♻️(frontend) add auxiliary window helpers and zoom DOM resync #1695

Open a proper popup window and keep zoom working when the video moves into it.

CHANGELOG.md

@@ -8,20 +8,46 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Changed
+
+- 📈(frontend) include LiveKit SIDs in the connection analytics event
+- 🔇(backend) silence expected 401 warnings on /me
+- 🔇(backend) silence noisy request summary info logs
+
+### Fixed
+
+- 🐛(backend) acknowledge unknown LiveKit webhook events instead of 422
+- 🔒️(backend) enforce display name setting on rename API
+- 🔒️(backend) reject inactive users in resource server backend
+
+## [1.31.0] - 2026-09-08
+
 ### Added
 
 - ✨(frontend) add 1080p sending resolution option #1660
 - ✨(backend) add Traefik support via configurable media-auth url header #1649
 - ✨(backend) update a room's attributes from the external API
+- 🔊(backend) log request duration in Gunicorn workers
+- 📈(frontend) track missing lobby participant on accept/reject
+- ✨(backend) sort waiting participants by their arrival time
 
 ### Changed
 
 - ⬆️(dev) pin LiveKit server to v1.13.6
+- 🔒(frontend) upgrade base image to 1.30.4-alpine3.24
 
 ### Fixed
 
 - 🐛(backend) allow any printable ASCII characters in user sub field #1673
 - 🐛(frontend) keep the sending resolution picked while the camera is off #1667
+- 🐛(frontend) restore automatic lower-hand on speaking
+- 🐛(frontend) center Avatar initials with a font-aware cap-height ratio
+- 🐛(frontend) keep feedback buttons on one line for fr/es/en
+- ⚡️(frontend) increase lobby polling interval on both sides
+- ⚡️(frontend) add trailing slash on the /me endpoint call
+- ⚡️(backend) refactor lobby storage to bound key lookups per room
+- ⚡️(backend) refactor presence cache to bound key lookups per room
+- 💄(frontend) position the login hint dynamically next to the button
 
 ## [1.30.0] - 2026-09-01
 
@@ -233,6 +259,10 @@ and this project adheres to
 - ♿️(frontend) focus side panel container on open #1452
 - 🐛(summary) whisper call error handling
 
+### Added
+
+- ✨(frontend) add screen share zoom controls #1498
+
 ## [1.23.0] - 2026-07-08
 
 ### Added

docker/dinum-frontend/Dockerfile

@@ -54,19 +54,11 @@ RUN npx webpack --mode production
 
 
 # ---- Front-end image ----
-FROM nginxinc/nginx-unprivileged:1.30.3-alpine3.23 AS frontend-production
+FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
-
-# Security patches for known CVEs
-RUN apk update && apk upgrade  \
-    libcrypto3>=3.5.7-r0 \
-    libssl3>=3.5.7-r0 \
-    musl \
-    musl-utils \
-    zlib>=1.3.2-r0 \
-    libexpat>=2.8.4-r0 \
-    && apk del curl
+RUN apk del curl
+USER nginx
 
 USER nginx
 

docker/dinum-frontend/dinum-styles.css

@@ -1,5 +1,6 @@
 :root {
     --fonts-sans: 'Marianne', ui-sans-serif, system-ui, sans-serif;
+    --avatar-cap-height: 0.7;
 }
 
 .Header-beforeLogo {

docker/files/usr/local/etc/gunicorn/meet.py

@@ -14,3 +14,4 @@ accesslog = "-"
 # Using '-' for the error log file makes gunicorn log errors to stderr
 errorlog = "-"
 loglevel = "info"
+access_log_format = '%(h)s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s" %(M)s'

docs/theming.md

@@ -34,6 +34,7 @@ Let's say you want to change the font of our application to a custom font. You c
 
