harden(deploy): add app/frontend healthchecks + readiness-gate Caddy

Caddy depended on app/frontend with no readiness gate, so it could proxy to a
not-yet-listening upstream and surface brief 502s on boot/restart. Add
wget-based healthchecks (busybox wget ships in both alpine runtime images):
app hits the unauthenticated /health, frontend hits / (SSR returns 200; the
redirect is client-side). app uses a 30s start_period to cover boot-time
migrations. Caddy now depends_on both with condition: service_healthy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/settings.json

@@ -1,9 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(cargo check *)",
-      "Bash(cargo clippy *)",
-      "Bash(git --no-pager diff *)"
-    ]
-  }
-}

.env.example

@@ -1,216 +1,51 @@
 # ── Domain ────────────────────────────────────────────────────────────────────
 # Public domain Caddy will serve and obtain a TLS certificate for.
-#
-# The DNS A record must already point at this server BEFORE the first `up -d`: Caddy
-# requests a certificate on boot, and Let's Encrypt allows only 5 failed validations per
-# hostname per hour. Never delete the caddy_data volume — it holds the certificate and
-# the ACME account key.
 DOMAIN=my-event.example.com
 
-# ── Image version ─────────────────────────────────────────────────────────────
-# Tag pulled for the `app` and `frontend` services (docker-compose.yml). Production runs
-# prebuilt images from the registry and never compiles — see DEPLOYMENT_RUNBOOK.md.
-# Always an immutable tag, never `latest`: rollback is `EVENTSNAP_VERSION=<previous>`
-# + `docker compose up -d`, which works offline if that image is still resident locally.
-#
-# ⚠ THIS TAG DOES NOT EXIST YET. The newest git tag is v0.12.0; v0.13.0 is the release you
-# cut for the event. Build and push it (plus its identical rollback twin v0.13.0-a) BEFORE
-# the first `docker compose up -d` — see DEPLOYMENT_RUNBOOK.md §6 (build) and §9 (rollback).
-# Copying this file and starting the stack without that step fails with `manifest unknown`.
-#
-# Do NOT "fix" this by dropping back to v0.12.0: no image was ever built for it, and a
-# 6-migration tree booting against a 31-migration database returns VersionMissing and
-# crash-loops forever behind a live Caddy. §9 covers this in full.
-EVENTSNAP_VERSION=v0.13.0
-
 # ── App server ────────────────────────────────────────────────────────────────
 APP_PORT=3000
-# Set to `production` in real deployments. This activates the secret guard that
-# refuses to boot with placeholder JWT_SECRET / ADMIN_PASSWORD_HASH values.
-# (docker-compose.yml already sets APP_ENV=production for the app service.)
-APP_ENV=production
+# docker-compose.yml already forces APP_ENV=production for the `app` service.
+# Only set this for a non-compose (bare cargo) run; leave unset for local dev.
+# APP_ENV=production
 
 # ── Database ──────────────────────────────────────────────────────────────────
-# Set a strong password and keep it in sync between DATABASE_URL and
-# POSTGRES_PASSWORD. Generate one with: openssl rand -hex 24
-#
-# SET THIS BEFORE THE FIRST `docker compose up -d`. Postgres reads POSTGRES_PASSWORD
-# only when it initialises its data directory, on that very first boot. Change it
-# afterwards and the app authenticates with the new password against a volume still
-# holding the old one — a permanent restart loop ("password authentication failed").
-# The only ways out are restoring the old password or `docker compose down -v`, which
-# deletes the database, the media and the exports. In production the app refuses to
-# boot while this is still the placeholder below, so it cannot be missed by accident.
-DATABASE_URL=postgres://eventsnap:CHANGE_ME_use_a_strong_password@db:5432/eventsnap
+# Set a strong password and keep it identical in DATABASE_URL and POSTGRES_PASSWORD.
+DATABASE_URL=postgres://eventsnap:CHANGE_ME_strong_db_password@db:5432/eventsnap
 POSTGRES_USER=eventsnap
-POSTGRES_PASSWORD=CHANGE_ME_use_a_strong_password
+POSTGRES_PASSWORD=CHANGE_ME_strong_db_password
 POSTGRES_DB=eventsnap
-# Connection pool size. The code default is 15 (DEFAULT_MAX_CONNECTIONS in backend/src/db.rs),
-# and docker-compose.yml pins this value in `app.environment` so an edit here cannot reach the
-# container. That pin is deliberate: since the value became boot-FATAL when unparseable — so an
-# operator tuning a knob that never took effect gets told, instead of silently staying on the
-# default — a stray quote or a trailing inline comment in `.env` would crash-loop the app behind
-# a live Caddy. Change the pin in compose, not this line.
-#
-# SIZE IT TO THE CORES, NOT TO THE GUESTS. The earlier advice here was ~30, reasoned from
-# "~100 guests polling the feed at once" back when a feed page cost ~449 ms and connections
-# were spent waiting. Migration 024 replaced the feed view's GROUP BY with scalar subqueries
-# and a page now costs well under a millisecond, so concurrency is no longer where the time
-# goes. On a 2 vCPU box 30 simultaneous queries cannot run — they queue on the CPU instead of
-# on the pool, which is the same wait wearing a different hat, and 30 Postgres backends plus
-# shared_buffers is snug in the 1G that docker-compose.yml allots `db`.
-#
-# 15 on 2 vCPU / 4 GB. Raise toward 30 only alongside more cores AND a bigger `db` memory
-# limit — an OOM in Postgres doesn't degrade one feature, it takes the whole event down.
-DATABASE_MAX_CONNECTIONS=15
-
-# Log level: see the "Logging" section near the bottom of this file.
-#
-# Defined THERE and nowhere else, deliberately. This file used to assign RUST_LOG twice —
-# once here and once there — and Compose takes the LAST assignment, so editing this line to
-# `debug` to chase a problem during the event changed nothing at all, silently. A key that
-# appears twice in a .env is a trap regardless of which value is better.
 
 # ── Authentication ────────────────────────────────────────────────────────────
-# Generate with: openssl rand -hex 64
+# REQUIRED in production: generate with `openssl rand -hex 64` (128 hex chars).
+# The backend refuses to start in production with this placeholder or any value
+# that is short or contains change/example/placeholder/replace.
 JWT_SECRET=change_me_to_a_random_64_byte_hex_string
 SESSION_EXPIRY_DAYS=30
 
 # Admin dashboard password (bcrypt hash).
-# Generate with an image the stack already pulls (htpasswd needs apache2-utils, which
-# a stock VPS does not have):
-#   docker run --rm caddy:2-alpine caddy hash-password --plaintext 'yourpassword'
-# IMPORTANT: keep the SINGLE QUOTES. A bcrypt hash is full of `$` (e.g. $2b$12$…$…),
-# and both Docker Compose's env_file interpolation and dotenvy's variable substitution
-# would otherwise eat the `$…` segments (reading them as unset vars) and corrupt the
-# hash — every admin login then 401s. Single quotes make both read it literally.
-ADMIN_PASSWORD_HASH='$2y$12$placeholder_replace_me'
+# Generate with: htpasswd -bnBC 12 "" yourpassword | tr -d ':\n'
+ADMIN_PASSWORD_HASH=$2y$12$placeholder_replace_me
 
 # ── Event ─────────────────────────────────────────────────────────────────────
-# DOUBLE-QUOTED, and it matters. Compose's env_file parser reads `Max & Maria's Wedding`
-# unquoted just fine — but the runbook also tells you to `set -a; . ./.env; set +a` in a plain
-# shell, and POSIX `sh` aborts on the apostrophe with "Unterminated quoted string" (rc=2).
-# Everything defined BELOW this line is then left unset, silently: the hourly pg_dump cron in
-# §10.2 does exactly this, so it would exit before ever writing a backup, every hour, into a log
-# nobody reads. Double quotes are read identically by both parsers (verified) — keep them, and
-# keep them double, since single quotes would make a literal `$` in a name survive but are what
-# `ADMIN_PASSWORD_HASH` above needs for the opposite reason.
-EVENT_NAME="Max & Maria's Wedding"
+EVENT_NAME=Max & Maria's Wedding
 EVENT_SLUG=max-maria-2026
 
 # ── Storage ───────────────────────────────────────────────────────────────────
 MEDIA_PATH=/media
-# Export archives (Gallery.zip / Memories.zip). MUST be outside MEDIA_PATH —
-# /media is publicly served, so exports here would be downloadable without auth.
-EXPORT_PATH=/exports
 
-# ── Runtime settings (upload limits, rate limits, capacity) ───────────────────
-# NOTE: These are NOT environment variables. Upload size caps, rate limits, guest
-# count and quota tolerance are stored in the database `config` table (seeded once
-# at first boot) and changed at runtime from the ADMIN DASHBOARD — the backend does
-# not read them from .env. Setting them here has no effect. Current seeded defaults:
-#   upload rate      100 / hour / guest   (raised from 10 by migration 015)
-#   feed rate         60 / minute
-#   export rate        3 / day
-#   max image size    20 MB
-#   max video size   500 MB
-#   estimated guests 100
-#   quota tolerance  0.75  (see below — NOT a warning threshold)
-# Adjust these in the admin UI before the event if needed.
-#
-# quota_tolerance is the MULTIPLIER IN THE PER-USER QUOTA FORMULA, not the point at
-# which anything warns you:
-#
-#     divisor        = max(active_uploaders, estimated_guest_count, 1)
-#     per_user_limit = max(floor(free_disk * quota_tolerance / divisor), 500 MiB)
-#
-# estimated_guest_count is a FLOOR ON THE DIVISOR, not decoration — it is a live knob
-# (upload::quota_limit_bytes). Earlier drafts of this file and the runbook both omitted
-# it and told operators it was inert; it is not.
-#
-# It is recomputed against LIVE free space on every upload, so in principle it self-
-# throttles: guests converge on a fixed point at tolerance/(1+tolerance) of the free space
-# you started with — 43% at 0.75.
-#
-# ON THIS BOX THAT FIXED POINT NEVER BINDS, and it is worth knowing which knob actually
-# stops the disk filling. The arithmetic above used to be quoted as "~30 GB of a fresh
-# 70 GB", which is an 80 GB CX33; this deploys to a CX22 with 40 GB. At ~28 GB free and
-# estimated_guest_count = 100 flooring the divisor, the formula yields ~210 MB per guest —
-# BELOW the 500 MiB floor — so every guest is granted the floor and the per-user quota
-# stops bounding aggregate growth at all.
-#
-# What actually bounds it is the keepsake preflight in upload.rs: uploads are refused once
-# free < media x 1.1 x 2 + 10 GB, which on 40 GB lands at ~8 GB of media (README, "Sizing
-# the disk"). So if a guest reports being blocked, the number to look at is total media,
-# not this one.
-#
-# Raising this still AUTHORISES GUESTS TO FILL MORE OF THE DISK on a larger box, and it
-# still eats the headroom the keepsake needs — Gallery.zip and Memories.zip are each
-# roughly a second copy of every original (both store media uncompressed). Budget for
-# media + 2x media, or move exports to their own volume.
-#
-# 0.75 is the tested default. Lower it if the box is tight; raise it only if you have
-# provisioned export headroom separately.
+# ── Upload limits ─────────────────────────────────────────────────────────────
+DEFAULT_MAX_IMAGE_SIZE_MB=20
+DEFAULT_MAX_VIDEO_SIZE_MB=500
+
+# ── Rate limiting ─────────────────────────────────────────────────────────────
+DEFAULT_UPLOAD_RATE_PER_HOUR=10
+DEFAULT_FEED_RATE_PER_MIN=60
+DEFAULT_EXPORT_RATE_PER_DAY=3
+
+# ── Capacity ──────────────────────────────────────────────────────────────────
+DEFAULT_ESTIMATED_GUEST_COUNT=100
+# Fraction of total storage that triggers the "low storage" warning (0.0–1.0)
+DEFAULT_QUOTA_TOLERANCE=0.75
 
 # ── Workers ───────────────────────────────────────────────────────────────────
-# Number of parallel media compression workers. Default 2. Boot-time only.
-#
-# CORRECTION TO EARLIER GUIDANCE: this used to say "each worker can run an ffmpeg
-# transcode, so raise the app memory limit to ~2G if you set 4". There is NO video
-# transcode anywhere in this codebase — services/video.rs runs
-# `ffmpeg -ss <t> -i <src> -vframes 1 -vf scale=...`, a single poster frame, and video
-# originals are stored and served byte-for-byte. Poster extraction costs ~150-250 MB
-# for a moment; it is not the constraint.
-#
-# The real memory consumer is the IMAGE path. `image` 0.25's resize builds an Rgba32F
-# intermediate at 16 BYTES PER PIXEL, sized (source_width x target_height) — which the
-# 256 MiB decode guard in imaging.rs does NOT cover. Peak per photo, decode + the 2048px
-# display resize: ~145 MB at 12 MP, ~223 MB at 24 MP, ~354 MB at 48 MP.
-#
-# So on a 2 vCPU / 4 GB box (e.g. Hetzner CX22) KEEP THIS AT 2:
-#   * concurrency 4 would put two giants at ~1.5 GB against the 1G app limit — OOM.
-#   * and app=2G + db=1G + frontend/caddy 256M each + ~370 MB of OS/Docker exceeds the
-#     ~3910 MiB a "4 GB" VM actually reports. Raising the limit oversubscribes the host.
-# 4 is only reasonable on the 4 vCPU / 8 GB box README.md documents.
-#
-# The "two 48 MP photos at once" worst case this number used to be sized against is no
-# longer reachable: compression.rs takes an EXCLUSIVE `heavy` permit for any job whose
-# estimated peak exceeds HEAVY_IMAGE_BYTES (150 MiB), so two giants serialise no matter what
-# this is set to. What concurrency 2 now buys is two ORDINARY phone photos in parallel
-# (~145 MB peak each), which is both memory-safe and short enough not to starve the two
-# tokio worker threads a 2 vCPU box gets.
-#
-# Do NOT drop this to 1 hoping to protect the CPU. It halves throughput on the common light
-# path for a heavy path that is already serialised, and a longer compression backlog means
-# more feed tiles served from full-size originals (VirtualFeed falls back to /original while
-# derivatives are pending) — trading a little CPU for a lot of venue-wifi bandwidth.
-#
-# Throughput at 2 is not the bottleneck anyone thinks it is: ~2.5s per 12 MP photo, so
-# 100 photos is ~250 CPU-seconds spread over an entire evening.
 COMPRESSION_WORKER_CONCURRENCY=2
-
-# ── Comments ──────────────────────────────────────────────────────────────────
-# Master switch for the comment feature. Boot-time only (NOT in the admin UI), so it
-# needs a `docker compose up -d` to apply. Anything other than false/0/no/off is on.
-#
-# When false the backend rejects NEW comments with 403 and the frontend hides the whole
-# comment UI, including in the offline keepsake viewer. Likes and captions are entirely
-# separate features and are unaffected. Existing comments stay in the database (hidden),
-# so flipping it back restores them.
-#
-# Note it gates POSTING only: GET /upload/{id}/comments still serves already-existing
-# comments, and the keepsake's data.json still embeds their text. Irrelevant if the flag
-# is off from the first boot, since no comment can ever have been written.
-# NOTE for the current deployment: `docker-compose.yml` PINS this to "false" on the app
-# service, and `environment` overrides `env_file` — so changing it here has no effect in
-# production. Remove that line from the compose file first if you want comments back.
-COMMENTS_ENABLED=true
-
-# ── Logging ───────────────────────────────────────────────────────────────────
-# SET THIS IN PRODUCTION. Without it the app falls back to
-# `eventsnap_backend=debug,tower_http=debug` (see main.rs), and with TraceLayer that is a
-# debug line per HTTP request — including every preview and thumbnail fetch. Combined with
-# Docker's json-file driver it writes to the same filesystem as the database and the media.
-# docker-compose.yml caps each service's logs at 30 MB; this keeps the volume sane in the
-# first place. The e2e stack has always used exactly this value.
-RUST_LOG=eventsnap_backend=info,tower_http=warn

.env.test

@@ -0,0 +1,45 @@
+# ── Domain ────────────────────────────────────────────────────────────────────
+# Public domain Caddy will serve and obtain a TLS certificate for.
+DOMAIN=my-event.example.com
+
+# ── App server ────────────────────────────────────────────────────────────────
+APP_PORT=3000
+
+# ── Database ──────────────────────────────────────────────────────────────────
+DATABASE_URL=postgres://eventsnap:secret@db:5432/eventsnap
+POSTGRES_USER=eventsnap
+POSTGRES_PASSWORD=secret
+POSTGRES_DB=eventsnap
+
+# ── Authentication ────────────────────────────────────────────────────────────
+# Generate with: openssl rand -hex 64
+JWT_SECRET=change_me_to_a_random_64_byte_hex_string
+SESSION_EXPIRY_DAYS=30
+
+# Admin dashboard password (bcrypt hash).
+# Generate with: htpasswd -bnBC 12 "" yourpassword | tr -d ':\n'
+ADMIN_PASSWORD_HASH=$2y$12$placeholder_replace_me
+
+# ── Event ─────────────────────────────────────────────────────────────────────
+EVENT_NAME=Max & Maria's Wedding
+EVENT_SLUG=max-maria-2026
+
+# ── Storage ───────────────────────────────────────────────────────────────────
+MEDIA_PATH=/media
+
+# ── Upload limits ─────────────────────────────────────────────────────────────
+DEFAULT_MAX_IMAGE_SIZE_MB=20
+DEFAULT_MAX_VIDEO_SIZE_MB=500
+
+# ── Rate limiting ─────────────────────────────────────────────────────────────
+DEFAULT_UPLOAD_RATE_PER_HOUR=10
+DEFAULT_FEED_RATE_PER_MIN=60
+DEFAULT_EXPORT_RATE_PER_DAY=3
+
+# ── Capacity ──────────────────────────────────────────────────────────────────
+DEFAULT_ESTIMATED_GUEST_COUNT=100
+# Fraction of total storage that triggers the "low storage" warning (0.0–1.0)
+DEFAULT_QUOTA_TOLERANCE=0.75
+
+# ── Workers ───────────────────────────────────────────────────────────────────
+COMPRESSION_WORKER_CONCURRENCY=2

.github/workflows/audit.yml

@@ -1,73 +0,0 @@
-# Dependency advisory scan.
-#
-# Lives in .github/workflows/ because Gitea Actions scans BOTH .gitea/workflows and
-# .github/workflows, and e2e.yml already proves this instance resolves `actions/*` from GitHub
-# (DEFAULT_ACTIONS_URL). Keeping one directory avoids a split where half the CI is invisible
-# depending on which convention you look under.
-#
-# Unlike the GitHub-hosted runners this workflow does NOT assume a preinstalled Rust toolchain —
-# the common Gitea runner images (gitea/runner-images, catthehacker/ubuntu) ship Node and Docker
-# but not cargo. So we install it explicitly instead of relying on the ambient environment.
-name: Audit
-
-on:
-  pull_request:
-  push:
-    branches: [main]
-  schedule:
-    # New advisories land against unchanged code, so a push-only trigger would never see them.
-    - cron: '0 6 * * 1'
-
-jobs:
-  cargo-audit:
-    name: cargo audit (backend)
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install Rust toolchain
-        run: |
-          if ! command -v cargo > /dev/null; then
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
-            echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-          fi
-
-      - name: Cache cargo
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/bin
-          key: cargo-audit-${{ hashFiles('backend/Cargo.lock') }}
-          restore-keys: cargo-audit-
-
-      - name: Install cargo-audit
-        run: cargo install cargo-audit --locked || true
-
-      # `rsa` 0.9 (RUSTSEC-2023-0071, "Marvin") is a transitive dep of the SQLx MySQL driver that
-      # this app never exercises: auth is HS256 + bcrypt, and the only database is Postgres. There
-      # is no patched release, so failing the build on it would mean a permanently red pipeline
-      # that everyone learns to ignore — which is worse than not scanning at all. Ignore it
-      # SPECIFICALLY, so that any OTHER advisory still fails the job.
-      - name: Audit
-        working-directory: ./backend
-        run: cargo audit --deny warnings --ignore RUSTSEC-2023-0071
-
-  npm-audit:
-    name: npm audit (frontend)
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-      - name: Install deps
-        working-directory: ./frontend
-        run: npm install
-      # Production dependencies only: a dev-only advisory (build tooling, test runners) can't be
-      # reached by a guest at the party, and gating merges on it just trains people to skip the gate.
-      - name: Audit
-        working-directory: ./frontend
-        run: npm audit --omit=dev --audit-level=high

.github/workflows/checks.yml

@@ -1,167 +0,0 @@
-# The checks that were only ever running on a laptop.
-#
-# Before this file, CI ran Playwright (chromium-desktop) and the dependency audit — and nothing
-# else. `cargo test` (40 tests), the frontend vitest suite (5 files, including the offline
-# upload-queue and auth-token logic), svelte-check, and the e2e typecheck were all green on a
-# developer's machine and gated NOTHING. A check that only ever runs locally is not running.
-#
-# In .github/workflows/ because Gitea Actions scans it too (see audit.yml). Rust is installed
-# explicitly: the common Gitea runner images ship Node and Docker, not cargo.
-name: Checks
-
-on:
-  pull_request:
-  push:
-    branches: [main]
-
-jobs:
-  backend:
-    name: Backend — cargo test + clippy + fmt
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install Rust toolchain
-        run: |
-          if ! command -v cargo > /dev/null; then
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
-            echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-          fi
-          rustup component add clippy rustfmt
-
-      - uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            backend/target
-          key: cargo-${{ hashFiles('backend/Cargo.lock') }}
-          restore-keys: cargo-
-
-      # SQLx runs its queries against a live database at TEST time (see backend/tests/), so the
-      # DB-backed tests need one. The pure unit tests don't care, but starting it unconditionally
-      # keeps the job simple and honest about what it covers.
-      - name: Start Postgres
-        run: |
-          docker run -d --name ci-pg -p 5432:5432 \
-            -e POSTGRES_PASSWORD=postgres -e POSTGRES_DB=eventsnap_ci \
-            postgres:16-alpine
-          for _ in $(seq 1 30); do
-            docker exec ci-pg pg_isready -U postgres > /dev/null 2>&1 && break
-            sleep 1
-          done
-
-      - name: Test
-        working-directory: ./backend
-        env:
-          DATABASE_URL: postgres://postgres:postgres@localhost:5432/eventsnap_ci
-        # `#[sqlx::test]` creates a fresh database per test and opens its own pool; run at unbounded
-        # parallelism against a default `max_connections=100` Postgres, a full suite can exhaust the
-        # server's connection slots and fail with PoolTimedOut — a pure infra flake, not a real
-        # failure. Cap the concurrency so the gate stays trustworthy on a loaded runner.
-        run: cargo test --all-features -- --test-threads=8
-
-      - name: Clippy
-        working-directory: ./backend
-        run: cargo clippy --all-targets -- -D warnings
-
-      - name: Format
-        working-directory: ./backend
-        run: cargo fmt --check
-
-  frontend:
-    name: Frontend — vitest + svelte-check
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: 'frontend/package-lock.json'
-
-      - name: Install deps
-        working-directory: ./frontend
-        run: npm ci || npm install
-
-      - name: Unit tests
-        working-directory: ./frontend
-        run: npm run test:unit
-
-      - name: svelte-check
-        working-directory: ./frontend
-        run: npx svelte-check --threshold error
-
-      - name: ESLint
-        working-directory: ./frontend
-        run: npm run lint
-
-      - name: Prettier
-        working-directory: ./frontend
-        run: npm run format:check
-
-  export-viewer:
-    name: Keepsake viewer — builds, self-contained, committed artifact in sync
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: 'frontend/export-viewer/package-lock.json'
-
-      - name: Install deps
-        working-directory: ./frontend/export-viewer
-        run: npm ci || npm install
-
-      # Two things nothing else in CI covered, both of which ship a broken keepsake silently.
-      #
-      # 1. The build's own self-contained guard (`inlineThemeFonts`) is the only thing standing
-      #    between an added theme asset and a viewer that reaches for files on the guest's disk.
-      #    It is a build-time `this.error`, so it only fires when somebody runs this build — and
-      #    no workflow, Dockerfile or script did. It could sit disarmed indefinitely.
-      #
-      # 2. `backend/static/export-viewer/index.html` is COMMITTED and compiled into the binary with
-      #    `include_dir!`. A viewer source change merged without a manual rebuild ships the stale
-      #    artifact, and nothing anywhere would say so. `git diff --exit-code` is the check.
-      - name: Build the standalone viewer
-        working-directory: ./frontend/export-viewer
-        run: npm run build
-
-      - name: Committed artifact matches a clean rebuild
-        run: |
-          if ! git diff --exit-code -- backend/static/export-viewer/; then
-            echo "::error::backend/static/export-viewer/ is out of date with frontend/export-viewer/."
-            echo "Run 'npm run build' in frontend/export-viewer and commit the result."
-            exit 1
-          fi
-
-  e2e-typecheck:
-    name: E2E — typecheck + lint
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-      - name: Install deps
-        working-directory: ./e2e
-        run: npm install
-      # Playwright TRANSPILES specs without typechecking them, so a type error in a spec is
-      # invisible until the assertion it guards silently does the wrong thing at runtime.
-      - name: tsc --noEmit
-        working-directory: ./e2e
-        run: npx tsc --noEmit
-
-      - name: ESLint
-        working-directory: ./e2e
-        run: npm run lint
-
-      - name: Prettier
-        working-directory: ./e2e
-        run: npm run format:check

.github/workflows/e2e.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   e2e:
-    name: Playwright E2E (chromium + webkit)
+    name: Playwright E2E (chromium-desktop)
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -25,7 +25,7 @@ jobs:
 
       - name: Install Playwright browsers
         working-directory: ./e2e
-        run: npx playwright install --with-deps chromium webkit
+        run: npx playwright install --with-deps chromium
 
       - name: Bring up the test stack
         working-directory: ./e2e
@@ -46,30 +46,6 @@ jobs:
         working-directory: ./e2e
         run: npm run test:e2e -- --project=chromium-desktop
 
-      # 09-mobile is `testIgnore`d on chromium-desktop (it needs hasTouch + a phone viewport), so
-      # running only that project left 22 tests — focus traps, touch targets, safe-area insets,
-      # viewport reflow, upload-cancel — never executing in CI. On a phone-first event app, where
-      # essentially every real guest is on a phone, that was the wrong half of the suite to skip.
-      - name: Run E2E tests (mobile)
-        working-directory: ./e2e
-        run: npm run test:e2e -- --project=chromium-mobile
-
-      # iOS Safari is the app's stated primary user (a wedding guest opening a QR link), and
-      # WebKit is the ONLY engine here that reproduces two of its behaviours:
-      #   - it enforces X-Frame-Options on the download iframe, so a site-wide `DENY` makes the
-      #     keepsake download silently do nothing. Blink hands attachments to the download
-      #     manager first and never notices. That shipped once already.
-      #   - it abandons a <video> load without a 206 response to its Range probe.
-      # Both regressions are invisible to every Chromium project, so running WebKit is what
-      # actually gates them on a PR rather than on someone remembering to test locally.
-      #
-      # The project is scoped in playwright.config.ts to the journeys a guest walks
-      # (01-auth, 02-upload, 03-feed, 06-export); four IndexedDB-blob tests skip themselves
-      # there — see helpers/webkit.ts for why that is the harness and not the app.
-      - name: Run E2E tests (webkit / iOS)
-        working-directory: ./e2e
-        run: npm run test:e2e -- --project=webkit-iphone
-
       - name: Upload Playwright report
         if: failure()
         uses: actions/upload-artifact@v4

.gitignore

@@ -1,7 +1,5 @@
 # Environment secrets — never commit the real .env
 .env
-# Stale local scratch copy of .env.example; nothing in the test stack reads it.
-.env.test
 
 # Rust
 backend/target/
@@ -13,16 +11,8 @@ frontend/build/
 frontend/export-viewer/node_modules/
 frontend/export-viewer/.svelte-kit/
 
-# Media uploads. In production these live in the `media_data` DOCKER VOLUME, never in the
-# working tree — so this pattern is anchored to the repo root and exists only for a local
-# bind-mount experiment.
-#
-# It used to read `media/`, unanchored, which matches a directory of that name at ANY depth.
-# The only one in the repo is `e2e/fixtures/media/`, so the rule's entire practical effect was
-# to keep every E2E fixture untracked: a fresh clone got the specs and none of the images or
-# videos they read. `.github/workflows/e2e.yml` does a plain checkout and generates nothing, so
-# the committed CI job could not have run the upload, video or export suites at all.
-/media/
+# Media uploads (mounted volume in production)
+media/
 
 # Playwright E2E suite — runtime artifacts (the suite itself is committed)
 e2e/node_modules/
@@ -30,13 +20,11 @@ e2e/playwright-report/
 e2e/test-results/
 e2e/.cache/
 e2e/.env.test
-# Playwright artifacts when run from the repo root instead of e2e/
-/test-results/
-/playwright-report/
 
 # OS
 .DS_Store
 Thumbs.db
 
-# Claude Code personal (per-user) settings — shared settings.json IS committed
-.claude/settings.local.json
+# Local audit/review reports — generated working artifacts, kept out of git
+docs/AUDIT-2026-06-27.md
+docs/FIX-VERIFICATION-2026-06-27.md

Caddyfile

@@ -1,163 +1,29 @@
-{
-	servers {
-		timeouts {
-			# Slowloris defence, at the layer that can actually apply it.
-			#
-			# There was no read or write timeout anywhere, so a client could open a POST, send one
-			# byte a minute, and hold a connection, a tokio task and a `.tmp` file indefinitely —
-			# and the upload sweeper is keyed on mtime precisely so a live upload never ages out,
-			# so ten such connections consumed disk the upload gate could not see.
-			#
-			# read_header is tight: a legitimate client sends its headers in one go.
-			read_header 10s
-			# read_body is GENEROUS but present. It was omitted on the reasoning that "a slow body
-			# still has to actually send bytes" — which is an argument about disk, and disk is not
-			# the scarce resource here. `upload_admission` budgets concurrent bodies at 4096 MiB and
-			# reserves the DECLARED cap, so a `video/*` upload reserves 500 MiB: eight connections
-			# that stall mid-body hold the entire budget, every other guest waits 20s and gets a
-			# 503, and it never recovers on its own because the permit is held until the handler
-			# returns. That needs no attacker — eight guests starting real videos and then walking
-			# out of AP range does it, and TCP will not reap those sockets for hours.
-			#
-			# 30m carries a 500 MB video at ~2.2 Mbit/s sustained, which is well under venue wifi
-			# and under most cellular, so it does not fail the uploads this product exists to
-			# collect. It does bound the leak to something that drains.
-			read_body 30m
-			idle 5m
-		}
-	}
-}
-
 {$DOMAIN} {
-	# Compress everything EXCEPT the SSE stream — gzip buffering delays
-	# "real-time" likes/comments until the ~30s keep-alive tick.
-	@compressible not path /api/v1/stream
-	encode @compressible zstd gzip
+    encode zstd gzip
 
-	# Site-wide security headers (defense-in-depth). HSTS is free since Caddy
-	# already terminates TLS. nosniff also covers all of /media/*.
-	header {
-		Strict-Transport-Security "max-age=31536000; includeSubDomains"
-		X-Content-Type-Options "nosniff"
-		Referrer-Policy "strict-origin-when-cross-origin"
-	}
+    # SvelteKit frontend — static assets with long-lived cache (content-hashed filenames)
+    @hashed_assets path_regexp hashed /_app/immutable/.*\.[a-f0-9]{8,}\.(js|css|woff2)$
+    header @hashed_assets Cache-Control "public, max-age=31536000, immutable"
 
-	# X-Frame-Options: DENY everywhere EXCEPT the keepsake download endpoints, which
-	# are navigated in a HIDDEN, SAME-ORIGIN iframe so a 404/429 can't unload the PWA
-	# (see frontend/src/routes/export/+page.svelte). WebKit enforces XFO *before*
-	# honouring Content-Disposition, so a blanket DENY makes the download silently do
-	# nothing on iOS Safari — the app's primary platform. SAMEORIGIN still blocks
-	# cross-origin framing.
-	#
-	# Split into two disjoint matchers rather than an override: Caddy applies the
-	# FIRST header directive outermost, so it wins on write — a later, more specific
-	# `header` would be silently ignored.
-	@framable path /api/v1/export/zip /api/v1/export/html
-	@not_framable not path /api/v1/export/zip /api/v1/export/html
-	header @framable X-Frame-Options "SAMEORIGIN"
-	header @not_framable X-Frame-Options "DENY"
+    # API — never cache
+    @api path /api/*
+    header @api Cache-Control "no-store"
 
-	# SvelteKit frontend — static assets with long-lived cache (content-hashed filenames)
-	@hashed_assets path_regexp hashed /_app/immutable/.*\.[a-f0-9]{8,}\.(js|css|woff2)$
-	header @hashed_assets Cache-Control "public, max-age=31536000, immutable"
+    # Media is served by the authenticated gateway at /media/{kind}/{id}, which
+    # sets its own Cache-Control (private) and security headers per response — no
+    # Caddy-side cache rules (the old /media/previews|originals matchers were for
+    # the retired static mount).
 
-	# Preview/thumbnail/display images. These are served by the app through a
-	# visibility-checked alias (/api/v1/upload/{id}/{preview,thumbnail,display}) so
-	# moderation can revoke access; the app serves no /media route at all, so there is no
-	# direct path to the bytes. Privately cacheable for a short window (the app sets the
-	# same header; this is the edge carve-out from the blanket no-store below). Kept short
-	# so a moderated image stops being served to a direct-URL holder promptly.
-	#
-	# `display` was missing here while the backend set `private, max-age=300` on it, and
-	# because `header` REPLACES, the blanket no-store below silently won. That route is the
-	# ~2048px derivative the diashow uses exclusively, so a projector left running all
-	# evening re-fetched a full-size JPEG for every slide — roughly 2-4 GB pulled through
-	# the app over 8 hours, on the same venue uplink 100 guests are uploading over, and a
-	# blank frame on every network hiccup.
-	@media_api path /api/v1/upload/*/preview /api/v1/upload/*/thumbnail /api/v1/upload/*/display
-	header @media_api Cache-Control "private, max-age=300"
+    # Route API and media requests to the Rust backend. Set X-Real-IP from the
+    # real TCP peer and overwrite any client-supplied value so the backend's
+    # rate-limit keys can't be spoofed via a forged X-Forwarded-For.
+    reverse_proxy /api/* app:3000 {
+        header_up X-Real-IP {remote_host}
+    }
+    reverse_proxy /media/* app:3000 {
+        header_up X-Real-IP {remote_host}
+    }
 
-	# API and health — never cache, EXCEPT the gated image routes above. A cached health
-	# response would report the last known state rather than the current one.
-	@api {
-		path /api/* /health
-		not path /api/v1/upload/*/preview /api/v1/upload/*/thumbnail /api/v1/upload/*/display
-	}
-	header @api Cache-Control "no-store"
-
-	# Route API and media requests to the Rust backend.
-	#
-	# The app serves no /media route at all (see the note in backend/src/main.rs) — media
-	# bytes are reachable only through the visibility-checked /api/v1/upload aliases, so
-	# /media/* forwards to a plain 404. The proxy line is kept deliberately: it means the
-	# edge faithfully hands /media to the app, so if a future change ever re-introduces a
-	# static media route the e2e gating specs see it here exactly as production would,
-	# instead of being masked by the SvelteKit 404 page.
-	reverse_proxy /api/* app:3000
-	reverse_proxy /media/* app:3000
-
-	# The backend registers /health on its ROOT router, not under /api/v1, so it needs its
-	# own line — without it the catch-all below hands /health to SvelteKit, which has no
-	# such route and returns its 404 page. That made the documented post-deploy check
-	# (`curl -fsS https://DOMAIN/health`) fail 100% of the time on a perfectly healthy
-	# stack. e2e/Caddyfile.test has always carried this line; production never did.
-	reverse_proxy /health app:3000
-
-	# Everything else goes to SvelteKit frontend
-	reverse_proxy frontend:3001
-
-	# Last-resort page for when Caddy itself cannot reach an upstream — the app or frontend
-	# container down, restarting, or still warming up after a host reboot. Without it a guest
-	# gets Caddy's bodiless 502: a completely blank page, which reads as "the whole thing is
-	# gone" rather than "try again in a moment".
-	#
-	# THIS DOES NOT TOUCH APPLICATION ERRORS. `handle_errors` fires only on errors CADDY
-	# generates; a status the app returns through `reverse_proxy` is written back verbatim and
-	# never reaches here. That distinction is load-bearing rather than incidental: the keepsake
-	# download navigates a HIDDEN IFRAME and depends on a real 404/429 arriving from the app
-	# (frontend/src/routes/export/+page.svelte), and every API route answers 403/404/429 as
-	# ordinary JSON that the client parses. Swallowing those into an HTML page would be a far
-	# worse regression than the blank 502 this fixes. Verified against this exact config: an
-	# upstream 404 through `reverse_proxy` still arrives as `Content-Type: application/json`
-	# with its body intact, while only a dial failure renders the page below.
-	#
-	# Scoped to 5xx so a hypothetical future Caddy-generated 4xx (there is none today) still
-	# returns plainly instead of claiming the server is restarting.
-	#
-	# The body is inline because the caddy service mounts ONLY ./Caddyfile and caddy_data —
-	# there is no volume to ship an HTML file through and the image has no build step, so a
-	# static file would mean changing the deployed stack's compose definition. No external
-	# font, stylesheet or image is referenced: the app may be exactly what is down.
-	#
-	# `handle_errors` has NO position in the directive order — Caddy hoists it into a separate
-	# `errors` route list — so it cannot disturb the "first `header` directive wins" hazard
-	# documented at the top of this file. The site-wide security headers still apply to it.
-	handle_errors 5xx {
-		header Content-Type "text/html; charset=utf-8"
-		header Cache-Control "no-store"
-		# {err.status_code} preserves the real status. Hardcoding 503 would mislabel a genuine
-		# 502 for anything watching from outside.
-		respond `<!doctype html>
-<html lang="de">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Gleich zurück</title>
-<style>
-html{background:#faf9f7;color:#1a1918;font-family:system-ui,-apple-system,"Segoe UI",Roboto,sans-serif}
-body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:2rem;text-align:center}
-h1{font-family:Georgia,"Times New Roman",serif;font-weight:600;font-size:1.5rem;margin:0 0 .75rem}
-p{margin:0;color:#545350;line-height:1.5}
-@media (prefers-color-scheme:dark){html{background:#100f0f;color:#f5f4f2}p{color:#a6a4a1}}
-</style>
-</head>
-<body>
-<main>
-<h1>Wir sind gleich zurück</h1>
-<p>Die Seite wird gerade neu gestartet.<br>Bitte lade in einem Moment neu — deine Fotos bleiben gespeichert.</p>
-</main>
-</body>
-</html>
-` {err.status_code}
-	}
+    # Everything else goes to SvelteKit frontend
+    reverse_proxy frontend:3001
 }

DEPLOYMENT_RUNBOOK.md

@@ -1,974 +0,0 @@
-# EventSnap — Production Deployment Runbook
-
-Target: **Hetzner CX22** (2 vCPU, 4 GB RAM, 40 GB disk), single host, docker compose.
-Event profile: ~100 guests, ~100 photos + a few videos, one evening, **operator attending and unavailable to troubleshoot**.
-
-Everything here is written for that last constraint. Where a choice trades throughput for
-"cannot need attention on the night", it takes the stable option.
-
-> **Note on this repo's own docs.** `README.md:62` and `PROJECT.md:359` specify a **CX33
-> (4 vCPU / 8 GB / 80 GB)**. You are deploying to half of that on every axis. Two pieces of
-> tuning advice in `.env.example` are calibrated for the CX33 and are actively wrong for a
-> CX22 — they are called out in §3. Trust this file over `.env.example` for sizing.
-
----
-
-## 0. Timeline — the single most important control
-
-### Step zero: verify the deployment files are committed, before you build anything
-
-Everything the server clones must be in git — §7 tells you to `git clone` onto the box, so
-anything living only in your working tree is not part of the deployment. Two failure modes if it
-is not:
-
-- If the committed `docker-compose.yml` still carried `build:` keys and no `image:` keys, then on
-  that clone `docker compose pull` would skip both services and `docker compose up -d` would start
-  **a fat-LTO release build of 427 crates on the CX22** — the exact scenario §1 rules out as an
-  expected OOM.
-- `sqlx::migrate!()` embeds `./migrations` **at compile time**. An image built from a working tree
-  with uncommitted migrations bakes them in and applies them on first boot; any later rebuild from
-  a clean clone produces an image that lacks them and crash-loops with `VersionMissing` against its
-  own database.
-
-**As of this writing all of these are committed and the check below passes.** Run it anyway — it
-costs a second and it is the difference between finding this now and finding it at T‑5.
-
-```bash
-# Every deployment file must be tracked. Prints nothing and exits 0 when correct;
-# names the offender and exits non-zero otherwise.
-git ls-files --error-unmatch \
-  docker-compose.yml docker-compose.dev.yml docker-compose.build.yml .env.example \
-  backend/.dockerignore frontend/.dockerignore frontend/Dockerfile \
-  DEPLOYMENT_RUNBOOK.md Caddyfile >/dev/null
-
-# No uncommitted edits to them.
-git status --porcelain -- docker-compose.yml .env.example Caddyfile DEPLOYMENT_RUNBOOK.md
-
-# The COMMITTED compose must pull, not build: 4 `image:` lines, zero `build:` lines.
-git show HEAD:docker-compose.yml | grep -cE '^[[:space:]]*image:'   # must be 4
-git show HEAD:docker-compose.yml | grep -cE '^[[:space:]]*build:'   # must be 0
-
-# Every migration in the tree is committed — a build from a dirty tree bakes in extras.
-git status --porcelain -- backend/migrations/                       # must print nothing
-
-# The Caddyfile PARSES. Nothing else checks it: the e2e stack mounts `e2e/Caddyfile.test`,
-# so the production file is never executed until the real deploy — and a syntax error there
-# is total. Caddy exits, `restart: unless-stopped` loops, 443 is dead for the whole event,
-# and `docker compose up -d --force-recreate caddy` still exits 0 while it crash-loops.
-docker run --rm -v "$PWD/Caddyfile:/etc/caddy/Caddyfile:ro" -e DOMAIN=example.com \
-  caddy:2-alpine caddy validate --config /etc/caddy/Caddyfile   # must end "Valid configuration"
-```
-
-| When | What |
-|---|---|
-| **T‑7 days** | Commit and push everything above. Registry + DNS pre-flight (§5). Build and push images (§6). |
-| **T‑5 days** | First deploy to the server (§7). Verify admin login. Leave it running. |
-| **T‑5 days** | ⚠ **Enable Hetzner automated snapshots** (§10.1) and **point an uptime monitor at `/health`** (§10.4). Two console checkboxes, ~10 minutes total. Without them a failure during the event is both total and unnoticed. |
-| **T‑3 days** | **Freeze migrations.** No further code deploys unless something is broken. |
-| **T‑2 days** | Pre-pull current *and* previous image tags (§9). Install the hourly DB dump and prove it runs (§10.2). Run the backup rehearsal (§10.3). |
-| **Event day** | Change nothing. Configuration tweaks via the admin dashboard only (§4). |
-
-**Why the freeze matters more than anything else here.** Migrations run automatically at boot
-(`backend/src/db.rs`, `create_pool`) and `sqlx::migrate!()` is used *without* `set_ignore_missing`. An older
-image booted against a newer schema does not degrade — it **crash-loops** with `VersionMissing`.
-The repo documents this itself in `backend/migrations/014_export_epoch.up.sql:3-8`. Once the
-migration set is frozen, rollback is a one-line `.env` edit; before it is frozen, rollback means
-hand-running down-SQL under pressure.
-
----
-
-## 1. Deployment strategy — build on the Mac, push, pull
-
-**Decision: build `linux/amd64` images on the M3 Pro, push to `registry.mc02.dev`, pull on the server.**
-
-Rejected alternatives, with the reason each loses:
-
-| Option | Why not |
-|---|---|
-| **Build on the CX22** | `backend/Cargo.toml` sets `lto = true` + `codegen-units = 1` over **427 crates**. Fat LTO links the whole program in one single-threaded process; peak RSS is estimated at 2.5–4 GB against ~1.5–2.5 GB free with the stack running. OOM is the expected outcome, not a tail risk. And *rollback would also be a build* — 35–60 min under pressure. |
-| **CI (Gitea on Pi 5)** | Ruled out by you, and correct: a Pi 5 is strictly worse than the CX22 for a fat-LTO link. |
-| **True cross-compilation** (`--target x86_64-unknown-linux-musl`) | The dependency graph has **four C-compiling crates** — `ring` (per-arch assembly), `zstd-sys`, `libdeflate-sys`, `libsqlite3-sys` — so it needs a real musl cross-toolchain. Alpine has no such package for an arm64 host; the working answer is `cargo-zigbuild`, which means a new base image and a new toolchain days before an unrepeatable event. **Slow but certain beats fast but novel.** |
-
-Emulated build is the right call because the cost lands where it is free: on your laptop, days
-early, with nothing depending on it. Estimated wall-clock for the backend is **25–60 min with
-Rosetta enabled** (hours without it) — start it and walk away.
-
-> **Escape hatch if emulation is unbearable:** spin up a temporary Hetzner CPX41 (8 vCPU/16 GB) in
-> the same account, build natively, push, destroy it. Costs cents, same commands, no repo change.
-
----
-
-## 2. Repo changes — ALREADY APPLIED
-
-> **Status: these are done, in the working tree.** They are documented here so you know what
-> changed and why, not as work to repeat. Run `git diff` to review before committing.
-
-### 2.1 `.dockerignore` files (were absent)
-
-`backend/.dockerignore`:
-```
-target/
-```
-
-`frontend/.dockerignore`:
-```
-node_modules/
-.svelte-kit/
-build/
-```
-
-Without these, the first time you run `cargo build` or `npm install` locally, every image build
-ships a multi-GB context to an *emulated* builder. Worse: `frontend/Dockerfile:8` does `COPY . .`
-**after** `npm ci`, so a macOS `node_modules/` would be merged over the container's Linux one.
-
-### 2.2 Switch compose from `build:` to `image:`
-
-In `docker-compose.yml`, replace the `build:` block on `app` and `frontend`:
-
-```yaml
-  app:
-    image: registry.mc02.dev/eventsnap/app:${EVENTSNAP_VERSION:?set EVENTSNAP_VERSION in .env}
-```
-```yaml
-  frontend:
-    image: registry.mc02.dev/eventsnap/frontend:${EVENTSNAP_VERSION:?set EVENTSNAP_VERSION in .env}
-```
-
-Two deliberate properties:
-- The `:?` form **fails loudly** on an unset variable instead of resolving to an empty tag.
-- **Removing `build:` entirely is a safety feature.** With no `build:` key on the server, a wrong
-  tag is an instant `manifest unknown` — never a surprise 45-minute compile on the production box.
-
-New `docker-compose.build.yml` (opt-in, Mac only — follows the convention stated in
-the header of `docker-compose.dev.yml` that overlays are never auto-loaded):
-
-```yaml
-# Build overlay. NOT loaded automatically. Used only where images are BUILT — never on the
-# production server, which pulls.
-#   docker compose -f docker-compose.yml -f docker-compose.build.yml build
-services:
-  app:
-    build: { context: ./backend, dockerfile: Dockerfile }
-  frontend:
-    build: { context: ./frontend, dockerfile: Dockerfile }
-```
-
-`e2e/docker-compose.test.yml` keeps its own `build:` blocks, so the e2e gate is unaffected.
-
-### 2.3 Add log rotation to every service
-
-`docker-compose.yml` currently sets **no logging config**, so the default `json-file` driver keeps
-logs forever, on the same filesystem as Postgres and the media. Add to each of the four services:
-
-```yaml
-    logging:
-      driver: json-file
-      options: { max-size: "10m", max-file: "3" }
-```
-
-(Equivalently, set it once in `/etc/docker/daemon.json` — but that restarts the Docker daemon,
-so do it *before* the stack is live, not after.)
-
----
-
-## 3. `.env` — production values
-
-```bash
-# ── Identity ──────────────────────────────────────────────────────────────
-DOMAIN=<your domain>
-EVENT_NAME=<...>
-EVENT_SLUG=<...>
-
-# ── Image version (NEW — drives the image: tags in docker-compose.yml) ────
-EVENTSNAP_VERSION=v0.13.0
-
-# ── Secrets — ALL of them, before the first `up -d` ───────────────────────
-JWT_SECRET=<openssl rand -hex 64>
-# These two are NOT optional and have no defaults. docker-compose.yml interpolates them into
-# `environment:`, which overrides `env_file`, so leaving them out does not fall back — it creates
-# a Postgres role and database named "" while DATABASE_URL still says `eventsnap`. The result is
-# a permanent crash loop whose only clean exit is `down -v`. Compose now refuses to start without
-# them, but write them here anyway: the three values below must agree with each other.
-POSTGRES_USER=eventsnap
-POSTGRES_DB=eventsnap
-POSTGRES_PASSWORD=<openssl rand -hex 24>
-DATABASE_URL=postgres://eventsnap:<SAME PASSWORD>@db:5432/eventsnap
-ADMIN_PASSWORD_HASH='<docker run --rm caddy:2-alpine caddy hash-password --plaintext "pw">'
-
-# ── Paths — must match the volume mounts ──────────────────────────────────
-# All four of these are PINNED in docker-compose.yml under `app.environment`, which overrides
-# `env_file`. Keep them consistent here for readability, but understand that editing them in
-# `.env` changes nothing — the pin is what the container gets. Change the pin.
-MEDIA_PATH=/media
-EXPORT_PATH=/exports
-APP_PORT=3000
-
-# ── Sizing (see the two corrections below) ────────────────────────────────
-# 15, matching .env.example, the `db` sizing comment in docker-compose.yml and the code
-# default. An earlier draft of this runbook said 30: that does not fit the 1G memory limit
-# compose allots `db`, and 30 simultaneous queries cannot run on 2 vCPU anyway — they queue
-# on the CPU instead of on the pool. Raise it only alongside more cores AND a bigger limit.
-#
-# ALSO PINNED IN COMPOSE (see above), and pinned for a sharper reason than the paths: an
-# unparseable value here is boot-FATAL rather than falling back to the default, so a stray
-# quote or a trailing inline comment in `.env` would crash-loop the app behind a live Caddy.
-DATABASE_MAX_CONNECTIONS=15
-COMPRESSION_WORKER_CONCURRENCY=2
-
-# ── Comments off, likes + captions on ─────────────────────────────────────
-COMMENTS_ENABLED=false
-
-# ── Logging (NEW — production currently defaults to DEBUG) ────────────────
-RUST_LOG=eventsnap_backend=info,tower_http=warn
-```
-
-### Two sizing decisions worth understanding before you touch them
-
-`.env.example` now agrees with this section on both — it carries the same reasoning inline and
-self-corrects the old advice. Kept here because these are the two knobs an operator is most
-tempted to raise under pressure.
-
-**`COMPRESSION_WORKER_CONCURRENCY`: keep `2`. Do NOT raise to 4, and do NOT raise the app memory
-limit to 2G.** An earlier draft justified both on the premise that "each worker can run an
-ffmpeg transcode". **There is no transcode anywhere in this codebase.** `services/video.rs::run_ffmpeg`
-runs `ffmpeg -ss <t> -i <src> -vframes 1 -vf scale=…` — a single poster frame. Video originals are
-stored and served byte-for-byte.
-
-The real memory consumer is the **image** path: `image` 0.25's `resize` builds an `Rgba32F`
-intermediate at **16 bytes/px**, sized `source_width × target_height`, which the 256 MiB decode
-guard in `imaging::decode_limits` does not cover. Estimated peak per photo:
-
-| Source | Peak (decode + display resize) |
-|---|---|
-| 12 MP (typical phone) | ~145 MB |
-| 24 MP (iPhone Pro default) | ~223 MB |
-| 48 MP ("Max" mode) | ~354 MB |
-
-Those are per-photo peaks, and the "two 48 MP photos at once" pair this limit used to be sized
-against **is no longer reachable**: `compression.rs` takes an EXCLUSIVE `heavy` permit for a large
-decode, so two giants serialise no matter what `COMPRESSION_WORKER_CONCURRENCY` is set to (see
-`.env.example`, which makes the same point). The binding case is now one giant (~354 MB) plus the
-ordinary working set against the 1 GiB cap, which is comfortable.
-
-What has not changed is the reason to keep concurrency at 2 and `app` at 1G: at concurrency 4 the
-memory arithmetic stops working (app=2G + db=1G + 256M + 256M + ~370 MB OS/Docker ≈ 3954 MiB
-against ~3910 MiB MemTotal — oversubscribed before a single photo arrives).
-
-**`quota_tolerance`: keep `0.75`. Raising it does not make anything more generous for a real guest.**
-See §4.
-
----
-
-## 4. Admin dashboard configuration
-
-These live in the DB `config` table, not `.env`. Changes take effect on the **next request** —
-`patch_config` invalidates the cache synchronously (`admin::patch_config`). No restart needed. Set them
-after the first deploy, before the event.
-
-| Key | Default | **Set to** | Why |
-|---|---|---|---|
-| `upload_rate_per_hour` | 100 | **1000** | A guest multi-selecting 100 photos hits exactly 100. Client backs off and resumes, but this makes it a non-issue. |
-| `feed_rate_per_min` | 60 | **240** | Headroom for reconnect bursts. |
-| `social_rate_per_min` | 120 | **600** | This is the **likes** limiter — the interaction you're keeping. |
-| `export_rate_per_day` | 3 | **20** | **One shared bucket across both archives** — `enforce_export_rate` keys on `export:{user_id}` regardless of which archive is being fetched. Downloading Gallery.zip + Memories.zip costs 2 of 3; one retry locks a guest out for 24 h. The limit is now charged when the download *ticket* is minted, so being over it produces a visible German error instead of a tap that silently does nothing. |
-| `max_video_size_mb` | 500 | **leave at 500** | See below. |
-| `quota_tolerance` | 0.75 | **leave at 0.75** | See below. |
-| `quota_enabled`, `storage_quota_enabled`, `rate_limits_enabled` | true | **leave on** | This is the only disk-full safety net. |
-
-> **Correction (was wrong in an earlier draft).** This section used to say "**Ignore
-> `estimated_guest_count`** … read by no code at all". That is **false** — it is a live tuning
-> knob and it is the dominant term in the quota divisor for a normal event. An operator who
-> believed the old text and changed it would have moved every guest's ceiling. `upload_count_quota_enabled`
-> genuinely is inert.
-
-### Why quotas are already as generous as you want
-
-```
-divisor        = max(active_uploaders, estimated_guest_count, 1)
-per_user_limit = max(floor(free_disk × quota_tolerance / divisor), 500 MiB)
-```
-(`upload::quota_limit_bytes`. The 500 MiB floor applies only when the whole budget can back it —
-below that the divided value stands, so the quota cannot promise space the disk does not have.)
-
-`active_uploaders` is `SELECT COUNT(DISTINCT user_id) FROM upload WHERE deleted_at IS NULL` —
-**people who actually uploaded**, not guests who joined. But it is a `max`, not the sole divisor:
-`estimated_guest_count` (default **100**) acts as a **floor on the divisor**, so the ceiling settles
-at its final value early instead of sliding down all evening as guests arrive. It also blunts the
-abuse case where the divisor was attacker-controlled — ~1000 throwaway accounts once drove every
-real guest's ceiling to ~52 MB.
-
-With ~28 GB free, `quota_tolerance` 0.75 and a realistic 30 people actually uploading, the divisor
-is **100** (not 30, because `estimated_guest_count` floors it), giving 28 GB × 0.75 / 100 ≈ 210 MB —
-which is below the floor, so **every guest is granted the 500 MiB minimum**. Against an expected
-~1.25 GB for the *entire event*, nobody will be blocked. An earlier draft computed "~700 MB each"
-by dividing by 30; that ignored the floor on the divisor and was wrong.
-
-Raising `quota_tolerance` would only raise the **saturation ceiling** (media converges to
-`t/(1+t)` of free space: 43% at 0.75, 50% at 1.0). It does nothing for a real guest at your volume,
-and it eats the headroom the keepsake needs — the export preflight reserves `media × 1.10 × 2`
-because `Gallery.zip` and `Memories.zip` each store media **uncompressed** (`export.rs` — both archives store media uncompressed).
-
-**Why `max_video_size_mb` stays at 500.** An earlier draft of this runbook said to lower it to 250,
-on the grounds that there is no client-side size check. That was wrong on both halves:
-
-- A client guard **does** exist — `frontend/src/routes/upload/+page.svelte` rejects anything over
-  `HARD_MAX_UPLOAD_BYTES` (576 MiB) before a byte leaves the phone, alongside the HEIC reject.
-- That guard is a **compile-time constant**, not the DB value. Lowering `max_video_size_mb` therefore
-  changes nothing on the client: the picker still accepts the clip, the phone still starts sending
-  it, and the *server* aborts it partway (`stream_field_to_file` does stop at the cap, so the AP is
-  not saturated for the full file — but the guest still gets a mid-upload failure where 500 MB would
-  simply have worked).
-
-So lowering it is a pure capacity decision with no UX upside, and at your volume there is no capacity
-problem to solve. Leave it. If you ever do want a smaller ceiling to bite on the phone, the constant
-above has to move with it.
-
----
-
-## 5. Pre-flight — T‑7 days (do NOT leave this to event week)
-
-### Registry
-
-From **both** the Mac and the server, as **the user who will deploy** (root's `docker login` does
-not help a non-root deploy — credentials go to `~/.docker/config.json`):
-
-```bash
-getent hosts registry.mc02.dev                 # DNS resolves from the server
-curl -fsSI https://registry.mc02.dev/v2/       # TLS must be PUBLICLY trusted; Docker rejects
-                                               # self-signed without extra daemon config
-docker login registry.mc02.dev
-```
-
-Also confirm: the `eventsnap` repository/namespace exists if your registry requires pre-creation
-(Harbor does; plain `registry:2` does not), and the registry host has ~500 MB free per release.
-
-### DNS and TLS — get this wrong and you are locked out for an hour
-
-The DNS **A record must point at the CX22 before the first `docker compose up -d`**, because Caddy
-attempts certificate issuance on boot. Let's Encrypt allows only **5 failed validations per hostname
-per hour** (refilling 1 per 12 min). A misconfigured DNS record plus a few impatient restarts will
-rate-limit you out of getting a certificate at all.
-
-- Deploy days early so issuance happens with no time pressure.
-- **Never delete the `caddy_data` volume** — it holds the certificate and the ACME account key.
-- Never run `docker compose down -v`. It destroys `postgres_data`, `media_data`, `exports_data`
-  *and* `caddy_data`.
-
-### Host preparation
-
-```bash
-docker compose version          # must be v2.x — see below, this one is not optional
-free -h && swapon --show        # Hetzner images ship no swap
-df -h /var/lib/docker           # want ≥ 25 GB free
-```
-
-> **If `docker compose version` reports v1 (or `docker-compose` is a separate Python binary), STOP
-> and install the v2 plugin before deploying.** This check previously had no failure action, which
-> made it decorative — and it is the single check that the whole sizing argument rests on.
->
-> On Compose v1, `deploy.resources.limits` is **silently ignored** outside Swarm: no warning, no
-> error, `up -d` exits 0. Every memory and CPU limit in `docker-compose.yml` evaporates, and §1's
-> arithmetic (`app` 1G + `db` 1G + 256M + 256M inside ~3910 MiB) becomes fiction — the first 48 MP
-> photo takes the box out via the OOM killer instead of being bounded. On v2 the limits are real
-> (verified empirically: `memory: 1G` produces `HostConfig.Memory=1073741824`).
->
-> ```bash
-> # Debian/Ubuntu, with Docker's official repo already configured:
-> apt-get update && apt-get install -y docker-compose-plugin
-> docker compose version   # must now print v2.x
-> ```
->
-> Verify the limits actually landed, once the stack is up — this is the check that matters, not the
-> version string:
->
-> ```bash
-> docker inspect eventsnap-app-1 --format '{{.HostConfig.Memory}} {{.HostConfig.NanoCpus}}'
-> # Must print two NON-ZERO numbers. `0 0` means the limits were dropped.
-> ```
-
-**Add 2 GB of swap** as an OOM cushion — a compression spike that would otherwise kill the container
-instead swaps out cold pages and merely runs slowly:
-
-```bash
-fallocate -l 2G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile
-echo '/swapfile none swap sw 0 0' >> /etc/fstab
-sysctl -w vm.swappiness=10 && echo 'vm.swappiness=10' > /etc/sysctl.d/99-swap.conf
-```
-
-> **Already handled — do not hand-edit compose.** Compose sets each container's `Memory` limit but
-> leaves `MemorySwap` unset, and Docker then allows swap equal to the memory limit, so adding host
-> swap would silently **double** every container ceiling (to ~5 GiB of ceilings on a 3.82 GiB box).
-> `docker-compose.yml` now ships `memswap_limit` on all four services — 1152m on `app` and `db`,
-> 320m on `frontend` and `caddy` — so this step is safe as written.
->
-> This used to say "add it yourself", which also broke §0's own gate that
-> `git status --porcelain -- docker-compose.yml` must print nothing. Confirm it is still there:
->
-> ```bash
-> docker inspect eventsnap-app-1 --format '{{.HostConfig.Memory}} {{.HostConfig.MemorySwap}}'
-> # 1073741824 1207959552 — the second number MUST be larger than the first but not double it.
-> ```
-
----
-
-## 6. Build and push — on the Mac
-
-Enable **Docker Desktop → Settings → General → "Use Rosetta for x86_64/amd64 emulation"**, and set
-**Resources → Memory ≥ 8 GB** (the fat-LTO step will OOM inside the VM otherwise, even with 18 GB on
-the host).
-
-```bash
-docker run --rm --platform linux/amd64 alpine uname -m     # must print x86_64
-
-cd /Users/fabianhammprivat/Projects/EventSnap
-VERSION=v0.13.0                          # latest existing tag is v0.12.0 — see §9 before reusing it
-ROLLBACK=v0.13.0-a                       # the SAME source, tagged twice; §9 explains why
-SHA=$(git rev-parse --short HEAD)
-
-docker buildx create --name eventsnap --use 2>/dev/null || docker buildx use eventsnap
-
-docker buildx build --platform linux/amd64 \
-  -t registry.mc02.dev/eventsnap/app:$VERSION \
-  -t registry.mc02.dev/eventsnap/app:$ROLLBACK \
-  -t registry.mc02.dev/eventsnap/app:$SHA \
-  --push ./backend
-
-docker buildx build --platform linux/amd64 \
-  -t registry.mc02.dev/eventsnap/frontend:$VERSION \
-  -t registry.mc02.dev/eventsnap/frontend:$ROLLBACK \
-  -t registry.mc02.dev/eventsnap/frontend:$SHA \
-  --push ./frontend
-```
-
-### Verify the architecture — never skip this
-
-An arm64 image pulls fine and then dies with `exec format error`. Catch it here, not on the server:
-
-```bash
-docker buildx imagetools inspect registry.mc02.dev/eventsnap/app:$VERSION
-docker buildx imagetools inspect registry.mc02.dev/eventsnap/frontend:$VERSION
-# Both MUST report  Platform: linux/amd64
-```
-
-Then prove the binary actually executes. `AppConfig::from_env()` runs before any DB connection
-(`main.rs` builds `AppConfig` before touching the pool), so this needs no database:
-
-```bash
-docker run --rm --platform linux/amd64 \
-  -e APP_ENV=production -e JWT_SECRET=x -e DATABASE_URL=x -e EVENT_SLUG=x \
-  registry.mc02.dev/eventsnap/app:$VERSION
-```
-Expect the "Refusing to start in production … placeholder" message. **That message means the amd64
-binary ran.** `exec format error` means the architecture is wrong.
-
-**Tag policy: never `latest` in production.** With `latest` you cannot tell what is running,
-rollback becomes a registry re-push (impossible if the registry is down — exactly when you need it),
-and `restart: unless-stopped` after a reboot is ambiguous. Two immutable tags per build: semver and
-short SHA. Deploy by semver.
-
----
-
-## 7. First deploy — on the server
-
-```bash
-# Directory name matters: volumes are prefixed with it, and README's backup commands
-# hardcode the `eventsnap_` prefix.
-git clone <repo> eventsnap && cd eventsnap
-cp .env.example .env && nano .env          # every value from §3
-docker login registry.mc02.dev
-docker compose pull                        # must fully succeed before anything starts
-```
-
-### 7.1 The secret pre-flight — run this before the first `up -d`, always
-
-```bash
-docker compose run --rm --no-deps app
-```
-
-`--no-deps` means `db` never starts, so **no Postgres data directory is initialised**.
-`AppConfig::from_env()` runs first and reports *every* placeholder at once (`config::validate_secrets`).
-When the only remaining complaint is a database *connection* failure, the secrets are good.
-
-**Why this step exists.** `POSTGRES_PASSWORD` is applied **only at initdb**. `docker-compose.yml`
-starts `db` in the same command as `app`, so a single `up -d` with a placeholder bakes the wrong
-password in permanently — the app then loops on `password authentication failed`, and the only exits
-are `ALTER ROLE` or `down -v`, which deletes the database, the media and the exports. The repo
-describes this trap at `backend/src/db.rs` (`explain_auth_failure`); this command is what avoids it.
-
-### 7.2 Bring it up
-
-```bash
-# `.env` is consumed by docker compose, not by your shell — read $DOMAIN out of it first.
-# Reads that ONE variable rather than sourcing the file: `.env` legitimately holds values with
-# apostrophes (EVENT_NAME), and `. ./.env` aborts on one with "Unterminated quoted string".
-DOMAIN=$(sed -n 's/^DOMAIN=//p' .env | tr -d "\"'")
-
-docker compose up -d
-docker compose logs -f app          # wait for "database connected and migrations applied"
-curl -fsS https://$DOMAIN/health    # → ok  (503 means the app is up but the DB is not)
-```
-
-### 7.3 Verify what the container actually received
-
-`MEDIA_PATH`, `EXPORT_PATH` and `APP_PORT` are all **pinned** on the `app` service in
-`docker-compose.yml`, exactly as §3 says — editing them in `.env` changes nothing. This step is
-not about whether they are pinned; it is about confirming the container got the values you think
-it did, including the two that genuinely do come from `.env`:
-
-```bash
-docker compose exec app printenv DATABASE_URL EXPORT_PATH ADMIN_PASSWORD_HASH
-```
-
-1. **`DATABASE_URL`** (from `.env`) must contain `@db:5432`. A dev `.env` points it at
-   `@localhost`, which inside the container is the app itself.
-2. **`EXPORT_PATH`** (pinned) must read `/exports`. If it does not, the pin has been edited —
-   anywhere else and the keepsake archives are written to the container's writable layer and
-   **vanish on the next `up -d`**, including on a rollback.
-3. **`ADMIN_PASSWORD_HASH`** (from `.env`) must match `.env` **byte for byte.**
-
-**Then actually log in to `/admin` with the real password.** This is not optional politeness:
-
-- The production secret guard only rejects *placeholders* (`config::looks_placeholder`). A hash **corrupted**
-  by shell or Compose escaping is not a placeholder — the app boots green, `/health` says `ok`, and
-  every admin login 401s.
-- The Admin user row is created **by a successful admin login** (`auth::handlers::admin_login`), and
-  promoting anyone to Host requires an Admin or Host (`auth::middleware`'s role guard). **No admin login
-  ⇒ no host, ever** ⇒ you cannot close the event, release the gallery, ban anyone, reset a PIN, or
-  change any limit — for the whole event.
-
-Per the Compose spec, single-quoted `env_file` values *are* used literally and the quotes are
-stripped, so the single-quote form in `.env.example` is correct. The comment in
-`docker-compose.dev.yml` claiming production has the same bug is **stale**. Verify anyway —
-the cost of checking is 10 seconds; the cost of being wrong is the whole event.
-
-**Promote a second person to Host** once you are in, so a single lost session is not fatal.
-
----
-
-## 8. Post-deploy verification
-
-```bash
-DOMAIN=$(sed -n 's/^DOMAIN=//p' .env | tr -d "\"'")          # $DOMAIN comes from .env, not your shell
-
-docker compose ps                                            # db, app, frontend healthy; caddy has
-                                                             # no healthcheck and shows only "running"
-docker inspect -f '{{.HostConfig.Memory}}' eventsnap-app-1   # must be 1073741824, not 0
-curl -fsS https://$DOMAIN/health                             # ok — now a real DB check, not a constant
-docker compose exec app printenv COMMENTS_ENABLED RUST_LOG
-docker builder prune -af && docker image prune -f            # reclaim build cache
-df -h /var/lib/docker
-```
-
-Then, from a phone on cellular (not the office wifi):
-
-- [ ] Join as a guest with a PIN
-- [ ] Upload a photo → appears in the feed within a few seconds
-- [ ] Upload a video → plays back (iOS Safari range requests)
-- [ ] Add a caption, add a like — **no comment UI anywhere**
-- [ ] Admin login works; host dashboard reachable
-- [ ] Release the gallery on a test event and download both archives
-
----
-
-## 9. Rollback
-
-### There is no older image you can roll back to. Build the rollback target yourself.
-
-Read this before the event, not during it. The obvious move — drop `EVENTSNAP_VERSION` back to the
-previous released tag — **takes the app down permanently** and looks like a crash loop with no
-explanation:
-
-```
-$ git ls-tree --name-only v0.12.0 backend/migrations/ | wc -l
-12          # 6 migrations. HEAD has 31.
-$ git rev-list --count v0.12.0..HEAD
-217
-```
-
-`db.rs` runs `sqlx::migrate!()` with no `set_ignore_missing`, so an image built from a 6-migration
-tree, booting against a database that already carries versions 007–031, returns `VersionMissing`.
-`create_pool` errors, `main` exits 1, and `restart: unless-stopped` restarts it forever — with Caddy
-still routing traffic to it. (`014_export_epoch.up.sql` documents this failure mode; §0 restates it.)
-No `v0.12.0` image was ever built or pushed either, so the pre-pull would fail with
-`manifest unknown` before you ever got that far.
-
-**So: at build time, tag the SAME frozen commit twice.** Two identical images, two names. The
-rollback then swaps to a binary that is bit-for-bit what you tested and carries the identical
-migration set, which makes it a genuine no-op rather than a gamble:
-
-```bash
-# In §6, push both tags from the one build:
-VERSION=v0.13.0
-ROLLBACK=v0.13.0-a          # same source, different name — the rollback target
-
-docker buildx build --platform linux/amd64 \
-  -t registry.mc02.dev/eventsnap/app:$VERSION \
-  -t registry.mc02.dev/eventsnap/app:$ROLLBACK \
-  --push ./backend
-# ...and the same two tags for ./frontend
-```
-
-**Rolling back — ~30 seconds, no network:**
-
-```bash
-sed -i 's/^EVENTSNAP_VERSION=.*/EVENTSNAP_VERSION=v0.13.0-a/' .env
-docker compose up -d app frontend
-```
-
-This only works offline if both are already resident. **Pre-pull all four at T‑2:**
-
-```bash
-docker pull registry.mc02.dev/eventsnap/app:v0.13.0
-docker pull registry.mc02.dev/eventsnap/frontend:v0.13.0
-docker pull registry.mc02.dev/eventsnap/app:v0.13.0-a
-docker pull registry.mc02.dev/eventsnap/frontend:v0.13.0-a
-docker image ls | grep eventsnap        # confirm all four
-```
-
-Once resident, `up -d`, reboots, restarts and rollbacks need **zero** registry contact. That single
-step makes a registry outage on event day irrelevant.
-
-Be clear-eyed about what this buys you: an identical image cannot undo a bad *release*, only an
-image that got corrupted or a container that wedged — and `docker compose restart app` already
-covers both. It exists so that the rollback line in the emergency card is safe to run rather than
-catastrophic. **If you genuinely need to undo a code change during the event, you cannot; freeze
-early enough that you never have to.**
-
-**Across a migration boundary — avoid by freezing.** If you must: all 31 migrations have paired
-`.down.sql` files, but **none of them removes its own `_sqlx_migrations` row**, so that second step
-is mandatory and undocumented:
-
-```bash
-docker compose stop app
-# `sh -c` so the CONTAINER expands the credentials. They live in the container's environment
-# and in .env — not in your shell — so an unwrapped `-U "$POSTGRES_USER"` sends `-U ""` and
-# psql answers `FATAL: role "" does not exist`.
-docker compose exec -T db sh -c \
-  'psql -U "$POSTGRES_USER" -d "$POSTGRES_DB" -v ON_ERROR_STOP=1' \
-  < backend/migrations/0NN_x.down.sql
-docker compose exec -T db sh -c \
-  'psql -U "$POSTGRES_USER" -d "$POSTGRES_DB" -c "DELETE FROM _sqlx_migrations WHERE version = NN;"'
-```
-
-> **A down migration is only valid PAIRED WITH A CODE ROLLBACK — it is not a standalone repair.**
-> `Upload::create` sends an `ON CONFLICT ... WHERE` predicate that must match the live partial
-> index exactly, and these queries are not compile-checked. Run **026**'s or **031**'s down against
-> the current binary and every upload carrying a `client_upload_id` — i.e. every upload from the
-> shipped client — becomes a runtime 500. Roll the image back first, then the migration.
->
-> **026's down can also fail outright, and that is expected.** It restores a wider unique index, so
-> it aborts with `could not create unique index ... is duplicated` on any database where a guest
-> ever deleted a photo and re-uploaded it. The transaction rolls back cleanly and the narrow index
-> survives intact — no half-state — but you cannot go below 026 on a database that has seen real
-> use. Verified against a live Postgres.
-
-Migration **014** is the only destructive one on the way up, and the only one with a rehearsal
-harness — `backend/scripts/rehearse-014.sh`. Run it once against a real dump before the event.
-
-**Registry-down transport fallback** (layers are already compressed — do not add gzip):
-
-```bash
-docker save registry.mc02.dev/eventsnap/app:v0.13.0 \
-            registry.mc02.dev/eventsnap/frontend:v0.13.0 | ssh root@SERVER 'docker load'
-```
-
----
-
-## 10. Backup
-
-Full commands are in README's **`## Backup`** and **`## Restore`** sections — read `## Restore` to
-its END (through the media *and* exports restore, and the `chown` that follows), not just the
-database step. Referenced by heading, not by line number: the previous pointer named a line range
-that had drifted to the middle of an unrelated section and stopped mid-way through restore step 2,
-which would have restored the database and no media. They are correct — `pg_dump --clean --if-exists`, plus
-`alpine tar` out of `eventsnap_media_data` and `eventsnap_exports_data`, mounted at `/src` (not
-`/media`), with `chown -R 100:101` on restore because the app runs non-root and BusyBox tar has no
-`--same-owner`. There is deliberately no script.
-
-Three gaps the README does not cover:
-
-1. **Nothing backs up `.env`**, which holds the only copy of `POSTGRES_PASSWORD`. A dump you cannot
-   authenticate against is not a backup. Copy `.env` off the box, encrypted, once it is final.
-2. **The final dump is not a backup — it is an archive.** Taking it *after* locking uploads gives
-   you a consistent pair, and that is the right way to archive the finished event. But it means
-   that until the host locks uploads there is **no copy of anything anywhere**. All four volumes
-   sit on the same 40 GB filesystem, on one VPS, with no redundancy. A disk or host failure at
-   23:00 — the fullest the gallery will ever be — loses **100% of the event**, permanently, with
-   the guests still in the room. Both of the mitigations below are required.
-3. **Nothing is watching.** See §10.2.
-
-### 10.1 Snapshots — do this once, before the event
-
-> ⚠ **ACTION REQUIRED — Hetzner Cloud console, ~5 minutes, one checkbox.**
-> Server → **Backups** → enable. Costs ~20% of the server price and needs no operator action
-> ever again.
-
-This is the single highest-value item in this runbook. It converts "total, permanent loss" into
-"lose at most the hours since the last snapshot", automatically, with nobody awake. It covers the
-whole volume set at once — database, media, exports and `.env` — which the `pg_dump` path does not.
-
-It does **not** replace §10's archive: snapshots are whole-disk and crash-consistent, so restoring
-one gives you the box back, not a portable copy of the photos. Do both.
-
-### 10.2 A mid-event database dump — cheap, and the only thing cron should do
-
-The database is small (a few MB — it holds rows, not pixels) and it is the part that cannot be
-reconstructed: media files on disk without their `upload` rows are anonymous UUIDs with no
-uploader, caption, hashtag or timestamp. Dumping it hourly costs essentially nothing and is safe
-while uploads are live, because a `pg_dump` is transactionally consistent on its own.
-
-Media is the bulk and *is* recoverable from guests' phones in the worst case, so it stays on the
-event-night schedule below.
-
-Install this as **the same user you deployed as** (§5) — not root. `docker compose` needs that
-user's docker group membership and its compose project, and a root crontab has neither.
-
-```bash
-# On the server, before the event. Hourly DB-only dump, keeping the last 48.
-mkdir -p ~/eventsnap-dumps
-cat >~/eventsnap-dump.sh <<'SH'
-#!/bin/sh
-set -eu
-# Must match your deploy directory from §5. cron starts in $HOME, so this cannot be relative.
-cd "$HOME/eventsnap"
-# NOTE: deliberately does NOT source .env. Nothing here reads it — POSTGRES_USER and POSTGRES_DB
-# are expanded INSIDE the db container by the single-quoted sh -c below, using the values compose
-# already injected. Sourcing it was actively harmful: `.env` legitimately contains values with
-# apostrophes (EVENT_NAME="Max & Maria's Wedding"), and POSIX sh aborts on one with
-# "Unterminated quoted string". Under `set -eu` this script would exit before pg_dump — every
-# hour, silently, leaving the only automated backup of the irreplaceable table permanently empty.
-OUT="$HOME/eventsnap-dumps/db-$(date -u +%Y%m%dT%H%M%SZ).sql.gz"
-docker compose exec -T db sh -c \
-  'pg_dump --clean --if-exists -U "$POSTGRES_USER" "$POSTGRES_DB"' | gzip >"$OUT.tmp"
-mv "$OUT.tmp" "$OUT"          # atomic: never leave a truncated dump looking complete
-ls -1t "$HOME"/eventsnap-dumps/db-*.sql.gz | tail -n +49 | xargs -r rm
-SH
-chmod +x ~/eventsnap-dump.sh
-( crontab -l 2>/dev/null; echo "17 * * * * $HOME/eventsnap-dump.sh >>$HOME/eventsnap-dumps/dump.log 2>&1" ) | crontab -
-
-# Prove it works NOW, not at 23:00 — and prove it produced a NON-EMPTY dump, since the failure
-# this replaces produced a zero-byte file and a clean exit code.
-~/eventsnap-dump.sh && ls -lh ~/eventsnap-dumps/
-gzip -t ~/eventsnap-dumps/db-*.sql.gz && echo "dump is a valid gzip"
-zcat ~/eventsnap-dumps/db-*.sql.gz | grep -c 'CREATE TABLE' # must be > 0, not just "a file exists"
-```
-
-These land on the same filesystem, so they do **not** survive a disk loss — that is what §10.1 is
-for. They protect against the far more likely failure: a bad migration, an accidental host action,
-or a corrupted table.
-
-### 10.3 The event-night archive — unchanged
-
-Take the dump and the media tarball back-to-back **the night of the event, after locking uploads
-from the host dashboard**, so the pair is consistent. Copy both off the box before you sleep.
-
-### 10.4 Monitoring — something has to be able to wake you
-
-> ⚠ **ACTION REQUIRED — external uptime monitor, ~5 minutes.**
-> Point any free monitor (UptimeRobot, Better Stack, Healthchecks.io — all have free tiers with
-> SMS or push) at `https://$DOMAIN/health`, 1–5 minute interval, **alerting to a phone that will
-> be on you during the event.**
-
-There is otherwise **no** metrics collection, no alerting, no log shipping and no external check
-anywhere in this deployment. Without this step, none of the following reaches a human: a crash
-loop, a full disk, a dead database, an expired certificate, or the box being off. The host is at
-a party and is not watching a dashboard.
-
-`/health` is already built for exactly this and nothing currently consumes it:
-
-| Response | Meaning | Action |
-|---|---|---|
-| `200 ok` | App **and** database are answering | — |
-| `503 database timeout` / `database unavailable` | App is up, Postgres is not | §13 emergency card |
-| Connection refused / TLS error | App container or Caddy is down | `docker compose ps`, then §13 |
-| Timeout | Box is gone, or the disk is full enough to wedge it | §10.1 snapshot restore |
-
-It runs a real `SELECT 1` against the pool with a 2 s timeout — a green check means the request
-path guests use is genuinely working, not merely that a process is listening.
-
-**The one signal this does not give you is disk.** The low-disk banner on `/host` requires the
-host to open a dashboard during their own party and does not refresh without a manual reload, so
-treat it as a pre-event check, not an alert. Before the event, confirm headroom with §11's
-numbers; the export preflight and the upload quota are the automated backstops.
-
----
-
-## 11. Disk — the numbers for 40 GB
-
-Expected event (100 photos @ ~4 MB, 5 videos @ ~150 MB). Originals are **always kept** and never
-lossily recompressed; derivatives are a ≤800 px preview and a ≤2048 px display JPEG.
-
-```
-media (originals + derivatives)                    ~1.25 GB
-peak during keepsake build (+ Gallery + Memories)  ~3.5 GB
-OS + Docker images + Postgres + logs               ~4.5 GB
-────────────────────────────────────────────────────────────
-total                             ~11–13 GB of ~36 GB usable
-```
-
-**40 GB fits with roughly 3× headroom**, provided you build elsewhere (a server-side build adds
-3–5 GB of cache that permanently shrinks the guest quota, because the quota is recomputed against
-*live* free space on every upload).
-
-The "ENOSPC" projection in README's **`### Sizing the disk`** discussion models guests
-**saturating the quota** (~12 GB of media), not 100 photos. That scenario needs ~10× your expected
-volume — and it degrades gracefully: the export preflight refuses up front rather than hitting
-ENOSPC mid-write, and the host dashboard warns while free space is still **1.25× above the level at
-which uploads stop** (`handlers::host::disk_is_low`). Note that is the only trigger: the separate
-10 GB absolute floor this used to describe was removed as unreachable, because the derived
-threshold is always higher.
-
----
-
-## 12. Known issues you are shipping with
-
-None of these has a fix in this runbook; they are listed so nothing is a surprise. Severity is
-scored purely by "would this interrupt you during the event".
-
-### Fixed in this pass
-
-| Was | Fix |
-|---|---|
-| **Queued uploads never rehydrated** — `loadQueue()` had one call site, so a guest whose PWA was evicted mid-upload and reopened onto `/feed` had pending photos in IndexedDB that nothing ever read. Silent photo loss. | `loadQueue()` now runs on every authenticated boot in `+layout.svelte`. |
-| **A corrupted `ADMIN_PASSWORD_HASH` booted green** and only failed at admin login — unrecoverable mid-event. | `config.rs` now validates the bcrypt *shape*, not just placeholder-ness, and refuses to start. |
-| **SSE reconnect thundering herd** — flat 500 ms jitter regardless of backoff. | Jitter now scales with the delay; the feed's in-place refresh is spread over 800–2800 ms. |
-| **No client-side size/HEIC pre-check** — a doomed 600 MB upload saturated the venue AP before being rejected. | Certain-rejects are refused before any bytes leave the phone. |
-| **Upload-queue UI unreachable** — the badged FAB opened the picker, not the queue, so a failed upload had no retry button. | The upload sheet now shows a queue entry whenever the badge is non-zero. |
-| **A mid-event 401 left a dead screen** with no nav and no URL bar. | `api.ts` now returns the guest to `/join` (skipping the auth routes themselves). |
-| **Rate limiter could panic while holding its mutex** (`timestamps[0]` with `max == 0`), poisoning it process-wide. | Uses `first()` with a fail-open guard. |
-| **Hashtag deadlock** — `edit_upload` and `add_comment` upserted tags in client/text order. | Both now sort + dedup on the normalised key, matching the upload path. |
-| **Unbounded Docker logs + debug-level app logging.** | `logging:` caps every service at 30 MB; `RUST_LOG` documented in `.env.example`. |
-
-### Fixed in the readiness pass — behaviour you should know about
-
-These change what you will observe on the night, so they are listed separately from the table above.
-
-| Was | Now |
-|---|---|
-| **Any ffmpeg-level failure DESTROYED the video.** A poster-frame error — ffmpeg hanging on a truncated `.mov`, an ENOSPC on `thumbnails/`, a DB blip — propagated into the give-up path, which soft-deleted the upload. Reproduced live: on a host with no ffmpeg the clip was gone ~6 s after its `201 Created`. | No failure in the video branch can fail the upload. The clip stays in the feed and plays from its original; only the poster is missing. |
-| **A lost response duplicated the photo.** Every retry minted a fresh upload id, so a phone that lost the reply and re-sent — manually, or automatically on reconnect — stored the same photo two or three times and paid quota for each. | The client sends a `client_upload_id`; migration 022 makes it unique. A retry returns `200` with the original row. Verified live: three sends → one row, quota charged once. |
-| **`/health` returned a constant `"ok"`.** The container reported healthy while every request 500'd. | Runs `SELECT 1` with a 2 s timeout: `200 ok` / `503`. Verified live: 200 → stop Postgres → 503 → start Postgres → 200, **with no app restart** (the pool revalidates on acquire). Note that Compose does not restart on an unhealthy probe — this is a diagnostic, deliberately not wired to automatic recovery, because a restart would truncate in-flight uploads to "fix" an outage that clears on its own. |
-| **Abandoned `.tmp` uploads were never reclaimed** (see the old issue #2 below — it is now fixed, not deferred). | Swept at boot and hourly, keyed on modification time so a live upload can never age into it. |
-| **A full disk made itself worse.** ENOSPC was retried three times, then refunded the quota, soft-deleted the row and *kept* the bytes — freeing nothing and inviting an immediate re-upload into the same full disk. | ENOSPC is classified separately: no retry, no refund, no delete. The row stays live and the photo is served from its original until there is room to compress it. |
-| **The keepsake download failed invisibly.** The rate limit was enforced inside the iframe navigation, so an over-limit guest tapped and *nothing happened*, forever. | Charged when the ticket is minted — a normal `fetch` — so it surfaces as a German message naming the daily window. Raise `export_rate_per_day` per §4 anyway. |
-| **`/host` and `/admin` subscribed to SSE but never opened the connection**, so the keepsake progress bar froze after a release. | Both connect on mount and disconnect on destroy, as `/export` already did. |
-| **`?limit=-5` on the feed returned a 500.** | Clamped at both ends. |
-| **All recurring hygiene lived in one unsupervised task** — one panic silently stopped session pruning, media reclamation and the temp sweep for the rest of the event. | Supervised and re-spawned, with an error log. |
-| **No pool acquire or statement timeout.** A DB blip parked every request for 30 s. | 5 s acquire, `statement_timeout=15s`, `lock_timeout=5s`. |
-
-### Still open — accepted for this event
-
-| # | Issue | Impact |
-|---|---|---|
-| 1 | **Guest delete/caption-edit after release invalidates both keepsake archives** (`upload.rs`), forcing a rebuild with a 20 s debounce. **No-op before release**, so it cannot bite during the event. | Post-event only. Left alone because blocking guest deletes has real privacy downsides — that is a product call, not a bug fix. |
-| 2 | **Video poster frames do not regenerate after a restart** mid-compression (the backfill filters `mime_type LIKE 'image/%'`). | Cosmetic — the video still plays; only its poster is missing. |
-| 3 | **SSE keep-alives are sent as SSE comments** (`:ping`), which the browser's EventSource parser discards without dispatching. A client therefore cannot implement a pure silence timer to detect a half-open socket. | Worked around client-side: the feed runs a jittered 60–120 s `/feed/delta` backstop and reconnects when a poll returns content the stream never delivered. A cleaner fix is to emit keep-alives as a *named* event; that is a coordinated backend+frontend change, not worth making during a freeze. |
-| 4 | **The lightbox stops at the end of the loaded page** — stepping past the last loaded photo does not fetch the next one. | The guest scrolls the feed (which does page) and re-opens. |
-
-### Migration checksum mismatch — `VersionMissing` / "previously applied but has been modified"
-
-`sqlx` compares **checksums**, so renaming or renumbering a migration file is indistinguishable
-from editing one. If a box ever booted an image built from a branch that numbered migrations
-differently, the next boot aborts with *"migration 21 was previously applied but has been
-modified"*, `main` exits non-zero, and `restart: unless-stopped` makes it **permanent** — with
-Caddy still routing traffic to the dead container.
-
-Every main-line migration is byte-identical to what shipped, so a box that only ever ran tagged
-releases is unaffected. **Verify rather than assume** — run this against the server before any
-deploy.
-
-Note the `sh -c` wrapping, for the same reason as §9: `POSTGRES_USER` and `POSTGRES_DB` live in
-`.env`, which Compose reads and **your shell does not**. Unwrapped, `-U "$POSTGRES_USER"` sends
-`-U ""` and psql answers `FATAL: role "" does not exist` — at 11pm, with the app crash-looping.
-
-```bash
-docker compose exec -T db sh -c \
-  'psql -U "$POSTGRES_USER" -d "$POSTGRES_DB" -c "SELECT version, description, success FROM _sqlx_migrations ORDER BY version;"'
-```
-
-If the app is already crash-looping on a renumbered migration, and **only** if you have confirmed
-the SQL in the new file is equivalent to what was actually applied. Take the version numbers from
-the crash message and the query above — do **not** copy the ones below, which are an example:
-
-```bash
-docker compose stop app
-# Replace 21,22,23 with the versions the boot error actually named.
-docker compose exec -T db sh -c \
-  'psql -U "$POSTGRES_USER" -d "$POSTGRES_DB" -c "DELETE FROM _sqlx_migrations WHERE version IN (21,22,23);"'
-docker compose start app     # re-applies exactly those, then continues
-```
-
-This re-runs those migrations. They must be idempotent (`IF NOT EXISTS` / `IF EXISTS`) or this
-fails differently. Take a `pg_dump` first — see §10.
-
-### Schema changes are **not** compile-time checked
-
-All ~120 queries use the runtime `sqlx::query()` API. There are no `query!` macros and no `.sqlx`
-cache, and the backend **compiles with no `DATABASE_URL` at all**. Consequences:
-
-- A migration that renames or drops a column **compiles clean** and fails in production as a
-  runtime 500 on whichever request path touches it first.
-- `cargo build` succeeding tells you nothing about schema/query agreement. Only `cargo test`
-  (which runs against a real Postgres) and manual exercise of the affected route do.
-
-So: after any migration that touches an existing column, exercise the routes that read it before
-you consider the deploy done. README and PROJECT previously claimed compile-time checking; they
-have been corrected.
-
----
-
-## 13. Event-day emergency card
-
-Assume you have a phone and two minutes.
-
-```bash
-cd ~/eventsnap
-
-# FIRST LINE, ALWAYS. `.env` is read by docker compose, NOT by your shell — without this,
-# every `$DOMAIN` below expands to nothing and `curl https:///health` reads like an outage
-# when the site is fine. Reads the one variable instead of sourcing the file, because `.env`
-# legitimately contains an apostrophe (EVENT_NAME) and `. ./.env` dies on it — which at 11pm
-# looks exactly like the outage you came here to diagnose.
-DOMAIN=$(sed -n 's/^DOMAIN=//p' .env | tr -d "\"'")
-
-# Is it alive? (200 = app AND database are answering; 503 = the app is up, the DB is not)
-curl -fsS https://$DOMAIN/health
-
-# What is broken?
-docker compose ps
-docker compose logs --tail=100 app
-
-# Nuclear option that is SAFE (keeps all data):
-docker compose restart app
-
-# Roll back to the identically-built sibling image — see §9 for what this can and cannot fix.
-# Do NOT substitute an older release tag here; it will crash-loop on the migration set.
-sed -i 's/^EVENTSNAP_VERSION=.*/EVENTSNAP_VERSION=v0.13.0-a/' .env && docker compose up -d app frontend
-
-# Disk check
-df -h /var/lib/docker
-```
-
-### "Der Speicher des Events ist fast voll" — guests cannot upload
-
-**`df -h` will look fine, and that is not a contradiction.** The upload gate refuses long before the
-disk fills: it reserves room for the keepsake, which is roughly a second copy of every original, plus
-a 10 GB floor. Uploads stop at **~8 GB of media** on a 40 GB box, when `df` still shows ~20 GB free.
-
-Check the number that actually binds, not free space:
-
-```bash
-docker compose exec -T db sh -c \
-  'psql -U "$POSTGRES_USER" -d "$POSTGRES_DB" -tAc "SELECT pg_size_pretty(sum(original_size_bytes)) FROM upload WHERE deleted_at IS NULL;"'
-```
-
-Mid-event, in order of preference: delete the largest videos from the host dashboard (each frees its
-own bytes immediately), or move `exports_data` to a separate volume. Raising `quota_tolerance` will
-**not** help — on this box every guest is already on the 500 MiB floor, so that knob is not what is
-refusing them (see §4 and `.env.example`).
-
-**NEVER** run `docker compose down -v`. It deletes the database, all media, all exports and the TLS
-certificate. There is no undo.
-
-Most limits are changeable from the **admin dashboard without a restart** — reach for that before
-touching the shell.

