSON.parse(text) : undefined;
+    } catch {
+      body = text;
+    }
+  }
+  if (expect && !expect.includes(res.status)) {
+    throw new Error(`${method} ${path} → ${res.status}: ${JSON.stringify(body)}`);
+  }
+  return { status: res.status, body };
+}
+
+const adminLogin = () =>
+  api('/admin/login', { method: 'POST', json: { password: cfg.adminPw }, expect: [200] }).then(
+    (r) => r.body.jwt
+  );
+
+const joinGuest = (name) =>
+  api('/join', { method: 'POST', json: { display_name: name }, expect: [201] }).then((r) => r.body);
+
+const patchConfig = (adminJwt, patch) =>
+  api('/admin/config', { method: 'PATCH', token: adminJwt, json: patch, expect: [204] });
+
+const getConfig = (adminJwt) => api('/admin/config', { token: adminJwt }).then((r) => r.body);
+
+const truncate = (adminJwt) =>
+  api('/admin/__truncate', { method: 'POST', token: adminJwt, expect: [204] });
+
+const CAPTIONS = [
+  'Was für ein magischer Tag 💍',
+  'Der erste Tanz 🕺',
+  'Prost! 🥂',
+  'Die Torte 🍰',
+  'Feuerwerk 🎆',
+  'Beste Freunde 💕',
+  'Was für eine Stimmung! 🎉',
+  'Details 🌸',
+  'Sonnenuntergang 🌅',
+  'Tanzfläche brennt 🔥',
+  null,
+  null,
+  null,
+];
+const TAGS = ['hochzeit', 'liebe', 'party', 'tanzen', 'natur', 'feier', 'freunde', 'dessert'];
+
+async function uploadPhoto(jwt, file, buf) {
+  const form = new FormData();
+  form.append('file', new Blob([buf], { type: 'image/jpeg' }), 'photo.jpg');
+  const cap = pick(CAPTIONS);
+  if (cap) form.append('caption', cap);
+  form.append('hashtags', `${pick(TAGS)},${pick(TAGS)}`);
+  const t0 = now();
+  const res = await fetch(`${API}/upload`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${jwt}` },
+    body: form,
+  });
+  const t1 = now();
+  let id, errText;
+  if (res.status === 201) {
+    id = (await res.json()).id;
+  } else {
+    errText = (await res.text()).slice(0, 200);
+  }
+  return { status: res.status, id, ms: t1 - t0, endTs: t1, bytes: buf.length, errText };
+}
+
+// ── SSE client (auto-reconnecting) ────────────────────────────────────────────
+class SseClient {
+  constructor(jwt, label, onEvent) {
+    this.jwt = jwt;
+    this.label = label;
+    this.onEvent = onEvent;
+    this.stop = false;
+    this.reconnects = 0;
+    this.resyncs = 0;
+    this.controller = null;
+  }
+  start() {
+    this._loop();
+    return this;
+  }
+  async _loop() {
+    while (!this.stop) {
+      try {
+        const tkt = await api('/stream/ticket', { method: 'POST', token: this.jwt, expect: [200] });
+        this.controller = new AbortController();
+        const res = await fetch(`${API}/stream?ticket=${tkt.body.ticket}`, {
+          headers: { Accept: 'text/event-stream' },
+          signal: this.controller.signal,
+        });
+        if (!res.ok || !res.body) throw new Error(`stream ${res.status}`);
+        const reader = res.body.getReader();
+        const dec = new TextDecoder();
+        let buf = '';
+        while (!this.stop) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          buf += dec.decode(value, { stream: true });
+          let idx;
+          while ((idx = buf.indexOf('\n\n')) !== -1) {
+            const frame = buf.slice(0, idx);
+            buf = buf.slice(idx + 2);
+            this._parseFrame(frame);
+          }
+        }
+      } catch (e) {
+        if (this.stop) return;
+        this.reconnects++;
+        await sleep(500 + Math.random() * 500);
+      }
+    }
+  }
+  _parseFrame(frame) {
+    let event = 'message';
+    let data = '';
+    for (const line of frame.split('\n')) {
+      if (line.startsWith('event:')) event = line.slice(6).trim();
+      else if (line.startsWith('data:')) data += line.slice(5).trim();
+    }
+    if (event === 'resync') this.resyncs++;
+    if (!data) return;
+    let payload;
+    try {
+      payload = JSON.parse(data);
+    } catch {
+      payload = data;
+    }
+    this.onEvent(event, payload, this.label);
+  }
+  close() {
+    this.stop = true;
+    try {
+      this.controller?.abort();
+    } catch {
+      /* noop */
+    }
+  }
+}
+
+// ── Resource sampler (docker stats + psql ground truth) ───────────────────────
+async function sampleResources() {
+  const out = { ts: now() };
+  try {
+    const { stdout } = await execFileAsync('docker', [
+      'stats',
+      '--no-stream',
+      '--format',
+      '{{.Name}}|{{.CPUPerc}}|{{.MemUsage}}',
+      cfg.appContainer,
+      cfg.dbContainer,
+    ]);
+    out.docker = stdout.trim();
+  } catch (e) {
+    out.dockerErr = String(e).slice(0, 120);
+  }
+  try {
+    const { stdout } = await psql(
+      `select count(*) from pg_stat_activity where datname='eventsnap_test'`
+    );
+    out.dbConns = parseInt(stdout.trim(), 10);
+  } catch {
+    /* ignore */
+  }
+  return out;
+}
+
+function psql(sql) {
+  return execFileAsync('docker', [
+    'exec',
+    cfg.dbContainer,
+    'psql',
+    '-U',
+    'eventsnap_test',
+    '-d',
+    'eventsnap_test',
+    '-tAc',
+    sql,
+  ]);
+}
+
+async function compressionCounts() {
+  try {
+    const { stdout } = await psql(
+      `select compression_status, count(*) from upload where deleted_at is null group by 1`
+    );
+    const map = {};
+    for (const line of stdout.trim().split('\n')) {
+      if (!line) continue;
+      const [status, n] = line.split('|');
+      map[status] = parseInt(n, 10);
+    }
+    return map;
+  } catch (e) {
+    return { error: String(e).slice(0, 120) };
+  }
+}
+
+// ── Stats helpers ─────────────────────────────────────────────────────────────
+function pct(sorted, p) {
+  if (!sorted.length) return null;
+  const i = Math.min(sorted.length - 1, Math.floor((p / 100) * sorted.length));
+  return sorted[i];
+}
+function summarize(nums) {
+  if (!nums.length) return null;
+  const s = [...nums].sort((a, b) => a - b);
+  const sum = s.reduce((a, b) => a + b, 0);
+  return {
+    n: s.length,
+    min: s[0],
+    max: s[s.length - 1],
+    mean: Math.round(sum / s.length),
+    p50: pct(s, 50),
+    p95: pct(s, 95),
+    p99: pct(s, 99),
+  };
+}
+
+// ── Image pool ────────────────────────────────────────────────────────────────
+function loadPool() {
+  let files;
+  try {
+    files = readdirSync(cfg.photosDir).filter((f) => f.endsWith('.jpg'));
+  } catch {
+    files = [];
+  }
+  if (!files.length) {
+    console.error(
+      `\n✗ No images in ${cfg.photosDir}. Run first:\n` +
+        `    LT_PHOTOS_DIR=${cfg.photosDir} python3 ${join(__dirname, 'gen-images.py')}\n`
+    );
+    process.exit(1);
+  }
+  const pool = files.map((f) => {
+    const p = join(cfg.photosDir, f);
+    return { buf: readFileSync(p), size: statSync(p).size, name: f };
+  });
+  return pool;
+}
+
+// ── Burst schedule ────────────────────────────────────────────────────────────
+// Build bursts until we reach the image target, assign each to a random guest at
+// a random time in the window. Naturally gives some guests several bursts and
+// some none — like a real event. Guests all join before their first burst.
+function buildSchedule() {
+  const bursts = [];
+  let remaining = cfg.images;
+  while (remaining > 0) {
+    const size = Math.min(remaining, rand(cfg.burstMin, cfg.burstMax));
+    bursts.push({
+      guest: rand(0, cfg.guests - 1),
+      atMs: Math.floor(Math.random() * cfg.windowSec * 1000),
+      size,
+    });
+    remaining -= size;
+  }
+  bursts.sort((a, b) => a.atMs - b.atMs);
+  return bursts;
+}
+
+// ── Main ──────────────────────────────────────────────────────────────────────
+async function main() {
+  console.log('━'.repeat(72));
+  console.log('EventSnap load driver');
+  console.log(
+    `  target: ${cfg.guests} guests, ${cfg.images} images, ` +
+      `bursts ${cfg.burstMin}-${cfg.burstMax}, window ${cfg.windowSec}s, ${cfg.viewers} viewers`
+  );
+  console.log(`  base: ${cfg.base}`);
+  console.log('━'.repeat(72));
+
+  const pool = loadPool();
+  const avgMb = pool.reduce((a, p) => a + p.size, 0) / pool.length / 1e6;
+  console.log(
+    `[pool] ${pool.length} images, avg ${avgMb.toFixed(2)} MB, ` +
+      `projected originals ~${((avgMb * cfg.images) / 1000).toFixed(1)} GB`
+  );
+
+  // Preflight: disk headroom
+  try {
+    const { stdout } = await execFileAsync('df', ['-BG', '--output=avail', '/']);
+    console.log(`[preflight] disk avail:${stdout.trim().split('\n').pop().trim()}`);
+  } catch {
+    /* ignore */
+  }
+
+  // Admin: reset + config
+  const admin = await adminLogin();
+  const cfgBefore = await getConfig(admin);
+  if (cfg.truncate) {
+    console.log('[setup] truncating event data…');
+    await truncate(admin);
+  }
+  const admin2 = await adminLogin();
+  if (!cfg.keepRateLimits) {
+    console.log('[setup] disabling rate limits (methodology: isolate pipeline, not limiter)');
+    await patchConfig(admin2, {
+      rate_limits_enabled: 'false',
+      upload_rate_enabled: 'false',
+      feed_rate_enabled: 'false',
+      join_rate_enabled: 'false',
+      recover_rate_enabled: 'false',
+    });
+  }
+  console.log(
+    `[setup] compression concurrency / quotas left at SHIPPING defaults ` +
+      `(compression_worker_concurrency is a boot env var, not runtime)`
+  );
+
+  // Metrics stores
+  const uploads = []; // {status, ms, endTs, bytes, id, guest}
+  const processedAt = new Map(); // upload_id -> ts of upload-processed
+  const uploadEndTs = new Map(); // upload_id -> endTs
+  const errorEvents = []; // upload-error payloads
+  const resources = [];
+  let newUploadEvents = 0;
+
+  // Join guests (staggered, small concurrency)
+  console.log(`[join] joining ${cfg.guests} guests…`);
+  const accounts = new Array(cfg.guests);
+  const joinConc = 10;
+  for (let i = 0; i < cfg.guests; i += joinConc) {
+    await Promise.all(
+      Array.from({ length: Math.min(joinConc, cfg.guests - i) }, (_, k) =>
+        joinGuest(`LoadGuest ${i + k}`).then((a) => (accounts[i + k] = a))
+      )
+    );
+  }
+  console.log('[join] done');
+
+  // Live connections: 1 diashow + N viewers
+  const onEvent = (event, payload) => {
+    if (event === 'new-upload') newUploadEvents++;
+    else if (event === 'upload-processed' && payload?.upload_id) {
+      if (!processedAt.has(payload.upload_id)) processedAt.set(payload.upload_id, now());
+    } else if (event === 'upload-error' && payload?.upload_id) {
+      errorEvents.push(payload);
+    }
+  };
+  const sseClients = [];
+  sseClients.push(new SseClient(accounts[0].jwt, 'diashow', onEvent).start());
+  for (let i = 0; i < Math.min(cfg.viewers, cfg.guests); i++) {
+    sseClients.push(new SseClient(accounts[i].jwt, `viewer${i}`, onEvent).start());
+  }
+  console.log(`[sse] opened ${sseClients.length} live connections (1 diashow + viewers)`);
+
+  // Viewers also poll the feed periodically (viewing load)
+  let feedPolls = 0;
+  const feedPoller = setInterval(async () => {
+    const g = accounts[rand(0, Math.min(cfg.viewers, cfg.guests) - 1)];
+    try {
+      await api('/feed', { token: g.jwt });
+      feedPolls++;
+    } catch {
+      /* ignore */
+    }
+  }, 1500);
+
+  // Resource sampler
+  const sampler = setInterval(async () => resources.push(await sampleResources()), 5000);
+  resources.push(await sampleResources());
+
+  // Run the burst schedule
+  const schedule = buildSchedule();
+  console.log(
+    `[run] ${schedule.length} bursts scheduled over ${cfg.windowSec}s ` +
+      `(≈${(cfg.images / (cfg.windowSec / 60)).toFixed(0)} img/min avg). Starting…`
+  );
+  const startTs = now();
+  let done = 0;
+
+  const runBurst = async (burst) => {
+    const jwt = accounts[burst.guest].jwt;
+    const items = Array.from({ length: burst.size }, () => pick(pool));
+    // upload with phone-like small concurrency inside the burst
+    for (let i = 0; i < items.length; i += cfg.burstConc) {
+      const chunk = items.slice(i, i + cfg.burstConc);
+      const results = await Promise.all(chunk.map((it) => uploadPhoto(jwt, it.name, it.buf)));
+      for (const r of results) {
+        uploads.push({ ...r, guest: burst.guest });
+        if (r.id) uploadEndTs.set(r.id, r.endTs);
+        done++;
+      }
+    }
+  };
+
+  const timers = [];
+  const burstPromises = [];
+  for (const burst of schedule) {
+    timers.push(
+      setTimeout(() => {
+        burstPromises.push(runBurst(burst));
+      }, burst.atMs)
+    );
+  }
+
+  // progress ticker
+  const ticker = setInterval(() => {
+    const elapsed = ((now() - startTs) / 1000).toFixed(0);
+    const ok = uploads.filter((u) => u.status === 201).length;
+    console.log(
+      `[t+${elapsed}s] uploads ${done}/${cfg.images} (ok ${ok}), ` +
+        `processed ${processedAt.size}, new-upload evts ${newUploadEvents}, ` +
+        `feedPolls ${feedPolls}`
+    );
+  }, 10000);
+
+  // wait for the window to elapse, then for all scheduled bursts to finish
+  await sleep(cfg.windowSec * 1000 + 500);
+  await Promise.all(burstPromises);
+  clearInterval(ticker);
+  console.log(
+    `[run] all bursts issued. uploaded ${done}, ok ${uploads.filter((u) => u.status === 201).length}`
+  );
+
+  // Drain: wait for compression backlog to clear (SSE processed ⊇ successful ids)
+  console.log('[drain] waiting for compression backlog to clear…');
+  const drainStart = now();
+  const successIds = new Set(uploads.filter((u) => u.id).map((u) => u.id));
+  let lastLog = 0;
+  let drainReason = 'timeout';
+  while (now() - drainStart < cfg.drainTimeoutSec * 1000) {
+    // SSE view (what the diashow actually "sees")
+    const pendingSse = [...successIds].filter((id) => !processedAt.has(id)).length;
+    if (pendingSse === 0) {
+      console.log('[drain] backlog cleared (all upload-processed events received)');
+      drainReason = 'sse-complete';
+      break;
+    }
+    // DB ground truth — authoritative even if an SSE reconnect dropped events
+    const counts = await compressionCounts();
+    const dbPending = Object.entries(counts)
+      .filter(([s]) => s !== 'done' && s !== 'error')
+      .reduce((a, [, n]) => a + n, 0);
+    if (!counts.error && dbPending === 0) {
+      console.log(`[drain] backlog cleared per DB (db status: ${JSON.stringify(counts)})`);
+      drainReason = 'db-complete';
+      break;
+    }
+    if (now() - lastLog > 5000) {
+      console.log(
+        `[drain] pending(sse) ${pendingSse}, pending(db) ${dbPending} — db: ${JSON.stringify(counts)}`
+      );
+      lastLog = now();
+    }
+    await sleep(1000);
+  }
+  const drainMs = now() - drainStart;
+
+  // Stop background work
+  clearInterval(sampler);
+  clearInterval(feedPoller);
+  timers.forEach(clearTimeout);
+  resources.push(await sampleResources());
+  const finalCounts = await compressionCounts();
+  await sleep(200);
+  sseClients.forEach((c) => c.close());
+
+  // ── Build report ────────────────────────────────────────────────────────────
+  const byStatus = {};
+  for (const u of uploads) byStatus[u.status] = (byStatus[u.status] ?? 0) + 1;
+  const okUploads = uploads.filter((u) => u.status === 201);
+  const uploadLatency = summarize(okUploads.map((u) => u.ms));
+  const pipelineLatency = summarize(
+    [...processedAt.entries()]
+      .filter(([id]) => uploadEndTs.has(id))
+      .map(([id, ts]) => ts - uploadEndTs.get(id))
+  );
+  const totalReconnects = sseClients.reduce((a, c) => a + c.reconnects, 0);
+  const totalResyncs = sseClients.reduce((a, c) => a + c.resyncs, 0);
+
+  const report = {
+    config: cfg,
+    startedAt: new Date(startTs).toISOString(),
+    durationSec: Math.round((now() - startTs) / 1000),
+    totals: {
+      uploadsAttempted: uploads.length,
+      uploadsOk: okUploads.length,
+      byStatus,
+      newUploadEvents,
+      processedEvents: processedAt.size,
+      uploadErrorEvents: errorEvents.length,
+      feedPolls,
+    },
+    uploadLatencyMs: uploadLatency,
+    pipelineLatencyMs: pipelineLatency,
+    drain: {
+      ms: drainMs,
+      cleared: drainReason !== 'timeout',
+      reason: drainReason,
+      ssePending: [...successIds].filter((id) => !processedAt.has(id)).length,
+      finalDbCounts: finalCounts,
+    },
+    sse: {
+      connections: sseClients.length,
+      reconnects: totalReconnects,
+      resyncs: totalResyncs,
+    },
+    resources,
+    rateLimitsDisabled: !cfg.keepRateLimits,
+    configBefore: cfgBefore,
+  };
+
+  mkdirSync(cfg.outDir, { recursive: true });
+  const stamp = new Date(startTs).toISOString().replace(/[:.]/g, '-');
+  const outPath = join(cfg.outDir, `run-${stamp}.json`);
+  writeFileSync(outPath, JSON.stringify(report, null, 2));
+
+  // ── Print verdict ─────────────────────────────────────────────────────────
+  console.log('\n' + '━'.repeat(72));
+  console.log('RESULTS');
+  console.log('━'.repeat(72));
+  console.log(
+    `uploads: ${okUploads.length}/${uploads.length} ok — byStatus ${JSON.stringify(byStatus)}`
+  );
+  console.log(`upload latency ms: ${JSON.stringify(uploadLatency)}`);
+  console.log(`pipeline latency ms (upload→preview ready): ${JSON.stringify(pipelineLatency)}`);
+  console.log(`backlog drain: ${(drainMs / 1000).toFixed(1)}s, cleared=${report.drain.cleared}`);
+  console.log(`final db compression status: ${JSON.stringify(finalCounts)}`);
+  console.log(
+    `sse: ${sseClients.length} conns, ${totalReconnects} reconnects, ${totalResyncs} resyncs`
+  );
+  console.log(`\nfull report → ${outPath}`);
+
+  // Heuristic pass/fail flags (validate shipping config)
+  const flags = [];
+  const err5xx = Object.entries(byStatus)
+    .filter(([s]) => +s >= 500)
+    .reduce((a, [, n]) => a + n, 0);
+  if (err5xx > 0) flags.push(`✗ ${err5xx} server errors (5xx)`);
+  if (byStatus['507']) flags.push(`✗ ${byStatus['507']} quota rejections (507)`);
+  if (byStatus['413']) flags.push(`⚠ ${byStatus['413']} too-large (413)`);
+  if (byStatus['429'])
+    flags.push(`⚠ ${byStatus['429']} rate-limited (429) — unexpected with limits off`);
+  if (!report.drain.cleared) flags.push(`✗ backlog did NOT drain within ${cfg.drainTimeoutSec}s`);
+  if (totalResyncs > sseClients.length) flags.push(`⚠ ${totalResyncs} SSE resyncs (consumer lag)`);
+  if (pipelineLatency && pipelineLatency.p95 > 60000)
+    flags.push(`⚠ pipeline p95 ${(pipelineLatency.p95 / 1000).toFixed(0)}s (diashow lags >1min)`);
+  console.log('\nflags:');
+  if (flags.length) flags.forEach((f) => console.log('  ' + f));
+  else console.log('  ✓ no red flags — default config handled the load');
+  console.log('━'.repeat(72));
+}
+
+main().catch((e) => {
+  console.error('\n✗ driver failed:', e);
+  process.exit(1);
+});