 :root {
   --fonts-sans: 'Roboto', ui-sans-serif, system-ui, sans-serif;
+  --avatar-cap-height: 0.7;
 }
 ```
 

src/agents/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "agents"
-version = "1.29.0"
+version = "1.31.0"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.6.7",

src/agents/uv.lock

@@ -9,7 +9,7 @@ resolution-markers = [
 
 [[package]]
 name = "agents"
-version = "1.29.0"
+version = "1.31.0"
 source = { virtual = "." }
 dependencies = [
     { name = "httpx" },

src/backend/core/api/viewsets.py

@@ -909,6 +909,15 @@ class RoomViewSet(
         """Rename the current participant in the room."""
         room = self.get_object()
 
+        if (
+            not settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME
+            and request.user.is_authenticated
+        ):
+            return drf_response.Response(
+                {"error": "Authenticated participants cannot edit their display name"},
+                status=drf_status.HTTP_403_FORBIDDEN,
+            )
+
         serializer = serializers.RenameParticipantSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 

src/backend/core/external_api/authentication.py

@@ -286,6 +286,10 @@ class ResourceServerBackend(LaSuiteBackend):
         if user is None and settings.OIDC_CREATE_USER:
             user = self.create_user(sub)
 
+        if user is not None and not user.is_active:
+            logger.warning("Inactive user attempted authentication: %s", user.pk)
+            raise SuspiciousOperation("User account is disabled.")
+
         return user
 
     def create_user(self, sub):

src/backend/core/logging_filters.py

@@ -0,0 +1,25 @@
+"""Logging filters for the core application."""
+
+import logging
+
+from django.conf import settings
+
+
+class SilenceExpected401(logging.Filter):
+    """Drop the expected 401 from anonymous hits on the /me endpoint.
+
+    The frontend probes `/users/me/` to check authentication; a 401 for
+    anonymous users is normal, not a warning worth logging.
+    """
+
+    def filter(self, record):
+        """Return False for a 401 on a silenced path, True otherwise."""
+        if getattr(record, "status_code", None) != 401:
+            return True
+
+        request = getattr(record, "request", None)
+        path = getattr(request, "path", None)
+        if not path:
+            return True
+
+        return path not in settings.LOGGING_SILENCED_401_PATHS

src/backend/core/services/livekit_events.py

@@ -52,12 +52,6 @@ class InvalidPayloadError(LiveKitWebhookError):
     status_code = 400
 
 
-class UnsupportedEventTypeError(LiveKitWebhookError):
-    """Unsupported event type."""
-
-    status_code = 422
-
-
 class ActionFailedError(LiveKitWebhookError):
     """Webhook action fails to process or complete."""
 
@@ -74,6 +68,7 @@ class LiveKitWebhookEventType(Enum):
     # Participant events
     PARTICIPANT_JOINED = "participant_joined"
     PARTICIPANT_LEFT = "participant_left"
+    PARTICIPANT_CONNECTION_ABORTED = "participant_connection_aborted"
 
     # Track events
     TRACK_PUBLISHED = "track_published"
@@ -153,10 +148,13 @@ class LiveKitEventsService:
 
         try:
             webhook_type = LiveKitWebhookEventType(data.event)
-        except ValueError as e:
-            raise UnsupportedEventTypeError(
-                f"Unknown webhook type: {data.event}"
-            ) from e
+        except ValueError:
+            logger.warning(
+                "Ignoring unknown LiveKit webhook event type '%s' for room '%s'",
+                data.event,
+                room_name,
+            )
+            return
 
         # Handle according to received webhook type
         handler = self._webhook_handlers.get(webhook_type.value)

src/backend/core/services/lobby.py

@@ -4,11 +4,12 @@ import logging
 import uuid
 from dataclasses import dataclass
 from enum import Enum
-from typing import Dict, List, Optional, Tuple
+from typing import Dict, FrozenSet, Optional, Sequence, Tuple
 from uuid import UUID
 
 from django.conf import settings
 from django.core.cache import cache
+from django.utils import timezone
 
 from core import models, utils
 
@@ -46,6 +47,7 @@ class LobbyParticipant:
     username: str
     color: str
     id: str
+    entered_at: str
 
     def to_dict(self) -> Dict[str, str]:
         """Serialize the participant object to a dict representation."""
@@ -54,6 +56,7 @@ class LobbyParticipant:
             "username": self.username,
             "id": self.id,
             "color": self.color,
+            "entered_at": self.entered_at,
         }
 
     @classmethod
@@ -68,6 +71,7 @@ class LobbyParticipant:
                 username=data["username"],
                 id=data["id"],
                 color=data["color"],
+                entered_at=data["entered_at"],
             )
         except (KeyError, ValueError) as e:
             logger.exception("Error creating Participant from dict:")
@@ -86,6 +90,47 @@ class LobbyService:
         """Generate cache key for participant(s) data."""
         return f"{settings.LOBBY_KEY_PREFIX}_{room_id!s}_{participant_id}"
 
+    @staticmethod
+    def _get_index_key(room_id: UUID) -> str:
+        """Raw Redis key of the per-room participant index (a native SET)."""
+        return cache.client.make_key(f"{settings.LOBBY_KEY_PREFIX}-index_{room_id!s}")
+
+    @staticmethod
+    def _redis(write: bool = True):
+        """Raw redis-py client.
+
+        SADD/SREM/SMEMBERS are not exposed by the Django cache API; this is
+        the documented django-redis escape hatch.
+        """
+        return cache.client.get_client(write=write)
+
+    def _index_add(self, room_id: UUID, participant_id: str) -> None:
+        """Record a participant id in the room index."""
+        index_key = self._get_index_key(room_id)
+        pipe = self._redis().pipeline(transaction=False)
+        pipe.sadd(index_key, participant_id)
+        pipe.expire(index_key, settings.LOBBY_ACCEPTED_TIMEOUT)
+        pipe.execute()
+
+    def _index_members(self, room_id: UUID) -> FrozenSet[str]:
+        """All participant ids currently indexed for the room."""
+        members = self._redis(write=False).smembers(self._get_index_key(room_id))
+        return frozenset(
+            member.decode() if isinstance(member, bytes) else member
+            for member in members
+        )
+
+    def _index_touch(self, room_id: UUID) -> None:
+        """Re-arm the room index backstop TTL."""
+        self._redis().expire(
+            self._get_index_key(room_id), settings.LOBBY_ACCEPTED_TIMEOUT
+        )
+
+    def _index_remove(self, room_id: UUID, *participant_ids: str) -> None:
+        """Drop participant ids from the room index."""
+        if participant_ids:
+            self._redis().srem(self._get_index_key(room_id), *participant_ids)
+
     @staticmethod
     def _get_or_create_participant_id(request) -> str:
         """Extract unique participant identifier from the request."""
@@ -162,6 +207,7 @@ class LobbyService:
                     username=username,
                     id=participant_id,
                     color=utils.generate_color(participant_id),
+                    entered_at=timezone.now().isoformat(),
                 )
             else:
                 participant.status = LobbyParticipantStatus.ACCEPTED
@@ -209,15 +255,12 @@ class LobbyService:
         cache.touch(
             self._get_cache_key(room_id, participant_id), settings.LOBBY_WAITING_TIMEOUT
         )
+        self._index_touch(room_id)
 
     def enter(
         self, room_id: UUID, participant_id: str, username: str
     ) -> LobbyParticipant:
-        """Add participant to waiting lobby.
-
-        Create a new participant entry in waiting status and notify room
-        participants of the new entry request.
-        """
+        """Add participant to waiting lobby."""
 
         color = utils.generate_color(participant_id)
 
@@ -226,6 +269,7 @@ class LobbyService:
             username=username,
             id=participant_id,
             color=color,
+            entered_at=timezone.now().isoformat(),
         )
 
         try:
@@ -245,6 +289,7 @@ class LobbyService:
             participant.to_dict(),
             timeout=settings.LOBBY_WAITING_TIMEOUT,
         )
+        self._index_add(room_id, participant_id)
 
         return participant
 
@@ -266,28 +311,42 @@ class LobbyService:
             cache.delete(cache_key)
             return None
 
-    def list_waiting_participants(self, room_id: UUID) -> List[dict]:
+    def list_waiting_participants(self, room_id: UUID) -> Sequence[dict]:
         """List all waiting participants for a room."""
 
-        pattern = self._get_cache_key(room_id, "*")
-        keys = list(cache.iter_keys(pattern, itersize=utils.CACHE_SCAN_ITERSIZE))
+        member_ids = self._index_members(room_id)
 
-        if not keys:
-            return []
+        if not member_ids:
+            return ()
 
-        data = cache.get_many(keys)
+        keys_by_id = {
+            participant_id: self._get_cache_key(room_id, participant_id)
+            for participant_id in member_ids
+        }
+        data = cache.get_many(list(keys_by_id.values()))
 
+        dead_ids = []
         waiting_participants = []
-        for cache_key, raw_participant in data.items():
+
+        for participant_id, cache_key in keys_by_id.items():
+            raw_participant = data.get(cache_key)
+            if raw_participant is None:
+                dead_ids.append(participant_id)
+                continue
             try:
                 participant = LobbyParticipant.from_dict(raw_participant)
             except LobbyParticipantParsingError:
                 cache.delete(cache_key)
+                dead_ids.append(participant_id)
                 continue
             if participant.status == LobbyParticipantStatus.WAITING:
                 waiting_participants.append(participant.to_dict())
 
-        return waiting_participants
+        self._index_remove(room_id, *dead_ids)
+
+        waiting_participants.sort(key=lambda p: p["entered_at"], reverse=True)
+
+        return tuple(waiting_participants)
 
     def handle_participant_entry(
         self,
@@ -341,16 +400,24 @@ class LobbyService:
 
         participant.status = status
         cache.set(cache_key, participant.to_dict(), timeout=timeout)
+        self._index_touch(room_id)
 
     def clear_room_cache(self, room_id: UUID) -> None:
         """Clear all participant entries from the cache for a specific room."""
 
-        cache.delete_pattern(
-            self._get_cache_key(room_id, "*"), itersize=utils.CACHE_SCAN_ITERSIZE
-        )
+        member_ids = self._index_members(room_id)
+        if member_ids:
+            cache.delete_many(
+                [
+                    self._get_cache_key(room_id, participant_id)
+                    for participant_id in member_ids
+                ]
+            )
+        self._redis().delete(self._get_index_key(room_id))
 
     def clear_participant_cache(self, room_id: UUID, participant_id: str) -> None:
         """Clear a given participant entry from the cache for a specific room."""
 
         cache_key = self._get_cache_key(room_id, participant_id)
         cache.delete(cache_key)
+        self._index_remove(room_id, participant_id)

src/backend/core/services/presence.py

@@ -1,25 +1,11 @@
-"""Presence cache.
-
-Redis-backed memo of "this identity is currently connected to this room".
-
-This module is intentionally a *pure cache store* with no dependency on other
-services, so that `participants_management` (which talks to LiveKit) can
-import it without creating an import cycle. The composition of "check cache,
-fall back to LiveKit" lives in
-`ParticipantsManagement.check_if_in_meeting_cached`.
-
-Only positive answers are stored: a sticky negative would lock out someone
-who joins right after a miss for the whole TTL. The TTL is a safety net in
-case an invalidation webhook is lost.
-"""
+"""Presence cache."""
 
+from typing import FrozenSet
 from uuid import UUID
 
 from django.conf import settings
 from django.core.cache import cache
 
-from core.utils import CACHE_SCAN_ITERSIZE
-
 
 class PresenceCache:
     """Store and invalidate (room, identity) presence entries."""
@@ -29,24 +15,65 @@ class PresenceCache:
         """Cache key for a (room, identity) presence entry."""
         return f"{settings.PRESENCE_KEY_PREFIX}_{room_id!s}_{identity}"
 
+    @staticmethod
+    def _get_index_key(room_id: UUID | str) -> str:
+        """Raw Redis key of the per-room identity index (a native SET).
+
+        Built through django-redis' make_key so it lives under the same
+        KEY_PREFIX/version namespace as the presence entries.
+        """
+        return cache.client.make_key(
+            f"{settings.PRESENCE_KEY_PREFIX}-index_{room_id!s}"
+        )
+
+    @staticmethod
+    def _redis(write: bool = True):
+        """Raw redis-py client.
+
+        SADD/SREM/SMEMBERS are not exposed by the Django cache API; this is
+        the documented django-redis escape hatch.
+        """
+        return cache.client.get_client(write=write)
+
+    def _index_members(self, room_id: UUID | str) -> FrozenSet[str]:
+        """All identities currently indexed for the room."""
+        members = self._redis(write=False).smembers(self._get_index_key(room_id))
+        return frozenset(
+            member.decode() if isinstance(member, bytes) else member
+            for member in members
+        )
+
     def is_marked_present(self, room_id: UUID | str, identity: str) -> bool:
         """Return True if a positive presence entry exists in cache."""
         return bool(cache.get(self._get_cache_key(room_id, identity)))
 
     def mark_present(self, room_id: UUID | str, identity: str) -> None:
-        """Record that `identity` is in `room_id`."""
+        """Record that `identity` is in `room_id` and index it for the room."""
         cache.set(
             self._get_cache_key(room_id, identity),
             True,
             timeout=settings.PRESENCE_CACHE_TIMEOUT,
         )
+        index_key = self._get_index_key(room_id)
+        pipe = self._redis().pipeline(transaction=False)
+        pipe.sadd(index_key, identity)
+        pipe.expire(index_key, settings.PRESENCE_CACHE_TIMEOUT)
+        pipe.execute()
 
     def clear(self, room_id: UUID | str, identity: str) -> None:
         """Forget presence for one participant (e.g. on participant_left)."""
         cache.delete(self._get_cache_key(room_id, identity))
+        self._redis().srem(self._get_index_key(room_id), identity)
 
     def clear_room(self, room_id: UUID | str) -> None:
-        """Forget presence for every participant of a room (on room_finished)."""
-        cache.delete_pattern(
-            self._get_cache_key(room_id, "*"), itersize=CACHE_SCAN_ITERSIZE
-        )
+        """Forget presence for every participant of a room (on room_finished).
+
+        Deletes the indexed entries and the index itself with targeted
+        commands instead of a full-keyspace pattern scan.
+        """
+        identities = self._index_members(room_id)
+        if identities:
+            cache.delete_many(
+                [self._get_cache_key(room_id, identity) for identity in identities]
+            )
+        self._redis().delete(self._get_index_key(room_id))

src/backend/core/tests/rooms/test_api_rooms_lobby.py

@@ -9,6 +9,7 @@ from unittest import mock
 from django.core.cache import cache
 
 import pytest
+from freezegun import freeze_time
 from rest_framework.test import APIClient
 
 from ... import utils
@@ -24,6 +25,7 @@ pytestmark = pytest.mark.django_db
 # Tests for request_entry endpoint
 
 
+@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_anonymous(settings):
     """Anonymous users should be allowed to request entry to a room."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
@@ -59,6 +61,7 @@ def test_request_entry_anonymous(settings):
         "username": "test_user",
         "status": "waiting",
         "color": "mocked-color",
+        "entered_at": "2025-01-01T10:00:00+00:00",
         "livekit": None,
     }
 
@@ -71,6 +74,7 @@ def test_request_entry_anonymous(settings):
     assert participant_data.get("username") == "test_user"
 
 
+@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_authenticated_user(settings):
     """Authenticated users should be allowed to request entry."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
@@ -108,6 +112,7 @@ def test_request_entry_authenticated_user(settings):
         "username": "test_user",
         "status": "waiting",
         "color": "mocked-color",
+        "entered_at": "2025-01-01T10:00:00+00:00",
         "livekit": None,
     }
 
@@ -120,6 +125,7 @@ def test_request_entry_authenticated_user(settings):
     assert participant_data.get("username") == "test_user"
 
 
+@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_with_existing_participants(settings):
     """Anonymous users should be allowed to request entry to a room with existing participants."""
     # Create a restricted access room
@@ -138,6 +144,7 @@ def test_request_entry_with_existing_participants(settings):
             "username": "user1",
             "status": "waiting",
             "color": "#123456",
+            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
     cache.set(
@@ -147,6 +154,7 @@ def test_request_entry_with_existing_participants(settings):
             "username": "user2",
             "status": "accepted",
             "color": "#654321",
+            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
 
@@ -178,6 +186,7 @@ def test_request_entry_with_existing_participants(settings):
     assert response.json() == {
         "id": participant_id,
         "username": "test_user",
+        "entered_at": "2025-01-01T10:00:00+00:00",
         "status": "waiting",
