diff --git a/README.md b/README.md
index 2ca6c4d..1ea2bb7 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ Think of it as an open-source alternative to **Buffer**, **Hypefury**, **Typeful
 - **Drafts** -- save unfinished posts and come back to them later
 - **Channel management** -- add your social media accounts with platform detection and color coding
 - **Labels** -- categorize posts with colored labels for organization
-- **Media attachments** -- attach several images to a post; every platform publishes the whole set (carousel, gallery or multi-photo, whichever that platform calls it)
+- **Media attachments** -- attach several images to a post and every platform publishes the whole set (carousel, gallery or multi-photo, whichever that platform calls it), or attach one video and it goes out as a video post
 - **Analytics** -- bar charts showing posts per channel, per label, and daily activity
 - **Dashboard** -- at-a-glance stats, upcoming posts, and recent drafts
 - **Native previews** -- see the post as it will look on each selected platform before it goes out
@@ -24,19 +24,22 @@ Think of it as an open-source alternative to **Buffer**, **Hypefury**, **Typeful
 
 ### Supported Platforms
 
-| Platform | Character Limit | Images | Publishing |
-|----------|----------------|--------|------------|
-| X / Twitter | 280 | up to 4 | text, or a post with up to four images |
-| LinkedIn | 3,000 | up to 20 | text, or a post with up to twenty images |
-| Instagram | 2,200 | 1-10 | photo + caption; two or more images publish as a carousel (Business or Creator account, picked up from the connection) |
-| Facebook | 63,206 | no stated cap | text, one photo, or one feed post with several photos, as a Page you manage |
-| TikTok | 2,200 | 1-35 | photo post; the first image is the cover |
-| Bluesky | 300 | up to 4 | text, with images and link cards |
-| Mastodon | 500 | -- | coming soon |
-| Threads | 500 | -- | coming soon |
-
-Attaching more images than a platform accepts fails **that channel only**, with the
-reason on the post, rather than quietly publishing a subset -- the other channels in
+| Platform | Character Limit | Images | Video | Publishing |
+|----------|----------------|--------|-------|------------|
+| X / Twitter | 280 | up to 4 | -- | text, or a post with up to four images |
+| LinkedIn | 3,000 | up to 20 | -- | text, or a post with up to twenty images |
+| Instagram | 2,200 | 1-10 | -- | photo + caption; two or more images publish as a carousel (Business or Creator account, picked up from the connection) |
+| Facebook | 63,206 | no stated cap | yes | text, one photo, one feed post with several photos, or a video, as a Page you manage |
+| TikTok | 2,200 | 1-35 | yes | photo post (the first image is the cover), or a video post |
+| Bluesky | 300 | up to 4 | -- | text, with images and link cards |
+| Mastodon | 500 | -- | -- | coming soon |
+| Threads | 500 | -- | -- | coming soon |
+
+A post carries either images or one video, never both -- no platform here takes a mix.
+
+Attaching more images than a platform accepts, or a video to a channel with no video
+column above, fails **that channel only**, with the reason on the post, rather than
+quietly publishing a subset or publishing the text on its own -- the other channels in
 the fan-out still go out. The composer warns you before you get there.
 
 Connect each account once in Clawnify (Settings → Integrations), then add it as a channel here. Facebook channels are Pages: the channel form lists the Pages the connected account manages so you can pick one.
@@ -100,7 +103,8 @@ database rather than left to the caller.
 ```
 src/
   shared/
-    platforms.ts    -- Platform limits, colours, labels; the media caps the server enforces and the composer warns on
+    platforms.ts    -- Platform limits, colours, labels; which platforms take video, and the media rules the server enforces and the composer warns on
+    media.ts        -- What an attachment is (image or video) and how its type is decided
   server/
     index.ts        -- Hono API with D1 + credentials middleware
     db.ts           -- D1-native database adapter
diff --git a/package.json b/package.json
index 88f299e..7fbcab2 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
   "scripts": {
     "dev": "wrangler d1 execute open-post-db --local --file=src/server/schema.sql && concurrently -n ui,api -c cyan,green \"vite\" \"wrangler dev --port 8787\"",
     "build": "vite build",
-    "test": "esbuild src/server/index.ts --bundle --format=esm --platform=node --outfile=test/.server.mjs && node test/publish-idempotency.mjs"
+    "test": "esbuild src/server/index.ts --bundle --format=esm --platform=node --outfile=test/.server.mjs && node test/publish-idempotency.mjs && node test/video-publishing.mjs"
   },
   "dependencies": {
     "@clawnify/app": "^0.1.0",
diff --git a/src/client/components/post-card.tsx b/src/client/components/post-card.tsx
index 371e611..0f73fa6 100644
--- a/src/client/components/post-card.tsx
+++ b/src/client/components/post-card.tsx
@@ -1,4 +1,4 @@
-import { Clock, Edit2, Trash2, Send, ExternalLink, AlertCircle } from "lucide-preact";
+import { Clock, Edit2, Trash2, Send, ExternalLink, AlertCircle, Hourglass } from "lucide-preact";
 import type { Post, Channel } from "../types";
 import { PLATFORM_LABELS } from "../types";
 import { PostPreview, hasNativePreview } from "./previews";
@@ -33,6 +33,18 @@ function ChannelChip({ ch }: { ch: Channel }) {
   const label = PLATFORM_LABELS[ch.platform] || ch.platform;
   const base = "inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-xs font-medium text-white";
 
+  // Sent, and the platform hasn't ruled on it yet — TikTok only accepts a post
+  // synchronously, the verdict comes later. A pending row carrying a message is
+  // the one that has already gone out; a plain pending row hasn't. Showing them
+  // the same way would hide a post whose fate nobody knows.
+  if (ch.delivery_status === "pending" && ch.delivery_error) {
+    return (
+      <span class={`${base} opacity-75`} style={{ background: ch.color }} title={ch.delivery_error}>
+        {label} <Hourglass size={11} />
+      </span>
+    );
+  }
+
   if (ch.delivery_status === "failed") {
     return (
       <span class={`${base} opacity-60`} style={{ background: ch.color }} title={ch.delivery_error || "Failed to publish"}>
@@ -66,7 +78,7 @@ function ChannelChip({ ch }: { ch: Channel }) {
 export function PostCard({ post, onEdit, onDelete, onPublish, preview }: Props) {
   const excerpt = post.content.length > 140 ? post.content.slice(0, 140) + "..." : post.content;
   const previewChannel = preview ? post.channels.find((ch) => hasNativePreview(ch.platform)) : undefined;
-  const firstImage = post.media[0]?.url;
+  const firstMedia = post.media[0];
   const timeLabel = post.scheduled_at
     ? new Date(post.scheduled_at + (post.scheduled_at.includes("T") ? "" : "T00:00:00"))
         .toLocaleDateString("en-US", { month: "short", day: "numeric", hour: "2-digit", minute: "2-digit" })
@@ -75,7 +87,7 @@ export function PostCard({ post, onEdit, onDelete, onPublish, preview }: Props)
   return (
     <div class="bg-card border border-border rounded-lg p-4 hover:shadow-md transition-shadow">
       {previewChannel ? (
-        <PostPreview channel={previewChannel} content={post.content} imageUrl={firstImage} timeLabel={timeLabel} />
+        <PostPreview channel={previewChannel} content={post.content} media={firstMedia} timeLabel={timeLabel} />
       ) : (
         <p class="text-sm text-foreground leading-relaxed whitespace-pre-wrap">
           {excerpt || "(empty)"}
diff --git a/src/client/components/post-composer.tsx b/src/client/components/post-composer.tsx
index 0d4dd0d..f0d09dc 100644
--- a/src/client/components/post-composer.tsx
+++ b/src/client/components/post-composer.tsx
@@ -1,7 +1,8 @@
 import { useState, useEffect, useMemo } from "preact/hooks";
 import { Send, Save, ArrowLeft, Image, X, Upload, Loader2 } from "lucide-preact";
 import { useApp } from "../context";
-import { PLATFORM_LIMITS, PLATFORM_LABELS, mediaLimitError } from "../types";
+import { PLATFORM_LIMITS, PLATFORM_LABELS, mediaError, mediaShapeError, mediaTypeFromUrl } from "../types";
+import type { MediaItem } from "../types";
 import type { Platform } from "../types";
 import { PostPreview, ChannelTabs } from "./previews";
 
@@ -25,7 +26,7 @@ interface Props {
 }
 
 export function PostComposer({ editId, navigate }: Props) {
-  const { channels, labels, posts, createPost, updatePost, uploadImage } = useApp();
+  const { channels, labels, posts, createPost, updatePost, uploadMedia } = useApp();
 
   const existing = editId ? posts.find((p) => p.id === editId) : null;
 
@@ -38,7 +39,7 @@ export function PostComposer({ editId, navigate }: Props) {
   const [selectedChannels, setSelectedChannels] = useState<number[]>([]);
   const [selectedLabels, setSelectedLabels] = useState<number[]>([]);
   const [scheduledAt, setScheduledAt] = useState("");
-  const [mediaUrls, setMediaUrls] = useState<string[]>([]);
+  const [media, setMedia] = useState<MediaItem[]>([]);
   const [newMediaUrl, setNewMediaUrl] = useState("");
   const [uploading, setUploading] = useState(false);
   const [saving, setSaving] = useState(false);
@@ -56,7 +57,7 @@ export function PostComposer({ editId, navigate }: Props) {
       setSelectedChannels(existing.channels.map((c) => c.id));
       setSelectedLabels(existing.labels.map((l) => l.id));
       setScheduledAt(existing.scheduled_at ? utcToLocalInput(existing.scheduled_at) : "");
-      setMediaUrls(existing.media.map((m) => m.url));
+      setMedia(existing.media.map((m) => ({ url: m.url, type: m.type })));
     }
   }, [existing?.id]);
 
@@ -95,20 +96,26 @@ export function PostComposer({ editId, navigate }: Props) {
     ? previewChannels.some((c) => (overrides[c.id] ?? content).trim())
     : !!content.trim();
 
-  // Selected channels whose platform can't carry this many images. Publishing
-  // fails those channels rather than posting a truncated set, so say it here —
-  // while the images are still on screen and removable — instead of letting it
-  // surface as a delivery error after the fact.
+  // Why a selected channel can't carry these attachments — too many images, a
+  // video that platform has no path for, or a mix no platform takes.
+  // Publishing fails those channels rather than posting a truncated set, so say
+  // it here, while the attachments are still on screen and removable, instead
+  // of letting it surface as a delivery error after the fact.
+  //
+  // The shape errors don't depend on a channel, so they show even before one is
+  // picked: "images or a video, not both" is worth saying the moment it is true.
   const mediaWarnings = useMemo(() => {
     const messages = new Set<string>();
+    const shape = mediaShapeError(media);
+    if (shape) messages.add(shape);
     for (const c of channels) {
       if (!selectedChannels.includes(c.id)) continue;
-      const msg = mediaLimitError(c.platform, mediaUrls.length);
+      const msg = mediaError(c.platform, media);
       // Two channels on the same platform share one message.
       if (msg) messages.add(msg);
     }
     return [...messages];
-  }, [selectedChannels, channels, mediaUrls.length]);
+  }, [selectedChannels, channels, media]);
 
   // Which tab is open: null = the shared draft ("All channels"), otherwise the
   // channel being written and previewed. Falls back to the shared draft when
@@ -158,26 +165,27 @@ export function PostComposer({ editId, navigate }: Props) {
     );
   };
 
+  // A pasted link has only its path to go on, so the extension decides whether
+  // it is a video. An upload doesn't guess — the server reads the file's MIME.