e2e/loadtest/gen-images.py

@@ -0,0 +1,146 @@
+#!/usr/bin/env python3
+"""
+Generate a pool of realistic phone-sized JPEGs for the EventSnap load test.
+
+The stress test uploads ~1000 images, but they don't need to be 1000 unique
+files — real load comes from realistic *byte size* and *decode cost*, which
+drive bandwidth, the compression/preview pipeline (decode + 800x800 resize),
+disk usage and the dynamic storage quota. So we generate a modest POOL of
+distinct, high-entropy images (~2-4 MB, 12 MP, like a phone camera) and the
+driver reuses them at random across the 1000 uploads.
+
+High entropy matters: a flat gradient compresses to almost nothing and would
+under-stress both the network and the JPEG decoder. We blend random noise over
+a colorful gradient + big shapes so the files land in a realistic size band,
+then tune JPEG quality per-image to hit the target size.
+
+Output: $LT_PHOTOS_DIR (default /tmp/eventsnap-loadtest/photos)
+Usage:  python3 gen-images.py [COUNT]     (default 40)
+"""
+
+import os
+import sys
+import math
+import random
+from PIL import Image, ImageDraw, ImageFont
+
+OUT_DIR = os.environ.get("LT_PHOTOS_DIR", "/tmp/eventsnap-loadtest/photos")
+COUNT = int(sys.argv[1]) if len(sys.argv) > 1 else 40
+
+# Target JPEG size band (bytes). Typical modern phone photo.
+TARGET_MIN = 2_000_000
+TARGET_MAX = 4_500_000
+
+# 12 MP-ish, both orientations (phones shoot portrait and landscape).
+SIZES = [(4032, 3024), (3024, 4032)]
+
+PALETTES = [
+    [(250, 245, 235), (212, 175, 55), (120, 90, 30)],   # champagne / gold
+    [(245, 244, 242), (190, 190, 198), (90, 92, 100)],   # silver / pearl
+    [(255, 250, 240), (240, 200, 160), (170, 110, 70)],  # warm sunset
+    [(235, 240, 248), (140, 170, 210), (40, 70, 120)],   # cool blue hour
+    [(248, 240, 245), (210, 150, 180), (110, 50, 90)],   # rose dusk
+    [(240, 248, 242), (150, 200, 170), (40, 110, 80)],   # garden green
+]
+
+
+def lerp(a, b, t):
+    return tuple(int(a[i] + (b[i] - a[i]) * t) for i in range(3))
+
+
+def gradient(w, h, palette, rng):
+    """Diagonal 3-stop gradient base."""
+    base = Image.new("RGB", (w, h))
+    px = base.load()
+    ang = rng.uniform(0, math.pi)
+    dx, dy = math.cos(ang), math.sin(ang)
+    # precompute per-column/row projection for speed
+    maxproj = abs(dx) * w + abs(dy) * h
+    for y in range(h):
+        for x in range(0, w, 4):  # step 4 then fill — good enough, much faster
+            t = (dx * x + dy * y) / maxproj
+            t = min(1.0, max(0.0, t + rng.uniform(-0.02, 0.02)))
+            if t < 0.5:
+                c = lerp(palette[0], palette[1], t * 2)
+            else:
+                c = lerp(palette[1], palette[2], (t - 0.5) * 2)
+            for k in range(4):
+                if x + k < w:
+                    px[x + k, y] = c
+    return base
+
+
+def add_shapes(img, rng):
+    d = ImageDraw.Draw(img, "RGBA")
+    w, h = img.size
+    for _ in range(rng.randint(6, 14)):
+        x0 = rng.randint(-w // 5, w)
+        y0 = rng.randint(-h // 5, h)
+        r = rng.randint(w // 12, w // 3)
+        col = (rng.randint(0, 255), rng.randint(0, 255), rng.randint(0, 255), rng.randint(20, 90))
+        if rng.random() < 0.5:
+            d.ellipse([x0, y0, x0 + r, y0 + r], fill=col)
+        else:
+            d.rectangle([x0, y0, x0 + r, y0 + int(r * rng.uniform(0.4, 1.6))], fill=col)
+    return img
+
+
+def noisy(w, h, rng):
+    """Full-resolution RGB noise from urandom — maximum entropy."""
+    return Image.frombytes("RGB", (w, h), os.urandom(w * h * 3))
+
+
+def label(img, idx, rng):
+    d = ImageDraw.Draw(img)
+    txt = f"EventSnap load #{idx:03d}"
+    try:
+        font = ImageFont.load_default(size=64)
+    except TypeError:
+        font = ImageFont.load_default()
+    d.text((60, 60), txt, fill=(255, 255, 255), font=font)
+    d.text((62, 62), txt, fill=(0, 0, 0), font=font)  # cheap shadow offset
+
+
+def encode_to_band(img, path, rng):
+    """Try qualities high→low until the file lands under TARGET_MAX; keep the
+    first that also clears TARGET_MIN if possible."""
+    best = None
+    for q in (92, 88, 84, 80, 76, 72):
+        img.save(path, "JPEG", quality=q, optimize=False)
+        size = os.path.getsize(path)
+        best = (q, size)
+        if size <= TARGET_MAX:
+            if size >= TARGET_MIN:
+                return q, size
+            # under the band — noise alpha likely too low; accept anyway at high q
+            return q, size
+    return best  # even q72 too big; accept the smallest we made
+
+
+def main():
+    os.makedirs(OUT_DIR, exist_ok=True)
+    rng = random.Random(20260718)  # deterministic pool
+    total_bytes = 0
+    print(f"[gen] writing {COUNT} images to {OUT_DIR}")
+    for i in range(COUNT):
+        w, h = rng.choice(SIZES)
+        palette = rng.choice(PALETTES)
+        base = gradient(w, h, palette, rng)
+        base = add_shapes(base, rng)
+        # blend noise to inject entropy -> realistic JPEG size
+        alpha = rng.uniform(0.28, 0.42)
+        base = Image.blend(base, noisy(w, h, rng), alpha)
+        label(base, i, rng)
+        path = os.path.join(OUT_DIR, f"photo_{i:03d}.jpg")
+        q, size = encode_to_band(base, path, rng)
+        total_bytes += size
+        print(f"  photo_{i:03d}.jpg  {w}x{h}  q{q}  {size/1_000_000:.2f} MB")
+    avg = total_bytes / COUNT
+    print(f"[gen] done. {COUNT} images, avg {avg/1_000_000:.2f} MB, "
+          f"pool total {total_bytes/1_000_000:.1f} MB")
+    print(f"[gen] projected for 1000 uploads (originals only): "
+          f"~{avg*1000/1_000_000_000:.1f} GB")
+
+
+if __name__ == "__main__":
+    main()

e2e/page-objects/export-page.ts

@@ -37,12 +37,19 @@ export class ExportPage {
   /**
    * The "Download" button inside the card whose heading is `heading`.
    *
-   * Scoped to the card element (`div.rounded-xl`) rather than "any div containing the
-   * heading" — the latter also matches the page wrapper, which contains BOTH cards' buttons.
+   * Scoped to the card element rather than "any div containing the heading" — the latter
+   * also matches the page wrapper, which contains BOTH cards' buttons.
+   *
+   * The scope class is `div.card` (see the ZIP/HTML cards in
+   * frontend/src/routes/export/+page.svelte). It was previously `div.rounded-xl`, which
+   * matched NOTHING: `.card` is a Tailwind `@apply` component class
+   * (frontend/src/lib/styles/components.css) so the DOM only ever carries `class="card p-5"`
+   * — and the utility it applies is `rounded-2xl` anyway. Both card-scoped locators were
+   * therefore dead, which is why the "shows enabled download buttons" test was red.
    */
   private cardButton(heading: string): Locator {
     return this.page
-      .locator('div.rounded-xl')
+      .locator('div.card')
       .filter({ has: this.page.getByRole('heading', { name: heading, exact: true }) })
       .getByRole('button', { name: 'Download', exact: true });
   }

e2e/playwright.config.ts

@@ -146,8 +146,18 @@ export default defineConfig({
       // that on `@smoke` — which exists on exactly two specs — meant the entire iOS guarantee was
       // one happy path and one join test. Every other UA here is a secondary browser and a smoke
       // check is proportionate; WebKit is not. Give it the core journeys the guest actually walks:
-      // join/recover, upload, and browse the feed.
-      testMatch: ['**/__smoke/**', '**/01-auth/**', '**/02-upload/**', '**/03-feed/**'],
+      // join/recover, upload, browse the feed — and take the keepsake home.
+      //
+      // 06-export is here because WebKit is the ONLY engine that enforces X-Frame-Options on the
+      // hidden download iframe. Excluding it is what let a site-wide `XFO: DENY` ship a keepsake
+      // download that silently did nothing on iOS. See 06-export/download-iframe.spec.ts.
+      testMatch: [
+        '**/__smoke/**',
+        '**/01-auth/**',
+        '**/02-upload/**',
+        '**/03-feed/**',
+        '**/06-export/**',
+      ],
     },
     {
       name: 'firefox-android',