FOLLOWUPS.md

@@ -46,90 +46,6 @@ is the smallest patch.
 - [frontend/src/lib/components/Toaster.svelte](frontend/src/lib/components/Toaster.svelte) — add passthrough marker (if approach 2) or move to a portal (if approach 1)
 - [frontend/src/app.html](frontend/src/app.html) — add `<div id="modal-root">` (if approach 1)
 
-## Feed — DOM-windowing virtualization (IMPLEMENTED — residual validation owed)
-
-**Status.** Implemented in [frontend/src/lib/components/VirtualFeed.svelte](frontend/src/lib/components/VirtualFeed.svelte)
-using `@tanstack/svelte-virtual`'s `createWindowVirtualizer`. Both the **list**
-view (dynamic `measureElement` heights, keyed by upload id with `anchorTo:'start'`
-so an SSE prepend doesn't yank a scrolled-down reader) and the **grid** view
-(three measured square tiles per row) now keep only the on-screen window (+overscan)
-in the DOM instead of one node per upload. The window virtualizer scrolls the
-document, so the sticky header, pull-to-refresh, the infinite-scroll sentinel and
-the bottom nav are untouched. The earlier `content-visibility` band-aid was removed
-from `FeedListCard` (it interferes with real-height measurement), and the old
-`FeedGrid.svelte` was deleted (its sole consumer migrated to `VirtualFeed`).
-
-**Verified.** `svelte-check` 0 errors, production build clean. The integration
-follows the library's documented window-virtualizer contract (confirmed against
-`virtual-core` source: item `start` includes `scrollMargin`, `getTotalSize()`
-excludes it; the SSR path is guarded by `getScrollElement()` returning null).
-
-**Residual validation owed (needs the running app — could not be done headless).**
-- Manual scroll testing on a ~1000-item event: confirm no jank, correct scrollbar
-  size, and that an SSE `new-upload` / `feed-delta` prepend while scrolled down does
-  not jump the viewport (the `anchorTo:'start'` + id-key path).
-- `scrollMargin` re-measure when grid filter chips change the header height (handled
-  reactively via the `uploads`-length-driven effect, but unverified visually).
-- A new e2e spec that scrolls far down, likes an item via SSE, and asserts scroll
-  position is retained — the existing suite only asserts a single card is visible,
-  so it cannot catch a scroll regression.
-
-**Files.**
-- [frontend/src/lib/components/VirtualFeed.svelte](frontend/src/lib/components/VirtualFeed.svelte) — new windowing component (list + grid)
-- [frontend/src/routes/feed/+page.svelte](frontend/src/routes/feed/+page.svelte) — renders `VirtualFeed` for both views
-- [frontend/src/lib/components/FeedListCard.svelte](frontend/src/lib/components/FeedListCard.svelte) — `content-visibility` removed
-
-**Known limitations (surfaced in the post-commit review, left as-is — low impact).**
-- **Grid prepend reflows tiles.** Grid rows are index-keyed and pack 3 tiles each, so
-  an SSE `new-upload` shifts every tile by one position; `anchorTo:'start'` can only
-  anchor a scrolled grid reader when the prepend crosses a 3-item boundary (it adds a
-  *row*). List view is unaffected (one id-keyed row per upload). A fix would key rows
-  by the first tile's id and accept partial-row churn; not worth it for the rarer
-  "new upload while browsing the grid" case.
-- **Filtered grid can auto-load the whole feed.** When a grid filter matches few items
-  the `VirtualFeed` is short, so the infinite-scroll sentinel sits in-viewport and
-  `loadMore()` fires until `nextCursor` is null — pulling all pages to widen the
-  client-side search. This is pre-existing (the old `FeedGrid` had the same shape, and
-  the empty-filter copy even says "scrolle weiter"), not a virtualization regression.
-  If undesired, gate auto-load to list view or to actual user scroll.
-
-## Feed — comment deletion leaves a stale live count
-
-**Problem.** `add_comment` now broadcasts a fresh `comment_count` so feed clients patch
-the card in place, but `delete_comment` and `host_delete_comment`
-([backend/src/handlers/social.rs](backend/src/handlers/social.rs),
-[host.rs](backend/src/handlers/host.rs)) soft-delete without broadcasting any
-count/event. So a deletion leaves the count too high on every client until a full
-refetch (pull-to-refresh or an unrelated `upload-processed` merge). `toggle_like`
-already broadcasts on both add and remove, so likes are fine — the gap is
-comments-on-delete. Pre-existing, but the in-place-patch scheme makes it observable.
-
-**Fix.** Emit a `new-comment` (or a `comment-deleted`) event carrying the refreshed
-`comment_count` from both delete paths, the same best-effort way `add_comment` does;
-the frontend `patchCount(..., 'comment_count')` handler already consumes it.
-
-**Note — count ordering.** The broadcast count is read just after the (auto-committed)
-mutation, not inside it, so under concurrent likes/comments on one upload the SSE
-messages are last-write-wins. The frontend *replaces* (not increments) the count, so
-steady state is correct and self-healing; only document this if strict per-event
-ordering is ever required (then compute the count in-tx with a monotonic sequence).
-
-## Feed — per-image exact CLS reservation
-
-**Problem.** `FeedListCard` now reserves a default `aspect-[4/5]` box for photos so
-the card doesn't collapse to height 0 and reflow as images stream in (matching
-`Skeleton`). But no image dimensions are stored anywhere (not on `FeedUpload`, the
-`upload` table, or any migration), so the box is a uniform guess that crops to fit —
-the original is one tap away in the lightbox.
-
-**Acceptance criterion.** Extract image width/height during the compression worker,
-store them on `upload`, expose them on `FeedUpload`, and have the card reserve the
-*true* aspect ratio (no crop, zero shift).
-
-**Files to touch.**
-- backend: `services/compression.rs`, `models/upload.rs`, `handlers/feed.rs`, a migration
-- [frontend/src/lib/types.ts](frontend/src/lib/types.ts), [FeedListCard.svelte](frontend/src/lib/components/FeedListCard.svelte)
-
 ## Smaller nits, optional
 
 - **Auto-submit on retried 4th digit.** [recover/+page.svelte](frontend/src/routes/recover/+page.svelte), [join/+page.svelte](frontend/src/routes/join/+page.svelte) — after a wrong PIN, deleting one digit and retyping triggers an immediate submit. Backend's 3-attempts/15-min lockout makes this safe; could feel hair-trigger after a typo. Consider gating the second auto-submit per input session behind an explicit button press.

PROJECT.md

@@ -344,7 +344,7 @@ COMPRESSION_WORKER_CONCURRENCY=2
 | Styling | Tailwind CSS | Utility-first, mobile-first; zero runtime CSS overhead |
 | Backend | Rust + Axum | Developer preference; memory safety, single-binary deploy |
 | Async Runtime | Tokio | De-facto Rust async runtime; Axum is built on it |
-| Database Driver | SQLx | Async PostgreSQL; automatic prepared statements. **Queries use the runtime `sqlx::query()` API, not the checked macros** — see the note under "Schema changes" |
+| Database Driver | SQLx | Async PostgreSQL with compile-time query checking; automatic prepared statements |
 | Database | PostgreSQL 16 | Robust, relational; straightforward to back up |
 | Auth | Custom JWT (`jsonwebtoken` crate) | No external service needed; name + PIN is the full auth model |
 | Image Compression | `image` crate + `oxipng` | Lossless PNG compression; JPEG preview generation |
@@ -709,7 +709,7 @@ CREATE TABLE config (
 INSERT INTO config (key, value) VALUES
     ('max_image_size_mb',       '20'),
     ('max_video_size_mb',       '500'),
-    ('upload_rate_per_hour',    '100'),  -- raised from 10 in migration 015 (guests upload bursts of 10-20)
+    ('upload_rate_per_hour',    '10'),
     ('feed_rate_per_min',       '60'),
     ('export_rate_per_day',     '3'),
     ('quota_tolerance',         '0.75'),
@@ -1133,19 +1133,16 @@ eventsnap/
 
 ### Backup Strategy
 
-Three artefacts in three places: the database, the `media_data` volume
-(originals + derivatives), and the **separate** `exports_data` volume. See
-[README.md](README.md#backup) for the exact commands.
+```bash
+# Daily (e.g. as a separate Compose service or cron on the VPS)
+pg_dump $DATABASE_URL | gzip > /media/backups/db_$(date +%Y-%m-%d).sql.gz
 
-Everything runs through `docker compose` / `docker run`, because `DATABASE_URL`
-and the `/media` and `/exports` paths only exist inside the compose network —
-they are not host paths, and `DATABASE_URL` is never exported into an operator's
-shell.
+# Weekly: rsync /media volume to Hetzner Storage Box
+rsync -az /opt/eventsnap/media/ \
+  user@u123456.your-storagebox.de:backup/eventsnap/
+```
 
-Export archives are deliberately outside `MEDIA_PATH` (`EXPORT_PATH=/exports`): a
-keepsake contains every photo in the event, and keeping it off the media tree is
-what stops it being reachable except through the ticket-gated handler. A backup
-of the media volume alone silently loses every generated keepsake.
+The `/media` volume contains originals, previews, thumbnails, generated exports, and DB backups — a single volume to back up.
 
 ---
 
@@ -1206,7 +1203,7 @@ of the media volume alone silently loses every generated keepsake.
 |-------|---------|
 | `axum` | Web framework |
 | `tokio` | Async runtime |
-| `sqlx` | Async PostgreSQL driver; prepared statements; migrations embedded at compile time. Queries are runtime-checked (`sqlx::query()`), **not** macro-checked |
+| `sqlx` | Async PostgreSQL driver; compile-time query checking; prepared statements; migrations |
 | `jsonwebtoken` | JWT sign / verify |
 | `bcrypt` | PIN + admin password hashing |
 | `uuid` | UUID v7 (time-sortable) |

README.md

@@ -34,6 +34,7 @@ A guest scans the QR code on their way in, types their name, and is immediately
 ### Planned (v1.x)
 
 - Individual file download button
+- Low-disk alert (< 10 GB free)
 - Event banner / cover image
 - Chunked resumable upload for large videos
 - Host-curated story highlights
@@ -49,7 +50,7 @@ A guest scans the QR code on their way in, types their name, and is immediately
 | Styling | Tailwind CSS v4 |
 | Backend | Rust + Axum |
 | Async | Tokio |
-| Database | PostgreSQL 16 via SQLx (runtime query API; migrations embedded at compile time) |
+| Database | PostgreSQL 16 via SQLx (compile-time query checking) |
 | Auth | Custom JWT (`jsonwebtoken`) + bcrypt PINs |
 | Image processing | `image` crate + `oxipng` (lossless compression) |
 | Video processing | ffmpeg via `tokio::process::Command` |
@@ -76,7 +77,6 @@ eventsnap/
 │   ├── svelte.config.js
 │   └── Dockerfile
 ├── docker-compose.yml
-├── docker-compose.dev.yml   # opt-in dev overlay (publishes Postgres on the host)
 ├── Caddyfile
 └── .env.example
 ```
@@ -93,157 +93,30 @@ eventsnap/
 ### Deploy on a fresh VPS
 
 ```bash
-# 1. Clone the repository (into a lowercase dir, matching the paths used below)
-git clone https://git.mc02.dev/fabi/EventSnap.git eventsnap
-cd eventsnap
+# 1. Clone the repository
+git clone https://git.mc02.dev/fabi/EventSnap.git
+cd EventSnap
 
-# 2. Configure environment — set EVERY secret NOW, before step 3.
+# 2. Configure environment
 cp .env.example .env
-nano .env   # DOMAIN, EVENT_NAME, EVENT_SLUG,
-            # JWT_SECRET, ADMIN_PASSWORD_HASH,
-            # POSTGRES_PASSWORD *and* the same password inside DATABASE_URL
-            # (see "Generate required secrets" below)
+nano .env   # set DOMAIN, JWT_SECRET, ADMIN_PASSWORD_HASH, EVENT_NAME, etc.
 
 # 3. Start the stack
 docker compose up -d
 ```
 
-> **Set every secret before step 3 — `POSTGRES_PASSWORD` especially.** Postgres reads it **only
-> when it initialises its data directory**, which happens on the very first `docker compose up -d`.
-> Changing it in `.env` afterwards does not change the stored password: the app then authenticates
-> with the new one against a volume holding the old one, and you get a permanent restart loop with
-> `password authentication failed for user "eventsnap"`. The only fixes are restoring the old
-> password or `docker compose down -v`, which **deletes the database, the media and the exports**.
-> Getting it right once, up front, costs nothing; getting it wrong costs the volume.
-
 Caddy automatically obtains a Let's Encrypt certificate on first start. The app is live at `https://DOMAIN` within ~30 seconds.
 
-> **If the site never comes up:** with `APP_ENV=production` the backend **refuses to boot** while
-> `JWT_SECRET`, `ADMIN_PASSWORD_HASH` or the password inside `DATABASE_URL` still hold the
-> `.env.example` placeholders (this is deliberate — a publicly-known signing key or database
-> password is worse than downtime). Caddy then waits on the unhealthy `app` container and never
-> serves. Check `docker compose logs app` — a "Refusing to start … placeholder …" line lists
-> **every** unset secret at once, so one edit fixes them all.
->
-> **If it comes up but keeps restarting with `password authentication failed for user
-> "eventsnap"`:** `POSTGRES_PASSWORD` was changed after the database volume was created. Postgres
-> applies that variable only at initialisation, so `.env` and the stored password have drifted
-> apart permanently. `docker compose logs app` spells this out. Before the event, with nothing
-> worth keeping:
->
-> ```bash
-> docker compose down -v && docker compose up -d   # -v DELETES db + media + exports. No undo.
-> ```
->
-> **Once the event has real data, never do that.** Put the original password back into
-> `DATABASE_URL`, or change the stored one instead:
->
-> ```bash
-> docker compose exec db psql -U "$POSTGRES_USER" -c \
->   "ALTER ROLE eventsnap WITH PASSWORD 'the-password-now-in-your-.env';"
-> ```
-
-> **Production note:** `docker compose up -d` does **not** expose the database — Postgres is reachable only on the internal Docker network. For local development where you need host access to Postgres, opt into the dev overlay explicitly:
-> ```bash
-> docker compose -f docker-compose.yml -f docker-compose.dev.yml up
-> ```
-
-### Updating an existing deployment
-
-> **The event server never compiles.** `app` and `frontend` have **no `build:` key** — they
-> pull an immutable tag from the registry (the `app` service in `docker-compose.yml` says so explicitly, so that
-> a wrong tag fails instantly with `manifest unknown` instead of silently starting a 45-minute
-> compile on the box guests are using). A `git pull` therefore deploys **nothing** on its own,
-> and `docker compose up -d --build` **errors** — there is nothing to build. Deploying means
-> pushing a new tag from a workstation and pointing `EVENTSNAP_VERSION` at it.
-
-```bash
-# ── On your workstation: build and push the new tag ───────────────────────────
-# Push the rollback twin at the same time, from the same source — see
-# DEPLOYMENT_RUNBOOK.md §9 for why an identical second tag is the rollback target.
-VERSION=v0.13.1
-docker buildx build --platform linux/amd64 \
-  -t registry.mc02.dev/eventsnap/app:$VERSION \
-  -t registry.mc02.dev/eventsnap/app:$VERSION-a --push ./backend
-docker buildx build --platform linux/amd64 \
-  -t registry.mc02.dev/eventsnap/frontend:$VERSION \
-  -t registry.mc02.dev/eventsnap/frontend:$VERSION-a --push ./frontend
-
-# ── On the server ─────────────────────────────────────────────────────────────
-cd /path/to/eventsnap
-
-# 1. Back up first — migrations run automatically on boot and are not reversible in place.
-#    (See "Backup" below; the database dump is the one that matters here.)
-
-# 2. Fetch the new compose/Caddyfile. This does NOT change which image runs.
-git pull
-
-# 3. Point the stack at the new tag.
-sed -i 's/^EVENTSNAP_VERSION=.*/EVENTSNAP_VERSION=v0.13.1/' .env
-
-# 4. Pull explicitly, BEFORE restarting. A failure here (bad tag, registry down) leaves the
-#    running stack untouched; letting `up -d` discover it takes the app down first.
-docker compose pull app frontend
-
-# 5. Restart onto the new images.
-docker compose up -d app frontend
-
-# 6. Apply any Caddyfile change. Step 5 does NOT do this — see the warning below.
-docker compose up -d --force-recreate caddy
-
-# 7. Confirm the app came back up. Anything other than "ok" means check the logs.
-curl -fsS https://DOMAIN/health && echo
-
-# 8. Confirm the running containers are actually on the new tag.
-docker compose images app frontend
-```
-
-Migrations are applied by the backend on startup, so step 5 covers them. If `app` stays
-unhealthy afterwards, `docker compose logs app` will name the failing migration — and note
-that a migration applied by a *newer* build is not removed by rolling the tag back, so
-reverting `EVENTSNAP_VERSION` without restoring the database snapshot from step 1 leaves the
-schema ahead of the binary and the app refusing to boot. **This is why the rollback target is
-an identical twin tag rather than an older release** — see `DEPLOYMENT_RUNBOOK.md` §9.
-
-> **Why step 6 exists.** Steps 4–5 only touch `app` and `frontend`; `caddy` is a separate
-> pinned upstream image. Compose decides whether to recreate a container from its
-> *config hash*, which covers the mount **specification** (`./Caddyfile:/etc/caddy/Caddyfile:ro`)
-> but **not the file's contents** — so a `git pull` that changes `./Caddyfile` produces no
-> delta, Compose reports `Running`, and Caddy keeps serving its old config indefinitely. Exit
-> code 0 throughout.
->
-> That is not hypothetical: the fix that made the keepsake download work on iOS
-> (`137c4ee`) touched the Caddyfile and four e2e files and nothing else, so **all** of its
-> production effect lives in that one file. Without step 6 you deploy it, watch both image IDs
-> change, and iOS downloads stay broken.
->
-> `--force-recreate` rather than `restart` or `caddy reload`: the bind mount is resolved to an
-> **inode** when the container is created, and `git pull` replaces the file instead of editing
-> it in place, so the container can still be bound to the old, now-unlinked inode. A restart
-> then re-reads the stale content. Recreating the container re-resolves the path.
-
-`db` is never touched, and recreating `caddy` does not disturb the `caddy_data` volume, so the
-TLS certificate and all data volumes survive.
-
 ### Generate required secrets
 
 ```bash
 # JWT secret (64 random bytes)
 openssl rand -hex 64
 
-# Database password (goes in BOTH DATABASE_URL and POSTGRES_PASSWORD)
-openssl rand -hex 24
-
-# Admin password hash (bcrypt). Uses an image the stack already pulls, so it needs
-# nothing installed on the host — `htpasswd` lives in apache2-utils, which a stock
-# VPS does not have. Emits cost 14 rather than 12; that is fine (admin login is
-# rate-limited and hashed off the async runtime), and any $2a/$2b/$2y hash verifies.
-docker run --rm caddy:2-alpine caddy hash-password --plaintext 'yourpassword'
+# Admin password hash (bcrypt, cost 12)
+htpasswd -bnBC 12 "" yourpassword | tr -d ':\n'
 ```
 
-Wrap the resulting hash in **single quotes** in `.env` — see the note there; a bcrypt
-hash is full of `$`, and both Compose and dotenvy would otherwise eat those segments.
-
 ### Environment Variables
 
 See [.env.example](.env.example) for the full list with descriptions and defaults. Key variables:
@@ -281,225 +154,26 @@ See [.env.example](.env.example) for the full list with descriptions and default
 └────────┘
 ```
 
-- `/api/*` → Rust backend
+- `/api/*` and `/media/*` → Rust backend
 - Everything else → SvelteKit frontend (`adapter-node`)
-- Named volumes: `postgres_data`, `media_data`, `exports_data`, `caddy_data`
-
-Media is **not** served as static files. Every image goes through a
-visibility-checked alias (`/api/v1/upload/{id}/{preview,display,thumbnail,original}`)
-so a host takedown or a ban actually revokes access to the bytes.
-
----
-
-## Sizing the disk
-
-`postgres_data`, `media_data` and `exports_data` are all Docker named volumes under
-`/var/lib/docker/volumes`, so **they share one filesystem**. Filling it does not
-degrade one subsystem — Postgres stops being able to write and the whole event goes
-down.
-
-**`Gallery.zip` and `Memories.zip` are each roughly a second copy of every original.**
-Both write their media `Compression::Stored`, and `Memories.zip` streams the untouched
-original for every video and for every image at or under 5 MB. So a release wants room
-for **two more copies of the gallery** on top of the gallery itself — which is what
-`required_free_bytes` encodes as `media × 1.1 × 2`.
-
-The per-user quota does **not** bound this. It is a fairness mechanism that divides
-free space between guests, and since it carries a floor (`MIN_QUOTA_LIMIT_BYTES`, so a
-guest's allowance stops shrinking as the party fills up) the aggregate ceiling it used
-to imply is gone. What bounds the disk is the **global gate in the upload handler**,
-which refuses any upload that would leave too little room to build the keepsake:
-
-```
-free_after_upload  <  media_after × 1.1 × 2  +  DISK_RESERVE_BYTES
-                                             +  UPLOAD_GATE_HEADROOM_BYTES   →   refused
-```
-
-That last term is what separates this gate from the export preflight, which bails at
-`media × 1.1 × 2 + DISK_RESERVE_BYTES` — the same expression **minus** the headroom. The
-two used to be identical, which meant the preflight was already sitting on its limit at
-the exact moment uploads stopped: every byte written between the last refused upload and
-the host tapping *Galerie freigeben* (Postgres WAL, container logs, the compression
-backlog draining at precisely that hour) pushed it under, and the release commits before
-the workers fail. The headroom buys 1.5 GB of slack so that cannot happen.
-
-Solving the gate for the gallery size gives the real ceiling — the gate's equilibrium is
-`3.2 × media`, so each GB of reserve or headroom costs ~0.31 GB of gallery. On the
-**40 GB box this runs on**, with ~5 GB for the OS, Docker images (the runbook pre-pulls
-the rollback tag too) and Postgres:
-
-| Volume | Usable after baseline | Media ceiling | Free at release | Preflight needs |
-|---|---|---|---|---|
-| 40 GB | ~35 GB | **~7.3 GB** | ~27.7 GB | ~26.2 GB → fits, 1.5 GB spare |
-| 80 GB | ~70 GB | ~18.3 GB | ~51.7 GB | ~50.2 GB → fits, 1.5 GB spare |
-
-**Uploads therefore stop at roughly 7 GB of media on a 40 GB box, not when the disk is
-full.** That is deliberate. 1000 photos at ~3.5 MB is ~3.5 GB and fits comfortably;
-video is what consumes the budget, so lower `max_video_size_mb` (seeded at 500) if you
-expect a lot of it. Refusing the 1001st upload is a far better outcome than accepting it
-and discovering at 01:00 that the archive can never be built.
-
-Two ways to buy headroom:
-
-- **Provision ~3× your expected media** on one volume (media + two archives), or
-- **give `exports_data` its own volume** so a full export cannot reach Postgres, and
-  size that one at ~2× expected media.
-
-None of this is silent. The upload gate refuses with a German message naming the cause,
-the export preflight refuses up front with both numbers rather than hitting ENOSPC
-halfway through a multi-GB write, a rebuild only reclaims the superseded generation
-**after** the new one lands (so a failed rebuild can never leave you with no archive at
-all), and the host dashboard warns as soon as the keepsake would not fit — which is the
-only point at which anyone can still do something about it.
+- Named volumes: `postgres_data`, `media_data`, `caddy_data`
 
 ---
 
 ## Backup
 
-There are **three** things to back up, and they live in three different places.
-`DATABASE_URL` and the container paths (`/media`, `/exports`) are meaningful only
-*inside* the compose network — they are not host paths, and `DATABASE_URL` is
-never exported into an operator's shell — so every command below runs through
-`docker compose` from the repo directory.
-
 ```bash
-# 1. Database snapshot. Runs pg_dump inside the db container (the app image has no
-#    postgres client), reading credentials from the compose environment.
-#    --clean --if-exists makes the dump SELF-CLEANING: without it the restore below
-#    aborts on the first "already exists" against a database that has ever booted,
-#    which is every database you would actually want to restore over.
-mkdir -p ./backups
-docker compose exec -T db \
-  sh -c 'pg_dump --clean --if-exists -U "$POSTGRES_USER" "$POSTGRES_DB"' \
-  | gzip > ./backups/db_$(date +%Y-%m-%d).sql.gz
+# Database snapshot
+pg_dump $DATABASE_URL | gzip > /media/backups/db_$(date +%Y-%m-%d).sql.gz
 
-# 2. Uploaded media (originals + derivatives) out of the named volume.
-#    NOTE the mountpoint is /src, not /media: if the volume is ever empty, Docker
-#    pre-populates a fresh mount from the image's own directory, and alpine ships a
-#    /media containing cdrom/floppy/usb. Mounting somewhere the image has nothing
-#    avoids silently tarring (and polluting the volume with) those.
-docker run --rm \
-  -v eventsnap_media_data:/src:ro -v "$PWD/backups":/backup \
-  alpine tar czf /backup/media_$(date +%Y-%m-%d).tar.gz -C /src .
-
-# 3. Export archives — a SEPARATE volume (see the security note below).
-docker run --rm \
-  -v eventsnap_exports_data:/src:ro -v "$PWD/backups":/backup \
-  alpine tar czf /backup/exports_$(date +%Y-%m-%d).tar.gz -C /src .
-
-# Offsite sync of the three artefacts above.
-rsync -az ./backups/ user@storagebox.example.com:backup/eventsnap/
+# Weekly offsite sync (Hetzner Storage Box or similar)
+rsync -az /opt/eventsnap/media/ user@storagebox.example.com:backup/eventsnap/
 ```
 
-Volume names are prefixed with the compose project name — `eventsnap_` if you run
-from a directory called `eventsnap`. Confirm yours with `docker volume ls`.
-
-> **Exports are deliberately NOT under `/media`.** They live on their own
-> `exports_data` volume (`EXPORT_PATH=/exports`) because a keepsake archive
-> contains every photo in the event; keeping it outside the media tree is what
-> stops it being reachable except through the ticket-gated download handler.
-> Backing up only the media volume therefore loses every generated keepsake.
-
-### When to run it
-
-**A nightly cron is the wrong shape for this app.** Every irreplaceable byte is
-created inside one eight-hour window, and nobody can retake a wedding. Run the three
-commands above:
-
-1. **The night of the event**, once uploads have stopped. This is the backup that
-   matters; everything else is a formality.
-2. **After the host releases the gallery**, so the generated keepsake is captured too.
-3. Weekly thereafter, until the event is archived and torn down.
-
-Take the DB dump and the media tarball **back to back**, without uploads in flight
-between them. Upload rows reference files by path — a database from 22:00 and a media
-volume from 23:00 gives you rows pointing at files the dump doesn't know about, and
-rows whose files aren't in the tarball. Locking uploads from the host dashboard first
-(**Uploads sperren**) makes the pair genuinely consistent.
+The `/media` volume holds originals, previews, thumbnails, exports, and DB backups — a single path to back up.
 
 ---
 
-## Restore
-
-An untested backup is not a backup. Run this once against a scratch host **before**
-the event — it is roughly ten minutes, and it is the only way to find out that your
-tarball is empty or your dump is truncated while that is still a small problem.
-
-```bash
-# 0. Stop the app FIRST. Migrations run on boot and a live pool will fight the
-#    restore — a booting app against a half-restored schema can leave the migration
-#    table and the schema disagreeing, which is its own recovery problem.
-#    Leave `db` running: the dump is restored through it.
-docker compose stop app caddy
-
-# 1. Database. The dump carries its own DROPs (step 1 of Backup), so this replaces
-#    rather than collides. A dump taken WITHOUT --clean --if-exists will abort here
-#    on the first "already exists" — restore that one into a fresh empty database
-#    instead.
-gunzip -c ./backups/db_2026-07-29.sql.gz \
-  | docker compose exec -T db \
-      sh -c 'psql -U "$POSTGRES_USER" -d "$POSTGRES_DB" --set ON_ERROR_STOP=1'
-
-# 2. Media. NOTE the `--numeric-owner` and the chown: the app runs as a
-#    NON-ROOT user (uid 100, gid 101 — `addgroup -S app && adduser -S app`), and a
-#    restore that lands root-owned files makes every upload fail with EACCES deep in
-#    the write path, surfacing to the guest as a generic 500 with nothing in the UI
-#    to suggest permissions. The explicit chown is what guarantees it — BusyBox tar
-#    (which is what `alpine` ships) has no --same-owner, and restores ownership only
-#    because it runs as root here.
-docker run --rm \
-  -v eventsnap_media_data:/dst -v "$PWD/backups":/backup:ro \
-  alpine sh -c 'tar xzf /backup/media_2026-07-29.tar.gz -C /dst \
-                    --numeric-owner && chown -R 100:101 /dst'
-
-# 3. Exports. Same volume-name caveat, same ownership rules.
-docker run --rm \
-  -v eventsnap_exports_data:/dst -v "$PWD/backups":/backup:ro \
-  alpine sh -c 'tar xzf /backup/exports_2026-07-29.tar.gz -C /dst \
-                    --numeric-owner && chown -R 100:101 /dst'
-
-# 4. Back up. Migrations run, then export recovery re-arms any keepsake whose file
-#    didn't come back with the volume.
-docker compose up -d app caddy
-docker compose logs -f app        # watch for "migrations applied"
-
-# 5. Verify — all three, not just the first.
-curl -fsS https://DOMAIN/health && echo            # → ok
-#   … then sign in as host and confirm the feed renders images (proves the media
-#   volume restored AND is readable by uid 100), and that the keepsake downloads.
-```
-
-If the media volume restored but images 404 while the feed lists them, the paths are
-there and the bytes aren't — check `docker compose exec app ls -ln /media/originals`
-and confirm both the files and the `100:101` ownership.
-
-The restore is deliberately **not** automated. It is rare, destructive, and the one
-operation where a script that half-works is worse than a checklist someone reads.
-
----
-
-## Running the backend test suite
-
-```bash
-cd backend
-
-# The DB-backed integration tests (backend/tests/) need a live Postgres. `#[sqlx::test]` creates a
-# throwaway database per test and runs backend/migrations/ into it — it does NOT touch this one's data.
-docker run -d --name eventsnap-test-pg -p 55433:5432 \
-  -e POSTGRES_PASSWORD=postgres -e POSTGRES_DB=eventsnap postgres:16-alpine
-
-export DATABASE_URL=postgres://postgres:postgres@localhost:55433/eventsnap
-cargo test        # 44 unit + 12 DB-backed
-cargo clippy --all-targets -- -D warnings
-```
-
-**`cargo test` requires `DATABASE_URL`** — without it the integration tests panic rather than skip.
-That is deliberate. The riskiest code in this repo is SQL (the export epoch state machine, the
-atomic quota increment, the `FOR SHARE` upload lock), and for a long time *not one line of it* was
-executed by `cargo test` — every backend test was a pure-function test, so the tests clustered
-tightly around the code that could not break and stopped exactly where it started to. Tests that
-silently skip when the database is absent recreate that hole; they were meant to be a gate.
-
 ## Running the E2E test suite
 
 Playwright-based end-to-end tests live in [`e2e/`](e2e/). They spin up an isolated docker-compose stack (Postgres on `:55432`, Caddy on `:3101`) and exercise the SvelteKit frontend against the real Rust backend with rate limits disabled.
@@ -516,14 +190,7 @@ npm run stack:down            # tear it down
 
 See [`e2e/README.md`](e2e/README.md) for the full UA matrix, Samsung Internet escalation tiers, and the Phase 2/3 roadmap.
 
-CI runs this on every PR — see [`.github/workflows/e2e.yml`](.github/workflows/e2e.yml) (desktop **and**
-mobile projects), plus [`checks.yml`](.github/workflows/checks.yml) for `cargo test`/clippy, the frontend
-unit tests, svelte-check and the e2e typecheck, and [`audit.yml`](.github/workflows/audit.yml) for
-dependency advisories.
-
-**Playwright runs with `retries: 0`, including in CI.** This repo's real bugs are races, and from the
-outside a race is indistinguishable from a flake — so a retry silently resolves that ambiguity in
-favour of "flake" every time. A flake here is a bug report; treat it as one.
+CI runs this on every PR — see [`.github/workflows/e2e.yml`](.github/workflows/e2e.yml).
 
 ---
 
@@ -550,7 +217,7 @@ Open:
 - [ ] SSE delta-fetch on foreground reconnect (scaffolded in [sse.ts](frontend/src/lib/sse.ts), not wired)
 - [ ] Live diashow / slideshow mode — see [docs/CONCEPT_DIASHOW.md](docs/CONCEPT_DIASHOW.md)
 - [ ] Individual file download button per post
-- [x] Low-disk alert — host dashboard warns below 10 GB free, or whenever the keepsake would not fit
+- [ ] Low-disk alert (< 10 GB free)
 - [ ] Event banner / cover image
 - [ ] Chunked resumable upload for files > 100 MB
 - [ ] Shared Tailwind config between main app and export-viewer

backend/.dockerignore

@@ -1,12 +0,0 @@
-# Build context exclusions.
-#
-# `target/` does not exist on a clean checkout, which is why builds have worked without this
-# file — but the moment anyone runs `cargo build` locally it becomes multi-GB, and every
-# `docker build` would ship all of it to the daemon for nothing (the Dockerfile only COPYs
-# Cargo.toml, Cargo.lock, src, static and migrations). On an EMULATED amd64 builder that
-# transfer is the slowest part of the build.
-target/
-
-# Never let a real .env reach an image layer.
-.env
-.env.*

backend/Cargo.lock

@@ -65,6 +65,56 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.102"
@@ -504,12 +554,46 @@ dependencies = [
  "inout",
 ]
 
+[[package]]
+name = "clap"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b193af5b67834b676abd72466a96c1024e6a6ad978a1f484bd90b85c94041351"
+dependencies = [
+ "clap_builder",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+ "terminal_size",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
 [[package]]
 name = "color_quant"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
 [[package]]
 name = "compression-codecs"
 version = "0.4.37"
@@ -593,6 +677,15 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-deque"
 version = "0.8.6"
@@ -605,9 +698,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.20"
+version = "0.9.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -723,6 +816,27 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "env_filter"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e90c2accc4b07a8456ea0debdc2e7587bdd890680d71173a15d4ae604f6eef"
+dependencies = [
+ "log",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0621c04f2196ac3f488dd583365b9c09be011a4ab8b9f37248ffcc8f6198b56a"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "log",
+]
+
 [[package]]
 name = "equator"
 version = "0.4.2"
@@ -1115,6 +1229,12 @@ dependencies = [
  "weezl",
 ]
 
+[[package]]
+name = "glob"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
+
 [[package]]
 name = "governor"
 version = "0.6.3"
@@ -1502,6 +1622,7 @@ checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
 dependencies = [
  "equivalent",
  "hashbrown 0.16.1",
+ "rayon",
  "serde",
  "serde_core",
 ]
@@ -1535,6 +1656,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
 [[package]]
 name = "itertools"
 version = "0.14.0"
@@ -1668,6 +1795,12 @@ dependencies = [
  "vcpkg",
 ]
 
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
 [[package]]
 name = "litemap"
 version = "0.8.1"
@@ -1956,6 +2089,12 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
 [[package]]
 name = "oxipng"
 version = "9.1.5"
@@ -1963,12 +2102,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26c613f0f566526a647c7473f6a8556dbce22c91b13485ee4b4ec7ab648e4973"
 dependencies = [
  "bitvec",
+ "clap",
+ "crossbeam-channel",
+ "env_logger",
  "filetime",
+ "glob",
  "indexmap",
  "libdeflater",
  "log",
+ "rayon",
  "rgb",
  "rustc-hash",
+ "zopfli",
 ]
 
 [[package]]
@@ -2462,6 +2607,19 @@ version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
 
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.22"
@@ -2902,6 +3060,12 @@ dependencies = [
  "unicode-properties",
 ]
 
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -2956,6 +3120,16 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
+[[package]]
+name = "terminal_size"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
+dependencies = [
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -3331,6 +3505,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "uuid"
 version = "1.23.0"
@@ -4007,6 +4187,18 @@ version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
 
+[[package]]
+name = "zopfli"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
+
 [[package]]
 name = "zstd"
 version = "0.13.3"

backend/Cargo.toml

@@ -27,17 +27,7 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 dotenvy = "0.15"
 sysinfo = "0.32"
 image = "0.25"
-# default-features = false drops "parallel", which is what actually bounds oxipng's memory:
-# with rayon it evaluates row filters concurrently, each trial holding its own full-size
-# buffer, and there is no Options knob to cap that. Without the feature, lib.rs swaps in a
-# sequential shim (oxipng's own supported path) so peak scales with ONE trial, not N.
-# PNG optimisation gets slower; it is a background, best-effort, lossless size saving.
-#
-# "filetime" must be KEPT: without it OutFile::Path { preserve_attrs: true } silently no-ops.
-# Dropping "binary" also removes clap/glob/env_logger — a CLI's dependencies that were being
-# compiled into a server image — and "zopfli", which preset 2 does not use (it selects
-# Deflaters::Libdeflater, which is not feature-gated).
-oxipng = { version = "9", default-features = false, features = ["filetime"] }
+oxipng = "9"
 async_zip = { version = "0.0.17", features = ["tokio", "deflate"] }
 include_dir = "0.7"
 infer = "0.15"

backend/Dockerfile

@@ -13,32 +13,23 @@ RUN mkdir src && echo "fn main(){}" > src/main.rs && \
 COPY src ./src
 COPY static ./static
 COPY migrations ./migrations
-# Copied WITH the sources, not with Cargo.toml above: cargo auto-detects `build.rs` by presence, so
-# putting it in the dependency-cache layer would make the dummy build run it too and invalidate a
-# layer that is otherwise stable. Copied at all because without it the image builds a subtly
-# DIFFERENT package from the one developers build — no build script, hence none of the
-# rerun-if-changed tracking for `static/export-viewer` and `migrations`. Harmless here (every image
-# build is clean, so there is no stale cache to reuse) and confusing everywhere else.
-COPY build.rs ./
 RUN touch src/main.rs && cargo build --release
 
 # --- Runtime stage ---
 FROM alpine:3.21
 
-RUN apk add --no-cache ca-certificates ffmpeg
-
-# Run as a non-root user. Pre-create and chown the media + export mount paths so
-# the fresh named volumes inherit the non-root ownership (Docker seeds an empty
-# named volume from the image directory, preserving its uid/gid) and uploads +
-# export archives can be written. Exports live OUTSIDE /media on purpose so the
-# public media ServeDir can't reach them.
-RUN addgroup -S app && adduser -S app -G app
+# Run as an unprivileged user (defense-in-depth). The media volume mounts at
+# /media; creating it here as `app` means a fresh named volume inherits app
+# ownership and is writable without running as root. (An existing root-owned
+# volume from a prior deploy needs a one-time `chown -R app:app` — see deploy notes.)
+RUN apk add --no-cache ca-certificates ffmpeg \
+    && addgroup -S app && adduser -S -G app app \
+    && mkdir -p /media && chown app:app /media
 
 WORKDIR /app
 COPY --from=builder /app/target/release/eventsnap-backend ./
+RUN chown -R app:app /app
 