   const addMedia = () => {
-    if (newMediaUrl.trim()) {
-      setMediaUrls((prev) => [...prev, newMediaUrl.trim()]);
-      setNewMediaUrl("");
-    }
+    const url = newMediaUrl.trim();
+    if (!url) return;
+    setMedia((prev) => [...prev, { url, type: mediaTypeFromUrl(url) }]);
+    setNewMediaUrl("");
   };
 
   const uploadFiles = async (files: FileList | null) => {
     if (!files || files.length === 0) return;
     setUploading(true);
     for (const file of Array.from(files)) {
-      if (!file.type.startsWith("image/")) continue;
-      const url = await uploadImage(file);
-      if (url) setMediaUrls((prev) => [...prev, url]);
+      const item = await uploadMedia(file);
+      if (item) setMedia((prev) => [...prev, item]);
     }
     setUploading(false);
   };
 
   const removeMedia = (index: number) => {
-    setMediaUrls((prev) => prev.filter((_, i) => i !== index));
+    setMedia((prev) => prev.filter((_, i) => i !== index));
   };
 
   const handleSave = async (status: string) => {
@@ -197,7 +205,7 @@ export function PostComposer({ editId, navigate }: Props) {
       channel_ids: selectedChannels,
       channel_content,
       label_ids: selectedLabels,
-      media_urls: mediaUrls,
+      media,
     };
     if (editId) {
       await updatePost(editId, data);
@@ -311,12 +319,12 @@ export function PostComposer({ editId, navigate }: Props) {
               ) : (
                 <>
                   <Upload size={18} />
-                  <span><span class="text-foreground font-medium">Upload images</span> or drag &amp; drop</span>
+                  <span><span class="text-foreground font-medium">Upload images or a video</span> or drag &amp; drop</span>
                 </>
               )}
               <input
                 type="file"
-                accept="image/*"
+                accept="image/*,video/*"
                 multiple
                 class="hidden"
                 onChange={(e) => { uploadFiles((e.target as HTMLInputElement).files); (e.target as HTMLInputElement).value = ""; }}
@@ -327,7 +335,7 @@ export function PostComposer({ editId, navigate }: Props) {
             <div class="flex gap-2 mt-2">
               <input
                 type="url"
-                placeholder="…or paste an image URL"
+                placeholder="…or paste an image or video URL"
                 value={newMediaUrl}
                 onInput={(e) => setNewMediaUrl((e.target as HTMLInputElement).value)}
                 onKeyDown={(e) => e.key === "Enter" && addMedia()}
@@ -348,11 +356,17 @@ export function PostComposer({ editId, navigate }: Props) {
                 ))}
               </div>
             )}
-            {mediaUrls.length > 0 && (
+            {media.length > 0 && (
               <div class="flex gap-2 mt-3 flex-wrap">
-                {mediaUrls.map((url, i) => (
+                {media.map((item, i) => (
                   <div key={i} class="relative group w-20 h-20 rounded-md overflow-hidden border border-border">
-                    <img src={url} alt="" class="w-full h-full object-cover" />
+                    {item.type === "video" ? (
+                      // muted + playsinline so the browser paints a first frame
+                      // without the tile becoming something that plays audio.
+                      <video src={item.url} class="w-full h-full object-cover bg-black" muted playsInline preload="metadata" />
+                    ) : (
+                      <img src={item.url} alt="" class="w-full h-full object-cover" />
+                    )}
                     <button
                       class="absolute top-0.5 right-0.5 p-0.5 bg-black/60 text-white rounded-full opacity-0 group-hover:opacity-100 transition-opacity"
                       onClick={() => removeMedia(i)}
@@ -374,7 +388,7 @@ export function PostComposer({ editId, navigate }: Props) {
               <PostPreview
                 channel={activePreviewChannel}
                 content={overrides[activePreviewChannel.id] ?? content}
-                imageUrl={mediaUrls[0]}
+                media={media[0]}
                 timeLabel="Now"
               />
             </div>
diff --git a/src/client/components/previews/facebook-preview.tsx b/src/client/components/previews/facebook-preview.tsx
index 43c003a..3056822 100644
--- a/src/client/components/previews/facebook-preview.tsx
+++ b/src/client/components/previews/facebook-preview.tsx
@@ -1,11 +1,13 @@
 import { useState } from "preact/hooks";
 import { Globe, MoreHorizontal, X, ThumbsUp, MessageCircle, Forward } from "lucide-preact";
+import type { MediaItem } from "../../types";
+import { PreviewMedia } from "./preview-media";
 
 interface Props {
   pageName: string;
   avatarUrl?: string;
   content: string;
-  imageUrl?: string;
+  media?: MediaItem;
   timeLabel?: string;
 }
 
@@ -25,7 +27,7 @@ const ACTIONS = [
   { Icon: Forward, label: "Share" },
 ];
 
-export function FacebookPreview({ pageName, avatarUrl, content, imageUrl, timeLabel }: Props) {
+export function FacebookPreview({ pageName, avatarUrl, content, media, timeLabel }: Props) {
   const [expanded, setExpanded] = useState(false);
 
   const isLong = content.length > COLLAPSE_AT || content.split("\n").length > 5;
@@ -69,10 +71,8 @@ export function FacebookPreview({ pageName, avatarUrl, content, imageUrl, timeLa
         )}
       </div>
 
-      {/* Image */}
-      {imageUrl && (
-        <img src={imageUrl} alt="" class="w-full max-h-[500px] object-cover bg-[#f0f2f5]" />
-      )}
+      {/* Attachment */}
+      <PreviewMedia media={media} class="w-full max-h-[500px] object-cover bg-[#f0f2f5]" />
 
       {/* Action bar */}
       <div class="mx-4 mt-1 border-t border-[#ced0d4] flex items-center justify-around py-1">
diff --git a/src/client/components/previews/generic-preview.tsx b/src/client/components/previews/generic-preview.tsx
index 80e1a81..d7ef0d3 100644
--- a/src/client/components/previews/generic-preview.tsx
+++ b/src/client/components/previews/generic-preview.tsx
@@ -1,10 +1,11 @@
 import { PLATFORM_LABELS } from "../../types";
-import type { Channel } from "../../types";
+import type { Channel, MediaItem } from "../../types";
+import { PreviewMedia } from "./preview-media";
 
 interface Props {
   channel: Channel;
   content: string;
-  imageUrl?: string;
+  media?: MediaItem;
   timeLabel?: string;
 }
 
@@ -17,7 +18,7 @@ function initials(name: string): string {
 
 // Plain text + attachments preview, used for platforms that don't have a
 // native-looking card yet. Mirrors the post's content as it will be sent.
-export function GenericPreview({ channel, content, imageUrl, timeLabel }: Props) {
+export function GenericPreview({ channel, content, media, timeLabel }: Props) {
   return (
     <div class="bg-card rounded-lg border border-border max-w-[552px] overflow-hidden">
       <div class="flex items-center gap-2 px-4 pt-3">
@@ -40,9 +41,7 @@ export function GenericPreview({ channel, content, imageUrl, timeLabel }: Props)
         {content || <span class="text-muted-foreground">What do you want to share?</span>}
       </div>
 
-      {imageUrl && (
-        <img src={imageUrl} alt="" class="w-full max-h-[480px] object-cover bg-muted" />
-      )}
+      <PreviewMedia media={media} class="w-full max-h-[480px] object-cover bg-muted" />
     </div>
   );
 }
diff --git a/src/client/components/previews/index.tsx b/src/client/components/previews/index.tsx
index d471aa2..21da3fb 100644
--- a/src/client/components/previews/index.tsx
+++ b/src/client/components/previews/index.tsx
@@ -1,4 +1,4 @@
-import type { Channel } from "../../types";
+import type { Channel, MediaItem } from "../../types";
 import { PLATFORM_LABELS } from "../../types";
 import { LinkedInPreview } from "./linkedin-preview";
 import { XPreview } from "./x-preview";
@@ -18,13 +18,13 @@ export function hasNativePreview(platform: string): boolean {
 interface Props {
   channel: Channel;
   content: string;
-  imageUrl?: string;
+  media?: MediaItem;
   timeLabel?: string;
 }
 
 // Renders the post as it will appear on the channel's platform — a native card
 // when available, otherwise a generic text+attachments preview.
-export function PostPreview({ channel, content, imageUrl, timeLabel }: Props) {
+export function PostPreview({ channel, content, media, timeLabel }: Props) {
   switch (channel.platform) {
     case "linkedin":
       return (
@@ -33,7 +33,7 @@ export function PostPreview({ channel, content, imageUrl, timeLabel }: Props) {
           authorHeadline={channel.profile_headline || channel.handle || undefined}
           avatarUrl={channel.profile_avatar_url || undefined}
           content={content}
-          imageUrl={imageUrl}
+          media={media}
           timeLabel={timeLabel}
         />
       );
@@ -44,7 +44,7 @@ export function PostPreview({ channel, content, imageUrl, timeLabel }: Props) {
           handle={channel.profile_handle || channel.handle || undefined}
           avatarUrl={channel.profile_avatar_url || undefined}
           content={content}
-          imageUrl={imageUrl}
+          media={media}
           timeLabel={timeLabel}
         />
       );
@@ -54,7 +54,7 @@ export function PostPreview({ channel, content, imageUrl, timeLabel }: Props) {
           username={channel.profile_handle || channel.handle || channel.name}
           avatarUrl={channel.profile_avatar_url || undefined}
           content={content}
-          imageUrl={imageUrl}
+          media={media}
           timeLabel={timeLabel}
         />
       );
@@ -64,7 +64,7 @@ export function PostPreview({ channel, content, imageUrl, timeLabel }: Props) {
           pageName={channel.profile_name || channel.name}
           avatarUrl={channel.profile_avatar_url || undefined}
           content={content}
-          imageUrl={imageUrl}
+          media={media}
           timeLabel={timeLabel}
         />
       );
@@ -74,12 +74,12 @@ export function PostPreview({ channel, content, imageUrl, timeLabel }: Props) {
           username={channel.profile_handle || channel.handle || channel.name}
           avatarUrl={channel.profile_avatar_url || undefined}
           content={content}
-          imageUrl={imageUrl}
+          media={media}
           timeLabel={timeLabel}
         />
       );
     default:
-      return <GenericPreview channel={channel} content={content} imageUrl={imageUrl} timeLabel={timeLabel} />;
+      return <GenericPreview channel={channel} content={content} media={media} timeLabel={timeLabel} />;
   }
 }
 
diff --git a/src/client/components/previews/instagram-preview.tsx b/src/client/components/previews/instagram-preview.tsx
index 350bbd5..d17c652 100644
--- a/src/client/components/previews/instagram-preview.tsx
+++ b/src/client/components/previews/instagram-preview.tsx
@@ -1,11 +1,13 @@
 import { useState } from "preact/hooks";
 import { MoreHorizontal, Heart, MessageCircle, Send, Bookmark, Image as ImageIcon } from "lucide-preact";
+import type { MediaItem } from "../../types";
+import { PreviewMedia } from "./preview-media";
 
 interface Props {
   username: string;
   avatarUrl?: string;
   content: string;
-  imageUrl?: string;
+  media?: MediaItem;
   timeLabel?: string;
 }
 
@@ -23,7 +25,7 @@ function toUsername(name: string): string {
 // Instagram truncates captions after ~125 chars behind a "… more".
 const COLLAPSE_AT = 125;
 
-export function InstagramPreview({ username, avatarUrl, content, imageUrl, timeLabel }: Props) {
+export function InstagramPreview({ username, avatarUrl, content, media, timeLabel }: Props) {
   const [expanded, setExpanded] = useState(false);
   const handle = toUsername(username);
 
@@ -45,9 +47,10 @@ export function InstagramPreview({ username, avatarUrl, content, imageUrl, timeL
         <MoreHorizontal size={18} class="text-[#262626] shrink-0" />
       </div>
 
-      {/* Image (photo-first; IG requires one) */}
-      {imageUrl ? (
-        <img src={imageUrl} alt="" class="w-full aspect-square object-cover bg-[#fafafa]" />
+      {/* Instagram requires an attachment — this app publishes photo posts, so
+          a video here is a channel that will fail rather than a Reel. */}
+      {media ? (
+        <PreviewMedia media={media} class="w-full aspect-square object-cover bg-[#fafafa]" />
       ) : (
         <div class="w-full aspect-square bg-[#fafafa] border-y border-[#efefef] flex flex-col items-center justify-center gap-2 text-[#8e8e8e]">
           <ImageIcon size={32} />
diff --git a/src/client/components/previews/linkedin-preview.tsx b/src/client/components/previews/linkedin-preview.tsx
index 627474f..4805d4d 100644
--- a/src/client/components/previews/linkedin-preview.tsx
+++ b/src/client/components/previews/linkedin-preview.tsx
@@ -1,12 +1,14 @@
 import { useState } from "preact/hooks";
 import { Globe, MoreHorizontal, X, ThumbsUp, MessageSquare, Repeat2, Send } from "lucide-preact";
+import type { MediaItem } from "../../types";
+import { PreviewMedia } from "./preview-media";
 
 interface Props {
   authorName: string;
   authorHeadline?: string;
   avatarUrl?: string;
   content: string;
-  imageUrl?: string;
+  media?: MediaItem;
   timeLabel?: string;
 }
 
@@ -27,7 +29,7 @@ const ACTIONS = [
   { Icon: Send, label: "Send" },
 ];
 
-export function LinkedInPreview({ authorName, authorHeadline, avatarUrl, content, imageUrl, timeLabel }: Props) {
+export function LinkedInPreview({ authorName, authorHeadline, avatarUrl, content, media, timeLabel }: Props) {
   const [expanded, setExpanded] = useState(false);
 
   const isLong = content.length > COLLAPSE_AT || content.split("\n").length > 4;
@@ -74,10 +76,8 @@ export function LinkedInPreview({ authorName, authorHeadline, avatarUrl, content
         )}
       </div>
 
-      {/* Image */}
-      {imageUrl && (
-        <img src={imageUrl} alt="" class="w-full max-h-[480px] object-cover bg-[#f3f2ef]" />
-      )}
+      {/* Attachment */}
+      <PreviewMedia media={media} class="w-full max-h-[480px] object-cover bg-[#f3f2ef]" />
 
       {/* Action bar */}
       <div class="mt-1 border-t border-[#00000014] flex items-center justify-around px-2 py-1">
diff --git a/src/client/components/previews/preview-media.tsx b/src/client/components/previews/preview-media.tsx
new file mode 100644
index 0000000..c612999
--- /dev/null
+++ b/src/client/components/previews/preview-media.tsx
@@ -0,0 +1,17 @@
+import type { MediaItem } from "../../types";
+
+// The post's first attachment, rendered as the platform would show it: an
+// image, or a video the reviewer can actually play.