e2e/shots.mjs

@@ -0,0 +1,255 @@
+// One-off: seed a realistic feed, then capture mobile screenshots (light + dark).
+// Run from the e2e dir so @playwright/test and pg resolve.
+import { chromium, devices } from '@playwright/test';
+import { Client } from 'pg';
+import { readFileSync, mkdirSync } from 'node:fs';
+
+const BASE = 'http://localhost:3101';
+const PHOTOS = '/tmp/eventsnap-shots/photos';
+const OUT = '/tmp/eventsnap-shots';
+mkdirSync(OUT, { recursive: true });
+
+const api = (path, opts = {}) =>
+  fetch(`${BASE}/api/v1${path}`, opts).then(async (r) => ({
+    status: r.status,
+    body: await r.text().then((t) => {
+      try {
+        return JSON.parse(t);
+      } catch {
+        return t;
+      }
+    }),
+  }));
+
+const authHeaders = (jwt, json = true) => ({
+  Authorization: `Bearer ${jwt}`,
+  ...(json ? { 'Content-Type': 'application/json' } : {}),
+});
+
+async function adminLogin() {
+  const r = await api('/admin/login', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ password: 'admin-test-pw' }),
+  });
+  return r.body.jwt;
+}
+async function joinGuest(name) {
+  const r = await api('/join', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ display_name: name }),
+  });
+  if (r.status !== 201)
+    throw new Error('join failed ' + name + ' ' + r.status + ' ' + JSON.stringify(r.body));
+  return r.body; // {jwt,pin,user_id}
+}
+async function upload(jwt, file, caption, hashtags) {
+  const form = new FormData();
+  form.append('file', new Blob([readFileSync(file)], { type: 'image/jpeg' }), 'photo.jpg');
+  if (caption) form.append('caption', caption);
+  if (hashtags) form.append('hashtags', hashtags);
+  const r = await fetch(`${BASE}/api/v1/upload`, {
+    method: 'POST',
+    headers: authHeaders(jwt, false),
+    body: form,
+  });
+  if (r.status !== 201) throw new Error('upload failed ' + r.status + ' ' + (await r.text()));
+  return (await r.json()).id;
+}
+async function like(jwt, id) {
+  await fetch(`${BASE}/api/v1/upload/${id}/like`, { method: 'POST', headers: authHeaders(jwt) });
+}
+async function comment(jwt, id, body) {
+  await fetch(`${BASE}/api/v1/upload/${id}/comments`, {
+    method: 'POST',
+    headers: authHeaders(jwt),
+    body: JSON.stringify({ body }),
+  });
+}
+
+const pg = () =>
+  new Client({
+    host: 'localhost',
+    port: 55432,
+    user: 'eventsnap_test',
+    password: 'eventsnap_test',
+    database: 'eventsnap_test',
+  });
+
+async function truncate(adminJwt) {
+  await fetch(`${BASE}/api/v1/admin/__truncate`, {
+    method: 'POST',
+    headers: authHeaders(adminJwt),
+  });
+}
+async function patchConfig(adminJwt, patch) {
+  await fetch(`${BASE}/api/v1/admin/config`, {
+    method: 'PATCH',
+    headers: authHeaders(adminJwt),
+    body: JSON.stringify(patch),
+  });
+}
+
+// ---- SEED ----
+console.log('[seed] admin login + reset');
+let admin = await adminLogin();
+await truncate(admin);
+admin = await adminLogin();
+await patchConfig(admin, {
+  rate_limits_enabled: 'false',
+  upload_rate_enabled: 'false',
+  feed_rate_enabled: 'false',
+  export_rate_enabled: 'false',
+  join_rate_enabled: 'false',
+  quota_enabled: 'false',
+  storage_quota_enabled: 'false',
+  upload_count_quota_enabled: 'false',
+});
+
+const guests = [
+  'Anna Bauer',
+  'Lukas Weber',
+  'Mia Schulz',
+  'Jonas Fischer',
+  'Emma Wagner',
+  'Ben Hoffmann',
+  'Sophie Klein',
+  'Paul Richter',
+];
+const accounts = {};
+for (const g of guests) accounts[g] = await joinGuest(g);
+console.log('[seed] joined', guests.length, 'guests');
+
+const posts = [
+  ['Anna Bauer', 'photo_00.jpg', 'Was für ein magischer Tag 💍✨', 'hochzeit,liebe'],
+  ['Lukas Weber', 'photo_01.jpg', 'Der erste Tanz 🕺💃', 'party,tanzen'],
+  ['Mia Schulz', 'photo_02.jpg', 'Sonnenuntergang am See 🌅', 'natur,abend'],
+  ['Jonas Fischer', 'photo_03.jpg', 'Prost auf das Brautpaar! 🥂', 'feier,freunde'],
+  ['Emma Wagner', 'photo_04.jpg', 'Die Torte war ein Traum 🍰', 'dessert,liebe'],
+  ['Ben Hoffmann', 'photo_05.jpg', 'Feuerwerk zum Abschluss 🎆', 'party,abend'],
+  ['Sophie Klein', 'photo_06.jpg', 'Beste Freunde für immer 💕', 'freunde,feier'],
+  ['Paul Richter', 'photo_07.jpg', 'Was für eine Stimmung! 🎉', 'party'],
+  ['Anna Bauer', 'photo_08.jpg', 'Details, die zählen 🌸', 'hochzeit'],
+  ['Mia Schulz', 'photo_09.jpg', 'Tanzfläche brennt 🔥', 'tanzen,party'],
+];
+const ids = [];
+for (const [who, f, cap, tags] of posts) {
+  const id = await upload(accounts[who].jwt, `${PHOTOS}/${f}`, cap, tags);
+  ids.push(id);
+}
+console.log('[seed] uploaded', ids.length, 'photos');
+
+// Likes: distribute varied counts
+const likeMatrix = [7, 3, 12, 5, 9, 4, 6, 2, 8, 5];
+for (let i = 0; i < ids.length; i++) {
+  const n = Math.min(likeMatrix[i], guests.length);
+  for (let j = 0; j < n; j++) await like(accounts[guests[j]].jwt, ids[i]);
+}
+// Comments on a few
+await comment(accounts['Lukas Weber'].jwt, ids[0], 'Wunderschön! 😍');
+await comment(accounts['Mia Schulz'].jwt, ids[0], 'Der Moment war perfekt.');
+await comment(accounts['Anna Bauer'].jwt, ids[2], 'Traumhaft 🌅');
+await comment(accounts['Ben Hoffmann'].jwt, ids[1], 'Was ein Abend!');
+console.log('[seed] likes + comments done');
+
+// Make one guest a host so /host renders populated
+await fetch(`${BASE}/api/v1/host/users/${accounts['Anna Bauer'].user_id}/role`, {
+  method: 'PATCH',
+  headers: authHeaders(admin),
+  body: JSON.stringify({ role: 'host' }),
+});
+
+// Wait for compression to finish so previews render
+const c = pg();
+await c.connect();
+for (let t = 0; t < 40; t++) {
+  const r = await c.query(
+    `SELECT COUNT(*)::int AS n FROM upload WHERE compression_status <> 'done' AND deleted_at IS NULL`
+  );
+  if (r.rows[0].n === 0) {
+    console.log('[seed] compression done');
+    break;
+  }
+  await new Promise((res) => setTimeout(res, 500));
+}
+await c.end();
+
+// ---- SCREENSHOTS ----
+const device = devices['Pixel 7'];
+const anna = accounts['Anna Bauer']; // host
+const shot = async (label, theme, who, route, prep) => {
+  const ctx = await browser.newContext({ ...device });
+  const page = await ctx.newPage();
+  // Seed localStorage on the origin
+  await page.goto(`${BASE}/join`, { waitUntil: 'domcontentloaded' });
+  await page.evaluate(
+    ({ jwt, pin, uid, name, theme, mode }) => {
+      localStorage.setItem('eventsnap_theme', theme);
+      localStorage.setItem('eventsnap_data_mode', mode);
+      if (jwt) {
+        localStorage.setItem('eventsnap_jwt', jwt);
+        localStorage.setItem('eventsnap_pin', pin);
+        localStorage.setItem('eventsnap_user_id', uid);
+        localStorage.setItem('eventsnap_display_name', name);
+      }
+      localStorage.setItem('eventsnap_guide_seen', '1');
+    },
+    { jwt: who?.jwt, pin: who?.pin, uid: who?.user_id, name: who?.name, theme, mode: 'saver' }
+  );
+  await page.goto(`${BASE}${route}`, { waitUntil: 'domcontentloaded' });
+  await page.waitForTimeout(1200);
+  if (prep) await prep(page);
+  await page.waitForTimeout(600);
+  await page.screenshot({ path: `${OUT}/${label}-${theme}.png`, fullPage: false });
+  await ctx.close();
+  console.log('[shot]', label, theme);
+};
+
+const browser = await chromium.launch();
+const hostWho = { ...anna, name: 'Anna Bauer' };
+const adminWho = { jwt: admin, pin: '', user_id: '', name: 'Admin' };
+
+for (const theme of ['light', 'dark']) {
+  await shot('01-join', theme, null, '/join');
+  await shot('02-feed-list', theme, hostWho, '/feed');
+  await shot('03-feed-grid', theme, hostWho, '/feed', async (p) => {
+    await p
+      .getByLabel('Rasteransicht')
+      .click()
+      .catch(() => {});
+  });
+  await shot('04-lightbox', theme, hostWho, '/feed', async (p) => {
+    await p
+      .locator('img')
+      .first()
+      .click()
+      .catch(() => {});
+    await p.waitForTimeout(500);
+  });
+  await shot('05-account', theme, hostWho, '/account');
+  await shot('06-host', theme, hostWho, '/host');
+  await shot('07-admin', theme, adminWho, '/admin');
+  await shot('08-upload', theme, hostWho, '/upload');
+  await shot('09-diashow', theme, hostWho, '/diashow');
+}
+// Onboarding: fresh guest, guide not seen
+{
+  const ctx = await browser.newContext({ ...device });
+  const page = await ctx.newPage();
+  await page.goto(`${BASE}/join`, { waitUntil: 'domcontentloaded' });
+  await page.evaluate((w) => {
+    localStorage.setItem('eventsnap_theme', 'light');
+    localStorage.setItem('eventsnap_jwt', w.jwt);
+    localStorage.setItem('eventsnap_pin', w.pin);
+    localStorage.setItem('eventsnap_user_id', w.user_id);
+    localStorage.setItem('eventsnap_display_name', 'Emma Wagner');
+  }, accounts['Emma Wagner']);
+  await page.goto(`${BASE}/feed`, { waitUntil: 'domcontentloaded' });
+  await page.waitForTimeout(1500);
+  await page.screenshot({ path: `${OUT}/10-onboarding-light.png` });
+  await ctx.close();
+  console.log('[shot] onboarding');
+}
+await browser.close();
+console.log('DONE');

e2e/specs/01-auth/join.spec.ts

@@ -13,7 +13,11 @@ test.describe('Auth — join flow', () => {
     const join = new JoinPage(page);
     await join.goto();
 
-    await expect(page.getByRole('heading', { name: 'Willkommen!' })).toBeVisible();
+    // The join form's landing state. There is no "Willkommen!" heading — the wedding
+    // redesign (f243bfe) split it into a "Willkommen bei" lead-in plus the event name as
+    // the <h1>, and this assertion was never updated, so it had been failing since.
+    // Anchor on the testid the markup provides rather than on copy.
+    await expect(page.getByTestId('join-event-name')).toBeVisible();
 
     const { pin } = await join.joinAs('Alice');
     expect(pin).toMatch(/^\d{4}$/);

e2e/specs/01-auth/rate-limit-shared-nat.spec.ts

@@ -0,0 +1,206 @@
+/**
+ * Regression guard — the door must not close on a venue behind one NAT.
+ *
+ * `/join` was throttled 5 per 60s keyed purely on the client IP. Every guest at a venue
+ * arrives from the same public IP (that is what a NAT is), so the whole party shared one
+ * bucket: 12 guests scanning the QR code within a few seconds meant 5 got in and 7 were
+ * turned away — with no Retry-After to tell them when to try again. `/feed` (60/min) and
+ * `/export` (3/DAY) had the identical defect.
+ *
+ * These ran green for the same structural reason every time: the e2e reseed forces every
+ * limiter toggle OFF before each test, so nothing here was ever exercised. Enable them
+ * explicitly, exactly as 02-upload/rate-limit does.
+ */
+import { test, expect } from '../../fixtures/test';
+import { BASE } from '../../helpers/env';
+
+test.describe('Rate limits — guests behind a shared NAT', () => {
+  test('a dozen guests can all join from one IP, and 429s carry Retry-After', async ({
+    api,
+    adminToken,
+  }) => {
+    await api.patchConfig(adminToken, {
+      rate_limits_enabled: 'true',
+      join_rate_enabled: 'true',
+    });
+
+    // Twelve DISTINCT guests, same source IP — the arrival burst at a real party.
+    const names = Array.from({ length: 12 }, (_, i) => `NatGuest${i}`);
+    const results = await Promise.all(
+      names.map((display_name) =>
+        fetch(`${BASE}/api/v1/join`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ display_name }),
+        })
+      )
+    );
+
+    const rejected = results.filter((r) => r.status === 429);
+    expect(
+      rejected.length,
+      `all 12 guests must get in from one IP; ${rejected.length} were turned away`
+    ).toBe(0);
+    expect(results.every((r) => r.status === 201)).toBe(true);
+  });
+
+  test('one guest retrying their own name is still throttled, and told for how long', async ({
+    api,
+    adminToken,
+  }) => {
+    // The per-name bucket must still bite — otherwise the NAT fix would have simply
+    // removed the anti-spam limit rather than re-keyed it.
+    await api.patchConfig(adminToken, {
+      rate_limits_enabled: 'true',
+      join_rate_enabled: 'true',
+    });
+
+    const attempt = () =>
+      fetch(`${BASE}/api/v1/join`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ display_name: 'RepeatOffender' }),
+      });
+
+    // 5 per 60s for the same (ip, name): the first succeeds (201), the next four collide
+    // with the taken name (409), and the sixth exhausts the bucket.
+    const codes: number[] = [];
+    for (let i = 0; i < 6; i++) codes.push((await attempt()).status);
+
+    expect(codes[0], 'the first join should succeed').toBe(201);
+    expect(codes.at(-1), 'the 6th attempt on one name must be throttled').toBe(429);
+
+    const throttled = await attempt();
+    expect(throttled.status).toBe(429);
+    const retryAfter = throttled.headers.get('retry-after');
+    expect(retryAfter, '429 must tell the client when to come back').toBeTruthy();
+    expect(Number(retryAfter)).toBeGreaterThan(0);
+    expect(Number(retryAfter)).toBeLessThanOrEqual(60);
+  });
+
+  test('the feed limit is per-user, not per-IP', async ({ api, adminToken, guest }) => {
+    // Two guests, one IP. With a limit of 3/min an IP key would let the first guest's
+    // three reads starve the second entirely.
+    await api.patchConfig(adminToken, {
+      rate_limits_enabled: 'true',
+      feed_rate_enabled: 'true',
+      feed_rate_per_min: '3',
+    });
+
+    const a = await guest('FeedHog');
+    const b = await guest('FeedVictim');
+    const read = (jwt: string) =>
+      fetch(`${BASE}/api/v1/feed`, { headers: { Authorization: `Bearer ${jwt}` } });
+
+    // Guest A burns their whole allowance.
+    for (let i = 0; i < 3; i++) expect((await read(a.jwt)).status).toBe(200);
+    expect((await read(a.jwt)).status, "A's own 4th read is throttled").toBe(429);
+
+    // Guest B must be entirely unaffected.
+    expect((await read(b.jwt)).status, 'B must not inherit A’s exhausted bucket').toBe(200);
+  });
+
+  test('the export limit is per-user — one guest cannot spend the whole venue’s quota', async ({
+    api,
+    adminToken,
+    guest,
+    host,
+    db,
+  }) => {
+    // The sharpest case: 3 downloads per DAY on an IP key meant the 4th guest to fetch
+    // their keepsake was locked out until tomorrow.
+    await db.setExportReleased('e2e-test-event', true);
+    await api.patchConfig(adminToken, {
+      rate_limits_enabled: 'true',
+      export_rate_enabled: 'true',
+      export_rate_per_day: '1',
+    });
+
+    const mintAndFetch = async (jwt: string) => {
+      const res = await fetch(`${BASE}/api/v1/export/ticket`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${jwt}` },
+      });
+      const { ticket } = await res.json();
+      return fetch(`${BASE}/api/v1/export/zip?ticket=${encodeURIComponent(ticket)}`);
+    };
+
+    const a = await guest('ExportFirst');
+    const b = await guest('ExportSecond');
+
+    // A spends their single daily allowance. The archive itself may not exist (404) —
+    // what matters is that the limiter admitted the request rather than 429ing it.
+    expect((await mintAndFetch(a.jwt)).status).not.toBe(429);
+    expect((await mintAndFetch(a.jwt)).status, 'A’s second download is throttled').toBe(429);
+
+    // B shares A's IP and must still get their keepsake.
+    expect((await mintAndFetch(b.jwt)).status, 'B must not be locked out by A’s download').not.toBe(
+      429
+    );
+
+    // And the host too, for good measure.
+    expect((await mintAndFetch(host.jwt)).status).not.toBe(429);
+  });
+});
+
+test.describe('Rate limits — /recover name cycling', () => {
+  test('cycling names from one IP hits the ceiling, while one name is still throttled', async ({
+    api,
+    adminToken,
+  }) => {
+    // /recover is keyed `recover:{ip}:{name}` — right for its job (stopping someone who
+    // knows a display name from burning the victim's 3-strike PIN counter), but the name is
+    // ATTACKER-CHOSEN, so cycling names minted a fresh bucket every time. Behind it sits a
+    // cost-12 bcrypt verify, including an unconditional throwaway one for unknown names, so
+    // a name generator was the cheapest way to make the server hash forever.
+    //
+    // Squeeze the ceiling so the flood is reproducible without firing 30+ requests.
+    await api.patchConfig(adminToken, {
+      rate_limits_enabled: 'true',
+      recover_rate_enabled: 'true',
+      recover_ip_rate_per_min: '5',
+    });
+
+    const attempt = (name: string) =>
+      fetch(`${BASE}/api/v1/recover`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ display_name: name, pin: '0000' }),
+      });
+
+    // Every name is distinct, so the per-name bucket can never fire — only the ceiling can.
+    const codes: number[] = [];
+    for (let i = 0; i < 12; i++) codes.push((await attempt(`Unbekannt${i}_${Date.now()}`)).status);
+
+    expect(
+      codes.filter((c) => c === 429).length,
+      'name cycling must be capped by the per-IP ceiling'
+    ).toBeGreaterThan(0);
+
+    const throttled = await attempt(`Unbekannt99_${Date.now()}`);
+    expect(throttled.status).toBe(429);
+    expect(Number(throttled.headers.get('retry-after'))).toBeGreaterThan(0);
+  });
+
+  test('the per-name bucket still protects a real account', async ({ api, adminToken, guest }) => {
+    // The ceiling must not have REPLACED the anti-guessing control. With a generous ceiling,
+    // repeated wrong PINs against ONE name must still be shut down by the per-name bucket.
+    const victim = await guest('PinVictim');
+    await api.patchConfig(adminToken, {
+      rate_limits_enabled: 'true',
+      recover_rate_enabled: 'true',
+      recover_ip_rate_per_min: '1000',
+    });
+
+    const attempt = () =>
+      fetch(`${BASE}/api/v1/recover`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ display_name: victim.displayName, pin: '9999' }),
+      });
+
+    const codes: number[] = [];
+    for (let i = 0; i < 7; i++) codes.push((await attempt()).status);
+    expect(codes.at(-1), 'guessing one name must still be throttled').toBe(429);
+  });
+});