-RUN mkdir -p /media /exports && chown -R app:app /app /media /exports
 USER app
-
 EXPOSE 3000
 CMD ["./eventsnap-backend"]

backend/build.rs

@@ -1,25 +0,0 @@
-//! Tell cargo which non-Rust inputs are baked into the binary.
-//!
-//! `include_dir!` and `sqlx::migrate!()` both embed directory contents at COMPILE time, and neither
-//! registers a rebuild dependency on its own. Cargo therefore reuses a cached binary when only
-//! those directories changed — the source files are untouched, so as far as cargo is concerned
-//! nothing happened.
-//!
-//! For the keepsake viewer that is a silent, shippable defect: run `npm run build` in
-//! `frontend/export-viewer`, then `cargo build`, and the resulting binary still carries the
-//! PREVIOUS `static/export-viewer/index.html`. The artifact on disk and the artifact in the binary
-//! disagree, `git status` is clean, and every check passes — while `Memories.zip` ships a stale
-//! viewer. Confirmed empirically: after replacing the file, the compiled-in copy did not change
-//! until a source file was touched.
-//!
-//! Production is mostly insulated because images are built from a clean context (no cache to
-//! reuse), but every incremental build — i.e. all local development and any test run that follows
-//! a viewer rebuild — hits it, and that includes the test that asserts the viewer is present.
-fn main() {
-    // The compiled-in keepsake viewer (services/export.rs: `include_dir!`).
-    println!("cargo:rerun-if-changed=static/export-viewer");
-    // The embedded migration set (db.rs: `sqlx::migrate!()`). Same mechanism, and the failure is
-    // worse: a binary built from a stale snapshot boots against a database that has already run a
-    // newer migration and crash-loops with VersionMissing.
-    println!("cargo:rerun-if-changed=migrations");
-}

backend/migrations/010_feed_view_perf.down.sql

@@ -1,6 +1,4 @@
-DROP TABLE IF EXISTS pin_reset_request;
-
--- Restore v_feed without the is_banned filter.
+-- Restore the original join-based v_feed definition.
 CREATE OR REPLACE VIEW v_feed AS
 SELECT
     u.id,

backend/migrations/010_feed_view_perf.up.sql

@@ -0,0 +1,26 @@
+-- H6: replace v_feed's double LEFT JOIN + COUNT(DISTINCT) (which materializes a
+-- likes×comments Cartesian per upload before de-duping) with correlated scalar
+-- subqueries. Each count now uses its own index (idx_like_upload /
+-- idx_comment_upload) and there is no GROUP BY. The output columns are
+-- unchanged, so every consumer keeps working.
+CREATE OR REPLACE VIEW v_feed AS
+SELECT
+    u.id,
+    u.event_id,
+    u.user_id,
+    usr.display_name             AS uploader_name,
+    usr.is_banned,
+    usr.uploads_hidden,
+    u.preview_path,
+    u.thumbnail_path,
+    u.mime_type,
+    u.caption,
+    u.created_at,
+    (SELECT COUNT(*) FROM "like" l
+       WHERE l.upload_id = u.id)                              AS like_count,
+    (SELECT COUNT(*) FROM comment c
+       WHERE c.upload_id = u.id AND c.deleted_at IS NULL)     AS comment_count
+FROM upload u
+JOIN "user" usr ON u.user_id = usr.id
+WHERE u.deleted_at IS NULL
+  AND usr.uploads_hidden = FALSE;

backend/migrations/010_review_indexes.down.sql

@@ -1,3 +0,0 @@
-DROP INDEX IF EXISTS idx_comment_hashtag_hashtag;
-DROP INDEX IF EXISTS idx_comment_user;
-DROP INDEX IF EXISTS idx_upload_event_created_id;

backend/migrations/010_review_indexes.up.sql

@@ -1,17 +0,0 @@
--- Composite feed index with an id tiebreaker so keyset pagination
--- (ORDER BY created_at DESC, id DESC) stays index-covered and stable when
--- multiple uploads share a created_at timestamp.
-CREATE INDEX idx_upload_event_created_id
-    ON upload(event_id, created_at DESC, id DESC)
-    WHERE deleted_at IS NULL;
-
--- A user's own comments (moderation, "who commented"). The sibling
--- idx_upload_user already exists for uploads; comment(user_id) was missing.
-CREATE INDEX idx_comment_user
-    ON comment(user_id)
-    WHERE deleted_at IS NULL;
-
--- Hashtag filtering over comments — mirrors idx_upload_hashtag_hashtag, which
--- only covered upload_hashtag.
-CREATE INDEX idx_comment_hashtag_hashtag
-    ON comment_hashtag(hashtag_id);

backend/migrations/011_ban_hides_and_pin_reset.up.sql

@@ -1,39 +0,0 @@
--- Ban now ALWAYS hides: exclude banned uploaders from the feed view. Previously ban and
--- hide were decoupled (a host could ban without hiding), leaving a banned user's photos on
--- the feed and baked into the export. `find_visible_media` and the export query get the
--- same `is_banned = FALSE` filter in code.
-CREATE OR REPLACE VIEW v_feed AS
-SELECT
-    u.id,
-    u.event_id,
-    u.user_id,
-    usr.display_name             AS uploader_name,
-    usr.is_banned,
-    usr.uploads_hidden,
-    u.preview_path,
-    u.thumbnail_path,
-    u.mime_type,
-    u.caption,
-    u.created_at,
-    COUNT(DISTINCT l.user_id)    AS like_count,
-    COUNT(DISTINCT c.id)         AS comment_count
-FROM upload u
-JOIN "user" usr ON u.user_id = usr.id
-LEFT JOIN "like" l  ON l.upload_id = u.id
-LEFT JOIN comment c ON c.upload_id = u.id AND c.deleted_at IS NULL
-WHERE u.deleted_at IS NULL
-  AND usr.uploads_hidden = FALSE
-  AND usr.is_banned = FALSE
-GROUP BY u.id, usr.display_name, usr.is_banned, usr.uploads_hidden;
-
--- pin_reset_request: a guest who forgot their PIN (localStorage was the only copy) can ask
--- a host to reset it in-app, instead of being permanently orphaned. One pending request per
--- user; cleared when the host resets the PIN or dismisses it, and cascades if the user/event
--- is removed.
-CREATE TABLE pin_reset_request (
-    id          UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
-    event_id    UUID        NOT NULL REFERENCES event(id) ON DELETE CASCADE,
-    user_id     UUID        NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
-    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-    UNIQUE (user_id)
-);

backend/migrations/012_export_release_seq.down.sql

@@ -1,2 +0,0 @@
-ALTER TABLE export_job
-    DROP COLUMN IF EXISTS release_seq;

backend/migrations/012_export_release_seq.up.sql

@@ -1,11 +0,0 @@
--- H1: export generation guard. A reopen (which clears `export_released_at`) followed by a
--- re-release could spawn a fresh export worker while a worker from the PRIOR release was
--- still streaming a now-stale snapshot to `Gallery.zip`. The stale worker's finalize then
--- re-set `export_*_ready = TRUE` on an archive that predated the reopen — a silent,
--- permanent data loss (new uploads missing from a "ready" keepsake).
---
--- `release_seq` is a per-(event,type) generation counter bumped on every (re)release.
--- A worker captures the seq it claimed and only finalizes / flips the ready flag while
--- that seq is still current; a superseded worker discards its output instead.
-ALTER TABLE export_job
-    ADD COLUMN release_seq BIGINT NOT NULL DEFAULT 0;

backend/migrations/013_uploads_hidden_at.down.sql

@@ -1,2 +0,0 @@
-ALTER TABLE "user"
-    DROP COLUMN IF EXISTS uploads_hidden_at;

backend/migrations/013_uploads_hidden_at.up.sql

@@ -1,12 +0,0 @@
--- Ban-replay on reconnect. A ban is not a soft-delete (it sets `uploads_hidden`/`is_banned`,
--- never `upload.deleted_at`), and live eviction rode only on the ephemeral `user-hidden` SSE
--- broadcast — which has no reconnect-replay. So a client (especially the unattended diashow
--- projector) that missed that broadcast kept cycling the banned user's already-loaded slides.
---
--- `uploads_hidden_at` stamps WHEN a user's uploads became hidden, so the reconnect delta can
--- return the set of users hidden since the client's cursor and the client can evict them.
-ALTER TABLE "user"
-    ADD COLUMN uploads_hidden_at TIMESTAMPTZ;
-
--- Backfill already-hidden users so a reconnect right after this migration still evicts them.
-UPDATE "user" SET uploads_hidden_at = NOW() WHERE uploads_hidden = TRUE;

backend/migrations/014_export_epoch.down.sql

@@ -1,28 +0,0 @@
--- Restore the stored ready flags and the per-job counter.
-DROP VIEW IF EXISTS export_current;
-
-ALTER TABLE event ADD COLUMN export_zip_ready  BOOLEAN NOT NULL DEFAULT FALSE;
-ALTER TABLE event ADD COLUMN export_html_ready BOOLEAN NOT NULL DEFAULT FALSE;
-
--- Re-derive the flags from what the epoch model considers downloadable, so the old code sees
--- exactly the state it would have written itself.
-UPDATE event e
-   SET export_zip_ready = EXISTS (
-         SELECT 1 FROM export_job j
-          WHERE j.event_id = e.id AND j.type = 'zip'
-            AND j.status = 'done' AND j.epoch = e.export_epoch
-       ),
-       export_html_ready = EXISTS (
-         SELECT 1 FROM export_job j
-          WHERE j.event_id = e.id AND j.type = 'html'
-            AND j.status = 'done' AND j.epoch = e.export_epoch
-       )
- WHERE e.export_released_at IS NOT NULL;
-
-ALTER TABLE export_job RENAME COLUMN epoch TO release_seq;
-
--- The old code treats release_seq as a non-negative per-job counter; the -1 retirement sentinel
--- has no meaning there, so floor it back to 0.
-UPDATE export_job SET release_seq = 0 WHERE release_seq < 0;
-
-ALTER TABLE event DROP COLUMN export_epoch;

backend/migrations/014_export_epoch.up.sql

@@ -1,86 +0,0 @@
--- Export generation, unified.
---
--- ⚠ ROLLBACK RUNBOOK. This is the repo's first DESTRUCTIVE migration (it DROPs two columns). The
--- previous image will NOT boot against this schema: sqlx runs migrations before serving and errors
--- with VersionMissing on an unknown version, so you get a crash loop, not a degraded service.
--- To roll back to the previous release you must run 014_export_epoch.down.sql BY HAND FIRST, then
--- deploy the old image. The down migration re-derives the old ready flags from the epoch state, so
--- no keepsake is lost.
---
--- Before this migration, "which generation of the keepsake is current?" had no single answer.
--- It was assembled at runtime from three separately-written pieces of state across two tables:
---   * event.export_released_at   — a release marker with NO identity (you cannot ask *which* release)
---   * export_job.release_seq     — a per-row counter, in a different table, bumped in a different statement
---   * event.export_{zip,html}_ready — a CACHED COPY of the derivation of the other two
--- Keeping those three in agreement took ~10 hand-written guards, and every guard was a repair of the
--- same missing invariant. Three consecutive review rounds each found another path that slipped through.
---
--- This replaces all of it with ONE authority:
---
---   event.export_epoch — a monotonic counter bumped in the SAME UPDATE as any change to
---                        export_released_at (release and reopen are its only writers).
---   export_job.epoch   — a COPY of event.export_epoch taken when the job was enqueued.
---                        NEVER independently incremented.
---
--- The single invariant, which replaces the entire proof:
---
---   An export is downloadable IFF
---       event.export_released_at IS NOT NULL
---   AND export_job.epoch = event.export_epoch
---   AND export_job.status = 'done'
---
--- Readiness is therefore DERIVED, never stored — so it cannot drift, and no worker can set it.
--- A worker holding a dead epoch is INERT BY CONSTRUCTION: anything it writes is invisible to every
--- reader, with no guard involved. Losing a race can no longer corrupt state; it can only waste work.
---
--- Crucially, epoch equality is checked on the SAME ROW the worker updates (export_job), never via a
--- cross-table EXISTS. That matters: under READ COMMITTED, when an UPDATE blocks on a row lock and the
--- blocker commits, Postgres re-evaluates the WHERE against the *updated target row* but answers
--- subqueries on OTHER tables from the statement's ORIGINAL snapshot. The old cross-row guard
--- (`EXISTS (SELECT 1 FROM event WHERE ... export_released_at IS NOT NULL)`) was unsound for exactly
--- that reason — it could admit a claim against an already-reopened event while RETURNING the
--- post-bump seq. A same-row `epoch = $n` predicate is re-evaluated correctly by EPQ.
-
-ALTER TABLE event ADD COLUMN export_epoch BIGINT NOT NULL DEFAULT 0;
-
--- A currently-released event's live generation becomes epoch 1.
-UPDATE event SET export_epoch = 1 WHERE export_released_at IS NOT NULL;
-
--- The per-job counter becomes a plain copy of the event epoch it was enqueued for.
-ALTER TABLE export_job RENAME COLUMN release_seq TO epoch;
-
--- Carry the OLD notion of "downloadable" across exactly: a job the old model considered ready
--- (released + done + its ready flag) adopts the event's live epoch. Everything else is retired to
--- -1, which can never equal a non-negative event.export_epoch, so it is inert forever.
-UPDATE export_job j
-   SET epoch = CASE
-         WHEN e.export_released_at IS NOT NULL
-          AND j.status = 'done'
-          AND ((j.type = 'zip'  AND e.export_zip_ready)
-            OR (j.type = 'html' AND e.export_html_ready))
-         THEN e.export_epoch
-         ELSE -1
-       END
-  FROM event e
- WHERE e.id = j.event_id;
-
--- The duplicated derivation. Gone — along with the whole class of bugs where a stale worker
--- resurrected it, or where it disagreed with the job row it was supposed to summarise.
-ALTER TABLE event DROP COLUMN export_zip_ready;
-ALTER TABLE event DROP COLUMN export_html_ready;
-
--- The ONE definition of "the current generation". Every reader goes through this, so readiness and
--- the file path are resolved in a SINGLE read — closing the download-path TOCTOU where the ready
--- flag was checked in one query and file_path fetched in another (a reopen between the two served a
--- keepsake that should have 404'd).
-CREATE VIEW export_current AS
-SELECT j.event_id,
-       j.type,
-       j.status,
-       j.progress_pct,
-       j.file_path,
-       j.epoch
-  FROM export_job j
-  JOIN event e ON e.id = j.event_id
- WHERE e.export_released_at IS NOT NULL   -- implied by the epoch match; kept as an assertion
-   AND j.epoch = e.export_epoch;

backend/migrations/015_raise_upload_rate.down.sql

@@ -1,3 +0,0 @@
--- Revert the default upload rate to 10/hour for installs still on the raised
--- default (preserves any explicit admin override at another value).
-UPDATE config SET value = '10' WHERE key = 'upload_rate_per_hour' AND value = '100';

backend/migrations/015_raise_upload_rate.up.sql

@@ -1,10 +0,0 @@
--- Raise the default per-guest upload rate from 10/hour to 100/hour.
---
--- Rationale: guests routinely upload a burst of 10-20 photos at once (phone
--- multi-select). At the old default of 10/hour a real guest's first burst was
--- throttled — surfaced by the 2026-07-18 load test. 100/hour comfortably covers
--- several bursts across an event while still bounding abuse.
---
--- Only bump installs still on the old default; an admin who deliberately set a
--- different value keeps it (migration 005 seeded 10; this UPDATE is scoped to '10').
-UPDATE config SET value = '100' WHERE key = 'upload_rate_per_hour' AND value = '10';

backend/migrations/016_display_derivative.down.sql

@@ -1,28 +0,0 @@
--- Drop the view (frees the column dependency), remove the column, then restore the
--- pre-016 view definition (matches migration 011).
-DROP VIEW IF EXISTS v_feed;
-ALTER TABLE upload DROP COLUMN display_path;
-
-CREATE VIEW v_feed AS
-SELECT
-    u.id,
-    u.event_id,
-    u.user_id,
-    usr.display_name             AS uploader_name,
-    usr.is_banned,
-    usr.uploads_hidden,
-    u.preview_path,
-    u.thumbnail_path,
-    u.mime_type,
-    u.caption,
-    u.created_at,
-    COUNT(DISTINCT l.user_id)    AS like_count,
-    COUNT(DISTINCT c.id)         AS comment_count
-FROM upload u
-JOIN "user" usr ON u.user_id = usr.id
-LEFT JOIN "like" l  ON l.upload_id = u.id
-LEFT JOIN comment c ON c.upload_id = u.id AND c.deleted_at IS NULL
-WHERE u.deleted_at IS NULL
-  AND usr.uploads_hidden = FALSE
-  AND usr.is_banned = FALSE
-GROUP BY u.id, usr.display_name, usr.is_banned, usr.uploads_hidden;

backend/migrations/016_display_derivative.up.sql

@@ -1,34 +0,0 @@
--- Display derivative: a big-screen-quality image (~2048px long edge) for the diashow.
--- The 800px `preview_path` is sized for phone feeds (data saver); upscaled on a projector
--- it looks soft. The diashow uses `display_path` instead — bounded in size (safe to decode
--- on weak kiosk hardware) yet sharp on 1080p/4K. NULL until the compression worker (or the
--- one-time backfill) generates it; consumers fall back to the original when absent.
-ALTER TABLE upload ADD COLUMN display_path TEXT;
-
--- Recreate (not CREATE OR REPLACE, which only allows appending columns at the end) so the
--- new column can sit alongside preview_path/thumbnail_path.
-DROP VIEW IF EXISTS v_feed;
-CREATE VIEW v_feed AS
-SELECT
-    u.id,
-    u.event_id,
-    u.user_id,
-    usr.display_name             AS uploader_name,
-    usr.is_banned,
-    usr.uploads_hidden,
-    u.preview_path,
-    u.thumbnail_path,
-    u.display_path,
-    u.mime_type,
-    u.caption,
-    u.created_at,
-    COUNT(DISTINCT l.user_id)    AS like_count,
-    COUNT(DISTINCT c.id)         AS comment_count
-FROM upload u
-JOIN "user" usr ON u.user_id = usr.id
-LEFT JOIN "like" l  ON l.upload_id = u.id
-LEFT JOIN comment c ON c.upload_id = u.id AND c.deleted_at IS NULL
-WHERE u.deleted_at IS NULL
-  AND usr.uploads_hidden = FALSE
-  AND usr.is_banned = FALSE
-GROUP BY u.id, usr.display_name, usr.is_banned, usr.uploads_hidden;

backend/migrations/017_join_ip_rate.down.sql

@@ -1 +0,0 @@
-DELETE FROM config WHERE key IN ('join_ip_rate_per_min', 'admin_login_rate_enabled');

backend/migrations/017_join_ip_rate.up.sql

@@ -1,18 +0,0 @@
--- Per-IP flood ceiling for /join, and the `admin_login_rate_enabled` toggle that
--- every prior migration forgot to seed.
---
--- Rationale: /join was throttled at 5 requests per 60s keyed on the client IP. At a
--- venue every guest is behind one NAT, so the whole party shared a single bucket —
--- 12 guests scanning the QR code within a few seconds meant 5 got in and 7 were
--- turned away. The handler now keys the real anti-spam bucket per (ip, name), the
--- same shape as `recover:{ip}:{name}`, and keeps only a loose per-IP ceiling to bound
--- raw volume. 60/min comfortably covers a whole wedding arriving at once while still
--- capping a flood from a single source.
---
--- `admin_login_rate_enabled` is read by auth::handlers::admin_login with a code
--- default of `true`, but no migration ever inserted it, so it was invisible to the
--- admin config UI and to the e2e reseed. Seed it explicitly.
-INSERT INTO config (key, value) VALUES
-    ('join_ip_rate_per_min',     '60'),
-    ('admin_login_rate_enabled', 'true')
-ON CONFLICT (key) DO NOTHING;

backend/migrations/018_derivatives_rev.down.sql

@@ -1,2 +0,0 @@
-DROP INDEX IF EXISTS idx_upload_derivatives_rev;
-ALTER TABLE upload DROP COLUMN IF EXISTS derivatives_rev;

backend/migrations/018_derivatives_rev.up.sql

@@ -1,18 +0,0 @@
--- Track which revision of the derivative pipeline produced an upload's preview/display.
---
--- Rev 1 applies the EXIF orientation tag. Everything generated before it decoded the raw
--- sensor pixels and re-encoded to JPEG (which writes no EXIF), so every portrait phone photo
--- was stored sideways in the feed preview, the diashow display and the keepsake — while the
--- untouched original still rendered upright.
---
--- Existing rows default to 0 so the startup backfill can find and re-generate them exactly
--- once; bump the constant in services/compression.rs if the pipeline ever changes again.
-ALTER TABLE upload ADD COLUMN IF NOT EXISTS derivatives_rev SMALLINT NOT NULL DEFAULT 0;
-
--- Only image derivatives are affected — video thumbnails are extracted by ffmpeg, which
--- already honours the rotation matrix. Mark them current so the backfill skips them.
-UPDATE upload SET derivatives_rev = 1 WHERE mime_type NOT LIKE 'image/%';
-
-CREATE INDEX IF NOT EXISTS idx_upload_derivatives_rev
-    ON upload (derivatives_rev)
-    WHERE deleted_at IS NULL;

backend/migrations/019_recover_ip_rate.down.sql

@@ -1 +0,0 @@
-DELETE FROM config WHERE key = 'recover_ip_rate_per_min';

backend/migrations/019_recover_ip_rate.up.sql

@@ -1,19 +0,0 @@
--- Per-IP flood ceiling for /recover, mirroring the one migration 017 added for /join.
---
--- Rationale: /recover is keyed `recover:{ip}:{name}` at 5 per 15 minutes. That is the
--- right shape for its actual job — stopping someone who knows a display name (they are
--- visible on the feed) from burning the victim's 3-strike PIN counter and locking them
--- out repeatedly. But the name is attacker-chosen, so cycling names mints a fresh bucket
--- every time and the per-IP cost is unbounded.
---
--- Behind that limiter sits a cost-12 bcrypt verify, including an UNCONDITIONAL throwaway
--- verify for names that don't exist — deliberately, to close a timing oracle. So an
--- unknown name is the cheapest possible way to make the server do ~200ms of hashing.
--- Without a ceiling, one client can saturate the box's CPU with a name generator.
---
--- 30/min is far above any real recovery attempt (a guest tries their PIN a handful of
--- times) while capping a name-cycling flood. The per-(ip, name) bucket is unchanged and
--- remains the anti-guessing control.
-INSERT INTO config (key, value) VALUES
-    ('recover_ip_rate_per_min', '30')
-ON CONFLICT (key) DO NOTHING;

backend/migrations/020_social_rate.down.sql

@@ -1 +0,0 @@
-DELETE FROM config WHERE key IN ('social_rate_per_min', 'social_rate_enabled');

backend/migrations/020_social_rate.up.sql

@@ -1,16 +0,0 @@
--- Per-user rate limit for social writes (likes, comments, comment deletions).
---
--- These were the only writes in the app with no limit at all. Every other mutating
--- path -- upload, join, recover, export, admin login -- carries one; social.rs
--- carried none, so the coverage was asymmetric rather than deliberately open.
---
--- Severity is genuinely low for an invited-guest event, and the amplification worry
--- turned out to be contained: a like fans an SSE broadcast to ~100 clients, but the
--- export regeneration it could otherwise trigger is debounced (REGEN_DEBOUNCE 20s)
--- and superseded workers are inert. So this closes the gap for symmetry, not urgency,
--- and the ceiling is set high enough that no real guest will ever meet it -- a
--- double-tapping enthusiast at a wedding is not the thing being defended against.
-INSERT INTO config (key, value) VALUES
-    ('social_rate_per_min',  '120'),
-    ('social_rate_enabled',  'true')
-ON CONFLICT (key) DO NOTHING;

backend/migrations/021_hashtag_counts_respect_bans.down.sql

@@ -1,13 +0,0 @@
--- Restore the pre-021 definition (no ban/hide filtering) exactly as 004 created it.
-DROP VIEW IF EXISTS v_hashtag_counts;
-
-CREATE VIEW v_hashtag_counts AS
-SELECT
-    h.event_id,
-    h.tag,
-    COUNT(uh.upload_id) AS upload_count
-FROM hashtag h
-JOIN upload_hashtag uh ON uh.hashtag_id = h.id
-JOIN upload u          ON u.id = uh.upload_id AND u.deleted_at IS NULL
-GROUP BY h.event_id, h.id, h.tag
-ORDER BY upload_count DESC;

backend/migrations/021_hashtag_counts_respect_bans.up.sql

@@ -1,31 +0,0 @@
--- v_hashtag_counts: apply the same visibility rules as v_feed.
---
--- The chip row and the grid's tag picker are both fed by this view, but it has only ever
--- filtered `u.deleted_at IS NULL`. Migration 011 added ban/hide filtering to the feed and
--- never reached here, so the two disagreed about which uploads exist:
---
---   * A host bans a guest who posted 3 of the 12 `#tanz` photos. The chip keeps reading
---     "#tanz 12"; tapping it returns 9. The count is presented as authoritative and is not.
---   * A tag used ONLY by a banned or hidden guest stays in the chip row and in the tag
---     picker as a selectable option that leads to an empty feed — a ghost filter that
---     cannot be cleared because there is nothing wrong with it to see.
---
--- Bans are exactly the moment a host is watching these numbers to confirm the moderation
--- took effect, so a stale count reads as "the ban didn't work".
---
--- Same predicate as v_feed (see 016_display_derivative.up.sql), joined through `user`.
-DROP VIEW IF EXISTS v_hashtag_counts;
-
-CREATE VIEW v_hashtag_counts AS
-SELECT
-    h.event_id,
-    h.tag,
-    COUNT(uh.upload_id) AS upload_count
-FROM hashtag h
-JOIN upload_hashtag uh ON uh.hashtag_id = h.id
-JOIN upload u          ON u.id = uh.upload_id AND u.deleted_at IS NULL
-JOIN "user" usr        ON usr.id = u.user_id
-WHERE usr.uploads_hidden = FALSE
-  AND usr.is_banned = FALSE
-GROUP BY h.event_id, h.id, h.tag
-ORDER BY upload_count DESC;

backend/migrations/022_client_upload_idempotency.down.sql

@@ -1,2 +0,0 @@
-DROP INDEX IF EXISTS upload_client_upload_id_key;
-ALTER TABLE upload DROP COLUMN IF EXISTS client_upload_id;

backend/migrations/022_client_upload_idempotency.up.sql

@@ -1,25 +0,0 @@
--- Idempotency key for uploads, supplied by the client.
---
--- The failure this closes is the ordinary one on a phone, not an exotic race: the server
--- receives the body, validates it, commits the row, and the response is lost on the way back
--- because the guest walked out of range or the AP dropped the connection. The client sees a
--- network error with the blob still in hand, marks the item retryable, and re-sends it — both
--- when the guest taps "Erneut" and automatically when the queue requeues on reconnect. Every
--- attempt minted a fresh `Uuid::new_v4()` server-side, so the same photo landed in the gallery
--- two or three times and was charged against the guest's storage quota each time.
---
--- The client already has a stable per-queue-item UUID, so it costs nothing to send. NULL is
--- allowed and unconstrained: uploads that predate this column, and any client that doesn't send
--- one, keep working exactly as before.
-ALTER TABLE upload ADD COLUMN client_upload_id UUID;
-
--- Partial rather than a plain UNIQUE. Postgres would tolerate the NULLs either way, but indexing
--- only the rows that carry a key keeps it small and states the rule exactly: uniqueness applies
--- where a key exists, and nowhere else.
---
--- Scoped globally rather than per user or per event. The key is a client-generated v4 UUID, so a
--- collision between two different photos is not a real possibility, and a single-column index
--- means the uniqueness check cannot be wrong about which event or user a retry belongs to.
-CREATE UNIQUE INDEX upload_client_upload_id_key
-    ON upload (client_upload_id)
-    WHERE client_upload_id IS NOT NULL;

backend/migrations/023_derivative_attempts.down.sql

@@ -1,3 +0,0 @@
-DROP INDEX IF EXISTS idx_upload_derivative_backfill;
-ALTER TABLE upload DROP COLUMN IF EXISTS derivative_last_error;
-ALTER TABLE upload DROP COLUMN IF EXISTS derivative_attempts;

backend/migrations/023_derivative_attempts.up.sql

@@ -1,23 +0,0 @@
--- Bound how many times a permanently-failing upload can be re-processed.
---
--- Without this, one poisoned row is an outage. The upload row is committed BEFORE compression
--- starts, `derivatives_rev` defaults to 0, and `set_derivatives_rev` only runs on success — so
--- a row whose processing kills the container survives at rev 0, the unconditional startup
--- backfill re-selects it on the next boot, and `restart: unless-stopped` turns that into an
--- infinite kill loop. Every restart also drops every SSE stream and truncates every in-flight
--- upload. That was reachable via a single large PNG (see services/compression.rs), but the
--- shape is general: any input that can kill or hang the worker repeats forever.
---
--- The counter is incremented WRITE-AHEAD, before the work is attempted, because the failure
--- mode being defended against is a SIGKILL — no error is returned, no handler runs, no Drop
--- fires. A counter bumped in an error path increments zero times per crash and changes nothing.
-ALTER TABLE upload ADD COLUMN IF NOT EXISTS derivative_attempts SMALLINT NOT NULL DEFAULT 0;
-
--- Last failure text, so a row that has given up can be diagnosed without reproducing it.
--- Nothing reads this in code; it exists for the operator.
-ALTER TABLE upload ADD COLUMN IF NOT EXISTS derivative_last_error TEXT;
-
--- Serves the backfill selection, which now filters on both columns.
-CREATE INDEX IF NOT EXISTS idx_upload_derivative_backfill
-    ON upload (derivatives_rev, derivative_attempts)
-    WHERE deleted_at IS NULL;

backend/migrations/024_feed_scalar_counts.down.sql

@@ -1,26 +0,0 @@
--- Restore the 016 definition verbatim.
-DROP VIEW IF EXISTS v_feed;
-CREATE VIEW v_feed AS
-SELECT
-    u.id,
-    u.event_id,
-    u.user_id,
-    usr.display_name             AS uploader_name,
-    usr.is_banned,
-    usr.uploads_hidden,
-    u.preview_path,
-    u.thumbnail_path,
-    u.display_path,
-    u.mime_type,
-    u.caption,
-    u.created_at,
-    COUNT(DISTINCT l.user_id)    AS like_count,
-    COUNT(DISTINCT c.id)         AS comment_count
-FROM upload u
-JOIN "user" usr ON u.user_id = usr.id
-LEFT JOIN "like" l  ON l.upload_id = u.id
-LEFT JOIN comment c ON c.upload_id = u.id AND c.deleted_at IS NULL
-WHERE u.deleted_at IS NULL
-  AND usr.uploads_hidden = FALSE
-  AND usr.is_banned = FALSE
-GROUP BY u.id, usr.display_name, usr.is_banned, usr.uploads_hidden;

backend/migrations/024_feed_scalar_counts.up.sql

@@ -1,55 +0,0 @@
--- Make a feed page cost a page, not the whole event.
---
--- The previous definition (016) computed like_count/comment_count with LEFT JOINs and a
--- GROUP BY. Postgres CAN push the `event_id = $1` qual and the keyset predicate through the
--- view — verified with EXPLAIN, it uses idx_upload_event_created_id — but it CANNOT push
--- ORDER BY ... LIMIT across a GroupAggregate. So every feed request aggregated every upload in
--- the event (times its likes and comments) and only then sorted and took 21 rows. The cost
--- grew with the event, not with the page, and page 1 — the most expensive one — is exactly
--- what refreshFeedInPlace refetches on every completed upload, from every open feed in the
--- venue.
---
--- Correlated scalar subqueries move the counts ABOVE the Limit in the plan: they are evaluated
--- once per returned row, so 21 index lookups instead of a full aggregation.
---
--- The rewrite is EXACTLY equivalent, not merely close:
---   * "like" is keyed (upload_id, user_id), so COUNT(DISTINCT l.user_id) == count(*).
---   * comment.id is the primary key, so COUNT(DISTINCT c.id) == count(*).
---   * one row per upload either way — the GROUP BY was on u.id.
--- Column names, order and types are unchanged (count(*) and COUNT(DISTINCT ...) are both
--- bigint), so no Rust code changes.
---
--- No new index needed: idx_like_upload plus the (upload_id, user_id) PK serve the like
--- subquery, and idx_comment_upload ... WHERE deleted_at IS NULL matches the comment
--- subquery's predicate exactly.
---
--- One thing a future editor needs to know: the hashtag-filtered feed joins upload_hashtag
--- against this view. That was safe before only because the GROUP BY collapsed the join
--- fan-out; it is safe now because the view is one row per upload and upload_hashtag is keyed
--- (upload_id, hashtag_id) with a single tag filtered. Adding a second tag filter would need
--- fresh thought.
-
--- Not CASCADE: if something ever comes to depend on this view, the migration should fail
--- loudly rather than silently drop it.
-DROP VIEW IF EXISTS v_feed;
-CREATE VIEW v_feed AS
-SELECT
-    u.id,
-    u.event_id,
-    u.user_id,
-    usr.display_name AS uploader_name,
-    usr.is_banned,
-    usr.uploads_hidden,
-    u.preview_path,
-    u.thumbnail_path,
-    u.display_path,
-    u.mime_type,
-    u.caption,
-    u.created_at,
-    (SELECT count(*) FROM "like" l WHERE l.upload_id = u.id)                           AS like_count,
-    (SELECT count(*) FROM comment c WHERE c.upload_id = u.id AND c.deleted_at IS NULL) AS comment_count
-FROM upload u
-JOIN "user" usr ON u.user_id = usr.id
-WHERE u.deleted_at IS NULL
-  AND usr.uploads_hidden = FALSE
-  AND usr.is_banned = FALSE;

backend/migrations/025_reserved_names_and_pin_decay.down.sql

@@ -1,11 +0,0 @@
--- NOTE: the reserved-name rename in the up migration is NOT reversible. The original names
--- are not recorded anywhere, and reversing it would in any case re-create the state that
--- bricked admin login. Rolling back the schema does not roll back that data change.
-DELETE FROM config WHERE key IN (
-    'recover_name_rate_per_15min',
-    'pin_reset_ip_rate_per_min',
-    'upload_edit_rate_per_min',
-    'upload_edit_rate_enabled'
-);
-
-ALTER TABLE "user" DROP COLUMN IF EXISTS last_failed_pin_at;

backend/migrations/025_reserved_names_and_pin_decay.up.sql

@@ -1,70 +0,0 @@
--- Two independent auth defects that share a migration because they share a table.
-
--- 1. RESERVED NAMES — free any guest squatting on a name the admin path used to depend on.
---
--- Migration 007 made display_name unique per event case-insensitively, and `join` had no
--- reserved-name guard. So any guest could join as "admin"/"Admin"/"ADMIN" before the operator's
--- first admin login; admin_login then looked its user up BY NAME, missed (wrong role), fell
--- through to creating "Admin", violated that unique index, and returned a 500 — permanently,
--- with no in-app recovery. Moderation, config and gallery release all gone, fixed only by SQL.
---
--- The real fix is in code (look the admin up by role, never by name — see auth/handlers.rs).
--- This clears the state an already-deployed database may be carrying.
---
--- RENAMED, NEVER DELETED: the guest keeps their uploads, their PIN and their session. Only
--- non-admin rows are touched — a real admin row named "Admin" is the expected state.
--- Two guards that are not optional, because this statement runs INSIDE the migration
--- transaction on boot and a failure here exits the process — `restart: unless-stopped` then
--- turns it into a crash loop with no in-app recovery. That is a strictly worse version of the
--- lockout this migration exists to clean up after.
---
---   * role = 'guest', not role <> 'admin'. The enum also has 'host' (001), and hosts are
---     promoted from guests at runtime — so <> 'admin' renamed a legitimately promoted staff
---     member whose name happens to be "Host".
---   * NOT EXISTS. The target name is derived, not unique: `idx_user_event_name_ci` (007) is a
---     UNIQUE index on (event_id, lower(display_name)), and nothing stopped a second guest from
---     having already joined as exactly "Admin (a1b2c3d4)" — the old code had no reserved-name
---     guard and the join response hands each guest their own id. Rare, but the cost of losing
---     that bet is the whole event.
---
--- A row that collides is simply left alone: `create_admin_user` already handles a name clash by
--- falling back to `Admin-<8hex>`, and `admin_login` no longer resolves by name at all, so this
--- cleanup is convenience rather than load-bearing.
-UPDATE "user" u
-   SET display_name = u.display_name || ' (' || left(u.id::text, 8) || ')'
- WHERE u.role = 'guest'
-   AND lower(u.display_name) IN ('admin', 'administrator', 'host', 'eventsnap')
-   AND NOT EXISTS (
-        SELECT 1 FROM "user" x
-         WHERE x.event_id = u.event_id
-           AND lower(x.display_name) = lower(u.display_name || ' (' || left(u.id::text, 8) || ')')
-   );
-
--- 2. PIN LOCKOUT DECAY.
---
--- failed_pin_attempts only ever cleared on a successful recovery or after a lockout expired, so
--- honest typos accumulated across days: a guest who fat-fingered their PIN twice last night
--- arrives today already two-thirds of the way to being locked out. With the threshold now
--- raised (see below) a decay window is what keeps that raise safe rather than merely lenient.
-ALTER TABLE "user" ADD COLUMN IF NOT EXISTS last_failed_pin_at TIMESTAMPTZ;
-
--- Rate-limit knobs introduced with this release.
---
--- recover_name_rate_per_15min (4, was a hardcoded 5): the per-(IP, name) ceiling. It MUST stay
--- below the account-lock threshold, which is the whole defect — at 5-per-IP against a 3-strike
--- lock, three requests from one IP locked any guest whose name is visible on the feed, every 15
--- minutes, forever. The lock threshold moves to 12 in code, so locking a victim now needs at
--- least three distinct sources while an honest guest never comes close.
---
--- pin_reset_ip_rate_per_min (30): /recover/request was the one unauthenticated endpoint with no
--- per-IP ceiling at all — /join got one in 017 and /recover in 019, and this third one was
--- simply missed. Its per-name key is attacker-chosen, so cycling names minted a fresh bucket
--- every time and the per-IP cost was unbounded.
---
--- upload_edit_rate_per_min (30): PATCH /upload/{id} had no rate limit of any kind.
-INSERT INTO config (key, value) VALUES
-    ('recover_name_rate_per_15min', '4'),
-    ('pin_reset_ip_rate_per_min',   '30'),
-    ('upload_edit_rate_per_min',    '30'),
-    ('upload_edit_rate_enabled',    'true')
-ON CONFLICT (key) DO NOTHING;

backend/migrations/026_idempotency_excludes_deleted.down.sql

@@ -1,13 +0,0 @@
--- Restore migration 022's wider index (which also covered soft-deleted rows).
---
--- Note this can FAIL where the up-migration succeeded: once retries-after-delete have been
--- allowed, two rows may legitimately share a `client_upload_id` (one deleted, one live), and
--- the wider unique index cannot be rebuilt over them. That is inherent to reverting this
--- direction, not a defect in the down-migration. If it fails, the live-only index is still
--- correct and should simply be kept.
-
-DROP INDEX IF EXISTS upload_client_upload_id_key;
-
-CREATE UNIQUE INDEX upload_client_upload_id_key
-    ON upload (client_upload_id)
-    WHERE client_upload_id IS NOT NULL;

backend/migrations/026_idempotency_excludes_deleted.up.sql

@@ -1,35 +0,0 @@
--- Narrow the client-upload idempotency index so it stops covering soft-deleted rows.
---
--- The bug (H9). Migration 022 created the index partial on `client_upload_id IS NOT NULL`
--- only, so a soft-deleted row kept occupying its key. But `find_by_client_upload_id` filters
--- `deleted_at IS NULL` — deliberately, and its doc comment says so: "if the guest deleted the
--- photo and their queue later retries, they should get a fresh upload rather than a
--- resurrection of a deleted one." The index and the lookup therefore disagreed, and the
--- disagreement is reachable by an ordinary guest:
---
---   1. guest uploads a photo, then deletes it (soft delete — the row stays, `deleted_at` set)
---   2. their queue retries the same item (reconnect requeue, or they tap "Erneut")
---   3. the whole body is re-streamed and re-validated, then `ON CONFLICT DO NOTHING` matches
---      the DEAD row and inserts nothing
---   4. the replay lookup filters that row out and finds nothing, so the handler returns 409
---   5. the client classifies 409 as terminal and DELETES the blob from IndexedDB
---
--- The photo is now gone from the device with no row in the gallery, and there is no path back.
--- Re-selecting the same file from the camera roll mints a new `client_upload_id`, so that does
--- work — but the guest has no way to know that is what is required.
---
--- Adding `deleted_at IS NULL` makes the index agree with the lookup: a key is claimed only
--- while a LIVE row holds it, so step 3 inserts a fresh row and the retry succeeds.
---
--- Uniqueness among live rows is what the feature actually needs. The property migration 022
--- was protecting — "the same photo must not land in the gallery twice" — is about rows the
--- guest can see, and a soft-deleted row is not one of those.
-
-DROP INDEX IF EXISTS upload_client_upload_id_key;
-
--- CONCURRENTLY is deliberately NOT used: sqlx runs each migration inside a transaction, and
--- CREATE INDEX CONCURRENTLY cannot run in one. The table is small (one event's uploads) and
--- this runs at boot before the server accepts requests, so the brief lock costs nothing.
-CREATE UNIQUE INDEX upload_client_upload_id_key
-    ON upload (client_upload_id)
-    WHERE client_upload_id IS NOT NULL AND deleted_at IS NULL;

backend/migrations/027_join_idempotency.down.sql

@@ -1,2 +0,0 @@
-DROP INDEX IF EXISTS user_client_join_id_key;
-ALTER TABLE "user" DROP COLUMN IF EXISTS client_join_id;

backend/migrations/027_join_idempotency.up.sql

@@ -1,34 +0,0 @@
--- Idempotency key for /join, supplied by the client.
---
--- The failure this closes (H16) is the single most likely failure of the evening, on step one
--- of the product. `/join` commits the user row AND the bcrypt hash of the PIN, but the PLAINTEXT
--- PIN exists nowhere except the HTTP response body. So:
---
---   1. guest scans the QR in the venue car park, taps "Beitreten"
---   2. the server creates the account and hashes the PIN
---   3. the response is lost on the way back — the 5G-to-nothing transition every wedding venue
---      has, or the AP handing off
---   4. the client retries; the name is now taken, so it 409s
---   5. the client shows a PIN entry form for a PIN THAT WAS NEVER DISPLAYED
---
--- The guest is locked out of their own brand-new account, and the only recovery is finding a
--- host with a dashboard open. `/upload` already solved exactly this with `client_upload_id`;
--- join never got the same treatment.
---
--- With a key, a retry is recognised as the same join and answered with a usable PIN. We do NOT
--- store the plaintext to replay it — see the handler: a retry ROTATES the PIN. That is sound
--- precisely because the original was never shown to anybody, so there is nothing to preserve,
--- and it keeps this table free of recoverable credentials.
-
-ALTER TABLE "user" ADD COLUMN client_join_id UUID;
-
--- Partial, for the same reasons as `upload_client_upload_id_key`: index only the rows that
--- carry a key, and state the rule exactly. NULL is allowed and unconstrained, so any client
--- that does not send one (and every row that predates this column) behaves exactly as before.
---
--- Scoped per event as well as per key. The key is a client-generated v4 UUID so a cross-event
--- collision is not realistic, but a reused install genuinely has two events in one table and
--- "this join belongs to that event" is the property we actually mean.
-CREATE UNIQUE INDEX user_client_join_id_key
-    ON "user" (event_id, client_join_id)
-    WHERE client_join_id IS NOT NULL;

backend/migrations/028_feed_counts_exclude_banned.down.sql

@@ -1,22 +0,0 @@
--- Restore migration 024's counts (which included banned users' likes and comments).
-CREATE OR REPLACE VIEW v_feed AS
-SELECT
-    u.id,
-    u.event_id,
-    u.user_id,
-    usr.display_name AS uploader_name,
-    usr.is_banned,
-    usr.uploads_hidden,
-    u.preview_path,
-    u.thumbnail_path,
-    u.display_path,
-    u.mime_type,
-    u.caption,
-    u.created_at,
-    (SELECT count(*) FROM "like" l WHERE l.upload_id = u.id)                           AS like_count,
-    (SELECT count(*) FROM comment c WHERE c.upload_id = u.id AND c.deleted_at IS NULL) AS comment_count
-FROM upload u
-JOIN "user" usr ON u.user_id = usr.id
-WHERE u.deleted_at IS NULL
-  AND usr.uploads_hidden = FALSE
-  AND usr.is_banned = FALSE;

backend/migrations/028_feed_counts_exclude_banned.up.sql

@@ -1,44 +0,0 @@
--- Exclude banned users' likes and comments from the feed's scalar counts (H11).
---
--- `v_feed` already excludes banned UPLOADERS (`usr.is_banned = FALSE` on the join), but the two
--- correlated subqueries added by migration 024 counted every like and every non-deleted comment
--- regardless of who wrote it. So after a ban:
---
---   * the banned guest's own photos disappear from the feed (correct), but
---   * their likes still inflate the counter on everyone else's photos, and
---   * their comments still contribute to `comment_count` — and, until the change to
---     `Comment::list_for_upload` that ships with this migration, were still RENDERED in the
---     lightbox on the most-viewed photo of the evening.
---
--- The host's mental model of "ban" is "this person's contributions are gone". Photos honoured it;
--- likes and comments did not. Migration 021 already applied exactly this reasoning to hashtag
--- counts, and the export query filters `is_banned` too — this brings the last read path in line.
---
--- Derived at read time, so `unban_user` restores the counts with no extra work, exactly as it
--- already restores the photos.
-
-CREATE OR REPLACE VIEW v_feed AS
-SELECT
-    u.id,
-    u.event_id,
-    u.user_id,
-    usr.display_name AS uploader_name,
-    usr.is_banned,
-    usr.uploads_hidden,
-    u.preview_path,
-    u.thumbnail_path,
-    u.display_path,
-    u.mime_type,
-    u.caption,
-    u.created_at,
-    (SELECT count(*) FROM "like" l
-       JOIN "user" lu ON lu.id = l.user_id
-      WHERE l.upload_id = u.id AND NOT lu.is_banned)                                   AS like_count,
-    (SELECT count(*) FROM comment c
-       JOIN "user" cu ON cu.id = c.user_id
-      WHERE c.upload_id = u.id AND c.deleted_at IS NULL AND NOT cu.is_banned)          AS comment_count
-FROM upload u
-JOIN "user" usr ON u.user_id = usr.id
-WHERE u.deleted_at IS NULL
-  AND usr.uploads_hidden = FALSE
-  AND usr.is_banned = FALSE;

backend/migrations/029_host_action_audit.down.sql

@@ -1,2 +0,0 @@
-DROP INDEX IF EXISTS host_action_audit_event_created_idx;
-DROP TABLE IF EXISTS host_action_audit;

backend/migrations/029_host_action_audit.up.sql

@@ -1,41 +0,0 @@
--- An audit trail for privileged actions (H17).
---
--- What existed before: nothing. `grep -i audit` across `handlers/host.rs` and `handlers/admin.rs`
--- returned no hits. Individual actions logged a `tracing::info!` line, but config changes, gallery
--- release and event lock/unlock logged nothing at all — and the "audit trail" as a whole was a
--- 30 MB rotating Docker log that the runbook's own retention settings will discard.
---
--- Why it matters here specifically: a host is a promoted GUEST, and `reset_pin` overwrites another
--- guest's credential and returns the new PIN in the clear. So a host can take over any guest's
--- account and post as them, and nothing in the record showed it happened (only /recover FAILURES
--- were logged). At a wedding the people involved know each other; the point is not catching a
--- villain, it is being able to answer "what happened to my photo?" the next morning without
--- guessing.
---
--- Deliberately append-only in practice: no UPDATE or DELETE path is written for it anywhere. Small
--- (a few hundred rows for a real event), so no partitioning or retention job.
-
-CREATE TABLE host_action_audit (
-    id           BIGSERIAL PRIMARY KEY,
-    event_id     UUID NOT NULL REFERENCES event(id) ON DELETE CASCADE,
-    -- The privileged caller. NOT a FK with ON DELETE CASCADE: the record must survive the actor's
-    -- account being removed, which is exactly when it is most likely to be wanted.
-    actor_id     UUID,
-    actor_name   TEXT,
-    actor_role   TEXT NOT NULL,
-    -- Short stable slug: 'ban_user', 'unban_user', 'reset_pin', 'delete_upload',
-    -- 'delete_comment', 'release_gallery', 'lock_uploads', 'unlock_uploads', 'patch_config',
-    -- 'promote_user', 'demote_user', 'delete_user'.
-    action       TEXT NOT NULL,
-    -- The guest or object acted upon, when there is one.
-    target_id    UUID,
-    target_name  TEXT,
-    -- Free-form context: the config key and its old/new value, the caption that was removed, etc.
-    -- Never credentials — a reset PIN must not be recoverable from this table.
-    detail       JSONB,
-    created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW()
-);
-
--- The only query shape this needs: "what happened at this event, newest first".
-CREATE INDEX host_action_audit_event_created_idx
-    ON host_action_audit (event_id, created_at DESC);

backend/migrations/030_raise_join_ip_rate.down.sql

@@ -1,3 +0,0 @@
--- Revert the join ceiling to 60/min for installs still on the raised default
--- (preserves any explicit admin override at another value).
-UPDATE config SET value = '60' WHERE key = 'join_ip_rate_per_min' AND value = '300';

backend/migrations/030_raise_join_ip_rate.up.sql

@@ -1,15 +0,0 @@
--- Raise the per-IP join ceiling from 60/min to 300/min.
---
--- Rationale: every guest at the venue arrives through one NAT'd public address,
--- so `join_ip:{ip}` is not a per-guest limit at all — it is a ceiling on the
--- whole party. The QR code goes up once and is scanned in a burst: at 60/min,
--- guest 61 onwards is refused on the join screen, which is the one screen with
--- no auto-retry, and every manual retry spends another slot.
---
--- The code default was already raised to 300 (auth/handlers.rs), but a default
--- only applies when the key is ABSENT, and migration 017 seeds it. Without this
--- UPDATE the raise is dead code on every existing install.
---
--- Only bump installs still on the seeded default; an admin who deliberately set
--- a different value keeps it (migration 017 seeded 60; this UPDATE is scoped to '60').
-UPDATE config SET value = '300' WHERE key = 'join_ip_rate_per_min' AND value = '60';

backend/migrations/031_takedown_holds_idempotency_key.down.sql

@@ -1,10 +0,0 @@
--- Restore migration 026's predicate, then drop the column it depended on.
---
--- Note the same pairing caveat 026's own down carries: this is only valid alongside a code
--- rollback. `Upload::create` sends an ON CONFLICT predicate that must match the live index, so
--- running this down against the current binary makes every keyed upload a runtime 500.
-DROP INDEX IF EXISTS upload_client_upload_id_key;
-CREATE UNIQUE INDEX upload_client_upload_id_key ON upload (client_upload_id)
-    WHERE client_upload_id IS NOT NULL AND deleted_at IS NULL;
-
-ALTER TABLE upload DROP COLUMN IF EXISTS taken_down_by_host;

backend/migrations/031_takedown_holds_idempotency_key.up.sql

@@ -1,28 +0,0 @@
--- Keep a client upload key CLAIMED when the deletion was a host takedown.
---
--- Migration 026 narrowed `upload_client_upload_id_key` to live rows so that a guest who deletes
--- their own photo and whose queue later retries gets a fresh upload instead of a permanent 409.
--- That rationale reasoned only about the GUEST deleting. `deleted_at` is also set by
--- `host_delete_upload`, and for that case the same rule undoes a moderation decision:
---
---   1. Guest uploads. The row commits and the photo appears in the feed, but the response is lost
---      on the way back (the flaky-wifi case this whole feature exists for), so the phone keeps the
---      queue item.
---   2. The host sees the photo and takes it down. `deleted_at` is stamped, the keepsake epoch is
---      bumped, and the archive is rebuilt without it.
---   3. Ten minutes later the phone reconnects and retries. The key is no longer claimed, the
---      INSERT succeeds, and the photo is BACK — in the feed, in the next keepsake, under a NEW
---      uuid that matches nothing in the host's moderation history, with nothing logged to say a
---      takedown was undone.
---
--- So the key stays claimed for a host takedown and is released only for a guest's own delete. The
--- retry then resolves to the duplicate path and is refused, which is the correct answer: the photo
--- was deliberately removed, and re-sending the bytes must not bring it back.
-ALTER TABLE upload ADD COLUMN taken_down_by_host BOOLEAN NOT NULL DEFAULT FALSE;
-
--- KEEP THE PREDICATE IN LOCKSTEP WITH `Upload::create`'s ON CONFLICT clause (models/upload.rs).
--- A drift between the two is not a compile error here — queries are checked at runtime — it is a
--- 500 on every upload that carries a key, i.e. on exactly the retries this index exists to serve.
-DROP INDEX IF EXISTS upload_client_upload_id_key;
-CREATE UNIQUE INDEX upload_client_upload_id_key ON upload (client_upload_id)
-    WHERE client_upload_id IS NOT NULL AND (deleted_at IS NULL OR taken_down_by_host);

backend/scripts/rehearse-014.sh

@@ -1,195 +0,0 @@
-#!/usr/bin/env bash
-#
-# Dress rehearsal for migration 014 (export_epoch) — the repo's first DESTRUCTIVE migration.
-#
-# 014 DROPs event.export_zip_ready / export_html_ready and rewrites export_job.release_seq into an
-# epoch. The dangerous part is not the DDL, it's the BACKFILL: it has to carry the old notion of
-# "downloadable" across exactly. Get it wrong and a released event's keepsake silently 404s for
-# every guest, on a dataset you cannot re-create.
-#
-# This script proves the backfill preserves downloadability, against a scratch copy of a REAL dump:
-#
-#   ./rehearse-014.sh /path/to/prod-dump.sql     # rehearse against production data
-#   ./rehearse-014.sh                            # synthetic: build a pre-014 DB covering every case
-#
-# It asserts:
-#   1. up:   {(event,type) downloadable BEFORE} == {(event,type) downloadable AFTER}
-#   2. down: the old ready flags come back identical  (so a rollback is actually a rollback)
-#   3. up again: still identical                      (so a roll-forward after a rollback is safe)
-#
-# It NEVER touches your real database. Everything runs in a throwaway container.
-#
-# NOTE ON ROLLBACK (see the runbook header in 014_export_epoch.up.sql): sqlx runs migrations before
-# serving and errors with VersionMissing on an unknown version, so the PREVIOUS image will not boot
-# against the 014 schema — it crash-loops. Rolling back means running 014_export_epoch.down.sql BY
-# HAND FIRST, then deploying the old image. Assertion 2 is what makes that safe. Rehearse it before
-# you need it, not while the party is happening.
-
-set -euo pipefail
-
-DUMP="${1:-}"
-MIG_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../migrations" && pwd)"
-CONTAINER="eventsnap-rehearse-014"
-PGPASSWORD="rehearse"
-DB="eventsnap_rehearsal"
-
-cleanup() { docker rm -f "$CONTAINER" > /dev/null 2>&1 || true; }
-trap cleanup EXIT
-cleanup
-
-echo "▸ Starting a throwaway postgres:16 (nothing here touches your real DB)…"
-docker run --rm -d --name "$CONTAINER" \
-  -e POSTGRES_PASSWORD="$PGPASSWORD" -e POSTGRES_DB="$DB" \
-  postgres:16-alpine > /dev/null
-
-psql() { docker exec -i -e PGPASSWORD="$PGPASSWORD" "$CONTAINER" psql -U postgres -d "$DB" -v ON_ERROR_STOP=1 "$@"; }
-
-for _ in $(seq 1 30); do
-  if docker exec "$CONTAINER" pg_isready -U postgres > /dev/null 2>&1; then break; fi
-  sleep 1
-done
-
-if [[ -n "$DUMP" ]]; then
-  echo "▸ Restoring $DUMP …"
-  psql -q < "$DUMP"
-else
-  echo "▸ No dump given — building a synthetic pre-014 DB (migrations 001→013)…"
-  for f in "$MIG_DIR"/0[0-1][0-9]_*.up.sql; do
-    [[ "$(basename "$f")" == 014_* ]] && continue
-    psql -q < "$f"
-  done
-
-  # Every state the backfill has to classify. If 014 mishandles ANY of these, assertion 1 fails.
-  # Every state the backfill has to classify. export_job is UNIQUE (event_id, type), so each event
-  # has at most one job per type — the cases are distinguished by event, not by piling up rows.
-  #   A: released, both flags, both done  → both stay downloadable
-  #   B: released, ZIP flag only          → ZIP downloadable, HTML not (a half-built keepsake)
-  #   C: released, jobs done, NO flags    → NOT downloadable (a superseded worker's finished job:
-  #                                          the exact state the old ready-flag model used to leak)
-  #   D: never released, jobs done        → NOT downloadable (reopened, or built before release)
-  #   E: released, ZIP flag set but the job is FAILED/RUNNING → NOT downloadable (flag/job disagree,
-  #                                          which the old two-source model made representable at all)
-  echo "▸ Seeding: released+both, zip-only, done-but-stale, unreleased, flag/job-disagreement…"
-  psql -q <<'SQL'
-INSERT INTO event (id, slug, name, export_released_at, export_zip_ready, export_html_ready) VALUES
-  ('aaaaaaaa-0000-0000-0000-000000000001','ev-a','A', now(), TRUE,  TRUE),
-  ('aaaaaaaa-0000-0000-0000-000000000002','ev-b','B', now(), TRUE,  FALSE),
-  ('aaaaaaaa-0000-0000-0000-000000000003','ev-c','C', now(), FALSE, FALSE),
-  ('aaaaaaaa-0000-0000-0000-000000000004','ev-d','D', NULL,  FALSE, FALSE),
-  ('aaaaaaaa-0000-0000-0000-000000000005','ev-e','E', now(), TRUE,  TRUE);
-
-INSERT INTO export_job (event_id, type, status, progress_pct, file_path, release_seq)
-SELECT e.id, t::export_type, 'done'::export_status, 100, '/x/' || e.slug || '.' || t, 0
-  FROM event e CROSS JOIN (VALUES ('zip'),('html')) AS v(t);
-
--- E: the flags claim ready, the jobs say otherwise. Old model required BOTH, so neither is
--- downloadable — the migration must not "trust the flag" and resurrect them.
-UPDATE export_job SET status = 'failed',  file_path = NULL, progress_pct = 40
- WHERE event_id = 'aaaaaaaa-0000-0000-0000-000000000005' AND type = 'zip';
-UPDATE export_job SET status = 'running', file_path = NULL, progress_pct = 70
- WHERE event_id = 'aaaaaaaa-0000-0000-0000-000000000005' AND type = 'html';
-SQL
-fi
-
-echo "▸ Snapshotting what is downloadable under the OLD model…"
-psql -q <<'SQL'
-CREATE TABLE _rehearsal_before AS
-SELECT j.event_id, j.type
-  FROM export_job j JOIN event e ON e.id = j.event_id
- WHERE e.export_released_at IS NOT NULL
-   AND j.status = 'done'
-   AND ((j.type = 'zip' AND e.export_zip_ready) OR (j.type = 'html' AND e.export_html_ready));
-
--- For assertion 2: the exact flags a rollback has to reproduce.
-CREATE TABLE _rehearsal_flags AS
-SELECT id, export_zip_ready, export_html_ready FROM event;
-SQL
-
-before=$(psql -tAc "SELECT count(*) FROM _rehearsal_before")
-echo "  → $before (event,type) pair(s) downloadable before."
-
-# The assertion. A symmetric difference of zero means the backfill carried the old notion of
-# "downloadable" across EXACTLY: nothing gained (a stale keepsake resurrected), nothing lost (a
-# guest's keepsake silently 404s).
-assert_up_preserves() {
-  local label="$1" diff
-  diff=$(psql -tAc "
-    SELECT count(*) FROM (
-      (SELECT event_id, type FROM _rehearsal_before
-        EXCEPT SELECT event_id, type FROM export_current WHERE status = 'done')
-      UNION ALL
-      (SELECT event_id, type FROM export_current WHERE status = 'done'
-        EXCEPT SELECT event_id, type FROM _rehearsal_before)
-    ) d")
-  if [[ "$diff" != "0" ]]; then
-    echo "✗ FAIL ($label): $diff (event,type) pair(s) changed downloadability across the migration."
-    psql -c "
-      (SELECT 'LOST — guests can no longer download this' AS problem, event_id, type FROM _rehearsal_before
-        EXCEPT ALL SELECT 'LOST — guests can no longer download this', event_id, type FROM export_current WHERE status='done')
-      UNION ALL
-      (SELECT 'GAINED — a stale keepsake became downloadable', event_id, type FROM export_current WHERE status='done'
-        EXCEPT ALL SELECT 'GAINED — a stale keepsake became downloadable', event_id, type FROM _rehearsal_before)"
-    exit 1
-  fi
-  echo "✓ $label: downloadability preserved exactly ($before pair(s))."
-}
-
-echo "▸ Applying 014 (up)…"
-psql -q < "$MIG_DIR/014_export_epoch.up.sql"
-assert_up_preserves "up"
-
-echo "▸ Applying 014 (down) — the rollback path…"
-psql -q < "$MIG_DIR/014_export_epoch.down.sql"
-
-# The down migration is an inverse UP TO DRIFT, not a bit-exact inverse — deliberately.
-#
-# The old model let a ready flag disagree with its job row (flag TRUE over a running/failed job):
-# the flag was a CACHED copy of a derivation, and keeping a cache in agreement with its source
-# across concurrent workers is precisely what it kept failing at. The down migration re-derives the
-# flags from the epoch state, so such a pair comes back FALSE. That HEALS the drift rather than
-# faithfully restoring corruption, and it costs nothing: a flag over a non-done job had no file to
-# serve (file_path is NULL until the worker finishes), so the old code 404'd on it anyway.
-#
-# What a rollback must NOT do is drop a flag for a keepsake that was genuinely downloadable
-# (flag set AND the job actually done). That is the assertion.
-lost=$(psql -tAc "
-  SELECT count(*) FROM _rehearsal_before b
-   WHERE NOT EXISTS (
-     SELECT 1 FROM event e
-      WHERE e.id = b.event_id
-        AND ((b.type = 'zip' AND e.export_zip_ready) OR (b.type = 'html' AND e.export_html_ready)))")
-if [[ "$lost" != "0" ]]; then
-  echo "✗ FAIL (down): $lost downloadable keepsake(s) lost their ready flag — the rollback is LOSSY."
-  psql -c "
-    SELECT b.event_id, b.type, 'was downloadable, flag not restored' AS problem
-      FROM _rehearsal_before b
-     WHERE NOT EXISTS (
-       SELECT 1 FROM event e
-        WHERE e.id = b.event_id
-          AND ((b.type = 'zip' AND e.export_zip_ready) OR (b.type = 'html' AND e.export_html_ready)))"
-  exit 1
-fi
-echo "✓ down: every downloadable keepsake kept its flag — the old image sees a working state."
-
-healed=$(psql -tAc "
-  SELECT count(*) FROM event e JOIN _rehearsal_flags f ON f.id = e.id
-   WHERE (e.export_zip_ready, e.export_html_ready) IS DISTINCT FROM (f.export_zip_ready, f.export_html_ready)")
-if [[ "$healed" != "0" ]]; then
-  echo "  ℹ $healed event(s) came back with a CLEARED flag that had drifted from its job row."
-  echo "    Not a loss — those had no file to serve. The rollback normalises them; the old code"
-  echo "    will rebuild on the next release. Listing them so the behaviour is not a surprise:"
-  psql -c "SELECT e.id, f.export_zip_ready AS was_zip, e.export_zip_ready AS now_zip,
-                  f.export_html_ready AS was_html, e.export_html_ready AS now_html
-             FROM event e JOIN _rehearsal_flags f ON f.id = e.id
-            WHERE (e.export_zip_ready, e.export_html_ready)
-                  IS DISTINCT FROM (f.export_zip_ready, f.export_html_ready)"
-fi
-
-echo "▸ Re-applying 014 (up) — roll forward after a rollback…"
-psql -q < "$MIG_DIR/014_export_epoch.up.sql"
-assert_up_preserves "up (after rollback)"
-
-echo
-echo "✓ Rehearsal passed. 014 is safe to deploy against this dataset."
-[[ -z "$DUMP" ]] && echo "  (synthetic data — re-run with a real pg_dump before you deploy for real)"
-exit 0

backend/src/auth/jwt.rs

@@ -46,20 +46,10 @@ pub fn create_token(
 }
 
 pub fn verify_token(token: &str, secret: &str) -> Result<Claims, jsonwebtoken::errors::Error> {
-    // We deliberately do NOT enforce the JWT's own `exp`. The authoritative session
-    // lifetime lives in the `session` row (`expires_at > NOW()`), which SLIDES forward on
-    // every authenticated request (see `Session::touch_and_renew`). Enforcing the JWT's
-    // fixed +Nd `exp` here would hard-log-out an actively-used client on day N+1 even
-    // though its session was renewed — the "30-day cliff" from the review. With server-
-    // side sliding sessions, the token is a signature-checked bearer credential and its
-    // lifetime is revocable (logout / expiry / ban all delete the row), which is strictly
-    // stronger than a stateless non-revocable exp.
-    let mut validation = Validation::default();
-    validation.validate_exp = false;
     let data = jsonwebtoken::decode::<Claims>(
         token,
         &DecodingKey::from_secret(secret.as_bytes()),
-        &validation,
+        &Validation::default(),
     )?;
     Ok(data.claims)
 }

backend/src/auth/middleware.rs

@@ -13,10 +13,6 @@ pub struct AuthUser {
     pub user_id: Uuid,
     pub event_id: Uuid,
     pub role: UserRole,
-    /// Live ban flag. Banned users keep *read* access (per USER_JOURNEYS §10), so
-    /// the base extractor does NOT reject them — write handlers and the
-    /// Require{Host,Admin} extractors enforce the ban instead.
-    pub is_banned: bool,
     pub token_hash: String,
 }
 
@@ -37,51 +33,49 @@ impl FromRequestParts<AppState> for AuthUser {
             .strip_prefix("Bearer ")
             .ok_or_else(|| AppError::Unauthorized("Ungültiges Token-Format.".into()))?;
 
-        // Verify the JWT's signature. Expiry is deliberately NOT enforced here (see
-        // `jwt::verify_token`) — the authoritative, sliding session lifetime lives in the
-        // `session` row read below. We also don't trust the token's role/ban claims; the
-        // live user row is authoritative, so the decoded claims aren't needed beyond this.
-        jwt::verify_token(token, &state.config.jwt_secret)
+        let claims = jwt::verify_token(token, &state.config.jwt_secret)
             .map_err(|_| AppError::Unauthorized("Token ungültig oder abgelaufen.".into()))?;
 
         let token_hash = jwt::hash_token(token);
 
-        // Single round-trip: resolve the session token to its *live* user row. A
-        // role/ban stored in the token would survive a demote/ban for the full session
-        // lifetime (up to 30d), so we always re-read the user (a demoted host loses host
-        // powers immediately). We do NOT reject banned users here — they retain read
-        // access by design; writes and host/admin actions enforce the ban downstream.
-        let user = Session::find_user_by_token_hash(&state.pool, &token_hash)
+        // Reconcile the session against the live `user` row. We do NOT trust the
+        // JWT claims for role/ban/event — a token can outlive a ban or demotion
+        // (default lifetime 30 days). The single JOIN query is the same number
+        // of round-trips as the old existence check.
+        let ctx = Session::find_auth_context(&state.pool, &token_hash)
             .await
             .map_err(|e| AppError::Internal(e.into()))?
-            .ok_or_else(|| {
-                AppError::Unauthorized("Sitzung nicht gefunden oder abgelaufen.".into())
-            })?;
+            .ok_or_else(|| AppError::Unauthorized("Sitzung nicht gefunden oder abgelaufen.".into()))?;
 
-        // Touch last_seen_at AND slide the session's expiry forward (fire-and-forget), so
-        // an active client's session renews instead of hitting the fixed 30-day cliff.
-        // Admin sessions keep their tighter 1-day window (they renew on activity but still
-        // lapse a day after the admin goes idle). Failures are non-fatal but worth
-        // surfacing — silent swallowing hides DB connection pressure that would otherwise
-        // be the first symptom of a real problem.
+        // Ban takes effect immediately on the next request, regardless of the
+        // token's remaining lifetime.
+        if ctx.is_banned {
+            return Err(AppError::Forbidden("Du bist gesperrt.".into()));
+        }
+
+        // Defend against a JWT that was issued for a different user/event than
+        // the session's DB row points at (e.g. a swapped or replayed token).
+        if claims.sub != ctx.user_id || claims.event_id != ctx.event_id {
+            return Err(AppError::Unauthorized("Token passt nicht zur Sitzung.".into()));
+        }
+
+        // Update last_seen_at in the background (fire-and-forget). Failures are
+        // non-fatal but worth surfacing — silent swallowing hides DB connection
+        // pressure that would otherwise be the first symptom of a real problem.
         let pool = state.pool.clone();
-        let touch_hash = token_hash.clone();
-        let expiry_days = if user.role == UserRole::Admin {
-            1
-        } else {
-            state.config.session_expiry_days
-        };
+        let session_id = ctx.session_id;
         tokio::spawn(async move {
-            if let Err(e) = Session::touch_and_renew(&pool, &touch_hash, expiry_days).await {
-                tracing::warn!(error = ?e, "session touch/renew failed");
+            if let Err(e) = Session::touch(&pool, session_id).await {
+                tracing::warn!(error = ?e, session_id = %session_id, "session touch failed");
             }
         });
 
         Ok(Self {
-            user_id: user.id,
-            event_id: user.event_id,
-            role: user.role,
-            is_banned: user.is_banned,
+            user_id: ctx.user_id,
+            event_id: ctx.event_id,
+            // Live role from the DB, not the claim — demotion/promotion takes
+            // effect on the next request.
+            role: ctx.role,
             token_hash,
         })
     }
@@ -98,9 +92,6 @@ impl FromRequestParts<AppState> for RequireHost {
         state: &AppState,
     ) -> Result<Self, Self::Rejection> {
         let auth = AuthUser::from_request_parts(parts, state).await?;
-        if auth.is_banned {
-            return Err(AppError::Forbidden("Du bist gesperrt.".into()));
-        }
         match auth.role {
             UserRole::Host | UserRole::Admin => Ok(Self(auth)),
             _ => Err(AppError::Forbidden("Nur für Hosts und Admins.".into())),
@@ -119,9 +110,6 @@ impl FromRequestParts<AppState> for RequireAdmin {
         state: &AppState,
     ) -> Result<Self, Self::Rejection> {
         let auth = AuthUser::from_request_parts(parts, state).await?;
-        if auth.is_banned {
-            return Err(AppError::Forbidden("Du bist gesperrt.".into()));
-        }
         match auth.role {
             UserRole::Admin => Ok(Self(auth)),
             _ => Err(AppError::Forbidden("Nur für Admins.".into())),

backend/src/config.rs

@@ -1,120 +1,11 @@
 use std::path::PathBuf;
 
-use anyhow::{Context, Result, anyhow};
+use anyhow::{anyhow, Context, Result};
 
 /// Well-known dev JWT secret shipped in `.env.example`. If APP_ENV=production
 /// we refuse to start with this value; otherwise we warn loudly.
 const DEV_JWT_SECRET_SENTINEL: &str = "dev_secret_do_not_use_in_production_32byteslong_aaaa";
 
-/// A secret is "placeholder-ish" if it's the shipped dev sentinel or still carries
-/// the tell-tale scaffolding substrings from `.env.example`. Length alone is not
-/// enough — the shipped `change_me_...` placeholder is >32 chars.
-fn looks_placeholder(s: &str) -> bool {
-    let lower = s.to_ascii_lowercase();
-    s == DEV_JWT_SECRET_SENTINEL
-        || lower.contains("change_me")
-        || lower.contains("dev_secret")
-        || lower.contains("placeholder")
-}
-
-/// A bcrypt hash is exactly 60 characters and opens with `$2<variant>$<cost>$`.
-///
-/// Checking the SHAPE, not just placeholder-ness, is what catches a hash silently mangled in
-/// transit. The `$` segments are variable-expansion bait for both shell quoting and Docker
-/// Compose's `env_file` parsing, and a mangled hash is not a placeholder — so without this it
-/// passes every other guard here, the app boots green, `/health` returns `ok`, and every admin
-/// login 401s.
-///
-/// That failure is unrecoverable mid-event, which is why it is worth a hard fail at boot: the
-/// Admin row is created BY a successful admin login (`auth/handlers.rs`), and only an Admin or
-/// Host can promote a Host. No admin login therefore means no host at all — the event cannot be
-/// closed, the gallery cannot be released, and nothing can be moderated.
-fn looks_bcrypt(s: &str) -> bool {
-    let b = s.as_bytes();
-    s.len() == 60
-        && b[0] == b'$'
-        && b[1] == b'2'
-        && matches!(b[2], b'a' | b'b' | b'x' | b'y')
-        && b[3] == b'$'
-        && b[4].is_ascii_digit()
-        && b[5].is_ascii_digit()
-        && b[6] == b'$'
-}
-
-/// Enforce secret hygiene. In production every guard is hard-fail: a booting app
-/// with a publicly-known signing key is worse than one that refuses to start.
-/// Outside production the dev sentinel is tolerated (warned) so local dev is frictionless.
-///
-/// EVERY failure is collected and reported together. Returning on the first one made fixing two
-/// secrets cost two boot cycles — the operator rotates JWT_SECRET, restarts, and only then learns
-/// about ADMIN_PASSWORD_HASH. Restarting this stack is not free (Caddy waits on the unhealthy app),
-/// and each avoidable cycle is another chance to reach for `down -v`.
-fn validate_secrets(
-    is_prod: bool,
-    jwt_secret: &str,
-    admin_password_hash: &str,
-    database_url: &str,
-) -> Result<()> {
-    if is_prod {
-        let mut problems: Vec<&str> = Vec::new();
-        if looks_placeholder(jwt_secret) {
-            problems.push(
-                "JWT_SECRET is still the .env.example placeholder — rotate it \
-                 (openssl rand -hex 64).",
-            );
-        } else if jwt_secret.len() < 32 {
-            problems.push("JWT_SECRET must be at least 32 characters.");
-        }
-        if admin_password_hash.is_empty() || looks_placeholder(admin_password_hash) {
-            problems.push(
-                "ADMIN_PASSWORD_HASH is unset or still the .env.example placeholder — generate one \
-                 (docker run --rm caddy:2-alpine caddy hash-password --plaintext '<password>').",
-            );
-        } else if !looks_bcrypt(admin_password_hash) {
-            problems.push(
-                "ADMIN_PASSWORD_HASH is not a well-formed bcrypt hash: expected exactly 60 \
-                 characters starting `$2b$12$…`. First look at the value that actually reached \
-                 the app — `docker compose exec app printenv ADMIN_PASSWORD_HASH` — and compare \
-                 it to .env character for character. In .env, SINGLE-QUOTE the hash \
-                 ('$2b$12$…'): Compose uses single-quoted env_file values literally, so the `$` \
-                 segments survive. Double them to `$$` ONLY when setting the value under \
-                 `environment:` in docker-compose.yml — doing that in .env corrupts a hash that \
-                 would otherwise have worked. Regenerate with: \
-                 docker run --rm caddy:2-alpine caddy hash-password --plaintext '<password>'",
-            );
-        }
-        // The DATABASE_URL carries the Postgres password, so a placeholder here means the stack is
-        // running on `CHANGE_ME_use_a_strong_password` — a credential published in the repo. The
-        // app used to boot green on it, because this guard only ever covered the two secrets it
-        // was written for and nothing else looked at POSTGRES_PASSWORD at all.
-        //
-        // Read POSTGRES_PASSWORD's docs before changing this: it is applied ONLY at initdb, so the
-        // remedy is not "edit .env and restart" — see the 28P01 diagnostic in db.rs.
-        if looks_placeholder(database_url) {
-            problems.push(
-                "DATABASE_URL still carries the .env.example placeholder password — set a strong \
-                 one (openssl rand -hex 24) in BOTH DATABASE_URL and POSTGRES_PASSWORD.",
-            );
-        }
-        if !problems.is_empty() {
-            return Err(anyhow!(
-                "Refusing to start in production — {} secret(s) still unset or placeholder:\n  - {}\n\
-                 ALL secrets must be set BEFORE the first `docker compose up -d`: Postgres bakes \
-                 POSTGRES_PASSWORD into its data directory on first boot and ignores later changes.",
-                problems.len(),
-                problems.join("\n  - ")
-            ));
-        }
-    } else if jwt_secret == DEV_JWT_SECRET_SENTINEL {
-        tracing::warn!(
-            "JWT_SECRET is the dev sentinel — fine for local development, NEVER ship this."
-        );
-    } else if jwt_secret.len() < 32 {
-        return Err(anyhow!("JWT_SECRET must be at least 32 characters."));
-    }
-    Ok(())
-}
-
 #[derive(Clone, Debug)]
 pub struct AppConfig {
     pub database_url: String,
@@ -124,318 +15,63 @@ pub struct AppConfig {
     pub event_name: String,
     pub event_slug: String,
     pub media_path: PathBuf,
-    /// Where export archives are written. MUST be outside `media_path` — that
-    /// directory is served by a public `ServeDir`, so a predictable archive name
-    /// under it would leak the whole gallery to anonymous visitors.
-    pub export_path: PathBuf,
     pub app_port: u16,
-    /// Number of concurrent media compression workers (read once at boot).
-    pub compression_concurrency: usize,
-    /// Master switch for the comment feature (env `COMMENTS_ENABLED`, default true).
-    /// When false the backend rejects new comments and the frontend hides the whole
-    /// comment UI. Existing comments stay in the DB (hidden), so flipping it back
-    /// restores them. Boot-time immutable, like `compression_concurrency`.
-    pub comments_enabled: bool,
-    /// Default colour theme, used as the fallback when the DB config keys are unset.
-    /// Runtime overrides live in the `config` table (admin UI); these env vars only
-    /// seed the initial default. `preset` is an id the frontend knows (e.g.
-    /// "champagne-gold", "rose", … or "custom"); the two seeds are `#rrggbb` brand +
-    /// accent colours the whole palette is derived from.
-    pub default_theme_preset: String,
-    pub default_theme_primary: String,
-    pub default_theme_accent: String,
-}
-
-/// The shipped default brand/accent seed (champagne gold — matches the hand-tuned
-/// ramp in tailwind-theme.css). Kept here so an unset env still yields the current look.
-const DEFAULT_THEME_SEED: &str = "#8a6a2b";
-
-/// Upper bound on `SESSION_EXPIRY_DAYS`. ~10 years — absurdly generous for a one-evening event,
-/// and low enough that `chrono::Duration::days` cannot overflow downstream.
-const MAX_SESSION_EXPIRY_DAYS: i64 = 3650;
-
-/// Parse and RANGE-CHECK `SESSION_EXPIRY_DAYS`. Refusing to boot is the whole point.
-///
-/// This was `.parse().context(...)` with no bounds, and both ends of the range were live faults
-/// that a green health check hid completely (H7):
-///
-///   * A huge value made `chrono::Duration::days` PANIC on every `/join`, `/recover` and
-///     `/admin/login`. There is no `CatchPanicLayer`, so the client got a connection reset with no
-///     HTTP response at all — the app was up, healthy, and unable to authenticate anybody.
-///   * Zero or negative created every session already-expired: `/join` returns 201 with a token,
-///     and then every authenticated request 401s. A guest joins successfully and the app
-///     immediately behaves as though they never did.
-///
-/// Both booted green because `/health` only probes the database. A bad value must stop the
-/// container instead, where the operator sees it.
-fn parse_session_expiry_days(raw: Option<&str>) -> Result<i64> {
-    let Some(raw) = raw else { return Ok(30) };
-    let trimmed = raw.trim();
-    if trimmed.is_empty() {
-        return Ok(30);
-    }
-    let days: i64 = trimmed
-        .parse()
-        .with_context(|| format!("SESSION_EXPIRY_DAYS must be a whole number (got {trimmed:?})"))?;
-    if days < 1 {
-        return Err(anyhow!(
-            "SESSION_EXPIRY_DAYS must be at least 1 (got {days}). Zero or negative makes every \
-             session expire the moment it is created: /join succeeds and every request after it \
-             returns 401."
-        ));
-    }
-    if days > MAX_SESSION_EXPIRY_DAYS {
-        return Err(anyhow!(
-            "SESSION_EXPIRY_DAYS must be at most {MAX_SESSION_EXPIRY_DAYS} (got {days}). Larger \
-             values overflow the token-expiry arithmetic and panic on every auth request."
-        ));
-    }
-    Ok(days)
 }
 
 impl AppConfig {
     pub fn from_env() -> Result<Self> {
-        let app_env = std::env::var("APP_ENV").unwrap_or_else(|_| "development".to_string());
+        let app_env =
+            std::env::var("APP_ENV").unwrap_or_else(|_| "development".to_string());
         let is_prod = app_env.eq_ignore_ascii_case("production");
 
         let jwt_secret = std::env::var("JWT_SECRET").context("JWT_SECRET must be set")?;
-        let admin_password_hash = std::env::var("ADMIN_PASSWORD_HASH").unwrap_or_default();
-        let database_url = std::env::var("DATABASE_URL").context("DATABASE_URL must be set")?;
+        // A weak/placeholder signing key lets anyone forge any token (including
+        // admin). Detect the known dev sentinel, the `.env.example` placeholder,
+        // and anything that smells like an unreplaced template value.
+        let lower = jwt_secret.to_ascii_lowercase();
+        let looks_placeholder = jwt_secret == DEV_JWT_SECRET_SENTINEL
+            || lower.contains("change")
+            || lower.contains("example")
+            || lower.contains("placeholder")
+            || lower.contains("replace");
 