+//
+// One component rather than an `<img>` in each preview card, because the
+// attachment is the one part of a preview that isn't platform-specific — only
+// its frame is, which is what `class` carries. A preview that quietly rendered
+// a video URL into an <img> would show a broken tile and tell the author their
+// post is broken when it isn't.
+export function PreviewMedia({ media, class: className }: { media?: MediaItem; class: string }) {
+  if (!media) return null;
+  if (media.type === "video") {
+    return <video src={media.url} class={className} controls muted playsInline preload="metadata" />;
+  }
+  return <img src={media.url} alt="" class={className} />;
+}
diff --git a/src/client/components/previews/tiktok-preview.tsx b/src/client/components/previews/tiktok-preview.tsx
index f9df3a9..9aa9d26 100644
--- a/src/client/components/previews/tiktok-preview.tsx
+++ b/src/client/components/previews/tiktok-preview.tsx
@@ -1,10 +1,12 @@
 import { Heart, MessageCircle, Bookmark, Share, Music2, Image as ImageIcon } from "lucide-preact";
+import type { MediaItem } from "../../types";
+import { PreviewMedia } from "./preview-media";
 
 interface Props {
   username: string;
   avatarUrl?: string;
   content: string;
-  imageUrl?: string;
+  media?: MediaItem;
   timeLabel?: string;
 }
 
@@ -21,20 +23,20 @@ function toUsername(name: string): string {
 
 const ACTIONS = [Heart, MessageCircle, Bookmark, Share];
 
-// Photo post only (matches this app's photo-first media model) — rendered as
-// TikTok's full-bleed vertical feed card with the caption + action rail
-// overlaid, rather than the actual short-form video player.
-export function TikTokPreview({ username, avatarUrl, content, imageUrl, timeLabel }: Props) {
+// TikTok's full-bleed vertical feed card, with the caption + action rail
+// overlaid. Carries a photo post or a video: PreviewMedia renders whichever
+// the post actually attached.
+export function TikTokPreview({ username, avatarUrl, content, media, timeLabel }: Props) {
   const handle = toUsername(username);
 
   return (
     <div class="relative bg-black rounded-2xl overflow-hidden w-[280px] aspect-[9/16] text-white mx-auto shadow-sm">
-      {imageUrl ? (
-        <img src={imageUrl} alt="" class="absolute inset-0 w-full h-full object-cover" />
+      {media ? (
+        <PreviewMedia media={media} class="absolute inset-0 w-full h-full object-cover" />
       ) : (
         <div class="absolute inset-0 flex flex-col items-center justify-center gap-2 text-white/40 bg-[#121212]">
           <ImageIcon size={32} />
-          <span class="text-xs">TikTok posts need an image</span>
+          <span class="text-xs">TikTok posts need an image or a video</span>
         </div>
       )}
       <div class="absolute inset-0 bg-gradient-to-t from-black/80 via-black/10 to-transparent" />
diff --git a/src/client/components/previews/x-preview.tsx b/src/client/components/previews/x-preview.tsx
index f2c90d2..00fe242 100644
--- a/src/client/components/previews/x-preview.tsx
+++ b/src/client/components/previews/x-preview.tsx
@@ -1,11 +1,13 @@
 import { MoreHorizontal, BadgeCheck, MessageCircle, Repeat2, Heart, Bookmark, Share } from "lucide-preact";
+import type { MediaItem } from "../../types";
+import { PreviewMedia } from "./preview-media";
 
 interface Props {
   authorName: string;
   handle?: string;
   avatarUrl?: string;
   content: string;
-  imageUrl?: string;
+  media?: MediaItem;
   timeLabel?: string;
 }
 
@@ -23,7 +25,7 @@ function toHandle(handle: string | undefined, name: string): string {
 
 const ACTIONS = [MessageCircle, Repeat2, Heart, Bookmark, Share];
 
-export function XPreview({ authorName, handle, avatarUrl, content, imageUrl, timeLabel }: Props) {
+export function XPreview({ authorName, handle, avatarUrl, content, media, timeLabel }: Props) {
   return (
     <div class="bg-white rounded-2xl border border-[#eff3f4] shadow-sm max-w-[552px] text-[#0f1419] overflow-hidden px-4 py-3">
       {/* Header */}
@@ -50,10 +52,8 @@ export function XPreview({ authorName, handle, avatarUrl, content, imageUrl, tim
         {content || <span class="text-[#536471]">What's happening?</span>}
       </div>
 
-      {/* Image */}
-      {imageUrl && (
-        <img src={imageUrl} alt="" class="mt-3 w-full max-h-[480px] object-cover rounded-2xl border border-[#eff3f4]" />
-      )}
+      {/* Attachment */}
+      <PreviewMedia media={media} class="mt-3 w-full max-h-[480px] object-cover rounded-2xl border border-[#eff3f4]" />
 
       {/* Timestamp */}
       {timeLabel && <div class="mt-3 text-[15px] text-[#536471]">{timeLabel}</div>}
diff --git a/src/client/hooks/use-app.ts b/src/client/hooks/use-app.ts
index 9eaeba2..8c34a65 100644
--- a/src/client/hooks/use-app.ts
+++ b/src/client/hooks/use-app.ts
@@ -1,6 +1,7 @@
 import { useState, useEffect, useCallback } from "preact/hooks";
 import { api } from "../api";
-import type { Post, Channel, Label, Stats } from "../types";
+import { MAX_VIDEO_BYTES } from "../types";
+import type { Post, Channel, Label, Stats, MediaItem, MediaType } from "../types";
 
 export function useAppState() {
   const [posts, setPosts] = useState<Post[]>([]);
@@ -69,14 +70,23 @@ export function useAppState() {
   }, [loadChannels]);
 
   // Upload an image to the app's storage; returns its public URL.
-  const uploadImage = useCallback(async (file: File): Promise<string | null> => {
+  // Upload one image or video. The server answers with the type it read off
+  // the file's own MIME, which is the only authoritative source for it — the
+  // filename lies and the composer would only be guessing.
+  const uploadMedia = useCallback(async (file: File): Promise<MediaItem | null> => {
+    // The server enforces this too; checking first is what stops a 60 MB
+    // upload from spending its whole trip to be rejected on arrival.
+    if (file.type.startsWith("video/") && file.size > MAX_VIDEO_BYTES) {
+      setError(`"${file.name}" is too large — videos are limited to ${Math.round(MAX_VIDEO_BYTES / (1024 * 1024))} MB.`);
+      return null;
+    }
     try {
       const fd = new FormData();
       fd.append("file", file);
       const r = await fetch("/api/upload", { method: "POST", body: fd });
-      const data = (await r.json()) as { url?: string; error?: string };
+      const data = (await r.json()) as { url?: string; type?: MediaType; error?: string };
       if (!r.ok || !data.url) throw new Error(data.error || "Upload failed");
-      return data.url;
+      return { url: data.url, type: data.type === "video" ? "video" : "image" };
     } catch (e: any) { setError(e.message); return null; }
   }, []);
 
@@ -128,7 +138,7 @@ export function useAppState() {
     // the shared draft.
     channel_content?: Record<string, string | null>;
     label_ids?: number[];
-    media_urls?: string[];
+    media?: MediaItem[];
   }) => {
     try {
       const post = await api<Post>("POST", "/api/posts", data);
@@ -144,7 +154,7 @@ export function useAppState() {
     channel_ids?: number[];
     channel_content?: Record<string, string | null>;
     label_ids?: number[];
-    media_urls?: string[];
+    media?: MediaItem[];
   }) => {
     try {
       await api("PUT", `/api/posts/${id}`, data);
@@ -179,7 +189,7 @@ export function useAppState() {
     setCalendarMonth,
     loadPosts, loadStats, loadCalendar,
     createChannel, updateChannel, deleteChannel, syncChannelProfile,
-    uploadImage,
+    uploadMedia,
     createLabel, updateLabel, deleteLabel,
     createPost, updatePost, deletePost, publishPost,
   };
diff --git a/src/client/types.ts b/src/client/types.ts
index 35dbc64..5d2efc5 100644
--- a/src/client/types.ts
+++ b/src/client/types.ts
@@ -12,10 +12,15 @@ export {
   PLATFORM_MEDIA_LIMITS,
   PLATFORM_COLORS,
   PLATFORM_LABELS,
-  mediaLimitError,
+  MAX_VIDEO_BYTES,
+  mediaError,
+  mediaShapeError,
 } from "../shared/platforms";
 export type { Platform } from "../shared/platforms";
 import type { Platform } from "../shared/platforms";
+export { mediaTypeFromUrl } from "../shared/media";
+export type { MediaType, MediaItem } from "../shared/media";
+import type { MediaType } from "../shared/media";
 
 // A Facebook Page the connected account manages (GET /api/platforms/facebook/pages).
 export interface FacebookPage {
@@ -64,7 +69,7 @@ export interface Media {
   id: number;
   post_id: number;
   url: string;
-  type: string;
+  type: MediaType;
   created_at: string;
 }
 
diff --git a/src/server/index.ts b/src/server/index.ts
index ee02e0a..867e7ca 100644
--- a/src/server/index.ts
+++ b/src/server/index.ts
@@ -5,7 +5,9 @@ import type { CredentialServiceBinding, StagedFile } from "./credentials";
 import { publishToBluesky, blueskyProfile, type BlueskyCreds } from "./bluesky";
 import { scheduleDelivery, cancelDelivery, verifyDelivery } from "./queue";
 import { initUploads, uploadsEnabled, putUpload, getUpload, makeKey } from "./uploads";
-import { mediaLimitError } from "../shared/platforms";
+import { mediaError, MAX_VIDEO_BYTES } from "../shared/platforms";
+import { splitMedia, toMediaItem, mediaTypeFromMime, type MediaItem } from "../shared/media";
+import { awaitPublish, tiktokPostUrl } from "./tiktok";
 
 type Env = {
   Bindings: {
@@ -27,6 +29,11 @@ interface PublishResult {
   channel: string;
   platform: string;
   success: boolean;
+  // Handed to the platform, which hasn't said whether it went live yet. Not a
+  // success and not a failure: the row stays `pending` so nothing re-sends it
+  // (a re-send would double-post) and the next delivery re-checks instead.
+  // Only TikTok produces this — its Content Posting API is asynchronous.
+  pending?: boolean;
   error?: string;
   ref?: string;   // platform post id (Postiz: releaseId)
   url?: string;   // link to the live post (Postiz: releaseURL)
@@ -37,7 +44,14 @@ interface PublishResult {
 // delivery. Every platform publishes via Composio execute (executeTool) —
 // Composio holds the real token server-side and permanently redacts raw tokens
 // since the May 2026 incident, so no raw-token path is usable.
-async function publishPost(id: number): Promise<{ published: boolean; results: PublishResult[] } | null> {
+async function publishPost(
+  id: number,
+  // Where to send the follow-up when a platform takes the post but doesn't
+  // finish it while we wait. Optional: without it (and without a
+  // CLAWNIFY_TOKEN) publishing still works, the unconfirmed channel just waits
+  // for the next delivery instead of arranging its own.