e2e/specs/02-upload/burst-queue.spec.ts

@@ -0,0 +1,219 @@
+/**
+ * Client upload-queue under a realistic burst — the scenario an event actually
+ * produces (a guest multi-selects 10-20 photos at once) and the one the
+ * server-side load test could NOT cover, because that test hit POST /upload
+ * directly and bypassed the browser queue entirely.
+ *
+ * Drives the REAL client path (UploadSheet → /upload → addToQueue →
+ * processQueue → XHR) and asserts the four properties that matter for not
+ * losing a guest's photos:
+ *
+ *   1. SERIAL drain      — the queue uploads ONE file at a time per device
+ *                          (processQueue's find-next-pending loop), never a
+ *                          parallel fan-out. Proven by counting how many upload
+ *                          requests sit in the intercept handler at once.
+ *   2. PERSISTENCE       — every staged file is written to IndexedDB with its
+ *                          blob before it's sent, and the blob is dropped only
+ *                          after the upload succeeds. Read straight out of IDB
+ *                          mid-burst.
+ *   3. ALL LAND          — every file in the burst is created server-side.
+ *   4. RESUME ON RELOAD  — a hard reload mid-burst (tab closed / PWA killed)
+ *                          resumes the remaining uploads from IndexedDB via
+ *                          loadQueue(), losing nothing.
+ *
+ * A tiny per-upload latency is injected via route interception so the serial
+ * drain is observable and there's a window to reload mid-burst — no need for
+ * large fixture files.
+ */
+import { test, expect } from '../../fixtures/test';
+import { skipIfNoIdbBlobs } from '../../helpers/webkit';
+import { FeedPage, UploadSheet } from '../../page-objects';
+import { mkdtempSync, copyFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import type { Page } from '@playwright/test';
+
+const SAMPLE_JPG = join(process.cwd(), 'fixtures', 'media', 'sample.jpg');
+const BURST = 16; // in the 10-20 "multi-select" range
+
+// Make BURST distinct files. The queue dedupes on name+size+lastModified, so
+// distinct NAMES are enough to keep them from collapsing into one item — content
+// can be identical (we only assert rows are created, not what they decode to).
+function makeBurstFiles(): { dir: string; paths: string[] } {
+  const dir = mkdtempSync(join(tmpdir(), 'eventsnap-burst-'));
+  const paths = Array.from({ length: BURST }, (_, i) => {
+    const p = join(dir, `burst_${String(i).padStart(2, '0')}.jpg`);
+    copyFileSync(SAMPLE_JPG, p);
+    return p;
+  });
+  return { dir, paths };
+}
+
+// White-box: read the queue rows straight from IndexedDB, including whether the
+// blob is still attached — so we can prove blobs are kept until upload and
+// dropped after. Mirrors the reader in offline-resume.spec.
+async function queueRows(page: Page): Promise<Array<{ status: string; hasBlob: boolean }>> {
+  return page.evaluate(async () => {
+    return new Promise<Array<{ status: string; hasBlob: boolean }>>((resolve, reject) => {
+      const req = indexedDB.open('eventsnap-uploads', 3);
+      req.onerror = () => reject(req.error);
+      req.onsuccess = () => {
+        const dbh = req.result;
+        const tx = dbh.transaction('queue', 'readonly');
+        const all = tx.objectStore('queue').getAll();
+        all.onsuccess = () =>
+          resolve(all.result.map((r: any) => ({ status: r.status, hasBlob: r.blob != null })));
+        all.onerror = () => reject(all.error);
+      };
+    });
+  });
+}
+
+/**
+ * Intercept POST /upload to (a) inject latency so the serial drain is observable
+ * and (b) count how many uploads are in the handler simultaneously. A serial
+ * client never has more than one in flight; a parallel fan-out would spike.
+ * Returns a `peak()` accessor for the max concurrency seen.
+ */
+async function instrumentUploads(page: Page, delayMs: number) {
+  let active = 0;
+  let peak = 0;
+  await page.route('**/api/v1/upload', async (route) => {
+    active++;
+    peak = Math.max(peak, active);
+    await new Promise((r) => setTimeout(r, delayMs));
+    active--;
+    await route.continue();
+  });
+  return { peak: () => peak };
+}
+
+async function warmUploadChunk(page: Page) {
+  // Load the code-split /upload route while online so a later reload/navigation
+  // doesn't fetch the chunk at a bad moment (mirrors offline-resume.spec).
+  await page.goto('/upload');
+  await page.goto('/feed');
+}
+
+test.describe('Upload — client queue under a burst', () => {
+  test('a 16-file burst drains serially, persists to IndexedDB, and all land', async ({
+    page,
+    guest,
+    signIn,
+    db,
+    browserName,
+  }) => {
+    skipIfNoIdbBlobs(browserName);
+    const g = await guest('BurstSerial');
+    await signIn(page, g);
+    await warmUploadChunk(page);
+    const uploads = await instrumentUploads(page, 200);
+
+    // Stage the whole burst through the real UI.
+    const { dir, paths } = makeBurstFiles();
+    try {
+      const feed = new FeedPage(page);
+      const sheet = new UploadSheet(page);
+      await feed.openUploadSheet();
+      await sheet.stageFiles(paths);
+      await sheet.captionInput.waitFor({ state: 'visible', timeout: 10_000 });
+      await sheet.fillCaption('burst of 16 #hochzeit');
+      await sheet.submit();
+      await page.waitForURL('**/feed', { timeout: 15_000 });
+
+      // (2) PERSISTENCE: all 16 are written to IndexedDB with blobs essentially
+      // immediately — before most have been sent. Catch the burst while the
+      // queue still holds most of them.
+      await expect
+        .poll(async () => (await queueRows(page)).length, { timeout: 10_000 })
+        .toBe(BURST);
+
+      // While draining, pending rows keep their blob; done rows have dropped it.
+      // Poll for a mid-burst moment that shows both invariants at once.
+      await expect
+        .poll(
+          async () => {
+            const rows = await queueRows(page);
+            const pendingKeepBlob = rows
+              .filter((r) => r.status === 'pending' || r.status === 'uploading')
+              .every((r) => r.hasBlob);
+            const doneDropBlob = rows.filter((r) => r.status === 'done').every((r) => !r.hasBlob);
+            return pendingKeepBlob && doneDropBlob;
+          },
+          { timeout: 10_000 }
+        )
+        .toBe(true);
+
+      // (3) ALL LAND: every file is created server-side.
+      await expect.poll(() => db.countUploadsForUser(g.userId), { timeout: 30_000 }).toBe(BURST);
+
+      // (1) SERIAL: never more than one upload in flight at a time.
+      expect(uploads.peak()).toBe(1);
+
+      // Clean end — the queue settles all items to done (no stuck error/blocked).
+      await expect
+        .poll(async () => (await queueRows(page)).every((r) => r.status === 'done'), {
+          timeout: 10_000,
+        })
+        .toBe(true);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('a hard reload mid-burst resumes the remaining uploads — nothing lost', async ({
+    page,
+    guest,
+    signIn,
+    db,
+    browserName,
+  }) => {
+    skipIfNoIdbBlobs(browserName);
+    const g = await guest('BurstResume');
+    await signIn(page, g);
+    await warmUploadChunk(page);
+    // Bigger delay → a wide, reliable mid-burst window to reload inside. (We don't
+    // assert seriality here — test 1 already proves it, and a reload aborts the
+    // in-flight request mid-intercept, which would overcount concurrency.)
+    await instrumentUploads(page, 300);
+
+    const { dir, paths } = makeBurstFiles();
+    try {
+      const feed = new FeedPage(page);
+      const sheet = new UploadSheet(page);
+      await feed.openUploadSheet();
+      await sheet.stageFiles(paths);
+      await sheet.captionInput.waitFor({ state: 'visible', timeout: 10_000 });
+      await sheet.fillCaption('burst then reload');
+      await sheet.submit();
+      await page.waitForURL('**/feed', { timeout: 15_000 });
+
+      // Wait until we're genuinely mid-burst: a few landed, but far from all.
+      await expect
+        .poll(() => db.countUploadsForUser(g.userId), { timeout: 20_000 })
+        .toBeGreaterThanOrEqual(3);
+      const landedBeforeReload = await db.countUploadsForUser(g.userId);
+      expect(landedBeforeReload).toBeLessThan(BURST);
+
+      // Hard reload — wipes the JS module (and its in-flight drain), exactly like
+      // a closed tab / killed PWA. The remaining pending items live only in
+      // IndexedDB now.
+      await page.reload();
+      // The queue only resumes where loadQueue() runs — the /upload route's
+      // onMount. Navigating there is the "reopen the composer" recovery path.
+      await page.goto('/upload');
+
+      // (4) RESUME: every file ends up server-side without re-staging anything.
+      // `>=` not `===`: the only imperfection possible is a DUPLICATE (an upload
+      // that succeeded server-side in the ~1ms between the XHR load event and the
+      // IndexedDB 'done' write, caught by the reload, then re-sent on resume).
+      // That's at worst one extra row, never a lost photo — the property we care
+      // about. A shortfall (< BURST) would be a real data-loss regression.
+      await expect
+        .poll(() => db.countUploadsForUser(g.userId), { timeout: 30_000 })
+        .toBeGreaterThanOrEqual(BURST);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

e2e/specs/02-upload/exif-orientation.spec.ts

@@ -0,0 +1,80 @@
+/**
+ * Regression guard — EXIF orientation must be applied when generating derivatives.
+ *
+ * Phones do not rotate sensor data. They shoot in the sensor's native landscape and record
+ * how the camera was held in an EXIF `Orientation` tag. `image`'s `decode()` returns the raw
+ * pixels and ignores that tag, and the JPEG re-encode writes no EXIF at all — so every
+ * portrait photo was stored SIDEWAYS in the 800px feed preview, the 2048px diashow display
+ * and the keepsake, while "Original anzeigen" still rendered it upright (the original keeps
+ * its tag). That asymmetry is why it reads as a viewer bug instead of a pipeline one.
+ *
+ * The fixture is 40x20 landscape pixels tagged Orientation=6 ("rotate 90° CW to display"),
+ * so a correctly-processed derivative is PORTRAIT (20x40). Asserting on the aspect ratio
+ * rather than the bytes keeps this robust across encoder changes.
+ */
+import { test, expect } from '../../fixtures/test';
+import { uploadRaw } from '../../helpers/upload-client';
+import { BASE } from '../../helpers/env';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const EXIF_FIXTURE = join(process.cwd(), 'fixtures', 'media', 'portrait-exif6.jpg');
+
+/**
+ * Read a baseline/progressive JPEG's pixel dimensions from its SOF marker.
+ * Avoids pulling an image dependency into the suite for one assertion.
+ */
+function jpegSize(buf: Buffer): { width: number; height: number } {
+  let i = 2; // skip SOI
+  while (i < buf.length) {
+    if (buf[i] !== 0xff) {
+      i++;
+      continue;
+    }
+    const marker = buf[i + 1];
+    // SOF0..SOF15, excluding DHT (c4), JPGA (c8) and DAC (cc)
+    if (marker >= 0xc0 && marker <= 0xcf && marker !== 0xc4 && marker !== 0xc8 && marker !== 0xcc) {
+      return { height: buf.readUInt16BE(i + 5), width: buf.readUInt16BE(i + 7) };
+    }
+    i += 2 + buf.readUInt16BE(i + 2);
+  }
+  throw new Error('no SOF marker found — not a JPEG?');
+}
+
+test.describe('Upload — EXIF orientation', () => {
+  test('a rotated photo is upright in the preview and the display derivative', async ({
+    guest,
+    db,
+  }) => {
+    const g = await guest('SidewaysShooter');
+
+    const res = await uploadRaw(g.jwt, readFileSync(EXIF_FIXTURE), {
+      filename: 'portrait-exif6.jpg',
+      contentType: 'image/jpeg',
+      caption: 'hochkant',
+    });
+    expect(res.status).toBe(201);
+    const { id } = (await res.json()) as { id: string };
+
+    // Sanity: the SOURCE really is stored landscape with the tag, otherwise this test
+    // could pass against a pipeline that does nothing.
+    const source = jpegSize(readFileSync(EXIF_FIXTURE));
+    expect(source.width).toBeGreaterThan(source.height);
+
+    await expect
+      .poll(() => db.compressionStatus(id), { timeout: 30_000, intervals: [250] })
+      .toBe('done');
+
+    for (const variant of ['preview', 'display'] as const) {
+      const r = await fetch(`${BASE}/api/v1/upload/${id}/${variant}`, {
+        headers: { Authorization: `Bearer ${g.jwt}` },
+      });
+      expect(r.status, `${variant} must be served`).toBe(200);
+      const { width, height } = jpegSize(Buffer.from(await r.arrayBuffer()));
+      expect(
+        height,
+        `${variant} must be portrait (${width}x${height}) — EXIF orientation was not applied`
+      ).toBeGreaterThan(width);
+    }
+  });
+});

e2e/specs/02-upload/gallery-path.spec.ts

@@ -4,6 +4,7 @@
  * IndexedDB queue resumption after refresh, and SSE `upload-processed`.
  */
 import { test, expect } from '../../fixtures/test';
+import { skipIfNoIdbBlobs } from '../../helpers/webkit';
 import { FeedPage, UploadSheet } from '../../page-objects';
 import { SseListener } from '../../helpers/sse-listener';
 import { join } from 'node:path';
@@ -49,7 +50,9 @@ test.describe('Upload — gallery path', () => {
     guest,
     signIn,
     db,
+    browserName,
   }) => {
+    skipIfNoIdbBlobs(browserName);
     // Previously fixme'd: the UI queue never fired a POST. Root cause was NOT a
     // navigation/blob timing quirk but an IndexedDB upgrade bug — the v1→v2
     // `upgrade` callback opened a *new* transaction, which throws during a

e2e/specs/02-upload/oversized-image.spec.ts

@@ -0,0 +1,100 @@
+/**
+ * Regression guard — an image that would blow the decode budget must be refused at the
+ * door, with a reason the guest can act on, and must never allocate.
+ *
+ * Two defects met here.
+ *
+ * 1. The budget was inert. `max_alloc = 256 MiB` was set, but reading the EXIF orientation
+ *    tag requires `ImageReader::into_decoder()`, which skips the
+ *    `limits.reserve(decoder.total_bytes())` that `decode()` performs — and nothing else
+ *    enforces it (the JPEG decoder's `set_limits` only checks support and dimensions). The
+ *    only real bound was the 12000px per-axis cap, leaving two concurrent decodes at
+ *    824 MiB against a 1 GiB container. This suite could not have caught it either, because
+ *    the e2e app container had NO memory limit while production is capped at 1 GiB; that cap
+ *    is now mirrored in docker-compose.test.yml so these assertions mean something.
+ *
+ * 2. Even with the budget restored, the upload was ACCEPTED with a 201 and then silently
+ *    soft-deleted minutes later when the worker gave up — the photo simply vanished, with at
+ *    best a vague "could not be processed". Admission now runs the same budget check against
+ *    the header, so the guest is told immediately and told why.
+ *
+ * Fixture: 11000x9000 = 99 MP, 568 KiB on disk. Deliberately UNDER the per-axis cap, so the
+ * axis check cannot be what rejects it — 283 MiB decoded against a 256 MiB budget. A fixture
+ * at 13000px would pass this test against a build with no budget at all.
+ */
+import { test, expect } from '../../fixtures/test';
+import { uploadRaw } from '../../helpers/upload-client';
+import { BASE } from '../../helpers/env';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const HUGE = join(process.cwd(), 'fixtures', 'media', 'huge-99mp.jpg');
+const SAMPLE = join(process.cwd(), 'fixtures', 'media', 'sample.jpg');
+
+test.describe('Upload — an oversized image is refused, not allocated', () => {
+  test('a 99 MP upload is rejected at admission with a readable reason', async ({ guest, db }) => {
+    test.setTimeout(60_000);
+    const g = await guest('BombThrower');
+    const before = await db.countUploadsForUser(g.userId);
+
+    const res = await uploadRaw(g.jwt, readFileSync(HUGE), {
+      filename: 'huge.jpg',
+      contentType: 'image/jpeg',
+      caption: 'zu gross',
+    });
+
+    // 4xx, not 201-then-vanish. The queue classifies this as terminal, so the guest gets the
+    // message rather than watching the photo disappear.
+    expect(res.status, 'an undecodable image must be refused at the door').toBe(400);
+    const body = (await res.json()) as { message?: string };
+    expect(body.message ?? '', 'the reason must be actionable, not generic').toMatch(/bildpunkte/i);
+    expect(body.message ?? '', 'and should name the size so it is obvious why').toMatch(/99/);
+
+    // Nothing was stored — no row to soft-delete later, no orphaned file to sweep.
+    expect(await db.countUploadsForUser(g.userId)).toBe(before);
+
+    // The backend never allocated: it is still alive and still doing useful work.
+    expect((await fetch(`${BASE}/health`)).status).toBe(200);
+    const ok = await uploadRaw(g.jwt, readFileSync(SAMPLE), {
+      filename: 'after.jpg',
+      contentType: 'image/jpeg',
+    });
+    expect(ok.status).toBe(201);
+    const after = (await ok.json()) as { id: string };
+    await expect.poll(() => db.compressionStatus(after.id), { timeout: 30_000 }).toBe('done');
+  });
+
+  test('a burst of oversized uploads leaves the container alive', async ({ guest }) => {
+    // The concurrent case is the one that OOM'd: `compression_concurrency` is 2, so decodes
+    // overlapped. Four at once is comfortably past that, and must still cost only header
+    // reads.
+    test.setTimeout(60_000);
+    const g = await guest('BombThrower2');
+    const bytes = readFileSync(HUGE);
+
+    const results = await Promise.all(
+      Array.from({ length: 4 }, (_, i) =>
+        uploadRaw(g.jwt, bytes, { filename: `huge-${i}.jpg`, contentType: 'image/jpeg' })
+      )
+    );
+    expect(results.map((r) => r.status)).toEqual([400, 400, 400, 400]);
+
+    expect(
+      (await fetch(`${BASE}/health`)).status,
+      'concurrent oversized uploads must not kill the backend'
+    ).toBe(200);
+  });
+
+  test('an ordinary photo is unaffected by the admission check', async ({ guest, db }) => {
+    // The mirror that keeps the check honest: a budget that rejected everything would pass
+    // both tests above.
+    const g = await guest('NormalShooter');
+    const res = await uploadRaw(g.jwt, readFileSync(SAMPLE), {
+      filename: 'normal.jpg',
+      contentType: 'image/jpeg',
+    });
+    expect(res.status).toBe(201);
+    const { id } = (await res.json()) as { id: string };
+    await expect.poll(() => db.compressionStatus(id), { timeout: 30_000 }).toBe('done');
+  });
+});

e2e/specs/02-upload/quota.spec.ts

@@ -56,14 +56,21 @@ function upload(jwt: string, name: string) {
 /**
  * Pick a `quota_tolerance` that makes the per-user ceiling land on `targetBytes`.
  * limit = floor(free_disk * tolerance / max(active, 1))  ⇒  tolerance = target * active / free.
+ *
+ * `staffJwt` reads the calibration inputs, `jwt` is the guest the limit is being aimed at.
+ * They must be different tokens: `free_disk_bytes` and `active_uploaders` are raw server
+ * telemetry and `/me/quota` zeroes both for non-staff (handlers/me.rs — "must never reach a
+ * guest"). Calibrating off the guest's own response divides by zero and yields a NaN
+ * tolerance, which is what silently broke this whole describe block.
  */
 async function setLimitTo(
   api: any,
   adminToken: string,
+  staffJwt: string,
   jwt: string,
   targetBytes: number
 ): Promise<number> {
-  const q = await quotaOf(jwt);
+  const q = await quotaOf(staffJwt);
   expect(
     q.free_disk_bytes,
     'the disk must be readable, else quota fails OPEN and proves nothing'
@@ -72,6 +79,7 @@ async function setLimitTo(
   const tolerance = (targetBytes * active) / (q.free_disk_bytes as number);
   await api.patchConfig(adminToken, { quota_tolerance: tolerance.toExponential(12) });
 