         "color": "mocked-color",
         "livekit": None,
@@ -192,6 +201,7 @@ def test_request_entry_with_existing_participants(settings):
     assert participant_data.get("username") == "test_user"
 
 
+@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_public_room(settings):
     """Entry requests to public rooms should return ACCEPTED status with LiveKit config."""
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
@@ -230,6 +240,7 @@ def test_request_entry_public_room(settings):
     assert response.json() == {
         "id": "123",
         "username": "test_user",
+        "entered_at": "2025-01-01T10:00:00+00:00",
         "status": "accepted",
         "color": "mocked-color",
         "livekit": {"token": "test-token"},
@@ -240,6 +251,7 @@ def test_request_entry_public_room(settings):
     assert not lobby_keys
 
 
+@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_authenticated_user_public_room(settings):
     """While authenticated, entry request to public rooms should get accepted."""
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
@@ -282,6 +294,7 @@ def test_request_entry_authenticated_user_public_room(settings):
     assert response.json() == {
         "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
         "username": "test_user",
+        "entered_at": "2025-01-01T10:00:00+00:00",
         "status": "accepted",
         "color": "mocked-color",
         "livekit": {"token": "test-token"},
@@ -292,6 +305,7 @@ def test_request_entry_authenticated_user_public_room(settings):
     assert not lobby_keys
 
 
+@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_waiting_participant_public_room(settings):
     """While waiting, entry request to public rooms should get accepted."""
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
@@ -308,6 +322,7 @@ def test_request_entry_waiting_participant_public_room(settings):
             "username": "user1",
             "status": "waiting",
             "color": "#123456",
+            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
 
@@ -338,6 +353,7 @@ def test_request_entry_waiting_participant_public_room(settings):
         "username": "user1",
         "status": "accepted",
         "color": "#123456",
+        "entered_at": "2025-01-01T10:00:00+00:00",
         "livekit": {"token": "test-token"},
     }
 
@@ -443,6 +459,7 @@ def test_allow_participant_to_enter_success(settings, allow_entry, updated_statu
             "status": "waiting",
             "username": "foo",
             "color": "123",
+            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
 
@@ -578,6 +595,7 @@ def test_list_waiting_participants_success(settings):
             "username": "user1",
             "status": "waiting",
             "color": "#123456",
+            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
     cache.set(
@@ -587,28 +605,35 @@ def test_list_waiting_participants_success(settings):
             "username": "user2",
             "status": "waiting",
             "color": "#654321",
+            "entered_at": "2025-01-01T10:05:00+00:00",
         },
     )
+    lobby_service = LobbyService()
+    lobby_service._index_add(room.id, "2f7f162f-e7d1-421b-90e7-02bfbfbf8def")
+    lobby_service._index_add(room.id, "f4ca3ab8a6c04ad88097b8da33f60f10")
 
     response = client.get(f"/api/v1.0/rooms/{room.id}/waiting-participants/")
 
     assert response.status_code == 200
 
-    participants = response.json().get("participants")
-    assert sorted(participants, key=lambda p: p["id"]) == [
-        {
-            "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
-            "username": "user1",
-            "status": "waiting",
-            "color": "#123456",
-        },
-        {
-            "id": "f4ca3ab8a6c04ad88097b8da33f60f10",
-            "username": "user2",
-            "status": "waiting",
-            "color": "#654321",
-        },
-    ]
+    assert response.json() == {
+        "participants": [
+            {
+                "id": "f4ca3ab8a6c04ad88097b8da33f60f10",
+                "username": "user2",
+                "status": "waiting",
+                "color": "#654321",
+                "entered_at": "2025-01-01T10:05:00+00:00",
+            },
+            {
+                "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
+                "username": "user1",
+                "status": "waiting",
+                "color": "#123456",
+                "entered_at": "2025-01-01T10:00:00+00:00",
+            },
+        ]
+    }
 
 
 def test_list_waiting_participants_empty(settings):

src/backend/core/tests/rooms/test_api_rooms_rename_toggle.py

@@ -372,6 +372,67 @@ def test_rename_participant_unexpected_twirp_error(mock_livekit_client, room, to
     mock_livekit_client.aclose.assert_called_once()
 
 
+@pytest.mark.parametrize("name", ["John Doe", "Admin", "Room Owner"])
+def test_rename_participant_forbidden_when_display_name_edit_disabled(
+    mock_livekit_client, settings, room, token, name
+):
+    """
+    Test rename is rejected for authenticated users when the self-hoster
+    disables AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME.
+    """
+    settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME = False
+
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url, {"name": name}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {
+        "error": "Authenticated participants cannot edit their display name"
+    }
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_rename_participant_allowed_when_display_name_edit_enabled(
+    mock_livekit_client, settings, room, token
+):
+    """Test rename still works for authenticated users when the setting is enabled."""
+    settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME = True
+
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    mock_livekit_client.room.update_participant.assert_called_once()
+
+
+def test_rename_participant_anonymous_allowed_when_display_name_edit_disabled(
+    mock_livekit_client, settings, room, anonymous_token
+):
+    """
+    Test the setting only restricts authenticated users: anonymous participants
+    have no account name to fall back on and can still rename themselves.
+    """
+    settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME = False
+
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "Guest User"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    mock_livekit_client.room.update_participant.assert_called_once()
+
+
 def test_rename_participant_success_anonymous(
     mock_livekit_client, room, anonymous_token
 ):

src/backend/core/tests/rooms/test_api_rooms_webhook.py

@@ -94,7 +94,7 @@ def test_invalid_payload(client, auth_token, mock_livekit_config):
 
 
 def test_unknown_event_type(client, mock_livekit_config):
-    """Should return 422 for unknown event type."""
+    """Should acknowledge (200) an unknown event type rather than reject it."""
     event_data = json.dumps({"event": "unknown_event_type"})
 
     # Generate auth token for this specific payload
@@ -112,10 +112,8 @@ def test_unknown_event_type(client, mock_livekit_config):
         HTTP_AUTHORIZATION=auth_token,
     )
 
-    assert response.status_code == 422
-    assert response.json() == {
-        "status": "error",
-    }
+    assert response.status_code == 200
+    assert response.json() == {"status": "success"}
 
 
 @mock.patch.object(LiveKitEventsService, "_handle_room_finished")

src/backend/core/tests/services/test_livekit_events.py

@@ -16,7 +16,6 @@ from core.services.livekit_events import (
     AuthenticationError,
     InvalidPayloadError,
     LiveKitEventsService,
-    UnsupportedEventTypeError,
     api,
 )
 from core.services.lobby import LobbyService
@@ -665,22 +664,27 @@ def test_receive_missing_auth(service):
 
 
 @mock.patch.object(api.WebhookReceiver, "receive")
-def test_receive_unsupported_event(mock_receive, service):
-    """Should raise LiveKitWebhookError for unsupported events."""
+def test_receive_unknown_event_is_acknowledged(mock_receive, service, caplog):
+    """Unknown event types are logged and ignored, not rejected.
+
+    LiveKit adds event types over time and does not retry 4xx responses, so
+    raising here would silently drop the event.
+    """
     mock_request = mock.MagicMock()
     mock_request.headers = {"Authorization": "test_token"}
     mock_request.body = b"{}"
 
-    # Mock returned data with unsupported event type
     mock_data = mock.MagicMock()
     mock_data.room.name = str(uuid.uuid4())
-    mock_data.event = "unsupported_event"
+    mock_data.event = "some_future_event"
     mock_receive.return_value = mock_data
 
-    with pytest.raises(
-        UnsupportedEventTypeError, match="Unknown webhook type: unsupported_event"
-    ):
-        service.receive(mock_request)
+    with caplog.at_level("WARNING", logger="core.services.livekit_events"):
+        service.receive(mock_request)  # must not raise
+
+    assert "Ignoring unknown LiveKit webhook event type 'some_future_event'" in (
+        caplog.text
+    )
 
 
 @mock.patch.object(api.WebhookReceiver, "receive")

src/backend/core/tests/services/test_lobby.py

@@ -2,7 +2,7 @@
 Test lobby service.
 """
 
-# pylint: disable=W0621,W0613, W0212, R0913
+# pylint: disable=W0621,W0613, W0212, R0913, C0302
 # ruff: noqa: PLR0913, PLR0917
 
 import uuid
@@ -14,6 +14,7 @@ from django.core.cache import cache
 from django.http import HttpResponse
 
 import pytest
+from freezegun import freeze_time
 
 from core.factories import RoomFactory, UserFactory, UserResourceAccessFactory
 from core.models import RoleChoices, RoomAccessLevel
@@ -24,7 +25,6 @@ from core.services.lobby import (
     LobbyParticipantStatus,
     LobbyService,
 )
-from core.services.presence import CACHE_SCAN_ITERSIZE
 from core.utils import NotificationError
 
 pytestmark = pytest.mark.django_db
@@ -56,6 +56,7 @@ def participant_dict():
         "username": "test-username",
         "id": "test-participant-id",
         "color": "#123456",
+        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
 
@@ -67,6 +68,7 @@ def participant_data():
         username="test-username",
         id="test-participant-id",
         color="#123456",
+        entered_at="2025-01-01T10:00:00+00:00",
     )
 
 
@@ -78,6 +80,7 @@ def test_lobby_participant_to_dict(participant_data):
     assert result["username"] == "test-username"
     assert result["id"] == "test-participant-id"
     assert result["color"] == "#123456"
+    assert result["entered_at"] == "2025-01-01T10:00:00+00:00"
 
 
 def test_lobby_participant_from_dict_success(participant_dict):
@@ -88,6 +91,20 @@ def test_lobby_participant_from_dict_success(participant_dict):
     assert participant.username == "test-username"
     assert participant.id == "test-participant-id"
     assert participant.color == "#123456"
+    assert participant.entered_at == "2025-01-01T10:00:00+00:00"
+
+
+def test_lobby_participant_from_dict_missing_entered_at():
+    """`entered_at` is mandatory; data without it is rejected."""
+    data = {
+        "status": "waiting",
+        "username": "test-username",
+        "id": "test-participant-id",
+        "color": "#123456",
+    }
+
+    with pytest.raises(LobbyParticipantParsingError, match="Invalid participant data"):
+        LobbyParticipant.from_dict(data)
 
 
 def test_lobby_participant_from_dict_default_status():
@@ -96,6 +113,7 @@ def test_lobby_participant_from_dict_default_status():
         "username": "test-username",
         "id": "test-participant-id",
         "color": "#123456",
+        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
     participant = LobbyParticipant.from_dict(data_without_status)
@@ -121,6 +139,7 @@ def test_lobby_participant_from_dict_invalid_status():
         "username": "test-username",
         "id": "test-participant-id",
         "color": "#123456",
+        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
     with pytest.raises(LobbyParticipantParsingError, match="Invalid participant data"):
@@ -265,6 +284,7 @@ def test_request_entry_public_room(
         username=username,
         id=participant_id,
         color="#123456",
+        entered_at="2025-01-01T10:00:00+00:00",
     )
 
     lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
@@ -303,6 +323,7 @@ def test_request_entry_trusted_room(
         username=username,
         id=participant_id,
         color="#123456",
+        entered_at="2025-01-01T10:00:00+00:00",
     )
 
     lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
@@ -345,6 +366,7 @@ def test_request_entry_new_participant(
         username=username,
         id=participant_id,
         color="#123456",
+        entered_at="2025-01-01T10:00:00+00:00",
     )
     mock_enter.return_value = participant_data
 
@@ -372,6 +394,7 @@ def test_request_entry_waiting_participant(
         username=username,
         id=participant_id,
         color="#123456",
+        entered_at="2025-01-01T10:00:00+00:00",
     )
     lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
     lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
@@ -400,6 +423,7 @@ def test_request_entry_accepted_participant(
         username=username,
         id=participant_id,
         color="#123456",
+        entered_at="2025-01-01T10:00:00+00:00",
     )
     lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
     lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
@@ -440,6 +464,7 @@ def test_request_entry_participant_with_role(
         username=username,
         id=participant_id,
         color="#123456",
+        entered_at="2025-01-01T10:00:00+00:00",
     )
     lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
     lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
@@ -466,18 +491,23 @@ def test_request_entry_participant_with_role(
 def test_refresh_waiting_status(mock_cache, lobby_service, participant_id):
     """Test refreshing waiting status for a participant."""
     lobby_service._get_cache_key = mock.Mock(return_value="mocked_cache_key")
+    lobby_service._index_touch = mock.Mock()
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     lobby_service.refresh_waiting_status(room.id, participant_id)
     mock_cache.touch.assert_called_once_with(
         "mocked_cache_key", settings.LOBBY_WAITING_TIMEOUT
     )
+    lobby_service._index_touch.assert_called_once_with(room.id)
 
 
 # pylint: disable=R0917
 @mock.patch("core.services.lobby.cache")
 @mock.patch("core.utils.generate_color")
 @mock.patch("core.utils.notify_participants")
+@mock.patch("core.services.lobby.LobbyService._index_add")
+@freeze_time("2025-01-01 10:00:00")
 def test_enter_success(
+    mock_index_add,
     mock_notify,
     mock_generate_color,
     mock_cache,
@@ -497,6 +527,7 @@ def test_enter_success(
     assert participant.username == username
     assert participant.id == participant_id
     assert participant.color == "#123456"
+    assert participant.entered_at == "2025-01-01T10:00:00+00:00"
 
     lobby_service._get_cache_key.assert_called_once_with(room.id, participant_id)
 
@@ -508,13 +539,16 @@ def test_enter_success(
     mock_notify.assert_called_once_with(
         room_name=str(room.pk), notification_data={"type": "participantWaiting"}
     )
+    mock_index_add.assert_called_once_with(room.id, participant_id)
 
 
 # pylint: disable=R0917
 @mock.patch("core.services.lobby.cache")
 @mock.patch("core.utils.generate_color")
 @mock.patch("core.utils.notify_participants")
+@mock.patch("core.services.lobby.LobbyService._index_add")
 def test_enter_with_notification_error(
+    mock_index_add,
     mock_notify,
     mock_generate_color,
     mock_cache,
@@ -541,6 +575,7 @@ def test_enter_with_notification_error(
         participant.to_dict(),
         timeout=settings.LOBBY_WAITING_TIMEOUT,
     )
+    mock_index_add.assert_called_once_with(room.id, participant_id)
 
 
 @mock.patch("core.services.lobby.cache")
@@ -579,14 +614,15 @@ def test_get_participant_parsing_error(
 @mock.patch("core.services.lobby.cache")
 def test_list_waiting_participants_empty(mock_cache, lobby_service):
     """Test listing waiting participants when none exist."""
-    mock_cache.iter_keys.return_value = []
-
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    lobby_service._index_members = mock.Mock(return_value=[])
+    lobby_service._index_remove = mock.Mock()
+
     result = lobby_service.list_waiting_participants(room.id)
 
-    assert result == []
-    pattern = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_*"
-    mock_cache.iter_keys.assert_called_once_with(pattern, itersize=CACHE_SCAN_ITERSIZE)
+    assert result == ()
+    lobby_service._index_members.assert_called_once_with(room.id)
+    lobby_service._index_remove.assert_not_called()
     mock_cache.get_many.assert_not_called()
 
 
@@ -595,7 +631,8 @@ def test_list_waiting_participants(mock_cache, lobby_service, participant_dict):
     """Test listing waiting participants with valid data."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     cache_key = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
-    mock_cache.iter_keys.return_value = [cache_key]
+    lobby_service._index_members = mock.Mock(return_value=["participant1"])
+    lobby_service._index_remove = mock.Mock()
     mock_cache.get_many.return_value = {cache_key: participant_dict}
 
     result = lobby_service.list_waiting_participants(room.id)
@@ -603,8 +640,8 @@ def test_list_waiting_participants(mock_cache, lobby_service, participant_dict):
     assert len(result) == 1
     assert result[0]["status"] == "waiting"
     assert result[0]["username"] == "test-username"
-    pattern = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_*"
-    mock_cache.iter_keys.assert_called_once_with(pattern, itersize=CACHE_SCAN_ITERSIZE)
+    lobby_service._index_members.assert_called_once_with(room.id)