+  recheck?: { env: Env["Bindings"]; origin: string },
+): Promise<{ published: boolean; results: PublishResult[] } | null> {
   const post = await get<any>("SELECT * FROM posts WHERE id = ?", [id]);
   if (!post) return null;
 
@@ -57,11 +71,12 @@ async function publishPost(id: number): Promise<{ published: boolean; results: P
      WHERE pc.post_id = ?`,
     [id],
   );
-  const media = await query<any>("SELECT * FROM media WHERE post_id = ? ORDER BY id ASC", [id]);
-  // Every attached image, in the order the composer shows them. Each platform
-  // decides how many it can carry (see mediaLimitError) — none of them silently
-  // gets a subset.
-  const imageUrls = media.map((m: any) => m.url as string).filter(Boolean);
+  // Every attachment, in the order the composer shows them, images and video
+  // alike. Each platform decides what it can carry (see mediaError) — none of
+  // them silently gets a subset, and none of them silently gets none.
+  const media = (await query<any>("SELECT * FROM media WHERE post_id = ? ORDER BY id ASC", [id]))
+    .map((m: any) => toMediaItem({ url: m.url, type: m.type }))
+    .filter((m): m is MediaItem => m !== null);
 
   // A post is publishable when at least one channel has text to send: the
   // shared draft, or its own override. Overriding every channel and clearing
@@ -104,16 +119,24 @@ async function publishPost(id: number): Promise<{ published: boolean; results: P
     );
     if (claim.changes !== 1) continue;
 
-    const r = await publishToChannel(channel, channelContent(channel, post.content), imageUrls);
+    // Accepted by the platform on an earlier delivery but never confirmed (a
+    // pending row that already carries a ref). Ask what became of it instead of
+    // sending again — TikTok is explicit that re-initiating the same publish_id
+    // double-posts, and it is the only platform that produces such a row.
+    const r =
+      (await recheckChannel(channel, base)) ??
+      (await publishToChannel(channel, channelContent(channel, post.content), media));
     // Persist this channel's delivery outcome on its post_channels row.
-    // attempts was already incremented by the claim above.
+    // attempts was already incremented by the claim above. `pending` is a third
+    // outcome, not a failure: the platform has the post and hasn't ruled on it,
+    // so the row must neither claim delivery nor invite a re-send.
     await run(
       `UPDATE post_channels
          SET status = ?, ref = ?, url = ?, error = ?,
              published_at = CASE WHEN ? THEN datetime('now') ELSE published_at END
        WHERE post_id = ? AND channel_id = ?`,
       [
-        r.success ? "published" : "failed",
+        r.success ? "published" : r.pending ? "pending" : "failed",
         r.ref ?? null,
         r.url ?? null,
         r.error ?? null,
@@ -129,14 +152,23 @@ async function publishPost(id: number): Promise<{ published: boolean; results: P
   // run's results: a retry only touches the channels that had not gone out,
   // and a concurrent delivery may have settled the rest. Re-reading is the
   // only view that covers both.
-  const states = await query<any>("SELECT status FROM post_channels WHERE post_id = ?", [id]);
+  const states = await query<any>("SELECT status, ref, attempts FROM post_channels WHERE post_id = ?", [id]);
   const delivered = states.filter((s: any) => s.status === "published").length;
-  const inFlight = states.filter((s: any) => s.status === "pending").length;
+  // Two different pending rows. One carries a ref: the platform has the post
+  // and hasn't ruled on it (TikTok). One doesn't: nothing has been sent, so
+  // another delivery is holding it.
+  const unconfirmed = states.filter((s: any) => s.status === "pending" && s.ref);
+  const awaiting = unconfirmed.length;
+  const inFlight = states.filter((s: any) => s.status === "pending" && !s.ref).length;
   const rollup =
     delivered === states.length ? "published"
-    : delivered > 0 ? "partial"
-    // Nothing delivered but something is still pending: another delivery holds
-    // it. Don't call the post failed on its behalf.
+    // Something has left the building — delivered, or handed to a platform that
+    // hasn't finished. Either way the post isn't fully out, and `partial` is
+    // what puts the retry back in the author's hands. A retry re-checks an
+    // unconfirmed channel rather than re-sending it (see recheckChannel).
+    : delivered > 0 || awaiting > 0 ? "partial"
+    // Nothing sent, but something is still pending: another delivery holds it.
+    // Don't call the post failed on its behalf.
     : inFlight > 0 ? (post.status as string)
     : "failed";
   await run(
@@ -147,9 +179,67 @@ async function publishPost(id: number): Promise<{ published: boolean; results: P
      WHERE id = ?`,
     [rollup, delivered > 0 ? 1 : 0, id],
   );
+
+  // Something is still unconfirmed: come back to it. Nobody is watching this
+  // request by then, so the follow-up is a queued delivery, not work held open
+  // past the response — a Worker's waitUntil budget is 30s and its promises are
+  // dropped at the end of it, which is neither long enough for a video nor
+  // durable enough to rely on.
+  if (awaiting && recheck) {
+    await scheduleRecheck(recheck.env, recheck.origin, id, Math.max(...unconfirmed.map((s: any) => Number(s.attempts) || 1)));
+  }
   return { published: delivered > 0, results };
 }
 
+// How long to wait before asking the platform again, indexed by how many
+// deliveries this post has already had. Widening gaps: a video that needs a
+// minute is the common case, one still unresolved after half an hour is a
+// stuck one, and there is no point hammering either. The ladder runs out after
+// roughly an hour — past that the post keeps its unconfirmed row and the
+// author's retry button, rather than this rescheduling itself forever.
+//
+// It normally ends long before the ladder does: once TikTok forgets a
+// publish_id the status call answers invalid_publish_id, which is terminal (see
+// tiktok.ts), so the row settles on its own.
+const RECHECK_DELAYS_S = [60, 120, 300, 900, 1800];
+
+// Queue one follow-up delivery to this app's own /internal/publish. That
+// endpoint already runs publishPost, which re-checks an unconfirmed channel
+// instead of re-sending it — so the follow-up needs no new endpoint, no new
+// payload and no new idempotency story, and a redelivery of it is harmless.
+//
+// No-op without a CLAWNIFY_TOKEN (local dev, and any self-hosted deploy without
+// the managed queue). That is why the in-request poll in tiktok.ts still exists:
+// it is the confirmation those deployments get.
+async function scheduleRecheck(env: Env["Bindings"], origin: string, postId: number, tries: number): Promise<void> {
+  const token = env.CLAWNIFY_TOKEN;
+  const delay = RECHECK_DELAYS_S[tries - 1];
+  if (!token || delay === undefined) return;
+  // Deliberately not stored on posts.queue_job_id: that column tracks the
+  // post's scheduled publish, so overwriting it here would make editing the
+  // post cancel the wrong job. This one is fire-and-forget — the worst a stray
+  // delivery can do is re-check a channel that already settled.
+  await scheduleDelivery({
+    token,
+    origin,
+    postId,
+    runAt: new Date(Date.now() + delay * 1000).toISOString(),
+  });
+}
+
+// Re-check a delivery the platform accepted but never confirmed, rather than
+// sending it a second time. Returns null when there is nothing to re-check —
+// the ordinary case — and the caller publishes normally.
+//
+// Only TikTok writes a pending row with a ref (its Content Posting API is
+// asynchronous; see settleTikTok). A pending row on any other platform is one
+// that was never sent, so it falls through to a real publish.
+async function recheckChannel(channel: any, base: { channelId: number; channel: string; platform: string }): Promise<PublishResult | null> {
+  if (channel.delivery_status !== "pending" || !channel.delivery_ref) return null;
+  if (channel.platform !== "tiktok") return null;
+  return { ...base, ...(await settleTikTok(channel, channel.delivery_ref as string)) };
+}
+
 // The text this channel actually publishes: its own version when it has one,
 // otherwise the post's shared draft. The single place the two are resolved, so
 // publishing, previews and the API can never disagree about which text wins.
@@ -158,8 +248,9 @@ function channelContent(channel: any, shared: string | null | undefined): string
   return (own ?? shared ?? "") as string;
 }
 
-async function publishToChannel(channel: any, content: string, imageUrls: string[]): Promise<PublishResult> {
+async function publishToChannel(channel: any, content: string, media: MediaItem[]): Promise<PublishResult> {
   const base = { channelId: channel.id as number, channel: channel.name as string, platform: channel.platform as string };
+  const { imageUrls, videoUrl } = splitMedia(media);
 
   // Only reachable when the shared draft is empty and this channel wasn't
   // given its own text — the other channels still go out.
@@ -167,12 +258,13 @@ async function publishToChannel(channel: any, content: string, imageUrls: string
     return { ...base, success: false, error: "No content for this channel. Write a shared draft, or customize this channel." };
   }
 
-  // More images than this platform accepts fails the channel rather than
-  // posting a truncated set. Sending fewer images than the user attached,
-  // silently, is the bug the whole media path exists to avoid — and the
-  // per-channel delivery model means the other channels still go out.
-  const overLimit = mediaLimitError(channel.platform, imageUrls.length);
-  if (overLimit) return { ...base, success: false, error: overLimit };
+  // Media this platform can't carry — too many images, a video it has no call
+  // for, or a mix no platform takes — fails the channel rather than posting a
+  // truncated set. Sending less than the user attached, silently, is the bug the
+  // whole media path exists to avoid, and the per-channel delivery model means
+  // the other channels still go out.
+  const rejected = mediaError(channel.platform, media);
+  if (rejected) return { ...base, success: false, error: rejected };
 
   switch (channel.platform) {
     case "twitter": {
@@ -272,10 +364,40 @@ async function publishToChannel(channel: any, content: string, imageUrls: string
       return { ...base, success: !!pub?.successful, error: pub?.successful ? undefined : (pub?.error || "Instagram publish failed"), ref };
     }
     case "tiktok": {
-      // Composio execute, single-step photo post (TikTok Content Posting API).
-      // Image-only for now, matching this app's photo-first media model.
-      // photo_images carries the whole set (1-35); the first is the cover.
-      if (!imageUrls.length) return { ...base, success: false, error: "TikTok requires an image." };
+      // Video: upload the bytes, then let the same call publish them.
+      //
+      // Not TIKTOK_PUBLISH_VIDEO, which is the URL-pull sibling and would be
+      // one call instead of two: TikTok only pulls from a domain verified in
+      // the developer portal that owns the app, and this app's own hostname is
+      // not one, so it answers 403. Uploading the bytes sidesteps verification
+      // — at the cost of the broker's own staging ceiling (10 MB), which comes
+      // back as the staging error below rather than as a TikTok rejection.
+      if (videoUrl) {
+        const staged = await stageFile("tiktok", "TIKTOK_UPLOAD_VIDEO", videoUrl);
+        if (!staged) return { ...base, success: false, error: "Couldn't upload the video to TikTok. Reconnect TikTok in Clawnify." };
+        if (!staged.descriptor) return { ...base, success: false, error: `TikTok video upload failed: ${staged.error}` };
+        const up = await executeTool("tiktok", "TIKTOK_UPLOAD_VIDEO", {
+          file_to_upload: staged.descriptor,
+          caption: content.slice(0, 2200),
+          privacy_level: "PUBLIC_TO_EVERYONE",
+          publish: true,
+        });
+        if (!up) return { ...base, success: false, error: "No TikTok credentials. Connect TikTok in Clawnify." };
+        const d = ((up.data as any)?.data ?? up.data ?? {}) as { publish_id?: string; published?: boolean };
+        if (!up.successful) return { ...base, success: false, error: tiktokError(up.error, up.data) };
+        // `published` says whether the publish step was attempted at all — not
+        // whether TikTok finished it. False means the bytes went to the inbox
+        // instead: a draft in the creator's app, not a post on their profile.
+        if (!d.published) {
+          return { ...base, success: false, ref: d.publish_id,
+            error: "TikTok took the video but didn't publish it — it's waiting as a draft in the TikTok app." };
+        }
+        return { ...base, ...(await settleTikTok(channel, d.publish_id)) };
+      }
+
+      // Photos: single-step post (TikTok Content Posting API). photo_images
+      // carries the whole set (1-35); the first is the cover.
+      if (!imageUrls.length) return { ...base, success: false, error: "TikTok requires an image or a video." };
       const r = await executeTool("tiktok", "TIKTOK_POST_PHOTO", {
         post_mode: "DIRECT_POST",
         photo_images: imageUrls,
@@ -287,17 +409,10 @@ async function publishToChannel(channel: any, content: string, imageUrls: string
       if (!r) return { ...base, success: false, error: "No TikTok credentials. Connect TikTok in Clawnify." };
       const d = (r.data as any)?.data || (r.data as any) || {};
       const ref = d.publish_id as string | undefined;
-      // TikTok rejects PUBLIC_TO_EVERYONE (rather than silently downgrading
-      // it) from apps TikTok hasn't audited yet, and from personal accounts
-      // that haven't unlocked public posting — both surface as one of these
-      // literal error codes. Relabel them instead of guessing a "safe" privacy
-      // level up front, which would post successfully but invisibly to
-      // everyone (Postiz's tiktok.provider.ts does the same relabeling).