+  // Read back through the GUEST, whose ceiling is the one under test.
   const after = await quotaOf(jwt);
   expect(after.enabled).toBe(true);
   return after.limit_bytes as number;
@@ -89,10 +97,11 @@ test.describe('Upload — storage quota enforcement', () => {
     api,
     adminToken,
     guest,
+    host,
   }) => {
     const g = await guest('QuotaOver');
     // Ceiling below one file: the very first upload must be refused.
-    const limit = await setLimitTo(api, adminToken, g.jwt, Math.floor(SIZE / 2));
+    const limit = await setLimitTo(api, adminToken, host.jwt, g.jwt, Math.floor(SIZE / 2));
     expect(limit).toBeLessThan(SIZE);
 
     const res = await upload(g.jwt, 'too-big.jpg');
@@ -111,9 +120,10 @@ test.describe('Upload — storage quota enforcement', () => {
     api,
     adminToken,
     guest,
+    host,
   }) => {
     const g = await guest('QuotaUnder');
-    await setLimitTo(api, adminToken, g.jwt, SIZE * 4);
+    await setLimitTo(api, adminToken, host.jwt, g.jwt, SIZE * 4);
 
     expect((await upload(g.jwt, 'fine.jpg')).status).toBe(201);
     expect((await quotaOf(g.jwt)).used_bytes).toBe(SIZE);
@@ -123,11 +133,12 @@ test.describe('Upload — storage quota enforcement', () => {
     api,
     adminToken,
     guest,
+    host,
   }) => {
     const g = await guest('QuotaRacer');
 
     // Room for exactly ONE file.
-    const limit = await setLimitTo(api, adminToken, g.jwt, Math.floor(SIZE * 1.5));
+    const limit = await setLimitTo(api, adminToken, host.jwt, g.jwt, Math.floor(SIZE * 1.5));
     expect(limit).toBeGreaterThanOrEqual(SIZE);
     expect(limit).toBeLessThan(SIZE * 2);
 
@@ -170,10 +181,11 @@ test.describe('Upload — storage quota enforcement', () => {
     api,
     adminToken,
     guest,
+    host,
   }) => {
     // Zero test hits before this — and it is the source of the "X von Y MB genutzt" widget.
     const g = await guest('QuotaWidget');
-    await setLimitTo(api, adminToken, g.jwt, SIZE * 10);
+    await setLimitTo(api, adminToken, host.jwt, g.jwt, SIZE * 10);
 
     const before = await quotaOf(g.jwt);
     expect(before.enabled).toBe(true);

e2e/specs/02-upload/rejection-visible.spec.ts

@@ -0,0 +1,87 @@
+/**
+ * Regression guard — a rejected upload must tell the user something.
+ *
+ * `UploadQueue.svelte` was 162 lines of complete, working UI — the only renderer of an
+ * item's error text, the only "Erneut" retry button, the only rate-limit countdown — and it
+ * was never imported anywhere, so `retryItem`, `removeItem` and `clearCompleted` were all
+ * unreachable at runtime. On a terminal rejection the store dropped the blob, wrote a clear
+ * German reason into `entry.error` with the comment "so the UI shows a clear reason", and
+ * there was no such UI.
+ *
+ * Meanwhile the FAB badge counted only pending/uploading, so a rejected photo decremented it
+ * exactly as if it had succeeded. Net effect: the photo silently vanished — no toast, no
+ * queue row, no error text, and it never appeared in the feed.
+ */
+import { test, expect } from '../../fixtures/test';
+import { skipIfNoIdbBlobs } from '../../helpers/webkit';
+import { FeedPage, UploadSheet } from '../../page-objects';
+import { join } from 'node:path';
+
+const SAMPLE_JPG = join(process.cwd(), 'fixtures', 'media', 'sample.jpg');
+
+test.describe('Upload — a rejected upload is surfaced', () => {
+  test('a terminally rejected upload toasts, and stays visible in the queue', async ({
+    page,
+    api,
+    host,
+    guest,
+    signIn,
+    browserName,
+  }) => {
+    skipIfNoIdbBlobs(browserName);
+    const g = await guest('RejectedUploader');
+    await signIn(page, g);
+
+    const feed = new FeedPage(page);
+    const sheet = new UploadSheet(page);
+    await feed.openUploadSheet();
+    await sheet.stageFiles([SAMPLE_JPG]);
+    await sheet.captionInput.waitFor({ state: 'visible', timeout: 10_000 });
+
+    // Ban the uploader between staging and sending, so the POST comes back 403 — a
+    // terminal 4xx the server will keep rejecting, which is the path that purges the blob.
+    await api.banUser(host.jwt, g.userId);
+
+    await sheet.submit();
+
+    // 1. The user is told, wherever they are (the flow lands them on /feed).
+    const toast = page.getByRole('region', { name: 'Benachrichtigungen' });
+    await expect(toast).toContainText(/sample\.jpg/i, { timeout: 15_000 });
+
+    // 2. The queue row survives with its reason and is reachable on /upload — this is what
+    //    the orphaned component made impossible.
+    await page.goto('/upload');
+    const queue = page.getByText('Upload-Warteschlange');
+    await expect(queue, 'the upload queue must be rendered somewhere').toBeVisible({
+      timeout: 10_000,
+    });
+    // Both the status chip ("Gesperrt") and the server's reason ("Du bist gesperrt.") must
+    // render — the reason is the part that had no UI at all before.
+    await expect(page.getByText('Gesperrt', { exact: true })).toBeVisible();
+    await expect(page.getByText('Du bist gesperrt.')).toBeVisible();
+
+    // 3. The badge must not read as success. It counted only pending/uploading before, so a
+    //    rejected item dropped it to 0 — indistinguishable from a completed upload.
+    await expect
+      .poll(
+        () =>
+          page.evaluate(async () => {
+            return new Promise<number>((resolve, reject) => {
+              const req = indexedDB.open('eventsnap-uploads', 3);
+              req.onerror = () => reject(req.error);
+              req.onsuccess = () => {
+                const tx = req.result.transaction('queue', 'readonly');
+                const all = tx.objectStore('queue').getAll();
+                all.onsuccess = () =>
+                  resolve(
+                    all.result.filter((r: { status: string }) => r.status === 'blocked').length
+                  );
+                all.onerror = () => reject(all.error);
+              };
+            });
+          }),
+        { timeout: 10_000 }
+      )
+      .toBe(1);
+  });
+});

e2e/specs/03-feed/social-rate-limit.spec.ts

@@ -0,0 +1,136 @@
+/**
+ * Regression guard — likes, comments and comment deletions are rate limited.
+ *
+ * These were the only mutating endpoints in the app with no limit at all. Every other write path
+ * -- upload, join, recover, export, admin login -- carried one; `social.rs` carried none, so the
+ * coverage was asymmetric rather than deliberately open.
+ *
+ * Severity is genuinely low for an invited-guest event, and the amplification worry is contained:
+ * a like does fan an SSE broadcast to every connected client, but the export regeneration a
+ * comment deletion triggers is debounced (REGEN_DEBOUNCE 20s) and superseded workers are inert. So
+ * this closes the gap for symmetry, and the ceiling is set well above anything a real guest
+ * produces -- it bounds a script, not an enthusiastic double-tapper.
+ *
+ * The bucket is shared across all three actions on purpose: separate buckets would let a caller
+ * triple the aggregate write rate just by alternating between them. That is what the second test
+ * pins, and it is the part most likely to be lost in a refactor.
+ *
+ * Keyed per USER, not per IP — at a venue every guest is behind one NAT, so an IP key would hand
+ * the whole party one bucket. Third test.
+ */
+import { test, expect } from '../../fixtures/test';
+import { seedUpload } from '../../helpers/seed';
+import { BASE } from '../../helpers/env';
+
+const like = (jwt: string, uploadId: string) =>
+  fetch(`${BASE}/api/v1/upload/${uploadId}/like`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${jwt}` },
+  });
+
+const comment = (jwt: string, uploadId: string, body: string) =>
+  fetch(`${BASE}/api/v1/upload/${uploadId}/comments`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${jwt}`, 'Content-Type': 'application/json' },
+    body: JSON.stringify({ body }),
+  });
+
+test.describe('Social — rate limit', () => {
+  test('a burst of likes past the ceiling returns 429 with Retry-After', async ({
+    api,
+    adminToken,
+    guest,
+  }) => {
+    await api.patchConfig(adminToken, {
+      rate_limits_enabled: 'true',
+      social_rate_enabled: 'true',
+      social_rate_per_min: '3',
+    });
+
+    const g = await guest('Tapper');
+    const uploadId = await seedUpload(g.jwt);
+
+    // Sequential, not parallel: a toggle flips state, so ordering matters for the assertion.
+    const statuses: number[] = [];
+    for (let i = 0; i < 5; i++) statuses.push((await like(g.jwt, uploadId)).status);
+
+    expect(statuses.slice(0, 3), 'the first three are within the ceiling').toEqual([200, 200, 200]);
+    expect(statuses.slice(3), 'everything past it is refused').toEqual([429, 429]);
+
+    const limited = await like(g.jwt, uploadId);
+    expect(limited.status).toBe(429);
+    expect(
+      limited.headers.get('retry-after'),
+      'a 429 without Retry-After tells the client nothing about when to come back'
+    ).toBeTruthy();
+  });
+
+  test('likes and comments share one bucket', async ({ api, adminToken, guest }) => {
+    // THE assertion. Per-action buckets would let a caller triple the aggregate write rate by
+    // alternating, which defeats the point of having a ceiling at all.
+    await api.patchConfig(adminToken, {
+      rate_limits_enabled: 'true',
+      social_rate_enabled: 'true',
+      social_rate_per_min: '2',
+    });
+
+    const g = await guest('Mixer');
+    const uploadId = await seedUpload(g.jwt);
+
+    expect((await like(g.jwt, uploadId)).status).toBe(200);
+    expect((await comment(g.jwt, uploadId, 'schön!')).status).toBe(201);
+    // Two writes spent, whichever endpoints they went to.
+    expect(
+      (await comment(g.jwt, uploadId, 'noch eins')).status,
+      'a comment must consume the same budget a like does'
+    ).toBe(429);
+    expect((await like(g.jwt, uploadId)).status).toBe(429);
+  });
+
+  test('one guest hitting the ceiling does not block another', async ({
+    api,
+    adminToken,
+    guest,
+  }) => {
+    // Keyed per user, not per IP. Every request in this suite comes from one address, which is
+    // exactly the venue-NAT shape that made the /join and /feed limits turn guests away.
+    await api.patchConfig(adminToken, {
+      rate_limits_enabled: 'true',
+      social_rate_enabled: 'true',
+      social_rate_per_min: '2',
+    });
+
+    const noisy = await guest('Noisy');
+    const quiet = await guest('Quiet');
+    const uploadId = await seedUpload(noisy.jwt);
+
+    for (let i = 0; i < 3; i++) await like(noisy.jwt, uploadId);
+    expect((await like(noisy.jwt, uploadId)).status).toBe(429);
+
+    expect(
+      (await like(quiet.jwt, uploadId)).status,
+      'a second guest behind the same IP must have their own budget'
+    ).toBe(200);
+  });
+
+  test('flipping social_rate_enabled off bypasses the limit', async ({
+    api,
+    adminToken,
+    guest,
+  }) => {
+    // The toggle has to actually be honoured, or the admin switch is decorative — the failure
+    // mode two other per-area toggles already shipped with.
+    await api.patchConfig(adminToken, {
+      rate_limits_enabled: 'true',
+      social_rate_enabled: 'false',
+      social_rate_per_min: '2',
+    });
+
+    const g = await guest('Unlimited');
+    const uploadId = await seedUpload(g.jwt);
+
+    const statuses: number[] = [];
+    for (let i = 0; i < 6; i++) statuses.push((await like(g.jwt, uploadId)).status);
+    expect(statuses.every((s) => s === 200)).toBe(true);
+  });
+});

e2e/specs/03-feed/video-playback.spec.ts

@@ -0,0 +1,172 @@
+/**
+ * Regression guard — videos must actually play.
+ *
+ * Two independent defects made every video unplayable, and nothing in the suite covered
+ * either one (no test anywhere played media or asserted a `<video>` src):
+ *
+ *  1. The lightbox fed `<video>` the URL from `pickMediaUrl`, which is mime-agnostic.
+ *     Compression only ever produces a *thumbnail* for a video — one ffmpeg frame — so in
+ *     the DEFAULT saver mode the element's src was `/api/v1/upload/{id}/thumbnail`: a JPEG,
+ *     served as image/jpeg with nosniff so the browser can't even sniff its way out.
+ *     Chromium reported DEMUXER_ERROR_COULD_NOT_OPEN.
+ *
+ *  2. `stream_media_file` ignored `Range` entirely — always 200 with the whole body, never
+ *     an Accept-Ranges or Content-Range. iOS Safari opens every `<video>` with a
+ *     `Range: bytes=0-1` probe and abandons the load without a 206, so video failed on the
+ *     app's primary platform even in `original` data mode.
+ *
+ * Fixing either alone still leaves video broken, so both are asserted here.
+ */
+import { test, expect } from '../../fixtures/test';
+import { uploadRaw } from '../../helpers/upload-client';
+import { BASE } from '../../helpers/env';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const SAMPLE_MP4 = join(process.cwd(), 'fixtures', 'media', 'sample.mp4');
+
+async function seedVideo(jwt: string): Promise<string> {
+  const res = await uploadRaw(jwt, readFileSync(SAMPLE_MP4), {
+    filename: 'clip.mp4',
+    contentType: 'video/mp4',
+    caption: 'ein Video',
+  });
+  if (res.status !== 201) throw new Error(`video seed failed: ${res.status}`);
+  return ((await res.json()) as { id: string }).id;
+}
+
+test.describe('Video — the lightbox plays it', () => {
+  test('the <video> src is the original, not the thumbnail JPEG', async ({
+    page,
+    guest,
+    signIn,
+  }) => {
+    const g = await guest('VideoWatcher');
+    const id = await seedVideo(g.jwt);
+
+    await signIn(page, g);
+    await page.goto('/feed');
+
+    const card = page.locator('article').first();
+    await expect(card).toBeVisible({ timeout: 15_000 });
+    await card.getByRole('button', { name: 'Bild vergrößern' }).click();
+
+    const video = page.locator('video');
+    await expect(video).toBeVisible({ timeout: 10_000 });
+
+    // The bug in one assertion: this was `/thumbnail` in the default data mode.
+    await expect(video).toHaveAttribute('src', `/api/v1/upload/${id}/original`);
+
+    // The poster SHOULD still be the thumbnail — that's what it's for.
+    await expect(video).toHaveAttribute('poster', `/api/v1/upload/${id}/thumbnail`);
+
+    // And the browser must accept the bytes as media. preload="none" means nothing is
+    // fetched until we ask, so drive a load explicitly and wait for metadata.
+    const readyState = await video.evaluate(async (el: HTMLVideoElement) => {
+      el.preload = 'metadata';
+      el.load();
+      await new Promise<void>((resolve) => {
+        if (el.readyState > 0) return resolve();
+        el.addEventListener('loadedmetadata', () => resolve(), { once: true });
+        el.addEventListener('error', () => resolve(), { once: true });
+        setTimeout(resolve, 15_000);
+      });
+      return { ready: el.readyState, err: el.error?.message ?? null };
+    });
+    expect(readyState.err, `the browser rejected the media: ${readyState.err}`).toBeNull();
+    expect(readyState.ready, 'video metadata must load').toBeGreaterThan(0);
+  });
+
+  test('the video body is not downloaded before the user presses play', async ({
+    page,
+    guest,
+    signIn,
+  }) => {
+    // saver mode exists to protect a guest's mobile data, and there is no smaller video
+    // derivative to fall back to — so opening the lightbox must not pull the file down.
+    //
+    // Asserting "no request at all" would be wrong: WebKit opens a connection for a
+    // preload="none" <video> and immediately ABORTS it (observed: GET with no Range,
+    // response status 0, nothing transferred), whereas Chromium issues nothing. The
+    // portable guarantee — and the one that actually protects the data plan — is that no
+    // response carrying the body ever completes. Dropping preload="none" fails this.
+    const g = await guest('VideoThrifty');
+    const id = await seedVideo(g.jwt);
+
+    await signIn(page, g);
+    const delivered: string[] = [];
+    page.on('response', (r) => {
+      if (!r.url().includes(`/upload/${id}/original`)) return;
+      // status 0 = aborted before any bytes landed.
+      if (r.status() === 200 || r.status() === 206) {
+        delivered.push(`${r.status()} len=${r.headers()['content-length'] ?? '?'}`);
+      }
+    });
+
+    await page.goto('/feed');
+    const card = page.locator('article').first();
+    await expect(card).toBeVisible({ timeout: 15_000 });
+    await card.getByRole('button', { name: 'Bild vergrößern' }).click();
+    await expect(page.locator('video')).toBeVisible({ timeout: 10_000 });
+    await page.waitForTimeout(2000);
+
+    expect(delivered, 'no video bytes may be delivered before play').toEqual([]);
+  });
+});
+
+test.describe('Media — HTTP Range', () => {
+  test('a range request is answered 206 with the right slice', async ({ guest }) => {
+    const g = await guest('RangeReader');
+    const id = await seedVideo(g.jwt);
+    const url = `${BASE}/api/v1/upload/${id}/original`;
+
+    const full = await fetch(url);
+    expect(full.status).toBe(200);
+    expect(full.headers.get('accept-ranges'), 'clients must be told seeking works').toBe('bytes');
+    const total = Number(full.headers.get('content-length'));
+    expect(total).toBeGreaterThan(0);
+
+    // The exact probe iOS Safari opens a <video> with. Two bytes, inclusive.
+    const probe = await fetch(url, { headers: { Range: 'bytes=0-1' } });
+    expect(probe.status, 'iOS abandons the load without a 206').toBe(206);
+    expect(probe.headers.get('content-range')).toBe(`bytes 0-1/${total}`);
+    expect(Number(probe.headers.get('content-length'))).toBe(2);
+    expect((await probe.arrayBuffer()).byteLength).toBe(2);
+
+    // A mid-file seek must return the matching slice, not the whole body.
+    const mid = await fetch(url, { headers: { Range: 'bytes=10-19' } });
+    expect(mid.status).toBe(206);
+    expect(mid.headers.get('content-range')).toBe(`bytes 10-19/${total}`);
+    const midBytes = Buffer.from(await mid.arrayBuffer());
+    expect(midBytes.byteLength).toBe(10);
+    expect(midBytes).toEqual(Buffer.from(await full.arrayBuffer()).subarray(10, 20));
+
+    // Open-ended range runs to EOF.
+    const tail = await fetch(url, { headers: { Range: `bytes=${total - 5}-` } });
+    expect(tail.status).toBe(206);
+    expect(Number(tail.headers.get('content-length'))).toBe(5);
+
+    // Past EOF must be 416 — answering 200 makes a player re-request forever.
+    const bad = await fetch(url, { headers: { Range: `bytes=${total + 10}-` } });
+    expect(bad.status).toBe(416);
+    expect(bad.headers.get('content-range')).toBe(`bytes */${total}`);
+  });
+
+  test('image derivatives are range-capable too', async ({ guest, db }) => {
+    // Same helper serves all four media routes, so the guarantee is uniform.
+    const g = await guest('RangeImages');
+    const res = await uploadRaw(
+      g.jwt,
+      readFileSync(join(process.cwd(), 'fixtures', 'media', 'sample.jpg')),
+      { filename: 'r.jpg', contentType: 'image/jpeg' }
+    );
+    const { id } = (await res.json()) as { id: string };
+    await expect.poll(() => db.compressionStatus(id), { timeout: 30_000 }).toBe('done');
+
+    const preview = await fetch(`${BASE}/api/v1/upload/${id}/preview`, {
+      headers: { Range: 'bytes=0-9' },
+    });
+    expect(preview.status).toBe(206);
+    expect(Number(preview.headers.get('content-length'))).toBe(10);
+  });
+});