+    lobby_service._index_remove.assert_called_once_with(room.id)
     mock_cache.get_many.assert_called_once_with([cache_key])
 
 
@@ -620,6 +657,7 @@ def test_list_waiting_participants_multiple(mock_cache, lobby_service):
         "username": "user1",
         "id": "participant1",
         "color": "#123456",
+        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
     participant2 = {
@@ -627,9 +665,13 @@ def test_list_waiting_participants_multiple(mock_cache, lobby_service):
         "username": "user2",
         "id": "participant2",
         "color": "#654321",
+        "entered_at": "2025-01-01T10:05:00+00:00",
     }
 
-    mock_cache.iter_keys.return_value = [cache_key1, cache_key2]
+    lobby_service._index_members = mock.Mock(
+        return_value=["participant1", "participant2"]
+    )
+    lobby_service._index_remove = mock.Mock()
     mock_cache.get_many.return_value = {
         cache_key1: participant1,
         cache_key2: participant2,
@@ -639,15 +681,15 @@ def test_list_waiting_participants_multiple(mock_cache, lobby_service):
 
     assert len(result) == 2
 
-    # Verify both participants are in the result
-    assert any(p["id"] == "participant1" and p["username"] == "user1" for p in result)
-    assert any(p["id"] == "participant2" and p["username"] == "user2" for p in result)
+    # Most recent entry comes first
+    assert [p["id"] for p in result] == ["participant2", "participant1"]
+    assert result[0]["username"] == "user2"
+    assert result[1]["username"] == "user1"
 
     # Verify all participants have waiting status
     assert all(p["status"] == "waiting" for p in result)
 
-    pattern = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_*"
-    mock_cache.iter_keys.assert_called_once_with(pattern, itersize=CACHE_SCAN_ITERSIZE)
+    lobby_service._index_members.assert_called_once_with(room.id)
     mock_cache.get_many.assert_called_once_with([cache_key1, cache_key2])
 
 
@@ -656,12 +698,13 @@ def test_list_waiting_participants_corrupted_data(mock_cache, lobby_service):
     """Test listing waiting participants with corrupted data."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     cache_key = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
-    mock_cache.iter_keys.return_value = [cache_key]
+    lobby_service._index_members = mock.Mock(return_value=["participant1"])
+    lobby_service._index_remove = mock.Mock()
     mock_cache.get_many.return_value = {cache_key: {"invalid": "data"}}
 
     result = lobby_service.list_waiting_participants(room.id)
 
-    assert result == []
+    assert result == ()
     mock_cache.delete.assert_called_once_with(cache_key)
 
 
@@ -677,11 +720,15 @@ def test_list_waiting_participants_partially_corrupted(mock_cache, lobby_service
         "username": "user2",
         "id": "participant2",
         "color": "#654321",
+        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
     corrupted_participant = {"invalid": "data"}
 
-    mock_cache.iter_keys.return_value = [cache_key1, cache_key2]
+    lobby_service._index_members = mock.Mock(
+        return_value=["participant1", "participant2"]
+    )
+    lobby_service._index_remove = mock.Mock()
     mock_cache.get_many.return_value = {
         cache_key1: corrupted_participant,
         cache_key2: valid_participant,
@@ -699,8 +746,6 @@ def test_list_waiting_participants_partially_corrupted(mock_cache, lobby_service
     mock_cache.delete.assert_called_once_with(cache_key1)
 
     # Verify both cache keys were queried
-    pattern = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_*"
-    mock_cache.iter_keys.assert_called_once_with(pattern, itersize=CACHE_SCAN_ITERSIZE)
     mock_cache.get_many.assert_called_once_with([cache_key1, cache_key2])
 
 
@@ -716,15 +761,20 @@ def test_list_waiting_participants_non_waiting(mock_cache, lobby_service):
         "username": "user1",
         "id": "participant1",
         "color": "#123456",
+        "entered_at": "2025-01-01T10:00:00+00:00",
     }
     participant2 = {
         "status": "accepted",
         "username": "user2",
         "id": "participant2",
         "color": "#654321",
+        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
-    mock_cache.iter_keys.return_value = [cache_key1, cache_key2]
+    lobby_service._index_members = mock.Mock(
+        return_value=["participant1", "participant2"]
+    )
+    lobby_service._index_remove = mock.Mock()
     mock_cache.get_many.return_value = {
         cache_key1: participant1,
         cache_key2: participant2,
@@ -816,10 +866,12 @@ def test_update_participant_status_success(mock_cache, lobby_service, participan
         "username": "test-username",
         "id": participant_id,
         "color": "#123456",
+        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
     mock_cache.get.return_value = participant_dict
     lobby_service._get_cache_key = mock.Mock(return_value="mocked_cache_key")
+    lobby_service._index_touch = mock.Mock()
 
     lobby_service._update_participant_status(
         room.id,
@@ -833,10 +885,12 @@ def test_update_participant_status_success(mock_cache, lobby_service, participan
         "username": "test-username",
         "id": participant_id,
         "color": "#123456",
+        "entered_at": "2025-01-01T10:00:00+00:00",
     }
     mock_cache.set.assert_called_once_with(
         "mocked_cache_key", expected_data, timeout=60
     )
+    lobby_service._index_touch.assert_called_once_with(room.id)
     lobby_service._get_cache_key.assert_called_once_with(room.id, participant_id)
 
 
@@ -857,6 +911,7 @@ def test_clear_room_cache(settings, lobby_service):
             username="participant1",
             id="participant1",
             color="#123456",
+            entered_at="2025-01-01T10:00:00+00:00",
         ),
         timeout=settings.LOBBY_WAITING_TIMEOUT,
     )
@@ -867,6 +922,7 @@ def test_clear_room_cache(settings, lobby_service):
             username="participant2",
             id="participant2",
             color="#123456",
+            entered_at="2025-01-01T10:00:00+00:00",
         ),
         timeout=settings.LOBBY_ACCEPTED_TIMEOUT,
     )
@@ -877,13 +933,18 @@ def test_clear_room_cache(settings, lobby_service):
             username="participant3",
             id="participant3",
             color="#123456",
+            entered_at="2025-01-01T10:00:00+00:00",
         ),
         timeout=settings.LOBBY_DENIED_TIMEOUT,
     )
 
+    for participant_id in ("participant1", "participant2", "participant3"):
+        lobby_service._index_add(room_id, participant_id)
+
     lobby_service.clear_room_cache(room_id)
 
     assert cache.keys(f"test-lobby_{room_id!s}_*") == []
+    assert lobby_service._index_members(room_id) == frozenset()
 
 
 def test_clear_room_empty(settings, lobby_service):
@@ -908,12 +969,16 @@ def test_clear_participant_cache(lobby_service):
         "username": "test-username",
         "id": participant_id,
         "color": "#123456",
+        "entered_at": "2025-01-01T10:00:00+00:00",
     }
     cache.set(cache_key, participant_data, timeout=settings.LOBBY_WAITING_TIMEOUT)
+    lobby_service._index_add(room_id, participant_id)
     assert cache.get(cache_key) is not None
+    assert participant_id in lobby_service._index_members(room_id)
 
     lobby_service.clear_participant_cache(room_id, participant_id)
     assert cache.get(cache_key) is None
+    assert participant_id not in lobby_service._index_members(room_id)
 
 
 def test_clear_participant_cache_nonexistent(lobby_service):
@@ -927,3 +992,85 @@ def test_clear_participant_cache_nonexistent(lobby_service):
     lobby_service.clear_participant_cache(room_id, participant_id)
 
     assert cache.get(cache_key) is None
+
+
+def test_index_add_members_remove_roundtrip(lobby_service):
+    """The room index records, lists and forgets participant ids."""
+    room_id = uuid.uuid4()
+
+    assert lobby_service._index_members(room_id) == frozenset()
+
+    lobby_service._index_add(room_id, "participant1")
+    lobby_service._index_add(room_id, "participant2")
+
+    assert sorted(lobby_service._index_members(room_id)) == [
+        "participant1",
+        "participant2",
+    ]
+
+    # The index carries a backstop TTL so abandoned rooms cannot leak it.
+    ttl = lobby_service._redis().ttl(lobby_service._get_index_key(room_id))
+    assert 0 < ttl <= settings.LOBBY_ACCEPTED_TIMEOUT
+
+    lobby_service._index_remove(room_id, "participant1")
+    assert lobby_service._index_members(room_id) == frozenset(["participant2"])
+
+
+@mock.patch("core.utils.notify_participants")
+def test_enter_registers_participant_in_room_index(
+    mock_notify, lobby_service, participant_id, username
+):
+    """Entering the lobby must index the participant id for the room."""
+    room_id = uuid.uuid4()
+
+    lobby_service.enter(room_id, participant_id, username)
+
+    assert lobby_service._index_members(room_id) == frozenset([participant_id])
+
+
+def test_list_waiting_participants_prunes_stale_index_ids(settings, lobby_service):
+    """Indexed ids whose cache entry expired are pruned and not listed."""
+    settings.LOBBY_KEY_PREFIX = "test-lobby-prune"
+    room_id = uuid.uuid4()
+
+    cache.set(
+        f"test-lobby-prune_{room_id!s}_participant1",
+        {
+            "id": "participant1",
+            "username": "user1",
+            "status": "waiting",
+            "color": "#123456",
+            "entered_at": "2025-01-01T10:00:00+00:00",
+        },
+        timeout=100,
+    )
+    lobby_service._index_add(room_id, "participant1")
+    # participant2 is indexed but its cache entry has expired.
+    lobby_service._index_add(room_id, "participant2")
+
+    result = lobby_service.list_waiting_participants(room_id)
+
+    assert [participant["id"] for participant in result] == ["participant1"]
+    assert lobby_service._index_members(room_id) == frozenset(["participant1"])
+
+
+def test_refresh_waiting_status_rearms_room_index_ttl(lobby_service, participant_id):
+    """A lone waiter's polling must keep the room index alive.
+
+    Regression test: the index backstop TTL is only armed at enter() time,
+    so a participant whose rolling WAITING refreshes outlast it would keep
+    their entry alive while silently vanishing from the moderator list.
+    Refreshing the waiting status must therefore re-arm the index TTL.
+    """
+    room_id = uuid.uuid4()
+    lobby_service._index_add(room_id, participant_id)
+
+    index_key = lobby_service._get_index_key(room_id)
+    redis_client = lobby_service._redis()
+    redis_client.expire(index_key, 10)
+    assert redis_client.ttl(index_key) <= 10
+
+    lobby_service.refresh_waiting_status(room_id, participant_id)
+
+    assert redis_client.ttl(index_key) > 10
+    assert lobby_service._index_members(room_id) == frozenset([participant_id])

src/backend/core/tests/services/test_presence.py

@@ -90,19 +90,18 @@ def test_presence_clear_and_clear_room():
     assert presence.is_marked_present(other_room, "a") is True
 
 
-def test_presence_clear_room_scans_in_pages():
-    """clear_room removes every match, even across several SCAN pages,
-    and only within the room."""
+def test_presence_clear_room_removes_many_entries_and_the_index():
+    """clear_room removes every entry of the room through the index — never
+    a keyspace scan — and leaves other rooms untouched."""
     room_id, other_room = str(uuid4()), str(uuid4())
     presence = PresenceCache()
     for i in range(7):
         presence.mark_present(room_id, f"user-{i}")
     presence.mark_present(other_room, "user-0")
 
-    # An itersize smaller than the match count forces delete_pattern to
-    # page through several SCAN cursors rather than finish in one pass.
-    with mock.patch("core.utils.CACHE_SCAN_ITERSIZE", 3):
-        presence.clear_room(room_id)
+    presence.clear_room(room_id)
 
     assert all(not presence.is_marked_present(room_id, f"user-{i}") for i in range(7))
     assert presence.is_marked_present(other_room, "user-0") is True
+    assert presence._index_members(room_id) == frozenset([])
+    assert presence._index_members(other_room) == frozenset(["user-0"])

src/backend/core/tests/test_external_api_authentication.py

@@ -0,0 +1,96 @@
+"""Tests for the external API ResourceServerBackend."""
+
+from django.core.exceptions import SuspiciousOperation
+
+import pytest
+import responses
+from rest_framework.test import APIClient
+
+from core.external_api.authentication import ResourceServerBackend
+from core.factories import UserFactory
+from core.models import User
+
+pytestmark = pytest.mark.django_db
+
+
+def _payload(sub):
+    return {"sub": sub, "active": True, "scope": "lasuite_meet", "client_id": "app"}
+
+
+def test_resource_server_backend_get_or_create_user_active():
+    """An existing active user matching the sub should be returned."""
+
+    user = UserFactory()
+
+    result = ResourceServerBackend().get_or_create_user(
+        access_token="token", id_token=None, payload=_payload(user.sub)
+    )
+
+    assert result == user
+
+
+def test_resource_server_backend_get_or_create_user_inactive():
+    """An inactive user should be rejected even with a valid token."""
+
+    user = UserFactory(is_active=False)
+
+    with pytest.raises(SuspiciousOperation, match="User account is disabled."):
+        ResourceServerBackend().get_or_create_user(
+            access_token="token", id_token=None, payload=_payload(user.sub)
+        )
+
+
+def test_resource_server_backend_get_or_create_user_creates(settings):
+    """An unknown sub should create an active user when OIDC_CREATE_USER is set."""
+
+    settings.OIDC_CREATE_USER = True
+
+    result = ResourceServerBackend().get_or_create_user(
+        access_token="token", id_token=None, payload=_payload("new-sub")
+    )
+
+    assert result.sub == "new-sub"
+    assert result.is_active is True
+    assert User.objects.filter(sub="new-sub").exists()
+
+
+def test_resource_server_backend_get_or_create_user_no_creation(settings):
+    """An unknown sub should return None when OIDC_CREATE_USER is unset."""
+
+    settings.OIDC_CREATE_USER = False
+
+    result = ResourceServerBackend().get_or_create_user(
+        access_token="token", id_token=None, payload=_payload("new-sub")
+    )
+
+    assert result is None
+    assert not User.objects.filter(sub="new-sub").exists()
+
+
+@responses.activate
+def test_api_rooms_list_resource_server_inactive_user(settings):
+    """End to end: a valid introspected token for an inactive user should get 401."""
+
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+
+    user = UserFactory(is_active=False)
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "active": True,
+            "sub": user.sub,
+            "scope": "openid lasuite_meet rooms:list",
+            "client_id": "app",
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer rs-token")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "login failed" in str(response.data).lower()

src/backend/core/utils.py

@@ -499,6 +499,3 @@ def build_telephony_config():
         "default_country": country,
         "international_phone_number": international,
     }
-
-
-CACHE_SCAN_ITERSIZE = 500

src/backend/meet/settings.py

@@ -469,6 +469,9 @@ class Base(Configuration):
 
     # Sentry
     SENTRY_DSN = values.Value(None, environ_name="SENTRY_DSN")
+    SENTRY_TRACES_SAMPLE_RATE = values.FloatValue(
+        0.0, environ_name="SENTRY_TRACES_SAMPLE_RATE", environ_prefix=None
+    )
 
     # Easy thumbnails
     THUMBNAIL_EXTENSION = "webp"
@@ -865,7 +868,7 @@ class Base(Configuration):
         "room_lobby", environ_name="LOBBY_KEY_PREFIX", environ_prefix=None
     )
     LOBBY_WAITING_TIMEOUT = values.PositiveIntegerValue(
-        3, environ_name="LOBBY_WAITING_TIMEOUT", environ_prefix=None
+        6, environ_name="LOBBY_WAITING_TIMEOUT", environ_prefix=None
     )
     LOBBY_DENIED_TIMEOUT = values.PositiveIntegerValue(
         5, environ_name="LOBBY_DENIED_TIMEOUT", environ_prefix=None
@@ -1110,6 +1113,12 @@ class Base(Configuration):
         environ_prefix=None,
     )
 
+    LOGGING_SILENCED_401_PATHS = values.ListValue(
+        default=["/api/v1.0/users/me/"],
+        environ_name="LOGGING_SILENCED_401_PATHS",
+        environ_prefix=None,
+    )
+
     # Logging
     # We want to make it easy to log to console but by default we log production
     # to Sentry and don't want to log to console.
@@ -1122,10 +1131,16 @@ class Base(Configuration):
                 "style": "{",
             },
         },
+        "filters": {
+            "silence_expected_401": {
+                "()": "core.logging_filters.SilenceExpected401",
+            },
+        },
         "handlers": {
             "console": {
                 "class": "logging.StreamHandler",
                 "formatter": "simple",
+                "filters": ["silence_expected_401"],
             },
         },
         # Override root logger to send it to console
@@ -1136,6 +1151,13 @@ class Base(Configuration):
             ),
         },
         "loggers": {
+            "request.summary": {
+                "level": values.Value(
+                    "WARNING",
+                    environ_name="LOGGING_LEVEL_REQUEST_SUMMARY",
+                    environ_prefix="",
+                )
+            },
             "core": {
                 "handlers": ["console"],
                 "level": values.Value(
@@ -1211,7 +1233,14 @@ class Base(Configuration):
                 dsn=cls.SENTRY_DSN,
                 environment=cls.__name__.lower(),  # build, test, development, production
                 release=get_release(),
-                integrations=[DjangoIntegration()],
+                traces_sample_rate=cls.SENTRY_TRACES_SAMPLE_RATE,
+                integrations=[
+                    DjangoIntegration(
+                        transaction_style="url",
+                        middleware_spans=True,