-      const raw = String(r.error || JSON.stringify(r.data || {}));
-      const friendly = /unaudited_client_can_only_post_to_private_accounts|privacy_level_option_mismatch/.test(raw)
-        ? "TikTok hasn't approved this account for public posts (app audit or account type). Contact support, or set this account to allow public posting in the TikTok app."
-        : r.error || "TikTok post failed";
-      return { ...base, success: !!r.successful, error: r.successful ? undefined : friendly, ref };
+      if (!r.successful) return { ...base, success: false, error: tiktokError(r.error, r.data), ref };
+      // A photo post is asynchronous for the same reason a video is: TikTok
+      // accepted the job, moderation still has to pass it.
+      return { ...base, ...(await settleTikTok(channel, ref)) };
     }
     case "facebook": {
       // Composio execute against the Graph API. Facebook only lets apps publish
@@ -307,6 +422,23 @@ async function publishToChannel(channel: any, content: string, imageUrls: string
       // through /feed (Postiz's facebook.provider.ts splits the same way).
       const pageId = accountId(channel);
       if (!pageId) return { ...base, success: false, error: "Facebook channel has no Page selected." };
+      // Video is its own Graph endpoint (/videos, not /feed or /photos) and
+      // takes the file by URL, so nothing is staged: Facebook fetches it from
+      // this app's own public /api/uploads route.
+      if (videoUrl) {
+        const v = await executeTool("facebook", "FACEBOOK_CREATE_VIDEO_POST", {
+          page_id: pageId,
+          file_url: videoUrl,
+          description: content,
+          published: true,
+        });
+        if (!v) return { ...base, success: false, error: "No Facebook credentials. Connect Facebook in Clawnify." };
+        const vd = (((v.data as any)?.response_data ?? v.data) || {}) as { id?: string };
+        // The id here is the video's, not a page_post id, so it takes the
+        // /videos permalink rather than facebookPostUrl's /posts one.
+        const vurl = vd.id ? `https://www.facebook.com/${pageId}/videos/${vd.id}` : undefined;
+        return { ...base, success: !!v.successful, error: v.successful ? undefined : (v.error || "Facebook video post failed"), ref: vd.id, url: vurl };
+      }
       // Several photos need the unpublished-upload + attached_media dance;
       // FACEBOOK_CREATE_MULTI_PHOTO_POST does the whole thing in one call and
       // fails the post outright if any upload fails, so a partial set never
@@ -391,6 +523,49 @@ async function uploadTwitterMedia(imageUrl: string): Promise<{ mediaId: string }
   return { mediaId };
 }
 
+// TikTok rejects PUBLIC_TO_EVERYONE (rather than silently downgrading it) from
+// apps TikTok hasn't audited yet, and from personal accounts that haven't
+// unlocked public posting — both surface as one of these literal error codes.
+// Relabel them instead of guessing a "safe" privacy level up front, which would
+// post successfully but invisibly to everyone (Postiz's tiktok.provider.ts does
+// the same relabeling). Shared by the photo and the video path: the privacy
+// level is the account's, not the media's, so both hit it the same way.
+function tiktokError(error: string | null | undefined, data: unknown): string {
+  const raw = String(error || JSON.stringify(data || {}));
+  return /unaudited_client_can_only_post_to_private_accounts|privacy_level_option_mismatch/.test(raw)
+    ? "TikTok hasn't approved this account for public posts (app audit or account type). Contact support, or set this account to allow public posting in the TikTok app."
+    : error || "TikTok post failed";
+}
+
+// Turn a TikTok publish_id into a delivery outcome by asking TikTok what
+// actually happened to it (see tiktok.ts — the Content Posting API only ever
+// *accepts* a post synchronously). Both the video and the photo path land here,
+// because both are asynchronous in exactly the same way.
+//
+// Shared by the initial publish and by the re-check on a later delivery, so a
+// post can only ever be called live on TikTok's own word.
+async function settleTikTok(
+  channel: any,
+  publishId: string | undefined,
+): Promise<{ success: boolean; pending?: boolean; error?: string; ref?: string; url?: string }> {
+  // TikTok accepted the post but gave us no id to poll. This must not become a
+  // pending row: `pending` only means "don't re-send" while there is a ref to
+  // re-check with, and a pending row without one falls through to a re-send on
+  // the next delivery — a duplicate post nobody asked for. Fail it instead, and
+  // say why, so retrying is the author's call rather than the machine's.
+  if (!publishId) {
+    return { success: false, error: "TikTok accepted the post but returned no id, so we can't confirm it went out. Check TikTok before retrying." };
+  }
+  const outcome = await awaitPublish(executeTool, publishId);
+  if (outcome.state === "published") {
+    return { success: true, ref: publishId, url: tiktokPostUrl(channel.profile_handle, outcome.postId) };
+  }
+  if (outcome.state === "processing") {
+    return { success: false, pending: true, ref: publishId, error: outcome.message };
+  }
+  return { success: false, ref: publishId, error: outcome.message };
+}
+
 // The platform-side account a channel publishes as (Facebook Page ID,
 // Instagram Business Account ID). Rows from before platform_account_id existed
 // kept that id in `handle`, so a purely numeric handle still counts.
@@ -580,24 +755,35 @@ app.use("*", async (c, next) => {
   await next();
 });
 
-// ── Image uploads ──
+// ── Media uploads ──
 
-// Upload an image to R2 and return its absolute, publicly-fetchable URL. The
-// URL must be public because the social platforms (Instagram especially) fetch
-// the image server-side at publish time — see /api/uploads/:key in the public
-// routes (clawnify.json).
+// Upload an image or a video to R2 and return its absolute, publicly-fetchable
+// URL. The URL must be public because the social platforms fetch the file
+// server-side at publish time — Instagram for images, Facebook for video — see
+// /api/uploads/:key in the public routes (clawnify.json).
 app.post("/api/upload", async (c) => {
   if (!uploadsEnabled()) return c.json({ error: "Uploads not configured" }, 503);
   const body = await c.req.parseBody();
   const file = body["file"];
   if (!file || typeof file === "string") return c.json({ error: "No file provided" }, 400);
-  if (!file.type.startsWith("image/")) return c.json({ error: "Only images are supported" }, 400);
 
-  const key = makeKey(file.name || "image");
-  await putUpload(key, await file.arrayBuffer(), file.type || "application/octet-stream");
+  const type = mediaTypeFromMime(file.type);
+  if (!type) return c.json({ error: "Only images and videos can be attached to a post" }, 400);
+  // Videos are capped because the whole file crosses this Worker on its way to
+  // R2. Images have no cap here: the platforms' own limits are far below
+  // anything a Worker struggles with, and their rejection is the better error.
+  if (type === "video" && file.size > MAX_VIDEO_BYTES) {
+    return c.json({ error: `Videos are limited to ${Math.round(MAX_VIDEO_BYTES / (1024 * 1024))} MB.` }, 413);
+  }
+
+  // The File goes to R2 as-is (a Blob is one of the values put() takes) rather
+  // than through an ArrayBuffer: a video is large enough that buffering it
+  // first would put the whole file in the Worker's memory.
+  const key = makeKey(file.name || type);
+  await putUpload(key, file, file.type || "application/octet-stream");
 
   const url = `${new URL(c.req.url).origin}/api/uploads/${key}`;
-  return c.json({ url }, 201);
+  return c.json({ url, type }, 201);
 });
 
 app.get("/api/uploads/:key", async (c) => {
@@ -773,6 +959,21 @@ async function setPostChannels(
   }
 }
 
+// Replace a post's attachments with exactly what the request carried.
+//
+// Wholesale replacement is right here and wrong for post_channels: an
+// attachment holds no delivery state to lose, so re-inserting it costs
+// nothing, while a post_channels row carries the link to a post that is
+// already live (see setPostChannels).
+async function setPostMedia(postId: number, media: unknown[]): Promise<void> {
+  await run("DELETE FROM media WHERE post_id = ?", [postId]);
+  for (const entry of media) {
+    const item = toMediaItem(entry);
+    if (!item) continue;
+    await run("INSERT INTO media (post_id, url, type) VALUES (?, ?, ?)", [postId, item.url, item.type]);
+  }
+}
+
 async function enrichPost(post: any) {
   // Include the per-channel delivery state (Postiz-style) so the UI can show
   // each channel's status, link out to the live post, and surface failures.
@@ -878,7 +1079,7 @@ app.get("/api/posts/:id", async (c) => {
 });
 
 app.post("/api/posts", async (c) => {
-  const { content, status, scheduled_at, channel_ids, channel_content, label_ids, media_urls } = await c.req.json<{
+  const { content, status, scheduled_at, channel_ids, channel_content, label_ids, media } = await c.req.json<{
     content: string;
     status?: string;
     scheduled_at?: string;
@@ -887,7 +1088,10 @@ app.post("/api/posts", async (c) => {
     // omits it posts the same shared draft everywhere, exactly as before.
     channel_content?: Record<string, string | null>;
     label_ids?: number[];
-    media_urls?: string[];
+    // Attachments, in display order. A bare string is an image URL whose type
+    // is read off the extension; { url, type } says it outright, which is what
+    // /api/upload returns and what a pasted .mp4 link needs.
+    media?: Array<string | { url: string; type?: string }>;
   }>();
 
   const postStatus = status || (scheduled_at ? "scheduled" : "draft");
@@ -905,10 +1109,8 @@ app.post("/api/posts", async (c) => {
       await run("INSERT INTO post_labels (post_id, label_id) VALUES (?, ?)", [postId, lid]);
     }
   }
-  if (media_urls?.length) {
-    for (const url of media_urls) {
-      await run("INSERT INTO media (post_id, url) VALUES (?, ?)", [postId, url]);
-    }
+  if (media?.length) {
+    await setPostMedia(Number(postId), media);
   }
 
   await syncSchedule(c.env, new URL(c.req.url).origin, Number(postId), postStatus, scheduled_at || null, null);
@@ -922,14 +1124,14 @@ app.put("/api/posts/:id", async (c) => {
   const existing = await get("SELECT * FROM posts WHERE id = ?", [id]);
   if (!existing) return c.json({ error: "Not found" }, 404);
 
-  const { content, status, scheduled_at, channel_ids, channel_content, label_ids, media_urls } = await c.req.json<{
+  const { content, status, scheduled_at, channel_ids, channel_content, label_ids, media } = await c.req.json<{
     content?: string;
     status?: string;
     scheduled_at?: string | null;
     channel_ids?: number[];
     channel_content?: Record<string, string | null>;
     label_ids?: number[];
-    media_urls?: string[];
+    media?: Array<string | { url: string; type?: string }>;
   }>();
 
   await run(
@@ -951,11 +1153,8 @@ app.put("/api/posts/:id", async (c) => {
       await run("INSERT INTO post_labels (post_id, label_id) VALUES (?, ?)", [id, lid]);
     }
   }
-  if (media_urls !== undefined) {
-    await run("DELETE FROM media WHERE post_id = ?", [id]);
-    for (const url of media_urls) {
-      await run("INSERT INTO media (post_id, url) VALUES (?, ?)", [id, url]);
-    }
+  if (media !== undefined) {
+    await setPostMedia(id, media);
   }
 
   const resolvedStatus = status ?? (existing as any).status;
@@ -999,7 +1198,7 @@ app.post("/api/posts/:id/publish", async (c) => {
 
   // The post exists and has channels, so a null here means no channel had any
   // text to send — neither the shared draft nor its own version.
-  const result = await publishPost(id);
+  const result = await publishPost(id, { env: c.env, origin: new URL(c.req.url).origin });
   if (!result) return c.json({ error: "Post has no content" }, 400);
   return c.json(result);
 });
@@ -1029,7 +1228,7 @@ app.post("/api/internal/publish", async (c) => {
   // cancel a delivered job.
   await run("UPDATE posts SET queue_job_id = NULL WHERE id = ?", [post_id]);
 
-  const result = await publishPost(post_id);
+  const result = await publishPost(post_id, { env: c.env, origin: new URL(c.req.url).origin });
   if (!result) return c.json({ error: "post not found or empty" }, 404);
   // 200 so the queue marks the job done even if a channel rejected the content
   // (a platform-level rejection isn't a delivery failure to retry).
diff --git a/src/server/schema.sql b/src/server/schema.sql
index 97f969e..761835f 100644
--- a/src/server/schema.sql
+++ b/src/server/schema.sql
@@ -55,7 +55,11 @@ CREATE TABLE IF NOT EXISTS post_channels (
   -- text, and only the channels the user actually tailored carry a row value.