-        validate_secrets(is_prod, &jwt_secret, &admin_password_hash, &database_url)?;
+        if is_prod {
+            // Production must use a real, strong secret — no placeholders, ≥64
+            // chars (an `openssl rand -hex 64` is 128 hex chars).
+            if looks_placeholder || jwt_secret.len() < 64 {
+                return Err(anyhow!(
+                    "Refusing to start in production: JWT_SECRET is a placeholder or too short. \
+                     Generate a real one (openssl rand -hex 64) and set it in the prod environment."
+                ));
+            }
+        } else if looks_placeholder || jwt_secret.len() < 32 {
+            tracing::warn!(
+                "JWT_SECRET looks like a dev/placeholder value — fine for local development, \
+                 NEVER ship this to production."
+            );
+        }
 
         Ok(Self {
-            database_url,
+            database_url: std::env::var("DATABASE_URL")
+                .context("DATABASE_URL must be set")?,
             jwt_secret,
-            session_expiry_days: parse_session_expiry_days(
-                std::env::var("SESSION_EXPIRY_DAYS").ok().as_deref(),
-            )?,
-            admin_password_hash,
-            event_name: std::env::var("EVENT_NAME").unwrap_or_else(|_| "EventSnap".to_string()),
-            event_slug: std::env::var("EVENT_SLUG").context("EVENT_SLUG must be set")?,
+            session_expiry_days: std::env::var("SESSION_EXPIRY_DAYS")
+                .unwrap_or_else(|_| "30".to_string())
+                .parse()
+                .context("SESSION_EXPIRY_DAYS must be a number")?,
+            admin_password_hash: std::env::var("ADMIN_PASSWORD_HASH")
+                .unwrap_or_default(),
+            event_name: std::env::var("EVENT_NAME")
+                .unwrap_or_else(|_| "EventSnap".to_string()),
+            event_slug: std::env::var("EVENT_SLUG")
+                .context("EVENT_SLUG must be set")?,
             media_path: PathBuf::from(
                 std::env::var("MEDIA_PATH").unwrap_or_else(|_| "/media".to_string()),
             ),
-            export_path: PathBuf::from(
-                std::env::var("EXPORT_PATH").unwrap_or_else(|_| "/exports".to_string()),
-            ),
             app_port: std::env::var("APP_PORT")
                 .unwrap_or_else(|_| "3000".to_string())
                 .parse()
                 .context("APP_PORT must be a number")?,
-            compression_concurrency: std::env::var("COMPRESSION_WORKER_CONCURRENCY")
-                .ok()
-                .and_then(|v| v.parse().ok())
-                .filter(|&n| n >= 1)
-                .unwrap_or(2),
-            comments_enabled: std::env::var("COMMENTS_ENABLED")
-                .map(|v| {
-                    !matches!(
-                        v.trim().to_ascii_lowercase().as_str(),
-                        "false" | "0" | "no" | "off"
-                    )
-                })
-                .unwrap_or(true),
-            default_theme_preset: std::env::var("THEME_PRESET")
-                .unwrap_or_else(|_| "champagne-gold".to_string()),
-            default_theme_primary: std::env::var("THEME_PRIMARY")
-                .unwrap_or_else(|_| DEFAULT_THEME_SEED.to_string()),
-            default_theme_accent: std::env::var("THEME_ACCENT")
-                .unwrap_or_else(|_| DEFAULT_THEME_SEED.to_string()),
         })
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    const REAL_SECRET: &str = "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2";
-    // A structurally valid bcrypt hash: exactly 60 chars, `$2y$12$` + 53 of salt/digest.
-    // The shape matters — `looks_bcrypt` enforces it, so a fixture of the wrong length
-    // would assert the opposite of what these tests claim.
-    const REAL_HASH: &str = "$2y$12$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXY01";
-    const REAL_DB_URL: &str = "postgres://eventsnap:7f3a9c1e5b2d8a4f@db:5432/eventsnap";
-
-    #[test]
-    fn prod_rejects_shipped_placeholder_secret() {
-        // The exact string shipped in `.env` — >32 chars, so it must be caught by
-        // the substring guard, not the length check.
-        let err = validate_secrets(
-            true,
-            "change_me_to_a_random_64_byte_hex_string",
-            REAL_HASH,
-            REAL_DB_URL,
-        );
-        assert!(
-            err.is_err(),
-            "placeholder JWT_SECRET must be rejected in prod"
-        );
-    }
-
-    #[test]
-    fn prod_rejects_dev_sentinel_and_short_secret() {
-        assert!(validate_secrets(true, DEV_JWT_SECRET_SENTINEL, REAL_HASH, REAL_DB_URL).is_err());
-        assert!(validate_secrets(true, "tooshort", REAL_HASH, REAL_DB_URL).is_err());
-    }
-
-    /// The failure this guards is silent and unrecoverable mid-event: a hash whose `$`
-    /// segments were eaten by shell or Compose interpolation is NOT a placeholder, so every
-    /// other guard passes, the app boots green and `/health` reports ok — and then every
-    /// admin login 401s, which (because the Admin row is created by a successful login, and
-    /// only an Admin/Host can promote a Host) means no host exists for the whole event.
-    #[test]
-    fn prod_rejects_mangled_admin_hash() {
-        // What `$2y$12$…` degrades to once `$2y`/`$12` are read as unset variables.
-        assert!(validate_secrets(true, REAL_SECRET, "abcdefghijklmnop", REAL_DB_URL).is_err());
-        // Right prefix, truncated body — still not a usable hash.
-        assert!(validate_secrets(true, REAL_SECRET, "$2y$12$tooshort", REAL_DB_URL).is_err());
-        // Correct length but no bcrypt prefix at all.
-        assert!(validate_secrets(true, REAL_SECRET, &"x".repeat(60), REAL_DB_URL).is_err());
-        // All three shipped bcrypt variants stay acceptable.
-        let body = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXY01";
-        for variant in ["2a", "2b", "2y"] {
-            let hash = format!("${variant}$12${body}");
-            assert_eq!(hash.len(), 60);
-            assert!(
-                validate_secrets(true, REAL_SECRET, &hash, REAL_DB_URL).is_ok(),
-                "bcrypt variant ${variant}$ must be accepted"
-            );
-        }
-    }
-
-    #[test]
-    fn prod_rejects_missing_or_placeholder_admin_hash() {
-        assert!(validate_secrets(true, REAL_SECRET, "", REAL_DB_URL).is_err());
-        assert!(
-            validate_secrets(
-                true,
-                REAL_SECRET,
-                "$2y$12$placeholder_replace_me",
-                REAL_DB_URL
-            )
-            .is_err()
-        );
-    }
-
-    /// The stack used to come up GREEN on the database password published in the repo: this guard
-    /// covered the two secrets it was written for, and nothing anywhere looked at the Postgres
-    /// credential. README step 2 doesn't name POSTGRES_PASSWORD either, so following the
-    /// documented procedure verbatim shipped it.
-    #[test]
-    fn prod_rejects_the_shipped_placeholder_database_password() {
-        let shipped = "postgres://eventsnap:CHANGE_ME_use_a_strong_password@db:5432/eventsnap";
-        let err = validate_secrets(true, REAL_SECRET, REAL_HASH, shipped).unwrap_err();
-        assert!(
-            err.to_string().contains("DATABASE_URL"),
-            "the refusal must name DATABASE_URL, not just fail: {err}"
-        );
-        // And it must point at the initdb trap, or the operator edits .env, restarts, and lands
-        // in a permanent auth-failure loop instead.
-        assert!(
-            err.to_string().contains("POSTGRES_PASSWORD"),
-            "the refusal must name POSTGRES_PASSWORD as the other half: {err}"
-        );
-    }
-
-    /// Every problem in ONE message. Reporting them one per boot made fixing two secrets cost two
-    /// restart cycles, on a stack where Caddy waits on the unhealthy app the whole time.
-    #[test]
-    fn prod_reports_every_placeholder_at_once() {
-        let err = validate_secrets(
-            true,
-            "change_me_to_a_random_64_byte_hex_string",
-            "$2y$12$placeholder_replace_me",
-            "postgres://eventsnap:CHANGE_ME_use_a_strong_password@db:5432/eventsnap",
-        )
-        .unwrap_err()
-        .to_string();
-        for expected in ["JWT_SECRET", "ADMIN_PASSWORD_HASH", "DATABASE_URL"] {
-            assert!(err.contains(expected), "{expected} missing from: {err}");
-        }
-        assert!(
-            err.contains("3 secret(s)"),
-            "the count must match what is listed: {err}"
-        );
-    }
-
-    #[test]
-    fn prod_accepts_real_secrets() {
-        assert!(validate_secrets(true, REAL_SECRET, REAL_HASH, REAL_DB_URL).is_ok());
-    }
-
-    /// A real password that happens to contain no placeholder substring must pass — including one
-    /// with URL-ish punctuation, so the guard can't be mistaken for a URL validator.
-    #[test]
-    fn prod_accepts_a_real_database_url_with_awkward_punctuation() {
-        assert!(
-            validate_secrets(
-                true,
-                REAL_SECRET,
-                REAL_HASH,
-                "postgres://eventsnap:aB3%24xY9-_.qW@db:5432/eventsnap"
-            )
-            .is_ok()
-        );
-    }
-
-    /// The e2e stack runs without APP_ENV=production, so none of this applies there — but assert
-    /// it, because a guard that tripped in e2e would be found the hard way.
-    #[test]
-    fn non_prod_ignores_a_placeholder_database_url() {
-        assert!(
-            validate_secrets(
-                false,
-                REAL_SECRET,
-                "",
-                "postgres://eventsnap:CHANGE_ME_use_a_strong_password@db:5432/eventsnap"
-            )
-            .is_ok()
-        );
-    }
-
-    #[test]
-    fn non_prod_tolerates_dev_sentinel() {
-        assert!(validate_secrets(false, DEV_JWT_SECRET_SENTINEL, "", REAL_DB_URL).is_ok());
-    }
-
-    #[test]
-    fn non_prod_still_rejects_short_non_sentinel_secret() {
-        assert!(validate_secrets(false, "tooshort", "", REAL_DB_URL).is_err());
-    }
-
-    #[test]
-    fn placeholder_detection_is_case_insensitive() {
-        // looks_placeholder lowercases before matching — an upper/mixed-case
-        // placeholder must still be rejected in prod.
-        assert!(
-            validate_secrets(
-                true,
-                "CHANGE_ME_TO_A_RANDOM_64_BYTE_HEX_STRING",
-                REAL_HASH,
-                REAL_DB_URL
-            )
-            .is_err()
-        );
-        assert!(
-            validate_secrets(
-                true,
-                REAL_SECRET,
-                "$2Y$12$PLACEHOLDER_replace_me",
-                REAL_DB_URL
-            )
-            .is_err()
-        );
-    }
-
-    #[test]
-    fn prod_len_boundary_at_32() {
-        // Exactly 32 non-placeholder chars is the minimum accepted; 31 is rejected.
-        const LEN_32: &str = "abcdefghijklmnopqrstuvwxyz012345";
-        const LEN_31: &str = "abcdefghijklmnopqrstuvwxyz01234";
-        assert_eq!(LEN_32.len(), 32);
-        assert_eq!(LEN_31.len(), 31);
-        assert!(validate_secrets(true, LEN_32, REAL_HASH, REAL_DB_URL).is_ok());
-        assert!(validate_secrets(true, LEN_31, REAL_HASH, REAL_DB_URL).is_err());
-    }
-}

backend/src/db.rs

@@ -1,132 +1,25 @@
 use anyhow::{Context, Result};
-use sqlx::PgPool;
 use sqlx::postgres::PgPoolOptions;
+use sqlx::PgPool;
 
-/// Keep in step with `.env.example` and the `db` sizing comment in `docker-compose.yml`.
-/// These three drifted apart once (code 10 / `.env.example` 15 / runbook 30) and the runbook
-/// presented its number as authoritative, so the contradiction was invisible at deploy time.
-/// 15 is sized to 2 vCPU and the 1G `db` memory limit — raise it only alongside both.
-const DEFAULT_MAX_CONNECTIONS: u32 = 15;
-
-/// SQLSTATE for `invalid_password`.
-const PG_INVALID_PASSWORD: &str = "28P01";
-
-/// Turn the one connect failure with an unguessable cause into a self-explaining one.
-///
-/// `POSTGRES_PASSWORD` is honoured ONLY when Postgres initialises its data directory. Change it in
-/// `.env` afterwards and the app authenticates with the new password against a volume that still
-/// holds the old one — a permanent restart loop whose only symptom is
-/// `password authentication failed`.
-///
-/// The production secret guard makes that sequence NEARLY CERTAIN rather than rare: it stops the
-/// app on the first `docker compose up -d`, but not the `db` service in that same command, which
-/// initialises and bakes in whatever password was in `.env` at that moment. So the intended
-/// recovery — see the refusal, fix your secrets, boot again — is exactly the sequence that breaks
-/// it. Nothing in the error names the cause, and the remedy destroys data, so it is the last thing
-/// an operator should guess at.
-fn explain_auth_failure(err: &sqlx::Error) {
-    let is_auth_failure = match err {
-        sqlx::Error::Database(db) => db.code().as_deref() == Some(PG_INVALID_PASSWORD),
-        _ => false,
-    };
-    if !is_auth_failure {
-        return;
-    }
-    tracing::error!(
-        "Postgres rejected the credentials in DATABASE_URL (SQLSTATE {PG_INVALID_PASSWORD}).\n\
-         \n\
-         This almost always means POSTGRES_PASSWORD was changed AFTER the database volume was \
-         first created. Postgres applies that variable only when it initialises its data \
-         directory; editing .env and restarting does not change the stored password, so the two \
-         drift apart permanently.\n\
-         \n\
-         If the event has NOT started and you have no data worth keeping:\n\n    \
-         docker compose down -v && docker compose up -d\n\n\
-         (-v DELETES the database, the uploaded media and the exports. There is no undo.)\n\
-         \n\
-         If you DO have data: restore the old password into DATABASE_URL instead, or change the \
-         stored one with ALTER ROLE inside the running db container. Never reach for -v to fix a \
-         login problem on a live event."
-    );
-}
+const DEFAULT_MAX_CONNECTIONS: u32 = 10;
 
 pub async fn create_pool(database_url: &str) -> Result<PgPool> {
-    // A malformed value must not silently become the default: an operator who typed
-    // `DATABASE_MAX_CONNECTIONS=3O` (letter O) would otherwise get 15 with no indication,
-    // and would keep tuning a knob that never took effect.
-    let max_connections = match std::env::var("DATABASE_MAX_CONNECTIONS") {
-        Err(_) => DEFAULT_MAX_CONNECTIONS,
-        Ok(raw) => match raw.trim().parse::<u32>() {
-            Ok(0) => {
-                anyhow::bail!("DATABASE_MAX_CONNECTIONS must be at least 1 (got 0)");
-            }
-            Ok(n) => n,
-            Err(e) => {
-                anyhow::bail!(
-                    "DATABASE_MAX_CONNECTIONS must be a positive integer (got {raw:?}): {e}"
-                );
-            }
-        },
-    };
+    let max_connections = std::env::var("DATABASE_MAX_CONNECTIONS")
+        .ok()
+        .and_then(|s| s.parse::<u32>().ok())
+        .unwrap_or(DEFAULT_MAX_CONNECTIONS);
 
-    let pool = match PgPoolOptions::new()
+    let pool = PgPoolOptions::new()
         .max_connections(max_connections)
-        // Fail fast instead of parking. sqlx's default is 30s, which on a DB blip means every
-        // request AND all ~100 SSE session revalidations sit on the pool for half a minute
-        // before erroring — the app looks hung rather than degraded, and the backlog outlives
-        // the blip. Five seconds is far longer than a healthy acquire ever takes.
-        .acquire_timeout(std::time::Duration::from_secs(5))
-        // Keep a couple of connections warm so the first request after an idle stretch (the gap
-        // between setting the venue up and the guests arriving) doesn't pay TCP + auth.
-        .min_connections(2)
-        // Bound every statement server-side. Without this a single pathological query holds a
-        // pool slot indefinitely and no client-side timeout can take it back — the slot is only
-        // released when Postgres finishes. `lock_timeout` covers the same hazard for a row lock
-        // contended by, say, a release running against an in-flight upload.
-        .after_connect(|conn, _meta| {
-            Box::pin(async move {
-                // Two statements, two round-trips, deliberately. `sqlx::query` uses the extended
-                // query protocol, which permits exactly ONE statement per call — sending them as
-                // `SET a; SET b` makes every new connection fail, which surfaces as the pool
-                // never opening one at all and `create_pool` reporting a connect timeout.
-                sqlx::query("SET statement_timeout = '15s'")
-                    .execute(&mut *conn)
-                    .await?;
-                sqlx::query("SET lock_timeout = '5s'").execute(conn).await?;
-                Ok(())
-            })
-        })
         .connect(database_url)
         .await
-    {
-        Ok(pool) => pool,
-        Err(e) => {
-            explain_auth_failure(&e);
-            return Err(e).context("failed to connect to database");
-        }
-    };
+        .context("failed to connect to database")?;
 
-    // Migrations run on their OWN connection, deliberately NOT from the pool.
-    //
-    // `after_connect` above puts `lock_timeout = 5s` on every pooled connection, and the migrator
-    // would inherit it. Migrations that take ACCESS EXCLUSIVE (026's index swap, 027's ADD COLUMN)
-    // then turn a short WAIT into a hard FAILURE: anything holding ACCESS SHARE on `upload` or
-    // `"user"` for more than five seconds — the hourly `pg_dump` the runbook installs in §10.2, or
-    // an operator's open `psql` transaction — aborts the migration, `create_pool` returns an
-    // error, `main` exits 1, and `restart: unless-stopped` crash-loops the app behind a live Caddy.
-    // The rollback is clean and a later retry succeeds, which is exactly what makes it a confusing
-    // intermittent outage rather than an obvious one.
-    //
-    // `statement_timeout` is left off here too: a migration on a real table can legitimately run
-    // longer than the 15s a request is allowed.
-    let mut migrator_conn = <sqlx::PgConnection as sqlx::Connection>::connect(database_url)
-        .await
-        .context("failed to open a connection for migrations")?;
     sqlx::migrate!()
-        .run(&mut migrator_conn)
+        .run(&pool)
         .await
         .context("failed to run database migrations")?;
-    let _ = sqlx::Connection::close(migrator_conn).await;
 
     tracing::info!(max_connections, "database connected and migrations applied");
     Ok(pool)

backend/src/error.rs

@@ -6,46 +6,10 @@ pub enum AppError {
     BadRequest(String),
     Unauthorized(String),
     Forbidden(String),
-    /// Uploads are temporarily locked (event closed / gallery released). Distinct from
-    /// `Forbidden` so the client can tell this REVERSIBLE 403 apart from a permanent one
-    /// (banned user, quota): the queued blob is kept and retried if the host reopens,
-    /// instead of being purged like a genuinely-terminal rejection.
-    UploadsLocked(String),
-    /// The gallery has been RELEASED — the keepsake was snapshotted, so a late upload could
-    /// never appear in it. Mechanically this is still reversible (a host reopen clears
-    /// `export_released_at` and bumps the epoch), which is why the blob must still be kept.
-    ///
-    /// Distinct from `UploadsLocked` because the two differ in *expectation*, and the client's
-    /// retry policy has to differ with them. A closed event is a pause the host means to undo;
-    /// a released gallery is the end of the event, and nobody reopens it. Under one shared code
-    /// the queue kept auto-retrying a released event forever — re-streaming a multi-megabyte
-    /// photo over cellular on every budget refill, for a request whose answer will not change,
-    /// while telling the guest to tap a camera button that 403s. `gallery_released` lets the
-    /// client park the item visibly and wait for an actual `event-opened` instead of guessing.
-    GalleryReleased(String),
-    /// The uploader is banned. A 403 like `Forbidden`, but tagged `user_banned` so the client
-    /// keeps the queued blob instead of purging it.
-    ///
-    /// A ban is reversible — `unban_user` exists, and the host's own confirm copy promises the
-    /// photos come back — but the client classified the generic `forbidden` code as permanent,
-    /// deleted the blob from IndexedDB, and moved the row to `blocked`, which has no retry
-    /// button. So an unban could restore everything except the photos that were in flight when
-    /// the ban landed, and a ban issued by mistake destroyed them with no way back.
-    UserBanned(String),
     NotFound(String),
     Conflict(String),
     /// Second field: optional retry-after seconds to include in the response.
     TooManyRequests(String, Option<u64>),
-    /// Per-user storage quota exhausted. Distinct from `TooManyRequests` (rate limit) so
-    /// the client can treat it as *terminal* (413, no retry) instead of backing off and
-    /// retrying a permanently-failing upload forever.
-    QuotaExceeded(String),
-    /// The server is temporarily unable to serve this request — currently only pool
-    /// saturation. Distinct from `Internal` because it is TRANSIENT and the client should be
-    /// told so: a 500 reads as "this request is broken", while a 503 + Retry-After reads as
-    /// "come back shortly", which is what the upload queue's retry classifier needs to make
-    /// the right call. Second field: optional retry-after seconds.
-    ServiceUnavailable(String, Option<u64>),
     Internal(anyhow::Error),
 }
 
@@ -55,16 +19,9 @@ impl AppError {
             Self::BadRequest(_) => (StatusCode::BAD_REQUEST, "bad_request"),
             Self::Unauthorized(_) => (StatusCode::UNAUTHORIZED, "unauthorized"),
             Self::Forbidden(_) => (StatusCode::FORBIDDEN, "forbidden"),
-            Self::UploadsLocked(_) => (StatusCode::FORBIDDEN, "uploads_locked"),
-            Self::GalleryReleased(_) => (StatusCode::FORBIDDEN, "gallery_released"),
-            Self::UserBanned(_) => (StatusCode::FORBIDDEN, "user_banned"),
             Self::NotFound(_) => (StatusCode::NOT_FOUND, "not_found"),
             Self::Conflict(_) => (StatusCode::CONFLICT, "conflict"),
             Self::TooManyRequests(..) => (StatusCode::TOO_MANY_REQUESTS, "too_many_requests"),
-            Self::QuotaExceeded(_) => (StatusCode::PAYLOAD_TOO_LARGE, "quota_exceeded"),
-            Self::ServiceUnavailable(..) => {
-                (StatusCode::SERVICE_UNAVAILABLE, "service_unavailable")
-            }
             Self::Internal(_) => (StatusCode::INTERNAL_SERVER_ERROR, "internal_error"),
         }
     }
@@ -74,14 +31,9 @@ impl AppError {
             Self::BadRequest(msg)
             | Self::Unauthorized(msg)
             | Self::Forbidden(msg)
-            | Self::UploadsLocked(msg)
-            | Self::GalleryReleased(msg)
-            | Self::UserBanned(msg)
             | Self::NotFound(msg)
             | Self::Conflict(msg) => msg.clone(),
             Self::TooManyRequests(msg, _) => msg.clone(),
-            Self::ServiceUnavailable(msg, _) => msg.clone(),
-            Self::QuotaExceeded(msg) => msg.clone(),
             Self::Internal(err) => {
                 tracing::error!("internal error: {err:#}");
                 "Ein interner Fehler ist aufgetreten.".to_string()
@@ -93,61 +45,13 @@ impl AppError {
 impl IntoResponse for AppError {
     fn into_response(self) -> Response {
         let (status, code) = self.status_and_code();
-        // BOTH retry-carrying variants must be matched here. `message()` would fail to
-        // compile on a missing arm; this one would not — it would silently drop the header and
-        // the `retry_after_secs` body field, which is exactly the sort of omission that only
-        // shows up under the load the 503 exists for.
-        let retry_after_secs = match &self {
-            Self::TooManyRequests(_, secs) | Self::ServiceUnavailable(_, secs) => *secs,
-            _ => None,
+        let retry_after_secs = if let Self::TooManyRequests(_, Some(secs)) = &self {
+            Some(*secs)
+        } else {
+            None
         };
         let message = self.message();
 
-        // Log every 4xx. Until now they were invisible at ANY log level: tower_http's
-        // `ServerErrorsAsFailures` classifier counts a 4xx as a *success*, so it goes to
-        // `DefaultOnResponse` at DEBUG, and production runs at `info`. The consequence is that a
-        // misconfigured limit leaves no trace at all — if guests spend the evening hitting 429s
-        // on `upload_rate_per_hour`, or 413s on the storage quota, `docker compose logs` after
-        // the event contains nothing about it and the cause is unknowable.
-        //
-        // WARN rather than INFO because every variant here is a request that did not do what
-        // the guest asked. 5xx is excluded: `Internal` already logs with its full source chain
-        // in `message()` above, and the pool-exhaustion 503 logs at construction — logging again
-        // here would double every server-side failure.
-        //
-        // No request context is available: `into_response` receives only the error, so there is
-        // no path, method or user id to attach. Status + code + message is what can honestly be
-        // reported from here, and it is enough to see the SHAPE of a bad evening. Raising
-        // `tower_http` to DEBUG instead was considered and rejected — see the note in main.rs.
-        //
-        // `detail = ?message`, NOT `%message`. Two reasons, both learned the hard way:
-        //
-        //  * `message` is tracing's own reserved field for an event's format literal, so `%message`
-        //    printed unlabelled and would collide under a JSON layer.
-        //  * Debug formatting QUOTES AND ESCAPES the string, and several 4xx messages interpolate
-        //    attacker-chosen text — the guest's name in `Der Name "X" ist bereits vergeben.`, and
-        //    multipart/parse errors that echo their input. With Display formatting, a value
-        //    carrying a newline plus a plausible log prefix lets two unauthenticated requests
-        //    forge lines in the only forensic record an unattended event has.
-        //    `validate_display_name` now rejects control characters, so the name route is closed
-        //    at the source as well — but that is ONE input, and this line formats every 4xx
-        //    message in the app. Escaping here is what makes the guarantee general; do not
-        //    "simplify" it to `%message` on the grounds that names are already validated.
-        //
-        // 401 and 404 are logged at DEBUG rather than WARN. They carry no operator signal (an
-        // expired session, a mistyped URL) and they are the cheapest lines for a scanner to
-        // generate — at ~260 bytes each against the 30 MB the json-file driver retains
-        // (docker-compose.yml), a sustained flood could otherwise roll the whole window in
-        // minutes and destroy the post-event forensics this logging exists to provide.
-        if status.is_client_error() {
-            let noisy = status == StatusCode::UNAUTHORIZED || status == StatusCode::NOT_FOUND;
-            if noisy {
-                tracing::debug!(status = status.as_u16(), code, detail = ?message, "request rejected");
-            } else {
-                tracing::warn!(status = status.as_u16(), code, detail = ?message, "request rejected");
-            }
-        }
-
         let mut body = serde_json::json!({
             "error": code,
             "message": message,
@@ -158,11 +62,10 @@ impl IntoResponse for AppError {
         }
 
         let mut resp = (status, axum::Json(body)).into_response();
-        if let Some(secs) = retry_after_secs
-            && let Ok(val) = axum::http::HeaderValue::from_str(&secs.to_string())
-        {
-            resp.headers_mut()
-                .insert(axum::http::header::RETRY_AFTER, val);
+        if let Some(secs) = retry_after_secs {
+            if let Ok(val) = axum::http::HeaderValue::from_str(&secs.to_string()) {
+                resp.headers_mut().insert(axum::http::header::RETRY_AFTER, val);
+            }
         }
         resp
     }
@@ -176,120 +79,6 @@ impl From<anyhow::Error> for AppError {
 
 impl From<sqlx::Error> for AppError {
     fn from(err: sqlx::Error) -> Self {
-        match err {
-            // Pool saturation is load, not a bug. Reporting it as a 500 was actively harmful:
-            // the frontend's upload-queue classifier treats 5xx as transient and retries, so
-            // the retries piled straight back into the saturated pool with no Retry-After to
-            // pace them. A 503 says the same thing honestly and carries the backoff.
-            //
-            // `PoolClosed` stays `Internal` — it only happens during shutdown, where a 503
-            // would invite a retry against a server that is going away.
-            sqlx::Error::PoolTimedOut => {
-                tracing::warn!("database pool exhausted; shedding a request with 503");
-                Self::ServiceUnavailable(
-                    "Server ist gerade ausgelastet. Bitte versuche es in ein paar Sekunden erneut."
-                        .into(),
-                    Some(POOL_TIMEOUT_RETRY_AFTER_SECS),
-                )
-            }
-            other => Self::Internal(other.into()),
-        }
-    }
-}
-
-/// Retry-After for a shed request. Short: pool saturation clears in seconds once the queue
-/// drains, and a long value would make a brief spike feel like an outage.
-const POOL_TIMEOUT_RETRY_AFTER_SECS: u64 = 3;
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// `into_response` extracts `retry_after_secs` by MATCHING ON VARIANTS, so unlike
-    /// `message()` a missing arm is not a compile error — it silently drops the header. Pin the
-    /// behaviour for both retry-carrying variants.
-    #[test]
-    fn both_retry_carrying_variants_emit_retry_after() {
-        for err in [
-            AppError::TooManyRequests("slow down".into(), Some(42)),
-            AppError::ServiceUnavailable("busy".into(), Some(3)),
-        ] {
-            let expected = match &err {
-                AppError::TooManyRequests(_, Some(s))
-                | AppError::ServiceUnavailable(_, Some(s)) => s.to_string(),
-                _ => unreachable!(),
-            };
-            let resp = err.into_response();
-            assert_eq!(
-                resp.headers()
-                    .get(axum::http::header::RETRY_AFTER)
-                    .and_then(|v| v.to_str().ok()),
-                Some(expected.as_str()),
-                "a shed/throttled client must be told when to come back"
-            );
-        }
-    }
-
-    /// 4xx must be logged and 5xx must not be logged HERE — `Internal` logs its source chain in
-    /// `message()` and the pool-exhaustion 503 logs at construction, so a second line in
-    /// `into_response` would double every server-side failure in the post-event logs.
-    ///
-    /// The guard is `status.is_client_error()`, so this pins the classification rather than the
-    /// logging itself (which needs a subscriber to observe).
-    #[test]
-    fn only_client_errors_are_in_the_logged_band() {
-        for err in [
-            AppError::BadRequest("x".into()),
-            AppError::Unauthorized("x".into()),
-            AppError::Forbidden("x".into()),
-            AppError::UploadsLocked("x".into()),
-            AppError::NotFound("x".into()),
-            AppError::Conflict("x".into()),
-            AppError::TooManyRequests("x".into(), Some(1)),
-            AppError::QuotaExceeded("x".into()),
-        ] {
-            let (status, _) = err.status_and_code();
-            assert!(
-                status.is_client_error(),
-                "{status} should be in the 4xx band this logs"
-            );
-        }
-
-        for err in [
-            AppError::ServiceUnavailable("x".into(), Some(3)),
-            AppError::Internal(anyhow::anyhow!("boom")),
-        ] {
-            let (status, _) = err.status_and_code();
-            assert!(
-                !status.is_client_error(),
-                "{status} logs elsewhere; logging it here would double it"
-            );
-        }
-    }
-
-    /// Pool saturation is load, not a bug. A 500 makes the frontend's retry classifier pile
-    /// straight back into the saturated pool with no backoff to pace it.
-    #[test]
-    fn pool_exhaustion_sheds_with_503_but_shutdown_does_not() {
-        let shed: AppError = sqlx::Error::PoolTimedOut.into();
-        assert_eq!(
-            shed.status_and_code(),
-            (StatusCode::SERVICE_UNAVAILABLE, "service_unavailable")
-        );
-
-        // PoolClosed only happens during shutdown; a 503 there would invite a retry against a
-        // server that is going away.
-        let closing: AppError = sqlx::Error::PoolClosed.into();
-        assert_eq!(
-            closing.status_and_code(),
-            (StatusCode::INTERNAL_SERVER_ERROR, "internal_error")
-        );
-
-        // Everything else must keep its existing mapping.
-        let missing: AppError = sqlx::Error::RowNotFound.into();
-        assert_eq!(
-            missing.status_and_code(),
-            (StatusCode::INTERNAL_SERVER_ERROR, "internal_error")
-        );
+        Self::Internal(err.into())
     }
 }

backend/src/handlers/admin.rs

@@ -1,16 +1,16 @@
 use std::collections::HashMap;
 use std::time::Duration;
 
+use axum::extract::State;
+use axum::http::{HeaderMap, StatusCode};
 use axum::Json;
-use axum::extract::{Query, State};
-use axum::http::StatusCode;
 use serde::{Deserialize, Serialize};
-use uuid::Uuid;
+use sysinfo::System;
 
 use crate::auth::middleware::RequireAdmin;
 use crate::error::AppError;
 use crate::services::config;
-use crate::services::sse_tickets::TicketKind;
+use crate::services::rate_limiter::client_ip;
 use crate::state::AppState;
 
 // ── DTOs ─────────────────────────────────────────────────────────────────────
@@ -46,17 +46,19 @@ pub async fn get_stats(
         .await?
         .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
 
-    let (user_count,): (i64,) = sqlx::query_as("SELECT COUNT(*) FROM \"user\" WHERE event_id = $1")
-        .bind(event.id)
-        .fetch_one(&state.pool)
-        .await?;
-
-    let (upload_count,): (i64,) =
-        sqlx::query_as("SELECT COUNT(*) FROM upload WHERE event_id = $1 AND deleted_at IS NULL")
+    let (user_count,): (i64,) =
+        sqlx::query_as("SELECT COUNT(*) FROM \"user\" WHERE event_id = $1")
             .bind(event.id)
             .fetch_one(&state.pool)
             .await?;
 
+    let (upload_count,): (i64,) = sqlx::query_as(
+        "SELECT COUNT(*) FROM upload WHERE event_id = $1 AND deleted_at IS NULL",
+    )
+    .bind(event.id)
+    .fetch_one(&state.pool)
+    .await?;
+
     let (comment_count,): (i64,) = sqlx::query_as(
         "SELECT COUNT(*) FROM comment c
          JOIN upload u ON u.id = c.upload_id
@@ -66,12 +68,23 @@ pub async fn get_stats(
     .fetch_one(&state.pool)
     .await?;
 
-    // Disk usage from the shared cache (unknown mount → zeros, same as before).
-    let (disk_total, disk_free) = state
-        .disk_cache
-        .snapshot(&state.config.media_path)
-        .map(|d| (d.total, d.free))
-        .unwrap_or((0, 0));
+    // Disk usage via sysinfo
+    let mut sys = System::new();
+    sys.refresh_all();
+
+    let media_path = state.config.media_path.to_string_lossy().to_string();
+    let (disk_total, disk_free) = sysinfo::Disks::new_with_refreshed_list()
+        .iter()
+        .find(|d| media_path.starts_with(d.mount_point().to_string_lossy().as_ref()))
+        .map(|d| (d.total_space(), d.available_space()))
+        .unwrap_or_else(|| {
+            // Fall back to the root disk
+            sysinfo::Disks::new_with_refreshed_list()
+                .iter()
+                .find(|d| d.mount_point().to_string_lossy() == "/")
+                .map(|d| (d.total_space(), d.available_space()))
+                .unwrap_or((0, 0))
+        });
 
     let disk_used = disk_total.saturating_sub(disk_free);
 
@@ -89,60 +102,34 @@ pub async fn get_config(
     State(state): State<AppState>,
     RequireAdmin(_auth): RequireAdmin,
 ) -> Result<Json<HashMap<String, String>>, AppError> {
-    let rows: Vec<(String, String)> = sqlx::query_as("SELECT key, value FROM config ORDER BY key")
-        .fetch_all(&state.pool)
-        .await?;
+    let rows: Vec<(String, String)> =
+        sqlx::query_as("SELECT key, value FROM config ORDER BY key")
+            .fetch_all(&state.pool)
+            .await?;
 
     Ok(Json(rows.into_iter().collect()))
 }
 
-/// Documents the wire shape of `PATCH /admin/config` (a flat `{key: value}` object).
-/// `patch_config` extracts the `HashMap` directly rather than going through this newtype, so it is
-/// never constructed in Rust — it stays as the serde-derived description of the request body.
-#[allow(dead_code)]
 #[derive(Deserialize)]
 pub struct PatchConfigRequest(pub HashMap<String, String>);
 
 pub async fn patch_config(
     State(state): State<AppState>,
-    RequireAdmin(auth): RequireAdmin,
+    RequireAdmin(_auth): RequireAdmin,
     Json(body): Json<HashMap<String, String>>,
 ) -> Result<StatusCode, AppError> {
     // Numeric keys validated as f64; boolean keys validated as truthy strings; the
     // privacy note is free text. Splitting these explicitly is verbose but makes the
     // failure mode for typos obvious (`Unbekannter Schlüssel: ...`).
-    // (key, integer_only, min, max). Ranges reject values that `parse::<f64>` would
-    // accept but that silently revert to the hardcoded default at read time
-    // (get_usize/get_i64 can't parse negatives/NaN/fractionals). `compression_concurrency`
-    // is intentionally absent — it's read once at boot, so a live edit was a no-op.
-    const NUMERIC_SPECS: &[(&str, bool, f64, f64)] = &[
-        ("max_image_size_mb", true, 1.0, 1024.0),
-        ("max_video_size_mb", true, 1.0, 10240.0),
-        ("upload_rate_per_hour", true, 1.0, 100_000.0),
-        ("feed_rate_per_min", true, 1.0, 100_000.0),
-        ("export_rate_per_day", true, 1.0, 100_000.0),
-        // Loose per-IP ceiling on /join. The real anti-spam bucket is per (ip, name); this
-        // only bounds raw volume from one source, so it must stay well above the size of a
-        // party arriving at once (see migration 017).
-        ("join_ip_rate_per_min", true, 1.0, 100_000.0),
-        // Same shape for /recover: the per-(ip, name) bucket is the anti-guessing control,
-        // this only bounds a name-cycling flood in front of a cost-12 bcrypt (migration 019).
-        ("recover_ip_rate_per_min", true, 1.0, 100_000.0),
-        // Aggregate ceiling on likes + comments + comment deletions, per user per minute.
-        // These were the only mutating endpoints with no limit at all (migration 020).
-        ("social_rate_per_min", true, 1.0, 100_000.0),
-        ("quota_tolerance", false, 0.0, 1.0),
-        ("estimated_guest_count", true, 1.0, 1_000_000.0),
-        // The three limiters migration 025 introduced. All are READ at runtime
-        // (`upload.rs` for the edit limiter, `auth/handlers.rs` for the other two) and 025
-        // INSERTs all of them into `config`, so `GET /admin/config` listed them while
-        // `PATCH /admin/config` answered "Unbekannter Konfigurationsschlüssel" — the same
-        // dead-key defect the comment under BOOL_KEYS says was fixed for the two login
-        // toggles. These are precisely the knobs an operator reaches for while abuse is
-        // happening, which is the one moment a restart to change them is unaffordable.
-        ("upload_edit_rate_per_min", true, 1.0, 100_000.0),
-        ("recover_name_rate_per_15min", true, 1.0, 100_000.0),
-        ("pin_reset_ip_rate_per_min", true, 1.0, 100_000.0),
+    const NUMERIC_KEYS: &[&str] = &[
+        "max_image_size_mb",
+        "max_video_size_mb",
+        "upload_rate_per_hour",
+        "feed_rate_per_min",
+        "export_rate_per_day",
+        "quota_tolerance",
+        "estimated_guest_count",
+        "compression_concurrency",
     ];
     const BOOL_KEYS: &[&str] = &[
         "rate_limits_enabled",
@@ -150,84 +137,23 @@ pub async fn patch_config(
         "feed_rate_enabled",
         "export_rate_enabled",
         "join_rate_enabled",
-        // These two per-area rate toggles are HONOURED by their handlers (auth/handlers.rs reads
-        // `admin_login_rate_enabled` and `recover_rate_enabled`, both defaulting true) but were
-        // missing from this allowlist — so the switch existed in code and could never be flipped.
-        "admin_login_rate_enabled",
-        "recover_rate_enabled",
-        "social_rate_enabled",
-        // Read by `upload::edit_upload`, inserted by migration 025, and until now unreachable
-        // from this endpoint — see the note in NUMERIC_SPECS.
-        "upload_edit_rate_enabled",
         "quota_enabled",
         "storage_quota_enabled",
         "upload_count_quota_enabled",
     ];
-    const TEXT_KEYS: &[&str] = &[
-        "privacy_note",
-        "theme_preset",
-        "theme_primary",
-        "theme_accent",
-    ];
+    const TEXT_KEYS: &[&str] = &["privacy_note"];
     const PRIVACY_NOTE_MAX_LEN: usize = 16 * 1024; // 16 KiB free text is plenty
-    // Preset ids the frontend knows how to render (mirror of PRESETS in
-    // frontend/src/lib/theme/palette.ts). "custom" means "use the theme_primary/accent
-    // seeds verbatim". Kept in sync by hand — a new preset must be added in both places.
-    const THEME_PRESETS: &[&str] = &[
-        "champagne-gold",
-        "rose",
-        "sage",
-        "dusk-blue",
-        "classic-silver",
-        "custom",
-    ];
 
     let mut privacy_note_changed = false;
-    let mut theme_changed = false;
 
-    // Validate every key first so a bad value in the batch can't leave a partial
-    // update behind — validation must fully precede any write.
     for (key, value) in &body {
         let key_str = key.as_str();
-        if let Some(&(_, integer_only, min, max)) =
-            NUMERIC_SPECS.iter().find(|(k, ..)| *k == key_str)
-        {
-            let n = value.trim().parse::<f64>().ok().filter(|n| n.is_finite());
-            let n = match n {
-                Some(n) => n,
-                None => {
-                    return Err(AppError::BadRequest(format!(
-                        "Ungültiger Wert für {key}: muss eine Zahl sein."
-                    )));
-                }
-            };
-            if integer_only && n.fract() != 0.0 {
+        if NUMERIC_KEYS.contains(&key_str) {
+            if value.parse::<f64>().is_err() {
                 return Err(AppError::BadRequest(format!(
-                    "Ungültiger Wert für {key}: muss eine ganze Zahl sein."
+                    "Ungültiger Wert für {key}: muss eine Zahl sein."
                 )));
             }
-            if n < min || n > max {
-                return Err(AppError::BadRequest(format!(
-                    "Wert für {key} liegt außerhalb des zulässigen Bereichs ({min}–{max})."
-                )));
-            }
-            // Zero is in range and catastrophic. `quota_tolerance` is the multiplier in
-            // `free_disk * tolerance / active_uploaders`, so 0 makes every per-user limit 0 and
-            // refuses EVERY upload — mid-event, with "Du hast dein Upload-Limit für dieses Event
-            // erreicht", an error naming the wrong cause entirely. `storage_quota_enabled` is the
-            // intended off-switch.
-            //
-            // Rejecting the value rather than raising the floor: very small tolerances are
-            // legitimate (they are how a large disk is throttled down to a sensible per-guest
-            // ceiling, and how the e2e quota tests steer it — around 1e-5 on a 174 GB volume), so
-            // a floor of, say, 0.01 would forbid real configurations to prevent one typo.
-            if key_str == "quota_tolerance" && n == 0.0 {
-                return Err(AppError::BadRequest(
-                    "quota_tolerance = 0 würde jeden Upload blockieren. Zum Abschalten der \
-                     Speicher-Quote stattdessen „Speicher-Quote aktiv“ ausschalten."
-                        .into(),
-                ));
-            }
         } else if BOOL_KEYS.contains(&key_str) {
             match value.trim().to_ascii_lowercase().as_str() {
                 "true" | "false" | "1" | "0" | "yes" | "no" | "on" | "off" => {}
@@ -238,100 +164,42 @@ pub async fn patch_config(
                 }
             }
         } else if TEXT_KEYS.contains(&key_str) {
-            // Count characters, not bytes — the message says "Zeichen" and a
-            // multi-byte grapheme shouldn't count against the limit multiple times.
-            if value.chars().count() > PRIVACY_NOTE_MAX_LEN {
+            if value.len() > PRIVACY_NOTE_MAX_LEN {
                 return Err(AppError::BadRequest(format!(
                     "Wert für {key} ist zu lang (max. {PRIVACY_NOTE_MAX_LEN} Zeichen)."
                 )));
             }
-            match key_str {
-                "privacy_note" => privacy_note_changed = true,
-                "theme_preset" => {
-                    if !THEME_PRESETS.contains(&value.trim()) {
-                        return Err(AppError::BadRequest(format!("Ungültiges Theme: {value}.")));
-                    }
-                    theme_changed = true;
-                }
-                "theme_primary" | "theme_accent" => {
-                    if !is_hex_color(value.trim()) {
-                        return Err(AppError::BadRequest(format!(
-                            "Ungültige Farbe für {key}: muss #rrggbb sein."
-                        )));
-                    }
-                    theme_changed = true;
-                }
-                _ => {}
+            if key_str == "privacy_note" {
+                privacy_note_changed = true;
             }
         } else {
             return Err(AppError::BadRequest(format!(
                 "Unbekannter Konfigurationsschlüssel: {key}"
             )));
         }
-    }
 
-    // Apply all writes in one transaction — the batch is all-or-nothing.
-    let mut tx = state.pool.begin().await?;
-    for (key, value) in &body {
         sqlx::query(
             "INSERT INTO config (key, value, updated_at) VALUES ($1, $2, NOW())
              ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()",
         )
         .bind(key)
         .bind(value)
-        .execute(&mut *tx)
+        .execute(&state.pool)
         .await?;
     }
-    tx.commit().await?;
-
-    // The config cache must reflect this write on the very next read (tests PATCH then
-    // immediately assert the new value takes effect). Invalidate synchronously here —
-    // the TTL is only a backstop and must not be relied on for correctness.
-    state.config_cache.invalidate();
-
-    // Config changes were logged NOWHERE. They are the actions most likely to be blamed the
-    // morning after ("why did uploads stop?") and the hardest to reconstruct, because the value
-    // that caused the problem has since been changed back. Record the keys and their new values;
-    // these are operational settings, not credentials, so the payload is safe to keep.
-    crate::services::audit::record(
-        &state.pool,
-        auth.event_id,
-        auth.user_id,
-        None,
-        auth.role.clone(),
-        "patch_config",
-        None,
-        None,
-        serde_json::to_value(&body).ok(),
-    )
-    .await;
 
     // Notify all clients that a publicly-readable config value changed so their stores
     // (e.g. the privacy note in My Account) refresh without a manual reload.
-    if privacy_note_changed || theme_changed {
-        let mut keys: Vec<&str> = Vec::new();
-        if privacy_note_changed {
-            keys.push("privacy_note");
-        }
-        if theme_changed {
-            keys.push("theme");
-        }
+    if privacy_note_changed {
         let _ = state.sse_tx.send(crate::state::SseEvent::new(
             "event-updated",
-            serde_json::json!({ "keys": keys }).to_string(),
+            serde_json::json!({ "keys": ["privacy_note"] }).to_string(),
         ));
     }
 
     Ok(StatusCode::NO_CONTENT)
 }
 
-/// A strict `#rrggbb` hex-colour check (6 hex digits, leading `#`). Deliberately not
-/// accepting shorthand/`#rgba` so the value is safe to drop straight into CSS.
-fn is_hex_color(s: &str) -> bool {
-    let bytes = s.as_bytes();
-    bytes.len() == 7 && bytes[0] == b'#' && bytes[1..].iter().all(|b| b.is_ascii_hexdigit())
-}
-
 pub async fn get_export_jobs(
     State(state): State<AppState>,
     RequireAdmin(_auth): RequireAdmin,
@@ -355,356 +223,85 @@ pub async fn get_export_jobs(
 
 // ── Export download endpoints (authenticated guests) ─────────────────────────
 
-#[derive(Deserialize)]
-pub struct DownloadQuery {
-    pub ticket: String,
-}
-
-/// Mint a short-lived ticket for a browser-driven export download. The download
-/// is a top-level navigation so the multi-GB ZIP streams straight to disk instead
-/// of being buffered in memory by `fetch()` + `blob()` — but a navigation can't
-/// carry an `Authorization` header, so the client exchanges its Bearer token for
-/// an opaque ticket here, then hits `/export/zip?ticket=...`. Uses the same store as the SSE
-/// stream, but NOT the same lifetime: a download ticket lives `DOWNLOAD_TTL` (6 h) and is
-/// redeemable up to `MAX_DOWNLOAD_REDEMPTIONS` times, because a multi-GB transfer over venue wifi
-/// has to survive being resumed with `Range`.
-#[derive(serde::Deserialize)]
-pub struct ExportTicketQuery {
-    /// Which archive the ticket is for — `zip` or `html`.
-    ///
-    /// REQUIRED. It used to be optional "so an older client keeps working", but the ticket is now
-    /// bound to the archive it was minted for (see `TicketKind::Download`), and a ticket with no
-    /// archive would either have to be valid for both — the abuse this closes — or be issued for a
-    /// guess that 401s at the other endpoint. Every shipped client sends it.
-    #[serde(default)]
-    pub kind: Option<String>,
-}
-
-pub async fn export_ticket(
-    State(state): State<AppState>,
-    axum::extract::Query(q): axum::extract::Query<ExportTicketQuery>,
-    auth: crate::auth::middleware::AuthUser,
-) -> Result<Json<serde_json::Value>, AppError> {
-    // NOTE: intentionally NOT gated on `is_banned`. A banned user keeps *read* access
-    // by design (USER_JOURNEYS §10.3, FEATURES: "Can still download the export once
-    // released — Spec design choice"). The export is read-only, so it stays available
-    // to them, consistent with the read-only-ban model.
-
-    // The rate limit is enforced HERE rather than on the download itself, and that placement is
-    // the whole point: the download is an iframe navigation, so its response is invisible to the
-    // page. Limiting it there meant a guest over the limit tapped "Herunterladen", the ticket
-    // POST returned 200, the iframe silently received a 429, and absolutely nothing happened —
-    // forever, with no explanation, on the one screen that is the emotional payoff of the app.
-    // Minting is a normal `fetch`, so a 429 here reaches the user as a German message.
-    //
-    // Moving it does not weaken the limit meaningfully: a ticket can only be obtained from this
-    // authenticated endpoint, is bound to one archive, and — since downloads must be resumable —
-    // is worth at most `MAX_DOWNLOAD_REDEMPTIONS` transfers rather than exactly one. The daily
-    // limit is therefore a bound on mints, not on bytes; see `MAX_DOWNLOAD_REDEMPTIONS` for why
-    // charging per redemption would re-break resumption.
-    // Confirm the archive actually EXISTS before spending anything on it.
-    //
-    // `export_status` — which is what enables the Download button — reports `done` from
-    // `export_job`, while the download resolves through `export_current.file_path` plus a
-    // `Path::exists()`. Those are different sources of truth and can legitimately disagree: a
-    // row can say done while the file is gone, or an epoch bump can retire it between the page
-    // rendering and the guest tapping. When they disagreed the guest got the worst possible
-    // shape of failure — a green "Download gestartet" toast, a consumed single-use ticket, one
-    // of only three daily slots spent, and nothing in their Downloads folder, repeatable until
-    // the day's allowance was gone.
-    //
-    // Checking here, before `enforce_export_rate`, turns that into an honest error on a plain
-    // `fetch` that the existing `toastError` path already renders. This is NOT the HEAD probe
-    // ruled out elsewhere: it reads the same indexed row the download will read and touches no
-    // ticket, so it cannot consume anything.
-    let export_kind = match q.kind.as_deref() {
-        Some("zip") => crate::services::sse_tickets::ExportKind::Zip,
-        Some("html") => crate::services::sse_tickets::ExportKind::Html,
-        Some(other) => {
-            return Err(AppError::BadRequest(format!(
-                "Unbekannter Export-Typ: {other}"
-            )));
-        }
-        None => {
-            return Err(AppError::BadRequest(
-                "Es fehlt die Angabe, welches Archiv geladen werden soll. Bitte lade die Seite \
-                 neu und versuche es erneut."
-                    .into(),
-            ));
-        }
-    };
-    {
-        let export_type = match export_kind {
-            crate::services::sse_tickets::ExportKind::Zip => "zip",
-            crate::services::sse_tickets::ExportKind::Html => "html",
-        };
-        let msg = if export_type == "zip" {
-            "Der ZIP-Export ist noch nicht verfügbar."
-        } else {
-            "Der HTML-Export ist noch nicht verfügbar."
-        };
-        resolve_export_file(&state, export_type, msg).await?;
-    }
-
-    // `issue` returns None when the ticket store is at capacity. Unwrapping it into the JSON body
-    // serialized `{"ticket": null}` with a 200 — so `api.post` resolved happily, the page toasted
-    // success, and the iframe navigated to `?ticket=null`. 503 + Retry-After, matching how
-    // `sse::issue_ticket` answers the identical condition.
-    //
-    // Minted BEFORE the rate limit is charged. Charging first meant a store-capacity 503 — a
-    // server-side condition the guest did nothing to cause and cannot see — still cost one of
-    // their three DAILY downloads. There is no refund path, so the only fix is not to charge until
-    // the thing being charged for actually exists.
-    let ticket = state
-        .sse_tickets
-        .issue(auth.token_hash, TicketKind::Download(export_kind))
-        .ok_or_else(|| {
-            AppError::ServiceUnavailable(
-                "Server ist gerade ausgelastet. Bitte versuch es in einem Moment erneut.".into(),
-                Some(30),
-            )
-        })?;
-
-    // A refused mint must not leave its ticket behind. The per-session cap is FOUR tickets of the
-    // same kind, and a download ticket now lives six hours instead of being consumed on first use —
-    // so every abandoned one occupies a slot until it expires. A guest whose 1.4 GB transfer looks
-    // stuck and who taps "Herunterladen" a few more times spends mints 1-3 legitimately, then gets
-    // a 429 on taps 4 and 5 — but both still minted, and the fifth evicted the OLDEST download
-    // ticket for the session: the one the running transfer is holding. The next `Range` resume then
-    // 401s, and re-minting is impossible because they are at the daily limit. The keepsake is gone
-    // until tomorrow, having done nothing worse than tapping a button that appeared to do nothing.
-    //
-    // Discarding here keeps both properties that put the mint first: a store-capacity 503 still
-    // costs no download, and a refused download costs no slot.
-    if let Err(e) = enforce_export_rate(&state, auth.user_id).await {
-        let _ = state
-            .sse_tickets
-            .consume(&ticket, TicketKind::Download(export_kind));
-        return Err(e);
-    }
-
-    Ok(Json(serde_json::json!({ "ticket": ticket })))
-}
-
-/// Validate a download ticket and confirm its session still exists, resolving it to the user who
-/// minted it. Deliberately NOT single-use — see the note on `redeem_download` below.
-async fn authenticate_download_ticket(
-    state: &AppState,
-    ticket: &str,
-    want: crate::services::sse_tickets::ExportKind,
-) -> Result<Uuid, AppError> {
-    // Non-consuming: a keepsake download must survive being resumed with `Range`, and a
-    // single-use ticket meant the resume 401'd and cost the guest another of their three daily
-    // downloads. `redeem_download` bounds it by DOWNLOAD_TTL instead, and the session check
-    // below still runs on every request.
-    let token_hash = state
-        .sse_tickets
-        .redeem_download(ticket, want)
-        .ok_or_else(|| AppError::Unauthorized("Ticket ungültig oder abgelaufen.".into()))?;
-    let session = crate::models::session::Session::find_by_token_hash(&state.pool, &token_hash)
-        .await
-        .map_err(|e| AppError::Internal(e.into()))?
-        .ok_or_else(|| AppError::Unauthorized("Sitzung nicht gefunden.".into()))?;
-    Ok(session.user_id)
-}
-
 pub async fn download_zip(
     State(state): State<AppState>,
-    headers: axum::http::HeaderMap,
-    Query(q): Query<DownloadQuery>,
+    _auth: crate::auth::middleware::AuthUser,
+    headers: HeaderMap,
 ) -> Result<axum::response::Response, AppError> {
-    // Ticket validation only — the rate limit was charged at mint time, where a 429 is visible
-    // to the page. Charging it again here would cost every download two slots.
-    authenticate_download_ticket(
-        &state,
-        &q.ticket,
-        crate::services::sse_tickets::ExportKind::Zip,
-    )
-    .await?;
+    enforce_export_rate(&state, &headers).await?;
 
-    let path =
-        resolve_export_file(&state, "zip", "Der ZIP-Export ist noch nicht verfügbar.").await?;
-    serve_file(
-        path,
-        "Gallery.zip",
-        "application/zip",
-        headers
-            .get(axum::http::header::RANGE)
-            .and_then(|v| v.to_str().ok()),
-        headers
-            .get(axum::http::header::IF_RANGE)
-            .and_then(|v| v.to_str().ok()),
-    )
-    .await
-}
+    let event = crate::models::event::Event::find_by_slug(&state.pool, &state.config.event_slug)
+        .await?
+        .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
 
-/// Resolve the on-disk path of the CURRENT export generation — readiness check and path lookup in
-/// ONE read, through the `export_current` view (migration 014).
-///
-/// This used to be two statements: the caller checked `event.export_zip_ready`, then this fetched
-/// `export_job.file_path`. A reopen landing between them served a keepsake that should have 404'd —
-/// the same stale-keepsake class, leaking through the read path, and it existed only because
-/// readiness was a stored copy rather than a derivation. `export_current` gives both facts from one
-/// consistent snapshot: it yields a row only when the event is released AND the job is `done` at the
-/// event's current epoch, so "is it ready" and "which file" can no longer disagree.
-async fn resolve_export_file(
-    state: &AppState,
-    export_type: &str,
-    not_ready_msg: &str,
-) -> Result<std::path::PathBuf, AppError> {
-    let file_path: Option<(Option<String>,)> = sqlx::query_as(
-        "SELECT c.file_path FROM export_current c
-         JOIN event e ON e.id = c.event_id
-         WHERE e.slug = $1 AND c.type = $2::export_type AND c.status = 'done'",
-    )
-    .bind(&state.config.event_slug)
-    .bind(export_type)
-    .fetch_optional(&state.pool)
-    .await
-    .map_err(|e| AppError::Internal(e.into()))?;
+    if !event.export_zip_ready {
+        return Err(AppError::NotFound(
+            "Der ZIP-Export ist noch nicht verfügbar.".into(),
+        ));
+    }
 
-    let Some((Some(rel),)) = file_path else {
-        return Err(AppError::NotFound(not_ready_msg.into()));
-    };
-
-    // `file_path` is stored as `exports/<name>`; the base dir is already `export_path`, so
-    // join only the file name (defends against any absolute/`..` content too).
-    let name = std::path::Path::new(&rel)
-        .file_name()
-        .ok_or_else(|| AppError::NotFound("Exportdatei nicht gefunden.".into()))?;
-    let path = state.config.export_path.join(name);
+    let path = state.config.media_path.join("exports").join("Gallery.zip");
     if !path.exists() {
         return Err(AppError::NotFound("Exportdatei nicht gefunden.".into()));
     }
-    Ok(path)
+
+    serve_file(path, "Gallery.zip", "application/zip").await
 }
 
 pub async fn download_html(
     State(state): State<AppState>,
-    headers: axum::http::HeaderMap,
-    Query(q): Query<DownloadQuery>,
+    _auth: crate::auth::middleware::AuthUser,
+    headers: HeaderMap,
 ) -> Result<axum::response::Response, AppError> {
-    // See `download_zip`: the limit is charged at ticket mint, where the client can see it.
-    authenticate_download_ticket(
-        &state,
-        &q.ticket,
-        crate::services::sse_tickets::ExportKind::Html,
-    )
-    .await?;
+    enforce_export_rate(&state, &headers).await?;
 
-    let path =
-        resolve_export_file(&state, "html", "Der HTML-Export ist noch nicht verfügbar.").await?;
-    serve_file(
-        path,
-        "Memories.zip",
-        "application/zip",
-        headers
-            .get(axum::http::header::RANGE)
-            .and_then(|v| v.to_str().ok()),
-        headers
-            .get(axum::http::header::IF_RANGE)
-            .and_then(|v| v.to_str().ok()),
-    )
-    .await
+    let event = crate::models::event::Event::find_by_slug(&state.pool, &state.config.event_slug)
+        .await?
+        .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
+
+    if !event.export_html_ready {
+        return Err(AppError::NotFound(
+            "Der HTML-Export ist noch nicht verfügbar.".into(),
+        ));
+    }
+
+    let path = state.config.media_path.join("exports").join("Memories.zip");
+    if !path.exists() {
+        return Err(AppError::NotFound("Exportdatei nicht gefunden.".into()));
+    }
+
+    serve_file(path, "Memories.zip", "application/zip").await
 }
 
-/// Stream a keepsake archive, honouring `Range`.
-///
-/// Range support is not a nicety here. The keepsake is the emotional payoff of the product and can
-/// be ~1.4 GB; without `Accept-Ranges` a download that dies at 90% over hotel wifi restarts at byte
-/// zero. Worse, the 3/day limit is charged when the download TICKET is minted and ZIP+HTML already
-/// costs 2 — so one dropped connection locked a guest out of their own wedding photos for ~24h.
-///
-/// Reuses `upload::parse_range`, which already implements exactly the forms a client sends and is
-/// unit-tested there. The media routes have always done this correctly; this route was the outlier.
 async fn serve_file(
     path: std::path::PathBuf,
     filename: &str,
     content_type: &str,
-    range_header: Option<&str>,
-    if_range_header: Option<&str>,
 ) -> Result<axum::response::Response, AppError> {
-    use crate::handlers::upload::{RangeSpec, parse_range};
     use axum::body::Body;
-    use axum::http::{Response, StatusCode, header};
-    use tokio::io::{AsyncReadExt, AsyncSeekExt};
+    use axum::http::{header, Response, StatusCode};
     use tokio_util::io::ReaderStream;
 
-    let mut file = tokio::fs::File::open(&path)
+    let file = tokio::fs::File::open(&path)
         .await
         .map_err(|e| AppError::Internal(e.into()))?;
-    let len = file
+    let metadata = file
         .metadata()
         .await
-        .map_err(|e| AppError::Internal(e.into()))?
-        .len();
+        .map_err(|e| AppError::Internal(e.into()))?;
+    let stream = ReaderStream::new(file);
 
     let disposition = format!("attachment; filename=\"{filename}\"");
 
-    // A validator that CHANGES when the archive does, so a resume cannot splice two generations.
-    //
-    // The on-disk name is `{prefix}.{event_id}.{epoch}.zip`, so it already identifies the exact
-    // generation; length distinguishes a rebuild at the same epoch. Together they are a strong
-    // validator.
-    //
-    // Why this matters: `resolve_export_file` re-reads `export_current` on EVERY request, and a
-    // download ticket outlives several redemptions. So a guest whose 500 MB download drops at
-    // 500 MB, while the host takes a photo down (epoch bumps, rebuild lands, the old generation is
-    // pruned), used to resume with `Range: bytes=500000000-` against a DIFFERENT FILE of a
-    // different length — and the server would happily seek 500 MB into it and stream. The client
-    // concatenated the two halves into a structurally corrupt ZIP, with nothing logged anywhere.
-    let etag = format!(
-        "\"{}-{len}\"",
-        path.file_name()
-            .and_then(|n| n.to_str())
-            .unwrap_or(filename)
-    );
+    let response = Response::builder()
+        .status(StatusCode::OK)
+        .header(header::CONTENT_TYPE, content_type)
+        .header(header::CONTENT_DISPOSITION, disposition)
+        .header(header::CONTENT_LENGTH, metadata.len())
+        .body(Body::from_stream(stream))
+        .map_err(|e| AppError::Internal(e.into()))?;
 
-    let base = |status: StatusCode| {
-        Response::builder()
-            .status(status)
-            .header(header::CONTENT_TYPE, content_type)
-            .header(header::CONTENT_DISPOSITION, disposition.clone())
-            // Advertised on EVERY response, including the 200. A client only knows it may resume
-            // if the first (unranged) response says so.
-            .header(header::ACCEPT_RANGES, "bytes")
-            .header(header::ETAG, etag.clone())
-    };
-
-    // Serve a partial ONLY when the client proves it is resuming the same bytes.
-    //
-    // `If-Range` matching our ETag is that proof. A client that sends `Range` with no `If-Range`
-    // at all (curl -C -, wget -c, most download managers) cannot be given a partial safely — it
-    // has no way to notice the archive changed underneath it — so it gets a 200 and starts over.
-    // Restarting a download is a cost; a silently corrupt keepsake is not recoverable. Browsers
-    // send `If-Range`, so the ordinary resume path is unaffected, and this is the first release
-    // where their resume works at all: without a validator they simply refused to try.
-    let resume_is_safe = if_range_header.is_some_and(|v| v.trim() == etag);
-    let effective_range = if resume_is_safe { range_header } else { None };
-
-    match parse_range(effective_range, len) {
-        RangeSpec::Full => base(StatusCode::OK)
-            .header(header::CONTENT_LENGTH, len)
-            .body(Body::from_stream(ReaderStream::new(file)))
-            .map_err(|e| AppError::Internal(e.into())),
-
-        RangeSpec::Partial { start, end } => {
-            file.seek(std::io::SeekFrom::Start(start))
-                .await
-                .map_err(|e| AppError::Internal(e.into()))?;
-            let span = end - start + 1;
-            base(StatusCode::PARTIAL_CONTENT)
-                .header(header::CONTENT_LENGTH, span)
-                .header(header::CONTENT_RANGE, format!("bytes {start}-{end}/{len}"))
-                .body(Body::from_stream(ReaderStream::new(file.take(span))))
-                .map_err(|e| AppError::Internal(e.into()))
-        }
-
-        RangeSpec::Unsatisfiable => base(StatusCode::RANGE_NOT_SATISFIABLE)
-            .header(header::CONTENT_RANGE, format!("bytes */{len}"))
-            .body(Body::empty())
-            .map_err(|e| AppError::Internal(e.into())),
-    }
+    Ok(response)
 }
 
 /// Also expose export status to all authenticated users (guests need it for the export page)
@@ -718,24 +315,8 @@ pub async fn export_status(
 
     let released = event.export_released_at.is_some();
 
-    // ONE statement: the epoch comparison happens inside the query, against a single snapshot.
-    // Binding the epoch read by a previous statement would let a release/regeneration commit in
-    // between and yield `{released: true, zip: locked, html: locked}` — a state that never existed.
-    //
-    // Only jobs at the CURRENT epoch are reported. A row left behind by a retired generation (a
-    // worker superseded mid-run) is meaningless — surfacing its frozen `running`/77% would show a
-    // progress bar that never moves for a keepsake nobody is building. It reads as "locked" (no
-    // current job), which is exactly what it is.
-    // `error_message` is carried here, not just on the admin dashboard's job list. The host is the
-    // one who releases the keepsake and the one who owns the "Erneut versuchen" button, but this
-    // endpoint used to hand them a bare `failed` — so a fully actionable reason (notably the disk
-    // preflight's "needs X GB, Y GB free") was written to the row and then shown to nobody who
-    // could act on it. An admin-only diagnostic is not a diagnostic for the person on the spot.
-    let jobs: Vec<(String, String, i16, Option<String>)> = sqlx::query_as(
-        "SELECT j.type::text, j.status::text, j.progress_pct, j.error_message
-           FROM export_job j
-           JOIN event e ON e.id = j.event_id
-          WHERE e.id = $1 AND j.epoch = e.export_epoch",
+    let jobs: Vec<(String, String, i16)> = sqlx::query_as(
+        "SELECT type::text, status::text, progress_pct FROM export_job WHERE event_id = $1",
     )
     .bind(event.id)
     .fetch_all(&state.pool)
@@ -743,21 +324,11 @@ pub async fn export_status(
 
     let job_status = |type_name: &str| {
         jobs.iter()
-            .find(|(t, _, _, _)| t == type_name)
-            .map(|(_, status, pct, err)| {
-                serde_json::json!({
-                    "status": status,
-                    "progress_pct": pct,
-                    // Only on a failure. A stale message left on a row that has since been re-armed
-                    // would otherwise show an error next to a running progress bar.
-                    "error_message": if status == "failed" { err.clone() } else { None },
-                })
-            })
-            .unwrap_or_else(|| {
-                serde_json::json!({
-                    "status": "locked", "progress_pct": 0, "error_message": null,
-                })
+            .find(|(t, _, _)| t == type_name)
+            .map(|(_, status, pct)| {
+                serde_json::json!({ "status": status, "progress_pct": pct })
             })
+            .unwrap_or_else(|| serde_json::json!({ "status": "locked", "progress_pct": 0 }))
     };
 