e2e/specs/04-host/low-disk-warning.spec.ts

@@ -0,0 +1,97 @@
+/**
+ * Regression guard — the host is warned about storage BEFORE it becomes unrecoverable.
+ *
+ * Storage visibility used to exist in exactly one place: a passive "Speicherauslastung" widget on
+ * the ADMIN dashboard. A host who isn't the admin had no view of it at all, and nothing anywhere
+ * warned anyone. README listed a low-disk alert under "Planned (v1.x)".
+ *
+ * Two things make that a safety net rather than a nice-to-have:
+ *
+ *  - `postgres_data`, `media_data` and `exports_data` are all Docker named volumes on ONE
+ *    filesystem. A full disk doesn't degrade a subsystem; Postgres stops being able to write and
+ *    the whole event goes down.
+ *  - The keepsake needs room for TWO gallery-sized archives (both write their media
+ *    `Compression::Stored`; `Memories.zip` streams the original for every video and every image
+ *    at or under 5 MB). The export preflight can refuse cleanly, but only AFTER the release —
+ *    when the event is over, the gallery is full, and every remedy is harder.
+ *
+ * So the threshold is deliberately NOT a fixed number alone. It fires on an absolute floor (10 GB,
+ * the figure the README always carried) OR on "you could not build the keepsake right now", which
+ * is the trigger a host can still act on.
+ *
+ * These drive it through `original_size_bytes` rather than a genuinely full disk: the estimate is
+ * pure SQL over that column, so overstating one row moves the accounting the warning reads without
+ * touching a byte on disk.
+ */
+import { test, expect } from '../../fixtures/test';
+import { seedUpload } from '../../helpers/seed';
+import { BASE } from '../../helpers/env';
+
+/** Comfortably larger than any disk this suite could run on. */
+const ABSURD_BYTES = 500_000_000_000_000;
+
+test.describe('Host — low-disk warning', () => {
+  test('a gallery too big to export warns the host, with the numbers', async ({
+    page,
+    host,
+    guest,
+    signIn,
+    db,
+  }) => {
+    const g = await guest('BigShooter');
+    const uploadId = await seedUpload(g.jwt);
+    await db.setUploadSizeBytes(uploadId, ABSURD_BYTES);
+
+    await signIn(page, host);
+    await page.goto('/host');
+
+    const warning = page.getByTestId('low-disk-warning');
+    await expect(warning, 'the host must be warned before releasing').toBeVisible({
+      timeout: 15_000,
+    });
+    // The actionable half: not just "low", but "the keepsake cannot be built".
+    await expect(warning).toContainText(/nicht.*erstellt werden/i);
+    // And the consequence that makes it urgent — the event, not just the download.
+    await expect(warning).toContainText(/gesamte Event/i);
+  });
+
+  test('the API reports the requirement and the verdict together', async ({ host, guest, db }) => {
+    const g = await guest('BigShooter2');
+    const uploadId = await seedUpload(g.jwt);
+    await db.setUploadSizeBytes(uploadId, ABSURD_BYTES);
+
+    const res = await fetch(`${BASE}/api/v1/host/event`, {
+      headers: { Authorization: `Bearer ${host.jwt}` },
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      disk_low: boolean;
+      disk_free_bytes: number | null;
+      keepsake_required_bytes: number;
+    };
+
+    expect(body.disk_low).toBe(true);
+    expect(
+      body.keepsake_required_bytes,
+      'both halves are armed by a release, so the requirement covers two archives'
+    ).toBeGreaterThan(ABSURD_BYTES);
+    expect(body.disk_free_bytes).not.toBeNull();
+    expect(body.keepsake_required_bytes).toBeGreaterThan(body.disk_free_bytes!);
+  });
+
+  test('an ordinary gallery shows no warning at all', async ({ page, host, guest, signIn }) => {
+    // The mirror that keeps the above honest. A warning that is always on is a warning nobody
+    // reads — and it would sit at the very top of the dashboard, above the PIN-reset queue.
+    const g = await guest('NormalShooter');
+    await seedUpload(g.jwt);
+
+    await signIn(page, host);
+    await page.goto('/host');
+
+    // Wait for the dashboard to actually be loaded before asserting on an absence.
+    await expect(page.getByRole('heading', { name: 'Host-Dashboard' })).toBeVisible({
+      timeout: 15_000,
+    });
+    await expect(page.getByTestId('low-disk-warning')).toHaveCount(0);
+  });
+});

e2e/specs/04-host/moderation-ui.spec.ts

@@ -0,0 +1,149 @@
+/**
+ * Regression guard — a host must be able to remove a guest's content FROM THE UI.
+ *
+ * `DELETE /host/upload/{id}` and `DELETE /host/comment/{id}` were fully implemented,
+ * transactional, SSE-broadcasting, audit-logged — and had zero frontend callers. The feed's
+ * context sheet offered "Löschen" only when `target.user_id === myUserId`, so the only lever
+ * a host actually had against an unwanted photo was banning the uploader. That is both
+ * disproportionate and ineffective: a ban doesn't retract what was already posted, and
+ * because the ban check runs BEFORE the ownership check on the guest delete route, banning
+ * the author makes their abusive comment permanently undeletable by them too.
+ *
+ * The API side was already covered (04-host/moderation). What was missing is the wiring,
+ * so these tests drive the real UI.
+ */
+import { test, expect } from '../../fixtures/test';
+import { seedUpload, seedComment } from '../../helpers/seed';
+import { BASE } from '../../helpers/env';
+
+test.describe('Host — moderation from the UI', () => {
+  test("a host removes a guest's photo via the feed context sheet", async ({
+    page,
+    host,
+    guest,
+    signIn,
+  }) => {
+    const g = await guest('PhotoOffender');
+    const uploadId = await seedUpload(g.jwt);
+
+    await signIn(page, host);
+    await page.goto('/feed');
+
+    const card = page.locator('article').filter({ hasText: g.displayName }).first();
+    await expect(card).toBeVisible({ timeout: 15_000 });
+
+    await card.getByRole('button', { name: 'Mehr Aktionen' }).click();
+    const remove = page.getByRole('button', { name: /beitrag entfernen/i });
+    await expect(remove, 'a host must be offered a removal action on a guest post').toBeVisible();
+    await remove.click();
+
+    const sheet = page.getByTestId('confirm-sheet');
+    await expect(sheet).toBeVisible();
+    // Moderation copy, not "delete my post" copy.
+    await expect(sheet).toContainText(/beitrag entfernen/i);
+    await page.getByTestId('confirm-sheet-confirm').click();
+
+    await expect(card).not.toBeVisible({ timeout: 10_000 });
+
+    // And it is really gone server-side, not just dropped from the local list.
+    const res = await fetch(`${BASE}/api/v1/feed`, {
+      headers: { Authorization: `Bearer ${host.jwt}` },
+    });
+    const body = await res.json();
+    expect(body.uploads.some((u: { id: string }) => u.id === uploadId)).toBe(false);
+  });
+
+  test('a guest is NOT offered any delete action on someone else’s post', async ({
+    page,
+    guest,
+    signIn,
+  }) => {
+    // The mirror that makes the test above meaningful: if this affordance rendered for
+    // everyone, the host test would still pass on a build that shipped moderation to guests.
+    const author = await guest('SomeAuthor');
+    await seedUpload(author.jwt);
+    const viewer = await guest('NosyViewer');
+
+    await signIn(page, viewer);
+    await page.goto('/feed');
+
+    const card = page.locator('article').filter({ hasText: author.displayName }).first();
+    await expect(card).toBeVisible({ timeout: 15_000 });
+    await card.getByRole('button', { name: 'Mehr Aktionen' }).click();
+
+    await expect(page.getByRole('button', { name: /beitrag entfernen/i })).toHaveCount(0);
+    await expect(page.getByRole('button', { name: /^löschen$/i })).toHaveCount(0);
+  });
+
+  test('a promoted guest gets host powers without signing out and back in', async ({
+    page,
+    api,
+    adminToken,
+    guest,
+    signIn,
+  }) => {
+    // The JWT is never reissued — the backend slides the session row forward and treats the
+    // DB row as authoritative. So the token of a promoted guest still claims `role: guest`
+    // for up to 30 days. The UI read that frozen claim, which meant a guest promoted at the
+    // party saw no Host-Dashboard and no moderation actions until they signed out and back
+    // in — while `/me/context` had been handing the client the real role all along.
+    const g = await guest('LatePromotion');
+    await signIn(page, g);
+
+    await page.goto('/account');
+    await expect(page.getByRole('link', { name: /host-dashboard/i })).toHaveCount(0);
+
+    // Promote mid-session. The token in localStorage is deliberately NOT refreshed.
+    await api.setRole(adminToken, g.userId, 'host');
+    const claim = JSON.parse(Buffer.from(g.jwt.split('.')[1], 'base64').toString());
+    expect(
+      claim.role,
+      'the token must still carry the stale claim for this to prove anything'
+    ).toBe('guest');
+
+    await page.reload();
+    await expect(
+      page.getByRole('link', { name: /host-dashboard/i }),
+      'the live role from /me/context must win over the frozen JWT claim'
+    ).toBeVisible({ timeout: 10_000 });
+  });
+
+  test('a host can remove the comment of a guest they have already banned', async ({
+    page,
+    api,
+    host,
+    guest,
+    signIn,
+  }) => {
+    // The deadlock this closes. Ban first, exactly as a host would react to abuse: from then
+    // on the author gets 403 on their own delete, so if the host has no removal affordance
+    // the comment is stuck on screen forever.
+    // The photo belongs to an innocent third party — a ban hides the banned user's OWN
+    // uploads, so if the comment sat on their own photo the whole card would vanish and
+    // there would be nothing left to moderate.
+    const victim = await guest('PhotoOwner');
+    const uploadId = await seedUpload(victim.jwt);
+    const author = await guest('CommentOffender');
+    const commentId = await seedComment(author.jwt, uploadId, 'unangebrachter Kommentar');
+    await api.banUser(host.jwt, author.userId);
+
+    // Confirm the deadlock really exists — the author cannot retract it themselves.
+    const selfDelete = await fetch(`${BASE}/api/v1/comment/${commentId}`, {
+      method: 'DELETE',
+      headers: { Authorization: `Bearer ${author.jwt}` },
+    });
+    expect(selfDelete.status, 'a banned author is blocked from their own delete').toBe(403);
+
+    await signIn(page, host);
+    await page.goto('/feed');
+
+    const card = page.locator('article').filter({ hasText: victim.displayName }).first();
+    await expect(card).toBeVisible({ timeout: 15_000 });
+    await card.getByRole('button', { name: 'Bild vergrößern' }).click();
+
+    const comment = page.getByText('unangebrachter Kommentar');
+    await expect(comment).toBeVisible({ timeout: 10_000 });
+    await page.getByRole('button', { name: 'Kommentar entfernen' }).first().click();
+    await expect(comment).toHaveCount(0, { timeout: 10_000 });
+  });
+});

e2e/specs/04-host/role-identity-reset.spec.ts

@@ -0,0 +1,102 @@
+/**
+ * Regression guard — the role must follow the identity, not the tab.
+ *
+ * The `role` store is a module-level singleton seeded ONCE at import. `goto()` is a
+ * client-side navigation, so leaving and re-joining in the same tab re-imports nothing and
+ * re-runs no `onMount` — the previous user's role simply stayed. A host who left and a
+ * guest who then joined kept `isStaff === true` and were offered "🚫 Beitrag entfernen" on
+ * other people's photos. The backend 403s the delete, so it was a false affordance rather
+ * than a privilege escalation, but `/feed` never fetched `/me/context`, so it never
+ * self-corrected either — it survived until a hard reload.
+ *
+ * The mirror case matters just as much and is easier to forget: a guest who recovers into a
+ * host account must GAIN the affordance without a reload.
+ */
+import { test, expect } from '../../fixtures/test';
+import { seedUpload } from '../../helpers/seed';
+import { JoinPage } from '../../page-objects';
+
+const REMOVE = /beitrag entfernen/i;
+
+test.describe('Role — follows the identity across a same-tab switch', () => {
+  test('a guest joining after a host leaves does NOT inherit host actions', async ({
+    page,
+    host,
+    guest,
+    signIn,
+  }) => {
+    // Someone else's photo — the only kind the removal action is offered on.
+    const author = await guest('RoleAuthor');
+    await seedUpload(author.jwt);
+
+    // 1. Host is signed in and DOES see the moderation action. Establishing this first is
+    //    what makes the negative assertion below meaningful.
+    await signIn(page, host);
+    await page.goto('/feed');
+    const card = page.locator('article').filter({ hasText: author.displayName }).first();
+    await expect(card).toBeVisible({ timeout: 15_000 });
+    await card.getByRole('button', { name: 'Mehr Aktionen' }).click();
+    await expect(page.getByRole('button', { name: REMOVE })).toBeVisible();
+    await page.keyboard.press('Escape');
+
+    // 2. Host leaves, in-app — no reload. This is the path "Event verlassen" takes.
+    await page.goto('/account');
+    await page.getByRole('button', { name: /event verlassen/i }).click();
+    const confirm = page.getByTestId('confirm-sheet-confirm');
+    if (await confirm.isVisible().catch(() => false)) await confirm.click();
+    await page.waitForURL('**/join', { timeout: 10_000 });
+
+    // 3. A brand-new guest joins in the same tab — the real flow, PIN modal and all.
+    const join = new JoinPage(page);
+    await join.joinAs(`Nachzuegler${Date.now() % 100000}`);
+    await join.continueToFeed();
+    await expect(page).toHaveURL(/\/feed$/, { timeout: 15_000 });
+
+    // 4. They must NOT be offered moderation on someone else's photo.
+    const card2 = page.locator('article').filter({ hasText: author.displayName }).first();
+    await expect(card2).toBeVisible({ timeout: 15_000 });
+    await card2.getByRole('button', { name: 'Mehr Aktionen' }).click();
+    await expect(
+      page.getByRole('button', { name: REMOVE }),
+      'a fresh guest must not inherit the previous user’s role'
+    ).toHaveCount(0);
+  });
+
+  test('a guest who recovers into a host account GAINS host actions without a reload', async ({
+    page,
+    api,
+    adminToken,
+    guest,
+    signIn,
+  }) => {
+    // The mirror. If the fix only cleared the role it would pass the test above and still
+    // leave a real host with no moderation until they reloaded.
+    const author = await guest('RoleAuthor2');
+    await seedUpload(author.jwt);
+
+    const futureHost = await guest('WillBeHost');
+    await signIn(page, futureHost);
+    await page.goto('/feed');
+    const card = page.locator('article').filter({ hasText: author.displayName }).first();
+    await expect(card).toBeVisible({ timeout: 15_000 });
+    await card.getByRole('button', { name: 'Mehr Aktionen' }).click();
+    await expect(page.getByRole('button', { name: REMOVE })).toHaveCount(0);
+    await page.keyboard.press('Escape');
+
+    // Promote them server-side. Their resident JWT still claims `role: guest`.
+    await api.setRole(adminToken, futureHost.userId, 'host');
+    const claim = JSON.parse(Buffer.from(futureHost.jwt.split('.')[1], 'base64').toString());
+    expect(claim.role, 'the token must still be stale for this to prove anything').toBe('guest');
+
+    // A plain in-app navigation back to the feed must pick up the live role.
+    await page.goto('/account');
+    await page.goto('/feed');
+    const card2 = page.locator('article').filter({ hasText: author.displayName }).first();
+    await expect(card2).toBeVisible({ timeout: 15_000 });
+    await card2.getByRole('button', { name: 'Mehr Aktionen' }).click();
+    await expect(
+      page.getByRole('button', { name: REMOVE }),
+      'the live role from /me/context must reach the feed'
+    ).toBeVisible({ timeout: 10_000 });
+  });
+});