   -- Empty is never stored: a blank override normalises to NULL (inherit).
   content TEXT,
-  status TEXT NOT NULL DEFAULT 'pending',  -- pending | published | failed
+  -- pending | published | failed. `pending` covers both "not sent yet" and
+  -- "sent, and the platform hasn't ruled on it" — the second is the one with a
+  -- ref, which publishPost() re-checks instead of re-sending (TikTok's Content
+  -- Posting API only ever accepts a post synchronously).
+  status TEXT NOT NULL DEFAULT 'pending',
   ref TEXT,            -- platform post id (Postiz: releaseId)
   url TEXT,            -- link to the live post (Postiz: releaseURL)
   error TEXT,          -- platform rejection reason when status = 'failed'
@@ -75,7 +79,12 @@ CREATE TABLE IF NOT EXISTS post_labels (
   PRIMARY KEY (post_id, label_id)
 );
 
--- Media attachments
+-- Media attachments. `type` is 'image' or 'video' and decides which platform
+-- call publishes the post — an images post and a video post go to different
+-- endpoints on every platform that takes both. A post carries either images or
+-- one video, never a mix (mediaShapeError in src/shared/platforms.ts); the rule
+-- lives in code rather than in a constraint because the composer has to explain
+-- it while the attachments are still removable.
 CREATE TABLE IF NOT EXISTS media (
   id INTEGER PRIMARY KEY AUTOINCREMENT,
   post_id INTEGER NOT NULL REFERENCES posts(id) ON DELETE CASCADE,
diff --git a/src/server/tiktok.ts b/src/server/tiktok.ts
new file mode 100644
index 0000000..33fe186
--- /dev/null
+++ b/src/server/tiktok.ts
@@ -0,0 +1,140 @@
+/**
+ * TikTok's Content Posting API is asynchronous, and that is the whole reason
+ * this module exists.
+ *
+ * Both of the calls this app makes — TIKTOK_UPLOAD_VIDEO with publish=true, and
+ * TIKTOK_POST_PHOTO with post_mode=DIRECT_POST — return as soon as TikTok has
+ * *accepted* the job. TikTok then downloads or transcodes the media, runs it
+ * through moderation, and only then does the post appear on the profile. Any of
+ * those stages can still reject it (spam risk, a duration or frame-rate check,
+ * a banned account), and none of that shows up in the response we already have.
+ *
+ * TIKTOK_UPLOAD_VIDEO's `published` field is not the answer either: it reports
+ * whether we asked TikTok to publish, not whether TikTok did. Trusting it marks
+ * the channel delivered — a terminal state that publishPost() never retries —
+ * while nothing is live and no retry will ever happen.
+ *
+ * So the publish_id gets polled through TIKTOK_FETCH_PUBLISH_STATUS until TikTok
+ * says something terminal. When it hasn't by the end of the budget, the honest
+ * answer is "we don't know yet": neither published (a lie) nor failed (which
+ * would invite a retry, and re-initiating the same publish_id is exactly what
+ * TikTok's docs tell you never to do — it would double-post).
+ */
+
+// Poll schedule, in milliseconds to wait *before* each retry. The first status
+// check happens immediately, so a post that is already done costs nothing.
+// TikTok allows 30 status calls per minute per token; four checks over ~10s is
+// far inside that, catches the photo posts and short clips that settle quickly,
+// and keeps a multi-channel publish from stalling on this one channel. Anything
+// slower comes back as "processing" and is resolved by the next delivery.
+const POLL_DELAYS_MS = [1500, 3000, 6000];
+
+export type TikTokPublishOutcome =
+  /** Live on the profile. `postId` is present once moderation has approved it. */
+  | { state: "published"; postId?: string }
+  /** TikTok took it but hasn't finished. Not live, and must not be re-sent. */
+  | { state: "processing"; message: string }
+  /** Terminal rejection, or a draft sitting in the creator's inbox. */
+  | { state: "failed"; message: string };
+
+// TikTok's fail_reason vocabulary. Anything unlisted falls through to the raw
+// code, which is still more useful to the author than "TikTok post failed".
+const FAIL_REASONS: Record<string, string> = {
+  file_format_check_failed: "TikTok rejected the file format. Use MP4, MOV or WEBM.",
+  picture_size_check_failed: "TikTok rejected the image size.",
+  frame_rate_check_failed: "TikTok rejected the video's frame rate (it accepts 23-60 fps).",
+  duration_check_failed: "The video is longer than this TikTok account is allowed to post.",
+  video_pull_failed: "TikTok couldn't download the video.",
+  photo_pull_failed: "TikTok couldn't download the images.",
+  spam_risk_text: "TikTok flagged the caption as spam.",
+  spam_risk: "TikTok flagged the post as spam.",
+  spam_risk_too_many_posts: "This TikTok account has posted too many times today.",
+  spam_risk_user_banned_from_posting: "This TikTok account is banned from posting.",
+  auth_removed: "The TikTok connection was revoked. Reconnect TikTok in Clawnify.",
+  publish_cancelled: "The post was cancelled in the TikTok app.",
+  internal: "TikTok hit an internal error while publishing.",
+};
+
+/** The subset of executeTool this module needs, so it stays testable in isolation. */
+type Exec = (
+  service: string,
+  toolSlug: string,
+  args: Record<string, unknown>,
+) => Promise<{ successful?: boolean; error?: string | null; data?: unknown } | null>;
+
+const sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
+
+/**
+ * Poll a publish_id to a terminal state, or give up and report "processing".
+ *
+ * Never throws and never reports success on an unknown state — every path this
+ * returns is one the caller can persist as-is.
+ */
+export async function awaitPublish(exec: Exec, publishId: string): Promise<TikTokPublishOutcome> {
+  let last = "TikTok is still processing this post.";
+
+  for (let attempt = 0; ; attempt++) {
+    const r = await exec("tiktok", "TIKTOK_FETCH_PUBLISH_STATUS", { publish_id: publishId });
+
+    // No broker at all (off-platform, or TikTok disconnected between the two
+    // calls). We can't confirm, and we already handed TikTok the post, so this
+    // is "unknown", not "failed" — the same reasoning as a timed-out poll.
+    if (!r) {
+      last = "Couldn't reach TikTok to confirm this post went out.";
+    } else {
+      const body = (r.data as any)?.data as
+        | { status?: string; fail_reason?: string; publicaly_available_post_id?: string[] }
+        | undefined;
+      // Composio nests TikTok's own error object under data.error; the wrapper's
+      // top-level `error` is Composio's. Either can carry the real reason.
+      const apiError = (r.data as any)?.error as { code?: string; message?: string } | undefined;
+
+      if (apiError?.code && apiError.code !== "ok") {
+        // invalid_publish_id / token_not_authorized are terminal: no amount of
+        // polling fixes them, and the post is not coming.
+        if (apiError.code === "invalid_publish_id" || apiError.code === "token_not_authorized_for_specified_publish_id") {
+          return { state: "failed", message: `TikTok lost track of this post (${apiError.code}).` };
+        }
+        last = apiError.message || `TikTok status check failed (${apiError.code}).`;
+      } else if (!r.successful) {
+        last = r.error || "TikTok status check failed.";
+      } else {
+        switch (body?.status) {
+          case "PUBLISH_COMPLETE":
+            // The post id array is only populated once moderation has approved a
+            // public post, so it can legitimately be empty on a private one.
+            return { state: "published", postId: body.publicaly_available_post_id?.[0] };
+          case "FAILED":
+            return {
+              state: "failed",
+              message: FAIL_REASONS[body.fail_reason ?? ""] ?? `TikTok rejected the post (${body.fail_reason || "no reason given"}).`,
+            };
+          case "SEND_TO_USER_INBOX":
+            // Uploaded, but as a draft the creator has to finish by hand. Never
+            // a published post, and nothing we can push further from here.
+            return {
+              state: "failed",
+              message: "TikTok took the post but left it as a draft — open the TikTok app to finish posting it.",
+            };
+          case "PROCESSING_UPLOAD":
+          case "PROCESSING_DOWNLOAD":
+          default:
+            last = "TikTok is still processing this post.";
+        }
+      }
+    }
+
+    if (attempt >= POLL_DELAYS_MS.length) return { state: "processing", message: last };
+    await sleep(POLL_DELAYS_MS[attempt]);
+  }
+}
+
+/**
+ * Link to a published TikTok post. Needs the creator's @handle, which only the
+ * channel's synced profile carries — without it there is no URL to build, and
+ * the post id alone is not a link.
+ */
+export function tiktokPostUrl(handle: string | null | undefined, postId: string | undefined): string | undefined {
+  const at = String(handle || "").trim().replace(/^@/, "");
+  return at && postId ? `https://www.tiktok.com/@${at}/video/${postId}` : undefined;
+}
diff --git a/src/server/uploads.ts b/src/server/uploads.ts
index 7383047..0e7e622 100644
--- a/src/server/uploads.ts
+++ b/src/server/uploads.ts
@@ -1,5 +1,5 @@
-// Thin R2 wrapper for uploaded post images. The bucket is bound as `UPLOADS`
-// when clawnify.json declares `app.storage: true`.
+// Thin R2 wrapper for uploaded post media — images and video. The bucket is
+// bound as `UPLOADS` when clawnify.json declares `app.storage: true`.
 
 let _bucket: R2Bucket | null = null;
 
@@ -11,9 +11,13 @@ export function uploadsEnabled(): boolean {
   return _bucket !== null;
 }
 
+// `Blob` is in the list because an upload hands the File straight through: a
+// video is large enough that reading it into an ArrayBuffer first would put the
+// whole file in the Worker's memory, and a Blob carries its own length, so R2
+// needs nothing else to store it.
 export async function putUpload(
   key: string,
-  data: ArrayBuffer | Uint8Array | ReadableStream,
+  data: ArrayBuffer | Uint8Array | ReadableStream | Blob,
   contentType: string,
 ): Promise<void> {
   if (!_bucket) throw new Error("uploads not configured");
@@ -35,9 +39,9 @@ export async function getUpload(
 // Collision-resistant, URL-safe, single-segment key (no '/') derived from the
 // original filename. The random prefix keeps the public URL unguessable.
 export function makeKey(filename: string): string {
-  const clean = (filename || "image")
+  const clean = (filename || "upload")
     .toLowerCase()
     .replace(/[^a-z0-9.\-]+/g, "-")
-    .replace(/^-+|-+$/g, "") || "image";
+    .replace(/^-+|-+$/g, "") || "upload";
   return `${crypto.randomUUID().slice(0, 8)}-${clean}`;
 }
diff --git a/src/shared/media.ts b/src/shared/media.ts
new file mode 100644
index 0000000..0ec996b
--- /dev/null
+++ b/src/shared/media.ts
@@ -0,0 +1,65 @@
+// What a post's attachments are, independent of any platform.
+//
+// Shared because the server and the client must agree on it: the composer
+// decides which element to render (an <img> or a <video>) the moment a URL is
+// pasted, and the server decides which platform call to make at publish time.
+// Two copies of this rule would disagree exactly once — on the post that then
+// goes out as the wrong kind of media, or not at all.
+
+export type MediaType = "image" | "video";
+
+// One attachment on a post, as it travels between the composer, the API and
+// the publisher.
+export interface MediaItem {
+  url: string;
+  type: MediaType;
+}
+
+// Container extensions the social platforms in PLATFORM_VIDEO actually accept
+// (MP4 is the only one all of them do; the rest are here so a user's own URL
+// isn't mistaken for an image and sent to an image endpoint, which fails with a
+// far less useful error than "this platform can't take that video").
+const VIDEO_EXTENSIONS = /\.(mp4|mov|m4v|webm|avi|mkv|mpe?g)(\?|#|$)/i;
+
+// The type of a media URL we were not told the type of — a pasted link. Upload
+// answers this from the file's own MIME type instead (mediaTypeFromMime), which
+// is authoritative; this is the fallback for a URL with nothing but a path.
+export function mediaTypeFromUrl(url: string): MediaType {
+  return VIDEO_EXTENSIONS.test(url) ? "video" : "image";
+}
+
+// The type of a browser-supplied MIME, or null when it is neither — the caller
+// turns that into "we don't take this file", rather than guessing "image" and
+// uploading a PDF the platforms will reject at publish time.