     Ok(Json(serde_json::json!({
@@ -770,29 +341,21 @@ pub async fn export_status(
 /// Centralised guard for the export rate limit. Same pattern as upload/feed: master
 /// switch + per-endpoint switch + numeric value, all stored in `config` and read on
 /// each request.
-async fn enforce_export_rate(state: &AppState, user_id: Uuid) -> Result<(), AppError> {
-    let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
-    let export_rate_on = config::get_bool(&state.config_cache, "export_rate_enabled", true).await;
+async fn enforce_export_rate(state: &AppState, headers: &HeaderMap) -> Result<(), AppError> {
+    let rate_limits_on = config::get_bool(&state.pool, "rate_limits_enabled", true).await;
+    let export_rate_on = config::get_bool(&state.pool, "export_rate_enabled", true).await;
     if !(rate_limits_on && export_rate_on) {
         return Ok(());
     }
-    let limit = config::get_usize(&state.config_cache, "export_rate_per_day", 3).await;
-    // Keyed per-user. This was the worst of the IP-keyed limiters: 3 downloads per DAY
-    // shared across every guest behind the venue's public IP, so the fourth person to
-    // fetch their keepsake was locked out until the next day.
-    if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
-        format!("export:{user_id}"),
-        limit,
-        Duration::from_secs(86400),
-    ) {
-        // Names the real window. The generic "warte kurz" wording this used to share with the
-        // per-minute limiters is actively wrong here — the bucket is a DAY, so a guest told to
-        // wait a moment would keep tapping a button that cannot work again until tomorrow.
+    let ip = client_ip(headers, "unknown");
+    let limit = config::get_usize(&state.pool, "export_rate_per_day", 3).await;
+    if !state
+        .rate_limiter
+        .check(format!("export:{ip}"), limit, Duration::from_secs(86400))
+    {
         return Err(AppError::TooManyRequests(
-            "Du hast das Tageslimit für Downloads erreicht. Versuch es später noch einmal — \
-             deine Galerie bleibt gespeichert."
-                .into(),
-            Some(retry_after_secs),
+            "Zu viele Anfragen. Bitte warte kurz und versuche es erneut.".into(),
+            None,
         ));
     }
     Ok(())

backend/src/handlers/feed.rs

@@ -1,7 +1,8 @@
 use std::time::Duration;
 
-use axum::Json;
 use axum::extract::{Query, State};
+use axum::http::HeaderMap;
+use axum::Json;
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use uuid::Uuid;
@@ -9,49 +10,15 @@ use uuid::Uuid;
 use crate::auth::middleware::AuthUser;
 use crate::error::AppError;
 use crate::services::config;
+use crate::services::media_token;
+use crate::services::rate_limiter::client_ip;
 use crate::state::AppState;
 
 #[derive(Deserialize)]
 pub struct FeedQuery {
     pub cursor: Option<Uuid>,
     pub limit: Option<i64>,
-    /// Single tag (list view). Kept alongside `hashtags` so existing callers keep working.
     pub hashtag: Option<String>,
-    /// Comma-separated tags, combined with **OR** — the grid's chip semantics
-    /// (USER_JOURNEYS §8). Filtering moved server-side because the client could only ever
-    /// filter the pages it had already loaded: with page 1 = 20 items out of a 1000-photo
-    /// event, selecting a tag showed a handful of tiles and looked complete. Matching is
-    /// now the exact `hashtag` row in both views, so the grid and the list can no longer
-    /// disagree about which photos carry a tag (the client matched a caption SUBSTRING, so
-    /// `#tanz` also matched `#tanzflaeche`).
-    pub hashtags: Option<String>,
-    /// Exact uploader display name, combined with the tag group using **AND**.
-    pub uploader: Option<String>,
-}
-
-/// Merge the single-tag and CSV tag params into one normalised, de-duplicated list.
-///
-/// Normalisation mirrors `Hashtag::upsert` exactly (trim, drop a leading `#`, lowercase), so
-/// a chip built from a display string like `#Tanz` matches the stored `tanz` row. Returns
-/// `None` when no usable tag was supplied, which makes the SQL predicate a no-op — an empty
-/// list must mean "no tag filter", never "match nothing".
-fn normalize_tags(single: Option<&str>, csv: Option<&str>) -> Option<Vec<String>> {
-    let mut out: Vec<String> = Vec::new();
-    let mut push = |raw: &str| {
-        let t = raw.trim().trim_start_matches('#').to_lowercase();
-        if !t.is_empty() && !out.contains(&t) {
-            out.push(t);
-        }
-    };
-    if let Some(s) = single {
-        push(s);
-    }
-    if let Some(s) = csv {
-        for part in s.split(',') {
-            push(part);
-        }
-    }
-    if out.is_empty() { None } else { Some(out) }
 }
 
 #[derive(Serialize)]
@@ -61,8 +28,8 @@ pub struct FeedUpload {
     pub uploader_name: String,
     pub preview_url: Option<String>,
     pub thumbnail_url: Option<String>,
-    /// Big-screen (~2048px) variant for the diashow. Absent until the derivative exists.
-    pub display_url: Option<String>,
+    /// Signed gateway URL for the full-resolution original. Always present.
+    pub original_url: Option<String>,
     pub mime_type: String,
     pub caption: Option<String>,
     pub like_count: i64,
@@ -84,7 +51,6 @@ struct FeedRow {
     uploader_name: String,
     preview_path: Option<String>,
     thumbnail_path: Option<String>,
-    display_path: Option<String>,
     mime_type: String,
     caption: Option<String>,
     like_count: i64,
@@ -92,126 +58,120 @@ struct FeedRow {
     created_at: DateTime<Utc>,
 }
 
+/// Build a feed DTO, minting fresh signed gateway URLs for each artifact. The
+/// preview/thumbnail URLs are present only when the derivative exists so the
+/// client can show a skeleton while compression is still running; the original
+/// URL is always present.
+fn to_feed_upload(r: FeedRow, liked: bool, secret: &str, now: i64) -> FeedUpload {
+    FeedUpload {
+        liked_by_me: liked,
+        preview_url: r
+            .preview_path
+            .as_ref()
+            .map(|_| media_token::signed_url(secret, "preview", r.id, now)),
+        thumbnail_url: r
+            .thumbnail_path
+            .as_ref()
+            .map(|_| media_token::signed_url(secret, "thumbnail", r.id, now)),
+        original_url: Some(media_token::signed_url(secret, "original", r.id, now)),
+        id: r.id,
+        user_id: r.user_id,
+        uploader_name: r.uploader_name,
+        mime_type: r.mime_type,
+        caption: r.caption,
+        like_count: r.like_count,
+        comment_count: r.comment_count,
+        created_at: r.created_at,
+    }
+}
+
 pub async fn feed(
     State(state): State<AppState>,
     auth: AuthUser,
+    headers: HeaderMap,
     Query(q): Query<FeedQuery>,
 ) -> Result<Json<FeedResponse>, AppError> {
-    let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
-    let feed_rate_on = config::get_bool(&state.config_cache, "feed_rate_enabled", true).await;
+    let ip = client_ip(&headers, "unknown");
+    let rate_limits_on = config::get_bool(&state.pool, "rate_limits_enabled", true).await;
+    let feed_rate_on = config::get_bool(&state.pool, "feed_rate_enabled", true).await;
     if rate_limits_on && feed_rate_on {
-        let rate_limit = config::get_usize(&state.config_cache, "feed_rate_per_min", 60).await;
-        // Keyed per-user, exactly like `feed_delta` below: at a venue every guest shares
-        // one public IP, so an IP key gave the whole party a single 60/min bucket and the
-        // fastest scroller starved everyone else.
-        if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
-            format!("feed:{}", auth.user_id),
-            rate_limit,
-            Duration::from_secs(60),
-        ) {
+        let rate_limit = config::get_usize(&state.pool, "feed_rate_per_min", 60).await;
+        if !state
+            .rate_limiter
+            .check(format!("feed:{ip}"), rate_limit, Duration::from_secs(60))
+        {
             return Err(AppError::TooManyRequests(
                 "Zu viele Anfragen. Bitte warte kurz und versuche es erneut.".into(),
-                Some(retry_after_secs),
+                None,
             ));
         }
     }
 
-    // Clamped at BOTH ends: only the upper bound was enforced, so `?limit=-5` reached Postgres
-    // as `LIMIT -4` and answered a hand-written URL with a 500.
-    let limit = q.limit.unwrap_or(20).clamp(1, 100);
+    let limit = q.limit.unwrap_or(20).min(100);
 
-    // Resolve the cursor to a (created_at, id) position. The pair is compared as a
-    // tuple so ties on created_at break on id — keyset pagination on created_at
-    // alone would silently drop rows sharing a timestamp across a page boundary.
-    let (cursor_time, cursor_id) = match q.cursor {
-        Some(c) => match get_cursor_pos(&state.pool, c).await {
-            Some((t, id)) => (Some(t), Some(id)),
-            None => (None, None),
-        },
-        None => (None, None),
+    let rows = if let Some(hashtag) = &q.hashtag {
+        let tag = hashtag.trim().trim_start_matches('#').to_lowercase();
+        sqlx::query_as::<_, FeedRow>(
+            "SELECT v.id, v.user_id, v.uploader_name, v.preview_path, v.thumbnail_path,
+                    v.mime_type, v.caption, v.like_count, v.comment_count, v.created_at
+             FROM v_feed v
+             JOIN upload_hashtag uh ON uh.upload_id = v.id
+             JOIN hashtag h ON h.id = uh.hashtag_id AND h.tag = $1
+             WHERE v.event_id = $2
+               AND ($3::timestamptz IS NULL OR v.created_at < $3)
+             ORDER BY v.created_at DESC
+             LIMIT $4",
+        )
+        .bind(&tag)
+        .bind(auth.event_id)
+        .bind(
+            if let Some(cursor) = q.cursor {
+                get_cursor_time(&state.pool, cursor).await
+            } else {
+                None
+            },
+        )
+        .bind(limit + 1)
+        .fetch_all(&state.pool)
+        .await?
+    } else {
+        sqlx::query_as::<_, FeedRow>(
+            "SELECT id, user_id, uploader_name, preview_path, thumbnail_path,
+                    mime_type, caption, like_count, comment_count, created_at
+             FROM v_feed
+             WHERE event_id = $1
+               AND ($2::timestamptz IS NULL OR created_at < $2)
+             ORDER BY created_at DESC
+             LIMIT $3",
+        )
+        .bind(auth.event_id)
+        .bind(
+            if let Some(cursor) = q.cursor {
+                get_cursor_time(&state.pool, cursor).await
+            } else {
+                None
+            },
+        )
+        .bind(limit + 1)
+        .fetch_all(&state.pool)
+        .await?
     };
 
-    // Tags from either param, normalised the same way `Hashtag::upsert` stores them
-    // (trimmed, leading `#` dropped, lowercased) so the comparison is exact.
-    let tags = normalize_tags(q.hashtag.as_deref(), q.hashtags.as_deref());
-    let uploader = q
-        .uploader
-        .as_deref()
-        .map(str::trim)
-        .filter(|s| !s.is_empty());
-
-    // ONE statement for every combination, rather than a branch per filter. `EXISTS` with
-    // `= ANY($4)` gives OR across the tag group without the row multiplication a JOIN would
-    // cause when a photo carries two selected tags; the uploader predicate ANDs on top. Both
-    // are no-ops when NULL, so the unfiltered feed takes the same path.
-    let rows = sqlx::query_as::<_, FeedRow>(
-        "SELECT v.id, v.user_id, v.uploader_name, v.preview_path, v.thumbnail_path,
-                v.display_path, v.mime_type, v.caption, v.like_count, v.comment_count,
-                v.created_at
-         FROM v_feed v
-         WHERE v.event_id = $1
-           AND ($2::timestamptz IS NULL OR (v.created_at, v.id) < ($2, $3))
-           AND ($4::text[] IS NULL OR EXISTS (
-                 SELECT 1 FROM upload_hashtag uh
-                 JOIN hashtag h ON h.id = uh.hashtag_id
-                 WHERE uh.upload_id = v.id AND h.tag = ANY($4)))
-           AND ($5::text IS NULL OR v.uploader_name = $5)
-         ORDER BY v.created_at DESC, v.id DESC
-         LIMIT $6",
-    )
-    .bind(auth.event_id)
-    .bind(cursor_time)
-    .bind(cursor_id)
-    .bind(tags.as_deref())
-    .bind(uploader)
-    .bind(limit + 1)
-    .fetch_all(&state.pool)
-    .await?;
-
     let has_more = rows.len() as i64 > limit;
     let rows: Vec<FeedRow> = rows.into_iter().take(limit as usize).collect();
-    let next_cursor = if has_more {
-        rows.last().map(|r| r.id)
-    } else {
-        None
-    };
+    let next_cursor = if has_more { rows.last().map(|r| r.id) } else { None };
 
     // Batch check which uploads the current user has liked
     let upload_ids: Vec<Uuid> = rows.iter().map(|r| r.id).collect();
     let liked_set = get_liked_set(&state.pool, auth.user_id, &upload_ids).await;
 
+    let now = Utc::now().timestamp();
+    let secret = &state.config.jwt_secret;
     let uploads = rows
         .into_iter()
         .map(|r| {
-            // Gated media aliases (visibility-checked, direct /media blocked). Emit the
-            // URL only when the variant actually exists — the URL is what signals the
-            // client which variant to load.
-            let preview_url = r
-                .preview_path
-                .as_ref()
-                .map(|_| format!("/api/v1/upload/{}/preview", r.id));
-            let thumbnail_url = r
-                .thumbnail_path
-                .as_ref()
-                .map(|_| format!("/api/v1/upload/{}/thumbnail", r.id));
-            let display_url = r
-                .display_path
-                .as_ref()
-                .map(|_| format!("/api/v1/upload/{}/display", r.id));
-            FeedUpload {
-                liked_by_me: liked_set.contains(&r.id),
-                id: r.id,
-                user_id: r.user_id,
-                uploader_name: r.uploader_name,
-                preview_url,
-                thumbnail_url,
-                display_url,
-                mime_type: r.mime_type,
-                caption: r.caption,
-                like_count: r.like_count,
-                comment_count: r.comment_count,
-                created_at: r.created_at,
-            }
+            let liked = liked_set.contains(&r.id);
+            to_feed_upload(r, liked, secret, now)
         })
         .collect();
 
@@ -230,143 +190,90 @@ pub struct DeltaQuery {
 pub struct DeltaResponse {
     pub uploads: Vec<FeedUpload>,
     pub deleted_ids: Vec<Uuid>,
-    /// Users whose uploads became hidden (banned / uploads_hidden) since `since`. A ban is
-    /// not a soft-delete, so it never appears in `deleted_ids`; without this, a client that
-    /// missed the ephemeral `user-hidden` SSE (a reconnecting projector, most acutely) would
-    /// keep displaying the banned user's already-loaded slides. The client evicts every
-    /// upload from these users on receipt.
-    pub hidden_user_ids: Vec<Uuid>,
-    /// True when the upload query hit `DELTA_LIMIT`: the response carries only the
-    /// newest slice of the gap, so the client must fall back to a full feed refresh
-    /// rather than merging (the older missed uploads are absent and unrecoverable
-    /// via a later delta, which advances `since` past them).
-    pub truncated: bool,
-    /// The server's clock at the moment this delta was computed. The client advances its
-    /// reconnect cursor from THIS, never `new Date()` — a browser clock even seconds fast
-    /// would otherwise silently skip uploads whose server `created_at` falls in the skew
-    /// window (they'd never reappear without a hard refresh).
-    pub server_time: DateTime<Utc>,
+    /// Set when the delta was clamped (too-old cursor) or hit the row cap — the
+    /// client should do a full feed reload instead of trusting the partial set.
+    pub reload_required: bool,
 }
 
+/// Hard cap on how many uploads one delta returns. Beyond this the client is
+/// told to reload rather than streaming the whole gallery through the view.
+const DELTA_LIMIT: i64 = 200;
+/// How far back a client-supplied `since` may reach. A tab backgrounded for days
+/// must not pull the entire event on reconnect.
+const DELTA_MAX_LOOKBACK_DAYS: i64 = 7;
+
 pub async fn feed_delta(
     State(state): State<AppState>,
     auth: AuthUser,
     Query(q): Query<DeltaQuery>,
 ) -> Result<Json<DeltaResponse>, AppError> {
-    // Rate-limit the delta the same way as the paginated feed. Without this, ~100 clients
-    // reconnecting at once (post-outage, or a flapping network) each fire an unbounded
-    // delta fetch — a reconnect stampede. Keyed per-user so one client can't starve others
-    // behind a shared NAT.
-    let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
-    let feed_rate_on = config::get_bool(&state.config_cache, "feed_rate_enabled", true).await;
+    // H7: feed_delta runs the (expensive) feed query and fires on every tab
+    // refocus, so it needs the same rate limit as feed(), keyed per user.
+    let rate_limits_on = config::get_bool(&state.pool, "rate_limits_enabled", true).await;
+    let feed_rate_on = config::get_bool(&state.pool, "feed_rate_enabled", true).await;
     if rate_limits_on && feed_rate_on {
-        let rate_limit = config::get_usize(&state.config_cache, "feed_rate_per_min", 60).await;
-        if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
+        let rate_limit = config::get_usize(&state.pool, "feed_rate_per_min", 60).await;
+        if !state.rate_limiter.check(
             format!("feed_delta:{}", auth.user_id),
             rate_limit,
             Duration::from_secs(60),
         ) {
             return Err(AppError::TooManyRequests(
                 "Zu viele Anfragen. Bitte warte kurz und versuche es erneut.".into(),
-                Some(retry_after_secs),
+                None,
             ));
         }
     }
 
-    // Anchor the next cursor to the DB clock, captured *before* the queries so an upload
-    // committed during this handler is re-fetched next time rather than skipped (a
-    // duplicate id merges idempotently on the client; a miss is unrecoverable).
-    let server_time: DateTime<Utc> = sqlx::query_scalar("SELECT NOW()")
-        .fetch_one(&state.pool)
-        .await?;
+    // Clamp the lookback server-side; signal a full reload if we had to.
+    let min_since = Utc::now() - chrono::Duration::days(DELTA_MAX_LOOKBACK_DAYS);
+    let clamped = q.since < min_since;
+    let since = if clamped { min_since } else { q.since };
 
-    // Bounded like the paginated feed: a stale `since` could otherwise pull the
-    // entire event's uploads in one response. If a client hits the cap it should
-    // fall back to a full feed refresh rather than another delta.
-    const DELTA_LIMIT: i64 = 200;
-    // `>= since` (not `>`): `created_at` is not unique, so a strict `>` anchored to the exact
-    // timestamp of the last-seen upload silently drops a SECOND upload committed in the same
-    // microsecond — an unrecoverable live-update miss. `>=` re-includes the boundary rows;
-    // the client merges by id (see the feed-delta handler's `seen` set), so the duplicate is
-    // harmless while the tied upload is no longer lost. The cursor still advances to the
-    // response's `server_time`, so this doesn't re-fetch on every subsequent delta.
     let rows = sqlx::query_as::<_, FeedRow>(
         "SELECT id, user_id, uploader_name, preview_path, thumbnail_path,
-                display_path, mime_type, caption, like_count, comment_count, created_at
+                mime_type, caption, like_count, comment_count, created_at
          FROM v_feed
-         WHERE event_id = $1 AND created_at >= $2
-         ORDER BY created_at DESC, id DESC
+         WHERE event_id = $1 AND created_at > $2
+         ORDER BY created_at DESC
          LIMIT $3",
     )
     .bind(auth.event_id)
-    .bind(q.since)
-    .bind(DELTA_LIMIT)
+    .bind(since)
+    .bind(DELTA_LIMIT + 1)
     .fetch_all(&state.pool)
     .await?;
 
-    // Hit the cap => this is only the newest slice of a larger gap. Signal the
-    // client to full-refresh instead of merging a partial delta.
-    let truncated = rows.len() as i64 >= DELTA_LIMIT;
+    let capped = rows.len() as i64 > DELTA_LIMIT;
+    let rows: Vec<FeedRow> = rows.into_iter().take(DELTA_LIMIT as usize).collect();
+    let reload_required = clamped || capped;
 
-    // `>=` for the same tie-break reason as the uploads query above; re-signalling an
-    // already-removed id is idempotent on the client (it filters its list by these ids).
     let deleted_ids: Vec<(Uuid,)> = sqlx::query_as(
         "SELECT id FROM upload
-         WHERE event_id = $1 AND deleted_at IS NOT NULL AND deleted_at >= $2",
+         WHERE event_id = $1 AND deleted_at IS NOT NULL AND deleted_at > $2",
     )
     .bind(auth.event_id)
-    .bind(q.since)
-    .fetch_all(&state.pool)
-    .await?;
-
-    // Users hidden since the cursor (ban / uploads_hidden). Uncapped like `deleted_ids` and
-    // for the same reason — an eviction the client misses is unrecoverable via a later delta.
-    let hidden_user_ids: Vec<(Uuid,)> = sqlx::query_as(
-        "SELECT id FROM \"user\"
-         WHERE event_id = $1 AND uploads_hidden = TRUE
-           AND uploads_hidden_at IS NOT NULL AND uploads_hidden_at >= $2",
-    )
-    .bind(auth.event_id)
-    .bind(q.since)
+    .bind(since)
     .fetch_all(&state.pool)
     .await?;
 
     let upload_ids: Vec<Uuid> = rows.iter().map(|r| r.id).collect();
     let liked_set = get_liked_set(&state.pool, auth.user_id, &upload_ids).await;
 
+    let now = Utc::now().timestamp();
+    let secret = &state.config.jwt_secret;
     let uploads = rows
         .into_iter()
-        .map(|r| FeedUpload {
-            liked_by_me: liked_set.contains(&r.id),
-            id: r.id,
-            user_id: r.user_id,
-            uploader_name: r.uploader_name,
-            preview_url: r
-                .preview_path
-                .as_ref()
-                .map(|_| format!("/api/v1/upload/{}/preview", r.id)),
-            thumbnail_url: r
-                .thumbnail_path
-                .as_ref()
-                .map(|_| format!("/api/v1/upload/{}/thumbnail", r.id)),
-            display_url: r
-                .display_path
-                .as_ref()
-                .map(|_| format!("/api/v1/upload/{}/display", r.id)),
-            mime_type: r.mime_type,
-            caption: r.caption,
-            like_count: r.like_count,
-            comment_count: r.comment_count,
-            created_at: r.created_at,
+        .map(|r| {
+            let liked = liked_set.contains(&r.id);
+            to_feed_upload(r, liked, secret, now)
         })
         .collect();
 
     Ok(Json(DeltaResponse {
         uploads,
         deleted_ids: deleted_ids.into_iter().map(|r| r.0).collect(),
-        hidden_user_ids: hidden_user_ids.into_iter().map(|r| r.0).collect(),
-        truncated,
-        server_time,
+        reload_required,
     }))
 }
 
@@ -380,11 +287,12 @@ pub async fn hashtags(
     State(state): State<AppState>,
     auth: AuthUser,
 ) -> Result<Json<Vec<HashtagCount>>, AppError> {
-    let rows: Vec<(String, i64)> =
-        sqlx::query_as("SELECT tag, upload_count FROM v_hashtag_counts WHERE event_id = $1")
-            .bind(auth.event_id)
-            .fetch_all(&state.pool)
-            .await?;
+    let rows: Vec<(String, i64)> = sqlx::query_as(
+        "SELECT tag, upload_count FROM v_hashtag_counts WHERE event_id = $1",
+    )
+    .bind(auth.event_id)
+    .fetch_all(&state.pool)
+    .await?;
 
     Ok(Json(
         rows.into_iter()
@@ -393,43 +301,14 @@ pub async fn hashtags(
     ))
 }
 
-/// Every uploader who has at least one visible upload, for the grid's "Nutzer suchen" picker.
-///
-/// The picker used to derive names from the uploads currently in memory — page 1, 20 items —
-/// so typing a guest's name found nothing whenever their photos happened to sit below the
-/// fold, which reads as "search is broken". This is the authoritative list.
-///
-/// Reads `v_feed`, so it inherits exactly the feed's visibility rules: soft-deleted uploads,
-/// banned uploaders and hidden uploaders are all excluded, and a guest who has not uploaded
-/// anything never appears. Uncapped on purpose — one short string per uploader, bounded by
-/// the guest count, and truncating it would reintroduce the very bug this replaces.
-/// Deliberately NOT the host-only `/host/users` route: that one lists every joined guest and
-/// exposes moderation state.
-pub async fn uploaders(
-    State(state): State<AppState>,
-    auth: AuthUser,
-) -> Result<Json<Vec<String>>, AppError> {
-    let rows: Vec<(String,)> = sqlx::query_as(
-        "SELECT DISTINCT uploader_name FROM v_feed WHERE event_id = $1 ORDER BY uploader_name",
-    )
-    .bind(auth.event_id)
-    .fetch_all(&state.pool)
-    .await?;
-
-    Ok(Json(rows.into_iter().map(|(name,)| name).collect()))
-}
-
-/// Resolve a cursor id to its `(created_at, id)` position. Both are needed:
-/// `created_at` alone isn't unique, so pagination must break ties on `id` to
-/// avoid silently dropping rows that share a timestamp across a page boundary.
-async fn get_cursor_pos(pool: &sqlx::PgPool, cursor_id: Uuid) -> Option<(DateTime<Utc>, Uuid)> {
-    let row: Option<(DateTime<Utc>, Uuid)> =
-        sqlx::query_as("SELECT created_at, id FROM upload WHERE id = $1")
+async fn get_cursor_time(pool: &sqlx::PgPool, cursor_id: Uuid) -> Option<DateTime<Utc>> {
+    let row: Option<(DateTime<Utc>,)> =
+        sqlx::query_as("SELECT created_at FROM upload WHERE id = $1")
             .bind(cursor_id)
             .fetch_optional(pool)
             .await
             .ok()?;
-    row
+    row.map(|r| r.0)
 }
 
 async fn get_liked_set(
@@ -440,51 +319,14 @@ async fn get_liked_set(
     if upload_ids.is_empty() {
         return std::collections::HashSet::new();
     }
-    let rows: Vec<(Uuid,)> =
-        sqlx::query_as("SELECT upload_id FROM \"like\" WHERE user_id = $1 AND upload_id = ANY($2)")
-            .bind(user_id)
-            .bind(upload_ids)
-            .fetch_all(pool)
-            .await
-            .unwrap_or_default();
+    let rows: Vec<(Uuid,)> = sqlx::query_as(
+        "SELECT upload_id FROM \"like\" WHERE user_id = $1 AND upload_id = ANY($2)",
+    )
+    .bind(user_id)
+    .bind(upload_ids)
+    .fetch_all(pool)
+    .await
+    .unwrap_or_default();
 
     rows.into_iter().map(|r| r.0).collect()
 }
-
-#[cfg(test)]
-mod tests {
-    use super::normalize_tags;
-
-    /// The chips carry display strings (`#Tanz`), the `hashtag` table stores `tanz`. If these
-    /// two drift the filter silently returns nothing, which is indistinguishable from "no
-    /// photos have this tag" — so pin the normalisation to `Hashtag::upsert`'s rule.
-    #[test]
-    fn tags_are_normalised_like_upsert_stores_them() {
-        assert_eq!(
-            normalize_tags(Some("#Tanz"), None),
-            Some(vec!["tanz".to_string()])
-        );
-        assert_eq!(
-            normalize_tags(None, Some(" #Buffet , reden ")),
-            Some(vec!["buffet".to_string(), "reden".to_string()])
-        );
-    }
-
-    /// An empty list must mean "no filter", never "match nothing" — returning `Some(vec![])`
-    /// would make `= ANY('{}')` false for every row and blank the feed.
-    #[test]
-    fn blank_input_disables_the_filter() {
-        assert_eq!(normalize_tags(None, None), None);
-        assert_eq!(normalize_tags(Some("   "), Some(" , ,#")), None);
-    }
-
-    /// Both params feed one list, de-duplicated: the list view sends `hashtag`, the grid sends
-    /// `hashtags`, and carrying a filter across views can legitimately set both to the same tag.
-    #[test]
-    fn single_and_csv_merge_without_duplicates() {
-        assert_eq!(
-            normalize_tags(Some("tanz"), Some("tanz,buffet")),
-            Some(vec!["tanz".to_string(), "buffet".to_string()])
-        );
-    }
-}

backend/src/handlers/me.rs

@@ -7,14 +7,14 @@
 //!   account page loads this once on mount instead of issuing several round trips.
 //! - `GET /api/v1/me/quota`  — live per-user storage quota estimate.
 
-use axum::Json;
 use axum::extract::State;
+use axum::Json;
 use serde::Serialize;
 
 use crate::auth::middleware::AuthUser;
 use crate::error::AppError;
 use crate::handlers::upload::compute_storage_quota;
-use crate::models::user::{User, UserRole};
+use crate::models::user::User;
 use crate::services::config;
 use crate::state::AppState;
 
@@ -37,26 +37,12 @@ pub async fn get_quota(
 
     let estimate = compute_storage_quota(&state).await;
 
-    // Raw server telemetry (free disk, concurrent uploader count) is staff-only — it
-    // must never reach a guest, even though the guest upload UI no longer renders it.
-    // A guest still gets their own `used`/`limit` so enforcement stays transparent to
-    // the code paths that consume it; only the server-wide fields are zeroed.
-    let is_staff = matches!(auth.role, UserRole::Host | UserRole::Admin);
-
     Ok(Json(QuotaDto {
         enabled: estimate.limit_bytes.is_some(),
         used_bytes: user.total_upload_bytes,
         limit_bytes: estimate.limit_bytes,
-        active_uploaders: if is_staff {
-            estimate.active_uploaders
-        } else {
-            0
-        },
-        free_disk_bytes: if is_staff {
-            estimate.free_disk_bytes
-        } else {
-            0
-        },
+        active_uploaders: estimate.active_uploaders,
+        free_disk_bytes: estimate.free_disk_bytes,
     }))
 }
 
@@ -69,20 +55,9 @@ pub struct MeContextDto {
     pub privacy_note: String,
     pub quota_enabled: bool,
     pub storage_quota_enabled: bool,
-    /// Uploads are locked (event closed) — the composer should show a locked state live
-    /// instead of letting a guest compose an upload only to eat a 403.
+    /// Whether uploads are currently locked for the event, so the client can show
+    /// a banner + disable the upload affordance on load (not just via SSE).
     pub uploads_locked: bool,
-    /// The gallery has been released and the export snapshotted — uploads are permanently
-    /// closed for this run (release ⇒ lock, and reopening regenerates).
-    pub gallery_released: bool,
-    /// This guest is banned: a deliberately READ-ONLY ban (see `handlers/host.rs`) — they keep
-    /// the feed and the keepsake, but every write is refused.
-    ///
-    /// Exposed so the UI can SAY so. Without it the client had no idea, so the upload button,
-    /// the like button and "Löschen" all rendered enabled and returned 403 "Du bist gesperrt."
-    /// on every tap — a guest tapping upload repeatedly with nobody to ask. The lock case
-    /// (`uploads_locked`) has always been surfaced for exactly this reason; a ban was not.
-    pub is_banned: bool,
 }
 
 pub async fn get_context(
@@ -93,21 +68,13 @@ pub async fn get_context(
         .await?
         .ok_or_else(|| AppError::NotFound("Benutzer nicht gefunden.".into()))?;
 
-    let privacy_note = config::get_str(&state.config_cache, "privacy_note", "").await;
-    let quota_enabled = config::get_bool(&state.config_cache, "quota_enabled", true).await;
-    let storage_quota_enabled =
-        config::get_bool(&state.config_cache, "storage_quota_enabled", true).await;
-
-    let event =
-        crate::models::event::Event::find_by_slug(&state.pool, &state.config.event_slug).await?;
-    let uploads_locked = event
-        .as_ref()
+    let privacy_note = config::get_str(&state.pool, "privacy_note", "").await;
+    let quota_enabled = config::get_bool(&state.pool, "quota_enabled", true).await;
+    let storage_quota_enabled = config::get_bool(&state.pool, "storage_quota_enabled", true).await;
+    let uploads_locked = crate::models::event::Event::find_by_slug(&state.pool, &state.config.event_slug)
+        .await?
         .map(|e| e.uploads_locked_at.is_some())
         .unwrap_or(false);
-    let gallery_released = event
-        .as_ref()
-        .map(|e| e.export_released_at.is_some())
-        .unwrap_or(false);
 
     Ok(Json(MeContextDto {
         user_id: user.id,
@@ -117,204 +84,5 @@ pub async fn get_context(
         quota_enabled,
         storage_quota_enabled,
         uploads_locked,
-        gallery_released,
-        is_banned: user.is_banned,
     }))
 }
-
-/// `(original_path, preview_path, thumbnail_path, display_path)` for one upload.
-type UploadFilePaths = (String, Option<String>, Option<String>, Option<String>);
-
-/// Delete the caller's own account and everything attached to it.
-///
-/// The erasure path (H18). There was no user-deletion route at ANY role, so honouring a "please
-/// remove my photos and my name" request meant hand-written SQL against production — during or
-/// after a wedding, by whoever happened to have psql access. Deletion also never removed text:
-/// captions, comment bodies and hashtag links survived indefinitely by design, so even the
-/// existing per-photo delete left the guest's words in the database and in the keepsake.
-///
-/// Self-service on purpose. The alternative (host-initiated only) puts a guest's erasure request
-/// through a third party who is at a party, and the join page's data notice now promises this.
-///
-/// ORDER MATTERS. `upload.user_id` and `comment.user_id` are plain FKs with NO `ON DELETE CASCADE`
-/// (migration 002), so deleting the user first fails on a constraint violation. Children first,
-/// then the row itself — at which point `session`, `like` and `pin_reset_request` do cascade.
-pub async fn delete_account(
-    State(state): State<AppState>,
-    auth: AuthUser,
-) -> Result<axum::http::StatusCode, AppError> {
-    // The last host/admin may not erase themselves: it would leave the event with no operator and
-    // no way to appoint one. Mirrors the floor `set_role` and `ban_user` already enforce.
-    let user = User::find_by_id(&state.pool, auth.user_id)
-        .await?
-        .ok_or_else(|| AppError::NotFound("Benutzer nicht gefunden.".into()))?;
-    if matches!(user.role, UserRole::Host | UserRole::Admin) {
-        let others = sqlx::query_scalar::<_, i64>(
-            "SELECT COUNT(*) FROM \"user\"
-              WHERE event_id = $1 AND id != $2
-                AND role IN ('host', 'admin') AND is_banned = FALSE",
-        )
-        .bind(auth.event_id)
-        .bind(auth.user_id)
-        .fetch_one(&state.pool)
-        .await?;
-        if others == 0 {
-            return Err(AppError::BadRequest(
-                "Du bist der letzte Gastgeber. Ernenne zuerst einen anderen Gastgeber, bevor du \
-                 dein Konto löschst."
-                    .into(),
-            ));
-        }
-    }
-
-    // Collect the file paths BEFORE the rows go, or they are unrecoverable. Every derivative, not
-    // just the original: a preview left behind is still the guest's photo.
-    let files: Vec<UploadFilePaths> = sqlx::query_as(
-        "SELECT original_path, preview_path, thumbnail_path, display_path
-           FROM upload WHERE user_id = $1",
-    )
-    .bind(auth.user_id)
-    .fetch_all(&state.pool)
-    .await?;
-
-    let mut tx = state.pool.begin().await?;
-
-    // The last-host guard, AUTHORITATIVELY — inside the transaction, holding a lock.
-    //
-    // The pre-check further up runs on the pool before this transaction opens, so two hosts
-    // deleting themselves at the same moment each saw the other and both proceeded, leaving the
-    // event with NO operator: nobody to moderate, nobody to release the gallery, and no way to
-    // appoint anyone because appointing requires a host. Not recoverable from inside the app.
-    //
-    // Serialised with a transaction-scoped ADVISORY lock, not a row lock. `FOR UPDATE` on the
-    // other operators\' rows looks like the obvious answer and is the wrong one: each deleter would
-    // lock the OTHER\'s row and then try to delete its own, so the two block on each other and
-    // Postgres resolves it by killing one with a deadlock error — the invariant holds, but the
-    // loser gets a 500 instead of the sentence below. Locking the `event` row instead would
-    // serialise cleanly, but it inverts the lock order every moderation path uses (upload/user
-    // rows first, event last). An advisory lock is a separate lock space, so it cannot join the
-    // row-lock graph at all, and it is released automatically when this transaction ends.
-    //
-    // FIRST STATEMENT IN THE TRANSACTION, before any row lock — the ORDER matters as much as the
-    // lock. `ban_user` and `set_role` take this same lock and then go on to lock `user` and
-    // `event` rows. If this path grabbed those rows first and reached for the advisory lock
-    // afterwards, the two would deadlock, each holding what the other needs, and Postgres would
-    // kill one with a 500: the invariant would survive, but a host deleting their account would
-    // get an error page instead of the sentence below.
-    //
-    // Taking it up front also means the refusal path does no work at all before answering.
-    if matches!(user.role, UserRole::Host | UserRole::Admin) {
-        // Shared with `host::ban_user` and `host::set_role` — the same key, by construction rather
-        // than by two copies agreeing. All three remove an operator, so all three must serialise
-        // against each other or the floor is enforceable only against its own kind of caller.
-        crate::handlers::host::lock_operator_floor(&mut tx, auth.event_id).await?;
-        let others: Vec<uuid::Uuid> = sqlx::query_scalar(
-            "SELECT id FROM \"user\"
-              WHERE event_id = $1 AND id != $2
-                AND role IN ('host', 'admin') AND is_banned = FALSE",
-        )
-        .bind(auth.event_id)
-        .bind(auth.user_id)
-        .fetch_all(&mut *tx)
-        .await?;
-        if others.is_empty() {
-            return Err(AppError::BadRequest(
-                "Du bist der letzte Gastgeber. Ernenne zuerst einen anderen Gastgeber, bevor du \
-                 dein Konto löschst."
-                    .into(),
-            ));
-        }
-    }
-
-    // Comments the guest wrote on OTHER people's photos. Hard delete, not `deleted_at`: this is
-    // erasure, and a soft delete leaves the body in the table and in the keepsake's data.json.
-    sqlx::query("DELETE FROM comment WHERE user_id = $1")
-        .bind(auth.user_id)
-        .execute(&mut *tx)
-        .await?;
-    // Their uploads. Cascades comments and likes ON those uploads, plus upload_hashtag links.
-    sqlx::query("DELETE FROM upload WHERE user_id = $1")
-        .bind(auth.user_id)
-        .execute(&mut *tx)
-        .await?;
-    // Invalidate the keepsake inside the same transaction — an already-released archive still
-    // contains this guest's photos and captions, and erasure that leaves them in the downloadable
-    // ZIP has not happened. Returns None when the event isn't released, in which case there is
-    // nothing to rebuild.
-    let regen = crate::services::export::invalidate_and_arm(
-        &mut tx,
-        &state.config.event_slug,
-        crate::services::export::Affects::Both,
-    )
-    .await?;
-    // And the account. `session`, `like` and `pin_reset_request` cascade from here.
-    sqlx::query("DELETE FROM \"user\" WHERE id = $1")
-        .bind(auth.user_id)
-        .execute(&mut *tx)
-        .await?;
-    tx.commit().await?;
-
-    // IMMEDIATELY after the commit, before any other `.await`. Every other `invalidate_and_arm`
-    // call site does this; this one used to spawn the workers *after* the file-removal loop below,
-    // and axum drops a handler future the moment the client disconnects. Drop it inside that loop
-    // and the keepsake is left with the epoch bumped, both `export_job` rows armed `pending` at
-    // that epoch, and NO WORKER: `/export/zip` and `/export/html` 404, the UI sits on
-    // "Wird vorbereitet…" forever, and `recover_exports` only runs at boot. Deleting your account
-    // from a phone that walks out of wifi range is enough to do it.
-    if let Some(r) = regen {
-        crate::handlers::host::start_regen(&state, r);
-    }
-
-    // Best effort, after the commit. Anything missed here is an orphan with no row pointing at it,
-    // which `sweep_orphan_originals` reclaims on its next pass — so a failure delays reclamation
-    // rather than leaving the file referenced.
-    for (original, preview, thumbnail, display) in &files {
-        for rel in [
-            Some(original),
-            preview.as_ref(),
-            thumbnail.as_ref(),
-            display.as_ref(),
-        ]
-        .into_iter()
-        .flatten()
-        {
-            let abs = state.config.media_path.join(rel);
-            if let Err(e) = tokio::fs::remove_file(&abs).await
-                && e.kind() != std::io::ErrorKind::NotFound
-            {
-                tracing::warn!(error = ?e, path = %abs.display(), "account deletion: could not remove media file");
-            }
-        }
-    }
-
-    // Evict their content from every open feed and the projector. `user-hidden` is exactly the
-    // right signal — it already means "this user's cards must go" — and reusing it means every
-    // client already handles this with no new event type.
-    let _ = state.sse_tx.send(crate::state::SseEvent::new(
-        "user-hidden",
-        serde_json::json!({ "user_id": auth.user_id }).to_string(),
-    ));
-
-    // Audited like the host actions it resembles, with the actor and target being the same person.
-    //
-    // The names are passed EXPLICITLY here, unlike every other call site. `audit::record` resolves
-    // a missing name by looking the id up in `"user"` — and this handler has just hard-deleted that
-    // row, so the lookup would find nothing and write the NULL that makes the record unreadable.
-    // This is the row most likely to be read later ("whose photos disappeared?"), and migration 029
-    // made these columns non-FK precisely so it would survive the deletion.
-    crate::services::audit::record(
-        &state.pool,
-        auth.event_id,
-        auth.user_id,
-        Some(&user.display_name),
-        user.role.clone(),
-        "delete_account",
-        Some(auth.user_id),
-        Some(&user.display_name),
-        Some(serde_json::json!({ "uploads_removed": files.len() })),
-    )
-    .await;
-
-    tracing::info!(user_id = %auth.user_id, uploads = files.len(), "account deleted by its owner");
-    Ok(axum::http::StatusCode::NO_CONTENT)
-}

backend/src/handlers/media.rs

@@ -0,0 +1,117 @@
+//! Authenticated media gateway.
+//!
+//! Replaces the raw `/media` `ServeDir`. Every media byte now flows through a
+//! signature check plus a DB lookup, so:
+//!   - soft-deleted uploads 404 (`find_by_id` filters `deleted_at`) — closes C3,
+//!   - ban-hidden uploaders' artifacts 404 (mirrors the `v_feed` rule) — H2,
+//!   - the export archives (which have no `upload` row) are unreachable — C1,
+//!   - HTML/SVG can't be served as an active document — the response carries
+//!     `nosniff` + a locked-down CSP (defense-in-depth behind the upload-time
+//!     allowlist) — C2 sink.
+//!
+//! Access is authorized by the embedded HMAC signature (see `media_token`), not
+//! a Bearer header, because `<img>`/`<video>` cannot send one.
+
+use axum::extract::{Path, Query, State};
+use axum::response::Response;
+use chrono::Utc;
+use serde::Deserialize;
+use uuid::Uuid;
+
+use crate::error::AppError;
+use crate::models::upload::Upload;
+use crate::models::user::User;
+use crate::services::media_token;
+use crate::state::AppState;
+
+#[derive(Deserialize)]
+pub struct MediaQuery {
+    pub exp: i64,
+    pub sig: String,
+}
+
+pub async fn serve(
+    State(state): State<AppState>,
+    Path((kind, id)): Path<(String, Uuid)>,
+    Query(q): Query<MediaQuery>,
+) -> Result<Response, AppError> {
+    if !media_token::verify(
+        &state.config.jwt_secret,
+        &kind,
+        id,
+        q.exp,
+        &q.sig,
+        Utc::now().timestamp(),
+    ) {
+        return Err(AppError::Unauthorized(
+            "Ungültige oder abgelaufene Medien-URL.".into(),
+        ));
+    }
+
+    // `find_by_id` filters `deleted_at IS NULL`, so soft-deleted uploads 404.
+    let upload = Upload::find_by_id(&state.pool, id)
+        .await?
+        .ok_or_else(|| AppError::NotFound("Datei nicht gefunden.".into()))?;
+
+    // Hide artifacts of users whose uploads were hidden by a host (ban + hide),
+    // matching the `usr.uploads_hidden = FALSE` predicate in `v_feed`.
+    let uploader = User::find_by_id(&state.pool, upload.user_id)
+        .await?
+        .ok_or_else(|| AppError::NotFound("Datei nicht gefunden.".into()))?;
+    if uploader.uploads_hidden {
+        return Err(AppError::NotFound("Datei nicht gefunden.".into()));
+    }
+
+    let (rel_path, content_type) = match kind.as_str() {
+        "original" => (upload.original_path.clone(), upload.mime_type.clone()),
+        "preview" => (
+            upload
+                .preview_path
+                .clone()
+                .ok_or_else(|| AppError::NotFound("Vorschau nicht verfügbar.".into()))?,
+            "image/jpeg".to_string(),
+        ),
+        "thumbnail" => (
+            upload
+                .thumbnail_path
+                .clone()
+                .ok_or_else(|| AppError::NotFound("Vorschau nicht verfügbar.".into()))?,
+            "image/jpeg".to_string(),
+        ),
+        _ => return Err(AppError::NotFound("Unbekannter Medientyp.".into())),
+    };
+
+    stream_file(&state.config.media_path.join(&rel_path), &content_type).await
+}
+
+async fn stream_file(path: &std::path::Path, content_type: &str) -> Result<Response, AppError> {
+    use axum::body::Body;
+    use axum::http::{header, StatusCode};
+    use tokio_util::io::ReaderStream;
+
+    let file = tokio::fs::File::open(path)
+        .await
+        .map_err(|_| AppError::NotFound("Datei nicht gefunden.".into()))?;
+    let metadata = file
+        .metadata()
+        .await
+        .map_err(|e| AppError::Internal(e.into()))?;
+    let stream = ReaderStream::new(file);
+
+    Response::builder()
+        .status(StatusCode::OK)
+        .header(header::CONTENT_TYPE, content_type)
+        .header(header::CONTENT_LENGTH, metadata.len())
+        // URLs are signed + time-boxed; cache only privately, aligned to the
+        // 1h URL-stability bucket.
+        .header(header::CACHE_CONTROL, "private, max-age=3600")
+        // Defense-in-depth against any active content slipping past the
+        // upload-time allowlist: never sniff, never script.
+        .header(header::X_CONTENT_TYPE_OPTIONS, "nosniff")
+        .header(
+            header::CONTENT_SECURITY_POLICY,
+            "default-src 'none'; sandbox; frame-ancestors 'none'",
+        )
+        .body(Body::from_stream(stream))
+        .map_err(|e| AppError::Internal(e.into()))
+}

backend/src/handlers/mod.rs

@@ -2,7 +2,7 @@ pub mod admin;
 pub mod feed;
 pub mod host;
 pub mod me;
-pub mod public;
+pub mod media;
 pub mod social;
 pub mod sse;
 pub mod test_admin;

backend/src/handlers/public.rs

@@ -1,54 +0,0 @@
-//! Unauthenticated, read-only endpoints safe to expose before a user has joined.
-
-use axum::Json;
-use axum::extract::State;
-use serde::Serialize;
-
-use crate::services::config;
-use crate::state::AppState;
-
-#[derive(Serialize)]
-pub struct PublicEventDto {
-    pub name: String,
-    pub slug: String,
-    /// Whether the comment feature is on (env `COMMENTS_ENABLED`). The frontend hides
-    /// the whole comment UI when false; exposed here so even the pre-auth shell knows.
-    pub comments_enabled: bool,
-    /// Active colour theme. `preset` is an id the frontend maps to a palette (or
-    /// "custom"); `primary`/`accent` are the `#rrggbb` seeds the ramps derive from.
-    /// Resolved as DB-config override → env default. Public so the theme applies on
-    /// the very first (pre-auth) paint without a flash.
-    pub theme_preset: String,
-    pub theme_primary: String,
-    pub theme_accent: String,
-    /// The operator's data notice, if they set one. Empty string when unset (migration 009
-    /// defaults it to `''`).
-    ///
-    /// Exposed PUBLICLY — it was only on `/me/context`, which requires a token, so the one place a
-    /// notice actually has to appear (before a name is collected) could not read it. The join page
-    /// pairs this with a baseline notice of its own, precisely because this can be empty: relying
-    /// on an operator-supplied string meant a stock deploy collected ~100 EU guests' photos of
-    /// identifiable people, including children, with no notice at the point of collection at all.
-    pub privacy_note: String,
-}
-
-/// Public event identity + presentation config, used by the pre-auth join/recover
-/// screens (which event am I joining, what does it look like). Only non-user-scoped
-/// fields are exposed, so this is safe without a token. Identity comes straight from
-/// instance config; the theme is resolved from the runtime `config` table (admin UI)
-/// falling back to the env-seeded default.
-pub async fn get_public_event(State(state): State<AppState>) -> Json<PublicEventDto> {
-    let cache = &state.config_cache;
-    Json(PublicEventDto {
-        name: state.config.event_name.clone(),
-        slug: state.config.event_slug.clone(),
-        comments_enabled: state.config.comments_enabled,
-        theme_preset: config::get_str(cache, "theme_preset", &state.config.default_theme_preset)
-            .await,
-        theme_primary: config::get_str(cache, "theme_primary", &state.config.default_theme_primary)
-            .await,
-        theme_accent: config::get_str(cache, "theme_accent", &state.config.default_theme_accent)
-            .await,
-        privacy_note: config::get_str(cache, "privacy_note", "").await,
-    })
-}

backend/src/handlers/social.rs

@@ -1,8 +1,8 @@
-use axum::Json;
 use axum::extract::{Path, Query, State};
 use axum::http::StatusCode;
+use axum::Json;
 use chrono::{DateTime, Utc};
-use serde::{Deserialize, Serialize};
+use serde::Deserialize;
 use uuid::Uuid;
 
 use crate::auth::middleware::AuthUser;
@@ -10,76 +10,21 @@ use crate::error::AppError;
 use crate::models::comment::{Comment, CommentDto};
 use crate::models::hashtag::{self, Hashtag};
 use crate::models::upload::Upload;
-use crate::services::config;
 use crate::state::AppState;
 
-/// Throttle a social write. Keyed PER USER, like the feed and upload limits and for the same
-/// reason: at a venue every guest sits behind one NAT, so an IP key hands the whole party a
-/// single bucket and the most active guest starves everyone else.
-///
-/// These were the only mutating endpoints in the app with no limit at all — the coverage was
-/// asymmetric, not deliberately open. The ceiling is set well above anything a real guest
-/// produces; this bounds a script, not an enthusiastic double-tapper.
-async fn check_social_rate(state: &AppState, user_id: Uuid) -> Result<(), AppError> {
-    let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
-    let social_rate_on = config::get_bool(&state.config_cache, "social_rate_enabled", true).await;
-    if !(rate_limits_on && social_rate_on) {
-        return Ok(());
-    }
-    let rate_limit = config::get_usize(&state.config_cache, "social_rate_per_min", 120).await;
-    // ONE bucket across likes, comments and comment deletions. Separate buckets would let a
-    // caller triple the aggregate write rate just by alternating between them.
-    state
-        .rate_limiter
-        .check_with_retry(
-            format!("social:{user_id}"),
-            rate_limit,
-            std::time::Duration::from_secs(60),
-        )
-        .map_err(|retry_after_secs| {
-            AppError::TooManyRequests(
-                "Zu viele Aktionen. Bitte warte kurz und versuche es erneut.".into(),
-                Some(retry_after_secs),
-            )
-        })
-}
-
-#[derive(Serialize)]
-pub struct LikeResponse {
-    /// The caller's like state *after* this toggle. The client sets `liked_by_me` from
-    /// this rather than blind-inverting local state — otherwise a second device (same
-    /// recovered user) drifts, since the `like-update` broadcast only carries `like_count`.
-    pub liked: bool,
-    /// Fresh like count, or `null` if the (best-effort) count query hiccuped. The client
-    /// keeps its current count when this is null rather than adopting a wrong number.
-    pub like_count: Option<i64>,
-}
-
 pub async fn toggle_like(
     State(state): State<AppState>,
     auth: AuthUser,
     Path(upload_id): Path<Uuid>,
-) -> Result<Json<LikeResponse>, AppError> {
-    // Check if user is banned
-    let user = crate::models::user::User::find_by_id(&state.pool, auth.user_id)
-        .await?
-        .ok_or_else(|| AppError::NotFound("Benutzer nicht gefunden.".into()))?;
-    if user.is_banned {
-        return Err(AppError::Forbidden("Du bist gesperrt.".into()));
-    }
-    check_social_rate(&state, auth.user_id).await?;
-
-    // Event-scope: the upload must belong to the caller's event (404 otherwise),
-    // matching the host handlers' find_by_id_and_event pattern.
+) -> Result<StatusCode, AppError> {
+    // Ban is already rejected by the AuthUser extractor. Scope the target to the
+    // caller's event and reject deleted uploads (M1: no cross-event IDOR, no
+    // likes on soft-deleted posts).
     Upload::find_by_id_and_event(&state.pool, upload_id, auth.event_id)
         .await?
         .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
 
-    // NOTE: liking is intentionally allowed while the event is locked. Locking
-    // ("Event schließen") freezes *new uploads* only — likes, comments and
-    // browsing stay open (USER_JOURNEYS §9.3, FEATURES capability matrix).
-
-    // Try to insert; if conflict, delete (toggle). `liked` = the caller's state afterwards.
+    // Try to insert; if conflict, delete (toggle)
     let result = sqlx::query(
         "INSERT INTO \"like\" (upload_id, user_id) VALUES ($1, $2)
          ON CONFLICT (upload_id, user_id) DO NOTHING",
@@ -89,8 +34,7 @@ pub async fn toggle_like(
     .execute(&state.pool)
     .await?;
 
-    let liked = result.rows_affected() > 0;
-    if !liked {
+    if result.rows_affected() == 0 {
         // Already liked — remove
         sqlx::query("DELETE FROM \"like\" WHERE upload_id = $1 AND user_id = $2")
             .bind(upload_id)
@@ -99,39 +43,13 @@ pub async fn toggle_like(
             .await?;
     }
 
-    // Fresh count so feed clients can patch the single card in place instead of
-    // refetching page 1 (mirrors v_feed.like_count = COUNT(DISTINCT user_id)). The like
-    // itself is already committed, so a failed count must not fail the request — but we
-    // also must NOT broadcast/return a bogus 0 (that would push like_count: 0 to every
-    // client until the next event). On error we skip the broadcast and return null.
-    // The `NOT u.is_banned` join is what makes "mirrors v_feed.like_count" true. Migration 028
-    // added it to the view and not here, so the two disagreed the moment anyone was banned: the
-    // host bans a guest, the feed correctly drops to the lower number, and then the very next like
-    // on that photo broadcasts the UNFILTERED count back to every open client — including the
-    // host's, who is watching that number to confirm the ban took. It stayed wrong until a full
-    // page-1 refetch. `like.user_id` is NOT NULL REFERENCES "user"(id), so the inner join can
-    // neither drop nor duplicate a row.
-    let like_count = sqlx::query_scalar::<_, i64>(
-        "SELECT COUNT(DISTINCT l.user_id) FROM \"like\" l \
-         JOIN \"user\" u ON u.id = l.user_id \
-         WHERE l.upload_id = $1 AND NOT u.is_banned",
-    )
-    .bind(upload_id)
-    .fetch_one(&state.pool)
-    .await
-    .ok();
+    // Broadcast SSE
+    let _ = state.sse_tx.send(crate::state::SseEvent {
+        event_type: "like-update".to_string(),
+        data: serde_json::json!({ "upload_id": upload_id }).to_string(),
+    });
 
-    if let Some(count) = like_count {
-        // Broadcast the new count so other clients patch their card. Only `like_count` is
-        // shared — each client's own `liked_by_me` only changes via its own toggle (which
-        // now reads it straight from this response).
-        let _ = state.sse_tx.send(crate::state::SseEvent {
-            event_type: "like-update".to_string(),
-            data: serde_json::json!({ "upload_id": upload_id, "like_count": count }).to_string(),
-        });
-    }
-
-    Ok(Json(LikeResponse { liked, like_count }))
+    Ok(StatusCode::NO_CONTENT)
 }
 
 #[derive(Deserialize, Default)]
@@ -150,7 +68,8 @@ pub async fn list_comments(
     Path(upload_id): Path<Uuid>,
     Query(q): Query<ListCommentsQuery>,
 ) -> Result<Json<Vec<CommentDto>>, AppError> {
-    // Event-scope: only list comments for an upload in the caller's event.
+    // M1: a pure read behind any valid token must still be scoped to the
+    // caller's event and must not leak comments on soft-deleted uploads.
     Upload::find_by_id_and_event(&state.pool, upload_id, auth.event_id)
         .await?
         .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
@@ -171,28 +90,15 @@ pub async fn add_comment(
     Path(upload_id): Path<Uuid>,
     Json(body): Json<AddCommentRequest>,
 ) -> Result<(StatusCode, Json<CommentDto>), AppError> {
-    // Comments can be disabled instance-wide (env COMMENTS_ENABLED). The frontend hides
-    // the UI, but gate the API too so a stale client or direct call can't slip one in.
-    if !state.config.comments_enabled {
-        return Err(AppError::Forbidden("Kommentare sind deaktiviert.".into()));
-    }
-
-    let user = crate::models::user::User::find_by_id(&state.pool, auth.user_id)
-        .await?
-        .ok_or_else(|| AppError::NotFound("Benutzer nicht gefunden.".into()))?;
-    if user.is_banned {
-        return Err(AppError::Forbidden("Du bist gesperrt.".into()));
-    }
-    check_social_rate(&state, auth.user_id).await?;
-
-    // Event-scope: only comment on an upload that belongs to the caller's event.
+    // M1: scope the target upload to the caller's event and reject deleted
+    // posts. (Ban is already handled by the AuthUser extractor.)
     Upload::find_by_id_and_event(&state.pool, upload_id, auth.event_id)
         .await?
         .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
 
-    // NOTE: commenting is intentionally allowed while the event is locked. Locking
-    // freezes *new uploads* only — likes, comments and browsing stay open
-    // (USER_JOURNEYS §9.3, FEATURES capability matrix).
+    let user = crate::models::user::User::find_by_id(&state.pool, auth.user_id)
+        .await?
+        .ok_or_else(|| AppError::NotFound("Benutzer nicht gefunden.".into()))?;
 
     let text = body.body.trim();
     let text_chars = text.chars().count();
@@ -202,53 +108,26 @@ pub async fn add_comment(
         ));
     }
 
-    // Insert the comment and link its hashtags atomically, so a crash mid-loop
-    // can't leave a committed comment with only some of its tags indexed.
-    let mut tags = hashtag::extract_hashtags(text);
-    // Deterministic lock order, matching the upload path. `Hashtag::upsert` takes row locks,
-    // so two transactions touching the same two tags in OPPOSITE order deadlock — Postgres
-    // aborts one after ~1s and that guest's comment 500s. `extract_hashtags` returns them in
-    // text order, which is exactly the unordered case. Sort on the NORMALISED form, because
-    // that is the key `upsert` locks on.
-    tags.sort_by_key(|t| t.trim().trim_start_matches('#').to_lowercase());
-    tags.dedup_by_key(|t| t.trim().trim_start_matches('#').to_lowercase());
-    let mut tx = state.pool.begin().await?;
-    let comment = Comment::create(&mut *tx, upload_id, auth.user_id, text).await?;
+    let comment = Comment::create(&state.pool, upload_id, auth.user_id, text).await?;
+
+    // Process hashtags in comment body
+    let tags = hashtag::extract_hashtags(text);
     for tag in &tags {
-        let h = Hashtag::upsert(&mut *tx, auth.event_id, tag).await?;
+        let h = Hashtag::upsert(&state.pool, auth.event_id, tag).await?;
         sqlx::query(
             "INSERT INTO comment_hashtag (comment_id, hashtag_id) VALUES ($1, $2) ON CONFLICT DO NOTHING",
         )
         .bind(comment.id)
         .bind(h.id)
-        .execute(&mut *tx)
+        .execute(&state.pool)
         .await?;
     }
-    tx.commit().await?;
 
-    // Fresh count so feed clients can patch the single card in place instead of
-    // refetching page 1 (mirrors v_feed.comment_count = COUNT(DISTINCT c.id); COUNT(*)
-    // over the same deleted_at filter is identical since comment.id is the PK). The
-    // count + broadcast are a UI optimisation — the comment is already committed, so a
-    // failure here must not fail the request. Swallow the error and skip the broadcast.
-    // `NOT u.is_banned` for the same reason as `like_count` above — see that comment. Migration
-    // 028 put this filter in `v_feed.comment_count` and `Comment::list_for_upload`, but not here,
-    // so posting a comment pushed the pre-ban total back to every client.
-    if let Ok(comment_count) = sqlx::query_scalar::<_, i64>(
-        "SELECT COUNT(*) FROM comment c \
-         JOIN \"user\" u ON u.id = c.user_id \
-         WHERE c.upload_id = $1 AND c.deleted_at IS NULL AND NOT u.is_banned",
-    )
-    .bind(upload_id)
-    .fetch_one(&state.pool)
-    .await
-    {
-        let _ = state.sse_tx.send(crate::state::SseEvent {
-            event_type: "new-comment".to_string(),
-            data: serde_json::json!({ "upload_id": upload_id, "comment_count": comment_count })
-                .to_string(),
-        });
-    }
+    // Broadcast SSE
+    let _ = state.sse_tx.send(crate::state::SseEvent {
+        event_type: "new-comment".to_string(),
+        data: serde_json::json!({ "upload_id": upload_id }).to_string(),
+    });
 
     let dto = CommentDto {
         id: comment.id,
@@ -267,11 +146,6 @@ pub async fn delete_comment(
     auth: AuthUser,
     Path(comment_id): Path<Uuid>,
 ) -> Result<StatusCode, AppError> {
-    // Banned users keep read access but cannot mutate (USER_JOURNEYS §10).
-    if auth.is_banned {
-        return Err(AppError::Forbidden("Du bist gesperrt.".into()));
-    }
-    check_social_rate(&state, auth.user_id).await?;
     let comment = Comment::find_by_id(&state.pool, comment_id)
         .await?
         .ok_or_else(|| AppError::NotFound("Kommentar nicht gefunden.".into()))?;
@@ -280,27 +154,6 @@ pub async fn delete_comment(
         return Err(AppError::Forbidden("Nur eigene Kommentare löschen.".into()));
     }
 
-    // Event-scope: soft_delete_in_event only matches comments whose upload is in
-    // the caller's event, so a cross-event comment_id resolves to a 404 here.
-    let mut tx = state.pool.begin().await?;
-    let deleted = Comment::soft_delete_in_event(&mut tx, comment_id, auth.event_id).await?;
-    if !deleted {
-        return Err(AppError::NotFound("Kommentar nicht gefunden.".into()));
-    }
-    // Comments live only in the HTML viewer, so the ZIP is carried forward, not rebuilt.
-    let regen = crate::services::export::invalidate_and_arm(
-        &mut tx,
-        &state.config.event_slug,
-        crate::services::export::Affects::ViewerOnly,
-    )
-    .await?;
-    tx.commit().await?;
-    if let Some(r) = regen {
-        crate::handlers::host::start_regen(&state, r);
-    }
-    let _ = state.sse_tx.send(crate::state::SseEvent::new(
-        "comment-deleted",
-        serde_json::json!({ "comment_id": comment_id, "upload_id": comment.upload_id }).to_string(),
-    ));
+    Comment::soft_delete(&state.pool, comment_id).await?;
     Ok(StatusCode::NO_CONTENT)
 }

backend/src/handlers/sse.rs

@@ -1,19 +1,17 @@
 use std::convert::Infallible;
 use std::time::Duration;
 
-use axum::Json;
 use axum::extract::{Query, State};
 use axum::response::sse::{Event, KeepAlive, Sse};
+use axum::Json;
 use futures::stream::Stream;
 use serde::{Deserialize, Serialize};
-use tokio_stream::StreamExt;
 use tokio_stream::wrappers::BroadcastStream;
-use tokio_stream::wrappers::errors::BroadcastStreamRecvError;
+use tokio_stream::StreamExt;
 
 use crate::auth::middleware::AuthUser;
 use crate::error::AppError;
 use crate::models::session::Session;
-use crate::services::sse_tickets::TicketKind;
 use crate::state::AppState;
 
 #[derive(Deserialize)]
@@ -24,10 +22,6 @@ pub struct SseQuery {
 #[derive(Serialize)]
 pub struct StreamTicketResponse {
     pub ticket: String,
-    /// Server clock at mint time — the client seeds its SSE reconnect cursor from this
-    /// instead of `new Date()`, so a skewed browser clock can't drop uploads. See
-    /// `DeltaResponse::server_time`.
-    pub server_time: chrono::DateTime<chrono::Utc>,
 }
 
 /// Mint a short-lived single-use SSE ticket. The browser's `EventSource` cannot
@@ -38,88 +32,9 @@ pub struct StreamTicketResponse {
 pub async fn issue_ticket(
     State(state): State<AppState>,
     auth: AuthUser,
-) -> Result<Json<StreamTicketResponse>, AppError> {
-    // The endpoint had no rate limit at all. Authentication is not a bound here: one valid
-    // session could loop it freely. 60/min is far above a real client (one ticket per SSE
-    // (re)connect, and reconnects are backed off) while capping a loop.
-    if let Err(retry_after_secs) = state.rate_limiter.check_with_retry(
-        format!("sse_ticket:{}", auth.user_id),
-        60,
-        Duration::from_secs(60),
-    ) {
-        return Err(AppError::TooManyRequests(
-            "Zu viele Verbindungsversuche. Bitte warte kurz.".into(),
-            Some(retry_after_secs),
-        ));
-    }
-
-    let ticket = state
-        .sse_tickets
-        .issue(auth.token_hash, TicketKind::Sse)
-        .ok_or_else(|| {
-            AppError::ServiceUnavailable(
-                "Server ist gerade ausgelastet. Live-Updates folgen in Kürze.".into(),
-                Some(30),
-            )
-        })?;
-    let server_time = sqlx::query_scalar("SELECT NOW()")
-        .fetch_one(&state.pool)
-        .await?;
-    Ok(Json(StreamTicketResponse {
-        ticket,
-        server_time,
-    }))
-}
-
-/// Live SSE streams one session may hold OPEN at once.
-///
-/// The ticket store's `MAX_TICKETS_PER_SESSION` bounds UNCONSUMED tickets, not open streams — so it
-/// never bounded this at all: mint a ticket, redeem it (freeing the slot), repeat. At the 60/min
-/// ticket ceiling one guest could accumulate 60 new live streams per minute indefinitely, each
-/// holding a broadcast receiver, a tokio task and a 60-second DB revalidation ticker.
-///
-/// 6 rather than 2: a guest legitimately has the feed in one tab, the diashow on a laptop, and both
-/// may briefly double during a reconnect before the old socket's `Drop` lands. Well above real use,
-/// far below anything that hurts.
-const MAX_OPEN_STREAMS_PER_SESSION: usize = 6;
-
-/// Open stream count per session token hash.
-type OpenStreams = std::collections::HashMap<String, usize>;
-static OPEN_STREAMS: std::sync::LazyLock<std::sync::Mutex<OpenStreams>> =
-    std::sync::LazyLock::new(|| std::sync::Mutex::new(OpenStreams::new()));
-
-/// Decrements the open-stream count for its session when the stream is dropped.
-///
-/// A `Drop` guard is the only thing that works here: a client vanishing off wifi never runs any
-/// cleanup path we write, but dropping the response future is exactly what happens.
-struct StreamSlot(String);
-
-impl Drop for StreamSlot {
-    fn drop(&mut self) {
-        if let Ok(mut map) = OPEN_STREAMS.lock()
-            && let Some(n) = map.get_mut(&self.0)
-        {
-            *n = n.saturating_sub(1);
-            if *n == 0 {
-                map.remove(&self.0);
-            }
-        }
-    }
-}
-
-/// Claim one of this session's stream slots, or `None` when it is already at the cap.
-fn claim_stream_slot(token_hash: &str) -> Option<StreamSlot> {
-    let mut map = match OPEN_STREAMS.lock() {
-        Ok(m) => m,
-        // Never let a poisoned lock take live updates down for the whole venue.
-        Err(e) => e.into_inner(),
-    };
-    let n = map.entry(token_hash.to_string()).or_insert(0);
-    if *n >= MAX_OPEN_STREAMS_PER_SESSION {
-        return None;
-    }
-    *n += 1;
-    Some(StreamSlot(token_hash.to_string()))
+) -> Json<StreamTicketResponse> {
+    let ticket = state.sse_tickets.issue(auth.token_hash);
+    Json(StreamTicketResponse { ticket })
 }
 
 /// SSE stream endpoint. Authenticates via a single-use ticket (see
@@ -130,75 +45,22 @@ pub async fn stream(
 ) -> Result<Sse<impl Stream<Item = Result<Event, Infallible>>>, AppError> {
     let token_hash = state
         .sse_tickets
-        .consume(&q.ticket, TicketKind::Sse)
+        .consume(&q.ticket)
         .ok_or_else(|| AppError::Unauthorized("Ticket ungültig oder abgelaufen.".into()))?;
 
-    // NOTE: this authenticates via ticket→session, not the `AuthUser` extractor. The
-    // SSE stream is read-only, and under the read-only-ban model (USER_JOURNEYS §10)
-    // banned users retain read access — so both minting a ticket and holding a stream
-    // open are intentionally allowed for banned users; only writes are blocked.
     Session::find_by_token_hash(&state.pool, &token_hash)
         .await
         .map_err(|e| AppError::Internal(e.into()))?
         .ok_or_else(|| AppError::Unauthorized("Sitzung nicht gefunden.".into()))?;
 
-    // Bound how many streams this session holds open — see MAX_OPEN_STREAMS_PER_SESSION. Refuse
-    // rather than evict: closing somebody's live feed to make room for their own reconnect loop
-    // reads exactly like the flakiness it would be trying to fix.
-    let slot = claim_stream_slot(&token_hash).ok_or_else(|| {
-        tracing::warn!("session at its open-SSE-stream cap; refusing another");
-        AppError::TooManyRequests(
-            "Zu viele offene Verbindungen. Bitte schließe andere Tabs.".into(),
-            Some(10),
-        )
-    })?;
-
     let rx = state.sse_tx.subscribe();
-    let events = BroadcastStream::new(rx).filter_map(|msg| match msg {
+    let stream = BroadcastStream::new(rx).filter_map(|msg| match msg {
         Ok(sse_event) => Some(Ok(Event::default()
             .event(sse_event.event_type)
             .data(sse_event.data))),
-        // A consumer that falls behind the broadcast buffer would otherwise silently
-        // lose events, leaving its feed permanently stale. Instead of dropping the
-        // gap, tell the client to resync — the frontend responds by running a full
-        // feed-delta fetch (which reconciles both new uploads and deletions).
-        Err(BroadcastStreamRecvError::Lagged(n)) => {
-            tracing::warn!("SSE consumer lagged, dropped {n} event(s); emitting resync");
-            Some(Ok(Event::default().event("resync").data(n.to_string())))
-        }
+        Err(_) => None,
     });
 