e2e/specs/06-export/download-iframe.spec.ts

@@ -0,0 +1,103 @@
+/**
+ * Regression guard — the keepsake download must actually download, in WebKit.
+ *
+ * The bug this exists to catch: `/export` streams the archive by pointing a HIDDEN,
+ * SAME-ORIGIN iframe at `/api/v1/export/zip` (deliberately — a top-level navigation to a
+ * 404/429 would unload the PWA). Caddy stamped a site-wide `X-Frame-Options: DENY` that
+ * also covered `/api/*`. Blink hands a `Content-Disposition: attachment` response to the
+ * download manager at the network layer, so Chromium never noticed; WebKit enforces XFO on
+ * the frame navigation FIRST and aborts the load. Result: on iOS Safari — the app's primary
+ * platform — tapping Download did nothing, silently, with no error anywhere.
+ *
+ * Why the old suite was structurally blind to it:
+ *   - `06-export` ran on `chromium-desktop` only (webkit-iphone's testMatch excluded it),
+ *   - and no test in the entire suite ever CLICKED a download button; every archive
+ *     assertion used Node `fetch`, which has no frame and therefore no XFO enforcement.
+ *
+ * So this spec must keep both properties to be worth anything: a real click, in WebKit.
+ */
+import { test, expect } from '../../fixtures/test';
+import { ExportPage } from '../../page-objects';
+import { BASE } from '../../helpers/env';
+
+const SLUG = 'e2e-test-event';
+
+function post(path: string, jwt: string) {
+  return fetch(BASE + path, { method: 'POST', headers: { Authorization: `Bearer ${jwt}` } });
+}
+
+/** The real export job runs image processing; give it head-room over the tiny fixtures. */
+async function releaseAndWait(jwt: string) {
+  expect((await post('/api/v1/host/gallery/release', jwt)).status).toBe(204);
+  await expect
+    .poll(
+      async () => {
+        const res = await fetch(BASE + '/api/v1/export/status', {
+          headers: { Authorization: `Bearer ${jwt}` },
+        });
+        const s = await res.json();
+        return s.released === true && s.zip?.status === 'done';
+      },
+      { timeout: 60_000, intervals: [500] }
+    )
+    .toBe(true);
+}
+
+test.describe('Export — the download actually fires in the browser', () => {
+  test.slow();
+
+  test('clicking Download triggers a real download event', async ({ page, host, signIn, db }) => {
+    await db.setExportReleased(SLUG, false);
+    await releaseAndWait(host.jwt);
+
+    await signIn(page, host);
+    const exportPage = new ExportPage(page);
+    await exportPage.goto();
+    await expect(exportPage.zipDownloadButton).toBeEnabled({ timeout: 10_000 });
+
+    // Capture the frame-level refusal that XFO produces, so a failure reports the CAUSE
+    // rather than just a timeout. WebKit logs "Refused to display ... in a frame because it
+    // set 'X-Frame-Options'"; Chromium logs nothing here, which is the whole problem.
+    const refusals: string[] = [];
+    page.on('console', (m) => {
+      if (/X-Frame-Options|Refused to display/i.test(m.text())) refusals.push(m.text());
+    });
+
+    const downloadPromise = page.waitForEvent('download', { timeout: 30_000 });
+    await exportPage.zipDownloadButton.click();
+
+    const download = await downloadPromise.catch((err) => {
+      throw new Error(
+        `No download event fired after clicking the ZIP button.` +
+          (refusals.length
+            ? ` The browser refused the iframe navigation: ${refusals.join(' | ')}`
+            : ' No X-Frame-Options refusal was logged; check the ticket/readiness path.') +
+          `\n${err}`
+      );
+    });
+
+    expect(download.suggestedFilename()).toMatch(/\.zip$/i);
+    // The stream must produce real bytes, not a zero-length placeholder.
+    const path = await download.path();
+    expect(path).toBeTruthy();
+    expect(refusals, 'no frame should have been refused').toEqual([]);
+  });
+
+  test('the export endpoints are framable same-origin; everything else stays DENY', async () => {
+    // Locks the Caddy carve-out itself, independently of any browser. Cheap, and it fails
+    // loudly at the exact layer that regressed if someone reinstates a blanket DENY.
+    for (const path of ['/api/v1/export/zip', '/api/v1/export/html']) {
+      const res = await fetch(BASE + path);
+      expect(res.headers.get('x-frame-options')?.toUpperCase(), `${path} must be framable`).toBe(
+        'SAMEORIGIN'
+      );
+    }
+
+    for (const path of ['/', '/api/v1/feed', '/api/v1/event']) {
+      const res = await fetch(BASE + path);
+      expect(res.headers.get('x-frame-options')?.toUpperCase(), `${path} must stay DENY`).toBe(
+        'DENY'
+      );
+    }
+  });
+});

e2e/specs/06-export/exif-orientation.spec.ts

@@ -0,0 +1,117 @@
+/**
+ * Regression guard — the keepsake must not be sideways.
+ *
+ * Round 1 taught the compression worker to apply EXIF orientation, which fixed the live app
+ * (feed preview + diashow display). The export worker was missed: it does NOT reuse those
+ * derivatives — it re-decodes the originals itself with `image::open`, which ignores the
+ * orientation tag — and then re-encodes to JPEG, which drops the tag, so the viewer has no
+ * way to recover it.
+ *
+ * The resulting damage was oddly shaped, which is what made it read as a viewer bug:
+ *   - Gallery.zip originals            → correct (byte-copied, EXIF intact)
+ *   - Memories viewer grid thumbnails  → ALWAYS sideways
+ *   - Memories viewer full image >5 MB → sideways (re-encoded at 2000px)
+ *   - Memories viewer full image ≤5 MB → correct (streamed byte-for-byte)
+ *
+ * So clicking a small photo silently "fixed" it and a large one didn't. This pins the
+ * thumbnail, which is the path every photo takes.
+ */
+import { test, expect } from '../../fixtures/test';
+import { uploadRaw } from '../../helpers/upload-client';
+import { BASE } from '../../helpers/env';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// 40x20 landscape pixels tagged Orientation=6 ("rotate 90° CW to display"), so anything
+// that honours the tag emits a PORTRAIT derivative.
+const EXIF_FIXTURE = join(process.cwd(), 'fixtures', 'media', 'portrait-exif6.jpg');
+
+/** Pixel dimensions from a JPEG's SOF marker — avoids an image dep for one assertion. */
+function jpegSize(buf: Buffer): { width: number; height: number } {
+  let i = 2;
+  while (i < buf.length) {
+    if (buf[i] !== 0xff) {
+      i++;
+      continue;
+    }
+    const marker = buf[i + 1];
+    if (marker >= 0xc0 && marker <= 0xcf && marker !== 0xc4 && marker !== 0xc8 && marker !== 0xcc) {
+      return { height: buf.readUInt16BE(i + 5), width: buf.readUInt16BE(i + 7) };
+    }
+    i += 2 + buf.readUInt16BE(i + 2);
+  }
+  throw new Error('no SOF marker found — not a JPEG?');
+}
+
+test.describe('Export — EXIF orientation in the keepsake', () => {
+  test('the Memories viewer thumbnail of a rotated photo is upright', async ({ host, db }) => {
+    test.setTimeout(90_000);
+    const bearer = { Authorization: `Bearer ${host.jwt}` };
+
+    const src = readFileSync(EXIF_FIXTURE);
+    // Sanity: the SOURCE really is stored landscape, or this test proves nothing.
+    const srcSize = jpegSize(src);
+    expect(srcSize.width).toBeGreaterThan(srcSize.height);
+
+    const up = await uploadRaw(host.jwt, src, {
+      filename: 'hochkant.jpg',
+      contentType: 'image/jpeg',
+      caption: 'hochkant',
+    });
+    expect(up.status).toBe(201);
+    const { id } = (await up.json()) as { id: string };
+    await expect.poll(() => db.compressionStatus(id), { timeout: 30_000 }).toBe('done');
+
+    const rel = await fetch(`${BASE}/api/v1/host/gallery/release`, {
+      method: 'POST',
+      headers: bearer,
+    });
+    expect(rel.status).toBe(204);
+
+    await expect
+      .poll(
+        async () => {
+          const res = await fetch(`${BASE}/api/v1/export/status`, { headers: bearer });
+          return (await res.json()).html?.status;
+        },
+        { timeout: 60_000, intervals: [500] }
+      )
+      .toBe('done');
+
+    const ticketRes = await fetch(`${BASE}/api/v1/export/ticket`, {
+      method: 'POST',
+      headers: bearer,
+    });
+    const { ticket } = (await ticketRes.json()) as { ticket: string };
+    const dl = await fetch(`${BASE}/api/v1/export/html?ticket=${encodeURIComponent(ticket)}`);
+    expect(dl.status).toBe(200);
+
+    const dir = mkdtempSync(join(tmpdir(), 'eventsnap-exif-'));
+    try {
+      const zipPath = join(dir, 'Memories.zip');
+      writeFileSync(zipPath, Buffer.from(await dl.arrayBuffer()));
+
+      const entries = execFileSync('unzip', ['-Z1', zipPath], { encoding: 'utf8' })
+        .split('\n')
+        .filter(Boolean);
+      const thumbEntry = entries.find((e) => e.includes(`${id}_thumb`));
+      expect(thumbEntry, `no thumbnail for ${id} in Memories.zip`).toBeTruthy();
+
+      // `-p` streams the entry to stdout. Extracting to disk instead fails with EACCES:
+      // the archive preserves the container's file mode, which the test user can't read.
+      const thumb = execFileSync('unzip', ['-p', zipPath, thumbEntry!], {
+        maxBuffer: 64 * 1024 * 1024,
+      });
+      const { width, height } = jpegSize(thumb);
+
+      expect(
+        height,
+        `the keepsake grid thumbnail is ${width}x${height} — EXIF orientation was not applied`
+      ).toBeGreaterThan(width);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

e2e/specs/06-export/failure-reason-visible.spec.ts

@@ -0,0 +1,95 @@
+/**
+ * Regression guard — when the keepsake fails to build, the HOST must be told why.
+ *
+ * `/export/status` reported `{status, progress_pct}` and nothing else, so the host dashboard could
+ * only ever render "Keepsake-Erstellung fehlgeschlagen." next to an "Erneut versuchen" button. The
+ * reason WAS being written — `mark_failed` stores it on the job row — but it surfaced solely in the
+ * admin dashboard's job list. The host is the person who releases the gallery, owns the retry
+ * button, and is standing at the venue; the admin may be someone else entirely, or the same person
+ * without the password to hand.
+ *
+ * That matters most for the failure this shipped alongside: the export disk preflight. Its message
+ * names the two numbers that decide what to do ("benötigt ca. X GB, frei sind Y GB"), and without
+ * it "Erneut versuchen" fails identically, forever, with no hint that the answer is free some space.
+ *
+ * These drive the real UI and the real endpoint — the plumbing is four hops (SQL → handler JSON →
+ * store type → Svelte branch) and any one of them dropping the field restores the silent version.
+ */
+import { test, expect } from '../../fixtures/test';
+import { BASE } from '../../helpers/env';
+
+const SLUG = 'e2e-test-event';
+const DISK_REASON =
+  'Nicht genug Speicherplatz für das Keepsake: benötigt ca. 42.0 GB, frei sind 3.0 GB. ' +
+  'Bitte Speicher freigeben und das Keepsake anschließend neu erstellen.';
+
+test.describe('Export — a failed keepsake explains itself to the host', () => {
+  test('the failure reason reaches /export/status', async ({ host, db }) => {
+    await db.setExportReleased(SLUG, true);
+    await db.fakeExportJob(SLUG, 'zip', 'failed', DISK_REASON);
+    await db.fakeExportJob(SLUG, 'html', 'failed', DISK_REASON);
+
+    const res = await fetch(`${BASE}/api/v1/export/status`, {
+      headers: { Authorization: `Bearer ${host.jwt}` },
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      zip: { status: string; error_message: string | null };
+      html: { status: string; error_message: string | null };
+    };
+
+    expect(body.zip.status).toBe('failed');
+    expect(
+      body.zip.error_message,
+      'the reason must travel with the status, not live only in the admin job list'
+    ).toBe(DISK_REASON);
+    expect(body.html.error_message).toBe(DISK_REASON);
+  });
+
+  test('a succeeding export carries no stale reason', async ({ host, db }) => {
+    // The mirror that keeps the above honest: a handler that returned `error_message`
+    // unconditionally would pass the first test while showing an error next to a green
+    // "Keepsake ist bereit." Rows keep their last message until they are re-armed, so this is a
+    // real state, not a hypothetical one.
+    await db.setExportReleased(SLUG, true);
+    await db.fakeExportJob(SLUG, 'zip', 'failed', DISK_REASON);
+    await db.fakeExportJob(SLUG, 'zip', 'done', DISK_REASON);
+
+    const res = await fetch(`${BASE}/api/v1/export/status`, {
+      headers: { Authorization: `Bearer ${host.jwt}` },
+    });
+    const body = (await res.json()) as { zip: { status: string; error_message: string | null } };
+    expect(body.zip.status).toBe('done');
+    expect(
+      body.zip.error_message,
+      'a message left on a row that has since succeeded must not be shown'
+    ).toBeNull();
+  });
+
+  test('the host dashboard renders the reason under the failure', async ({
+    page,
+    host,
+    signIn,
+    db,
+  }) => {
+    await db.setExportReleased(SLUG, true);
+    await db.fakeExportJob(SLUG, 'zip', 'failed', DISK_REASON);
+    await db.fakeExportJob(SLUG, 'html', 'failed', DISK_REASON);
+
+    await signIn(page, host);
+    await page.goto('/host');
+
+    await expect(page.getByText(/Keepsake-Erstellung fehlgeschlagen/i)).toBeVisible({
+      timeout: 15_000,
+    });
+    // The actionable half — the numbers, not just the verdict.
+    await expect(
+      page.getByText(/Nicht genug Speicherplatz/i),
+      'the host must see WHY, next to the only button they have'
+    ).toBeVisible();
+    await expect(page.getByText(/3\.0 GB/)).toBeVisible();
+
+    // And the retry button is still mounted — it is deliberately outside the status branches.
+    await expect(page.getByTestId('export-rebuild')).toBeVisible();
+  });
+});

e2e/specs/07-adversarial/ddos.spec.ts

@@ -15,7 +15,15 @@ test.describe('Adversarial — small-scale abuse', () => {
     await api.patchConfig(adminToken, { rate_limits_enabled: 'true', join_rate_enabled: 'true' });
   });
 
-  test('20 parallel /join from one IP — rate limiter catches the excess', async () => {
+  test('a /join flood from one IP is caught by the per-IP ceiling', async ({ api, adminToken }) => {
+    // This used to assert that 20 joins from one IP produced 429s under a 5/min per-IP
+    // bucket. That "protection" was the bug: at a venue every guest shares one public IP,
+    // so it turned real arriving guests away (see 01-auth/rate-limit-shared-nat). The
+    // anti-spam bucket is now per (ip, name); what remains per-IP is a loose ceiling whose
+    // job is only to bound raw volume. Squeeze the ceiling so a flood is reproducible here
+    // without firing 60+ requests.
+    await api.patchConfig(adminToken, { join_ip_rate_per_min: '5' });
+
     const requests = Array.from({ length: 20 }, (_, i) =>
       fetch(`${BASE}/api/v1/join`, {
         method: 'POST',
@@ -24,7 +32,7 @@ test.describe('Adversarial — small-scale abuse', () => {
       })
     );
     const statuses = (await Promise.all(requests)).map((r) => r.status);
-    // 5/min limit → at least some should be 429.
+    // Ceiling of 5 → the excess must be shed.
     expect(statuses.filter((s) => s === 429).length).toBeGreaterThan(0);
     // Server stays up — at least one succeeded.
     expect(statuses.some((s) => s === 201 || s === 409)).toBe(true);

e2e/specs/07-adversarial/media-gating.spec.ts

@@ -45,6 +45,23 @@ test.describe('Media gating — moderation revokes preview access (F2)', () => {
     const direct = await fetch(`${BASE}/media/previews/${id}.jpg`);
     expect(direct.status, 'direct /media/previews must be blocked').toBe(404);
 