+                        cache_spans=True,
+                    )
+                ],
             )
             sentry_sdk.set_tag("application", "backend")
 

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.30.0"
+version = "1.31.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",

src/backend/uv.lock

@@ -1187,7 +1187,7 @@ wheels = [
 
 [[package]]
 name = "meet"
-version = "1.30.0"
+version = "1.31.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },

src/frontend/Dockerfile

@@ -42,20 +42,10 @@ ENV VITE_APP_TITLE=${VITE_APP_TITLE}
 RUN npm run build
 
 # ---- Front-end image ----
-FROM nginxinc/nginx-unprivileged:1.30.3-alpine3.23 AS frontend-production
+FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
-
-# Security patches for known CVEs
-RUN apk update && apk upgrade  \
-    libcrypto3>=3.5.7-r0 \
-    libssl3>=3.5.7-r0 \
-    musl \
-    musl-utils \
-    zlib>=1.3.2-r0 \
-    libexpat>=2.8.4-r0 \
-    && apk del curl
-
+RUN apk del curl
 USER nginx
 
 # Un-privileged user running the application

src/frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "meet",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "meet",
-      "version": "1.30.0",
+      "version": "1.31.0",
       "dependencies": {
         "@fontsource-variable/atkinson-hyperlegible-next": "5.3.0",
         "@fontsource-variable/lexend": "5.3.0",

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.30.0",
+  "version": "1.31.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",

src/frontend/src/components/Avatar.tsx

@@ -1,5 +1,5 @@
 import { css, cva, RecipeVariantProps } from '@/styled-system/css'
-import React, { useLayoutEffect, useMemo } from 'react'
+import React, { useMemo } from 'react'
 
 const avatar = cva({
   base: {
@@ -28,24 +28,17 @@ const avatar = cva({
   },
 })
 
-// Instantiating a segmenter is expensive; create it once and reuse it.
 const graphemeSegmenter =
   typeof Intl !== 'undefined' && 'Segmenter' in Intl
     ? new Intl.Segmenter(undefined, { granularity: 'grapheme' })
     : undefined
 
-/**
- * Returns the first user-perceived character. Some Unicode characters span
- * multiple UTF-16 code units, so a naive index into the string can split them
- * and yield a broken glyph.
- */
 const getFirstGrapheme = (value: string): string => {
   if (!value) return ''
   if (graphemeSegmenter) {
     const [first] = graphemeSegmenter.segment(value)
     return first?.segment ?? ''
   }
-  // Fallback: keeps single code points intact (including surrogate pairs).
   return Array.from(value)[0] ?? ''
 }
 
@@ -66,36 +59,6 @@ export type AvatarProps = React.HTMLAttributes<HTMLDivElement> & {
 export const Avatar = React.memo(
   ({ name, bgColor, context, notification, style, ...props }: AvatarProps) => {
     const initials = useMemo(() => getInitials(name), [name])
-    const textRef = React.useRef<SVGTextElement>(null)
-    const [offsetY, setOffsetY] = React.useState(0)
-
-    // Optically center the initials: measure the ink bounding box of the
-    // rendered glyphs and shift them so the box's center sits at the middle
-    // of the viewBox. Works for any font, weight or glyph shape, unlike a
-    // hand-tuned dy offset. getBBox() is in local (pre-transform)
-    // coordinates, so applying the translation never changes the measure.
-    useLayoutEffect(() => {
-      const text = textRef.current
-      if (!text) return
-
-      const center = () => {
-        const box = text.getBBox()
-        // A hidden element measures as an empty box; keep the default then.
-        if (box.height === 0) return
-        setOffsetY(50 - (box.y + box.height / 2))
-      }
-
-      center()
-      // Glyph metrics can change once webfonts finish loading.
-      let cancelled = false
-      document.fonts?.ready.then(() => {
-        if (!cancelled) center()
-      })
-      return () => {
-        cancelled = true
-      }
-    }, [initials])
-
     return (
       <div
         style={{ backgroundColor: bgColor, ...style }}
@@ -108,15 +71,16 @@ export const Avatar = React.memo(
           className={css({ width: '100%', height: '100%', display: 'block' })}
         >
           <text
-            ref={textRef}
             x="50"
-            y="50"
-            transform={`translate(0 ${offsetY})`}
+            y={50}
             textAnchor="middle"
-            dominantBaseline="central"
             fontSize="52"
             fontWeight="500"
             fill="currentColor"
+            className={css({
+              transform:
+                'translateY(calc(var(--avatar-cap-height, 0.7) * 0.5em))',
+            })}
           >
             {initials}
           </text>

src/frontend/src/features/auth/api/fetchUser.ts

@@ -18,7 +18,7 @@ export const fetchUser = (
   }
 ): Promise<ApiUser | false> => {
   return new Promise((resolve, reject) => {
-    fetchApi<ApiUser>('/users/me')
+    fetchApi<ApiUser>('/users/me/')
       .then(resolve)
       .catch((error) => {
         // we assume that a 401 means the user is not logged in

src/frontend/src/features/participantTile/components/ParticipantTile.tsx

@@ -20,6 +20,7 @@ import { Track } from 'livekit-client'
 import { ParticipantPlaceholder } from './ParticipantPlaceholder'
 import { ParticipantTileFocus } from './participantTileFocus/ParticipantTileFocus'
 import { FullScreenShareWarning } from './FullScreenShareWarning'
+import { ScreenShareZoomableVideo } from '@/features/rooms/livekit/components/ScreenShareZoomableVideo'
 import { useTranslation } from 'react-i18next'
 import { getShortcutDescriptorById } from '@/features/shortcuts/catalog'
 import { formatShortcutLabel } from '@/features/shortcuts/formatLabels'
@@ -48,6 +49,8 @@ interface ParticipantTileExtendedProps extends ParticipantTileProps {
   disableTileControls?: boolean
 }
 
+const MOUSE_IDLE_TIME = 3000
+
 export const ParticipantTile: (
   props: ParticipantTileExtendedProps & React.RefAttributes<HTMLDivElement>
 ) => React.ReactNode = /* @__PURE__ */ React.forwardRef<
@@ -89,6 +92,8 @@ export const ParticipantTile: (
   )
 
   const isScreenShare = trackReference.source != Track.Source.Camera
+  const isRemoteScreenShare =
+    isScreenShare && !trackReference.participant.isLocal
   const [hasKeyboardFocus, setHasKeyboardFocus] = React.useState(false)
 
   const participantColor = getParticipantColor(trackReference.participant)
@@ -98,11 +103,38 @@ export const ParticipantTile: (
   })
   const participantName = name || identity || 'Unknown'
 
+  // Hover + idle tracking for the focus overlay (pin, effects, mute buttons).
+  const [isTileHovered, setIsTileHovered] = React.useState(false)
+  const [isIdle, setIsIdle] = React.useState(false)
+  const idleTimerRef = React.useRef<number | null>(null)
+
+  const handleTileMouseMove = React.useCallback(() => {
+    if (idleTimerRef.current) window.clearTimeout(idleTimerRef.current)
+    idleTimerRef.current = window.setTimeout(
+      () => setIsIdle(true),
+      MOUSE_IDLE_TIME
+    )
+    setIsIdle(false)
+  }, [])
+
+  const isOverlayVisible = hasKeyboardFocus || (isTileHovered && !isIdle)
+
+  // tileRef: fullscreen target. setRefs merges it with the forwarded ref on the same node.
+  const tileRef = React.useRef<HTMLDivElement>(null)
+  const setRefs = React.useCallback(
+    (node: HTMLDivElement | null) => {
+      ;(tileRef as React.MutableRefObject<HTMLDivElement | null>).current = node
+      if (typeof ref === 'function') ref(node)
+      else if (ref)
+        (ref as React.MutableRefObject<HTMLDivElement | null>).current = node
+    },
+    [ref]
+  )
+
   const { t } = useTranslation('rooms', { keyPrefix: 'participantTileFocus' })
 
   const interactiveProps = {
     ...elementProps,
-    // Ensure the tile is focusable to expose contextual controls to keyboard users.
     tabIndex: 0,
     'aria-label': t('containerLabel', { name: participantName }),
     onFocus: (event: React.FocusEvent<HTMLDivElement>) => {
@@ -120,8 +152,60 @@ export const ParticipantTile: (
     },
   }
 
+  const isVideoTrack =
+    isTrackReference(trackReference) &&
+    (trackReference.publication?.kind === 'video' ||
+      trackReference.source === Track.Source.Camera ||
+      trackReference.source === Track.Source.ScreenShare)
+
+  let trackMedia: React.ReactNode = null
+  if (isVideoTrack) {
+    // Zoom toolbar stays out of picture-in-picture: that window has its own
+    // document and the fullscreen API is off. Follow-up PR can restore zoom
+    // there without the dead fullscreen button.
+    if (isRemoteScreenShare && !disableTileControls) {
+      trackMedia = (
+        <ScreenShareZoomableVideo
+          trackRef={trackReference}
+          tileRef={tileRef}
+          onSubscriptionStatusChanged={handleSubscribe}
+          manageSubscription={autoManageSubscription}
+        />
+      )
+    } else {
+      trackMedia = (
+        <VideoTrack
+          trackRef={trackReference}
+          onSubscriptionStatusChanged={handleSubscribe}
+          manageSubscription={autoManageSubscription}
+        />
+      )
+    }
+  } else if (isTrackReference(trackReference)) {
+    trackMedia = (
+      <AudioTrack
+        trackRef={trackReference}
+        onSubscriptionStatusChanged={handleSubscribe}
+      />
+    )
+  }
+
   return (
-    <div ref={ref} style={{ position: 'relative' }} {...interactiveProps}>
+    <div
+      ref={setRefs}
+      style={{ position: 'relative' }}
+      {...interactiveProps}
+      onMouseEnter={() => setIsTileHovered(true)}
+      onMouseLeave={() => {
+        setIsTileHovered(false)
+        setIsIdle(false)
+        if (idleTimerRef.current) {
+          window.clearTimeout(idleTimerRef.current)
+          idleTimerRef.current = null
+        }
+      }}
+      onMouseMove={handleTileMouseMove}
+    >
       <TrackRefContextIfNeeded trackRef={trackReference}>
         <ParticipantContextIfNeeded participant={trackReference.participant}>
           {trackReference.participant.isLocal && (
@@ -129,23 +213,7 @@ export const ParticipantTile: (
           )}
           {children ?? (
             <>
-              {isTrackReference(trackReference) &&
-              (trackReference.publication?.kind === 'video' ||
-                trackReference.source === Track.Source.Camera ||
-                trackReference.source === Track.Source.ScreenShare) ? (
-                <VideoTrack
-                  trackRef={trackReference}
-                  onSubscriptionStatusChanged={handleSubscribe}
-                  manageSubscription={autoManageSubscription}
-                />
-              ) : (
-                isTrackReference(trackReference) && (
-                  <AudioTrack
-                    trackRef={trackReference}
-                    onSubscriptionStatusChanged={handleSubscribe}
-                  />
-                )
-              )}
+              {trackMedia}
               <div className="lk-participant-placeholder">
                 <ParticipantPlaceholder
                   color={participantColor}
@@ -164,7 +232,7 @@ export const ParticipantTile: (
           {!disableMetadata && !disableTileControls && (
             <ParticipantTileFocus
               trackRef={trackReference}
-              hasKeyboardFocus={hasKeyboardFocus}
+              isVisible={isOverlayVisible}
             />
           )}
         </ParticipantContextIfNeeded>

src/frontend/src/features/participantTile/components/participantTileFocus/ParticipantTileFocus.tsx

@@ -1,44 +1,22 @@
 import { css } from '@/styled-system/css'
 import { HStack } from '@/styled-system/jsx'
 import { TrackReferenceOrPlaceholder } from '@livekit/components-core'
-import { ReactNode, useEffect, useRef, useState } from 'react'
+import { ReactNode } from 'react'
 import { Track } from 'livekit-client'
 import { useCanMute } from '@/features/rooms/livekit/hooks/useCanMute'
 import { FocusButton } from './FocusButton'
 import { EffectsButton } from './EffectsButton'
 import { MuteButton } from './MuteButton'
-import { ZoomButton } from './ZoomButton'
-
-const MOUSE_IDLE_TIME = 3000
 
 type FadeOverlayProps = {
   children: ReactNode
-  hasKeyboardFocus: boolean
+  isVisible: boolean
 }
 
-const FadeOverlay = ({ children, hasKeyboardFocus }: FadeOverlayProps) => {
-  const [active, setActive] = useState(false)
-  const idleTimerRef = useRef<number | null>(null)
-
-  const clearIdleTimer = () => {
-    if (idleTimerRef.current) window.clearTimeout(idleTimerRef.current)
-  }
-
-  const armIdleTimer = () => {
-    clearIdleTimer()
-    idleTimerRef.current = window.setTimeout(() => {
-      setActive(false)
-    }, MOUSE_IDLE_TIME)
-  }
-
-  const handleActivity = () => {
-    setActive(true)
-    armIdleTimer()
-  }
-
-  useEffect(() => clearIdleTimer, [])
-
-  const isVisible = hasKeyboardFocus || active
+// Pointer-events none so this overlay doesn't block the zoom surface below.
+// Hover and idle tracking therefore lives on the tile, which still receives
+// the pointer events, and comes back in as isVisible.
+const FadeOverlay = ({ children, isVisible }: FadeOverlayProps) => {
   return (
     <div
       className={css({
@@ -50,15 +28,10 @@ const FadeOverlay = ({ children, hasKeyboardFocus }: FadeOverlayProps) => {
         alignItems: 'center',
         width: '100%',
         height: '100%',
+        pointerEvents: 'none',
       })}
       data-visible={isVisible || undefined}
       aria-hidden={!isVisible}
-      onMouseEnter={handleActivity}
-      onMouseMove={handleActivity}
-      onMouseLeave={() => {
-        clearIdleTimer()
-        setActive(false)
-      }}
     >
       {isVisible && children}
     </div>
@@ -67,10 +40,10 @@ const FadeOverlay = ({ children, hasKeyboardFocus }: FadeOverlayProps) => {
 
 export const ParticipantTileFocus = ({
   trackRef,
-  hasKeyboardFocus,
+  isVisible,
 }: {
   trackRef: TrackReferenceOrPlaceholder
-  hasKeyboardFocus: boolean
+  isVisible: boolean
 }) => {
   const participant = trackRef.participant
   const isScreenShare = trackRef.source == Track.Source.ScreenShare
@@ -78,7 +51,7 @@ export const ParticipantTileFocus = ({
   const canMute = useCanMute(participant)
 
   return (
-    <FadeOverlay hasKeyboardFocus={hasKeyboardFocus}>
+    <FadeOverlay isVisible={isVisible}>
       <div
         className={css({
           backgroundColor: 'primaryDark.50',
@@ -87,6 +60,7 @@ export const ParticipantTileFocus = ({
           display: 'flex',
           opacity: 0.6,
           animation: 'overlayIn 200ms linear 300ms backwards',
+          pointerEvents: 'auto',
           _hover: {
             opacity: 0.95,
           },
@@ -94,7 +68,7 @@ export const ParticipantTileFocus = ({
       >
         <HStack gap={0.5} padding={0.5}>
           <FocusButton trackRef={trackRef} />
-          {!isScreenShare ? (
+          {!isScreenShare && (
             <>
               {isLocal ? (
                 <EffectsButton />
@@ -102,8 +76,6 @@ export const ParticipantTileFocus = ({
                 canMute && <MuteButton participant={participant} />
               )}
             </>
-          ) : (
-            !isLocal && <ZoomButton trackRef={trackRef} />
           )}
         </HStack>
       </div>

src/frontend/src/features/participantTile/components/participantTileFocus/ZoomButton.tsx

@@ -1,32 +0,0 @@
-import { TrackReferenceOrPlaceholder } from '@livekit/components-core'
-import { useTranslation } from 'react-i18next'
-import { useFullScreen } from '@/features/rooms/livekit/hooks/useFullScreen'
-import { Button } from '@/primitives'
-import { RiFullscreenLine } from '@remixicon/react'
-
-export const ZoomButton = ({
-  trackRef,
-}: {
-  trackRef: TrackReferenceOrPlaceholder
-}) => {
-  const { t } = useTranslation('rooms', { keyPrefix: 'participantTileFocus' })
-  const { toggleFullScreen, isFullscreenAvailable } = useFullScreen({
-    trackRef,
-  })
-
-  if (!isFullscreenAvailable) {
-    return
-  }
-
-  return (
-    <Button
-      size="sm"
-      variant="primaryTextDark"
-      square
-      tooltip={t('fullScreen')}
-      onPress={() => toggleFullScreen()}
-    >
-      <RiFullscreenLine />
-    </Button>
-  )
-}

src/frontend/src/features/participants/api/enterRoom.ts

@@ -1,5 +1,6 @@
 import { ApiError } from '@/api/ApiError'
 import { fetchApi } from '@/api/fetchApi'
+import { captureEvent } from '@/features/analytics/telemetry'
 import { useMutation, type UseMutationOptions } from '@tanstack/react-query'
 
 export interface EnterRoomParams {
@@ -17,13 +18,23 @@ export const enterRoom = async ({
   allowEntry,
   participantId,
 }: EnterRoomParams): Promise<EnterRoomResponse> => {
-  return await fetchApi<EnterRoomResponse>(`/rooms/${roomId}/enter/`, {
-    method: 'POST',
-    body: JSON.stringify({
-      participant_id: participantId,
-      allow_entry: allowEntry,
-    }),
-  })
+  try {
+    return await fetchApi<EnterRoomResponse>(`/rooms/${roomId}/enter/`, {
+      method: 'POST',
+      body: JSON.stringify({
+        participant_id: participantId,
+        allow_entry: allowEntry,
+      }),
+    })
+  } catch (error) {
+    if (error instanceof ApiError && error.statusCode === 404) {
+      captureEvent('lobby_entry_participant_gone', {
+        room_id: roomId,
+        allow_entry: allowEntry,
+      })
+    }
+    throw error
+  }
 }
 
 export function useEnterRoom(

src/frontend/src/features/participants/api/listWaitingParticipants.ts

@@ -8,6 +8,7 @@ export type WaitingParticipant = {
   status: string
   username: string
   color: string
+  entered_at: string
 }
 
 export type WaitingParticipantsResponse = {

src/frontend/src/features/participants/hooks/useWaitingParticipants.ts

@@ -9,6 +9,14 @@ import {
 } from '../../participants/api/listWaitingParticipants'
 import { reportError } from '@/features/analytics/telemetry'
 
+const toTimestamp = (participant: WaitingParticipant): number =>
+  Date.parse(participant.entered_at)
+