+export function mediaTypeFromMime(mime: string | undefined | null): MediaType | null {
+  const m = (mime || "").toLowerCase();
+  if (m.startsWith("video/")) return "video";
+  if (m.startsWith("image/")) return "image";
+  return null;
+}
+
+// Normalise whatever the API was handed into a MediaItem. Anything that isn't
+// literally "video" is an image: the type only chooses which platform call is
+// made, so an unrecognised value must fall back to the shape the platforms all
+// accept rather than to the one only two of them do.
+export function toMediaItem(input: unknown): MediaItem | null {
+  if (typeof input === "string") {
+    return input.trim() ? { url: input, type: mediaTypeFromUrl(input) } : null;
+  }
+  if (input && typeof input === "object") {
+    const url = (input as { url?: unknown }).url;
+    if (typeof url !== "string" || !url.trim()) return null;
+    const type = (input as { type?: unknown }).type;
+    return { url, type: type === "video" ? "video" : "image" };
+  }
+  return null;
+}
+
+// The images and the video on a post, split — the two questions every publish
+// path asks. `video` is the first one: carrying more than one is rejected
+// before publishing (see mediaShapeError).
+export function splitMedia(media: MediaItem[]): { imageUrls: string[]; videoUrl?: string } {
+  const imageUrls = media.filter((m) => m.type === "image").map((m) => m.url);
+  const videoUrl = media.find((m) => m.type === "video")?.url;
+  return { imageUrls, ...(videoUrl ? { videoUrl } : {}) };
+}
diff --git a/src/shared/platforms.ts b/src/shared/platforms.ts
index 3dab9f8..f63b1f0 100644
--- a/src/shared/platforms.ts
+++ b/src/shared/platforms.ts
@@ -5,6 +5,8 @@
 // same media limits it warns about: two copies of this table would drift, and
 // the copy that drifts is the one that only fails at send time.
 
+import type { MediaItem } from "./media";
+
 export type Platform =
   | "twitter"
   | "linkedin"
@@ -84,11 +86,56 @@ export const PLATFORM_LABELS: Record<Platform, string> = {
   tiktok: "TikTok",
 };
 
-// Why a channel can't take this many images, in the user's words. Null when the
-// count is fine (or the platform states no cap).
-export function mediaLimitError(platform: string, count: number): string | null {
-  const max = PLATFORM_MEDIA_LIMITS[platform as Platform];
-  if (max === undefined || count <= max) return null;
+// The platforms this app can deliver a video to. Membership is about the call
+// this app has, not about what the platform's own product does: TikTok is a
+// video service, but it is on this list because TIKTOK_UPLOAD_VIDEO takes the
+// bytes, while X is off it because the broker's X media upload has no verified
+// answer for a video's asynchronous processing yet.
+//
+//   facebook — FACEBOOK_CREATE_VIDEO_POST.file_url pulls the video from a URL.
+//   tiktok   — TIKTOK_UPLOAD_VIDEO.file_to_upload takes the bytes. (Its URL-pull
+//              sibling, TIKTOK_PUBLISH_VIDEO, needs the URL's domain to be
+//              verified with TikTok, which an app's own hostname is not.)
+export const PLATFORM_VIDEO: Partial<Record<Platform, boolean>> = {
+  facebook: true,
+  tiktok: true,
+};
+
+// The most bytes /api/upload accepts for one video. The ceiling that actually
+// binds is smaller and lives in the credential broker, which buffers a staged
+// file whole (10 MB) — but that limit is TikTok's path only, and a Facebook
+// video is passed as a URL and never staged. So this caps what the app stores;
+// the per-platform failure says the rest.
+export const MAX_VIDEO_BYTES = 50 * 1024 * 1024;
+
+// Why this set of attachments is not a post any platform would take, in the
+// user's words. Null when the shape is fine. Platform-independent on purpose:
+// these two rules hold everywhere this app publishes, so they are checked once
+// rather than repeated per channel.
+export function mediaShapeError(media: MediaItem[]): string | null {
+  const videos = media.filter((m) => m.type === "video").length;
+  if (videos > 1) return `A post carries one video; this one has ${videos}.`;
+  if (videos && media.length > videos) return "A post carries either images or a video, not both.";
+  return null;
+}
+
+// Why this channel can't carry these attachments, in the user's words. Null
+// when it can. The composer shows this next to the images while they are still
+// removable; publishToChannel calls the same function so the two can't disagree
+// about what would have been rejected.
+export function mediaError(platform: string, media: MediaItem[]): string | null {
+  const shape = mediaShapeError(media);
+  if (shape) return shape;
+
   const label = PLATFORM_LABELS[platform as Platform] ?? platform;
-  return `${label} takes at most ${max} image${max === 1 ? "" : "s"}; this post has ${count}.`;
+  if (media.some((m) => m.type === "video") && !PLATFORM_VIDEO[platform as Platform]) {
+    return `${label} video posts aren't supported yet. Remove the video, or unselect this channel.`;
+  }
+
+  const images = media.filter((m) => m.type === "image").length;
+  const max = PLATFORM_MEDIA_LIMITS[platform as Platform];
+  if (max !== undefined && images > max) {
+    return `${label} takes at most ${max} image${max === 1 ? "" : "s"}; this post has ${images}.`;
+  }
+  return null;
 }
diff --git a/test/harness.mjs b/test/harness.mjs
index 1655d88..634b002 100644
--- a/test/harness.mjs
+++ b/test/harness.mjs
@@ -47,13 +47,32 @@ function storage(db) {
  */
 function broker(plan = {}) {
   const sends = [];
+  // Every status check the app made, so "did it confirm before calling this
+  // published" is a counted fact rather than something inferred.
+  const polls = [];
   const linkedinOk = plan.linkedinOk ?? (() => true);
+  // TikTok's upload action can succeed while leaving the video unpublished — a
+  // draft in the creator's inbox rather than a post on their profile. The
+  // scenario picks which of the two happened.
+  const tiktokPublished = plan.tiktokPublished ?? (() => true);
+  // TikTok only *accepts* a post synchronously; whether it went live is a
+  // separate status call, and the scenario decides what that call reports.
+  // Called once per poll, so a scenario can return PROCESSING_UPLOAD forever to
+  // reproduce a post the app never gets a verdict on.
+  const tiktokStatus = plan.tiktokStatus ?? (() => ({ status: "PUBLISH_COMPLETE", publicaly_available_post_id: ["7500"] }));
   return {
     sends,
+    polls,
     binding: {
       async getToken() { return null; },
       async listConnected() { return []; },
       async getCredentials() { return null; },
+      // The broker stages a file and hands back an opaque descriptor; the app's
+      // only correct use is to forward it, so the stub returns a marked object
+      // the assertions can recognise on the far side.
+      async stageFile(service, toolSlug, file) {
+        return { descriptor: { staged: file.url, tool: toolSlug }, error: null };
+      },
       async executeTool(service, toolSlug, args) {
         switch (toolSlug) {
           case "TWITTER_USER_LOOKUP_ME":
@@ -62,12 +81,43 @@ function broker(plan = {}) {
             return linkedinOk()
               ? { data: { id: "li-me", localizedFirstName: "Test", localizedLastName: "User" }, error: null, successful: true }
               : { data: null, error: "LinkedIn token expired", successful: false };
+          case "TWITTER_UPLOAD_MEDIA":
+            // Not a send: uploading media posts nothing. It only mints the id
+            // the tweet then attaches, so a tweet that lost its image still
+            // shows up below as a send with no media ids.
+            return { data: { data: { id: `media-${args.media?.staged ?? "?"}` } }, error: null, successful: true };
           case "TWITTER_CREATION_OF_A_POST":
-            sends.push({ service, toolSlug, text: args.text });
+            sends.push({ service, toolSlug, text: args.text, images: args.media_media_ids });
             return { data: { data: { id: `tw-${sends.length}` } }, error: null, successful: true };
           case "LINKEDIN_CREATE_LINKED_IN_POST":
-            sends.push({ service, toolSlug, text: args.commentary });
+            sends.push({ service, toolSlug, text: args.commentary, images: args.images });
             return { data: { x_restli_id: `li-${sends.length}` }, error: null, successful: true };
+          case "TIKTOK_UPLOAD_VIDEO":
+            sends.push({ service, toolSlug, text: args.caption, video: args.file_to_upload?.staged });
+            return {
+              data: { publish_id: `tt-${sends.length}`, published: tiktokPublished(), upload_completed: true },
+              error: null,
+              successful: true,
+            };
+          case "TIKTOK_POST_PHOTO":
+            sends.push({ service, toolSlug, text: args.description, images: args.photo_images });
+            return { data: { publish_id: `tt-${sends.length}` }, error: null, successful: true };
+          case "TIKTOK_FETCH_PUBLISH_STATUS": {
+            // Not a send: asking TikTok what happened posts nothing. Composio
+            // wraps TikTok's body twice — data.data plus a sibling data.error.
+            polls.push(args.publish_id);
+            const body = tiktokStatus(args.publish_id, polls.length);
+            return { data: { data: body, error: { code: "ok", message: "", log_id: "l1" } }, error: null, successful: true };
+          }
+          case "FACEBOOK_CREATE_VIDEO_POST":
+            sends.push({ service, toolSlug, text: args.description, video: args.file_url });
+            return { data: { id: `fbv-${sends.length}` }, error: null, successful: true };
+          case "FACEBOOK_CREATE_POST":
+            sends.push({ service, toolSlug, text: args.message });
+            return { data: { id: `fb-${sends.length}` }, error: null, successful: true };
+          case "FACEBOOK_CREATE_PHOTO_POST":
+            sends.push({ service, toolSlug, text: args.message, images: [args.url] });
+            return { data: { post_id: `fb-${sends.length}` }, error: null, successful: true };
           default:
             return { data: null, error: `harness has no stub for ${toolSlug}`, successful: false };
         }
@@ -76,13 +126,37 @@ function broker(plan = {}) {
   };
 }
 
+// The managed queue is a plain HTTPS call, so intercepting fetch is enough to
+// see what the app asked the platform to do later. Installed once — scenarios
+// run in one process — and each boot only reads the entries made after it.
+const enqueued = [];
+const realFetch = globalThis.fetch;
+globalThis.fetch = async (url, init) => {
+  if (String(url).startsWith("https://services.clawnify.com/queue")) {
+    enqueued.push({ url: String(url), body: JSON.parse(init?.body ?? "{}") });
+    return new Response(JSON.stringify({ job_id: `job-${enqueued.length}` }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+  return realFetch(url, init);
+};
+
 /** A running app with an empty database, plus helpers to drive it over HTTP. */
-export async function boot(plan) {
+export async function boot(plan = {}) {
   const db = new DatabaseSync(":memory:");
   db.exec(SCHEMA);
   const { default: app } = await import(`${BUNDLE}?${instance++}`);
   const b = broker(plan);
-  const env = { STORAGE: storage(db), CREDENTIALS: b.binding, CLAWNIFY_ORG_ID: "org-test" };
+  const queueMark = enqueued.length;
+  const env = {
+    STORAGE: storage(db),
+    CREDENTIALS: b.binding,
+    CLAWNIFY_ORG_ID: "org-test",
+    // Present only when the scenario is about deferred work. Its absence is the
+    // self-hosted deploy, where scheduling degrades to nothing.
+    ...(plan.queue ? { CLAWNIFY_TOKEN: "tok-test" } : {}),
+  };
 
   const send = async (method, path, body) => {
     const res = await app.request(
@@ -98,6 +172,9 @@ export async function boot(plan) {
   return {
     db,
     sends: b.sends,
+    polls: b.polls,
+    // Jobs this scenario asked the managed queue to run later.
+    get queued() { return enqueued.slice(queueMark); },
     get: (path) => send("GET", path),
     post: (path, body) => send("POST", path, body ?? {}),
     put: (path, body) => send("PUT", path, body),
diff --git a/test/video-publishing.mjs b/test/video-publishing.mjs
new file mode 100644
index 0000000..3b7be01
--- /dev/null
+++ b/test/video-publishing.mjs
@@ -0,0 +1,351 @@
+/**
+ * A post can carry a video, and it reaches the platforms that can take one.
+ *
+ * Two failure modes matter more than the happy path:
+ *
+ *   • Publishing the text and quietly dropping the video. Every platform here
+ *     accepts a text-only post, so a video that never got attached still comes
+ *     back "successful" — the author finds out from their timeline. So every
+ *     check below reads the video off the call the app actually made.
+ *
+ *   • Calling a channel delivered when nothing is live. TikTok's upload can
+ *     succeed while leaving the video as a draft in the creator's inbox; a
+ *     "published" row there would hide a post that never went out.
+ *
+ * Run with `pnpm test`.