+    // …and it must stay blocked under percent-encoding. The block used to be four
+    // `nest_service("/media/previews", 404)` route matches sitting above a `/media`
+    // ServeDir. axum routes on the RAW path while ServeDir percent-decodes afterwards, so
+    // ONE escaped byte (`%70` = `p`) missed every blocker, fell through to the ServeDir,
+    // and was decoded back to `previews/` on disk — serving the bytes unauthenticated.
+    // Asserting only the literal spelling is what let that sit here undetected.
+    for (const variant of [
+      `/media/%70reviews/${id}.jpg`, // p
+      `/media/p%72eviews/${id}.jpg`, // r — any position works
+      `/media/%64isplays/${id}.jpg`, // d
+      `/media/%74humbnails/${id}.jpg`, // t
+      `/media/%6Friginals/${id}.jpg`, // o
+    ]) {
+      const res = await fetch(`${BASE}${variant}`, { redirect: 'manual' });
+      expect(res.status, `${variant} must not bypass the media block`).toBe(404);
+    }
+
     // Host deletes the upload → the preview must stop being served.
     const del = await fetch(`${BASE}/api/v1/host/upload/${id}`, {
       method: 'DELETE',

frontend/export-viewer/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="de">
+	<head>
+		<meta charset="utf-8" />
+		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		<title>EventSnap — Galerie</title>
+	</head>
+	<body>
+		<div id="app"></div>
+		<script type="module" src="/src/standalone.ts"></script>
+	</body>
+</html>

frontend/export-viewer/package-lock.json

@@ -15,7 +15,8 @@
 				"svelte": "^5.54.0",
 				"tailwindcss": "^4.2.2",
 				"typescript": "^5.9.3",
-				"vite": "^7.3.1"
+				"vite": "^7.3.1",
+				"vite-plugin-singlefile": "^2.3.3"
 			}
 		},
 		"node_modules/@esbuild/aix-ppc64": {
@@ -1318,6 +1319,19 @@
 				"node": ">= 0.4"
 			}
 		},
+		"node_modules/braces": {
+			"version": "3.0.3",
+			"resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+			"integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"fill-range": "^7.1.1"
+			},
+			"engines": {
+				"node": ">=8"
+			}
+		},
 		"node_modules/clsx": {
 			"version": "2.1.1",
 			"resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
@@ -1457,6 +1471,19 @@
 				}
 			}
 		},
+		"node_modules/fill-range": {
+			"version": "7.1.1",
+			"resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+			"integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"to-regex-range": "^5.0.1"
+			},
+			"engines": {
+				"node": ">=8"
+			}
+		},
 		"node_modules/fsevents": {
 			"version": "2.3.3",
 			"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
@@ -1479,6 +1506,16 @@
 			"dev": true,
 			"license": "ISC"
 		},
+		"node_modules/is-number": {
+			"version": "7.0.0",
+			"resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+			"integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=0.12.0"
+			}
+		},
 		"node_modules/is-reference": {
 			"version": "3.0.3",
 			"resolved": "https://registry.npmjs.org/is-reference/-/is-reference-3.0.3.tgz",
@@ -1787,6 +1824,33 @@
 				"@jridgewell/sourcemap-codec": "^1.5.5"
 			}
 		},
+		"node_modules/micromatch": {
+			"version": "4.0.8",
+			"resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
+			"integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"braces": "^3.0.3",
+				"picomatch": "^2.3.1"
+			},
+			"engines": {
+				"node": ">=8.6"
+			}
+		},
+		"node_modules/micromatch/node_modules/picomatch": {
+			"version": "2.3.2",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+			"integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=8.6"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/jonschlinkert"
+			}
+		},
 		"node_modules/mrmime": {
 			"version": "2.0.1",
 			"resolved": "https://registry.npmjs.org/mrmime/-/mrmime-2.0.1.tgz",
@@ -2021,6 +2085,19 @@
 				"url": "https://github.com/sponsors/SuperchupuDev"
 			}
 		},
+		"node_modules/to-regex-range": {
+			"version": "5.0.1",
+			"resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+			"integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"is-number": "^7.0.0"
+			},
+			"engines": {
+				"node": ">=8.0"
+			}
+		},
 		"node_modules/totalist": {
 			"version": "3.0.1",
 			"resolved": "https://registry.npmjs.org/totalist/-/totalist-3.0.1.tgz",
@@ -2122,6 +2199,28 @@
 				}
 			}
 		},
+		"node_modules/vite-plugin-singlefile": {
+			"version": "2.3.3",
+			"resolved": "https://registry.npmjs.org/vite-plugin-singlefile/-/vite-plugin-singlefile-2.3.3.tgz",
+			"integrity": "sha512-XVnGH0QzbOa8fxRSsHdCarVN1BSBXNi7uLMQYlrGRN5apdHkk62XQWRJhVever0lnfuyBkwn+kvVChdm/OoOUg==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"micromatch": "^4.0.8"
+			},
+			"engines": {
+				"node": ">18.0.0"
+			},
+			"peerDependencies": {
+				"rollup": "^4.59.0",
+				"vite": "^5.4.21 || ^6.0.0 || ^7.0.0 || ^8.0.0"
+			},
+			"peerDependenciesMeta": {
+				"rollup": {
+					"optional": true
+				}
+			}
+		},
 		"node_modules/vitefu": {
 			"version": "1.1.3",
 			"resolved": "https://registry.npmjs.org/vitefu/-/vitefu-1.1.3.tgz",

frontend/export-viewer/package.json

@@ -5,7 +5,8 @@
 	"type": "module",
 	"scripts": {
 		"dev": "vite dev",
-		"build": "vite build",
+		"build": "vite build --config vite.standalone.config.js",
+		"build:sveltekit": "vite build",
 		"preview": "vite preview",
 		"prepare": "svelte-kit sync || echo ''"
 	},
@@ -17,6 +18,7 @@
 		"svelte": "^5.54.0",
 		"tailwindcss": "^4.2.2",
 		"typescript": "^5.9.3",
-		"vite": "^7.3.1"
+		"vite": "^7.3.1",
+		"vite-plugin-singlefile": "^2.3.3"
 	}
 }

frontend/export-viewer/src/lib/types.ts

@@ -2,6 +2,9 @@ export interface ViewerData {
 	event: {
 		name: string;
 		exported_at: string;
+		// Mirrors the live COMMENTS_ENABLED flag. Older exports predate this field, so
+		// treat a missing value as enabled (`?? true`) to preserve their comment UI.
+		comments_enabled?: boolean;
 	};
 	posts: ViewerPost[];
 }

frontend/export-viewer/src/routes/+page.svelte

@@ -31,6 +31,9 @@
 
 	let posts = $derived(data?.posts ?? []);
 
+	// Mirror the live COMMENTS_ENABLED flag. Missing on older exports → treat as enabled.
+	let commentsEnabled = $derived(data?.event.comments_enabled ?? true);
+
 	let allTags = $derived.by(() => {
 		// eslint-disable-next-line svelte/prefer-svelte-reactivity -- local throwaway counter inside a $derived.by; never stored in $state.
 		const freq = new Map<string, number>();
@@ -99,9 +102,18 @@
 
 	onMount(async () => {
 		try {
-			const res = await fetch('./data.json');
-			if (!res.ok) throw new Error(`HTTP ${res.status}`);
-			data = await res.json();
+			// The keepsake is opened by double-clicking index.html (file://), where a
+			// cross-origin `fetch()` is blocked. The export injects the data as a global
+			// so it's available without any network request; fall back to fetching
+			// data.json only when the viewer is actually served over http(s).
+			const injected = (globalThis as { __EXPORT_DATA__?: ViewerData }).__EXPORT_DATA__;
+			if (injected) {
+				data = injected;
+			} else {
+				const res = await fetch('./data.json');
+				if (!res.ok) throw new Error(`HTTP ${res.status}`);
+				data = await res.json();
+			}
 		} catch {
 			error =
 				'Daten konnten nicht geladen werden. Stelle sicher, dass data.json im selben Ordner liegt.';
@@ -541,22 +553,24 @@
 								</svg>
 								{post.likes}
 							</span>
-							<span class="flex items-center gap-1.5 text-sm font-medium text-gray-500">
-								<svg
-									class="h-5 w-5"
-									fill="none"
-									viewBox="0 0 24 24"
-									stroke="currentColor"
-									stroke-width="2"
-								>
-									<path
-										stroke-linecap="round"
-										stroke-linejoin="round"
-										d="M8 12h.01M12 12h.01M16 12h.01M21 12c0 4.418-4.03 8-9 8a9.863 9.863 0 01-4.255-.949L3 20l1.395-3.72C3.512 15.042 3 13.574 3 12c0-4.418 4.03-8 9-8s9 3.582 9 8z"
-									/>
-								</svg>
-								{post.comments.length}
-							</span>
+							{#if commentsEnabled}
+								<span class="flex items-center gap-1.5 text-sm font-medium text-gray-500">
+									<svg
+										class="h-5 w-5"
+										fill="none"
+										viewBox="0 0 24 24"
+										stroke="currentColor"
+										stroke-width="2"
+									>
+										<path
+											stroke-linecap="round"
+											stroke-linejoin="round"
+											d="M8 12h.01M12 12h.01M16 12h.01M21 12c0 4.418-4.03 8-9 8a9.863 9.863 0 01-4.255-.949L3 20l1.395-3.72C3.512 15.042 3 13.574 3 12c0-4.418 4.03-8 9-8s9 3.582 9 8z"
+										/>
+									</svg>
+									{post.comments.length}
+								</span>
+							{/if}
 						</div>
 
 						<!-- Caption -->
@@ -632,17 +646,24 @@
 										</svg>
 										{post.likes}
 									</span>
-									<span class="flex items-center gap-0.5">
-										<svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-											<path
-												stroke-linecap="round"
-												stroke-linejoin="round"
-												stroke-width="2"
-												d="M8 12h.01M12 12h.01M16 12h.01M21 12c0 4.418-4.03 8-9 8a9.863 9.863 0 01-4.255-.949L3 20l1.395-3.72C3.512 15.042 3 13.574 3 12c0-4.418 4.03-8 9-8s9 3.582 9 8z"
-											/>
-										</svg>
-										{post.comments.length}
-									</span>
+									{#if commentsEnabled}
+										<span class="flex items-center gap-0.5">
+											<svg
+												class="h-3.5 w-3.5"
+												fill="none"
+												viewBox="0 0 24 24"
+												stroke="currentColor"
+											>
+												<path
+													stroke-linecap="round"
+													stroke-linejoin="round"
+													stroke-width="2"
+													d="M8 12h.01M12 12h.01M16 12h.01M21 12c0 4.418-4.03 8-9 8a9.863 9.863 0 01-4.255-.949L3 20l1.395-3.72C3.512 15.042 3 13.574 3 12c0-4.418 4.03-8 9-8s9 3.582 9 8z"
+												/>
+											</svg>
+											{post.comments.length}
+										</span>
+									{/if}
 								</div>
 							</div>
 						</div>
@@ -775,23 +796,25 @@
 					</div>
 
 					<!-- Comments list -->
-					<div class="flex-1 overflow-y-auto p-3">
-						{#if selectedPost.comments.length === 0}
-							<p class="text-center text-sm text-gray-400">Keine Kommentare.</p>
-						{:else}
-							<div class="space-y-3">
-								{#each selectedPost.comments as comment, i (i)}
-									<div>
-										<span class="text-sm font-medium text-gray-900">{comment.author}</span>
-										<span class="ml-1 text-sm text-gray-700">{comment.text}</span>
-										<div class="mt-0.5 text-xs text-gray-400">
-											{formatShortDate(comment.timestamp)}
+					{#if commentsEnabled}
+						<div class="flex-1 overflow-y-auto p-3">
+							{#if selectedPost.comments.length === 0}
+								<p class="text-center text-sm text-gray-400">Keine Kommentare.</p>
+							{:else}
+								<div class="space-y-3">
+									{#each selectedPost.comments as comment, i (i)}
+										<div>
+											<span class="text-sm font-medium text-gray-900">{comment.author}</span>
+											<span class="ml-1 text-sm text-gray-700">{comment.text}</span>
+											<div class="mt-0.5 text-xs text-gray-400">
+												{formatShortDate(comment.timestamp)}
+											</div>
 										</div>
-									</div>
-								{/each}
-							</div>
-						{/if}
-					</div>
+									{/each}
+								</div>
+							{/if}
+						</div>
+					{/if}
 				</div>
 			</div>
 		</div>

frontend/export-viewer/src/standalone.ts

@@ -0,0 +1,8 @@
+// Standalone (non-SvelteKit) entry for the offline keepsake. Mounts the plain
+// Svelte viewer component into a single, self-contained index.html so it works
+// when opened by double-clicking from an extracted ZIP (file://).
+import './app.css';
+import { mount } from 'svelte';
+import App from './routes/+page.svelte';
+
+mount(App, { target: document.getElementById('app')! });

frontend/export-viewer/vite.config.js

@@ -0,0 +1,10 @@
+import { sveltekit } from '@sveltejs/kit/vite';
+import tailwindcss from '@tailwindcss/vite';
+import { defineConfig } from 'vite';
+
+// NOTE: the production keepsake is built with `vite.standalone.config.js`
+// (see `npm run build`), which inlines everything into a single, file://-safe
+// index.html. This SvelteKit config is kept only for `npm run dev`/`preview`.
+export default defineConfig({
+	plugins: [tailwindcss(), sveltekit()]
+});

frontend/export-viewer/vite.standalone.config.js

@@ -0,0 +1,25 @@
+import { svelte, vitePreprocess } from '@sveltejs/vite-plugin-svelte';
+import tailwindcss from '@tailwindcss/vite';
+import { viteSingleFile } from 'vite-plugin-singlefile';
+import { defineConfig } from 'vite';
+import { fileURLToPath } from 'node:url';
+
+// Builds the keepsake viewer as ONE self-contained index.html (all JS + CSS
+// inlined) so it renders when opened via file://. Uses the plain Svelte plugin
+// (not SvelteKit) because SvelteKit emits multiple module entry points, which
+// cannot be inlined into a single file.
+export default defineConfig({
+	plugins: [
+		tailwindcss(),
+		svelte({ configFile: false, preprocess: vitePreprocess(), compilerOptions: { runes: true } }),
+		viteSingleFile()
+	],
+	resolve: {
+		alias: { $lib: fileURLToPath(new URL('./src/lib', import.meta.url)) }
+	},
+	build: {
+		outDir: fileURLToPath(new URL('../../backend/static/export-viewer', import.meta.url)),
+		emptyOutDir: true,
+		target: 'es2020'
+	}
+});

frontend/src/app.css

@@ -1,4 +1,5 @@
 @import './tailwind-theme.css';
+@import './lib/styles/components.css';
 
 /* Respect the OS "reduce motion" setting. Collapses every animation/transition
  * (HeartBurst, Skeleton pulse, diashow cross-fades, sheet/FAB slides) to a

frontend/src/app.html

@@ -7,8 +7,8 @@
 		<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
 		<meta name="text-scale" content="scale" />
 		<!-- Light/dark theme-color so the browser chrome matches the active theme. -->
-		<meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)" />
-		<meta name="theme-color" content="#030712" media="(prefers-color-scheme: dark)" />
+		<meta name="theme-color" content="#faf9f7" media="(prefers-color-scheme: light)" />
+		<meta name="theme-color" content="#100f0f" media="(prefers-color-scheme: dark)" />
 		<!-- Installable PWA keepsake: manifest + Apple home-screen metadata. -->
 		<link rel="manifest" href="%sveltekit.assets%/manifest.webmanifest" />
 		<link rel="icon" href="%sveltekit.assets%/icon.svg" type="image/svg+xml" />
@@ -33,6 +33,19 @@
 						(pref === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches);
 					if (dark) document.documentElement.classList.add('dark');
 				} catch (_) {}
+				// Colour-theme FOUC guard: re-apply the cached palette override before paint so
+				// a custom/preset theme doesn't flash the default gold. The value is a ready-to-
+				// inject `:root:root{…}` string from event-config-store (empty for the default
+				// theme); refreshed from /event once the app mounts.
+				try {
+					var css = localStorage.getItem('eventsnap_palette_css');
+					if (css) {
+						var s = document.createElement('style');
+						s.id = 'es-theme';
+						s.textContent = css;
+						document.head.appendChild(s);
+					}
+				} catch (_) {}
 			})();
 		</script>
 		%sveltekit.head%
@@ -61,31 +74,29 @@
 				align-items: center;
 				justify-content: center;
 				gap: 0.75rem;
-				background: #f9fafb;
+				background: #faf9f7;
 			}
 			html.dark #app-boot {
-				background: #030712;
+				background: #100f0f;
 			}
 			.app-boot__spinner {
 				width: 2rem;
 				height: 2rem;
 				border-radius: 9999px;
-				border: 2px solid #d1d5db;
-				border-top-color: #2563eb;
+				border: 2px solid #e5e4e1;
+				border-top-color: #8a6a2b;
 				animation: app-boot-spin 0.6s linear infinite;
 			}
 			html.dark .app-boot__spinner {
-				border-color: #374151;
-				border-top-color: #60a5fa;
+				border-color: #3b3a38;
+				border-top-color: #c6a24a;
 			}
 			.app-boot__label {
-				font-family:
-					system-ui,
-					-apple-system,
-					sans-serif;
-				font-size: 0.875rem;
-				font-weight: 500;
-				color: #9ca3af;
+				font-family: Georgia, 'Times New Roman', serif;
+				font-size: 1rem;
+				font-weight: 600;
+				letter-spacing: 0.01em;
+				color: #8a6a2b;
 			}
 			@keyframes app-boot-spin {
 				to {