-    // The session is only checked once at open. Re-validate it periodically so a
-    // logged-out, expired, OR banned session's stream is closed rather than kept alive
-    // until the client happens to disconnect. Bounds a stale stream to ~60s. NOTE: a ban is
-    // deliberately read-only and does NOT revoke sessions (see `ban_user`), so the
-    // `is_banned` re-read below is LOAD-BEARING — it is the only thing that stops a banned
-    // user's live push stream. Do not remove it. Only a *definitive* gone/expired/banned
-    // state ends the stream; a transient DB error just retries next tick.
-    let pool = state.pool.clone();
-    let session_hash = token_hash.clone();
-    let session_gone = async move {
-        // Owns the slot guard, and this future is owned by the returned stream — so the slot is
-        // released exactly when the stream is dropped, including when the client simply walks out
-        // of range and no cleanup code of ours ever runs.
-        let _slot = slot;
-        let mut ticker = tokio::time::interval(Duration::from_secs(60));
-        ticker.tick().await; // consume the immediate first tick
-        loop {
-            ticker.tick().await;
-            match Session::find_user_by_token_hash(&pool, &session_hash).await {
-                Ok(Some(user)) if !user.is_banned => {} // still valid — keep streaming
-                Ok(Some(_)) => break,                   // banned — cut the stream
-                Ok(None) => break,                      // logged out or expired — stop
-                Err(e) => {
-                    tracing::warn!(error = ?e, "SSE session revalidation query failed; retrying");
-                }
-            }
-        }
-    };
-
-    let stream = futures::StreamExt::take_until(events, Box::pin(session_gone));
-
     Ok(Sse::new(stream).keep_alive(
         KeepAlive::new()
             .interval(Duration::from_secs(30))

backend/src/handlers/test_admin.rs

@@ -13,10 +13,9 @@ use crate::auth::middleware::RequireAdmin;
 use crate::error::AppError;
 use crate::state::AppState;
 
-/// Truncates every event-scoped table, wipes media on disk, and reseeds the `config`
-/// table: numeric values from the migration defaults, but every feature toggle forced
-/// OFF (production seeds them ON — see the note at the reseed below). Requires an admin
-/// JWT — even with `EVENTSNAP_TEST_MODE=1` it cannot be hit anonymously.
+/// Truncates every event-scoped table, wipes media on disk, and reseeds the
+/// `config` table from migration defaults. Requires an admin JWT — even with
+/// `EVENTSNAP_TEST_MODE=1` it cannot be hit anonymously.
 pub async fn truncate_all(
     State(state): State<AppState>,
     RequireAdmin(_auth): RequireAdmin,
@@ -41,29 +40,15 @@ pub async fn truncate_all(
     .execute(&state.pool)
     .await?;
 
-    // Reseed config. The NUMERIC values mirror migrations 005/015/016/017/019; the BOOLEAN
-    // toggles deliberately do NOT — migration 009 seeds every one of them `true`
-    // (production), and this forces them `false` so the suite isn't fighting rate limits
-    // and quotas it isn't testing.
-    //
-    // Be aware of what that costs: this runs as an auto-fixture before EVERY test, so no
-    // test starts from production's config unless it explicitly turns a toggle back on
-    // (02-upload/rate-limit, 07-adversarial/ddos, 01-auth/rate-limit-nat, …). That blind
-    // spot is exactly why an entire class of per-IP limiter bugs went unnoticed: the
-    // limiters were simply off. When adding a limiter or quota, add a spec that enables it.
-    //
-    // Kept in sync by hand because pulling SQL out of the migration files at runtime is
-    // fragile — if you add a config key in a migration, add it here too.
+    // Reseed config — mirrors migrations 005 and 009. Kept in sync by hand
+    // because pulling SQL out of the migration files at runtime is fragile.
     sqlx::query(
         r#"INSERT INTO config (key, value) VALUES
             ('max_image_size_mb',          '20'),
             ('max_video_size_mb',          '500'),
-            ('upload_rate_per_hour',       '100'),
+            ('upload_rate_per_hour',       '10'),
             ('feed_rate_per_min',          '60'),
             ('export_rate_per_day',        '3'),
-            ('join_ip_rate_per_min',       '300'),
-            ('recover_ip_rate_per_min',    '30'),
-            ('social_rate_per_min',        '120'),
             ('quota_tolerance',            '0.75'),
             ('estimated_guest_count',      '100'),
             ('compression_concurrency',    '2'),
@@ -72,8 +57,6 @@ pub async fn truncate_all(
             ('feed_rate_enabled',          'false'),
             ('export_rate_enabled',        'false'),
             ('join_rate_enabled',          'false'),
-            ('social_rate_enabled',        'false'),
-            ('admin_login_rate_enabled',   'false'),
             ('quota_enabled',              'false'),
             ('storage_quota_enabled',      'false'),
             ('upload_count_quota_enabled', 'false'),
@@ -87,47 +70,10 @@ pub async fn truncate_all(
     let _ = tokio::fs::remove_dir_all(&state.config.media_path).await;
     let _ = tokio::fs::create_dir_all(&state.config.media_path).await;
 
-    // Wipe the export directory too. Exports moved OUT of media_path (CR2 fix), so
-    // the media wipe above no longer covers them — without this a real export in
-    // one test would leave Gallery.zip on disk and contaminate the next.
-    let _ = tokio::fs::remove_dir_all(&state.config.export_path).await;
-    let _ = tokio::fs::create_dir_all(&state.config.export_path).await;
-
     // The rate limiter holds an in-memory HashMap; clear it so a previous test's
     // counters don't leak into the next one.
     state.rate_limiter.clear();
 
-    // The reseed above wrote the `config` table directly (bypassing patch_config), so
-    // the cache must be invalidated too — otherwise the first request after a truncate
-    // could serve the previous test's toggles.
-    state.config_cache.invalidate();
-
-    // The other two in-memory singletons that TRUNCATE used to leave standing.
-    //
-    // `disk_cache` holds a free-space reading for up to its TTL. TRUNCATE has just deleted every
-    // uploaded file, which materially changes free space — so without this the next test can
-    // compute a storage quota from the PREVIOUS test's disk. That was harmless only while quotas
-    // were globally disabled in e2e (they no longer are: see specs/02-upload/quota.spec.ts, which
-    // steers the per-user limit off `free_disk_bytes`), i.e. two holes were masking each other.
-    state.disk_cache.invalidate();
-
-    // `media_total` caches SUM(user.total_upload_bytes) for the upload gate's keepsake-headroom
-    // check. TRUNCATE has just zeroed every one of those rows, so a surviving reading would make
-    // the next test's first upload measure its headroom against the previous test's gallery —
-    // and that gate REFUSES uploads, so the failure would look like a spurious quota rejection.
-    state.media_total.invalidate();
-
-    // `sse_tickets` maps a ticket to a session token hash. TRUNCATE deletes the sessions, so every
-    // surviving ticket is a dangling reference to a user that no longer exists.
-    state.sse_tickets.clear();
-
-    // Invalidate any in-flight/queued compression task spawned by the previous test. Without this a
-    // task still waiting on the concurrency semaphore wakes AFTER this wipe, fails to find its
-    // (now-deleted) file, and broadcasts upload-error/upload-deleted into the NEXT test's SSE
-    // stream. (Export workers are already inert across a truncate: they are epoch-guarded on the
-    // event row, and truncate gives the event a fresh random UUID, so their writes match nothing.)
-    state.compression.bump_generation();
-
     Ok(StatusCode::NO_CONTENT)
 }
 

backend/src/main.rs

@@ -1,7 +1,7 @@
 use anyhow::Result;
-use axum::Router;
 use axum::extract::DefaultBodyLimit;
 use axum::routing::{delete, get, patch, post};
+use axum::Router;
 use tower_http::trace::TraceLayer;
 use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
 
@@ -17,44 +17,18 @@ mod state;
 use config::AppConfig;
 use state::AppState;
 
-/// Hard HTTP body cap for the upload endpoint (576 MiB). Backstop against
-/// memory-exhaustion; precise per-class size limits are enforced in the handler.
-const MAX_UPLOAD_BYTES: usize = 576 * 1024 * 1024;
-
 #[tokio::main]
 async fn main() -> Result<()> {
     dotenvy::dotenv().ok();
 
     tracing_subscriber::registry()
-        .with(
-            // `info`, not `debug`. A stock deploy sets RUST_LOG nowhere (it is absent from
-            // .env.example and was absent from docker-compose.yml), so this fallback IS the
-            // production level — and at `debug` the TraceLayer below emits a line per request
-            // AND per response, into a log file that had no rotation. `tower_http=warn`
-            // rather than `info` states the intent: those spans are diagnostics, not an
-            // access log, and a future `DefaultOnResponse::new().level(Level::INFO)` should
-            // not silently re-enable them.
-            tracing_subscriber::EnvFilter::try_from_default_env()
-                .unwrap_or_else(|_| "eventsnap_backend=info,tower_http=warn".into()),
-        )
+        .with(tracing_subscriber::EnvFilter::try_from_default_env().unwrap_or_else(|_| {
+            "eventsnap_backend=debug,tower_http=debug".into()
+        }))
         .with(tracing_subscriber::fmt::layer())
         .init();
 
     let config = AppConfig::from_env()?;
-
-    // Prove both media directories are writable BEFORE anything else runs. This is first
-    // because everything downstream — the derivative backfill, export recovery, every upload —
-    // assumes it silently.
-    //
-    // This used to be `create_dir_all(&media_path).await.ok()` far below, which discarded the
-    // only signal there was, and EXPORT_PATH was never created or probed at all. The failure
-    // mode that produced: a wrong bind mount or a root-owned volume left the app booting
-    // *green* — `/health` only probes the database — so Caddy routed traffic to it, guests
-    // joined, and every single upload failed with EACCES. Existence is not the property we
-    // need; writability is, and the only way to know is to write.
-    ensure_writable_dir(&config.media_path, "MEDIA_PATH").await?;
-    ensure_writable_dir(&config.export_path, "EXPORT_PATH").await?;
-
     let pool = db::create_pool(&config.database_url).await?;
 
     // Reset any rows left mid-flight by a previous (possibly crashed) instance —
@@ -65,32 +39,6 @@ async fn main() -> Result<()> {
 
     let state = AppState::new(pool.clone(), config.clone());
 
-    // Regenerate image derivatives an older pipeline produced: the big-screen display for
-    // uploads processed before it existed (v0.17.x), and anything predating the current
-    // DERIVATIVES_REV (rev 1 applies the EXIF orientation, without which every portrait
-    // phone photo is stored sideways). Fire-and-forget behind the compression semaphore;
-    // originals are never touched, so a failure just retries on the next start.
-    state.compression.backfill_stale_derivatives().await;
-
-    // Re-extract poster frames for videos a restart interrupted. `startup_recovery` above
-    // marks their compression `failed` but nothing re-enqueued them, so `thumbnail_path`
-    // stayed NULL for the rest of the event. Shares the attempt budget with the image
-    // backfill, so a clip that genuinely yields no frame stops being retried.
-    state.compression.backfill_video_posters().await;
-
-    // Re-spawn exports for events that were released but whose keepsake never finished
-    // (crash mid-export). Needs the media/export paths + SSE sender, so it runs here
-    // rather than inside `startup_recovery`. Fire-and-forget: the workers run in the
-    // background; the HTTP server can start accepting requests meanwhile.
-    services::export::recover_exports(
-        pool.clone(),
-        config.media_path.clone(),
-        config.export_path.clone(),
-        config.comments_enabled,
-        state.sse_tx.clone(),
-    )
-    .await;
-
     // Hourly background hygiene: prune expired sessions, evict cold rate-limiter
     // keys. Keeps the DB and process from growing unboundedly over multi-day events.
     services::maintenance::spawn_periodic_tasks(
@@ -100,136 +48,58 @@ async fn main() -> Result<()> {
         config.media_path.clone(),
     );
 
+    // Ensure media directories exist
+    tokio::fs::create_dir_all(&config.media_path).await.ok();
+
     let api = Router::new()
         // Auth
-        .route("/api/v1/event", get(handlers::public::get_public_event))
         .route("/api/v1/join", post(auth::handlers::join))
         .route("/api/v1/recover", post(auth::handlers::recover))
-        // Forgotten-PIN escape hatch: ask a host to reset it (unauthenticated, throttled).
-        .route(
-            "/api/v1/recover/request",
-            post(auth::handlers::request_pin_reset),
-        )
         .route("/api/v1/admin/login", post(auth::handlers::admin_login))
         .route("/api/v1/session", delete(auth::handlers::logout))
-        // "Sign out everywhere" — revoke all of the caller's sessions.
-        .route("/api/v1/sessions", delete(auth::handlers::logout_all))
-        // Upload — HTTP-level body cap as an OOM backstop. The handler still enforces
-        // the precise per-class limits from DB config (max_image/video_size_mb); this
-        // layer just stops a multi-GB body from being buffered into memory before that
-        // check runs. Sized generously above the default 500 MB video limit + multipart
-        // overhead — if an admin raises max_video_size_mb above this, bump MAX_UPLOAD_BYTES.
-        .route(
-            "/api/v1/upload",
-            post(handlers::upload::upload).route_layer(DefaultBodyLimit::max(MAX_UPLOAD_BYTES)),
-        )
+        // Upload — cap the request body so a single request can't buffer the box
+        // into OOM. Sized to the largest allowed video (500 MB) plus multipart
+        // overhead; the per-category limit is still enforced inside the handler.
+        .route("/api/v1/upload", post(handlers::upload::upload)
+            .route_layer(DefaultBodyLimit::max(550 * 1024 * 1024)))
         .route(
             "/api/v1/upload/{id}",
             patch(handlers::upload::edit_upload).delete(handlers::upload::delete_upload),
         )
-        .route(
-            "/api/v1/upload/{id}/original",
-            get(handlers::upload::get_original),
-        )
-        // Preview/thumbnail variants are gated the same way as originals (visibility
-        // check + direct /media block below) so moderation actually revokes access to
-        // the displayed images, not just the full-res download.
-        .route(
-            "/api/v1/upload/{id}/preview",
-            get(handlers::upload::get_preview),
-        )
-        .route(
-            "/api/v1/upload/{id}/display",
-            get(handlers::upload::get_display),
-        )
-        .route(
-            "/api/v1/upload/{id}/thumbnail",
-            get(handlers::upload::get_thumbnail),
-        )
         // Current-user endpoints (live quota estimate, profile + privacy note bundle)
         .route("/api/v1/me/context", get(handlers::me::get_context))
         .route("/api/v1/me/quota", get(handlers::me::get_quota))
-        // Self-service erasure. There was no user-deletion route at any role, so an erasure
-        // request could only be honoured with hand-written SQL against production — and the join
-        // page's data notice now promises this exists. See `me::delete_account`.
-        .route("/api/v1/me", delete(handlers::me::delete_account))
         // Feed
         .route("/api/v1/feed", get(handlers::feed::feed))
         .route("/api/v1/feed/delta", get(handlers::feed::feed_delta))
         .route("/api/v1/hashtags", get(handlers::feed::hashtags))
-        .route("/api/v1/uploaders", get(handlers::feed::uploaders))
         // Social
-        .route(
-            "/api/v1/upload/{id}/like",
-            post(handlers::social::toggle_like),
-        )
+        .route("/api/v1/upload/{id}/like", post(handlers::social::toggle_like))
         .route(
             "/api/v1/upload/{id}/comments",
             get(handlers::social::list_comments).post(handlers::social::add_comment),
         )
-        .route(
-            "/api/v1/comment/{id}",
-            delete(handlers::social::delete_comment),
-        )
+        .route("/api/v1/comment/{id}", delete(handlers::social::delete_comment))
         // SSE
         .route("/api/v1/stream", get(handlers::sse::stream))
         .route("/api/v1/stream/ticket", post(handlers::sse::issue_ticket))
         // Host Dashboard
         .route("/api/v1/host/event", get(handlers::host::get_event_status))
-        .route(
-            "/api/v1/host/event/close",
-            post(handlers::host::close_event),
-        )
+        .route("/api/v1/host/event/close", post(handlers::host::close_event))
         .route("/api/v1/host/event/open", post(handlers::host::open_event))
-        .route(
-            "/api/v1/host/gallery/release",
-            post(handlers::host::release_gallery),
-        )
-        // Escape hatch: force a keepsake rebuild. Without it a failed export is terminal at runtime
-        // (release_gallery refuses an already-released event; recovery only runs at boot).
-        .route(
-            "/api/v1/host/export/rebuild",
-            post(handlers::host::rebuild_export),
-        )
+        .route("/api/v1/host/gallery/release", post(handlers::host::release_gallery))
         .route("/api/v1/host/users", get(handlers::host::list_users))
-        .route(
-            "/api/v1/host/users/{id}/ban",
-            post(handlers::host::ban_user),
-        )
-        .route(
-            "/api/v1/host/users/{id}/unban",
-            post(handlers::host::unban_user),
-        )
-        .route(
-            "/api/v1/host/users/{id}/role",
-            patch(handlers::host::set_role),
-        )
+        .route("/api/v1/host/users/{id}/ban", post(handlers::host::ban_user))
+        .route("/api/v1/host/users/{id}/unban", post(handlers::host::unban_user))
+        .route("/api/v1/host/users/{id}/role", patch(handlers::host::set_role))
         .route(
             "/api/v1/host/users/{id}/pin-reset",
             post(handlers::host::reset_user_pin),
         )
-        .route(
-            "/api/v1/host/pin-reset-requests",
-            get(handlers::host::list_pin_reset_requests),
-        )
-        .route(
-            "/api/v1/host/pin-reset-requests/{id}",
-            delete(handlers::host::dismiss_pin_reset_request),
-        )
-        .route(
-            "/api/v1/host/upload/{id}",
-            delete(handlers::host::host_delete_upload),
-        )
-        .route(
-            "/api/v1/host/comment/{id}",
-            delete(handlers::host::host_delete_comment),
-        )
+        .route("/api/v1/host/upload/{id}", delete(handlers::host::host_delete_upload))
+        .route("/api/v1/host/comment/{id}", delete(handlers::host::host_delete_comment))
         // Export (all authenticated users)
         .route("/api/v1/export/status", get(handlers::admin::export_status))
-        .route(
-            "/api/v1/export/ticket",
-            post(handlers::admin::export_ticket),
-        )
         .route("/api/v1/export/zip", get(handlers::admin::download_zip))
         .route("/api/v1/export/html", get(handlers::admin::download_html))
         // Admin Dashboard
@@ -238,10 +108,7 @@ async fn main() -> Result<()> {
             "/api/v1/admin/config",
             get(handlers::admin::get_config).patch(handlers::admin::patch_config),
         )
-        .route(
-            "/api/v1/admin/export/jobs",
-            get(handlers::admin::get_export_jobs),
-        );
+        .route("/api/v1/admin/export/jobs", get(handlers::admin::get_export_jobs));
 
     // Test-only route: a hard reset for the Playwright E2E harness. The handler
     // is compiled in always, but the route is only attached when
@@ -260,210 +127,33 @@ async fn main() -> Result<()> {
         api
     };
 
-    // NOTE: media is deliberately NOT served over HTTP.
-    //
-    // Files live under `media_path` so the compression worker and the export job can read
-    // them off disk, but nothing may pull them straight from `/media/**` — that bypasses
-    // the visibility checks (soft-delete + ban-hide) that make a host takedown stick.
-    // Every legitimate fetch goes through `/api/v1/upload/{id}/{original,preview,display,
-    // thumbnail}`, which filter via `find_visible_media`; those are the only media URLs the
-    // backend ever emits (see `handlers::feed`).
-    //
-    // This used to be a `ServeDir` on `/media` with four `nest_service` blockers on the
-    // subtrees above it. That was bypassable: axum routes on the RAW path while `ServeDir`
-    // percent-decodes afterwards, so `/media/%70reviews/{id}.jpg` missed every blocker,
-    // fell through to the `ServeDir`, and was decoded back to `previews/` on disk — serving
-    // a taken-down photo to anyone, unauthenticated. Any single escaped byte worked, in all
-    // four subtrees. Deleting the route removes the vector outright rather than racing the
-    // decoder; `/media/**` now 404s regardless of encoding.
+    // Media is served exclusively through the authenticated, signed gateway —
+    // there is no raw static mount. The gateway verifies an HMAC signature and
+    // consults the DB (deleted / ban-hidden / type), so private artifacts and
+    // the export archives are never reachable by guessing a path.
+    // Trace spans log the request *path* only, never the query string — signed
+    // media URLs carry a replayable `?sig=` capability that must not land in
+    // access logs.
+    let trace_layer = TraceLayer::new_for_http().make_span_with(
+        |req: &axum::http::Request<axum::body::Body>| {
+            tracing::info_span!(
+                "request",
+                method = %req.method(),
+                path = %req.uri().path(),
+            )
+        },
+    );
+
     let router = Router::new()
-        // ONE probe, and it touches the database. The merge of the unattended-blockers work
-        // brought a competing design — a dependency-free `/health` for the compose gate plus
-        // a DB-backed `/health/ready` for an external monitor. That split is defensible, and
-        // it was rejected deliberately:
-        //
-        //   * `/health` returning a constant "ok" is the exact defect faea555 fixed and
-        //     verified live (stop Postgres → 503 → start → 200, with no app restart). Every
-        //     request path touches the database, so a constant probe reports healthy while
-        //     the app is useless — the disk-full endgame stayed green all the way down.
-        //   * The split's motive was that Caddy's `depends_on: app: service_healthy` would
-        //     be blocked by a Postgres hiccup at boot. But `app` itself already gates on
-        //     `db: service_healthy`, so the DB is up before this probe ever runs, and the
-        //     healthcheck carries a 20s start_period plus 5 retries on top.
-        //   * The two handlers were the same `SELECT 1` with the same 2s timeout under two
-        //     names, so keeping both bought nothing.
-        //
-        // The external uptime monitor points at this route — DEPLOYMENT_RUNBOOK.md §10.4,
-        // which documents the response table and is the only thing in this deployment that
-        // can page a human. (That section previously did not exist and this comment claimed
-        // it did; if you are removing §10.4, this route loses its only consumer.)
-        .route("/health", get(health))
+        .route("/health", get(|| async { "ok" }))
         .merge(api)
-        .layer(TraceLayer::new_for_http())
+        .route("/media/{kind}/{id}", get(handlers::media::serve))
+        .layer(trace_layer)
         .with_state(state);
 
     let listener = tokio::net::TcpListener::bind(("0.0.0.0", config.app_port)).await?;
     tracing::info!("listening on {}", listener.local_addr()?);
-    // `into_make_service_with_connect_info` is required by the pre-auth handlers, which
-    // extract `ConnectInfo<SocketAddr>` to use the peer address as the rate-limit key when
-    // X-Forwarded-For is absent. Without it those extractors fail at runtime.
-    axum::serve(
-        listener,
-        router.into_make_service_with_connect_info::<std::net::SocketAddr>(),
-    )
-    .with_graceful_shutdown(shutdown_signal())
-    .await?;
+    axum::serve(listener, router).await?;
 
     Ok(())
 }
-
-/// Create `dir` if absent, then prove we can actually write inside it. Hard error otherwise.
-///
-/// `create_dir_all` succeeding proves nothing: it is a no-op on an existing directory, so a
-/// root-owned volume, a read-only bind mount and a full filesystem all "succeed". The probe
-/// below is the only thing that distinguishes them, and it is worth the two syscalls once per
-/// boot to turn a silent evening of failed uploads into a container that refuses to start.
-///
-/// `label` is the env var name so the operator gets the name of the knob to fix, not a path
-/// they then have to trace back to a variable.
-async fn ensure_writable_dir(dir: &std::path::Path, label: &str) -> anyhow::Result<()> {
-    use anyhow::Context;
-
-    tokio::fs::create_dir_all(dir)
-        .await
-        .with_context(|| format!("{label}: cannot create {}", dir.display()))?;
-
-    // A fixed name is fine: this runs once, before the server accepts requests, and two
-    // instances sharing one volume would be a misconfiguration in its own right. Removed on
-    // both the success and failure paths so a crashed boot cannot leave litter behind.
-    let probe = dir.join(".eventsnap-write-probe");
-    let result = async {
-        let mut f = tokio::fs::File::create(&probe)
-            .await
-            .with_context(|| format!("{label}: cannot create a file in {}", dir.display()))?;
-        // Write and fsync rather than just create: a full filesystem lets the create succeed
-        // and fails at the first byte, which is exactly the disk-full endgame this guards.
-        tokio::io::AsyncWriteExt::write_all(&mut f, b"ok")
-            .await
-            .with_context(|| format!("{label}: cannot write to {}", dir.display()))?;
-        f.sync_all()
-            .await
-            .with_context(|| format!("{label}: cannot flush to {}", dir.display()))?;
-        anyhow::Ok(())
-    }
-    .await;
-    let _ = tokio::fs::remove_file(&probe).await;
-
-    result.with_context(|| {
-        format!(
-            "{label} ({}) is not writable. The app refuses to start rather than accept uploads \
-             it cannot store — check the bind mount and that the volume is owned by the \
-             container's non-root user.",
-            dir.display()
-        )
-    })?;
-
-    tracing::info!(path = %dir.display(), "{label} is writable");
-    Ok(())
-}
-
-/// How long `/health` waits for the database before calling the app unhealthy. Deliberately
-/// short: the point is to answer "can this process actually serve a request right now", and a
-/// probe that blocks for the acquire timeout is itself a symptom.
-const HEALTH_DB_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(2);
-
-/// Readiness probe — the Docker healthcheck, Caddy's `depends_on` gate, and the runbook's
-/// event-day `curl` all hit this.
-///
-/// It used to return the literal string `"ok"` and touch nothing. Every request in the app needs
-/// the database, so that answered a question nobody asked: the container reported healthy while
-/// every real request 500'd, and with no operator watching during the event there was no signal
-/// at all. Note what this does NOT buy: Compose's `restart: unless-stopped` does not react to
-/// healthcheck state, so nothing restarts on a red probe — this is a diagnostic, and it is
-/// deliberately not wired to automatic recovery, because the pool already heals itself across a
-/// Postgres restart (sqlx revalidates on acquire) and an auto-restart would truncate every
-/// in-flight upload to "fix" an outage that was about to clear on its own.
-async fn health(
-    axum::extract::State(state): axum::extract::State<AppState>,
-) -> impl axum::response::IntoResponse {
-    use axum::http::StatusCode;
-    match tokio::time::timeout(
-        HEALTH_DB_TIMEOUT,
-        sqlx::query("SELECT 1").execute(&state.pool),
-    )
-    .await
-    {
-        Ok(Ok(_)) => (StatusCode::OK, "ok"),
-        Ok(Err(e)) => {
-            tracing::error!(error = ?e, "health check: database query failed");
-            (StatusCode::SERVICE_UNAVAILABLE, "database unavailable")
-        }
-        Err(_) => {
-            tracing::error!(
-                timeout_s = HEALTH_DB_TIMEOUT.as_secs(),
-                "health check: database did not respond"
-            );
-            (StatusCode::SERVICE_UNAVAILABLE, "database timeout")
-        }
-    }
-}
-
-/// Hard cap on how long we wait for in-flight connections to drain after a shutdown
-/// signal. Uploads (streamed to disk) finish in well under this; the cap exists because
-/// long-lived SSE streams never end on their own and would otherwise keep the graceful
-/// drain — and thus the process — pending until the orchestrator force-kills it.
-const SHUTDOWN_GRACE: std::time::Duration = std::time::Duration::from_secs(10);
-
-/// Resolves on SIGINT (Ctrl-C) or SIGTERM (container stop / deploy). Letting
-/// `axum::serve` drain in-flight requests on this signal means a redeploy no longer
-/// truncates uploads mid-flight; any background compression/export half-states that a
-/// hard kill would leave are already reconciled by `startup_recovery` on the next boot.
-///
-/// Once the signal fires we also arm a detached backstop that force-exits after
-/// [`SHUTDOWN_GRACE`]. Without it, open SSE streams (which have no natural end) would
-/// hold the graceful drain open indefinitely; the backstop bounds shutdown regardless
-/// of the orchestrator's own kill timeout. If the drain completes first, `main` returns
-/// and the process exits before the timer ever fires.
-async fn shutdown_signal() {
-    let ctrl_c = async {
-        let _ = tokio::signal::ctrl_c().await;
-    };
-
-    #[cfg(unix)]
-    let terminate = async {
-        match tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate()) {
-            Ok(mut sig) => {
-                sig.recv().await;
-            }
-            Err(e) => {
-                tracing::warn!(error = ?e, "failed to install SIGTERM handler");
-                // Never resolve — fall back to ctrl_c only.
-                std::future::pending::<()>().await;
-            }
-        }
-    };
-
-    #[cfg(not(unix))]
-    let terminate = std::future::pending::<()>();
-
-    tokio::select! {
-        _ = ctrl_c => {}
-        _ = terminate => {}
-    }
-
-    tracing::info!(
-        "shutdown signal received, draining in-flight requests (max {}s)",
-        SHUTDOWN_GRACE.as_secs()
-    );
-
-    // Backstop: if the graceful drain is still blocked after the grace window (almost
-    // always because SSE streams are still open), exit anyway so deploys aren't stalled.
-    tokio::spawn(async {
-        tokio::time::sleep(SHUTDOWN_GRACE).await;
-        tracing::warn!(
-            "graceful drain exceeded {}s (likely open SSE streams); forcing exit",
-            SHUTDOWN_GRACE.as_secs()
-        );
-        std::process::exit(0);
-    });
-}

backend/src/models/comment.rs

@@ -3,10 +3,6 @@ use serde::Serialize;
 use sqlx::PgPool;
 use uuid::Uuid;
 
-// Row shape for `comment`: every field is populated by sqlx from `SELECT *` / `RETURNING *`.
-// `deleted_at` is not read in Rust today (the soft-delete filter lives in SQL), but it is part of
-// the row and stays here so the struct keeps mirroring the table.
-#[allow(dead_code)]
 #[derive(Debug, sqlx::FromRow)]
 pub struct Comment {
     pub id: Uuid,
@@ -28,24 +24,19 @@ pub struct CommentDto {
 }
 
 impl Comment {
-    /// Takes any executor so the caller can insert the comment and link its
-    /// hashtags inside a single transaction.
-    pub async fn create<'e, E>(
-        executor: E,
+    pub async fn create(
+        pool: &PgPool,
         upload_id: Uuid,
         user_id: Uuid,
         body: &str,
-    ) -> Result<Self, sqlx::Error>
-    where
-        E: sqlx::PgExecutor<'e>,
-    {
+    ) -> Result<Self, sqlx::Error> {
         sqlx::query_as::<_, Self>(
             "INSERT INTO comment (upload_id, user_id, body) VALUES ($1, $2, $3) RETURNING *",
         )
         .bind(upload_id)
         .bind(user_id)
         .bind(body)
-        .fetch_one(executor)
+        .fetch_one(pool)
         .await
     }
 
@@ -62,27 +53,13 @@ impl Comment {
     ) -> Result<Vec<CommentDto>, sqlx::Error> {
         // Two-step: pick the newest `limit` rows older than `before`, then flip
         // them back into ascending order so the caller can render top-to-bottom.
-        // `AND NOT u.is_banned` — the filter that was missing (H11).
-        //
-        // Only `deleted_at` was checked, so a banned guest's comments stayed on the live feed
-        // forever: the host bans somebody for an abusive comment, watches every photo of theirs
-        // vanish, and the comment is still sitting there on the most-viewed photo of the evening.
-        // Nothing on the client evicted them either.
-        //
-        // The tell that this was an oversight rather than a decision: the EXPORT query already
-        // filters `is_banned`, so the comment disappeared from the keepsake but not from the app —
-        // the two views of the same moderation action disagreed. Migration 021 did the same for
-        // hashtag counts. This brings the live read path in line with both.
-        //
-        // A ban is reversible and this is derived at read time, so `unban_user` restores the
-        // comments with no extra work.
         sqlx::query_as::<_, CommentDto>(
             "SELECT * FROM (
                SELECT c.id, c.upload_id, c.user_id, u.display_name AS uploader_name,
                       c.body, c.created_at
                FROM comment c
                JOIN \"user\" u ON u.id = c.user_id
-               WHERE c.upload_id = $1 AND c.deleted_at IS NULL AND NOT u.is_banned
+               WHERE c.upload_id = $1 AND c.deleted_at IS NULL
                  AND ($2::timestamptz IS NULL OR c.created_at < $2)
                ORDER BY c.created_at DESC
                LIMIT $3
@@ -97,18 +74,26 @@ impl Comment {
     }
 
     pub async fn find_by_id(pool: &PgPool, id: Uuid) -> Result<Option<Self>, sqlx::Error> {
-        sqlx::query_as::<_, Self>("SELECT * FROM comment WHERE id = $1 AND deleted_at IS NULL")
-            .bind(id)
-            .fetch_optional(pool)
-            .await
+        sqlx::query_as::<_, Self>(
+            "SELECT * FROM comment WHERE id = $1 AND deleted_at IS NULL",
+        )
+        .bind(id)
+        .fetch_optional(pool)
+        .await
     }
 
-    /// Event-scoped soft delete. Returns `false` if the comment doesn't exist or belongs to a
-    /// different event.
-    /// Executor-generic so the delete and the keepsake regeneration can share one transaction
-    /// (see `Upload::soft_delete_in_event` for why that must be atomic).
+    pub async fn soft_delete(pool: &PgPool, id: Uuid) -> Result<(), sqlx::Error> {
+        sqlx::query("UPDATE comment SET deleted_at = NOW() WHERE id = $1")
+            .bind(id)
+            .execute(pool)
+            .await?;
+        Ok(())
+    }
+
+    /// Event-scoped variant of [`Self::soft_delete`]. Returns `false` if the
+    /// comment doesn't exist or belongs to a different event.
     pub async fn soft_delete_in_event(
-        conn: &mut sqlx::PgConnection,
+        pool: &PgPool,
         id: Uuid,
         event_id: Uuid,
     ) -> Result<bool, sqlx::Error> {
@@ -121,7 +106,7 @@ impl Comment {
         )
         .bind(id)
         .bind(event_id)
-        .execute(conn)
+        .execute(pool)
         .await?;
         Ok(result.rows_affected() > 0)
     }

backend/src/models/event.rs

@@ -2,11 +2,6 @@ use chrono::{DateTime, Utc};
 use sqlx::PgPool;
 use uuid::Uuid;
 
-// Row shape for `event`: every field is populated by sqlx from `SELECT *` / `RETURNING *`. Several
-// (`slug`, `cover_image_path`, `export_epoch`, `created_at`) are not read through this struct today
-// — callers that need them query the column directly — but they are part of the row and stay here so
-// the struct keeps mirroring the table.
-#[allow(dead_code)]
 #[derive(Debug, sqlx::FromRow)]
 pub struct Event {
     pub id: Uuid,
@@ -16,11 +11,8 @@ pub struct Event {
     pub is_active: bool,
     pub uploads_locked_at: Option<DateTime<Utc>>,
     pub export_released_at: Option<DateTime<Utc>>,
-    /// Monotonic generation counter for the keepsake. Bumped in the SAME UPDATE as any change to
-    /// `export_released_at` (release and reopen are its only writers). An export is downloadable
-    /// iff a `done` `export_job` row carries this exact epoch — readiness is derived from that,
-    /// never stored, so it cannot drift and no worker can resurrect it. See migration 014.
-    pub export_epoch: i64,
+    pub export_zip_ready: bool,
+    pub export_html_ready: bool,
     pub created_at: DateTime<Utc>,
 }
 
@@ -32,23 +24,9 @@ impl Event {
             .await
     }
 
-    /// Insert the event, or return the existing row if another request won the race.
-    ///
-    /// `ON CONFLICT`, not a bare INSERT. `slug` is UNIQUE (migration 002), and the only callers are
-    /// `/join` and `/admin/login` — both of which run before the row exists, at the one moment the
-    /// app is most concurrent: the QR code goes up and every phone in the room posts `/join` within
-    /// the same second. A check-then-insert loses that race by construction, and the losers got a
-    /// bare unique violation surfaced as a 500 on the very first screen of the event.
-    ///
-    /// `DO UPDATE SET slug = EXCLUDED.slug` is a deliberate no-op write: `DO NOTHING` returns no
-    /// row on conflict, which would put the loser right back at square one. It touches only `slug`,
-    /// so `name`, `export_epoch` and the lock/release timestamps are never disturbed by a late
-    /// arrival.
     pub async fn create(pool: &PgPool, slug: &str, name: &str) -> Result<Self, sqlx::Error> {
         sqlx::query_as::<_, Self>(
-            "INSERT INTO event (slug, name) VALUES ($1, $2)
-             ON CONFLICT (slug) DO UPDATE SET slug = EXCLUDED.slug
-             RETURNING *",
+            "INSERT INTO event (slug, name) VALUES ($1, $2) RETURNING *",
         )
         .bind(slug)
         .bind(name)
@@ -56,8 +34,6 @@ impl Event {
         .await
     }
 
-    /// Reads first so the common case (the row already exists, i.e. every join after the first)
-    /// stays a plain SELECT and never takes a row lock.
     pub async fn find_or_create(
         pool: &PgPool,
         slug: &str,
@@ -69,71 +45,3 @@ impl Event {
         Self::create(pool, slug, name).await
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The QR code goes up and every phone posts `/join` in the same second, before the event row
-    /// exists. `find_or_create` reads first, so all of them miss, and all of them insert.
-    ///
-    /// With a bare `INSERT`, exactly one wins and the rest get a unique violation on `slug` —
-    /// surfaced as a 500 on the first screen of the event, for everyone but the winner. There is no
-    /// retry on that path and nothing in the UI explains it.
-    #[sqlx::test]
-    async fn concurrent_first_joins_all_get_the_same_event(pool: PgPool) {
-        let racers: Vec<_> = (0..16)
-            .map(|_| {
-                let pool = pool.clone();
-                tokio::spawn(
-                    async move { Event::find_or_create(&pool, "wedding", "Hochzeit").await },
-                )
-            })
-            .collect();
-
-        let mut ids = Vec::new();
-        for r in racers {
-            let event = r
-                .await
-                .expect("task panicked")
-                .expect("a concurrent first join must not fail — this is the QR-scan burst");
-            ids.push(event.id);
-        }
-
-        assert_eq!(ids.len(), 16);
-        assert!(
-            ids.iter().all(|id| *id == ids[0]),
-            "every racer must land on ONE event row, not create rivals"
-        );
-
-        let count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM event WHERE slug = 'wedding'")
-            .fetch_one(&pool)
-            .await
-            .expect("count");
-        assert_eq!(count, 1, "exactly one event row may exist for a slug");
-    }
-
-    /// A late arrival must not clobber the row it collides with — the no-op `DO UPDATE` exists to
-    /// return the loser a row, not to let it rewrite one mid-event.
-    #[sqlx::test]
-    async fn a_late_create_does_not_disturb_the_existing_row(pool: PgPool) {
-        let first = Event::find_or_create(&pool, "wedding", "Hochzeit")
-            .await
-            .expect("first");
-
-        sqlx::query("UPDATE event SET name = $1, export_epoch = 7 WHERE id = $2")
-            .bind("Anna und Ben")
-            .bind(first.id)
-            .execute(&pool)
-            .await
-            .expect("simulate a live event");
-
-        let late = Event::create(&pool, "wedding", "Hochzeit")
-            .await
-            .expect("a colliding insert must still return the row");
-
-        assert_eq!(late.id, first.id);
-        assert_eq!(late.name, "Anna und Ben", "the name must survive");
-        assert_eq!(late.export_epoch, 7, "and so must the export epoch");
-    }
-}

backend/src/models/hashtag.rs

@@ -1,8 +1,6 @@
+use sqlx::PgPool;
 use uuid::Uuid;
 
-// Row shape for `hashtag`, populated by sqlx from `RETURNING *` in `upsert`. Callers only use
-// `id` today; `event_id`/`tag` are the rest of the row and stay part of the struct.
-#[allow(dead_code)]
 #[derive(Debug, sqlx::FromRow)]
 pub struct Hashtag {
     pub id: Uuid,
@@ -12,13 +10,7 @@ pub struct Hashtag {
 
 impl Hashtag {
     /// Upsert a hashtag (insert if not exists, return existing if it does).
-    ///
-    /// Takes any executor so callers can run it inside a transaction (atomic
-    /// upload/comment writes) or standalone against the pool.
-    pub async fn upsert<'e, E>(executor: E, event_id: Uuid, tag: &str) -> Result<Self, sqlx::Error>
-    where
-        E: sqlx::PgExecutor<'e>,
-    {
+    pub async fn upsert(pool: &PgPool, event_id: Uuid, tag: &str) -> Result<Self, sqlx::Error> {
         let normalized = tag.trim().trim_start_matches('#').to_lowercase();
         sqlx::query_as::<_, Self>(
             "INSERT INTO hashtag (event_id, tag) VALUES ($1, $2)
@@ -27,68 +19,51 @@ impl Hashtag {
         )
         .bind(event_id)
         .bind(&normalized)
-        .fetch_one(executor)
+        .fetch_one(pool)
         .await
     }
 
-    pub async fn link_to_upload<'e, E>(
-        executor: E,
+    pub async fn link_to_upload(
+        pool: &PgPool,
         upload_id: Uuid,
         hashtag_id: Uuid,
-    ) -> Result<(), sqlx::Error>
-    where
-        E: sqlx::PgExecutor<'e>,
-    {
+    ) -> Result<(), sqlx::Error> {
         sqlx::query(
             "INSERT INTO upload_hashtag (upload_id, hashtag_id) VALUES ($1, $2)
              ON CONFLICT DO NOTHING",
         )
         .bind(upload_id)
         .bind(hashtag_id)
-        .execute(executor)
+        .execute(pool)
         .await?;
         Ok(())
     }
 
-    pub async fn unlink_all_from_upload<'e, E>(
-        executor: E,
+    pub async fn unlink_all_from_upload(
+        pool: &PgPool,
         upload_id: Uuid,
-    ) -> Result<(), sqlx::Error>
-    where
-        E: sqlx::PgExecutor<'e>,
-    {
+    ) -> Result<(), sqlx::Error> {
         sqlx::query("DELETE FROM upload_hashtag WHERE upload_id = $1")
             .bind(upload_id)
-            .execute(executor)
+            .execute(pool)
             .await?;
         Ok(())
     }
 
-    /// The upload's current tags, lowercased and sorted — the comparable form.
-    ///
-    /// Exists so `edit_upload` can tell a real hashtag change from a re-send of the same list.
-    /// Without it, `PATCH {"hashtags": []}` in a loop retired the HTML keepsake on every request
-    /// (readiness is derived from `event.export_epoch`), and every armed rebuild was superseded
-    /// before the debounce let it start — so the viewer 404'd for the rest of the event at zero
-    /// cost to the client. One indexed lookup on `upload_hashtag(upload_id)` is a fair price for
-    /// closing that.
-    pub async fn normalized_for_upload<'e, E>(
-        executor: E,
+    pub async fn tags_for_upload(
+        pool: &PgPool,
         upload_id: Uuid,
-    ) -> Result<Vec<String>, sqlx::Error>
-    where
-        E: sqlx::PgExecutor<'e>,
-    {
+    ) -> Result<Vec<String>, sqlx::Error> {
         let rows: Vec<(String,)> = sqlx::query_as(
-            "SELECT lower(h.tag) FROM hashtag h
+            "SELECT h.tag FROM hashtag h
              JOIN upload_hashtag uh ON uh.hashtag_id = h.id
              WHERE uh.upload_id = $1
-             ORDER BY lower(h.tag)",
+             ORDER BY h.tag",
         )
         .bind(upload_id)
-        .fetch_all(executor)
+        .fetch_all(pool)
         .await?;
-        Ok(rows.into_iter().map(|(t,)| t).collect())
+        Ok(rows.into_iter().map(|r| r.0).collect())
     }
 }
 
@@ -134,44 +109,4 @@ mod tests {
     fn empty_or_bare_hash_skipped() {
         assert_eq!(extract_hashtags("# #"), Vec::<String>::new());
     }
-
-    #[test]
-    fn tag_stops_at_first_non_word_char() {
-        // A tag runs until the first char that isn't ascii-alphanumeric or '_'.
-        assert_eq!(extract_hashtags("#foo#bar"), vec!["foo"]);
-        assert_eq!(extract_hashtags("#foo-bar"), vec!["foo"]);
-        assert_eq!(extract_hashtags("##tag"), Vec::<String>::new()); // '#' after the strip is non-word
-    }
-
-    #[test]
-    fn tag_length_is_capped_at_40_chars() {
-        let ok = "a".repeat(40);
-        assert_eq!(extract_hashtags(&format!("#{ok}")), vec![ok.clone()]);
-        // 41+ chars → dropped entirely (not truncated).
-        let too_long = "a".repeat(41);
-        assert_eq!(
-            extract_hashtags(&format!("#{too_long}")),
-            Vec::<String>::new()
-        );
-    }
-
-    #[test]
-    fn duplicate_tags_are_returned_verbatim_not_deduplicated() {
-        // Dedup is the DB's job (Hashtag::upsert ON CONFLICT); extraction returns each
-        // occurrence so callers can count/link them independently. Case folds to lower.
-        assert_eq!(
-            extract_hashtags("#fun #Fun #fun!"),
-            vec!["fun", "fun", "fun"]
-        );
-    }
-
-    #[test]
-    fn non_ascii_word_chars_truncate_the_tag() {
-        // KNOWN LIMITATION for a German app: `is_ascii_alphanumeric` excludes umlauts
-        // and ß, so a tag truncates at the first non-ASCII letter. Pinned here so a
-        // future Unicode-aware change is a deliberate, test-visible decision.
-        assert_eq!(extract_hashtags("#Grüße"), vec!["gr"]);
-        assert_eq!(extract_hashtags("#Straße"), vec!["stra"]);
-        assert_eq!(extract_hashtags("#café"), vec!["caf"]);
-    }
 }

backend/src/models/session.rs

@@ -2,9 +2,8 @@ use chrono::{DateTime, Utc};
 use sqlx::PgPool;
 use uuid::Uuid;
 
-// Row shape for `session`, populated by sqlx from `RETURNING *`. Session validation is done in SQL
-// (expiry/last-seen predicates), so no field is read in Rust — the struct is the row's shape.
-#[allow(dead_code)]
+use crate::models::user::UserRole;
+
 #[derive(Debug, sqlx::FromRow)]
 pub struct Session {
     pub id: Uuid,
@@ -15,6 +14,18 @@ pub struct Session {
     pub created_at: DateTime<Utc>,
 }
 
+/// Live identity reconciled from the DB for a valid, unexpired session. Used by
+/// the `AuthUser` extractor so role/ban/event are sourced from the `user` row
+/// rather than trusted from (potentially stale) JWT claims.
+#[derive(Debug, sqlx::FromRow)]
+pub struct AuthContext {
+    pub session_id: Uuid,
+    pub user_id: Uuid,
+    pub event_id: Uuid,
+    pub role: UserRole,
+    pub is_banned: bool,
+}
+
 impl Session {
     pub async fn create(
         pool: &PgPool,
@@ -46,19 +57,16 @@ impl Session {
         .await
     }
 
-    /// Resolve a session token straight to its live user row in one round-trip.
-    ///
-    /// The auth extractor runs on every authenticated request and used to do two
-    /// sequential queries (session lookup, then user lookup); this collapses them into
-    /// a single `session JOIN "user"`. The `expires_at` guard mirrors
-    /// [`Self::find_by_token_hash`], and the user row is read live (role/ban are never
-    /// trusted from the JWT). Returns `None` when the session is missing/expired.
-    pub async fn find_user_by_token_hash(
+    /// Reconcile a session against the live `user` row in a single round-trip.
+    /// Returns `None` when the session is missing/expired. The PK join to
+    /// `"user"` is cheap and lets the extractor read the *current* role/ban
+    /// state instead of the JWT claim.
+    pub async fn find_auth_context(
         pool: &PgPool,
         token_hash: &str,
-    ) -> Result<Option<crate::models::user::User>, sqlx::Error> {
-        sqlx::query_as::<_, crate::models::user::User>(
-            "SELECT u.*
+    ) -> Result<Option<AuthContext>, sqlx::Error> {
+        sqlx::query_as::<_, AuthContext>(
+            "SELECT s.id AS session_id, u.id AS user_id, u.event_id, u.role, u.is_banned
              FROM session s
              JOIN \"user\" u ON u.id = s.user_id
              WHERE s.token_hash = $1 AND s.expires_at > NOW()",
@@ -68,29 +76,18 @@ impl Session {
         .await
     }
 
-    /// Touch `last_seen_at` AND slide `expires_at` forward by `expiry_days` from now, so
-    /// an actively-used session never hits the fixed 30-day cliff (it renews on every
-    /// authenticated request). An idle session still expires `expiry_days` after its last
-    /// activity. Keyed by token hash so the auth extractor needs no prior id lookup.
-    pub async fn touch_and_renew(
-        pool: &PgPool,
-        token_hash: &str,
-        expiry_days: i64,
-    ) -> Result<(), sqlx::Error> {
-        sqlx::query(
-            "UPDATE session
-             SET last_seen_at = NOW(),
-                 expires_at = NOW() + ($2 || ' days')::interval
-             WHERE token_hash = $1",
-        )
-        .bind(token_hash)
-        .bind(expiry_days.to_string())
-        .execute(pool)
-        .await?;
+    pub async fn touch(pool: &PgPool, id: Uuid) -> Result<(), sqlx::Error> {
+        sqlx::query("UPDATE session SET last_seen_at = NOW() WHERE id = $1")
+            .bind(id)
+            .execute(pool)
+            .await?;
         Ok(())
     }
 
-    pub async fn delete_by_token_hash(pool: &PgPool, token_hash: &str) -> Result<(), sqlx::Error> {
+    pub async fn delete_by_token_hash(
+        pool: &PgPool,
+        token_hash: &str,
+    ) -> Result<(), sqlx::Error> {
         sqlx::query("DELETE FROM session WHERE token_hash = $1")
             .bind(token_hash)
             .execute(pool)
@@ -98,13 +95,14 @@ impl Session {
         Ok(())
     }
 
-    /// Revoke every session for a user. Backs "sign out everywhere" and the forced
-    /// re-auth after a host PIN-reset or a ban. Returns the number of sessions cleared.
-    pub async fn delete_all_for_user(pool: &PgPool, user_id: Uuid) -> Result<u64, sqlx::Error> {
-        let r = sqlx::query("DELETE FROM session WHERE user_id = $1")
+    /// Revoke every session belonging to a user — used on ban, role change, and
+    /// PIN reset so existing JWTs stop working immediately. Returns the number
+    /// of sessions removed. Best-effort: callers log but do not fail on error.
+    pub async fn delete_by_user_id(pool: &PgPool, user_id: Uuid) -> Result<u64, sqlx::Error> {
+        let result = sqlx::query("DELETE FROM session WHERE user_id = $1")
             .bind(user_id)
             .execute(pool)
             .await?;
-        Ok(r.rows_affected())
+        Ok(result.rows_affected())
     }
 }

backend/src/models/upload.rs

@@ -3,10 +3,6 @@ use serde::Serialize;
 use sqlx::PgPool;
 use uuid::Uuid;
 
-// Row shape for `upload`: every field is populated by sqlx from `RETURNING *` in `create`. Callers
-// mostly use `id` and hand the rest to the compression/feed queries, so most fields are never read
-// through this struct — they stay here so it keeps mirroring the table.
-#[allow(dead_code)]
 #[derive(Debug, sqlx::FromRow)]
 pub struct Upload {
     pub id: Uuid,
@@ -23,6 +19,15 @@ pub struct Upload {
     pub deleted_at: Option<DateTime<Utc>>,
 }
 
+/// On-disk artifact paths returned by the soft-delete methods so the caller can
+/// unlink the files after the DB commit.
+#[derive(Debug, sqlx::FromRow)]
+pub struct DeletedPaths {
+    pub original: String,
+    pub preview: Option<String>,
+    pub thumbnail: Option<String>,
+}
+
 #[derive(Debug, Serialize)]
 pub struct UploadDto {
     pub id: Uuid,
@@ -30,6 +35,8 @@ pub struct UploadDto {
     pub uploader_name: String,
     pub preview_url: Option<String>,
     pub thumbnail_url: Option<String>,
+    /// Signed gateway URL for the full-resolution original. Always present.
+    pub original_url: Option<String>,
     pub mime_type: String,
     pub caption: Option<String>,
     pub hashtags: Vec<String>,
@@ -39,23 +46,10 @@ pub struct UploadDto {
     pub created_at: DateTime<Utc>,
 }
 
-/// Minimal projection of an upload's on-disk file paths, used by the visibility-gated
-/// media aliases so they don't hydrate the entire `Upload` row per request.
-#[derive(Debug, sqlx::FromRow)]
-pub struct VisibleMedia {
-    pub original_path: String,
-    pub preview_path: Option<String>,
-    pub thumbnail_path: Option<String>,
-    pub display_path: Option<String>,
-    pub mime_type: String,
-}
-
 impl Upload {
-    /// Takes any executor so the caller can run it inside a transaction (atomic
-    /// quota + insert) or standalone against the pool.
-    // Eight arguments, one per column the INSERT writes, with exactly one call site. A params
-    // struct here would restate the column list a second time and buy nothing.
-    #[allow(clippy::too_many_arguments)]
+    /// Generic over the executor so it can run inside the upload transaction
+    /// (`&mut *tx`) alongside the quota-counter reservation, keeping the
+    /// byte-counter and the row atomic (no quota leak on a mid-write crash).
     pub async fn create<'e, E>(
         executor: E,
         event_id: Uuid,
@@ -64,34 +58,13 @@ impl Upload {
         mime_type: &str,
         original_size_bytes: i64,
         caption: Option<&str>,
-        client_upload_id: Option<Uuid>,
-    ) -> Result<Option<Self>, sqlx::Error>
+    ) -> Result<Self, sqlx::Error>
     where
         E: sqlx::PgExecutor<'e>,
     {
-        // `Ok(None)` means this exact `client_upload_id` is already stored — the caller's request
-        // is a retry of one that already succeeded, and it must replay the original row rather
-        // than create a second. Letting the unique index raise instead would work, but only after
-        // the whole transaction had aborted, and it would arrive as an opaque database error the
-        // caller would have to string-match to recognise.
-        //
-        // The conflict target repeats the index's `WHERE` clause because it is a partial index;
-        // without it Postgres cannot prove which index to use and rejects the statement.
-        //
-        // KEEP THIS IN LOCKSTEP WITH `upload_client_upload_id_key` (migrations 026 and 031). The
-        // predicate here must match the index's, or the arbiter cannot be inferred and every
-        // upload that carries a `client_upload_id` fails as a runtime 500 — queries in this
-        // codebase are not compile-time checked, so nothing catches a drift at build time.
-        //
-        // `deleted_at IS NULL` is what makes a retry-after-delete work instead of 409ing forever:
-        // the key is claimed only while a LIVE row holds it, which is what
-        // `find_by_client_upload_id` below has always assumed. `OR taken_down_by_host` carves the
-        // moderation case back out — see migration 031: releasing the key for a HOST takedown let
-        // a late retry resurrect a photo the host had deliberately removed.
         sqlx::query_as::<_, Self>(
-            "INSERT INTO upload (event_id, user_id, original_path, mime_type, original_size_bytes, caption, client_upload_id)
-             VALUES ($1, $2, $3, $4, $5, $6, $7)
-             ON CONFLICT (client_upload_id) WHERE client_upload_id IS NOT NULL AND (deleted_at IS NULL OR taken_down_by_host) DO NOTHING
+            "INSERT INTO upload (event_id, user_id, original_path, mime_type, original_size_bytes, caption)
+             VALUES ($1, $2, $3, $4, $5, $6)
              RETURNING *",
         )
         .bind(event_id)
@@ -100,74 +73,13 @@ impl Upload {
         .bind(mime_type)
         .bind(original_size_bytes)
         .bind(caption)
-        .bind(client_upload_id)
-        .fetch_optional(executor)
+        .fetch_one(executor)
         .await
     }
 
-    /// Look up a live upload by the idempotency key its client sent.
-    ///
-    /// Scoped to the user as well as the key: the key alone is unique, but a lookup that ignored
-    /// ownership would let one guest's retry return another guest's row if a key ever repeated.
-    /// Soft-deleted rows are excluded on purpose — if the guest deleted the photo and their queue
-    /// later retries, they should get a fresh upload rather than a resurrection of a deleted one.
-    pub async fn find_by_client_upload_id(
-        pool: &sqlx::PgPool,
-        user_id: Uuid,
-        client_upload_id: Uuid,
-    ) -> Result<Option<Self>, sqlx::Error> {
+    pub async fn find_by_id(pool: &PgPool, id: Uuid) -> Result<Option<Self>, sqlx::Error> {
         sqlx::query_as::<_, Self>(
-            "SELECT * FROM upload
-             WHERE client_upload_id = $1 AND user_id = $2 AND deleted_at IS NULL",
-        )
-        .bind(client_upload_id)
-        .bind(user_id)
-        .fetch_optional(pool)
-        .await
-    }
-
-    /// Was this key claimed by a row the HOST took down?
-    ///
-    /// Only used to answer a refused retry honestly. Without it the guest's queue shows
-    /// "Dieser Upload wurde bereits verarbeitet." for a photo that was in fact removed by the
-    /// hosts — technically true, actively misleading, and it invites them to try again.
-    pub async fn taken_down_by_client_upload_id(
-        pool: &sqlx::PgPool,
-        user_id: Uuid,
-        client_upload_id: Uuid,
-    ) -> Result<bool, sqlx::Error> {
-        sqlx::query_scalar::<_, bool>(
-            "SELECT EXISTS (
-                 SELECT 1 FROM upload
-                 WHERE client_upload_id = $1 AND user_id = $2
-                   AND deleted_at IS NOT NULL AND taken_down_by_host
-             )",
-        )
-        .bind(client_upload_id)
-        .bind(user_id)
-        .fetch_one(pool)
-        .await
-    }
-
-    /// Lean lookup for the public media aliases (`get_original`/`get_preview`/
-    /// `get_thumbnail`): returns ONLY the file paths + mime for a visible upload —
-    /// excluding soft-deleted rows, hidden owners (`uploads_hidden`), and banned owners
-    /// (`is_banned`) — the same filter `v_feed` applies. So moderation that removes a post
-    /// from the feed also stops its original/preview/thumbnail from being pulled by UUID.
-    ///
-    /// Selects four columns instead of the whole `Upload` row: this runs once per image
-    /// per cache-miss on the media hot path, so we avoid hydrating fields the response
-    /// never uses.
-    pub async fn find_visible_media(
-        pool: &PgPool,
-        id: Uuid,
-    ) -> Result<Option<VisibleMedia>, sqlx::Error> {
-        sqlx::query_as::<_, VisibleMedia>(
-            "SELECT up.original_path, up.preview_path, up.thumbnail_path, up.display_path, up.mime_type
-             FROM upload up
-             JOIN \"user\" u ON u.id = up.user_id
-             WHERE up.id = $1 AND up.deleted_at IS NULL
-               AND u.uploads_hidden = false AND u.is_banned = false",
+            "SELECT * FROM upload WHERE id = $1 AND deleted_at IS NULL",
         )
         .bind(id)
         .fetch_optional(pool)
@@ -204,94 +116,6 @@ impl Upload {
         Ok(())
     }
 
-    pub async fn set_display_path(
-        pool: &PgPool,
-        id: Uuid,
-        display_path: &str,
-    ) -> Result<(), sqlx::Error> {
-        sqlx::query("UPDATE upload SET display_path = $2 WHERE id = $1")
-            .bind(id)
-            .bind(display_path)
-            .execute(pool)
-            .await?;
-        Ok(())
-    }
-
-    /// Stamp which revision of the derivative pipeline produced this row's preview/display,
-    /// so the startup backfill can find rows generated by an older one exactly once.
-    ///
-    /// Also clears the attempt counter: success is the only thing that resets it, and folding
-    /// the reset in here means both the live path and the backfill get it with no extra call
-    /// site to forget.
-    pub async fn set_derivatives_rev(pool: &PgPool, id: Uuid, rev: i16) -> Result<(), sqlx::Error> {
-        sqlx::query(
-            "UPDATE upload
-                SET derivatives_rev = $2, derivative_attempts = 0, derivative_last_error = NULL
-              WHERE id = $1",
-        )
-        .bind(id)
-        .bind(rev)
-        .execute(pool)
-        .await?;
-        Ok(())
-    }
-
-    /// Record that derivative processing is ABOUT to be attempted, returning the new count.
-    ///
-    /// WRITE-AHEAD ON PURPOSE. The failure this bounds is a cgroup SIGKILL: the process
-    /// vanishes mid-work, so no `Err` is returned, no error handler runs and no `Drop` fires.
-    /// A counter incremented after a failure would increment zero times per crash and the
-    /// boot loop would be unchanged. Counting the ATTEMPT is the only thing that survives the
-    /// process dying. The cost is that a genuinely transient failure also burns an attempt —
-    /// acceptable, because the retry budget is per-boot-loop, not per-request, and success
-    /// resets it to zero.
-    /// `None` when the row no longer exists (hard-deleted, or an e2e TRUNCATE landed while the
-    /// task waited on the semaphore) — the caller should abandon quietly rather than treat a
-    /// missing row as a processing failure.
-    pub async fn begin_derivative_attempt(
-        pool: &PgPool,
-        id: Uuid,
-    ) -> Result<Option<i16>, sqlx::Error> {
-        sqlx::query_scalar(
-            "UPDATE upload
-                SET derivative_attempts = derivative_attempts + 1
-              WHERE id = $1
-          RETURNING derivative_attempts",
-        )
-        .bind(id)
-        .fetch_optional(pool)
-        .await
-    }
-
-    /// Read the lifetime derivative-attempt counter WITHOUT charging it.
-    ///
-    /// Used by the in-request retries after the first: those re-enter `do_process` but must not
-    /// spend the lifetime budget again (see `charge_lifetime_attempt`). `None` still means the
-    /// row vanished, so the caller's "nothing to do" branch keeps working unchanged.
-    pub async fn derivative_attempts(pool: &PgPool, id: Uuid) -> Result<Option<i16>, sqlx::Error> {
-        sqlx::query_scalar("SELECT derivative_attempts FROM upload WHERE id = $1")
-            .bind(id)
-            .fetch_optional(pool)
-            .await
-    }
-
-    /// Store why the last derivative attempt failed. Diagnostics only — nothing branches on it.
-    pub async fn record_derivative_failure(
-        pool: &PgPool,
-        id: Uuid,
-        error: &str,
-    ) -> Result<(), sqlx::Error> {
-        // Bounded: an anyhow chain can be long, and this is written on a failure path that may
-        // repeat across every row of a bad batch.
-        let truncated: String = error.chars().take(500).collect();
-        sqlx::query("UPDATE upload SET derivative_last_error = $2 WHERE id = $1")
-            .bind(id)
-            .bind(truncated)
-            .execute(pool)
-            .await?;
-        Ok(())
-    }
-
     pub async fn set_thumbnail_path(
         pool: &PgPool,
         id: Uuid,
@@ -305,39 +129,28 @@ impl Upload {
         Ok(())
     }
 
-    /// Soft-deletes an upload within its event and refunds the uploader's
-    /// `total_upload_bytes`, in one transaction. Returns `false` if no row
-    /// matched (already deleted, wrong event, or unknown id) so host handlers
-    /// can return a clean 404 instead of silently no-op'ing.
-    /// Executor-generic so a caller can run the delete and the keepsake regeneration in ONE
-    /// transaction. They must be atomic: if the delete commits and the regeneration doesn't (a
-    /// dropped handler future, a failed second tx), the taken-down photo stays in the downloadable
-    /// archive forever, and recovery can't tell — the keepsake still looks complete at the current
-    /// epoch, and the host can no longer even find the upload to retry.
+    /// Soft-deletes the upload and decrements the uploader's `total_upload_bytes`.
+    /// Done in a single transaction so a crash between the two writes can't leave
+    /// the quota counter pointing at bytes the user has already deleted (which would
+    /// silently lock them out of future uploads).
     ///
-    /// `by_host` records WHO removed it, which decides whether the row keeps holding its
-    /// idempotency key — see migration 031. A host takedown holds it, so a late retry from the
-    /// uploader's queue cannot bring the photo back; a guest deleting their own photo releases it,
-    /// so their next upload of the same queue item succeeds.
-    pub async fn soft_delete_in_event(
-        conn: &mut sqlx::PgConnection,
-        id: Uuid,
-        event_id: Uuid,
-        by_host: bool,
-    ) -> Result<bool, sqlx::Error> {
-        let tx = conn;
-        let row: Option<(Uuid, i64)> = sqlx::query_as(
+    /// No-op if the row is already deleted — protects against a double-tap on the
+    /// delete action double-decrementing the counter.
+    ///
+    /// Returns the artifact paths of the row that was deleted (`None` if nothing
+    /// matched) so the caller can unlink the files after the commit.
+    pub async fn soft_delete(pool: &PgPool, id: Uuid) -> Result<Option<DeletedPaths>, sqlx::Error> {
+        let mut tx = pool.begin().await?;
+        let row: Option<(Uuid, i64, String, Option<String>, Option<String>)> = sqlx::query_as(
             "UPDATE upload
-             SET deleted_at = NOW(), taken_down_by_host = $3
-             WHERE id = $1 AND event_id = $2 AND deleted_at IS NULL
-             RETURNING user_id, original_size_bytes",
+             SET deleted_at = NOW()
+             WHERE id = $1 AND deleted_at IS NULL
+             RETURNING user_id, original_size_bytes, original_path, preview_path, thumbnail_path",
         )
         .bind(id)
-        .bind(event_id)
-        .bind(by_host)
         .fetch_optional(&mut *tx)
         .await?;
-        let deleted = if let Some((user_id, bytes)) = row {
+        let paths = if let Some((user_id, bytes, original, preview, thumbnail)) = row {
             sqlx::query(
                 "UPDATE \"user\"
                  SET total_upload_bytes = GREATEST(0, total_upload_bytes - $2)
@@ -347,25 +160,60 @@ impl Upload {
             .bind(bytes)
             .execute(&mut *tx)
             .await?;
-            true
+            Some(DeletedPaths { original, preview, thumbnail })
         } else {
-            false
+            None
         };
-        Ok(deleted)
+        tx.commit().await?;
+        Ok(paths)
     }
 
-    pub async fn update_caption<'e, E>(
-        executor: E,
+    /// Event-scoped variant of [`Self::soft_delete`]. Returns `None` if no row
+    /// matched (already deleted, wrong event, or unknown id) so host handlers
+    /// can return a clean 404, and the artifact paths otherwise.
+    pub async fn soft_delete_in_event(
+        pool: &PgPool,
+        id: Uuid,
+        event_id: Uuid,
+    ) -> Result<Option<DeletedPaths>, sqlx::Error> {
+        let mut tx = pool.begin().await?;
+        let row: Option<(Uuid, i64, String, Option<String>, Option<String>)> = sqlx::query_as(
+            "UPDATE upload
+             SET deleted_at = NOW()
+             WHERE id = $1 AND event_id = $2 AND deleted_at IS NULL
+             RETURNING user_id, original_size_bytes, original_path, preview_path, thumbnail_path",
+        )
+        .bind(id)
+        .bind(event_id)
+        .fetch_optional(&mut *tx)
+        .await?;
+        let paths = if let Some((user_id, bytes, original, preview, thumbnail)) = row {
+            sqlx::query(
+                "UPDATE \"user\"
+                 SET total_upload_bytes = GREATEST(0, total_upload_bytes - $2)
+                 WHERE id = $1",
+            )
+            .bind(user_id)
+            .bind(bytes)
+            .execute(&mut *tx)
+            .await?;
+            Some(DeletedPaths { original, preview, thumbnail })
+        } else {
+            None
+        };
+        tx.commit().await?;
+        Ok(paths)
+    }
+
+    pub async fn update_caption(
+        pool: &PgPool,
         id: Uuid,
         caption: Option<&str>,
-    ) -> Result<(), sqlx::Error>
-    where
-        E: sqlx::PgExecutor<'e>,
-    {
+    ) -> Result<(), sqlx::Error> {
         sqlx::query("UPDATE upload SET caption = $2 WHERE id = $1")
             .bind(id)
             .bind(caption)
-            .execute(executor)
+            .execute(pool)
             .await?;
         Ok(())
     }

backend/src/models/user.rs

@@ -22,10 +22,6 @@ impl UserRole {
     }
 }
 
-// Row shape for `user`: every field is populated by sqlx from `SELECT *` / `RETURNING *`.
-// `uploads_hidden`, `failed_pin_attempts` and `created_at` are enforced/updated in SQL rather than
-// read in Rust, but they are part of the row and stay here so the struct keeps mirroring the table.
-#[allow(dead_code)]
 #[derive(Debug, sqlx::FromRow)]
 pub struct User {
     pub id: Uuid,
@@ -47,89 +43,19 @@ impl User {
         event_id: Uuid,
         display_name: &str,
         pin_hash: &str,
-        client_join_id: Option<Uuid>,
     ) -> Result<Self, sqlx::Error> {
         sqlx::query_as::<_, Self>(
-            "INSERT INTO \"user\" (event_id, display_name, recovery_pin_hash, client_join_id)
-             VALUES ($1, $2, $3, $4)
+            "INSERT INTO \"user\" (event_id, display_name, recovery_pin_hash)
+             VALUES ($1, $2, $3)
              RETURNING *",
         )
         .bind(event_id)
         .bind(display_name)
         .bind(pin_hash)
-        .bind(client_join_id)
         .fetch_one(pool)
         .await
     }
 