+export const sortWaitingParticipants = (
+  participants: WaitingParticipant[]
+): WaitingParticipant[] =>
+  [...participants].sort((a, b) => toTimestamp(a) - toTimestamp(b))
+
 export const useWaitingParticipants = () => {
   const roomData = useRoomData()
   const roomId = roomData?.id || '' // FIXME - bad practice
@@ -22,7 +30,10 @@ export const useWaitingParticipants = () => {
     })
 
   const waitingParticipants = useMemo(
-    () => (canManageLobby ? waitingData?.participants || [] : []),
+    () =>
+      canManageLobby
+        ? sortWaitingParticipants(waitingData?.participants || [])
+        : [],
     [waitingData, canManageLobby]
   )
 

src/frontend/src/features/rooms/components/LobbyProvider.tsx

@@ -12,8 +12,8 @@ import { keys } from '@/api/queryKeys'
 import { queryClient } from '@/api/queryClient'
 import { ApiError } from '@/api/ApiError'
 
-export const POLL_INTERVAL_MS = 1000
-export const LAZY_POLL_INTERVAL_MS = 10_000
+export const POLL_INTERVAL_MS = 4_000
+export const LAZY_POLL_INTERVAL_MS = 15_000
 
 export const LobbyProvider = () => {
   const room = useRoomContext()
@@ -79,7 +79,7 @@ export const LobbyProvider = () => {
   // 3. Rights regained.
   const prevCanManageLobby = usePrevious(canManageLobby)
   useEffect(() => {
-    if (!prevCanManageLobby && canManageLobby && isConnected) {
+    if (prevCanManageLobby != canManageLobby && isConnected) {
       fetchIfManager()
     }
   }, [

src/frontend/src/features/rooms/components/Rating.tsx

@@ -16,7 +16,7 @@ const Card = styled('div', {
     borderRadius: '0.25rem',
     boxShadow: '',
     width: '100%',
-    maxWidth: '380px',
+    maxWidth: '410px',
     minHeight: '196px',
   },
 })
@@ -229,7 +229,7 @@ const ConfirmationMessage = ({ onNext }: { onNext: () => void }) => {
   return (
     <Card
       style={{
-        maxWidth: '380px',
+        maxWidth: '410px',
         display: 'flex',
         flexDirection: 'column',
         justifyContent: 'center',

src/frontend/src/features/rooms/hooks/useLobby.ts

@@ -8,7 +8,7 @@ import {
 } from '../api/requestEntry'
 
 export const WAIT_TIMEOUT_MS = 600000 // 10 minutes
-export const POLL_INTERVAL_MS = 1000
+export const POLL_INTERVAL_MS = 3_000
 
 export const useLobby = ({
   roomId,

src/frontend/src/features/rooms/livekit/components/ConnectionObserver.tsx

@@ -71,20 +71,30 @@ export const ConnectionObserver = () => {
   useEffect(() => {
     if (!isAnalyticsEnabled) return
 
-    const handleConnection = () => {
+    const handleConnection = async () => {
       // Preserve original connection timestamp across reconnections to measure
       // total session duration from first connect to final disconnect.
       if (connectionStartTimeRef.current != null) return
       connectionStartTimeRef.current = Date.now()
-      void captureMediaEvent('connection-event', {})
+      const participantSid = room.localParticipant.sid
+      const roomSid = await room.getSid().catch(() => undefined)
+      void captureMediaEvent('connection-event', {
+        livekit_room_sid: roomSid,
+        livekit_participant_sid: participantSid,
+      })
     }
 
     const handleReconnect = () => {
       captureEvent('reconnect-event')
     }
 
-    const handleReconnected = () => {
-      captureEvent('reconnected-event')
+    const handleReconnected = async () => {
+      const participantSid = room.localParticipant.sid
+      const roomSid = await room.getSid().catch(() => undefined)
+      captureEvent('reconnected-event', {
+        livekit_room_sid: roomSid,
+        livekit_participant_sid: participantSid,
+      })
     }
 
     const handleSignalingConnect = () => {

src/frontend/src/features/rooms/livekit/components/ScreenShareVideoTrack.tsx

@@ -0,0 +1,26 @@
+import { VideoTrack } from '@livekit/components-react'
+import { type TrackReference } from '@livekit/components-core'
+import { memo } from 'react'
+
+interface ScreenShareVideoTrackProps {
+  trackRef: TrackReference
+  onSubscriptionStatusChanged: (subscribed: boolean) => void
+  manageSubscription?: boolean
+}
+
+// Zoom/pan updates the wrapper transform only; skip VideoTrack re-renders.
+export const ScreenShareVideoTrack = memo(
+  ({
+    trackRef,
+    onSubscriptionStatusChanged,
+    manageSubscription,
+  }: ScreenShareVideoTrackProps) => (
+    <VideoTrack
+      trackRef={trackRef}
+      onSubscriptionStatusChanged={onSubscriptionStatusChanged}
+      manageSubscription={manageSubscription}
+    />
+  )
+)
+
+ScreenShareVideoTrack.displayName = 'ScreenShareVideoTrack'

src/frontend/src/features/rooms/livekit/components/ScreenShareZoomControls.tsx

@@ -0,0 +1,223 @@
+import { css } from '@/styled-system/css'
+import { Button } from '@/primitives'
+import {
+  RiCollapseDiagonalLine,
+  RiExpandDiagonalLine,
+  RiFullscreenExitLine,
+  RiZoomInLine,
+  RiZoomOutLine,
+} from '@remixicon/react'
+import { useTranslation } from 'react-i18next'
+import { Toolbar } from 'react-aria-components'
+import { useCallback, useEffect, useRef, useState } from 'react'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
+import { isMacintosh } from '@/utils/livekit'
+import { srOnly } from '@/styles/a11y'
+
+interface ScreenShareZoomControlsProps {
+  containerRef: React.RefObject<HTMLDivElement | null>
+  isZoomed: boolean
+  zoomPercentage: number
+  canZoomIn: boolean
+  canZoomOut: boolean
+  onZoomIn: () => void
+  onZoomOut: () => void
+  onResetZoom: () => void
+}
+
+export const ScreenShareZoomControls = ({
+  containerRef,
+  isZoomed,
+  zoomPercentage,
+  canZoomIn,
+  canZoomOut,
+  onZoomIn,
+  onZoomOut,
+  onResetZoom,
+}: ScreenShareZoomControlsProps) => {
+  const { t } = useTranslation('rooms', { keyPrefix: 'screenShareZoom' })
+  const announce = useScreenReaderAnnounce()
+
+  const zoomInButtonRef = useRef<HTMLButtonElement>(null)
+  const hadFocusInCollapsibleRef = useRef(false)
+
+  const [isFullscreen, setIsFullscreen] = useState(false)
+  // Tracks whether this tile's container triggered fullscreen (vs another share's).
+  const wasThisTileFullscreen = useRef(false)
+  const isFullscreenAvailable = document.fullscreenEnabled
+
+  // Covers Esc and browser UI exits, not just the toolbar button.
+  // Only this tile's instance announces to avoid duplicates with multiple shares.
+  useEffect(() => {
+    const onChange = () => {
+      const isThisTileFullscreen =
+        document.fullscreenElement === containerRef.current
+      setIsFullscreen(isThisTileFullscreen)
+
+      if (isThisTileFullscreen) {
+        wasThisTileFullscreen.current = true
+        announce(t('fullScreenEntered'), 'assertive')
+      } else if (wasThisTileFullscreen.current) {
+        wasThisTileFullscreen.current = false
+        announce(t('fullScreenExited'), 'assertive')
+      }
+    }
+    document.addEventListener('fullscreenchange', onChange)
+    return () => document.removeEventListener('fullscreenchange', onChange)
+  }, [announce, t, containerRef])
+
+  // Back at 100 % the collapsible controls are disabled and hidden, which drops
+  // keyboard focus on the body. Hand it to the zoom in button instead, the only
+  // control of that group still reachable.
+  useEffect(() => {
+    if (isZoomed || !hadFocusInCollapsibleRef.current) return
+    hadFocusInCollapsibleRef.current = false
+    zoomInButtonRef.current?.focus()
+  }, [isZoomed])
+
+  const toggleFullScreen = useCallback(async () => {
+    try {
+      if (document.fullscreenElement === containerRef.current) {
+        await document.exitFullscreen()
+      } else {
+        // Tile container so zoom controls stay visible in fullscreen.
+        await containerRef.current?.requestFullscreen()
+      }
+    } catch (error) {
+      console.error('Error toggling fullscreen:', error)
+    }
+  }, [containerRef])
+
+  const wheelShortcut = t(isMacintosh() ? 'wheelShortcutMac' : 'wheelShortcut')
+
+  return (
+    <div
+      className={css({
+        position: 'absolute',
+        bottom: '12px',
+        right: '12px',
+        zIndex: 2,
+        pointerEvents: 'auto',
+      })}
+    >
+      {/* react-aria Toolbar: left/right arrows move between the controls and
+          Tab leaves the group as a whole, as the toolbar role implies. */}
+      <Toolbar
+        aria-label={t('toolbarLabel')}
+        className={css({
+          display: 'flex',
+          alignItems: 'center',
+          backgroundColor: 'primaryDark.50',
+          borderRadius: '2rem',
+          padding: '0.5rem',
+          opacity: 0.7,
+          transition: 'opacity 200ms linear',
+          _hover: {
+            opacity: 0.95,
+          },
+        })}
+      >
+        <span className={srOnly}>
+          {t(isMacintosh() ? 'wheelShortcutHintMac' : 'wheelShortcutHint')}
+        </span>
+        {/* Animated wrapper: collapses to 0 when not zoomed. padding/margin
+            trick keeps overflow:hidden from clipping focus rings. */}
+        <div
+          className={css({
+            display: 'flex',
+            alignItems: 'center',
+            overflow: 'hidden',
+            transition: 'max-width 200ms ease-out, opacity 200ms ease-out',
+            padding: '3px',
+            margin: '-3px',
+          })}
+          style={{
+            maxWidth: isZoomed ? '12rem' : '0',
+            opacity: isZoomed ? 1 : 0,
+          }}
+          aria-hidden={!isZoomed}
+          onFocus={() => {
+            hadFocusInCollapsibleRef.current = true
+          }}
+          onBlur={(e) => {
+            // Disabling a focused button blurs it with no relatedTarget, so the
+            // flag must survive that case for the effect above to rescue focus.
+            if (e.relatedTarget) hadFocusInCollapsibleRef.current = false
+          }}
+        >
+          <Button
+            size="sm"
+            variant="primaryTextDark"
+            square
+            tooltip={t('fitToWindow')}
+            aria-label={t('fitToWindow')}
+            isDisabled={!isZoomed}
+            onPress={onResetZoom}
+          >
+            <RiFullscreenExitLine size={20} />
+          </Button>
+          <Button
+            size="sm"
+            variant="primaryTextDark"
+            square
+            tooltip={t('zoomOutWithShortcut', {
+              shortcut: wheelShortcut,
+            })}
+            aria-label={t('zoomOut')}
+            isDisabled={!isZoomed || !canZoomOut}
+            onPress={onZoomOut}
+          >
+            <RiZoomOutLine size={20} />
+          </Button>
+          {/* Visual only - zoom level is announced via useScreenReaderAnnounce. */}
+          <span
+            aria-hidden="true"
+            className={css({
+              color: 'white',
+              fontSize: '0.8125rem',
+              fontWeight: 500,
+              minWidth: '3.25rem',
+              textAlign: 'center',
+              userSelect: 'none',
+              display: 'flex',
+              alignItems: 'center',
+              justifyContent: 'center',
+              padding: '0 0.25rem',
+              whiteSpace: 'nowrap',
+            })}
+          >
+            {zoomPercentage} %
+          </span>
+        </div>
+        <Button
+          ref={zoomInButtonRef}
+          size="sm"
+          variant="primaryTextDark"
+          square
+          tooltip={t('zoomInWithShortcut', { shortcut: wheelShortcut })}
+          aria-label={t('zoomIn')}
+          isDisabled={!canZoomIn}
+          onPress={onZoomIn}
+        >
+          <RiZoomInLine size={20} />
+        </Button>
+        {isFullscreenAvailable && (
+          <Button
+            size="sm"
+            variant="primaryTextDark"
+            square
+            tooltip={isFullscreen ? t('exitFullScreen') : t('fullScreen')}
+            aria-label={isFullscreen ? t('exitFullScreen') : t('fullScreen')}
+            onPress={toggleFullScreen}
+          >
+            {isFullscreen ? (
+              <RiCollapseDiagonalLine size={20} />
+            ) : (
+              <RiExpandDiagonalLine size={20} />
+            )}
+          </Button>
+        )}
+      </Toolbar>
+    </div>
+  )
+}

src/frontend/src/features/rooms/livekit/components/ScreenShareZoomableVideo.tsx

@@ -0,0 +1,106 @@
+import { css } from '@/styled-system/css'
+import { type TrackReference } from '@livekit/components-core'
+import { useEffect, useRef } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useScreenShareZoom } from '../hooks/useScreenShareZoom'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
+import { ScreenShareZoomControls } from './ScreenShareZoomControls'
+import { ScreenShareVideoTrack } from './ScreenShareVideoTrack'
+
+interface ScreenShareZoomableVideoProps {
+  trackRef: TrackReference
+  tileRef: React.RefObject<HTMLDivElement | null>
+  onSubscriptionStatusChanged: (subscribed: boolean) => void
+  manageSubscription?: boolean
+}
+
+export const ScreenShareZoomableVideo = ({
+  trackRef,
+  tileRef,
+  onSubscriptionStatusChanged,
+  manageSubscription,
+}: ScreenShareZoomableVideoProps) => {
+  const zoom = useScreenShareZoom()
+  const { t } = useTranslation('rooms', { keyPrefix: 'screenShareZoom' })
+  const announce = useScreenReaderAnnounce()
+
+  // SR announcement: announce zoom level on change, with a one-time pan hint
+  // on the first zoom above 100 % per session.
+  const prevZoomRef = useRef(zoom.zoomPercentage)
+  const hasAnnouncedPanHint = useRef(false)
+  useEffect(() => {
+    if (prevZoomRef.current === zoom.zoomPercentage) return
+    const wasAtDefault = prevZoomRef.current <= 100
+    prevZoomRef.current = zoom.zoomPercentage
+
+    if (wasAtDefault && zoom.isZoomed && !hasAnnouncedPanHint.current) {
+      hasAnnouncedPanHint.current = true
+      announce(t('panHint', { level: zoom.zoomPercentage }), 'polite')
+    } else {
+      announce(t('currentZoomLevel', { level: zoom.zoomPercentage }), 'polite')
+    }
+
+    if (!zoom.isZoomed) hasAnnouncedPanHint.current = false
+  }, [zoom.zoomPercentage, zoom.isZoomed, announce, t])
+
+  // Attach keyboard listener on the tile container (has tabIndex=0).
+  useEffect(() => {
+    const el = tileRef.current
+    if (!el) return
+    el.addEventListener('keydown', zoom.handleKeyDown)
+    return () => el.removeEventListener('keydown', zoom.handleKeyDown)
+  }, [tileRef, zoom.handleKeyDown])
+
+  // Native wheel listener with { passive: false } so preventDefault works.
+  useEffect(() => {
+    const el = zoom.surfaceElRef.current
+    if (!el) return
+    el.addEventListener('wheel', zoom.handleWheel, { passive: false })
+    return () => el.removeEventListener('wheel', zoom.handleWheel)
+  }, [zoom.handleWheel, zoom.surfaceElRef])
+
+  return (
+    <>
+      <div
+        ref={zoom.surfaceElRef}
+        className={css({
+          width: '100%',
+          height: '100%',
+          overflow: 'hidden',
+          position: 'relative',
+          userSelect: 'none',
+          // Leaves the browser's native pinch-zoom available on touch devices
+          // while still routing single-pointer drags to useMove for panning.
+          touchAction: 'pinch-zoom',
+        })}
+        {...zoom.moveProps}
+      >
+        <div
+          ref={zoom.transformElRef}
+          style={{
+            width: '100%',
+            height: '100%',
+            pointerEvents: 'none',
+            transformOrigin: 'center center',
+          }}
+        >
+          <ScreenShareVideoTrack
+            trackRef={trackRef}
+            onSubscriptionStatusChanged={onSubscriptionStatusChanged}
+            manageSubscription={manageSubscription}
+          />
+        </div>
+      </div>
+      <ScreenShareZoomControls
+        containerRef={tileRef}
+        isZoomed={zoom.isZoomed}
+        zoomPercentage={zoom.zoomPercentage}
+        canZoomIn={zoom.canZoomIn}
+        canZoomOut={zoom.canZoomOut}
+        onZoomIn={zoom.zoomIn}
+        onZoomOut={zoom.zoomOut}
+        onResetZoom={zoom.resetZoom}
+      />
+    </>
+  )
+}

src/frontend/src/features/rooms/livekit/components/controls/HandToggle.tsx

@@ -2,7 +2,7 @@ import { useTranslation } from 'react-i18next'
 import { RiHand } from '@remixicon/react'
 import { ToggleButton } from '@/primitives'
 import { css } from '@/styled-system/css'
-import { useRoomContext } from '@livekit/components-react'
+import { useIsSpeaking, useRoomContext } from '@livekit/components-react'
 import { useRaisedHand } from '@/features/rooms/livekit/hooks/useRaisedHand'
 import { useEffect, useRef, useState } from 'react'
 import {
@@ -25,11 +25,11 @@ export const HandToggle = ({
   const { t } = useTranslation('rooms', { keyPrefix: 'controls.hand' })
 
   const room = useRoomContext()
-  const { isHandRaised, toggleRaisedHand } = useRaisedHand({
+  const { isHandRaised, toggleRaisedHand, lowerHand } = useRaisedHand({
     participant: room.localParticipant,
   })
 
-  const isSpeaking = room.localParticipant.isSpeaking
+  const isSpeaking = useIsSpeaking(room.localParticipant)
   const speakingTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
   const [hasShownToast, setHasShownToast] = useState(false)
 
@@ -57,9 +57,10 @@ export const HandToggle = ({
 
     if (shouldShowToast && !speakingTimerRef.current) {
       speakingTimerRef.current = setTimeout(() => {
+        speakingTimerRef.current = null
         setHasShownToast(true)
         const onClose = () => {
-          if (isHandRaised) toggleRaisedHand()
+          lowerHand()
           resetToastState()
         }
         showLowerHandToast(room.localParticipant, onClose)
@@ -70,7 +71,17 @@ export const HandToggle = ({
       speakingTimerRef.current = null
     }
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [isSpeaking, isHandRaised, hasShownToast, toggleRaisedHand])
+  }, [isSpeaking, isHandRaised, hasShownToast, lowerHand])
+
+  // Clear any pending timer on unmount
+  useEffect(() => {
+    return () => {
+      if (speakingTimerRef.current) {