-    /// Look up a join that already succeeded, by the idempotency key its client sent.
-    ///
-    /// The retry path for H16: the account was created but the response never arrived, so the
-    /// client re-sends the same `client_join_id`. Finding a row here means "this join already
-    /// happened" — the caller rotates the PIN and answers with a usable one rather than 409ing
-    /// on a name the caller itself owns.
-    pub async fn find_by_client_join_id(
-        pool: &PgPool,
-        event_id: Uuid,
-        client_join_id: Uuid,
-    ) -> Result<Option<Self>, sqlx::Error> {
-        sqlx::query_as::<_, Self>(
-            "SELECT * FROM \"user\" WHERE event_id = $1 AND client_join_id = $2",
-        )
-        .bind(event_id)
-        .bind(client_join_id)
-        .fetch_optional(pool)
-        .await
-    }
-
-    /// Create a user with an explicit role, in ONE statement.
-    ///
-    /// `create` + a separate `UPDATE ... SET role` is not equivalent: a crash or a pool error
-    /// between the two leaves a GUEST row holding a reserved name, which is exactly the
-    /// poisoned state that bricked admin login — now self-inflicted, and invisible to a
-    /// role-based lookup, so the next login would create yet another.
-    pub async fn create_with_role(
-        pool: &PgPool,
-        event_id: Uuid,
-        display_name: &str,
-        pin_hash: &str,
-        role: UserRole,
-    ) -> Result<Self, sqlx::Error> {
-        sqlx::query_as::<_, Self>(
-            "INSERT INTO \"user\" (event_id, display_name, recovery_pin_hash, role)
-             VALUES ($1, $2, $3, $4)
-             RETURNING *",
-        )
-        .bind(event_id)
-        .bind(display_name)
-        .bind(pin_hash)
-        .bind(role)
-        .fetch_one(pool)
-        .await
-    }
-
-    /// The event's admin, looked up BY ROLE.
-    ///
-    /// The name is not the identity and never was. Looking the admin up by `display_name`
-    /// meant any guest who joined as "Admin" first made the lookup miss, and the fallback
-    /// `create` then violated the case-insensitive unique index from migration 007 — a
-    /// permanent 500 on admin login, recoverable only by hand-editing the database.
-    ///
-    /// `ORDER BY created_at` so a database that somehow acquired two admin rows resolves to a
-    /// stable one rather than alternating between them.
-    pub async fn find_admin_for_event(
-        pool: &PgPool,
-        event_id: Uuid,
-    ) -> Result<Option<Self>, sqlx::Error> {
-        sqlx::query_as::<_, Self>(
-            "SELECT * FROM \"user\" WHERE event_id = $1 AND role = 'admin'
-             ORDER BY created_at ASC LIMIT 1",
-        )
-        .bind(event_id)
-        .fetch_optional(pool)
-        .await
-    }
-
     pub async fn find_by_id(pool: &PgPool, id: Uuid) -> Result<Option<Self>, sqlx::Error> {
         sqlx::query_as::<_, Self>("SELECT * FROM \"user\" WHERE id = $1")
             .bind(id)
@@ -166,54 +92,33 @@ impl User {
         Ok(row.0)
     }
 
-    /// Window after which a failed-PIN streak is forgotten. Matches the lockout duration, so
-    /// "wait out the cooldown" and "start clean" are the same interval to a guest.
-    const PIN_ATTEMPT_DECAY_MINUTES: i64 = 15;
-
-    /// Record a wrong PIN and return the CURRENT streak length.
-    ///
-    /// The counter decays: before this, it only ever cleared on a successful recovery or after
-    /// a lockout expired, so ordinary typos accumulated across days and a guest could arrive at
-    /// an event already most of the way to being locked out by mistakes made the night before.
-    /// Decay is what makes the raised lock threshold safe rather than merely lenient.
     pub async fn increment_failed_pin(pool: &PgPool, id: Uuid) -> Result<i16, sqlx::Error> {
         let row: (i16,) = sqlx::query_as(
             "UPDATE \"user\"
-             SET failed_pin_attempts = CASE
-                     WHEN last_failed_pin_at IS NULL
-                       OR last_failed_pin_at < NOW() - ($2 || ' minutes')::interval
-                     THEN 1
-                     ELSE failed_pin_attempts + 1
-                 END,
-                 last_failed_pin_at = NOW()
+             SET failed_pin_attempts = failed_pin_attempts + 1
              WHERE id = $1
              RETURNING failed_pin_attempts",
         )
         .bind(id)
-        .bind(Self::PIN_ATTEMPT_DECAY_MINUTES.to_string())
         .fetch_one(pool)
         .await?;
         Ok(row.0)
     }
 
-    pub async fn lock_pin(
-        pool: &PgPool,
-        id: Uuid,
-        until: DateTime<Utc>,
-    ) -> Result<(), sqlx::Error> {
-        sqlx::query("UPDATE \"user\" SET pin_locked_until = $2 WHERE id = $1")
-            .bind(id)
-            .bind(until)
-            .execute(pool)
-            .await?;
+    pub async fn lock_pin(pool: &PgPool, id: Uuid, until: DateTime<Utc>) -> Result<(), sqlx::Error> {
+        sqlx::query(
+            "UPDATE \"user\" SET pin_locked_until = $2 WHERE id = $1",
+        )
+        .bind(id)
+        .bind(until)
+        .execute(pool)
+        .await?;
         Ok(())
     }
 
     pub async fn reset_pin_attempts(pool: &PgPool, id: Uuid) -> Result<(), sqlx::Error> {
         sqlx::query(
-            "UPDATE \"user\"
-                SET failed_pin_attempts = 0, pin_locked_until = NULL, last_failed_pin_at = NULL
-              WHERE id = $1",
+            "UPDATE \"user\" SET failed_pin_attempts = 0, pin_locked_until = NULL WHERE id = $1",
         )
         .bind(id)
         .execute(pool)

backend/src/services/audit.rs

@@ -1,314 +0,0 @@
-//! Append-only record of privileged actions. See migration 029 for why it exists.
-//!
-//! Design constraints, both learned from the rest of this codebase:
-//!
-//!  * **Never fail the action.** An audit write that can turn a successful ban into a 500 makes
-//!    moderation less reliable than no audit at all. Every failure here is logged and swallowed.
-//!  * **Never store a credential.** `reset_pin` is the action most worth recording and the one
-//!    whose payload must never be in `detail` — a table that could hand back a guest's PIN would
-//!    be a worse privacy problem than the gap it closes.
-//!
-//! **Action slugs actually written**, since migration 029's header lists three (`promote_user`,
-//! `demote_user`, `delete_user`) that no call site has ever emitted, and the migration file cannot
-//! be corrected without changing its checksum and crash-looping every database that ran it:
-//!
-//! `ban_user`, `unban_user`, `set_role`, `reset_pin`, `delete_upload`, `delete_comment`,
-//! `lock_uploads`, `unlock_uploads`, `release_gallery`, `delete_account`, `patch_config`.
-//! Eleven, one per `audit::record` call site — grep for it if this list ages.
-//!
-//! **There is deliberately no read endpoint.** The table is queried by hand:
-//!
-//! ```sql
-//! SELECT created_at, actor_name, actor_role, action, target_name, detail
-//!   FROM host_action_audit ORDER BY created_at DESC LIMIT 50;
-//! ```
-
-use serde_json::Value;
-use sqlx::PgPool;
-use uuid::Uuid;
-
-use crate::models::user::UserRole;
-
-/// Record one privileged action.
-///
-/// Takes `&PgPool` rather than a transaction on purpose: the audit row is not part of the action's
-/// atomicity. If the action commits and the audit write fails we want the action to stand (and a
-/// loud log line); if the action rolls back, an orphan audit row saying "someone tried" is more
-/// useful than silence.
-#[allow(clippy::too_many_arguments)]
-pub async fn record(
-    pool: &PgPool,
-    event_id: Uuid,
-    actor_id: Uuid,
-    actor_name: Option<&str>,
-    actor_role: UserRole,
-    action: &str,
-    target_id: Option<Uuid>,
-    target_name: Option<&str>,
-    detail: Option<Value>,
-) {
-    // Resolve whatever names the caller did not supply.
-    //
-    // Migration 029 made `actor_id`/`target_id` deliberately non-FK so "the record survives the
-    // actor's account being removed, which is exactly when it is most likely to be wanted". Every
-    // caller passed None for both names, so what survived was a bare uuid resolving to nothing —
-    // the guarantee the column exists for, minus the only thing that made it readable.
-    //
-    // Resolved HERE rather than at eleven call sites so none can be missed. The one caller that
-    // destroys the row it is recording — `me::delete_account` — must still pass the name in, since
-    // by the time this runs there is nothing left to look up, and that is precisely the row a host
-    // will be reading the next morning ("whose photos disappeared?").
-    let (actor_name, target_name) =
-        resolve_names(pool, actor_id, actor_name, target_id, target_name).await;
-
-    let result = sqlx::query(
-        "INSERT INTO host_action_audit
-           (event_id, actor_id, actor_name, actor_role, action, target_id, target_name, detail)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
-    )
-    .bind(event_id)
-    .bind(actor_id)
-    .bind(actor_name.as_deref())
-    // `as_str()`, not `format!("{actor_role:?}")`: the Debug spelling is not a stable wire format,
-    // so a `#[derive(Debug)]` change or a renamed variant would silently start writing a different
-    // string into a column nothing validates. `as_str` is the one the rest of the codebase uses.
-    .bind(actor_role.as_str())
-    .bind(action)
-    .bind(target_id)
-    .bind(target_name.as_deref())
-    .bind(detail)
-    .execute(pool)
-    .await;
-
-    match result {
-        Ok(_) => {}
-        Err(e) => {
-            // `error`, not `warn`: losing an audit row is the kind of thing that should show up in
-            // whatever is watching the logs, even though it must not fail the request.
-            tracing::error!(
-                error = ?e, action, %actor_id, ?target_id,
-                "failed to write host action audit row"
-            );
-        }
-    }
-}
-
-/// Fill in any name the caller left as `None`, in ONE query.
-///
-/// Best-effort by the same rule as the insert: a failed lookup writes NULL rather than failing the
-/// action, and it is one round-trip whether zero, one or both names are missing.
-async fn resolve_names(
-    pool: &PgPool,
-    actor_id: Uuid,
-    actor_name: Option<&str>,
-    target_id: Option<Uuid>,
-    target_name: Option<&str>,
-) -> (Option<String>, Option<String>) {
-    let need_actor = actor_name.is_none();
-    let need_target = target_name.is_none() && target_id.is_some();
-    if !need_actor && !need_target {
-        return (
-            actor_name.map(str::to_owned),
-            target_name.map(str::to_owned),
-        );
-    }
-
-    let mut wanted: Vec<Uuid> = Vec::with_capacity(2);
-    if need_actor {
-        wanted.push(actor_id);
-    }
-    if let Some(t) = target_id
-        && need_target
-    {
-        wanted.push(t);
-    }
-
-    let rows: Vec<(Uuid, String)> =
-        sqlx::query_as("SELECT id, display_name FROM \"user\" WHERE id = ANY($1)")
-            .bind(&wanted)
-            .fetch_all(pool)
-            .await
-            .unwrap_or_default();
-
-    let lookup = |id: Uuid| rows.iter().find(|(i, _)| *i == id).map(|(_, n)| n.clone());
-
-    (
-        actor_name.map(str::to_owned).or_else(|| lookup(actor_id)),
-        target_name
-            .map(str::to_owned)
-            .or_else(|| target_id.and_then(lookup)),
-    )
-}
-
-/// These live HERE, not in `tests/`, and that is the entire point.
-///
-/// `backend/` is a binary crate, so an integration test cannot import `record`. The house rule in
-/// `tests/common/mod.rs` — copy the production SQL character-for-character — works for pinning
-/// behaviour that already existed, but applied to a NEW fix whose only coverage is the copy it
-/// proves nothing: the fix and its test become two independent implementations, and deleting the
-/// fix leaves the test green. The previous `tests/audit_names.rs` did exactly that, down to
-/// asserting `actor_role == "host"` against its own hardcoded `.bind("host")` — an assertion that
-/// could not fail for any change to the code it named.
-///
-/// A `#[cfg(test)]` module inside the binary can call the real function, so these do.
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    async fn seed_event(pool: &PgPool, slug: &str) -> Uuid {
-        sqlx::query_scalar("INSERT INTO event (slug, name) VALUES ($1, $2) RETURNING id")
-            .bind(slug)
-            .bind("Hochzeit")
-            .fetch_one(pool)
-            .await
-            .expect("seed event")
-    }
-
-    async fn seed_user(pool: &PgPool, event_id: Uuid, name: &str) -> Uuid {
-        sqlx::query_scalar(
-            "INSERT INTO \"user\" (event_id, display_name, recovery_pin_hash)
-             VALUES ($1, $2, 'x') RETURNING id",
-        )
-        .bind(event_id)
-        .bind(name)
-        .fetch_one(pool)
-        .await
-        .expect("seed user")
-    }
-
-    async fn audit_row(pool: &PgPool, action: &str) -> Option<(Option<String>, Option<String>)> {
-        sqlx::query_as(
-            "SELECT actor_name, target_name FROM host_action_audit
-              WHERE action = $1 ORDER BY created_at DESC LIMIT 1",
-        )
-        .bind(action)
-        .fetch_optional(pool)
-        .await
-        .expect("audit lookup")
-    }
-
-    /// The ordinary case: the caller supplies no names and `record` resolves both from the ids.
-    /// This is what nine of the eleven call sites do. Revert `resolve_names` and both names go NULL.
-    #[sqlx::test]
-    async fn a_recorded_action_carries_both_names_without_the_caller_supplying_them(pool: PgPool) {
-        let event_id = seed_event(&pool, "wedding").await;
-        let host = seed_user(&pool, event_id, "Gastgeberin Greta").await;
-        let guest = seed_user(&pool, event_id, "Gesperrter Gustav").await;
-
-        record(
-            &pool,
-            event_id,
-            host,
-            None,
-            UserRole::Host,
-            "ban_user",
-            Some(guest),
-            None,
-            None,
-        )
-        .await;
-
-        let (actor_name, target_name) = audit_row(&pool, "ban_user").await.expect("a row");
-        assert_eq!(actor_name.as_deref(), Some("Gastgeberin Greta"));
-        assert_eq!(target_name.as_deref(), Some("Gesperrter Gustav"));
-    }
-
-    /// `as_str()`, not the `Debug` spelling. Asserted against `UserRole::as_str` itself rather than
-    /// a literal, so it tracks a rename instead of pretending to: what must hold is that the column
-    /// carries the SAME string the rest of the codebase uses, whatever that string is. Swap line 75
-    /// back to `format!("{actor_role:?}")` and this goes red on the `Host`/`host` casing.
-    #[sqlx::test]
-    async fn the_role_column_carries_the_canonical_spelling(pool: PgPool) {
-        let event_id = seed_event(&pool, "wedding").await;
-        let host = seed_user(&pool, event_id, "Gastgeberin Greta").await;
-
-        record(
-            &pool,
-            event_id,
-            host,
-            None,
-            UserRole::Host,
-            "release_gallery",
-            None,
-            None,
-            None,
-        )
-        .await;
-
-        let role: String = sqlx::query_scalar(
-            "SELECT actor_role FROM host_action_audit WHERE action = 'release_gallery'",
-        )
-        .fetch_one(&pool)
-        .await
-        .expect("role");
-        assert_eq!(role, UserRole::Host.as_str());
-        assert_ne!(
-            role,
-            format!("{:?}", UserRole::Host),
-            "the Debug spelling is not a wire format"
-        );
-    }
-
-    /// The case the columns exist for. `delete_account` hard-deletes the user row, so a name
-    /// resolved AFTER the fact would be NULL — the caller has to pass it in.
-    #[sqlx::test]
-    async fn a_name_supplied_by_the_caller_survives_the_row_being_deleted(pool: PgPool) {
-        let event_id = seed_event(&pool, "wedding").await;
-        let leaver = seed_user(&pool, event_id, "Abschied Anke").await;
-
-        // Exactly the order `me::delete_account` runs in: the row goes first, the audit row second.
-        sqlx::query("DELETE FROM \"user\" WHERE id = $1")
-            .bind(leaver)
-            .execute(&pool)
-            .await
-            .expect("delete user");
-
-        record(
-            &pool,
-            event_id,
-            leaver,
-            Some("Abschied Anke"),
-            UserRole::Guest,
-            "delete_account",
-            Some(leaver),
-            Some("Abschied Anke"),
-            None,
-        )
-        .await;
-
-        let (actor_name, target_name) = audit_row(&pool, "delete_account").await.expect("a row");
-        assert_eq!(
-            actor_name.as_deref(),
-            Some("Abschied Anke"),
-            "the audit row must name the deleted account — resolving it later is impossible"
-        );
-        assert_eq!(target_name.as_deref(), Some("Abschied Anke"));
-    }
-
-    /// And the failure mode that made this worth testing: with nothing supplied and nothing to look
-    /// up, the write must still succeed (an audit row must never fail an action) and carry NULLs.
-    #[sqlx::test]
-    async fn an_unresolvable_name_writes_the_row_anyway(pool: PgPool) {
-        let event_id = seed_event(&pool, "wedding").await;
-        let ghost = Uuid::new_v4();
-
-        record(
-            &pool,
-            event_id,
-            ghost,
-            None,
-            UserRole::Host,
-            "reset_pin",
-            Some(ghost),
-            None,
-            None,
-        )
-        .await;
-
-        let (actor_name, target_name) = audit_row(&pool, "reset_pin")
-            .await
-            .expect("the row must be written even when no name can be resolved");
-        assert_eq!(actor_name, None);
-        assert_eq!(target_name, None);
-    }
-}

backend/src/services/compression.rs

@@ -1,10 +1,9 @@
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
-use std::sync::atomic::{AtomicU64, Ordering};
 
 use anyhow::{Context, Result};
 use sqlx::PgPool;
-use tokio::sync::{Semaphore, broadcast};
+use tokio::sync::{broadcast, Semaphore};
 use uuid::Uuid;
 
 use crate::models::upload::Upload;
@@ -12,117 +11,41 @@ use crate::state::SseEvent;
 
 #[derive(Clone)]
 pub struct CompressionWorker {
-    semaphore: Arc<Semaphore>,
+    /// Separate permit pools for images and videos so a couple of slow/large
+    /// videos (each holding a permit across the full ffmpeg wait) can never
+    /// starve image-preview generation, and vice versa.
+    image_sem: Arc<Semaphore>,
+    video_sem: Arc<Semaphore>,
     pool: PgPool,
     media_path: PathBuf,
     sse_tx: broadcast::Sender<SseEvent>,
-    /// Bumped whenever the underlying data is reset out from under in-flight work (only the e2e
-    /// TRUNCATE does this today). A task captures the value at spawn and abandons itself if it has
-    /// changed by the time it runs — see `process`.
-    generation: Arc<AtomicU64>,
 }
 
 impl CompressionWorker {
     pub fn new(
         pool: PgPool,
         media_path: PathBuf,
-        concurrency: usize,
+        image_concurrency: usize,
+        video_concurrency: usize,
         sse_tx: broadcast::Sender<SseEvent>,
     ) -> Self {
         Self {
-            semaphore: Arc::new(Semaphore::new(concurrency)),
+            image_sem: Arc::new(Semaphore::new(image_concurrency)),
+            video_sem: Arc::new(Semaphore::new(video_concurrency)),
             pool,
             media_path,
             sse_tx,
-            generation: Arc::new(AtomicU64::new(0)),
         }
     }
 
-    /// Invalidate all in-flight and queued compression work. Called by the e2e TRUNCATE endpoint:
-    /// truncating deletes the upload rows and wipes `media/`, so a worker that was queued on the
-    /// semaphore when the wipe happened would otherwise wake in the NEXT test, fail to find its
-    /// file, and broadcast `upload-error` / `upload-deleted` into that test's live SSE stream —
-    /// corrupting any test that asserts on toasts or feed contents. Bumping the generation makes
-    /// those stale tasks return silently instead. A no-op in production (never called there).
-    pub fn bump_generation(&self) {
-        self.generation.fetch_add(1, Ordering::SeqCst);
-    }
-
-    /// How many times `do_process` is attempted before an upload is given up on. The
-    /// give-up path is user-visible (the photo disappears), so transient infrastructure
-    /// errors must not reach it.
-    const MAX_PROCESS_ATTEMPTS: u32 = 3;
-
-    /// Revision of the image-derivative pipeline. Bump this whenever a change makes existing
-    /// previews/displays wrong, so `backfill_stale_derivatives` regenerates them once on the
-    /// next start. Rev 1 = EXIF orientation is applied.
-    const DERIVATIVES_REV: i16 = 1;
-
-    /// How many times derivative generation may be ATTEMPTED for one upload before it is left
-    /// alone. Counted write-ahead and reset on success — see `Upload::begin_derivative_attempt`.
-    ///
-    /// This is what turns a fatal input from an outage into a blemish. The startup backfill
-    /// runs unconditionally on every boot, so before this bound a row whose processing killed
-    /// the process was re-selected and re-run forever, and `restart: unless-stopped` made that
-    /// an infinite loop that also dropped every SSE stream and truncated every in-flight
-    /// upload on each cycle. Three attempts absorbs genuinely transient infrastructure
-    /// failures (an ENOSPC spike, a pool blip) without ever becoming unbounded.
-    const MAX_DERIVATIVE_ATTEMPTS: i16 = 3;
-
-    /// Rows regenerated per boot. Bounds both the query and the amount of work a single start
-    /// can queue; whatever is left is picked up on the next boot.
-    const BACKFILL_BATCH: i64 = 200;
-
     /// Spawn a background task to process an uploaded file.
     pub fn process(&self, upload_id: Uuid, original_path: String, mime_type: String) {
         let worker = self.clone();
-        let born_at = worker.generation.load(Ordering::SeqCst);
         tokio::spawn(async move {
-            let _permit = worker.semaphore.acquire().await;
-            // The data this task was queued against may have been reset while it waited for a permit
-            // (e2e TRUNCATE). If so, its file and row are gone; doing anything — including
-            // broadcasting a failure — would leak into an unrelated test. Abandon quietly.
-            if worker.generation.load(Ordering::SeqCst) != born_at {
-                return;
-            }
-            // Retry before giving up. Most failures here are transient and self-clearing —
-            // an ENOSPC spike while several guests upload at once, a momentary DB-pool
-            // exhaustion, a panic inside the image codec — and the give-up path is
-            // user-visible data loss, so it is worth a few seconds to avoid entering it.
-            //
-            // But only for failures that CAN clear. An image that exceeds the decode budget,
-            // is corrupt, or is in an unsupported format fails identically on every attempt,
-            // so retrying it just burns 2s + 4s of backoff and writes three near-identical
-            // warnings before reaching the same conclusion. Give up on those immediately.
-            let mut attempt = 1u32;
-            let outcome = loop {
-                match worker
-                    // Charge the lifetime budget once per episode, on the first attempt only.
-                    .do_process(upload_id, &original_path, &mime_type, attempt == 1)
-                    .await
-                {
-                    Ok(v) => break Ok(v),
-                    Err(e)
-                        if attempt < Self::MAX_PROCESS_ATTEMPTS
-                            && !crate::services::imaging::is_permanent_image_error(&e)
-                            && !crate::services::imaging::is_storage_full_error(&e) =>
-                    {
-                        tracing::warn!(
-                            error = ?e, %upload_id, attempt,
-                            "compression attempt failed; retrying"
-                        );
-                        tokio::time::sleep(std::time::Duration::from_secs(2u64.pow(attempt))).await;
-                        attempt += 1;
-                        // The data may have been reset while we slept (e2e TRUNCATE).
-                        if worker.generation.load(Ordering::SeqCst) != born_at {
-                            return;
-                        }
-                    }
-                    Err(e) => break Err(e),
-                }
-            };
-
-            match outcome {
+            let is_video = mime_type.starts_with("video/");
+            let sem = if is_video { &worker.video_sem } else { &worker.image_sem };
+            let _permit = sem.acquire().await;
+            match worker.do_process(upload_id, &original_path, &mime_type).await {
                 Ok(_) => {
                     tracing::info!("compression completed for upload {upload_id}");
                     let _ = worker.sse_tx.send(SseEvent {
@@ -130,751 +53,172 @@ impl CompressionWorker {
                         data: serde_json::json!({ "upload_id": upload_id }).to_string(),
                     });
                 }
-                Err(e) if crate::services::imaging::is_storage_full_error(&e) => {
-                    // Out of disk. Keep the row AND the original — the opposite of the branch
-                    // below, and for the same reason it retains the file: nothing here is the
-                    // guest's fault and nothing about the photo is wrong.
-                    //
-                    // Soft-deleting on ENOSPC was strictly harmful. It refunded the quota while
-                    // keeping the bytes, so it freed nothing, removed the photo from the feed
-                    // seconds after a `201 Created`, and handed the guest the allowance to
-                    // upload it again into the same full disk. Leaving the row live costs
-                    // nothing instead: every client already falls back to the original when
-                    // `preview_url` and `thumbnail_url` are NULL, so the photo stays visible —
-                    // just uncompressed — and `backfill_stale_derivatives` regenerates the
-                    // derivatives on the next start, once there is room for them.
-                    tracing::error!(
-                        %upload_id,
-                        "compression failed: the media filesystem is out of space. The upload is \
-                         kept and served from its original; free disk space and restart to \
-                         regenerate derivatives: {e:#}"
-                    );
-                    let _ = Upload::set_compression_status(&worker.pool, upload_id, "failed").await;
-                    // Not an "error" event: nothing was lost and there is nothing for the guest
-                    // to act on. Clients treat this purely as "refetch me", which is what makes
-                    // the card appear with its original as the image source.
-                    let _ = worker.sse_tx.send(SseEvent {
-                        event_type: "upload-processed".to_string(),
-                        data: serde_json::json!({ "upload_id": upload_id }).to_string(),
-                    });
-                }
                 Err(e) => {
-                    tracing::error!(
-                        "compression failed for upload {upload_id} after {attempt} attempt(s): {e:#}"
-                    );
-                    // KEEP THE ROW. This used to soft-delete, which made a derivative failure
-                    // indistinguishable — to the guest — from their photo being deleted: they
-                    // got a `201 Created`, watched the card appear, and then watched it vanish.
-                    // The row left `v_feed`, `find_visible_media` and BOTH keepsake archives,
-                    // so the photo was gone from the product's core promise while its bytes sat
-                    // on disk for 14 days waiting for a `cleanup_deleted_media` that nothing
-                    // told anyone about. There is no host or admin screen listing compression
-                    // failures, so recovery meant hand-written SQL that also had to re-add the
-                    // refunded quota bytes. Against "0 lost uploads", that was silent per-photo
-                    // loss on any error the ENOSPC arm above doesn't catch — a HEIC that slipped
-                    // the allowlist, a truncated frame, an ffmpeg hiccup, a pool blip.
-                    //
-                    // This is exactly what the ENOSPC arm already does and documents as correct:
-                    // every client falls back to the original when `preview_url` and
-                    // `thumbnail_url` are NULL, so the photo stays visible and downloadable —
-                    // just uncompressed — and `backfill_stale_derivatives` retries it on the
-                    // next boot, now bounded by `derivative_attempts` so a poisoned row cannot
-                    // loop. The quota stays charged, which is correct: the bytes are still on
-                    // disk and still the guest's.
-                    let _ = Upload::set_compression_status(&worker.pool, upload_id, "failed").await;
-                    tracing::warn!(
-                        %upload_id,
-                        path = %worker.media_path.join(&original_path).display(),
-                        "derivatives failed; the upload is kept and served from its original"
-                    );
-                    // `upload-error` still fires so the uploader learns the photo will look
-                    // uncompressed. `upload-deleted` deliberately does NOT — nothing was
-                    // deleted, and evicting the card was the visible half of the data loss.
+                    // Log the detailed error (incl. paths) server-side only; the
+                    // SSE channel is broadcast to every client, so send a generic
+                    // message — never leak absolute filesystem paths.
+                    tracing::error!("compression failed for upload {upload_id}: {e:#}");
                     let _ = worker.sse_tx.send(SseEvent {
                         event_type: "upload-error".to_string(),
-                        data: serde_json::json!({ "upload_id": upload_id, "error": e.to_string() })
-                            .to_string(),
-                    });
-                    // Tell every client to refetch, so the card re-renders from the original
-                    // instead of sitting on a stale "processing" placeholder forever.
-                    let _ = worker.sse_tx.send(SseEvent {
-                        event_type: "upload-processed".to_string(),
-                        data: serde_json::json!({ "upload_id": upload_id }).to_string(),
+                        data: serde_json::json!({
+                            "upload_id": upload_id,
+                            "error": "Verarbeitung fehlgeschlagen."
+                        }).to_string(),
                     });
+                    let _ = Upload::set_compression_status(&worker.pool, upload_id, "failed").await;
                 }
             }
         });
     }
 
-    /// `charge_lifetime_attempt` is true only for the FIRST `do_process` of a given
-    /// `process()` call, so the two budgets stay independent.
-    ///
-    /// They were not. `MAX_PROCESS_ATTEMPTS` (in-request retries, 3) and
-    /// `MAX_DERIVATIVE_ATTEMPTS` (lifetime, 3) are equal, and every retry re-entered here and
-    /// charged the lifetime counter — so one request's three retries, six seconds apart,
-    /// exhausted the entire lifetime budget. A ten-second pool blip during the arrival burst
-    /// therefore stranded every photo whose worker was inside that window with no preview and no
-    /// display derivative, permanently, recoverable by nothing: the boot backfill re-selects them
-    /// and immediately gives up on the same exhausted counter.
-    ///
-    /// The two exist to bound different things — "this request is flapping" versus "this INPUT is
-    /// poison" — and only the second should survive across requests.
     async fn do_process(
         &self,
         upload_id: Uuid,
         original_path: &str,
         mime_type: &str,
-        charge_lifetime_attempt: bool,
     ) -> Result<()> {
         Upload::set_compression_status(&self.pool, upload_id, "processing").await?;
 
         let original = self.media_path.join(original_path);
 
         if mime_type.starts_with("image/") {
-            // Count the attempt BEFORE doing the work — see `begin_derivative_attempt`. If this
-            // input is the one that kills the container, this write is the only record that
-            // survives, and it is what stops the boot backfill replaying it forever. Charging on
-            // the first attempt preserves that: a container-killing input never reaches a second.
-            let charged = if charge_lifetime_attempt {
-                Upload::begin_derivative_attempt(&self.pool, upload_id).await?
-            } else {
-                // Already charged for this episode. Re-read the row only to notice it vanished.
-                Upload::derivative_attempts(&self.pool, upload_id).await?
-            };
-            match charged {
-                Some(attempts) if attempts > Self::MAX_DERIVATIVE_ATTEMPTS => {
-                    anyhow::bail!(
-                        "derivative generation gave up after {} attempt(s)",
-                        attempts - 1
-                    );
-                }
-                Some(_) => {}
-                // The row vanished while this task waited on the semaphore. Nothing to do, and
-                // reporting a failure would broadcast into a stream that no longer has a card.
-                None => return Ok(()),
-            }
-            let (preview_rel, display_rel) = self
-                .generate_image_derivatives(upload_id, &original, mime_type)
-                .await?;
+            let preview_rel = self.generate_image_preview(upload_id, &original, mime_type).await?;
             Upload::set_preview_path(&self.pool, upload_id, &preview_rel).await?;
-            Upload::set_display_path(&self.pool, upload_id, &display_rel).await?;
-            Upload::set_derivatives_rev(&self.pool, upload_id, Self::DERIVATIVES_REV).await?;
-            tracing::info!("preview + display generated for upload {upload_id}");
+            tracing::info!("preview generated for upload {upload_id}");
         } else if mime_type.starts_with("video/") {
-            // A missing poster must NOT fail the upload. `set_thumbnail_path` is only reached when
-            // a file really exists, so `thumbnail_path` stays NULL otherwise — which every consumer
-            // already handles (FeedListCard, VirtualFeed, LightboxModal are all null-safe).
-            //
-            // The `?` here used to hide the defect; making the check strict without also making
-            // this non-fatal would have been far worse than the bug. Every clip of a second or less
-            // would fail compression, exhaust its retries and be soft-deleted — a cosmetic defect
-            // turned into data loss, on exactly the mis-tap/Live-Photo clips guests produce most.
-            // Handling only the `Ok(None)` arm was not enough: the `?` on the call itself still
-            // routed every OTHER poster failure into the give-up path. `extract_poster_frame`
-            // returns `Err` when ffmpeg is missing from the image, when it hangs on a truncated
-            // `.mov` and trips FFMPEG_TIMEOUT, or when `thumbnails/` can't be created — and
-            // `set_thumbnail_path` returns `Err` on any DB blip. None of those say anything about
-            // the video itself, yet each one destroyed it. Confirmed live: on a box with no ffmpeg
-            // the spawn error propagated, exhausted all three attempts and soft-deleted the clip.
-            //
-            // Nothing about a video post depends on the poster — `get_original` serves the file
-            // byte-for-byte and the tile falls back to the video element — so no failure in this
-            // branch may fail the upload.
-            match self.generate_video_thumbnail(upload_id, &original).await {
-                Ok(Some(thumb_rel)) => {
-                    match Upload::set_thumbnail_path(&self.pool, upload_id, &thumb_rel).await {
-                        Ok(()) => tracing::info!("thumbnail generated for upload {upload_id}"),
-                        Err(e) => tracing::warn!(
-                            error = ?e, %upload_id,
-                            "poster extracted but could not be recorded; the video keeps its own tile"
-                        ),
-                    }
-                }
-                Ok(None) => {
-                    tracing::warn!(
-                        %upload_id,
-                        "no poster frame could be extracted; the video keeps its own tile"
-                    );
-                }
-                Err(e) => {
-                    tracing::warn!(
-                        error = ?e, %upload_id,
-                        "poster extraction failed; the video keeps its own tile"
-                    );
-                }
-            }
+            let thumb_rel = self.generate_video_thumbnail(upload_id, &original).await?;
+            Upload::set_thumbnail_path(&self.pool, upload_id, &thumb_rel).await?;
+            tracing::info!("thumbnail generated for upload {upload_id}");
         }
 
         Upload::set_compression_status(&self.pool, upload_id, "done").await?;
         Ok(())
     }
 
-    /// Longest edge of the big-screen "display" derivative used by the diashow. Sized to be
-    /// sharp on 1080p/4K while staying bounded (a ~2048px JPEG decodes to ~16 MB — trivial
-    /// for any kiosk, unlike a raw multi-thousand-pixel original).
-    const DISPLAY_MAX_EDGE: u32 = 2048;
-    /// Longest edge of the phone-feed "preview" (data-saver default).
-    const PREVIEW_MAX_EDGE: u32 = 800;
-
-    /// Above this pixel count the PNG original is stored as uploaded, unoptimised.
-    ///
-    /// oxipng's peak memory scales with PIXELS, not file size: it decodes the PNG itself and
-    /// then evaluates row filters, each trial holding a full-size buffer. That is why a 2.82
-    /// MiB file could measure 1250 MiB of peak RSS inside a 1 GiB container — smooth,
-    /// synthetic content compresses to almost nothing on disk while still being 8000x8000.
-    /// 8 MP covers every real phone photo; beyond it we decline the (lossless, cosmetic)
-    /// saving rather than risk the OOM kill.
-    const OXIPNG_MAX_PIXELS: u64 = 8_000_000;
-
-    /// Wall-clock ceiling for one oxipng run.
-    ///
-    /// Bounds TIME, NOT MEMORY — oxipng checks the deadline between trials, so a single trial
-    /// still allocates in full. The pixel gate above and the sequential build (see
-    /// `default-features = false` in Cargo.toml) are what bound memory. Do not treat this
-    /// constant as the OOM fix.
-    const OXIPNG_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(20);
-
-    /// Decode the image ONCE and emit both derivatives — the 800px `preview` (phone feed)
-    /// and the 2048px `display` (diashow). Returns `(preview_rel, display_rel)`.
-    async fn generate_image_derivatives(
+    async fn generate_image_preview(
         &self,
         upload_id: Uuid,
         original: &Path,
         mime_type: &str,
-    ) -> Result<(String, String)> {
+    ) -> Result<String> {
         let previews_dir = self.media_path.join("previews");
-        let displays_dir = self.media_path.join("displays");
         tokio::fs::create_dir_all(&previews_dir).await?;
-        tokio::fs::create_dir_all(&displays_dir).await?;
 
-        let filename = format!("{upload_id}.jpg");
-        let preview_path = previews_dir.join(&filename);
-        let display_path = displays_dir.join(&filename);
+        let preview_filename = format!("{upload_id}.jpg");
+        let preview_path = previews_dir.join(&preview_filename);
         let original = original.to_path_buf();
+        let preview_path_clone = preview_path.clone();
         let mime_owned = mime_type.to_string();
 
-        // Estimate the peak from the HEADER (no pixels decoded — the same kind of cheap probe
-        // the upload handler already does via `exceeds_decode_budget`) and, if this job is a
-        // giant, take the exclusive permit so it cannot overlap another giant. Held for the
-        // whole blocking section, released on drop including on error.
-        let estimate = crate::services::imaging::estimated_processing_peak_bytes(
-            &original,
-            Self::DISPLAY_MAX_EDGE,
-        );
-        let _heavy_permit = match estimate {
-            Some(bytes) if bytes > crate::services::imaging::HEAVY_IMAGE_BYTES => {
-                tracing::debug!(
-                    %upload_id,
-                    estimated_mib = bytes / (1024 * 1024),
-                    "waiting for the heavy-image permit"
+        // Run blocking image operations in a spawn_blocking task, bounded by a
+        // hard timeout (mirrors the ffmpeg guard) so a pathological decode can't
+        // hold the permit forever.
+        let handle = tokio::task::spawn_blocking(move || -> Result<()> {
+            use image::ImageReader;
+
+            // Reject decompression bombs *before* fully decoding: a small file can
+            // otherwise expand to enormous dimensions and a very expensive resize.
+            // 12000×12000 covers any real phone photo; max_alloc caps memory.
+            let mut reader = ImageReader::open(&original)
+                .context("failed to open image")?
+                .with_guessed_format()
+                .context("failed to read image header")?;
+            let mut limits = image::Limits::default();
+            limits.max_image_width = Some(12_000);
+            limits.max_image_height = Some(12_000);
+            limits.max_alloc = Some(256 * 1024 * 1024);
+            reader.limits(limits);
+            let img = reader.decode().context("failed to decode image")?;
+
+            // Resize to max 800px wide, preserving aspect ratio
+            let preview = img.resize(800, 800, image::imageops::FilterType::Lanczos3);
+            preview.save_with_format(&preview_path_clone, image::ImageFormat::Jpeg)
+                .context("failed to save preview")?;
+
+            // If the original is PNG, try lossless compression in-place
+            if mime_owned == "image/png" {
+                let opts = oxipng::Options::from_preset(2);
+                let _ = oxipng::optimize(
+                    &oxipng::InFile::Path(original),
+                    &oxipng::OutFile::Path {
+                        path: None,
+                        preserve_attrs: true,
+                    },
+                    &opts,
                 );
-                Some(
-                    crate::services::imaging::HEAVY_IMAGE_PERMITS
-                        .acquire()
-                        .await,
-                )
             }
-            _ => None,
-        };
 
-        // Run blocking image operations in a spawn_blocking task
-        tokio::task::spawn_blocking(move || {
-            write_image_derivatives(
-                upload_id,
-                &original,
-                &mime_owned,
-                &preview_path,
-                &display_path,
-            )
-        })
-        .await??;
-
-        Ok((
-            format!("previews/{filename}"),
-            format!("displays/{filename}"),
-        ))
-    }
-
-    /// Regenerate image derivatives that an older pipeline produced. Fire-and-forget from
-    /// startup; picks up two cases, both of which leave the ORIGINAL untouched:
-    ///
-    /// - uploads processed before the `display` derivative existed (preview but no
-    ///   `display_path`), and
-    /// - uploads whose derivatives predate `DERIVATIVES_REV` — currently rev 1, which applies
-    ///   the EXIF orientation. Everything generated before it is stored sideways for any
-    ///   portrait phone photo.
-    ///
-    /// Unlike the failure path in `process`, a backfill error is logged and skipped — it must
-    /// NEVER destroy or soft-delete an upload that already has a working preview.
-    ///
-    /// Bounded in three ways, all of them load-bearing on a box that restarts itself:
-    /// `derivative_attempts` stops a fatal row being replayed on every boot, `BACKFILL_BATCH`
-    /// stops one start queueing unbounded work, and the whole thing runs as ONE task walking
-    /// the rows sequentially rather than N tasks racing for the same semaphore.
-    pub async fn backfill_stale_derivatives(&self) {
-        // `original_path IS NOT NULL` was dead — the column is NOT NULL. What actually needs
-        // excluding is the blanked path `cleanup_deleted_media` leaves behind.
-        let rows = sqlx::query_as::<_, (Uuid, String, String)>(
-            "SELECT id, original_path, mime_type FROM upload
-             WHERE deleted_at IS NULL AND mime_type LIKE 'image/%'
-               AND original_path <> ''
-               AND derivative_attempts < $2
-               AND (
-                     (display_path IS NULL AND preview_path IS NOT NULL)
-                  OR derivatives_rev < $1
-               )
-             ORDER BY created_at DESC
-             LIMIT $3",
-        )
-        .bind(Self::DERIVATIVES_REV)
-        .bind(Self::MAX_DERIVATIVE_ATTEMPTS)
-        .bind(Self::BACKFILL_BATCH)
-        .fetch_all(&self.pool)
-        .await;
-        let rows = match rows {
-            Ok(r) => r,
-            Err(e) => {
-                tracing::warn!(error = ?e, "derivative backfill query failed");
-                return;
-            }
-        };
-
-        self.report_exhausted_derivatives().await;
-
-        if rows.is_empty() {
-            return;
-        }
-        tracing::info!("regenerating derivatives for {} upload(s)", rows.len());
-
-        // ONE task for the whole batch. The previous shape spawned a task per row, so a large
-        // backlog created thousands of live tasks that each held a pool handle and queued on
-        // the same two semaphore permits, competing with live uploads for the entire boot.
-        let worker = self.clone();
-        tokio::spawn(async move {
-            for (id, original_path, mime_type) in rows {
-                let _permit = worker.semaphore.acquire().await;
-                // Write-ahead, exactly as in the live path: if this row is the one that kills
-                // the process, this increment is the only thing that outlives the SIGKILL.
-                match Upload::begin_derivative_attempt(&worker.pool, id).await {
-                    Ok(Some(n)) if n > Self::MAX_DERIVATIVE_ATTEMPTS => continue,
-                    Ok(Some(_)) => {}
-                    Ok(None) => continue,
-                    Err(e) => {
-                        tracing::warn!(error = ?e, %id, "could not record a backfill attempt; skipping");
-                        continue;
-                    }
-                }
-                let original = worker.media_path.join(&original_path);
-                match worker
-                    .generate_image_derivatives(id, &original, &mime_type)
-                    .await
-                {
-                    Ok((preview_rel, display_rel)) => {
-                        let _ = Upload::set_preview_path(&worker.pool, id, &preview_rel).await;
-                        let _ = Upload::set_display_path(&worker.pool, id, &display_rel).await;
-                        // Clears derivative_attempts too, so a row that failed transiently is
-                        // not one boot closer to being abandoned.
-                        let _ =
-                            Upload::set_derivatives_rev(&worker.pool, id, Self::DERIVATIVES_REV)
-                                .await;
-                        tracing::info!("derivatives regenerated for upload {id}");
-                    }
-                    Err(e) => {
-                        // Leave the existing derivatives and the original intact; this row is
-                        // retried on the next start until its attempt budget runs out. The rev
-                        // stays behind, which is the marker that it still needs doing.
-                        tracing::warn!(error = ?e, %id, "derivative backfill failed; leaving as-is");
-                        let _ =
-                            Upload::record_derivative_failure(&worker.pool, id, &format!("{e:#}"))
-                                .await;
-                    }
-                }
-            }
+            Ok(())
         });
-    }
 
-    /// Re-extract poster frames for videos that never got one.
-    ///
-    /// A video interrupted by a restart is stranded: `startup_recovery` flips its
-    /// `compression_status` from `processing` to `failed` and nothing re-enqueues it, so
-    /// `thumbnail_path` stays NULL forever while the clip itself plays fine. The feed shows a
-    /// posterless tile for the rest of the event, and after
-    /// `FAILED_ORIGINAL_RETENTION_DAYS` the reclaim sweep is entitled to the original.
-    ///
-    /// Shares `derivative_attempts` with the image backfill on purpose. Note the consequence,
-    /// which is intended rather than a bug to fix later: `extract_poster_frame` returning
-    /// `Ok(false)` is a NORMAL, permanent outcome for a sub-second clip (Live Photos,
-    /// mis-taps), and since the counter is write-ahead and only cleared by a real success,
-    /// those clips stop being re-ffmpeg'd on every boot once the budget is spent.
-    pub async fn backfill_video_posters(&self) {
-        let rows = sqlx::query_as::<_, (Uuid, String)>(
-            "SELECT id, original_path FROM upload
-             WHERE deleted_at IS NULL AND mime_type LIKE 'video/%'
-               AND thumbnail_path IS NULL
-               AND original_path <> ''
-               AND derivative_attempts < $1
-             ORDER BY created_at DESC
-             LIMIT $2",
-        )
-        .bind(Self::MAX_DERIVATIVE_ATTEMPTS)
-        .bind(Self::BACKFILL_BATCH)
-        .fetch_all(&self.pool)
-        .await;
-        let rows = match rows {
-            Ok(r) => r,
-            Err(e) => {
-                tracing::warn!(error = ?e, "video poster backfill query failed");
-                return;
-            }
-        };
-        if rows.is_empty() {
-            return;
+        match tokio::time::timeout(std::time::Duration::from_secs(120), handle).await {
+            Ok(join) => join.context("image task panicked")??,
+            Err(_) => anyhow::bail!("image processing timeout after 120s"),
         }
-        tracing::info!("re-extracting posters for {} video(s)", rows.len());
 
-        let worker = self.clone();
-        tokio::spawn(async move {
-            for (id, original_path) in rows {
-                let _permit = worker.semaphore.acquire().await;
-                match Upload::begin_derivative_attempt(&worker.pool, id).await {
-                    Ok(Some(n)) if n > Self::MAX_DERIVATIVE_ATTEMPTS => continue,
-                    Ok(Some(_)) => {}
-                    Ok(None) => continue,
-                    Err(e) => {
-                        tracing::warn!(error = ?e, %id, "could not record a poster attempt; skipping");
-                        continue;
-                    }
-                }
-                let original = worker.media_path.join(&original_path);
-                match worker.generate_video_thumbnail(id, &original).await {
-                    Ok(Some(thumb_rel)) => {
-                        if Upload::set_thumbnail_path(&worker.pool, id, &thumb_rel)
-                            .await
-                            .is_ok()
-                        {
-                            // Clears the attempt counter: a video that eventually succeeded
-                            // must not carry a budget scar into a future pipeline revision.
-                            let _ = Upload::set_derivatives_rev(
-                                &worker.pool,
-                                id,
-                                Self::DERIVATIVES_REV,
-                            )
-                            .await;
-                            tracing::info!("poster regenerated for upload {id}");
-                        }
-                    }
-                    // No frame at all — normal for a very short clip. The tile stays
-                    // posterless and the attempt is spent, which is what stops the retry.
-                    Ok(None) => {
-                        tracing::debug!(%id, "still no poster frame; leaving the tile as-is");
-                    }
-                    Err(e) => {
-                        tracing::warn!(error = ?e, %id, "poster backfill failed; leaving as-is");
-                        let _ =
-                            Upload::record_derivative_failure(&worker.pool, id, &format!("{e:#}"))
-                                .await;
-                    }
-                }
-            }
-        });
+        Ok(format!("previews/{preview_filename}"))
     }
 
-    /// Say out loud, once per boot, that some uploads have stopped being retried.
-    ///
-    /// Without this the give-up is invisible: the loop stops (which is the point) but the
-    /// affected photos keep a stale or missing derivative forever with nothing to notice. The
-    /// originals are untouched, so this is recoverable once the cause is fixed — reset
-    /// `derivative_attempts` to 0 and restart.
-    async fn report_exhausted_derivatives(&self) {
-        let exhausted: Result<i64, _> = sqlx::query_scalar(
-            "SELECT count(*) FROM upload
-             WHERE deleted_at IS NULL AND mime_type LIKE 'image/%'
-               AND derivative_attempts >= $2
-               AND (
-                     (display_path IS NULL AND preview_path IS NOT NULL)
-                  OR derivatives_rev < $1
-               )",
-        )
-        .bind(Self::DERIVATIVES_REV)
-        .bind(Self::MAX_DERIVATIVE_ATTEMPTS)
-        .fetch_one(&self.pool)
-        .await;
-        if let Ok(count) = exhausted
-            && count > 0
-        {
-            tracing::error!(
-                count,
-                "{count} upload(s) exhausted derivative regeneration and will no longer be \
-                 retried; their originals are intact — see upload.derivative_last_error, fix \
-                 the cause, then reset derivative_attempts to 0 and restart"
-            );
-        }
-    }
-
-    /// Extract the feed poster for a video. `Ok(None)` when the clip yields no frame — see
-    /// [`crate::services::video::extract_poster_frame`], which owns the seek order, the timeout and
-    /// the artifact check that this function used to be missing.
     async fn generate_video_thumbnail(
         &self,
         upload_id: Uuid,
         original: &Path,
-    ) -> Result<Option<String>> {
+    ) -> Result<String> {
         let thumbs_dir = self.media_path.join("thumbnails");
         tokio::fs::create_dir_all(&thumbs_dir).await?;
 
         let thumb_filename = format!("{upload_id}.jpg");
         let thumb_path = thumbs_dir.join(&thumb_filename);
 
-        let produced =
-            crate::services::video::extract_poster_frame(original, &thumb_path, 800).await?;
+        // Hard timeout — a malformed video can hang `ffmpeg` indefinitely. Without a
+        // cap, the held compression-worker semaphore permit is never released and the
+        // pool eventually deadlocks (no further uploads ever processed). 120s is well
+        // above the time to extract one frame from any sane input.
+        let mut child = tokio::process::Command::new("ffmpeg")
+            .args([
+                "-i",
+                original.to_str().unwrap_or_default(),
+                "-vframes",
+                "1",
+                "-ss",
+                "00:00:01",
+                "-vf",
+                "scale=800:-1",
+                "-y",
+                thumb_path.to_str().unwrap_or_default(),
+            ])
+            .stdout(std::process::Stdio::piped())
+            .stderr(std::process::Stdio::piped())
+            .kill_on_drop(true)
+            .spawn()
+            .context("failed to spawn ffmpeg")?;
 
-        Ok(produced.then(|| format!("thumbnails/{thumb_filename}")))
-    }
-}
-
-/// The blocking half of [`CompressionWorker::generate_image_derivatives`]: decode once, write
-/// both derivatives, then optionally shrink a PNG original in place.
-///
-/// A free function rather than an inline closure so its memory behaviour is directly testable —
-/// this is the code path that OOM-killed the container, and the fix is a scoping property that a
-/// future edit could silently undo.
-fn write_image_derivatives(
-    upload_id: Uuid,
-    original: &Path,
-    mime_type: &str,
-    preview_path: &Path,
-    display_path: &Path,
-) -> Result<()> {
-    let preview_max = CompressionWorker::PREVIEW_MAX_EDGE;
-    let display_max = CompressionWorker::DISPLAY_MAX_EDGE;
-
-    // THE FULL-SIZE DECODE IS SCOPED TO THIS BLOCK ON PURPOSE, and the block yields the
-    // DISPLAY derivative rather than the original.
-    //
-    // `img` is up to 256 MiB (imaging::decode_limits max_alloc) and `resize` only BORROWS it,
-    // so it used to stay alive through both resizes AND the oxipng call below — which decodes
-    // the PNG a second time and holds a full-size buffer per filter trial. That measured
-    // ~1250 MiB of peak RSS for a 2.8 MiB input, inside a 1 GiB cgroup: the container was
-    // SIGKILLed, taking every SSE stream and every in-flight upload with it.
-    //
-    // A block rather than a bare `drop(img)` because a `drop` call is one careless edit away
-    // from being removed as redundant-looking — and note the `else` arm MOVES `img` out, which
-    // is what makes "the block's value is the only survivor" true in both arms.
-    let (display, width, height) = {
-        // Decompression-bomb limits + EXIF orientation, both in one place — see
-        // services::imaging for why neither may be skipped.
-        let img = crate::services::imaging::decode_oriented(original)?;
-        let (width, height) = (img.width(), img.height());
-
-        // Display: max 2048px for the diashow. Only DOWNSCALE — never upscale a smaller
-        // original (that adds bytes with no quality gain); re-encode it as JPEG as-is.
-        let display = if width > display_max || height > display_max {
-            img.resize(
-                display_max,
-                display_max,
-                image::imageops::FilterType::Lanczos3,
-            )
-        } else {
-            img
-        };
-        (display, width, height)
-    };
-
-    display
-        .save_with_format(display_path, image::ImageFormat::Jpeg)
-        .context("failed to save display")?;
-
-    // Preview: max 800px, derived from the DISPLAY, not from the original.
-    //
-    // Both derivatives used to resize the full-size decode independently, so a 8000x8000
-    // original paid for two full-size Lanczos passes and their intermediates — measured 520
-    // MiB peak even after the scoping fix above, which two concurrent workers cannot fit in a
-    // 1 GiB container. Chaining 8000 -> 2048 -> 800 makes the second pass operate on 2048px
-    // input, and the full-size buffer is already freed by the time it runs. Quality is not the
-    // trade-off here: a staged Lanczos3 downscale to 800px is visually indistinguishable from
-    // a single-step one (and is a standard technique for large ratios).
-    display
-        .resize(
-            preview_max,
-            preview_max,
-            image::imageops::FilterType::Lanczos3,
+        let status = match tokio::time::timeout(
+            std::time::Duration::from_secs(120),
+            child.wait(),
         )
-        .save_with_format(preview_path, image::ImageFormat::Jpeg)
-        .context("failed to save preview")?;
-    drop(display);
-
-    let pixels = u64::from(width) * u64::from(height);
-
-    // If the original is PNG, try lossless compression in place — but only when its pixel count
-    // is inside the budget, and never for longer than OXIPNG_TIMEOUT. This is a best-effort size
-    // saving: declining it costs disk, while attempting it unbounded cost the whole container.
-    if mime_type == "image/png" {
-        if pixels <= CompressionWorker::OXIPNG_MAX_PIXELS {
-            let mut opts = oxipng::Options::from_preset(2);
-            opts.timeout = Some(CompressionWorker::OXIPNG_TIMEOUT);
-            let _ = oxipng::optimize(
-                &oxipng::InFile::Path(original.to_path_buf()),
-                &oxipng::OutFile::Path {
-                    path: None,
-                    preserve_attrs: true,
-                },
-                &opts,
-            );
-        } else {
-            tracing::info!(
-                %upload_id, pixels,
-                "skipping oxipng: above the pixel budget; the original is stored as uploaded"
-            );
-        }
-    }
-
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// Peak resident set of THIS process, in bytes, from `/proc/self/status`.
-    fn peak_rss_bytes() -> u64 {
-        let status = std::fs::read_to_string("/proc/self/status").expect("procfs");
-        let line = status
-            .lines()
-            .find(|l| l.starts_with("VmHWM:"))
-            .expect("VmHWM");
-        let kb: u64 = line
-            .split_whitespace()
-            .nth(1)
-            .and_then(|v| v.parse().ok())
-            .expect("VmHWM value");
-        kb * 1024
-    }
-
-    /// Reset the kernel's peak-RSS watermark so the measurement covers only what follows.
-    /// Linux 4.0+; writing "5" to `clear_refs` resets `VmHWM` to the current RSS.
-    fn reset_peak_rss() {
-        let _ = std::fs::write("/proc/self/clear_refs", "5");
-    }
-
-    /// The pixel gate has to sit below what the axis limits allow, or it can never fire.
-    #[test]
-    fn the_oxipng_gate_is_reachable_within_the_decode_limits() {
-        const _: () = {
-            // imaging::decode_limits permits 12_000 x 12_000 = 144 MP. A gate above that would
-            // never skip anything.
-            assert!(CompressionWorker::OXIPNG_MAX_PIXELS < 12_000 * 12_000);
-            // ...and it must stay above a 48 MP camera, so real photos still get optimised.
-            assert!(CompressionWorker::OXIPNG_MAX_PIXELS >= 8_000_000);
-        };
-    }
-
-    /// The heavy-image gate has to classify the two cases the way the sizing assumed:
-    /// an ordinary phone photo must NOT serialise, and the giant must.
-    #[test]
-    fn the_heavy_gate_separates_a_phone_photo_from_a_giant() {
-        let dir = std::env::temp_dir().join(format!("es-heavy-{}", std::process::id()));
-        std::fs::create_dir_all(&dir).unwrap();
-
-        // 12 MP, the shape of a default phone capture.
-        let ordinary = dir.join("ordinary.jpg");
-        image::RgbImage::new(4032, 3024).save(&ordinary).unwrap();
-        let ordinary_peak = crate::services::imaging::estimated_processing_peak_bytes(
-            &ordinary,
-            CompressionWorker::DISPLAY_MAX_EDGE,
-        )
-        .expect("header readable");
-        assert!(
-            ordinary_peak <= crate::services::imaging::HEAVY_IMAGE_BYTES,
-            "a 12 MP photo estimated at {} MiB would serialise the common path",
-            ordinary_peak / 1048576
-        );
-
-        // The 64 MP RGBA case that measured ~516 MiB peak.
-        let giant = dir.join("giant.png");
-        image::RgbaImage::new(8000, 8000).save(&giant).unwrap();
-        let giant_peak = crate::services::imaging::estimated_processing_peak_bytes(
-            &giant,
-            CompressionWorker::DISPLAY_MAX_EDGE,
-        )
-        .expect("header readable");
-        assert!(
-            giant_peak > crate::services::imaging::HEAVY_IMAGE_BYTES,
-            "an 8000x8000 RGBA original estimated at only {} MiB would be allowed to run \
-             concurrently with another one — 2x its real ~516 MiB peak does not fit in 1 GiB",
-            giant_peak / 1048576
-        );
-        // The estimate must also be in the right ballpark, not merely on the right side of the
-        // threshold: 244 MiB decode + 262 MiB f32 resize intermediate.
-        assert!(
-            (400..700).contains(&(giant_peak / 1048576)),
-            "estimate {} MiB is far from the measured ~516 MiB peak",
-            giant_peak / 1048576
-        );
-
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    /// The OOM that took the container down, measured rather than argued.
-    ///
-    /// An 8000x8000 RGBA PNG passes admission: 256,000,000 bytes is just under the 256 MiB
-    /// `max_alloc`, and smooth content is a few MB on disk, far under any size cap. The old
-    /// code kept that ~244 MiB decode alive across an unbounded, multi-threaded oxipng run and
-    /// peaked at ~1250 MiB — inside a 1 GiB cgroup. Being SIGKILLed there is not a blip: the
-    /// row was already committed, so the boot backfill replayed the identical workload on every
-    /// restart.
-    ///
-    /// `#[ignore]` because it allocates ~250 MiB and takes a few seconds. Run explicitly:
-    ///   cargo test --release oom -- --ignored --nocapture --test-threads=1
-    /// It must run ALONE — `VmHWM` is per process, so a concurrent test would pollute it.
-    #[test]
-    #[ignore = "heavy: allocates ~250 MiB; run with --ignored --test-threads=1"]
-    fn a_large_png_stays_far_below_the_container_limit() {
-        const EDGE: u32 = 8_000;
-        let dir = std::env::temp_dir().join(format!("es-oom-{}", std::process::id()));
-        std::fs::create_dir_all(&dir).unwrap();
-        let original = dir.join("big.png");
-
-        // Smooth gradient: ~244 MiB decoded, a couple of MB on disk. That gap is the whole
-        // point — file size tells you nothing about what a PNG costs to process.
+        .await
         {
-            let mut buf = image::RgbaImage::new(EDGE, EDGE);
-            for (x, y, px) in buf.enumerate_pixels_mut() {
-                *px = image::Rgba([(x >> 5) as u8, (y >> 5) as u8, ((x + y) >> 6) as u8, 255]);
+            Ok(res) => res.context("ffmpeg wait failed")?,
+            Err(_) => {
+                let _ = child.kill().await;
+                anyhow::bail!("ffmpeg timeout after 120s");
             }
-            buf.save(&original).unwrap();
+        };
+
+        if !status.success() {
+            // Best-effort: drain stderr for the log.
+            let mut stderr = Vec::new();
+            if let Some(mut handle) = child.stderr.take() {
+                use tokio::io::AsyncReadExt;
+                let _ = handle.read_to_end(&mut stderr).await;
+            }
+            anyhow::bail!(
+                "ffmpeg failed: {}",
+                String::from_utf8_lossy(&stderr)
+            );
         }
 
-        // Everything above is fixture setup, not the code under test.
-        reset_peak_rss();
-        let before = peak_rss_bytes();
-
-        write_image_derivatives(
-            Uuid::new_v4(),
-            &original,
-            "image/png",
-            &dir.join("preview.jpg"),
-            &dir.join("display.jpg"),
-        )
-        .expect("derivatives");
-
-        let peak = peak_rss_bytes();
-        let on_disk = std::fs::metadata(&original).unwrap().len();
-        eprintln!(
-            "input {:.2} MiB on disk ({EDGE}x{EDGE}); peak RSS {:.0} MiB (was {:.0} MiB before)",
-            on_disk as f64 / 1048576.0,
-            peak as f64 / 1048576.0,
-            before as f64 / 1048576.0
-        );
-
-        assert!(dir.join("preview.jpg").exists() && dir.join("display.jpg").exists());
-        // The container gets 1 GiB and runs two of these concurrently. 600 MiB is a generous
-        // ceiling that the old code (~1250 MiB) could not have met.
-        assert!(
-            peak < 600 * 1024 * 1024,
-            "peak RSS {} MiB — the decode is being held across oxipng again, or the pixel \
-             gate stopped firing",
-            peak / 1048576
-        );
-        let _ = std::fs::remove_dir_all(&dir);
+        Ok(format!("thumbnails/{thumb_filename}"))
     }
 }

backend/src/services/config.rs

@@ -1,251 +1,49 @@
-//! Reads of the runtime-tunable `config` table, fronted by an in-memory cache.
+//! Reads of the runtime-tunable `config` table.
 //!
 //! Each handler used to keep a small local copy of these helpers; consolidating them
 //! here means one place to add a parser, one place to mock for tests, and one place to
 //! find when a key changes. New keys do not require code changes — they're picked up
-//! the next time the cache reloads.
-//!
-//! ## Why a cache
-//!
-//! The `config` table is effectively static during an event, yet it was the busiest
-//! query in the system: every request re-read each key with its own `SELECT`
-//! (an upload touched it ~8 times). Against the small connection pool that was the
-//! throughput ceiling. [`ConfigCache`] loads the whole table once and serves reads
-//! from memory.
-//!
-//! ## Consistency contract
-//!
-//! Correctness comes from **synchronous invalidation on every write**, not from the
-//! TTL. The two runtime write paths — the admin `PATCH /admin/config` handler and the
-//! test-mode truncate/reseed — both call [`ConfigCache::invalidate`] after committing,
-//! so the *next* read reloads from the DB and sees the new value immediately. The
-//! [`RELOAD_TTL`] is only a safety net for out-of-band changes (e.g. a migration or a
-//! manual DB edit); it is deliberately short but never the primary mechanism.
+//! the next time someone calls `get_*`.
 //!
 //! Values are read with a default fallback so the app still starts if a key is missing
 //! (e.g. during a migration window). Production seeds keys via migrations 005 and 009.
 