+        clearTimeout(speakingTimerRef.current)
+        speakingTimerRef.current = null
+      }
+    }
+  }, [])
 
   const tooltipLabel = isHandRaised ? 'lower' : 'raise'
 

src/frontend/src/features/rooms/livekit/hooks/useRaisedHand.ts

@@ -86,5 +86,16 @@ export function useRaisedHand({ participant }: useRaisedHandProps) {
     }
   }
 
-  return { isHandRaised, toggleRaisedHand }
+  const lowerHand = async () => {
+    if (!isLocal(participant)) return
+    try {
+      await raiseHand(false)
+    } catch (e) {
+      reportError('generic_failure', e, {
+        context: 'lower_raised_hand',
+      })
+    }
+  }
+
+  return { isHandRaised, toggleRaisedHand, lowerHand }
 }

src/frontend/src/features/rooms/livekit/hooks/useScreenShareZoom.ts

@@ -0,0 +1,322 @@
+import { useCallback, useRef, useSyncExternalStore } from 'react'
+import { useMove } from 'react-aria'
+import type { MoveMoveEvent } from '@react-types/shared'
+import {
+  FULL_PICTURE_RATIO,
+  MIN_ZOOM,
+  PAN_STEP,
+  WHEEL_ZOOM_SPEED,
+  ZOOM_STEP,
+  type PanOffset,
+  type ZoomSnapshot,
+  buildZoomSnapshot,
+  clampPan,
+  clampZoom,
+  getCursorFromZoomState,
+  getCursorPercentsFromWheelEvent,
+  getPanDeltaPercentsFromMove,
+  getPictureRatio,
+  getWheelPanOffset,
+  getZoomTransform,
+} from '../utils/screenShareZoom'
+
+/**
+ * Manages zoom and pan state for a remote screen share.
+ *
+ * Performance: zoom/pan live in refs and are applied imperatively to the DOM
+ * (via transformElRef / surfaceElRef) so the hot path (drag, wheel) never
+ * triggers a React re-render. A useSyncExternalStore snapshot is flushed only
+ * when the toolbar UI needs to update (zoom level change, drag end).
+ *
+ * Drag/touch panning is handled by react-aria's useMove (moveProps).
+ * The wheel listener (non-passive) zooms on Ctrl/Cmd+scroll and pans on a
+ * two-finger trackpad scroll once zoomed.
+ * Arrow key panning and +/-/0 zoom are on a keydown listener attached to the
+ * tile container (which has tabIndex=0 and focus).
+ */
+export const useScreenShareZoom = () => {
+  const zoomRef = useRef(MIN_ZOOM)
+  const panRef = useRef<PanOffset>({ x: 0, y: 0 })
+  const draggingRef = useRef(false)
+
+  // The consumer binds these to the inner transform div and the outer drag surface.
+  const transformElRef = useRef<HTMLDivElement | null>(null)
+  const surfaceElRef = useRef<HTMLDivElement | null>(null)
+
+  // Snapshot store: subscribers are notified only on explicit flush() calls.
+  const snapshotRef = useRef<ZoomSnapshot>(
+    buildZoomSnapshot(MIN_ZOOM, { x: 0, y: 0 }, false)
+  )
+  const listenersRef = useRef(new Set<() => void>())
+
+  const subscribe = useCallback((cb: () => void) => {
+    listenersRef.current.add(cb)
+    return () => {
+      listenersRef.current.delete(cb)
+    }
+  }, [])
+
+  const getSnapshot = useCallback(() => snapshotRef.current, [])
+
+  const snapshot = useSyncExternalStore(subscribe, getSnapshot, getSnapshot)
+
+  const flush = useCallback(() => {
+    snapshotRef.current = buildZoomSnapshot(
+      zoomRef.current,
+      panRef.current,
+      draggingRef.current
+    )
+    listenersRef.current.forEach((cb) => cb())
+  }, [])
+
+  const applyTransform = useCallback(() => {
+    const el = transformElRef.current
+    if (!el) return
+    el.style.transform = getZoomTransform(zoomRef.current, panRef.current)
+  }, [])
+
+  // The video is letterboxed inside the surface by object-fit: contain, so the
+  // pan bounds depend on how much of the surface the picture actually covers.
+  // Read live rather than cached: both the tile and the shared resolution can
+  // change at any time.
+  const readPictureRatio = useCallback(() => {
+    const surface = surfaceElRef.current
+    const video = transformElRef.current?.querySelector('video')
+    if (!surface || !video) return FULL_PICTURE_RATIO
+    return getPictureRatio(
+      surface.clientWidth,
+      surface.clientHeight,
+      video.videoWidth,
+      video.videoHeight
+    )
+  }, [])
+
+  const applyCursor = useCallback(() => {
+    const el = surfaceElRef.current
+    if (!el) return
+    el.style.cursor = getCursorFromZoomState(
+      zoomRef.current,
+      draggingRef.current
+    )
+  }, [])
+
+  // After the video moves to the other window, write the current zoom back
+  // on the new nodes (otherwise it looks like 100 % until the next scroll).
+  const resync = useCallback(() => {
+    panRef.current = clampPan(
+      panRef.current,
+      zoomRef.current,
+      readPictureRatio()
+    )
+    applyTransform()
+    applyCursor()
+    flush()
+  }, [applyCursor, applyTransform, flush, readPictureRatio])
+
+  const setZoom = useCallback(
+    (next: number) => {
+      zoomRef.current = next
+      panRef.current =
+        next <= MIN_ZOOM
+          ? { x: 0, y: 0 }
+          : clampPan(panRef.current, next, readPictureRatio())
+      applyTransform()
+      applyCursor()
+      flush()
+    },
+    [applyTransform, applyCursor, flush, readPictureRatio]
+  )
+
+  const zoomIn = useCallback(
+    () => setZoom(clampZoom(zoomRef.current + ZOOM_STEP)),
+    [setZoom]
+  )
+
+  const zoomOut = useCallback(
+    () => setZoom(clampZoom(zoomRef.current - ZOOM_STEP)),
+    [setZoom]
+  )
+
+  const resetZoom = useCallback(() => setZoom(MIN_ZOOM), [setZoom])
+
+  // Must be attached with { passive: false } so preventDefault() blocks
+  // the browser's native Ctrl+scroll page zoom. Trackpad pinch arrives
+  // here as a wheel event with ctrl/cmd already set.
+  const handleWheel = useCallback(
+    (e: WheelEvent) => {
+      if (e.ctrlKey || e.metaKey) {
+        e.preventDefault()
+        e.stopPropagation()
+
+        const target = e.currentTarget as HTMLElement
+        const prev = zoomRef.current
+        const delta = -e.deltaY * WHEEL_ZOOM_SPEED
+        const next = clampZoom(prev + delta)
+
+        if (next <= MIN_ZOOM) {
+          zoomRef.current = MIN_ZOOM
+          panRef.current = { x: 0, y: 0 }
+        } else {
+          const { cursorXPercent, cursorYPercent } =
+            getCursorPercentsFromWheelEvent(e, target)
+          zoomRef.current = next
+          panRef.current = getWheelPanOffset({
+            pan: panRef.current,
+            prevZoom: prev,
+            nextZoom: next,
+            cursorXPercent,
+            cursorYPercent,
+            ratio: readPictureRatio(),
+          })
+        }
+
+        applyTransform()
+        applyCursor()
+        flush()
+        return
+      }
+
+      // Two-finger trackpad scroll: pan only once zoomed, otherwise leave
+      // the event alone so the page can still scroll.
+      if (zoomRef.current <= MIN_ZOOM) return
+
+      const el = surfaceElRef.current
+      if (!el) return
+
+      e.preventDefault()
+      e.stopPropagation()
+
+      const { deltaXPercent, deltaYPercent } = getPanDeltaPercentsFromMove(
+        -e.deltaX,
+        -e.deltaY,
+        el
+      )
+      panRef.current = clampPan(
+        {
+          x: panRef.current.x + deltaXPercent,
+          y: panRef.current.y + deltaYPercent,
+        },
+        zoomRef.current,
+        readPictureRatio()
+      )
+      applyTransform()
+    },
+    [applyTransform, applyCursor, flush, readPictureRatio]
+  )
+
+  // useMove handles mouse drag + touch pan. Keyboard arrows are not handled
+  // here because moveProps is on the zoom surface, while focus is on the tile
+  // container, see handleKeyDown below.
+  const { moveProps } = useMove({
+    onMoveStart() {
+      if (zoomRef.current <= MIN_ZOOM) return
+      draggingRef.current = true
+      applyCursor()
+      flush()
+    },
+    onMove(e: MoveMoveEvent) {
+      if (zoomRef.current <= MIN_ZOOM) return
+
+      const el = surfaceElRef.current
+      if (!el) return
+
+      const { deltaXPercent, deltaYPercent } = getPanDeltaPercentsFromMove(
+        e.deltaX,
+        e.deltaY,
+        el
+      )
+
+      panRef.current = clampPan(
+        {
+          x: panRef.current.x + deltaXPercent,
+          y: panRef.current.y + deltaYPercent,
+        },
+        zoomRef.current,
+        readPictureRatio()
+      )
+
+      applyTransform()
+      // Mouse drag: skip flush (imperative-only) to avoid re-renders per frame.
+      // Keyboard: flush so the toolbar reflects the updated position.
+      if (e.pointerType === 'keyboard') {
+        flush()
+      }
+    },
+    onMoveEnd() {
+      draggingRef.current = false
+      applyTransform()
+      applyCursor()
+      flush()
+    },
+  })
+
+  const panBy = useCallback(
+    (dx: number, dy: number) => {
+      panRef.current = clampPan(
+        { x: panRef.current.x + dx, y: panRef.current.y + dy },
+        zoomRef.current,
+        readPictureRatio()
+      )
+      applyTransform()
+      flush()
+    },
+    [applyTransform, flush, readPictureRatio]
+  )
+
+  // Attached to the tile container (not the zoom surface) where keyboard
+  // focus lives. Arrows pan, +/-/0 zoom.
+  const handleKeyDown = useCallback(
+    (e: KeyboardEvent) => {
+      const isZoomed = zoomRef.current > MIN_ZOOM
+      if (!isZoomed && e.key !== '+' && e.key !== '=') return
+
+      if (e.key.startsWith('Arrow') && e.target !== e.currentTarget) return
+
+      switch (e.key) {
+        case 'ArrowLeft':
+          e.preventDefault()
+          panBy(PAN_STEP, 0)
+          break
+        case 'ArrowRight':
+          e.preventDefault()
+          panBy(-PAN_STEP, 0)
+          break
+        case 'ArrowUp':
+          e.preventDefault()
+          panBy(0, PAN_STEP)
+          break
+        case 'ArrowDown':
+          e.preventDefault()
+          panBy(0, -PAN_STEP)
+          break
+        case '+':
+        case '=':
+          e.preventDefault()
+          zoomIn()
+          break
+        case '-':
+          e.preventDefault()
+          zoomOut()
+          break
+        case '0':
+          e.preventDefault()
+          resetZoom()
+          break
+      }
+    },
+    [panBy, zoomIn, zoomOut, resetZoom]
+  )
+
+  return {
+    ...snapshot,
+    transformElRef,
+    surfaceElRef,
+    moveProps,
+    zoomIn,
+    zoomOut,
+    resetZoom,
+    resync,
+    handleWheel,
+    handleKeyDown,
+  }
+}

src/frontend/src/features/rooms/livekit/utils/screenShareZoom.ts

@@ -0,0 +1,154 @@
+export const MIN_ZOOM = 1
+export const MAX_ZOOM = 4
+export const ZOOM_STEP = 0.1
+export const WHEEL_ZOOM_SPEED = 0.002
+export const PAN_STEP = 5
+
+// Half of a 100 % axis. Geometry, not a tunable: it is both the centre the
+// cursor offset is measured from and the half extent the pan is clamped
+// against, so the two stay consistent by construction.
+export const HALF_EXTENT_PERCENT = 50
+
+export interface PanOffset {
+  x: number
+  y: number
+}
+
+// Fraction of the surface each axis of the picture covers, in [0, 1].
+export interface PictureRatio {
+  x: number
+  y: number
+}
+
+export const FULL_PICTURE_RATIO: PictureRatio = { x: 1, y: 1 }
+
+export interface ZoomSnapshot {
+  zoomLevel: number
+  zoomPercentage: number
+  panOffset: PanOffset
+  isZoomed: boolean
+  isDragging: boolean
+  canZoomIn: boolean
+  canZoomOut: boolean
+}
+
+export const clampZoom = (value: number) => {
+  return Math.max(MIN_ZOOM, Math.min(MAX_ZOOM, value))
+}
+
+// Restrict pan so the picture always covers the view. Pan is a % of the
+// surface, in which object-fit: contain letterboxes the picture: its half
+// extent is `ratio * 50` against a view half extent of 50, and scaling by
+// `zoom` must keep `zoom * (ratio * 50 - |pan|) >= 50`. An axis whose picture
+// is still smaller than the view is pinned to 0, keeping the bars symmetric.
+export const clampPan = (
+  pan: PanOffset,
+  zoom: number,
+  ratio: PictureRatio
+): PanOffset => {
+  const maxPanX = Math.max(0, (ratio.x - 1 / zoom) * HALF_EXTENT_PERCENT)
+  const maxPanY = Math.max(0, (ratio.y - 1 / zoom) * HALF_EXTENT_PERCENT)
+  return {
+    x: Math.max(-maxPanX, Math.min(maxPanX, pan.x)),
+    y: Math.max(-maxPanY, Math.min(maxPanY, pan.y)),
+  }
+}
+
+// Per-axis fraction of the surface covered by an object-fit: contain picture.
+export const getPictureRatio = (
+  surfaceWidth: number,
+  surfaceHeight: number,
+  videoWidth: number,
+  videoHeight: number
+): PictureRatio => {
+  if (!surfaceWidth || !surfaceHeight || !videoWidth || !videoHeight) {
+    return FULL_PICTURE_RATIO
+  }
+  const surfaceRatio = surfaceWidth / surfaceHeight
+  const videoRatio = videoWidth / videoHeight
+  return surfaceRatio > videoRatio
+    ? { x: videoRatio / surfaceRatio, y: 1 }
+    : { x: 1, y: surfaceRatio / videoRatio }
+}
+
+export const buildZoomSnapshot = (
+  zoom: number,
+  pan: PanOffset,
+  dragging: boolean
+): ZoomSnapshot => {
+  return {
+    zoomLevel: zoom,
+    zoomPercentage: Math.round(zoom * 100),
+    panOffset: pan,
+    isZoomed: zoom > MIN_ZOOM,
+    isDragging: dragging,
+    canZoomIn: zoom < MAX_ZOOM,
+    canZoomOut: zoom > MIN_ZOOM,
+  }
+}
+
+export const getZoomTransform = (zoom: number, pan: PanOffset) => {
+  return `scale(${zoom}) translate(${pan.x}%, ${pan.y}%)`
+}
+
+export const getCursorFromZoomState = (zoom: number, dragging: boolean) => {
+  if (zoom <= MIN_ZOOM) return 'default'
+  return dragging ? 'grabbing' : 'grab'
+}
+
+// Keep the content point under the cursor anchored while zooming. With
+// `scale(z) translate(pan%)`, a point at `offset` from the center renders at
+// `z * (offset + pan)`, so holding it still gives:
+// pan' = pan + cursor * (1 / zoom' - 1 / zoom).
+export const getWheelPanOffset = ({
+  pan,
+  prevZoom,
+  nextZoom,
+  cursorXPercent,
+  cursorYPercent,
+  ratio,
+}: {
+  pan: PanOffset
+  prevZoom: number
+  nextZoom: number
+  cursorXPercent: number
+  cursorYPercent: number
+  ratio: PictureRatio
+}): PanOffset => {
+  const panShift = 1 / nextZoom - 1 / prevZoom
+  return clampPan(
+    {
+      x: pan.x + cursorXPercent * panShift,
+      y: pan.y + cursorYPercent * panShift,
+    },
+    nextZoom,
+    ratio
+  )
+}
+
+// Convert cursor pixel position to a % offset from the surface center.
+export const getCursorPercentsFromWheelEvent = (
+  e: WheelEvent,
+  target: HTMLElement
+) => {
+  const rect = target.getBoundingClientRect()
+  return {
+    cursorXPercent:
+      ((e.clientX - rect.left) / rect.width) * 100 - HALF_EXTENT_PERCENT,
+    cursorYPercent:
+      ((e.clientY - rect.top) / rect.height) * 100 - HALF_EXTENT_PERCENT,
+  }
+}
+
+// Convert useMove pixel deltas to % of the surface dimensions.
+export const getPanDeltaPercentsFromMove = (
+  deltaX: number,
+  deltaY: number,
+  surface: HTMLElement
+) => {
+  const rect = surface.getBoundingClientRect()
+  return {
+    deltaXPercent: (deltaX / rect.width) * 100,
+    deltaYPercent: (deltaY / rect.height) * 100,
+  }
+}

src/frontend/src/features/rooms/routes/Feedback.tsx

@@ -24,7 +24,8 @@ const Heading = styled('h1', {
 })
 
 const buttonClass = css({
-  width: { base: '100%', xsm: 'auto' },
+  width: '100%',
+  flex: 1,
 })
 
 enum DisconnectReasonKey {
@@ -64,8 +65,8 @@ const FeedbackRoute = () => {
           <Heading>{t(`feedback.heading.${reasonKey || 'normal'}`)}</Heading>
           <Stack
             direction={{ base: 'column', xsm: 'row' }}
-            width={{ base: '100%', xsm: 'auto' }}
-            maxWidth="380px"
+            width="100%"
+            maxWidth="410px"
           >
             {showBackButton && (
               <Button

src/frontend/src/features/shortcuts/catalog.ts

@@ -16,6 +16,10 @@ export type ShortcutId =
   | 'recording'
   | 'reaction'
   | 'fullscreen'
+  | 'zoom-in'
+  | 'zoom-out'
+  | 'zoom-reset'
+  | 'zoom-pan'
 
 export const getShortcutDescriptorById = (id: ShortcutId) =>
   shortcutCatalog.find((item) => item.id === id)
@@ -24,7 +28,7 @@ export type ShortcutDescriptor = {
   id: ShortcutId
   category: ShortcutCategory
   shortcut?: Shortcut
-  kind?: 'press' | 'longPress'
+  kind?: 'press' | 'longPress' | 'arrows'
   code?: string // used when kind === 'longPress' (KeyboardEvent.code)
   description?: string
 }
@@ -86,4 +90,27 @@ export const shortcutCatalog: ShortcutDescriptor[] = [
     category: 'interaction',
     shortcut: { key: 'P', ctrlKey: true, shiftKey: true },
   },
+  // Screen share zoom keys are unmodified, so they are bound on the focused
+  // tile instead of being registered globally. They are listed here so the
+  // shortcuts panel stays exhaustive.
+  {
+    id: 'zoom-in',
+    category: 'interaction',
+    shortcut: { key: '+' },
+  },
+  {
+    id: 'zoom-out',
+    category: 'interaction',
+    shortcut: { key: '-' },
+  },
+  {
+    id: 'zoom-reset',
+    category: 'interaction',
+    shortcut: { key: '0' },
+  },
+  {
+    id: 'zoom-pan',
+    category: 'interaction',
+    kind: 'arrows',
+  },
 ]

src/frontend/src/features/shortcuts/formatLabels.ts

@@ -25,6 +25,7 @@ export const formatShortcutLabelForSR = (
     shiftLabel,
     plusLabel,
     noShortcutLabel,
+    keyLabels,
   }: {
     controlLabel: string
     commandLabel: string
@@ -33,10 +34,12 @@ export const formatShortcutLabelForSR = (
     shiftLabel: string
     plusLabel: string
     noShortcutLabel: string
+    // Spelled-out names for keys screen readers may skip or mispronounce.
+    keyLabels?: Record<string, string>
   }
 ) => {
   if (!shortcut) return noShortcutLabel
-  const key = shortcut.key?.toUpperCase()
+  const key = keyLabels?.[shortcut.key] ?? shortcut.key?.toUpperCase()
   if (!key) return noShortcutLabel
   const ctrlWord = isMacintosh() ? commandLabel : controlLabel
   const altWord = isMacintosh() ? optionLabel : altLabel

src/frontend/src/features/shortcuts/hooks/useShortcutFormatting.ts

@@ -12,6 +12,9 @@ export const useShortcutFormatting = () => {
 
   const formatVisual = useCallback(
     (shortcut?: Shortcut, code?: string, kind?: string) => {
+      if (kind === 'arrows') {
+        return t('shortcutsPanel.visual.arrows')
+      }
       if (code && kind === 'longPress') {
         const label = getKeyLabelFromCode(code)
         return t('shortcutsPanel.visual.hold', { key: label || '?' })
@@ -23,6 +26,9 @@ export const useShortcutFormatting = () => {
 
   const formatForSR = useCallback(
     (shortcut?: Shortcut, code?: string, kind?: string) => {
+      if (kind === 'arrows') {
+        return t('shortcutsPanel.sr.arrows')
+      }
       if (code && kind === 'longPress') {
         const label = getKeyLabelFromCode(code)
         return t('shortcutsPanel.sr.hold', { key: label || '?' })
@@ -35,6 +41,10 @@ export const useShortcutFormatting = () => {
         shiftLabel: t('shortcutsPanel.sr.shift'),
         plusLabel: t('shortcutsPanel.sr.plus'),
         noShortcutLabel: t('shortcutsPanel.sr.noShortcut'),
+        keyLabels: {
+          '+': t('shortcutsPanel.sr.plusKey'),
+          '-': t('shortcutsPanel.sr.minusKey'),
+        },
       })
     },
     [t]

src/frontend/src/layout/Header.tsx

@@ -35,30 +35,21 @@ const LoginHint = () => {
     <div
       className={css({
         position: 'absolute',
-        top: '103px',
-        right: '110px',
+        top: 'calc(100% + 12px)',
+        right: 0,
         zIndex: '100',
         outline: 'none',
         padding: '1.25rem',
-        maxWidth: '350px',
+        width: 'max-content',
+        maxWidth: 'min(350px, calc(100vw - 2rem))',
         boxShadow: '0 2px 5px rgba(0 0 0 / 0.1)',
         borderRadius: '1rem',
         backgroundColor: 'primary.200',
-        display: 'none',
-        xsm: {
-          display: 'block',
-        },
-        sm: {
-          top: '131px',
-          right: '100px',
-          zIndex: '100',
-        },
         _after: {
           content: '""',
           position: 'absolute',
           top: '-10px',
-          right: '20%',
-          marginLeft: '-10px',
+          right: '1.5rem',
           borderWidth: '0 10px 10px 10px',
           borderStyle: 'solid',
           borderColor: 'transparent transparent #E3E3FB transparent',
@@ -171,12 +162,13 @@ export const Header = () => {
                   <>
                     <div
                       className={css({
+                        position: 'relative',
                         display: { base: 'none', xsm: 'block' },
                       })}
                     >
                       <LoginButton proConnectHint={false} />
+                      <LoginHint />
                     </div>
-                    <LoginHint />
                   </>
                 )}
               {!!user && (

src/frontend/src/locales/de/rooms.json

@@ -480,7 +480,7 @@
       "destination": "Ein neues Dokument wird erstellt auf",
       "destinationUnknown": "Ein neues Dokument wird erstellt",
       "language": "Meeting-Sprache:",
-      "recording": "Auch eine Aufzeichnung starten"
+      "recording": "Auch eine Videoaufzeichnung starten"
     },
     "button": {
       "start": "Meeting-Transkription starten",
@@ -756,6 +756,24 @@
     "muteParticipant": "{{name}} stummschalten",
     "fullScreen": "Vollbild"
   },
+  "screenShareZoom": {
+    "toolbarLabel": "Zoom-Steuerung für Bildschirmfreigabe",
+    "zoomIn": "Vergrößern",
+    "zoomInWithShortcut": "Vergrößern ({{shortcut}})",
+    "zoomOut": "Verkleinern",
+    "zoomOutWithShortcut": "Verkleinern ({{shortcut}})",
+    "wheelShortcut": "Steuerung plus Mausrad",
+    "wheelShortcutMac": "Befehl plus Mausrad",
+    "wheelShortcutHint": "Tastenkürzel: Steuerung plus Mausrad zum Vergrößern oder Verkleinern.",
+    "wheelShortcutHintMac": "Tastenkürzel: Befehl plus Mausrad zum Vergrößern oder Verkleinern.",
+    "fitToWindow": "An Fenster anpassen",
+    "fullScreen": "Vollbild",
+    "exitFullScreen": "Vollbild beenden",
+    "currentZoomLevel": "Zoom {{level}} %",
+    "panHint": "Zoom {{level}} %. Mit der Maus ziehen oder den Fokus zurück auf die Bildschirmfreigabe setzen und mit den Pfeiltasten im Bild navigieren.",
+    "fullScreenEntered": "Vollbild aktiviert",
+    "fullScreenExited": "Vollbild deaktiviert"
+  },
   "shortcutsPanel": {
     "title": "Tastenkürzel",
     "categories": {
@@ -775,7 +793,11 @@
       "raise-hand": "Hand heben oder senken",
       "toggle-chat": "Chat anzeigen/ausblenden",
       "toggle-participants": "Teilnehmende anzeigen/ausblenden",
-      "open-shortcuts-settings": "Tastenkürzel-Einstellungen öffnen"
+      "open-shortcuts-settings": "Tastenkürzel-Einstellungen öffnen",
+      "zoom-in": "In einen geteilten Bildschirm hineinzoomen",
+      "zoom-out": "Aus einem geteilten Bildschirm herauszoomen",
+      "zoom-reset": "Zoom des geteilten Bildschirms zurücksetzen",
+      "zoom-pan": "Im gezoomten geteilten Bildschirm navigieren"
     },
     "sr": {
       "control": "Steuerung",
@@ -785,10 +807,14 @@
       "shift": "Umschalt",
       "plus": "plus",
       "hold": "Halte {{key}} gedrückt",
+      "arrows": "Pfeiltasten",
+      "plusKey": "Plus-Taste",
+      "minusKey": "Minus-Taste",
       "noShortcut": "Kein Tastenkürzel"
     },
     "visual": {
-      "hold": "Halte {{key}} gedrückt"
+      "hold": "Halte {{key}} gedrückt",
+      "arrows": "↑ ↓ ← →"
     }
   },
   "fullScreenWarning": {

src/frontend/src/locales/en/rooms.json

@@ -480,7 +480,7 @@
       "destination": "A new document will be created on",
       "destinationUnknown": "A new document will be created",
       "language": "Meeting language:",
-      "recording": "Also start a recording"
+      "recording": "Also start a video recording"
     },
     "button": {
       "start": "Start transcribing the meeting",
@@ -756,6 +756,24 @@
     "muteParticipant": "Mute {{name}}",
     "fullScreen": "Full screen"
   },
+  "screenShareZoom": {
+    "toolbarLabel": "Screen share zoom controls",
+    "zoomIn": "Zoom in",
+    "zoomInWithShortcut": "Zoom in ({{shortcut}})",
+    "zoomOut": "Zoom out",
+    "zoomOutWithShortcut": "Zoom out ({{shortcut}})",
+    "wheelShortcut": "Control plus scroll wheel",
+    "wheelShortcutMac": "Command plus scroll wheel",
+    "wheelShortcutHint": "Shortcut: Control plus scroll wheel to zoom in or out.",
+    "wheelShortcutHintMac": "Shortcut: Command plus scroll wheel to zoom in or out.",
+    "fitToWindow": "Fit to window",
+    "fullScreen": "Full screen",
+    "exitFullScreen": "Exit full screen",
+    "currentZoomLevel": "Zoom {{level}} %",
+    "panHint": "Zoom {{level}} %. Drag with mouse, or move focus back to the screen share and use arrow keys to navigate the picture.",
+    "fullScreenEntered": "Full screen enabled",
+    "fullScreenExited": "Full screen disabled"
+  },
   "shortcutsPanel": {
     "title": "Keyboard shortcuts",
     "categories": {
@@ -775,7 +793,11 @@
       "raise-hand": "Raise or lower hand",
       "toggle-chat": "Toggle chat",
       "toggle-participants": "Toggle participants",
-      "open-shortcuts-settings": "Open shortcuts settings"
+      "open-shortcuts-settings": "Open shortcuts settings",
+      "zoom-in": "Zoom in on a shared screen",
+      "zoom-out": "Zoom out on a shared screen",
+      "zoom-reset": "Reset the shared screen zoom",
+      "zoom-pan": "Move around a zoomed shared screen"
     },
     "sr": {
       "control": "Control",
@@ -785,10 +807,14 @@
       "shift": "Shift",
       "plus": "plus",
       "hold": "Hold {{key}}",
+      "arrows": "Arrow keys",
+      "plusKey": "Plus key",
+      "minusKey": "Minus key",
       "noShortcut": "No shortcut"
     },
     "visual": {
-      "hold": "Hold {{key}}"
+      "hold": "Hold {{key}}",
+      "arrows": "↑ ↓ ← →"
     }
   },
   "fullScreenWarning": {

src/frontend/src/locales/es/rooms.json

@@ -479,7 +479,7 @@
       "destination": "Se creará un nuevo documento en",
       "destinationUnknown": "Se creará un nuevo documento",
       "language": "Idioma de la reunión:",
-      "recording": "Iniciar también una grabación"
+      "recording": "Iniciar también una grabación de vídeo"
     },
     "button": {
       "start": "Empezar a transcribir la reunión",

src/frontend/src/locales/fr/rooms.json

@@ -480,7 +480,7 @@
       "destination": "Un nouveau document sera créé sur",
       "destinationUnknown": "Un nouveau document sera créé",
       "language": "Langue de la réunion :",
-      "recording": "Démarrer aussi un enregistrement"
+      "recording": "Démarrer aussi un enregistrement vidéo"
     },
     "button": {
       "start": "Commencer à transcrire la réunion",
@@ -756,6 +756,24 @@
     "muteParticipant": "Couper le micro de {{name}}",
     "fullScreen": "Plein écran"
   },
+  "screenShareZoom": {
+    "toolbarLabel": "Contrôles de zoom du partage d'écran",
+    "zoomIn": "Zoomer",
+    "zoomInWithShortcut": "Zoomer ({{shortcut}})",
+    "zoomOut": "Dézoomer",
+    "zoomOutWithShortcut": "Dézoomer ({{shortcut}})",
+    "wheelShortcut": "Contrôle plus molette",
+    "wheelShortcutMac": "Commande plus molette",
+    "wheelShortcutHint": "Raccourci : Contrôle plus molette pour zoomer ou dézoomer.",
+    "wheelShortcutHintMac": "Raccourci : Commande plus molette pour zoomer ou dézoomer.",
+    "fitToWindow": "Ajuster à la fenêtre",
+    "fullScreen": "Plein écran",
+    "exitFullScreen": "Quitter le plein écran",
+    "currentZoomLevel": "Zoom {{level}} %",
+    "panHint": "Zoom {{level}} %. Glissez avec la souris, ou revenez sur le partage d'écran et utilisez les touches fléchées pour naviguer dans l'image.",
+    "fullScreenEntered": "Plein écran activé",
+    "fullScreenExited": "Plein écran désactivé"
+  },
   "shortcutsPanel": {
     "title": "Raccourcis clavier",
     "categories": {
@@ -775,7 +793,11 @@
       "raise-hand": "Lever ou baisser la main",
       "toggle-chat": "Afficher/Masquer le chat",
       "toggle-participants": "Afficher/Masquer les participants",
-      "open-shortcuts-settings": "Ouvrir les réglages des raccourcis"
+      "open-shortcuts-settings": "Ouvrir les réglages des raccourcis",
+      "zoom-in": "Zoomer sur un écran partagé",
+      "zoom-out": "Dézoomer sur un écran partagé",
+      "zoom-reset": "Réinitialiser le zoom de l’écran partagé",
+      "zoom-pan": "Se déplacer dans un écran partagé zoomé"
     },
     "sr": {
       "control": "Contrôle",
@@ -785,10 +807,14 @@
       "shift": "Majuscule",
       "plus": "plus",
       "hold": "Maintenir {{key}}",
+      "arrows": "Touches fléchées",
+      "plusKey": "Touche plus",
+      "minusKey": "Touche moins",
       "noShortcut": "Aucun raccourci"
     },
     "visual": {
-      "hold": "Maintenir {{key}}"
+      "hold": "Maintenir {{key}}",
+      "arrows": "↑ ↓ ← →"
     }
   },
   "fullScreenWarning": {

src/frontend/src/locales/nl/rooms.json

@@ -480,7 +480,7 @@
       "destination": "Er wordt een nieuw document aangemaakt op",
       "destinationUnknown": "Een nieuw document wordt aangemaakt",
       "language": "Vergadertalen:",
-      "recording": "Start ook een opname"
+      "recording": "Start ook een video-opname"
     },
     "button": {
       "start": "Begin met het transcriberen van de vergadering",
@@ -756,6 +756,24 @@
     "muteParticipant": "Demp {{name}}",
     "fullScreen": "Volledig scherm"
   },
+  "screenShareZoom": {
+    "toolbarLabel": "Zoombediening voor schermdeling",
+    "zoomIn": "Inzoomen",
+    "zoomInWithShortcut": "Inzoomen ({{shortcut}})",
+    "zoomOut": "Uitzoomen",
+    "zoomOutWithShortcut": "Uitzoomen ({{shortcut}})",
+    "wheelShortcut": "Control plus scrollwiel",
+    "wheelShortcutMac": "Command plus scrollwiel",
+    "wheelShortcutHint": "Sneltoets: Control plus scrollwiel om in of uit te zoomen.",
+    "wheelShortcutHintMac": "Sneltoets: Command plus scrollwiel om in of uit te zoomen.",
+    "fitToWindow": "Aanpassen aan venster",
+    "fullScreen": "Volledig scherm",
+    "exitFullScreen": "Volledig scherm verlaten",
+    "currentZoomLevel": "Zoom {{level}} %",
+    "panHint": "Zoom {{level}} %. Sleep met de muis, of zet de focus terug op de schermdeling en gebruik de pijltjestoetsen om door het beeld te navigeren.",
+    "fullScreenEntered": "Volledig scherm ingeschakeld",
+    "fullScreenExited": "Volledig scherm uitgeschakeld"
+  },
   "shortcutsPanel": {
     "title": "Sneltoetsen",
     "categories": {
@@ -775,7 +793,11 @@
       "raise-hand": "Hand opsteken of laten zakken",
       "toggle-chat": "Chat tonen/verbergen",
       "toggle-participants": "Deelnemers tonen/verbergen",
-      "open-shortcuts-settings": "Sneltoets-instellingen openen"
+      "open-shortcuts-settings": "Sneltoets-instellingen openen",
+      "zoom-in": "Inzoomen op een gedeeld scherm",
+      "zoom-out": "Uitzoomen op een gedeeld scherm",
+      "zoom-reset": "Zoom van het gedeelde scherm herstellen",
+      "zoom-pan": "Navigeren in een ingezoomd gedeeld scherm"
     },
     "sr": {
       "control": "Control",
@@ -785,10 +807,14 @@
       "shift": "Shift",
       "plus": "plus",
       "hold": "Houd {{key}} ingedrukt",
+      "arrows": "Pijltoetsen",
+      "plusKey": "Plus-toets",
+      "minusKey": "Min-toets",
       "noShortcut": "Geen sneltoets"
     },
     "visual": {
-      "hold": "Houd {{key}} ingedrukt"
+      "hold": "Houd {{key}} ingedrukt",
+      "arrows": "↑ ↓ ← →"
     }
   },
   "fullScreenWarning": {

src/frontend/src/styles/index.css

@@ -6,6 +6,10 @@ body,
   height: 100%;
 }
 
+:root {
+  --avatar-cap-height: 0.7;
+}
+
 html.font-lexend {
   --fonts-sans: 'Lexend Variable', ui-sans-serif, system-ui, sans-serif;
 }

src/frontend/src/utils/auxiliaryWindow.ts

@@ -0,0 +1,90 @@
+// Helpers for a separate window. Not the meeting PiP: that API allows only
+// one window, and it is already used. A blank popup has no CSS, so we copy
+// styles from the meeting.
+
+const AUXILIARY_ROOT_ID = 'root'
+
+export const copyDocumentChrome = (target: Window) => {
+  const { document: targetDoc } = target
+  document.head
+    .querySelectorAll('link[rel="stylesheet"], style')
+    .forEach((node) => {
+      targetDoc.head.appendChild(node.cloneNode(true))
+    })
+
+  targetDoc.documentElement.className = document.documentElement.className
+  targetDoc.documentElement.style.cssText =
+    document.documentElement.style.cssText
+  targetDoc.documentElement.setAttribute(
+    'lang',
+    document.documentElement.lang || 'en'
+  )
+
+  const theme = document.documentElement.dataset.lkTheme
+  if (theme) {
+    targetDoc.documentElement.dataset.lkTheme = theme
+  }
+}
+
+export const ensureAuxiliaryRoot = (
+  target: Window,
+  id = AUXILIARY_ROOT_ID
+) => {
+  const existing = target.document.getElementById(id)
+  if (existing) return existing
+
+  const root = target.document.createElement('div')
+  root.id = id
+  root.style.width = '100%'
+  root.style.height = '100%'
+  target.document.body.appendChild(root)
+  return root
+}
+
+export const initializeAuxiliaryWindow = (
+  target: Window,
+  { title, rootId = AUXILIARY_ROOT_ID }: { title: string; rootId?: string }
+) => {
+  copyDocumentChrome(target)
+  target.document.title = title
+  return ensureAuxiliaryRoot(target, rootId)
+}
+
+// Fill the window and reuse the meeting colors so it does not flash white.
+export const applyAuxiliaryWindowLayout = (target: Window) => {
+  const { document: targetDoc } = target
+  const sourceBody = getComputedStyle(document.body)
+
+  targetDoc.documentElement.style.height = '100%'
+  targetDoc.body.style.margin = '0'
+  targetDoc.body.style.height = '100%'
+  targetDoc.body.style.overflow = 'hidden'
+  targetDoc.body.style.backgroundColor = sourceBody.backgroundColor
+  targetDoc.body.style.color = sourceBody.color
+}
+
+// Match the shared screen size, but keep the window on one display.
+export const getAuxiliaryWindowSize = (
+  video?: Pick<HTMLVideoElement, 'videoWidth' | 'videoHeight'> | null
+) => {
+  const maxWidth = Math.max(320, Math.round(window.screen.availWidth * 0.9))
+  const maxHeight = Math.max(240, Math.round(window.screen.availHeight * 0.9))
+  const videoWidth = video?.videoWidth ?? 0
+  const videoHeight = video?.videoHeight ?? 0
+
+  if (videoWidth > 0 && videoHeight > 0) {
+    const scale = Math.min(maxWidth / videoWidth, maxHeight / videoHeight, 1)
+    return {
+      width: Math.max(320, Math.round(videoWidth * scale)),
+      height: Math.max(240, Math.round(videoHeight * scale)),
+    }
+  }
+
+  return {
+    width: Math.min(1280, maxWidth),
+    height: Math.min(720, maxHeight),
+  }
+}
+
+export const getAuxiliaryWindowFeatures = (width: number, height: number) =>
+  `popup=yes,width=${width},height=${height},resizable=yes,scrollbars=no,status=no,location=no,toolbar=no,menubar=no`

src/mail/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "mail_mjml",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "mail_mjml",
-      "version": "1.30.0",
+      "version": "1.31.0",
       "license": "MIT",
       "dependencies": {
         "@html-to/text-cli": "0.6.1",

src/mail/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mail_mjml",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "description": "An util to generate html and text django's templates from mjml templates",
   "type": "module",
   "dependencies": {

src/sdk/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "sdk",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "sdk",
-      "version": "1.30.0",
+      "version": "1.31.0",
       "license": "ISC",
       "workspaces": [
         "./library",

src/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sdk",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "author": "",
   "license": "ISC",
   "description": "",

src/summary/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "summary"
-version = "1.30.0"
+version = "1.31.0"
 requires-python = ">=3.13"
 dependencies = [
     "fastapi[standard]>=0.105.0",

src/summary/uv.lock

@@ -1507,7 +1507,7 @@ wheels = [
 
 [[package]]
 name = "summary"
-version = "1.30.0"
+version = "1.31.0"
 source = { editable = "." }
 dependencies = [
     { name = "celery" },