-use std::collections::HashMap;
-use std::sync::{Arc, RwLock};
-use std::time::{Duration, Instant};
-
 use sqlx::PgPool;
 
-/// How long a loaded snapshot is trusted before the next read reloads it. This is a
-/// backstop for out-of-band DB changes only — every in-process write invalidates the
-/// cache synchronously, so tests that PATCH-then-assert never depend on this expiring.
-const RELOAD_TTL: Duration = Duration::from_secs(30);
-
-struct Snapshot {
-    values: HashMap<String, String>,
-    loaded_at: Instant,
-}
-
-/// In-memory cache of the entire `config` table. Cheap to `clone` (shares the pool and
-/// the `Arc`), so it lives in `AppState` and every handler reads through it.
-#[derive(Clone)]
-pub struct ConfigCache {
-    pool: PgPool,
-    inner: Arc<RwLock<Option<Snapshot>>>,
-}
-
-impl ConfigCache {
-    pub fn new(pool: PgPool) -> Self {
-        Self {
-            pool,
-            inner: Arc::new(RwLock::new(None)),
-        }
-    }
-
-    /// Drop the cached snapshot so the next read reloads the whole table from the DB.
-    /// Call this after any write to the `config` table (admin PATCH, test reseed).
-    pub fn invalidate(&self) {
-        *self.inner.write().unwrap() = None;
-    }
-
-    /// Return the fresh snapshot if one is loaded and still within [`RELOAD_TTL`].
-    fn fresh_snapshot(&self) -> Option<HashMap<String, String>> {
-        let guard = self.inner.read().unwrap();
-        match guard.as_ref() {
-            Some(snap) if snap.loaded_at.elapsed() < RELOAD_TTL => Some(snap.values.clone()),
-            _ => None,
-        }
-    }
-
-    /// Read one key, loading the whole table into the cache on a miss/expiry. On a DB
-    /// error we return `None` (callers fall back to their default) without poisoning
-    /// the cache.
-    async fn get_raw(&self, key: &str) -> Option<String> {
-        if let Some(values) = self.fresh_snapshot() {
-            return values.get(key).cloned();
-        }
-
-        // Cache miss or stale — reload the entire table in one query.
-        let rows: Vec<(String, String)> = match sqlx::query_as::<_, (String, String)>(
-            "SELECT key, value FROM config",
-        )
-        .fetch_all(&self.pool)
+async fn fetch_raw(pool: &PgPool, key: &str) -> Option<String> {
+    sqlx::query_as::<_, (String,)>("SELECT value FROM config WHERE key = $1")
+        .bind(key)
+        .fetch_optional(pool)
         .await
-        {
-            Ok(rows) => rows,
-            Err(e) => {
-                tracing::warn!(error = ?e, "config reload failed; using defaults for this read");
-                return None;
-            }
-        };
-
-        let values: HashMap<String, String> = rows.into_iter().collect();
-        let result = values.get(key).cloned();
-        *self.inner.write().unwrap() = Some(Snapshot {
-            values,
-            loaded_at: Instant::now(),
-        });
-        result
-    }
+        .ok()
+        .flatten()
+        .map(|(v,)| v)
 }
 
-pub async fn get_str(cache: &ConfigCache, key: &str, default: &str) -> String {
-    cache
-        .get_raw(key)
-        .await
-        .unwrap_or_else(|| default.to_string())
+pub async fn get_str(pool: &PgPool, key: &str, default: &str) -> String {
+    fetch_raw(pool, key).await.unwrap_or_else(|| default.to_string())
 }
 
-pub async fn get_i64(cache: &ConfigCache, key: &str, default: i64) -> i64 {
-    cache
-        .get_raw(key)
-        .await
-        .and_then(|v| v.parse().ok())
-        .unwrap_or(default)
+pub async fn get_i64(pool: &PgPool, key: &str, default: i64) -> i64 {
+    fetch_raw(pool, key).await.and_then(|v| v.parse().ok()).unwrap_or(default)
 }
 
-pub async fn get_usize(cache: &ConfigCache, key: &str, default: usize) -> usize {
-    cache
-        .get_raw(key)
-        .await
-        .and_then(|v| v.parse().ok())
-        .unwrap_or(default)
+pub async fn get_usize(pool: &PgPool, key: &str, default: usize) -> usize {
+    fetch_raw(pool, key).await.and_then(|v| v.parse().ok()).unwrap_or(default)
 }
 
-pub async fn get_f64(cache: &ConfigCache, key: &str, default: f64) -> f64 {
-    cache
-        .get_raw(key)
-        .await
-        .and_then(|v| v.parse().ok())
-        .unwrap_or(default)
+pub async fn get_f64(pool: &PgPool, key: &str, default: f64) -> f64 {
+    fetch_raw(pool, key).await.and_then(|v| v.parse().ok()).unwrap_or(default)
 }
 
 /// Parses common truthy spellings used by both the migration seeds and the admin form.
 /// Accepts `true/false`, `1/0`, `yes/no`, `on/off` — case-insensitive. Anything else
 /// returns `default`.
-pub async fn get_bool(cache: &ConfigCache, key: &str, default: bool) -> bool {
-    let Some(raw) = cache.get_raw(key).await else {
-        return default;
-    };
+pub async fn get_bool(pool: &PgPool, key: &str, default: bool) -> bool {
+    let Some(raw) = fetch_raw(pool, key).await else { return default };
     match raw.trim().to_ascii_lowercase().as_str() {
         "true" | "1" | "yes" | "on" => true,
         "false" | "0" | "no" | "off" => false,
         _ => default,
     }
 }
-
-#[cfg(test)]
-mod seed_tests {
-    /// The value a fresh database actually ends up with for `key`, by replaying the migrations.
-    ///
-    /// This exists because a `config::get_*` default is only a fallback for a MISSING key, and the
-    /// migrations seed nearly every key there is. So the literal in the handler is dead code on any
-    /// real install, and changing it changes nothing — which is exactly what happened to
-    /// `join_ip_rate_per_min`: it was raised 60 → 300 in `auth/handlers.rs` to stop one QR-code
-    /// burst from locking the venue out of `/join`, shipped, and did nothing at all, because
-    /// migration 017 seeds 60 and the seed wins. Nothing in the test suite could see it: the e2e
-    /// regression guard fires 12 concurrent joins, which is green at 60 and at 300 alike.
-    fn effective_seed(key: &str) -> Option<String> {
-        let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("migrations");
-        let mut files: Vec<_> = std::fs::read_dir(&dir)
-            .expect("migrations directory")
-            .filter_map(|e| e.ok().map(|e| e.path()))
-            .filter(|p| p.to_string_lossy().ends_with(".up.sql"))
-            .collect();
-        // Version order: migrations are applied in filename order and later ones override.
-        files.sort();
-
-        let mut value: Option<String> = None;
-        for path in files {
-            let sql = std::fs::read_to_string(&path).expect("readable migration");
-            for line in sql.lines() {
-                let line = line.trim();
-                if line.starts_with("--") {
-                    continue;
-                }
-                // Seed form:  ('key', 'value')
-                if let Some(rest) = line.strip_prefix(&format!("('{key}',"))
-                    && let Some(v) = rest.split('\'').nth(1)
-                {
-                    value = Some(v.to_string());
-                }
-                // Update form: UPDATE config SET value = 'new' WHERE key = 'key' AND value = 'old'
-                if line.starts_with("UPDATE config SET value")
-                    && line.contains(&format!("key = '{key}'"))
-                    && let Some(new) = line.split('\'').nth(1)
-                {
-                    let scoped_to = line
-                        .rsplit_once("AND value = '")
-                        .and_then(|(_, tail)| tail.split('\'').next().map(|s| s.to_string()));
-                    // Only applies if the current value still matches the scope it was written for.
-                    if scoped_to.is_none() || scoped_to.as_deref() == value.as_deref() {
-                        value = Some(new.to_string());
-                    }
-                }
-            }
-        }
-        value
-    }
-
-    /// The invariant, not the number: `join_ip:{ip}` is keyed on an address the WHOLE VENUE shares
-    /// behind NAT, and `/join` is the one screen with no auto-retry. A ceiling near the size of the
-    /// party is a ceiling on the party. Asserted against the effective seed rather than the code
-    /// default precisely because the code default is what silently did not apply.
-    #[test]
-    fn the_join_ceiling_a_real_install_gets_is_sized_for_a_whole_venue_arriving_at_once() {
-        let seeded = effective_seed("join_ip_rate_per_min")
-            .expect("join_ip_rate_per_min must be seeded by a migration");
-        let seeded: usize = seeded.parse().expect("numeric");
-        assert!(
-            seeded >= 300,
-            "a fresh database ends up with join_ip_rate_per_min = {seeded}. Every guest shares one \
-             NAT address, so this is the ceiling for the entire party scanning one QR code. Raise \
-             it with a value-scoped UPDATE migration (see 030) — changing the default in \
-             auth/handlers.rs does nothing, because the seed wins."
-        );
-    }
-
-    /// Pins the other half of the same trap: the seeded value must not exceed the ceiling the
-    /// handler clamps to, or an operator reading `GET /admin/config` sees a number that is not the
-    /// one being enforced.
-    #[test]
-    fn the_seeded_recover_name_ceiling_is_within_what_the_handler_will_honour() {
-        let seeded = effective_seed("recover_name_rate_per_15min")
-            .expect("recover_name_rate_per_15min must be seeded by a migration");
-        let seeded: usize = seeded.parse().expect("numeric");
-        assert!(
-            seeded <= crate::auth::handlers::RECOVER_NAME_CEILING_MAX,
-            "seeded recover_name_rate_per_15min = {seeded} exceeds RECOVER_NAME_CEILING_MAX = {}; \
-             the handler clamps at the point of use, so the advertised value would be a lie.",
-            crate::auth::handlers::RECOVER_NAME_CEILING_MAX
-        );
-    }
-
-    /// The parser itself, against a value migration 015 really does change. Without this a bug in
-    /// `effective_seed` makes both tests above vacuously green.
-    #[test]
-    fn the_seed_parser_follows_a_value_through_a_later_update_migration() {
-        assert_eq!(
-            effective_seed("upload_rate_per_hour").as_deref(),
-            Some("100"),
-            "005 seeds 10 and 015 raises it to 100; reading 10 here means the UPDATE form is not \
-             being applied, and every assertion built on this helper is worthless."
-        );
-        assert_eq!(effective_seed("no_such_key_anywhere"), None);
-    }
-}

backend/src/services/disk.rs

@@ -1,169 +0,0 @@
-//! Cached view of the filesystem backing the media directory.
-//!
-//! Free/total disk space is needed on two hot paths — the per-user storage quota
-//! (checked on every upload *and* every `GET /me/quota` poll) and the admin stats
-//! endpoint. Reading it means `sysinfo::Disks::new_with_refreshed_list()`, which stats
-//! every mounted filesystem; doing that per request is wasteful for a number that
-//! barely moves. [`DiskCache`] refreshes it at most once per [`TTL`] and serves the
-//! rest from memory.
-
-use std::path::{Path, PathBuf};
-use std::sync::{Arc, RwLock};
-use std::time::{Duration, Instant};
-
-/// How long a disk reading is trusted before the next call re-stats the filesystem.
-const TTL: Duration = Duration::from_secs(15);
-
-#[derive(Clone, Copy)]
-pub struct DiskInfo {
-    pub total: u64,
-    pub free: u64,
-}
-
-/// Cheap-to-clone cache of the media filesystem's total/free bytes. Lives in
-/// `AppState`.
-#[derive(Clone)]
-pub struct DiskCache {
-    inner: Arc<RwLock<Option<(PathBuf, DiskInfo, Instant)>>>,
-}
-
-impl DiskCache {
-    pub fn new() -> Self {
-        Self {
-            inner: Arc::new(RwLock::new(None)),
-        }
-    }
-
-    /// Drop the cached reading so the next `snapshot()` re-measures the filesystem.
-    ///
-    /// Used by the e2e TRUNCATE endpoint. Truncating deletes every uploaded file, which materially
-    /// changes free space — but the cached reading survives for up to the TTL, so the next test can
-    /// compute a quota from the PREVIOUS test's disk. That matters now that the quota tests steer
-    /// the per-user limit off `free_disk_bytes`: a stale reading makes the limit wrong and the test
-    /// flaky, for reasons that have nothing to do with the code under test.
-    pub fn invalidate(&self) {
-        *self.inner.write().unwrap() = None;
-    }
-
-    /// Cached `(total, free)` bytes for the filesystem that holds `media_path`.
-    ///
-    /// Returns `None` when the mount can't be resolved — callers MUST treat that as
-    /// "unknown", never "zero free". (The quota path in particular fails *open* on
-    /// `None`: enforcing a 0-byte limit would lock every user out of uploading.)
-    /// Cached free-space reading for `path`.
-    ///
-    /// The cache is keyed BY PATH. It used to hold a single slot and ignore its argument on a hit,
-    /// so it would happily return the media volume's numbers for any other path within the TTL.
-    /// That was invisible only because every caller happened to pass `media_path` — the first
-    /// caller to ask about a different volume (e.g. the exports volume, which is a separate mount)
-    /// would have silently got the wrong filesystem's free space.
-    pub fn snapshot(&self, path: &Path) -> Option<DiskInfo> {
-        if let Some((cached_path, info, at)) = self.inner.read().unwrap().as_ref()
-            && cached_path == path
-            && at.elapsed() < TTL
-        {
-            return Some(*info);
-        }
-        let info = read_disk_for_path(path)?;
-        *self.inner.write().unwrap() = Some((path.to_path_buf(), info, Instant::now()));
-        Some(info)
-    }
-}
-
-impl Default for DiskCache {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-/// UNCACHED free-space reading for the filesystem backing `path`.
-///
-/// Deliberately bypasses [`DiskCache`]. The cache exists for the quota poll, where a 15s-stale
-/// number is fine because it is only ever advisory. The export preflight is the opposite case: it
-/// decides whether to start writing a multi-GB archive, and the sibling export worker running
-/// concurrently can move free space by tens of gigabytes well inside the TTL. A stale reading there
-/// would authorise exactly the write that fills the disk.
-pub fn free_bytes(path: &Path) -> Option<u64> {
-    read_disk_for_path(path).map(|d| d.free)
-}
-
-/// Resolve the filesystem backing `media_path` and read its total/free bytes.
-///
-/// Snapshots the mount table via `sysinfo`, then delegates the selection to the pure
-/// [`select_disk`] so the (fiddly, edge-case-prone) matching logic is unit-testable
-/// without touching the real filesystem.
-fn read_disk_for_path(media_path: &Path) -> Option<DiskInfo> {
-    let disks = sysinfo::Disks::new_with_refreshed_list();
-    let mounts: Vec<(String, u64, u64)> = disks
-        .iter()
-        .map(|d| {
-            (
-                d.mount_point().to_string_lossy().to_string(),
-                d.total_space(),
-                d.available_space(),
-            )
-        })
-        .collect();
-    select_disk(&mounts, &media_path.to_string_lossy())
-}
-
-/// Pick the filesystem for `media_path` from a `(mount_point, total, free)` table.
-///
-/// Chooses the **longest** mount point that is a prefix of `media_path` (the most
-/// specific filesystem) rather than the first match — otherwise the root `/` mount,
-/// which prefixes every absolute path, could shadow a dedicated `/media` volume. Falls
-/// back to `/` when nothing prefixes the path (e.g. a relative media path), and to
-/// `None` when even that is absent — the caller treats `None` as "unknown" and fails
-/// open on quota.
-fn select_disk(mounts: &[(String, u64, u64)], media_path: &str) -> Option<DiskInfo> {
-    mounts
-        .iter()
-        .filter(|(mp, _, _)| media_path.starts_with(mp.as_str()))
-        .max_by_key(|(mp, _, _)| mp.len())
-        .or_else(|| mounts.iter().find(|(mp, _, _)| mp == "/"))
-        .map(|(_, total, free)| DiskInfo {
-            total: *total,
-            free: *free,
-        })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::select_disk;
-
-    #[test]
-    fn picks_longest_matching_mount() {
-        // Both "/" and "/media" prefix the path; the dedicated volume must win.
-        let mounts = vec![("/".to_string(), 100, 40), ("/media".to_string(), 200, 150)];
-        let d = select_disk(&mounts, "/media/originals/x.jpg").unwrap();
-        assert_eq!((d.total, d.free), (200, 150));
-    }
-
-    #[test]
-    fn falls_back_to_root_when_no_specific_mount_matches() {
-        let mounts = vec![("/".to_string(), 100, 40), ("/media".to_string(), 200, 150)];
-        // "/var/lib" is only prefixed by "/".
-        let d = select_disk(&mounts, "/var/lib/data").unwrap();
-        assert_eq!((d.total, d.free), (100, 40));
-    }
-
-    #[test]
-    fn relative_path_uses_root_fallback() {
-        let mounts = vec![("/".to_string(), 100, 40)];
-        // A relative path prefixes nothing, so the explicit "/" fallback applies.
-        let d = select_disk(&mounts, "media/originals").unwrap();
-        assert_eq!((d.total, d.free), (100, 40));
-    }
-
-    #[test]
-    fn none_when_no_mount_matches_and_no_root() {
-        // No "/" present and nothing prefixes the relative path → unknown (fail-open).
-        let mounts = vec![("/data".to_string(), 100, 40)];
-        assert!(select_disk(&mounts, "relative/path").is_none());
-    }
-
-    #[test]
-    fn none_on_empty_mount_table() {
-        assert!(select_disk(&[], "/media/x").is_none());
-    }
-}

backend/src/services/imaging.rs

@@ -1,388 +0,0 @@
-//! Shared image decoding.
-//!
-//! Exists so there is exactly ONE way to turn a file on disk into a `DynamicImage` in this
-//! codebase. Two properties have to hold everywhere an image is decoded, and both were
-//! previously re-derived per call site — which is how they drifted apart:
-//!
-//! - **EXIF orientation must be applied.** Phones do not rotate sensor data; they record how
-//!   the camera was held in a tag and store the pixels as shot. `image::open` and
-//!   `ImageReader::decode` both hand back the raw pixels and ignore that tag, and re-encoding
-//!   to JPEG writes no EXIF, so the derivative is permanently sideways while the untouched
-//!   original still renders upright. The compression worker was fixed; the export worker was
-//!   not, so every portrait photo came out sideways in the keepsake's HTML viewer.
-//! - **Decode limits must be set.** The upload body cap bounds the file on disk, but a small
-//!   file can decode to enormous dimensions (a ~1 MB image expanding to 50k×50k px), OOM-ing
-//!   the box. `image::open` applies NO limits at all, so the export path was also decoding
-//!   arbitrary user-supplied images unbounded.
-
-use anyhow::{Context, Result};
-use image::{DynamicImage, ImageDecoder};
-use std::path::Path;
-
-/// Bounds for any decode of user-supplied image data. The per-axis cap covers any real phone
-/// photo; `max_alloc` bounds the decoded buffer — but only because `decode_oriented` reserves
-/// against it explicitly, see there.
-///
-/// Sized against the deployment: the app container is capped at 1 GiB and the compression
-/// worker runs `compression_concurrency` decodes at once (default 2), so 256 MiB per decode
-/// leaves headroom for the resize buffers and the runtime.
-fn decode_limits() -> image::Limits {
-    let mut limits = image::Limits::default();
-    limits.max_image_width = Some(12_000);
-    limits.max_image_height = Some(12_000);
-    limits.max_alloc = Some(256 * 1024 * 1024);
-    limits
-}
-
-/// True when re-running the exact same work on the exact same bytes cannot possibly
-/// succeed, so retrying only burns wall-clock and log noise.
-///
-/// Deliberately narrow. Only the `ImageError` variants that are a property of the *input*
-/// count: the file will not shrink, gain codec support, or un-corrupt itself between
-/// attempts. `IoError` is excluded on purpose — EMFILE under load, or a momentarily
-/// unreadable file, is exactly the transient case the retry exists for. A FULL disk is the
-/// one io error that must not be retried either, but for a different reason and with a
-/// different remedy; see [`is_storage_full_error`].
-pub fn is_permanent_image_error(err: &anyhow::Error) -> bool {
-    err.chain().any(|cause| {
-        matches!(
-            cause.downcast_ref::<image::ImageError>(),
-            Some(
-                image::ImageError::Limits(_)
-                    | image::ImageError::Unsupported(_)
-                    | image::ImageError::Decoding(_)
-            )
-        )
-    })
-}
-
-/// True when the failure is the media filesystem being out of space.
-///
-/// Deliberately separate from [`is_permanent_image_error`], which is about the *input*. ENOSPC
-/// is about the *host*, and it is the one failure the retry loop actively makes worse: a disk
-/// does not drain during six seconds of backoff, so all three attempts fail identically while
-/// holding a compression permit that photos are queued behind.
-///
-/// The give-up path it fed was worse still. It refunded the guest's quota and soft-deleted the
-/// row while deliberately RETAINING the original — so the bytes stayed on the full disk, the
-/// photo vanished from the feed seconds after a `201 Created`, and the guest was handed back
-/// the quota to upload it again into the same full disk. Each round shrank free space further.
-pub fn is_storage_full_error(err: &anyhow::Error) -> bool {
-    fn is_full(io: &std::io::Error) -> bool {
-        // `StorageFull` is the portable classification; the raw ENOSPC catches the paths where
-        // the OS error was never mapped to a named kind.
-        io.kind() == std::io::ErrorKind::StorageFull || io.raw_os_error() == Some(28)
-    }
-    err.chain().any(|cause| {
-        // `image` wraps the io error in its own variant rather than exposing it as a source,
-        // so the plain downcast alone would miss every derivative-write failure.
-        cause.downcast_ref::<std::io::Error>().is_some_and(is_full)
-            || matches!(
-                cause.downcast_ref::<image::ImageError>(),
-                Some(image::ImageError::IoError(io)) if is_full(io)
-            )
-    })
-}
-
-/// Build a decoder for `path` with the budget enforced, WITHOUT reading any pixels.
-///
-/// Single source of truth for "may this image be decoded at all": both the upload
-/// admission check and the compression worker go through here, so they cannot disagree
-/// about what is acceptable.
-fn decoder_within_budget(path: &Path) -> Result<impl image::ImageDecoder> {
-    let mut reader = image::ImageReader::open(path)
-        .context("failed to open image")?
-        .with_guessed_format()
-        .context("failed to read image header")?;
-    let mut limits = decode_limits();
-    reader.limits(limits.clone());
-
-    // We need `into_decoder` rather than `decode()` to read the EXIF orientation tag before
-    // the pixels are consumed. But the two are NOT equivalent on safety: `decode()` performs
-    //
-    //     limits.reserve(decoder.total_bytes())?;
-    //
-    // between building the decoder and reading the image, and `into_decoder()` skips it (the
-    // crate's own FIXME concedes `from_decoder` doesn't compensate). Nothing else enforces
-    // `max_alloc` — the JPEG decoder's `set_limits` only checks support and dimensions — so
-    // without the line below the budget is inert and the ONLY bound is the per-axis cap. That
-    // leaves 12000x12000 decodable at 412 MiB, and two concurrent at 824 MiB against a 1 GiB
-    // container. Re-add it, exactly as `decode()` does.
-    let mut decoder = reader.into_decoder().context("failed to decode image")?;
-    limits
-        .reserve(decoder.total_bytes())
-        .context("image too large to decode within the memory budget")?;
-    decoder
-        .set_limits(limits)
-        .context("image too large to decode within the memory budget")?;
-    Ok(decoder)
-}
-
-/// Rough peak heap an image will cost to turn into derivatives, read from the HEADER only —
-/// no pixels are decoded. `None` when the header can't be read or the image is over budget
-/// (the caller is about to fail on it anyway).
-///
-/// Two terms, and the second is the one that surprises:
-///
-/// - the decoded buffer, `width * height * channels`; and
-/// - the resize intermediate. `image`'s Lanczos3 path accumulates in `f32`, so the buffer
-///   between the horizontal and vertical passes is `new_width * old_height * 4 channels * 4
-///   bytes` — 16 bytes per pixel-row-slot, not the 4 the output uses. For an 8000x8000
-///   original that is 262 MiB on top of a 244 MiB decode, measured. It is bigger than the
-///   decode for any tall image, which is why "the decode is bounded by max_alloc" was never
-///   the whole story.
-///
-/// Used to decide whether an image is heavy enough to need exclusive use of the box's memory
-/// headroom, NOT to reject anything.
-pub fn estimated_processing_peak_bytes(path: &Path, display_edge: u32) -> Option<u64> {
-    let decoder = decoder_within_budget(path).ok()?;
-    let (width, height) = decoder.dimensions();
-    let decoded = decoder.total_bytes();
-
-    // Aspect-preserving fit into `display_edge`, matching DynamicImage::resize. No downscale
-    // means no intermediate at all.
-    let intermediate = if width > display_edge || height > display_edge {
-        let ratio = f64::from(display_edge) / f64::from(width.max(height));
-        let new_width = (f64::from(width) * ratio).round().max(1.0) as u64;
-        new_width * u64::from(height) * 16
-    } else {
-        0
-    };
-
-    Some(decoded.saturating_add(intermediate))
-}
-
-/// Megapixels an image would decode to, or `None` if its header can't be read. Used only
-/// to put a concrete number in the message the guest sees.
-pub fn megapixels(path: &Path) -> Option<f64> {
-    let reader = image::ImageReader::open(path)
-        .ok()?
-        .with_guessed_format()
-        .ok()?;
-    let (w, h) = reader.into_dimensions().ok()?;
-    Some(f64::from(w) * f64::from(h) / 1_000_000.0)
-}
-
-/// True when an image cannot be decoded specifically because it would exceed the memory
-/// budget — read from the header, no pixels touched.
-///
-/// Called at upload admission so a guest who sends a 100 MP photo is told at the door, with
-/// a reason they can act on, instead of the upload being accepted with a 201 and then
-/// silently soft-deleted minutes later when the worker gives up on it.
-///
-/// Deliberately narrow: ONLY the budget. A corrupt, truncated or unsupported file also
-/// fails to build a decoder, but rejecting those here would change a contract the
-/// adversarial suite pins on purpose — acceptance follows the magic bytes, and a payload
-/// with a valid JPEG header is accepted regardless of what follows it. Those go to the
-/// compression worker as before, which handles them gracefully and (since the retry
-/// classifier) no longer burns backoff on them.
-pub fn exceeds_decode_budget(path: &Path) -> bool {
-    match decoder_within_budget(path) {
-        Ok(_) => false,
-        Err(e) => e.chain().any(|cause| {
-            matches!(
-                cause.downcast_ref::<image::ImageError>(),
-                Some(image::ImageError::Limits(_))
-            )
-        }),
-    }
-}
-
-/// Decode an image from disk with decompression-bomb limits applied and its EXIF
-/// orientation baked into the pixels.
-///
-/// Blocking — call inside `spawn_blocking`.
-pub fn decode_oriented(path: &Path) -> Result<DynamicImage> {
-    let mut decoder = decoder_within_budget(path)?;
-
-    // Cheap, and it happens BEFORE any pixels are read: an oversized image costs a header
-    // parse, not an allocation.
-    let orientation = decoder
-        .orientation()
-        .unwrap_or(image::metadata::Orientation::NoTransforms);
-    let mut img = DynamicImage::from_decoder(decoder).context("failed to decode image")?;
-    img.apply_orientation(orientation);
-    Ok(img)
-}
-
-/// Process-wide serialisation for memory-heavy image work.
-///
-/// The `app` container gets 1 GiB. A single 8000x8000 original measures ~516 MiB peak even with
-/// the decode correctly scoped, so two overlapping giants is an OOM kill — and the kernel kills
-/// the whole process, dropping every SSE stream and stranding every in-flight upload.
-///
-/// GLOBAL rather than a field on `CompressionWorker`, because the constraint is the container's
-/// memory and there is more than one producer of this work. The export's own image path
-/// (`services::export`) decodes and resizes every photo in the gallery — a thumbnail for each,
-/// plus a 2000px re-encode for every original over 5 MB — and it ran in a bare `spawn_blocking`
-/// with no permit at all. So "host taps Freigeben while the last phone photos are still
-/// compressing" put an export decode and a heavy compression job in the same cgroup at the same
-/// time, which is the scenario the permit exists to make impossible. Worse, it is self-repeating:
-/// the OOM kill marks the export failed, and `recover_exports` re-spawns it on boot into the same
-/// conditions.
-///
-/// Held across the blocking section and released on drop, including on error.
-pub static HEAVY_IMAGE_PERMITS: std::sync::LazyLock<tokio::sync::Semaphore> =
-    std::sync::LazyLock::new(|| tokio::sync::Semaphore::new(1));
-
-/// Estimated peak heap above which a job must take [`HEAVY_IMAGE_PERMITS`].
-///
-/// 150 MiB sits far above a normal phone photo (a 12 MP JPEG costs ~50 MiB all-in) so the common
-/// path never serialises, and far below the point where two jobs stop fitting in the container.
-pub const HEAVY_IMAGE_BYTES: u64 = 150 * 1024 * 1024;
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// Shared with the e2e suite rather than duplicating 568 KiB of binary: the same file
-    /// drives `02-upload/oversized-image` so both layers assert on one artefact.
-    const HUGE: &str = concat!(
-        env!("CARGO_MANIFEST_DIR"),
-        "/../e2e/fixtures/media/huge-99mp.jpg"
-    );
-
-    #[test]
-    fn rejects_an_image_that_would_blow_the_allocation_budget() {
-        // 11000x9000 = 99 MP. Deliberately UNDER the 12000px per-axis cap, so the axis check
-        // cannot reject it — the allocation budget is the only thing that can, which is
-        // exactly what makes this a regression test rather than a restatement of the axis cap.
-        // 283 MiB decoded as RGB8 against a 256 MiB budget, from 568 KiB on disk.
-        //
-        // This failed before the guard was restored: `ImageReader::decode` performs
-        // `limits.reserve(decoder.total_bytes())`, and `into_decoder()` — which we need for
-        // the EXIF tag — skips it, so `max_alloc` was inert and this decoded happily.
-        // Map the Ok arm to its dimensions first: on failure `expect_err` Debug-prints the
-        // value, and Debug on a DynamicImage dumps every pixel — 283 MiB of output.
-        let err = decode_oriented(Path::new(HUGE))
-            .map(|img| (img.width(), img.height()))
-            .expect_err("a 99 MP image must be refused, not allocated");
-        let msg = format!("{err:#}");
-        assert!(
-            msg.to_lowercase().contains("limit") || msg.to_lowercase().contains("memory"),
-            "expected a limits error, got: {msg}"
-        );
-    }
-
-    #[test]
-    fn an_oversized_image_is_a_permanent_failure() {
-        // The retry loop must not burn 2s + 4s of backoff on this: the file will not shrink
-        // between attempts, so all three attempts reach the identical conclusion.
-        let err = decode_oriented(Path::new(HUGE))
-            .map(|img| (img.width(), img.height()))
-            .expect_err("fixture must exceed the budget");
-        assert!(
-            is_permanent_image_error(&err),
-            "a Limits error can never succeed on retry: {err:#}"
-        );
-    }
-
-    #[test]
-    fn a_plain_io_error_is_not_permanent() {
-        // The mirror that keeps the classifier honest. EMFILE under load, or a momentary
-        // unreadable file, is exactly what the retry exists for — misclassifying those as
-        // permanent would turn a transient blip back into the data loss round 1 fixed.
-        // (A FULL disk is its own case now; see the storage-full tests below.)
-        let err = decode_oriented(Path::new("/nonexistent/definitely-not-here.jpg"))
-            .map(|img| (img.width(), img.height()))
-            .expect_err("a missing file must error");
-        assert!(
-            !is_permanent_image_error(&err),
-            "an IO error must stay retryable: {err:#}"
-        );
-    }
-
-    #[test]
-    fn a_full_disk_is_recognised_through_both_wrappers() {
-        // The two shapes ENOSPC actually arrives in. A bare io::Error is what `tokio::fs` and
-        // `std::fs` produce; the `image` crate wraps its own in `ImageError::IoError`, which is
-        // NOT reachable via `source()` — so a chain walk that only downcast to io::Error would
-        // miss every derivative-write failure, i.e. the exact case this classifier exists for.
-        let bare = anyhow::Error::from(std::io::Error::from(std::io::ErrorKind::StorageFull))
-            .context("failed to write the preview");
-        assert!(is_storage_full_error(&bare), "bare io::Error: {bare:#}");
-
-        let wrapped = anyhow::Error::from(image::ImageError::IoError(std::io::Error::from(
-            std::io::ErrorKind::StorageFull,
-        )))
-        .context("failed to save the display derivative");
-        assert!(
-            is_storage_full_error(&wrapped),
-            "ImageError::IoError: {wrapped:#}"
-        );
-    }
-
-    #[test]
-    fn an_ordinary_io_error_is_not_a_full_disk() {
-        // Keeps the classifier from swallowing the general case: only ENOSPC may skip the retry
-        // and take the keep-the-row branch. Anything else must still be retried and, if it keeps
-        // failing, soft-deleted as before.
-        let missing = decode_oriented(Path::new("/nonexistent/definitely-not-here.jpg"))
-            .map(|img| (img.width(), img.height()))
-            .expect_err("a missing file must error");
-        assert!(
-            !is_storage_full_error(&missing),
-            "a missing file is not a full disk: {missing:#}"
-        );
-    }
-
-    #[test]
-    fn admission_rejects_only_the_over_budget_case() {
-        // Admission and processing must agree about SIZE — a photo accepted at the door and
-        // then rejected by the worker for being too big is the failure this pair prevents.
-        assert!(
-            exceeds_decode_budget(Path::new(HUGE)),
-            "admission must reject what the decoder rejects for size"
-        );
-        let ordinary = concat!(
-            env!("CARGO_MANIFEST_DIR"),
-            "/../e2e/fixtures/media/portrait-exif6.jpg"
-        );
-        assert!(
-            !exceeds_decode_budget(Path::new(ordinary)),
-            "admission must accept an ordinary photo"
-        );
-    }
-
-    #[test]
-    fn admission_does_not_reject_a_merely_undecodable_file() {
-        // The narrowing that keeps the adversarial contract intact: a payload with valid
-        // JPEG magic bytes and nothing behind them cannot be decoded, but acceptance follows
-        // the magic bytes by design (07-adversarial/file-upload-attacks). It is the worker's
-        // job to fail it, not admission's — admission is only the resource guard.
-        let dir = std::env::temp_dir().join("eventsnap-imaging-test");
-        std::fs::create_dir_all(&dir).expect("tmp dir");
-        let stub = dir.join("magic-only.jpg");
-        let mut bytes = vec![0u8; 1024];
-        bytes[..3].copy_from_slice(&[0xFF, 0xD8, 0xFF]);
-        std::fs::write(&stub, &bytes).expect("write stub");
-
-        assert!(
-            !exceeds_decode_budget(&stub),
-            "a corrupt file is not an over-budget file"
-        );
-        assert!(
-            decode_oriented(&stub)
-                .map(|i| (i.width(), i.height()))
-                .is_err(),
-            "...but it must still fail in the worker"
-        );
-        let _ = std::fs::remove_file(&stub);
-    }
-
-    #[test]
-    fn still_decodes_an_ordinary_photo_and_applies_orientation() {
-        // The guard must not have become a blanket refusal. This fixture is 40x20 stored with
-        // EXIF Orientation=6, so a correct decode returns it rotated to 20x40 portrait.
-        let path = concat!(
-            env!("CARGO_MANIFEST_DIR"),
-            "/../e2e/fixtures/media/portrait-exif6.jpg"
-        );
-        let img = decode_oriented(Path::new(path)).expect("an ordinary photo must decode");
-        assert_eq!(
-            (img.width(), img.height()),
-            (20, 40),
-            "EXIF orientation must still be applied after restoring the guard"
-        );
-    }
-}

backend/src/services/jobs.rs

@@ -0,0 +1,73 @@
+//! Shared shape for long-running background work.
+//!
+//! Today's [`compression`](crate::services::compression) and [`export`](crate::services::export)
+//! pipelines each implement their own progress + SSE plumbing. They could converge on the
+//! trait sketched here so future jobs (analytics, archival, ...) plug into one progress
+//! pipeline.
+//!
+//! This module is intentionally a *sketch*: the existing services are not yet wired to
+//! it. The aim is to (a) document the convention so new jobs follow it, (b) make the
+//! refactor mechanical when someone is ready to do it. See `docs/IDEAS.md` —
+//! "Maintainability principles" — for the rationale.
+//!
+//! Example of an eventual implementor:
+//!
+//! ```ignore
+//! struct ZipExport { event_id: Uuid, /* … */ }
+//!
+//! impl BackgroundJob for ZipExport {
+//!     fn name(&self) -> &'static str { "zip-export" }
+//!     async fn run(self, ctx: JobContext) -> Result<()> {
+//!         for (i, item) in items.iter().enumerate() {
+//!             ctx.report(percent(i, items.len())).await?;
+//!             // … write to zip …
+//!         }
+//!         Ok(())
+//!     }
+//! }
+//! ```
+
+use anyhow::Result;
+
+/// Handle handed to a running job: reports progress and emits SSE events.
+///
+/// Wraps the existing SSE broadcaster and an optional `export_job` row. Implementors
+/// don't need to know about `state.sse_tx` directly — they call [`JobContext::report`]
+/// and get the same effect.
+pub struct JobContext {
+    pub job_id: Option<uuid::Uuid>,
+    pub event_kind: &'static str,
+    pub sse_tx: tokio::sync::broadcast::Sender<crate::state::SseEvent>,
+    pub pool: sqlx::PgPool,
+}
+
+impl JobContext {
+    /// Update progress (0..=100) and broadcast an SSE tick. Cheap to call often —
+    /// rate-limit at the call site if a job emits at > 10 Hz.
+    pub async fn report(&self, percent: u8) -> Result<()> {
+        if let Some(job_id) = self.job_id {
+            sqlx::query("UPDATE export_job SET progress_pct = $1 WHERE id = $2")
+                .bind(percent as i16)
+                .bind(job_id)
+                .execute(&self.pool)
+                .await?;
+        }
+        let _ = self.sse_tx.send(crate::state::SseEvent::new(
+            self.event_kind,
+            serde_json::json!({ "progress_pct": percent }).to_string(),
+        ));
+        Ok(())
+    }
+}
+
+/// One unit of work that publishes progress through a [`JobContext`].
+///
+/// `run` consumes `self`; spawn with `tokio::spawn` at the caller. Errors propagate;
+/// the caller is responsible for mapping them to `export_job.error_message` or
+/// equivalent. Implementors stay small — the trait deliberately has no `cancel`
+/// or `pause`; we have not needed those yet.
+#[allow(async_fn_in_trait)]
+pub trait BackgroundJob: Send + 'static {
+    fn name(&self) -> &'static str;
+    async fn run(self, ctx: JobContext) -> Result<()>;
+}

backend/src/services/maintenance.rs

@@ -9,11 +9,9 @@
 //!    users staring at a spinner. Resetting them on startup recovers gracefully.
 //!
 //! 2. **Periodic tasks** — pruning that should happen "every hour" rather than per
-//!    request: expired sessions (otherwise the table grows unboundedly), the
+//!    request: expired sessions (otherwise the table grows unboundedly), and the
 //!    rate-limiter's in-memory windows (so keys for IPs that left long ago don't
-//!    accumulate), and the media of soft-deleted uploads — both the ones whose compression
-//!    permanently failed and the ones a guest or host deliberately removed — which are
-//!    retained for a recovery window and then reclaimed.
+//!    accumulate).
 
 use std::path::PathBuf;
 use std::time::Duration;
@@ -23,42 +21,6 @@ use sqlx::PgPool;
 use crate::services::rate_limiter::RateLimiter;
 use crate::services::sse_tickets::SseTicketStore;
 
-/// How long a permanently-failed upload's original is kept on disk before it is
-/// reclaimed.
-///
-/// The compression worker stops deleting originals on failure — a transient error must
-/// never destroy the guest's only copy of a photo they can't retake. But the row is
-/// soft-deleted and the uploader's quota IS refunded, so without a sweep those bytes are
-/// invisible, unowned, and free: a reproducible codec failure lets one guest accumulate
-/// orphans at no personal cost, and because `active_uploaders` counts only users with
-/// non-deleted uploads, dropping out of that count actually RAISES everyone's per-user
-/// ceiling while the disk gets fuller.
-///
-/// Two weeks is comfortably longer than any single event, so an operator investigating a
-/// failed upload still has the file, while the leak stays bounded.
-const FAILED_ORIGINAL_RETENTION_DAYS: i64 = 14;
-
-/// How long a DELIBERATELY deleted upload's files are kept before they are reclaimed.
-///
-/// The same leak, reached by the ordinary path rather than the exceptional one.
-/// `soft_delete_in_event` stamps `deleted_at` and refunds `total_upload_bytes`, but nothing ever
-/// removed the bytes — so the quota stopped bounding the disk. Upload 500 MB, delete, quota is back
-/// to zero, upload another 500 MB: not an attack, just a guest curating their camera roll, which is
-/// what people do. The host then sees guests hitting "Du hast dein Upload-Limit erreicht" while the
-/// admin widget shows a disk full of files no upload row points at, and the quota message is
-/// actively misleading because the space really is gone — just not to anyone the accounting can
-/// name.
-///
-/// Much shorter than the failure window on purpose. Fourteen days outlives the whole event, so a
-/// deliberate delete would never reclaim anything while it mattered. A day still gives an operator
-/// a recovery window for a mis-tap.
-///
-/// NOTE what this does NOT do: within the window the bytes are still spent and still unaccounted,
-/// so a guest deleting and re-uploading through an eight-hour event can outrun the sweep. Bounding
-/// that would mean holding the quota until the file is actually reclaimed rather than refunding at
-/// `deleted_at` — a deliberate trade, and the reason the low-disk warning exists.
-const DELETED_UPLOAD_RETENTION_HOURS: i64 = 24;
-
 /// Reset rows left in flight by a previous crashed instance. Run once on startup,
 /// before the HTTP server starts taking requests, so users never observe the
 /// half-state.
@@ -83,23 +45,8 @@ pub async fn startup_recovery(pool: &PgPool) {
         Err(e) => tracing::error!("startup recovery: failed to sweep uploads: {e:#}"),
     }
 
-    // Export jobs interrupted mid-run are marked 'failed' here so they aren't left
-    // 'running' forever. The host CANNOT re-trigger a released export (release_gallery
-    // rejects an already-released event), so `export::recover_exports` re-spawns these
-    // failed-but-released jobs from `main` once `AppState` exists (it needs the media
-    // paths + SSE sender this fn doesn't have).
-    //
-    // SINGLE-INSTANCE ASSUMPTION: this sweep is unscoped — it reaps every `running` row, not just
-    // this process's. That is correct for the supported deployment (one app container; see
-    // docker-compose.yml), where no other process can own a job at boot. If EventSnap is ever run
-    // with more than one replica, a booting replica would mark a peer's live workers `failed`.
-    // This is NOT merely wasteful — do not assume the epoch model contains it. Recovery re-arms the
-    // job at the SAME epoch, so the reaped-but-still-alive worker and the fresh one would BOTH hold
-    // that epoch; the guards carry no owner/lease token, so they share the same artifact paths and
-    // either can win the other's `finalize_job`. That can corrupt or delete the keepsake. Running
-    // more than one replica therefore requires an owner/lease/heartbeat on export_job first. That
-    // machinery is not worth building for a single-container app — so this is a documented
-    // CONSTRAINT, not a hidden assumption: do not scale this service horizontally as-is.
+    // Export jobs interrupted mid-run. Mark 'failed' so the host can re-trigger.
+    // The `UNIQUE(event_id, type)` constraint would otherwise block re-release.
     match sqlx::query(
         "UPDATE export_job
          SET status = 'failed',
@@ -120,19 +67,6 @@ pub async fn startup_recovery(pool: &PgPool) {
     }
 }
 
-/// How long a file in `originals/` may exist without a database row before it is treated as
-/// abandoned.
-///
-/// This window is the ONLY thing making the sweep safe, because the upload handler renames the
-/// temp file into its final path BEFORE committing the row: for a short moment a perfectly
-/// healthy upload legitimately looks exactly like an orphan. Six hours is far beyond any live
-/// request (a 576 MiB body over a bad venue uplink is minutes, and the request itself is bounded
-/// by the reverse proxy) while still reclaiming the leak inside a single event.
-///
-/// DO NOT SHORTEN THIS to make a test faster — a value below the longest possible in-flight
-/// upload deletes photos out from under the request that is committing them.
-const ORPHAN_UPLOAD_RETENTION_HOURS: u64 = 6;
-
 /// Spawns a background task that periodically:
 /// - deletes session rows whose `expires_at` is more than a day in the past
 /// - prunes the in-memory rate-limiter HashMap of empty windows
@@ -145,247 +79,22 @@ pub fn spawn_periodic_tasks(
     sse_tickets: SseTicketStore,
     media_path: PathBuf,
 ) {
-    // Supervised, because this one task carries EVERY piece of recurring hygiene in the app:
-    // session pruning, media reclamation, the orphan-temp sweep, and the rate-limiter and
-    // SSE-ticket maps. As a bare `tokio::spawn` with no retained handle, a single panic anywhere
-    // inside it stopped all five permanently and silently — no log line, no symptom until the
-    // disk or a HashMap grew into one. The supervisor re-spawns and, just as importantly, says
-    // so; it can never spin hot because the inner loop only returns by dying.
     tokio::spawn(async move {
+        let mut tick = tokio::time::interval(Duration::from_secs(3600));
+        // Fire the first tick immediately, then hourly.
+        tick.tick().await;
         loop {
-            let inner = tokio::spawn(periodic_loop(
-                pool.clone(),
-                rate_limiter.clone(),
-                sse_tickets.clone(),
-                media_path.clone(),
-            ));
-            match inner.await {
-                Ok(()) => tracing::error!("periodic maintenance loop returned; restarting it"),
-                Err(e) => {
-                    tracing::error!(error = ?e, "periodic maintenance task died; restarting it")
-                }
-            }
-            tokio::time::sleep(Duration::from_secs(60)).await;
+            tick.tick().await;
+            cleanup_sessions(&pool).await;
+            rate_limiter.prune();
+            sse_tickets.prune();
+            // Reclaim disk for uploads soft-deleted more than the grace period
+            // ago, and hard-delete those rows (FKs cascade).
+            crate::services::media_fs::reap_deleted(&pool, &media_path).await;
         }
     });
 }
 
-/// The actual hygiene loop. Never returns in normal operation — see the supervisor above.
-async fn periodic_loop(
-    pool: PgPool,
-    rate_limiter: RateLimiter,
-    sse_tickets: SseTicketStore,
-    media_path: PathBuf,
-) {
-    // A crash left whatever the previous process was mid-upload behind, and the first periodic
-    // tick is an hour away — sweep once up front so a restart is also a cleanup.
-    sweep_orphan_upload_temps(&media_path).await;
-
-    let mut tick = tokio::time::interval(Duration::from_secs(3600));
-    // Fire the first tick immediately, then hourly.
-    tick.tick().await;
-    loop {
-        tick.tick().await;
-        cleanup_sessions(&pool).await;
-        cleanup_deleted_media(&pool, &media_path).await;
-        sweep_orphan_upload_temps(&media_path).await;
-        // Runs AFTER the .tmp sweep, and covers the class that one structurally cannot see:
-        // an original that was renamed to its final name but whose transaction never
-        // committed. Those have no row, so `cleanup_deleted_media` (row-driven) can never
-        // find them, and `sweep_orphan_upload_temps` skips them because they no longer end
-        // in `.tmp` — they were permanently unowned, silently shrinking the free disk that
-        // `compute_storage_quota` divides among guests.
-        sweep_orphan_originals(&pool, &media_path).await;
-        rate_limiter.prune();
-        sse_tickets.prune();
-    }
-}
-
-/// How long an upload's `.tmp` file must have been untouched before it is treated as abandoned.
-///
-/// This is an age on the MODIFICATION time, not on creation, and that is what makes an hour
-/// safe rather than reckless: a live upload is being written to continuously, so its mtime keeps
-/// advancing and it can never age into the sweep no matter how slow the connection. The clock
-/// only starts once the writer stops — i.e. once the upload is genuinely dead.
-const ORPHAN_TEMP_MAX_AGE: Duration = Duration::from_secs(3600);
-
-/// Reclaim `.tmp` files left in the media tree by uploads that never finished.
-///
-/// `stream_field_to_file` removes its temp file on every error return, which covers everything
-/// the handler can see. It cannot cover the case that actually happens at a party: the client
-/// simply goes away — a phone sleeps, a guest walks out of range, the PWA is evicted mid-video —
-/// and axum DROPS the handler future rather than returning an error, so no cleanup code runs at
-/// all. The shutdown backstop force-exits in-flight handlers for the same net effect.
-///
-/// Nothing else reclaims these. `cleanup_deleted_media` only visits rows with `deleted_at`, and
-/// an abandoned upload never got a row; `export::sweep_orphan_temps` is only ever pointed at the
-/// exports volume. So before this, every abandonment stranded up to `max_video_size_mb` of
-/// unowned bytes permanently — and worse than merely leaking, they were subtracted from what
-/// everyone else could upload, because the per-user quota is computed from live free disk
-/// (`compute_storage_quota`). On a 40 GB disk shared with `postgres_data`, an evening of flaky
-/// venue wifi could take the event down.
-async fn sweep_orphan_upload_temps(media_path: &std::path::Path) {
-    let originals = media_path.join("originals");
-    let mut event_dirs = match tokio::fs::read_dir(&originals).await {
-        Ok(d) => d,
-        // Absent before the first upload — not a problem worth logging every hour.
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return,
-        Err(e) => {
-            tracing::warn!(error = ?e, path = %originals.display(), "orphan temp sweep: unreadable");
-            return;
-        }
-    };
-
-    let mut reclaimed = 0usize;
-    let mut bytes = 0u64;
-    while let Ok(Some(event_dir)) = event_dirs.next_entry().await {
-        let Ok(mut files) = tokio::fs::read_dir(event_dir.path()).await else {
-            continue;
-        };
-        while let Ok(Some(file)) = files.next_entry().await {
-            let path = file.path();
-            if path.extension().is_none_or(|e| e != "tmp") {
-                continue;
-            }
-            let Ok(meta) = file.metadata().await else {
-                continue;
-            };
-            // No mtime (or a clock that moved backwards) means we cannot show the file is
-            // abandoned, and deleting a live upload is far worse than leaking one temp file.
-            let abandoned = meta
-                .modified()
-                .ok()
-                .and_then(|m| m.elapsed().ok())
-                .is_some_and(|age| age >= ORPHAN_TEMP_MAX_AGE);
-            if !abandoned {
-                continue;
-            }
-            match tokio::fs::remove_file(&path).await {
-                Ok(()) => {
-                    reclaimed += 1;
-                    bytes += meta.len();
-                }
-                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-                Err(e) => {
-                    tracing::warn!(error = ?e, path = %path.display(),
-                        "orphan temp sweep: could not reclaim")
-                }
-            }
-        }
-    }
-
-    if reclaimed > 0 {
-        tracing::info!(
-            "orphan temp sweep: reclaimed {reclaimed} abandoned upload temp file(s), {} MiB",
-            bytes / (1024 * 1024)
-        );
-    }
-}
-
-/// Reclaim the media of soft-deleted uploads once they are past their retention window.
-///
-/// ONLY ever touches rows with `deleted_at IS NOT NULL`, so it can never reach a live upload. Two
-/// classes, two windows, because the two deletes mean different things:
-///
-/// - a compression failure the guest didn't ask for and may want investigated —
-///   [`FAILED_ORIGINAL_RETENTION_DAYS`];
-/// - a deliberate removal by the guest or the host — [`DELETED_UPLOAD_RETENTION_HOURS`].
-///
-/// ALL FOUR paths are reclaimed, not just the original. The previous version cleared
-/// `original_path` alone, which was right for its only case (a failed compression produces no
-/// derivatives) but wrong the moment the sweep reaches a successfully processed upload: preview,
-/// display and thumbnail are each a separate file on disk, none of them counted in
-/// `original_size_bytes`, and nothing else ever removed them.
-///
-/// Every column is cleared in the same pass, which makes the sweep idempotent and stops a later run
-/// re-reporting files that are already gone. The ROW is kept: it is the audit trail, it costs a few
-/// hundred bytes, and `backfill_stale_derivatives` is guarded on `deleted_at IS NULL` so a nulled
-/// `preview_path` can never make it regenerate what was just reclaimed.
-async fn cleanup_deleted_media(pool: &PgPool, media_path: &std::path::Path) {
-    type Row = (
-        uuid::Uuid,
-        String,
-        Option<String>,
-        Option<String>,
-        Option<String>,
-    );
-    let rows = sqlx::query_as::<_, Row>(
-        "SELECT id, original_path, preview_path, display_path, thumbnail_path FROM upload
-         WHERE deleted_at IS NOT NULL
-           AND CASE WHEN compression_status = 'failed'
-                    THEN deleted_at < NOW() - ($1 || ' days')::interval
-                    ELSE deleted_at < NOW() - ($2 || ' hours')::interval
-               END
-           AND (original_path <> '' OR preview_path IS NOT NULL
-                OR display_path IS NOT NULL OR thumbnail_path IS NOT NULL)",
-    )
-    .bind(FAILED_ORIGINAL_RETENTION_DAYS.to_string())
-    .bind(DELETED_UPLOAD_RETENTION_HOURS.to_string())
-    .fetch_all(pool)
-    .await;
-
-    let rows = match rows {
-        Ok(r) => r,
-        Err(e) => {
-            tracing::warn!(error = ?e, "deleted-media sweep query failed");
-            return;
-        }
-    };
-    if rows.is_empty() {
-        return;
-    }
-
-    let mut reclaimed = 0usize;
-    for (id, original, preview, display, thumbnail) in rows {
-        let paths: Vec<String> = std::iter::once(original)
-            .filter(|p| !p.is_empty())
-            .chain([preview, display, thumbnail].into_iter().flatten())
-            .collect();
-
-        // All-or-nothing per row: the columns are only cleared once every file for that upload is
-        // gone. Clearing after a partial success would strand the survivors with nothing pointing
-        // at them — the same unowned-bytes state this sweep exists to drain.
-        let mut all_gone = true;
-        for rel in &paths {
-            let absolute = media_path.join(rel);
-            match tokio::fs::remove_file(&absolute).await {
-                Ok(()) => reclaimed += 1,
-                // Already gone (manual cleanup, restored backup) — still counts as reclaimed for
-                // the purpose of clearing the columns, or the row is re-selected every hour forever.
-                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-                Err(e) => {
-                    tracing::warn!(error = ?e, %id, path = %absolute.display(),
-                        "could not reclaim deleted media; leaving the row for the next sweep");
-                    all_gone = false;
-                }
-            }
-        }
-        if !all_gone {
-            continue;
-        }
-
-        if let Err(e) = sqlx::query(
-            "UPDATE upload SET original_path = '', preview_path = NULL,
-                    display_path = NULL, thumbnail_path = NULL
-             WHERE id = $1",
-        )
-        .bind(id)
-        .execute(pool)
-        .await
-        {
-            tracing::warn!(error = ?e, %id, "reclaimed the files but could not clear the paths");
-        }
-    }
-
-    if reclaimed > 0 {
-        tracing::info!(
-            "reclaimed {reclaimed} file(s) from soft-deleted uploads (deliberate deletes after \
-             {DELETED_UPLOAD_RETENTION_HOURS}h, compression failures after \
-             {FAILED_ORIGINAL_RETENTION_DAYS}d)"
-        );
-    }
-}
-
 async fn cleanup_sessions(pool: &PgPool) {
     match sqlx::query("DELETE FROM session WHERE expires_at < NOW() - INTERVAL '1 day'")
         .execute(pool)
@@ -398,198 +107,3 @@ async fn cleanup_sessions(pool: &PgPool) {
         Err(e) => tracing::warn!("session cleanup failed: {e:#}"),
     }
 }
-
-/// Reclaim files in `originals/` that no upload row references.
-///
-/// The backstop behind [`TempFileGuard`](crate::handlers::upload). The guard covers the
-/// process that is running; this covers the process that was killed — a SIGKILL, an OOM, or a
-/// power cut leaves whatever bytes had been written with no `Drop` to reclaim them, and those
-/// files are then permanently invisible: they have no row, so `cleanup_deleted_media` (which is
-/// row-driven) can never see them, and they are not counted against any quota while still
-/// consuming the free disk that `compute_storage_quota` divides among guests. On a single box
-/// where all three volumes share a filesystem, that ends with Postgres unable to write WAL.
-///
-/// Two classes:
-/// - `*.tmp` — an upload that never got as far as being renamed. Always safe past the window.
-/// - everything else — a final-named original whose commit never happened.
-async fn sweep_orphan_originals(pool: &PgPool, media_path: &std::path::Path) {
-    let originals = media_path.join("originals");
-    let cutoff = Duration::from_secs(ORPHAN_UPLOAD_RETENTION_HOURS * 3600);
-
-    // originals/{event_slug}/{uuid}.{ext} — one level of per-event directories.
-    let mut event_dirs = match tokio::fs::read_dir(&originals).await {
-        Ok(rd) => rd,
-        // Nothing uploaded yet; the directory is created lazily by the upload handler.
-        Err(_) => return,
-    };
-
-    let mut candidates: Vec<(String, std::path::PathBuf)> = Vec::new();
-    let mut temps_removed = 0u32;
-
-    while let Ok(Some(event_dir)) = event_dirs.next_entry().await {
-        if !event_dir
-            .file_type()
-            .await
-            .map(|t| t.is_dir())
-            .unwrap_or(false)
-        {
-            continue;
-        }
-        let slug = event_dir.file_name().to_string_lossy().to_string();
-        let Ok(mut files) = tokio::fs::read_dir(event_dir.path()).await else {
-            continue;
-        };
-        while let Ok(Some(entry)) = files.next_entry().await {
-            let Ok(meta) = entry.metadata().await else {
-                continue;
-            };
-            if !meta.is_file() {
-                continue;
-            }
-            // Too young to judge: an upload committing RIGHT NOW is indistinguishable from an
-            // orphan, because the rename precedes the commit.
-            //
-            // This sweep is also the backstop for the one case the upload handler's drop guard
-            // deliberately leaks: a client disconnect while `tx.commit()` is in flight disarms
-            // the guard first (so a COMMIT that Postgres applied anyway keeps its file), which
-            // means a COMMIT that did NOT apply leaves a final-named file with no row. The
-            // `NOT EXISTS` check below is what reclaims it. See `upload.rs`, the disarm site.
-            let recent = meta
-                .modified()
-                .ok()
-                .and_then(|m| m.elapsed().ok())
-                .is_none_or(|age| age < cutoff);
-            if recent {
-                continue;
-            }
-
-            let name = entry.file_name().to_string_lossy().to_string();
-            if name.ends_with(".tmp") {
-                // A `.tmp` never has a row by construction — no DB check needed.
-                if tokio::fs::remove_file(entry.path()).await.is_ok() {
-                    temps_removed += 1;
-                }
-                continue;
-            }
-            candidates.push((format!("originals/{slug}/{name}"), entry.path()));
-        }
-    }
-
-    if temps_removed > 0 {
-        tracing::warn!(
-            "reclaimed {temps_removed} abandoned upload temp file(s) older than \
-             {ORPHAN_UPLOAD_RETENTION_HOURS}h"
-        );
-    }
-    if candidates.is_empty() {
-        return;
-    }
-
-    // One query per batch, not one per file: a backlog of thousands of orphans must not turn
-    // into thousands of round trips on an hourly timer.
-    let mut orphans_removed = 0u32;
-    for chunk in candidates.chunks(500) {
-        let paths: Vec<String> = chunk.iter().map(|(rel, _)| rel.clone()).collect();
-        // NO `deleted_at IS NULL` FILTER HERE. A soft-deleted row still points at its file
-        // during its retention window, and reclaiming that file is `cleanup_deleted_media`'s
-        // job — filtering here would race the two sweeps and destroy the exact files the
-        // recovery window exists to preserve.
-        let unreferenced: Result<Vec<(String,)>, _> = sqlx::query_as(
-            "SELECT p FROM unnest($1::text[]) AS p
-              WHERE NOT EXISTS (SELECT 1 FROM upload u WHERE u.original_path = p)",
-        )
-        .bind(&paths)
-        .fetch_all(pool)
-        .await;
-        let unreferenced = match unreferenced {
-            Ok(rows) => rows,
-            Err(e) => {
-                tracing::warn!(error = ?e, "orphan-original sweep query failed");
-                return;
-            }
-        };
-        for (rel,) in unreferenced {
-            if let Some((_, abs)) = chunk.iter().find(|(r, _)| *r == rel)
-                && tokio::fs::remove_file(abs).await.is_ok()
-            {
-                orphans_removed += 1;
-            }
-        }
-    }
-
-    if orphans_removed > 0 {
-        tracing::warn!(
-            "reclaimed {orphans_removed} original(s) with no upload row, older than \
-             {ORPHAN_UPLOAD_RETENTION_HOURS}h"
-        );
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// Build `<root>/originals/<event>/<name>` with `len` bytes, optionally back-dating its mtime
-    /// by `age`. Back-dating is the only way to test the sweep without sleeping through an hour.
-    fn temp_file(root: &std::path::Path, name: &str, len: usize, age: Option<Duration>) {
-        let dir = root.join("originals").join("wedding");
-        std::fs::create_dir_all(&dir).expect("create dir");
-        let path = dir.join(name);
-        let f = std::fs::File::create(&path).expect("create file");
-        std::io::Write::write_all(&mut &f, &vec![0u8; len]).expect("write");
-        if let Some(age) = age {
-            let when = std::time::SystemTime::now() - age;
-            f.set_modified(when).expect("set mtime");
-        }
-    }
-
-    fn exists(root: &std::path::Path, name: &str) -> bool {
-        root.join("originals").join("wedding").join(name).exists()
-    }
-
-    /// The two halves of the guarantee in one pass: an abandoned temp is reclaimed, and a temp
-    /// that is still being written to is NOT — the second matters more, because deleting a live
-    /// upload's temp file would corrupt a photo that was about to succeed.
-    #[tokio::test]
-    async fn the_sweep_reclaims_abandoned_temps_and_spares_live_ones() {
-        let root = std::env::temp_dir().join(format!("es-sweep-{}", uuid::Uuid::new_v4()));
-
-        // Abandoned: the writer died over an hour ago and nothing has touched it since.
-        temp_file(
-            &root,
-            "dead.tmp",
-            2048,
-            Some(ORPHAN_TEMP_MAX_AGE + Duration::from_secs(60)),
-        );
-        // Live: an upload in progress keeps advancing its mtime, so it always looks young —
-        // this is why the threshold is on modification time and not on creation time.
-        temp_file(&root, "inflight.tmp", 2048, None);
-        // A committed original. The sweep must only ever consider `.tmp`.
-        temp_file(&root, "keeper.jpg", 2048, Some(Duration::from_secs(86_400)));
-
-        sweep_orphan_upload_temps(&root).await;
-
-        assert!(
-            !exists(&root, "dead.tmp"),
-            "an abandoned temp must be reclaimed"
-        );
-        assert!(
-            exists(&root, "inflight.tmp"),
-            "a temp still being written to must survive — deleting it destroys a live upload"
-        );
-        assert!(
-            exists(&root, "keeper.jpg"),
-            "the sweep must never touch a committed original"
-        );
-
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    /// Runs on every boot and every hour, so a media tree that does not exist yet (before the
-    /// first upload) must be a silent no-op rather than an error logged 24 times a day.
-    #[tokio::test]
-    async fn a_missing_media_tree_is_not_an_error() {
-        let root = std::env::temp_dir().join(format!("es-sweep-absent-{}", uuid::Uuid::new_v4()));
-        sweep_orphan_upload_temps(&root).await; // must simply return
-    }
-}

backend/src/services/media_fs.rs

@@ -0,0 +1,83 @@
+//! Filesystem lifecycle for media artifacts.
+//!
+//! The DB-aware gateway hides deleted/hidden uploads, but the bytes still sit on
+//! a fixed-size disk until something removes them. This module is that
+//! something: best-effort unlinking on delete, plus a periodic reaper that
+//! sweeps files belonging to soft-deleted rows (catching anything an in-process
+//! unlink missed — e.g. a crash between the DB commit and the unlink).
+
+use std::path::Path;
+
+use sqlx::PgPool;
+
+use crate::models::upload::DeletedPaths;
+
+/// Best-effort removal of an upload's three on-disk artifacts. A missing file is
+/// not an error (it may already be gone, or never existed for videos without a
+/// preview); anything else is logged but never propagated — losing the bytes
+/// must not fail the user's delete.
+pub async fn unlink_media(media_path: &Path, paths: &DeletedPaths) {
+    let candidates = [
+        Some(&paths.original),
+        paths.preview.as_ref(),
+        paths.thumbnail.as_ref(),
+    ];
+    for rel in candidates.into_iter().flatten() {
+        let abs = media_path.join(rel);
+        match tokio::fs::remove_file(&abs).await {
+            Ok(()) => {}
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+            Err(e) => tracing::warn!(path = %rel, error = ?e, "media unlink failed"),
+        }
+    }
+}
+
+/// Reaper: remove on-disk files for uploads that were soft-deleted more than
+/// `grace` ago, then hard-delete those rows so they don't accumulate. Strictly
+/// DB-row-driven — it never walks the filesystem, so it can never remove a file
+/// belonging to a live upload.
+pub async fn reap_deleted(pool: &PgPool, media_path: &Path) {
+    // Snapshot the exact rows (id + paths) we are about to unlink, and delete by
+    // those ids — NOT by re-evaluating the `deleted_at < now - 1 day` predicate.
+    // A row that crosses the 1-day line *during* the unlink loop would otherwise
+    // be hard-deleted by the second predicate without ever having its files
+    // unlinked → a permanent orphan.
+    let rows: Vec<(uuid::Uuid, String, Option<String>, Option<String>)> = match sqlx::query_as(
+        "SELECT id, original_path, preview_path, thumbnail_path
+         FROM upload
+         WHERE deleted_at IS NOT NULL AND deleted_at < NOW() - INTERVAL '1 day'",
+    )
+    .fetch_all(pool)
+    .await
+    {
+        Ok(rows) => rows,
+        Err(e) => {
+            tracing::warn!(error = ?e, "media reaper: query failed");
+            return;
+        }
+    };
+
+    if rows.is_empty() {
+        return;
+    }
+
+    let mut ids = Vec::with_capacity(rows.len());
+    for (id, original, preview, thumbnail) in &rows {
+        unlink_media(media_path, &DeletedPaths {
+            original: original.clone(),
+            preview: preview.clone(),
+            thumbnail: thumbnail.clone(),
+        })
+        .await;
+        ids.push(*id);
+    }
+
+    match sqlx::query("DELETE FROM upload WHERE id = ANY($1)")
+        .bind(&ids)
+        .execute(pool)
+        .await
+    {
+        Ok(r) => tracing::info!("media reaper: removed {} deleted upload(s)", r.rows_affected()),
+        Err(e) => tracing::warn!(error = ?e, "media reaper: row delete failed"),
+    }
+}

backend/src/services/media_token.rs

@@ -0,0 +1,122 @@
+//! Stateless signed URLs for the authenticated media gateway.
+//!
+//! Media (`<img>`/`<video>` sources) cannot carry an `Authorization` header, so
+//! access is granted by an HMAC-SHA256 signature embedded in the URL. The
+//! feed/upload DTOs are serialized for an already-authenticated event member, so
+//! that is where fresh signatures are minted; the gateway handler verifies them
+//! without any DB/session state.
+//!
+//! HMAC is implemented over the in-tree `sha2` crate (no new dependency). The
+//! key is the app's `jwt_secret`.
+
+use sha2::{Digest, Sha256};
+use uuid::Uuid;
+
+/// Validity window of a signed URL.
+const TTL_SECS: i64 = 24 * 3600;
+/// Issue-time bucket. Expiry (and therefore the URL) is stable within this
+/// window so the browser caches image bytes across feed polls instead of
+/// re-downloading on every refresh.
+const BUCKET_SECS: i64 = 3600;
+
+fn hmac_sha256(key: &[u8], msg: &[u8]) -> [u8; 32] {
+    const BLOCK: usize = 64;
+    let mut key_block = [0u8; BLOCK];
+    if key.len() > BLOCK {
+        let digest = Sha256::digest(key);
+        key_block[..32].copy_from_slice(&digest);
+    } else {
+        key_block[..key.len()].copy_from_slice(key);
+    }
+
+    let mut ipad = [0x36u8; BLOCK];
+    let mut opad = [0x5cu8; BLOCK];
+    for i in 0..BLOCK {
+        ipad[i] ^= key_block[i];
+        opad[i] ^= key_block[i];
+    }
+
+    let mut inner = Sha256::new();
+    inner.update(ipad);
+    inner.update(msg);
+    let inner_digest = inner.finalize();
+
+    let mut outer = Sha256::new();
+    outer.update(opad);
+    outer.update(inner_digest);
+    outer.finalize().into()
+}
+
+fn sign(secret: &str, kind: &str, id: Uuid, exp: i64) -> String {
+    let msg = format!("{kind}:{id}:{exp}");
+    let mac = hmac_sha256(secret.as_bytes(), msg.as_bytes());
+    let mut hex = String::with_capacity(64);
+    for b in mac {
+        use std::fmt::Write;
+        let _ = write!(hex, "{b:02x}");
+    }
+    hex
+}
+
+/// Build a signed, time-boxed gateway URL for one of an upload's artifacts.
+/// `kind` is `original` | `preview` | `thumbnail`.
+pub fn signed_url(secret: &str, kind: &str, id: Uuid, now: i64) -> String {
+    let exp = ((now / BUCKET_SECS) * BUCKET_SECS) + TTL_SECS;
+    let sig = sign(secret, kind, id, exp);
+    format!("/media/{kind}/{id}?exp={exp}&sig={sig}")
+}
+
+/// Verify a signed URL: signature must match and the expiry must not have
+/// passed. Signature comparison is constant-time.
+pub fn verify(secret: &str, kind: &str, id: Uuid, exp: i64, sig: &str, now: i64) -> bool {
+    if exp < now {
+        return false;
+    }
+    let expected = sign(secret, kind, id, exp);
+    constant_time_eq(expected.as_bytes(), sig.as_bytes())
+}
+
+fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    let mut diff = 0u8;
+    for (x, y) in a.iter().zip(b.iter()) {
+        diff |= x ^ y;
+    }
+    diff == 0
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn sign_verify_roundtrip() {
+        let secret = "test_secret_at_least_32_chars_long_xxxx";
+        let id = Uuid::new_v4();
+        let now = 1_700_000_000;
+        let url = signed_url(secret, "original", id, now);
+        // Extract exp + sig from the query string.
+        let (_, query) = url.split_once('?').unwrap();
+        let mut exp = 0i64;
+        let mut sig = String::new();
+        for pair in query.split('&') {
+            let (k, v) = pair.split_once('=').unwrap();
+            match k {
+                "exp" => exp = v.parse().unwrap(),
+                "sig" => sig = v.to_string(),
+                _ => {}
+            }
+        }
+        assert!(verify(secret, "original", id, exp, &sig, now));
+        // Tampered kind / id / sig must fail.
+        assert!(!verify(secret, "preview", id, exp, &sig, now));
+        assert!(!verify(secret, "original", Uuid::new_v4(), exp, &sig, now));
+        assert!(!verify(secret, "original", id, exp, "deadbeef", now));
+        // Wrong secret must fail.
+        assert!(!verify("other_secret_at_least_32_chars_long_yy", "original", id, exp, &sig, now));
+        // Expired must fail.
+        assert!(!verify(secret, "original", id, exp, &sig, exp + 1));
+    }
+}

backend/src/services/media_total.rs

@@ -1,112 +0,0 @@
-//! Cached sum of all media bytes the event is holding.
-//!
-//! The upload gate needs to know "how big would the keepsake be if we accept this file", because
-//! the archive needs room for BOTH halves at once (`export::required_free_bytes` is
-//! `media × 1.1 × 2` — the ZIP and the HTML viewer are each gallery-sized). Asking that question
-//! per upload has to be cheap, and it has to be cheap on the busiest write path in the app.
-//!
-//! `export::estimate_export_bytes` answers the same question exactly, but it aggregates
-//! `original_size_bytes` across every upload row joined to `user` — fine once per release,
-//! wasteful per upload and growing all evening. This sums `user.total_upload_bytes` instead:
-//! one row per guest (~100), already maintained transactionally by the quota path, already
-//! refunded on delete.
-//!
-//! The two differ slightly — this one counts uploads belonging to banned or hidden users, which
-//! the export filters out. That skew is in the SAFE direction: it over-estimates the archive, so
-//! the gate closes marginally early rather than marginally late. Never swap it for a cheaper
-//! query that could under-estimate; an under-estimate authorises the very upload that makes the
-//! keepsake unbuildable, which is the failure this exists to prevent.
-
-use std::sync::{Arc, RwLock};
-use std::time::{Duration, Instant};
-
-use sqlx::PgPool;
-
-/// How long a reading is trusted. Shorter than [`crate::services::disk`]'s TTL because this
-/// number only ever grows and does so in the same request path that reads it — a stale value
-/// under-counts the newest uploads, and under-counting is the direction that matters.
-const TTL: Duration = Duration::from_secs(5);
-
-/// Cheap-to-clone cache of the event's total media bytes. Lives in `AppState`.
-#[derive(Clone)]
-pub struct MediaTotalCache {
-    inner: Arc<RwLock<Option<(i64, Instant)>>>,
-}
-
-impl MediaTotalCache {
-    pub fn new() -> Self {
-        Self {
-            inner: Arc::new(RwLock::new(None)),
-        }
-    }
-
-    /// Drop the cached reading so the next `get()` re-queries.
-    ///
-    /// Used by the e2e TRUNCATE endpoint for the same reason `DiskCache::invalidate` exists:
-    /// truncation removes every upload, and a surviving reading would make the next test's
-    /// gate compute against the previous test's data.
-    pub fn invalidate(&self) {
-        *self.inner.write().unwrap() = None;
-    }
-
-    /// Total bytes of media the event is holding, cached for [`TTL`].
-    ///
-    /// Returns 0 when the query fails. That is a deliberate FAIL-OPEN, consistent with the
-    /// quota path and the export preflight: a database blip must not turn into "every upload
-    /// refused". The disk-space half of the gate still applies, so a failure here degrades the
-    /// check to the old flat-reserve behaviour rather than disabling it.
-    pub async fn get(&self, pool: &PgPool, event_slug: &str) -> i64 {
-        if let Some((bytes, at)) = *self.inner.read().unwrap()
-            && at.elapsed() < TTL
-        {
-            return bytes;
-        }
-        // Scoped to THIS event (H12). The unscoped `SUM(total_upload_bytes) FROM "user"` summed
-        // every user row in the table, so reusing the install for a second event carried the first
-        // one's bytes into the second one's keepsake-headroom gate — closing uploads early with a
-        // message about "the event's storage" being full, counting media that belongs to a party
-        // that already happened (and whose files are never reclaimed either).
-        let queried = sqlx::query_scalar::<_, Option<i64>>(
-            "SELECT SUM(u.total_upload_bytes)::bigint FROM \"user\" u
-               JOIN event e ON e.id = u.event_id
-              WHERE e.slug = $1",
-        )
-        .bind(event_slug)
-        .fetch_one(pool)
-        .await;
-
-        let bytes = match queried {
-            Ok(v) => v.unwrap_or(0).max(0),
-            Err(e) => {
-                // FAIL OPEN, but do NOT cache the failure, and do NOT let it pass silently.
-                //
-                // Storing 0 here pinned the gate's view of the event at "empty" for the whole
-                // TTL. During that window `media_after` is just this upload, `keepsake_needs`
-                // collapses to ~2.2x one file, and the gate degrades to the flat 10 GB reserve —
-                // precisely the behaviour the two-halves design replaced, reappearing with no
-                // trace in the log. And the trigger correlates with the danger: with
-                // `max_connections = 10` and a 5s acquire timeout, this query fails exactly when
-                // a burst is in progress.
-                //
-                // Falling back to the LAST GOOD reading (however stale) is strictly better than
-                // 0: the total only ever grows, so a stale value under-counts slightly, while 0
-                // under-counts by everything.
-                let previous = self.inner.read().unwrap().map(|(b, _)| b);
-                tracing::warn!(
-                    error = %e,
-                    fallback_bytes = previous.unwrap_or(0),
-                    "media total query failed; upload gate is running on a stale reading"
-                );
-                return previous.unwrap_or(0);
-            }
-        };
-        *self.inner.write().unwrap() = Some((bytes, Instant::now()));
-        bytes
-    }
-}
-
-impl Default for MediaTotalCache {
-    fn default() -> Self {
-        Self::new()
-    }
-}

backend/src/services/mod.rs

@@ -1,12 +1,10 @@
-pub mod audit;
 pub mod compression;
 pub mod config;
-pub mod disk;
 pub mod export;
-pub mod imaging;
+pub mod jobs;
 pub mod maintenance;
-pub mod media_total;
+pub mod media_fs;
+pub mod media_token;
+pub mod password;
 pub mod rate_limiter;
 pub mod sse_tickets;
-pub mod upload_admission;
-pub mod video;

backend/src/services/password.rs

@@ -0,0 +1,25 @@
+//! bcrypt hashing/verification offloaded to the blocking pool.
+//!
+//! bcrypt cost-12 is ~250–400ms of synchronous CPU. Called directly in an async
+//! handler it pins a Tokio worker for that whole time, so a handful of
+//! concurrent joins/recovers/admin-logins can starve every other request
+//! (feed, SSE, upload). Routing the work through `spawn_blocking` keeps the
+//! async reactor responsive.
+
+use crate::error::AppError;
+
+/// Hash a secret with the given bcrypt cost, off the async reactor.
+pub async fn hash(plain: String, cost: u32) -> Result<String, AppError> {
+    tokio::task::spawn_blocking(move || bcrypt::hash(&plain, cost))
+        .await
+        .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))?
+        .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))
+}
+
+/// Verify a secret against a bcrypt hash, off the async reactor. Returns `false`
+/// on any error (mirrors the previous `unwrap_or(false)` fail-closed behavior).
+pub async fn verify(plain: String, hash: String) -> bool {
+    tokio::task::spawn_blocking(move || bcrypt::verify(&plain, &hash).unwrap_or(false))
+        .await
+        .unwrap_or(false)
+}