+ */
+import { boot, check, section, report } from "./harness.mjs";
+
+const VIDEO = "https://app.example.com/api/uploads/ab12-clip.mp4";
+const IMAGE = "https://app.example.com/api/uploads/cd34-photo.jpg";
+
+async function channels(h) {
+  const mk = (name, platform, extra = {}) =>
+    h.post("/api/channels", { name, platform, ...extra }).then((r) => r.body);
+  return {
+    tiktok: await mk("TikTok", "tiktok"),
+    facebook: await mk("Page", "facebook", { platform_account_id: "9001" }),
+    x: await mk("X", "twitter"),
+    linkedin: await mk("LinkedIn", "linkedin"),
+  };
+}
+
+const by = (results, id) => results.find((r) => r.channelId === id);
+
+section("A video post reaches the platforms that can take one");
+{
+  const h = await boot();
+  const ch = await channels(h);
+  const post = (await h.post("/api/posts", {
+    content: "our new spot",
+    channel_ids: [ch.tiktok.id, ch.facebook.id, ch.x.id, ch.linkedin.id],
+    media: [{ url: VIDEO, type: "video" }],
+  })).body;
+
+  const res = (await h.post(`/api/posts/${post.id}/publish`)).body.results;
+
+  check("TikTok takes it", by(res, ch.tiktok.id).success);
+  check("Facebook takes it", by(res, ch.facebook.id).success);
+  check("X refuses it, and says why",
+    !by(res, ch.x.id).success && /video posts aren't supported yet/.test(by(res, ch.x.id).error),
+    by(res, ch.x.id).error);
+  check("LinkedIn refuses it, and says why",
+    !by(res, ch.linkedin.id).success && /video posts aren't supported yet/.test(by(res, ch.linkedin.id).error));
+
+  check("sends nothing at all to the two that can't take it", h.sends.length === 2,
+    h.sends.map((s) => s.toolSlug).join(", "));
+  check("the video itself reached TikTok, not just the caption",
+    h.sends.find((s) => s.service === "tiktok")?.video === VIDEO,
+    JSON.stringify(h.sends.find((s) => s.service === "tiktok")));
+  check("the video itself reached Facebook, not just the message",
+    h.sends.find((s) => s.service === "facebook")?.video === VIDEO);
+  check("Facebook posted it as a video, not as a plain text post",
+    h.sends.find((s) => s.service === "facebook")?.toolSlug === "FACEBOOK_CREATE_VIDEO_POST");
+  check("the post is partial, not published",
+    h.row("SELECT status FROM posts WHERE id = ?", post.id).status === "partial");
+  check("the refused channels are retryable, not stuck as delivered",
+    h.rows("SELECT status FROM post_channels WHERE post_id = ? AND status = 'failed'", post.id).length === 2);
+}
+
+section("A TikTok upload that lands in the inbox is not a published post");
+{
+  const h = await boot({ tiktokPublished: () => false });
+  const ch = await channels(h);
+  const post = (await h.post("/api/posts", {
+    content: "draft only",
+    channel_ids: [ch.tiktok.id],
+    media: [{ url: VIDEO, type: "video" }],
+  })).body;
+
+  const res = (await h.post(`/api/posts/${post.id}/publish`)).body.results;
+  check("the channel fails rather than reporting a post nobody can see",
+    !res[0].success && /draft in the TikTok app/.test(res[0].error), res[0].error);
+  check("the post is not marked published",
+    h.row("SELECT status FROM posts WHERE id = ?", post.id).status === "failed");
+}
+
+section("Attachments no platform accepts are refused before anything is sent");
+{
+  const h = await boot();
+  const ch = await channels(h);
+  const mixed = (await h.post("/api/posts", {
+    content: "both",
+    channel_ids: [ch.tiktok.id, ch.facebook.id],
+    media: [{ url: IMAGE, type: "image" }, { url: VIDEO, type: "video" }],
+  })).body;
+
+  const res = (await h.post(`/api/posts/${mixed.id}/publish`)).body.results;
+  check("images and a video together fail every channel",
+    res.every((r) => !r.success && /either images or a video/.test(r.error)), res[0]?.error);
+  check("and nothing was sent", h.sends.length === 0);
+
+  const two = (await h.post("/api/posts", {
+    content: "two clips",
+    channel_ids: [ch.tiktok.id],
+    media: [{ url: VIDEO, type: "video" }, { url: VIDEO + "?b", type: "video" }],
+  })).body;
+  const res2 = (await h.post(`/api/posts/${two.id}/publish`)).body.results;
+  check("a second video is refused too",
+    !res2[0].success && /one video/.test(res2[0].error), res2[0].error);
+}
+
+section("Image posts are untouched by any of this");
+{
+  const h = await boot();
+  const ch = await channels(h);
+  const post = (await h.post("/api/posts", {
+    content: "look at this",
+    channel_ids: [ch.tiktok.id, ch.facebook.id, ch.x.id],
+    media: [{ url: IMAGE, type: "image" }],
+  })).body;
+
+  const res = (await h.post(`/api/posts/${post.id}/publish`)).body.results;
+  check("TikTok still gets a photo post",
+    by(res, ch.tiktok.id).success &&
+      h.sends.some((s) => s.toolSlug === "TIKTOK_POST_PHOTO" && s.images?.[0] === IMAGE));
+  check("Facebook still gets a photo post",
+    by(res, ch.facebook.id).success &&
+      h.sends.some((s) => s.toolSlug === "FACEBOOK_CREATE_PHOTO_POST" && s.images?.[0] === IMAGE));
+  check("X still gets the image attached, not the text on its own",
+    by(res, ch.x.id).success &&
+      h.sends.find((s) => s.service === "twitter")?.images?.[0] === `media-${IMAGE}`,
+    JSON.stringify(h.sends.find((s) => s.service === "twitter")));
+}
+
+section("The stored type is what decides, and it survives the round trip");
+{
+  const h = await boot();
+  const ch = await channels(h);
+  // A bare string is the shape a pasted link arrives in: the extension is all
+  // there is to go on, so a .mp4 link must not be filed as an image and sent
+  // to an image endpoint.
+  const post = (await h.post("/api/posts", {
+    content: "pasted",
+    channel_ids: [ch.tiktok.id],
+    media: [VIDEO],
+  })).body;
+  check("a pasted .mp4 URL is stored as a video", post.media[0].type === "video",
+    JSON.stringify(post.media));
+
+  const reread = (await h.get(`/api/posts/${post.id}`)).body;
+  check("and reads back as one", reread.media[0].type === "video");
+
+  await h.put(`/api/posts/${post.id}`, { media: [{ url: IMAGE, type: "image" }] });
+  const edited = (await h.get(`/api/posts/${post.id}`)).body;
+  check("replacing the video with an image leaves only the image",
+    edited.media.length === 1 && edited.media[0].type === "image" && edited.media[0].url === IMAGE,
+    JSON.stringify(edited.media));
+
+  const res = (await h.post(`/api/posts/${post.id}/publish`)).body.results;
+  check("and it publishes down the photo path", res[0].success &&
+    h.sends.some((s) => s.toolSlug === "TIKTOK_POST_PHOTO"));
+}
+
+
+/**
+ * TikTok's Content Posting API is asynchronous: both the video upload and the
+ * photo post return once TikTok has *accepted* the job, and the post only
+ * appears after a download/transcode/moderation pass that can still reject it.
+ *
+ * A channel marked published is terminal — publishPost() never sends to it
+ * again — so believing that acceptance is what makes a post that failed
+ * moderation invisible forever. Everything below is about never doing that.
+ */
+
+section("A TikTok post is only published once TikTok says it is");
+{
+  const h = await boot();
+  const ch = await channels(h);
+  h.db.prepare("UPDATE channels SET profile_handle = ? WHERE id = ?").run("thespot", ch.tiktok.id);
+  const post = (await h.post("/api/posts", {
+    content: "our new spot",
+    channel_ids: [ch.tiktok.id],
+    media: [{ url: VIDEO, type: "video" }],
+  })).body;
+
+  const r = by((await h.post(`/api/posts/${post.id}/publish`)).body.results, ch.tiktok.id);
+
+  check("it asked TikTok what happened before calling it published", h.polls.length === 1, h.polls.join(","));
+  check("and it is published", r.success);
+  check("with a link to the post TikTok reported", r.url === "https://www.tiktok.com/@thespot/video/7500", r.url);
+}
+
+section("A TikTok post that fails moderation is a failed channel, not a delivered one");
+{
+  const h = await boot({ tiktokStatus: () => ({ status: "FAILED", fail_reason: "spam_risk_text" }) });
+  const ch = await channels(h);
+  const post = (await h.post("/api/posts", {
+    content: "buy now",
+    channel_ids: [ch.tiktok.id],
+    media: [{ url: VIDEO, type: "video" }],
+  })).body;
+
+  const r = by((await h.post(`/api/posts/${post.id}/publish`)).body.results, ch.tiktok.id);
+
+  check("the channel fails, and says what TikTok objected to",
+    !r.success && /flagged the caption as spam/.test(r.error), r.error);
+  check("the row is failed, so the author can fix the caption and retry",
+    h.row("SELECT status FROM post_channels WHERE post_id = ?", post.id).status === "failed");
+  check("the post is not marked published",
+    h.row("SELECT status FROM posts WHERE id = ?", post.id).status !== "published");
+}
+
+section("A TikTok post left as an inbox draft is not a published post");
+{
+  const h = await boot({ tiktokStatus: () => ({ status: "SEND_TO_USER_INBOX" }) });
+  const ch = await channels(h);
+  const post = (await h.post("/api/posts", {
+    content: "draft",
+    channel_ids: [ch.tiktok.id],
+    media: [{ url: IMAGE, type: "image" }],
+  })).body;
+
+  const r = by((await h.post(`/api/posts/${post.id}/publish`)).body.results, ch.tiktok.id);
+  check("the photo path polls too — it is just as asynchronous", h.polls.length === 1);
+  check("and a draft is reported as one, not as a delivery",
+    !r.success && /left it as a draft/.test(r.error), r.error);
+}
+
+section("A TikTok post TikTok hasn't ruled on is re-checked, never re-sent");
+{
+  // TikTok never reaches a verdict on the first publish, then completes by the
+  // time the next delivery looks. This is the case that would double-post: the
+  // channel is not published, and re-initiating the same publish_id is exactly
+  // what TikTok's docs say never to do.
+  let verdict = { status: "PROCESSING_UPLOAD" };
+  const h = await boot({ tiktokStatus: () => verdict });
+  const ch = await channels(h);
+  const post = (await h.post("/api/posts", {
+    content: "still cooking",
+    channel_ids: [ch.tiktok.id],
+    media: [{ url: VIDEO, type: "video" }],
+  })).body;
+
+  const first = by((await h.post(`/api/posts/${post.id}/publish`)).body.results, ch.tiktok.id);
+  check("it is neither published nor failed", !first.success && first.pending === true);
+  check("and it says so plainly", /still processing/.test(first.error), first.error);
+
+  const row = h.row("SELECT status, ref, error FROM post_channels WHERE post_id = ?", post.id);
+  check("the row stays pending, holding the id TikTok gave us",
+    row.status === "pending" && row.ref === "tt-1", JSON.stringify(row));
+  check("the post reads partial, so the author still has a retry to press",
+    h.row("SELECT status FROM posts WHERE id = ?", post.id).status === "partial",
+    h.row("SELECT status FROM posts WHERE id = ?", post.id).status);
+
+  verdict = { status: "PUBLISH_COMPLETE", publicaly_available_post_id: ["7501"] };
+  const sendsBefore = h.sends.length;
+  const second = by((await h.post(`/api/posts/${post.id}/publish`)).body.results, ch.tiktok.id);
+
+  check("the next delivery confirms it instead of uploading again",
+    second.success && h.sends.length === sendsBefore, `${sendsBefore} -> ${h.sends.length}`);
+  check("and the post is published now",
+    h.row("SELECT status FROM posts WHERE id = ?", post.id).status === "published");
+}
+
+
+section("An unconfirmed TikTok post arranges its own follow-up");
+{
+  // Nobody is watching the request once it returns, so the re-check has to be
+  // queued work. It goes to /api/internal/publish — the same endpoint the
+  // scheduler uses — because publishPost already re-checks rather than re-sends.
+  let verdict = { status: "PROCESSING_UPLOAD" };
+  const h = await boot({ queue: true, tiktokStatus: () => verdict });
+  const ch = await channels(h);
+  const post = (await h.post("/api/posts", {
+    content: "still cooking",
+    channel_ids: [ch.tiktok.id],
+    media: [{ url: VIDEO, type: "video" }],
+  })).body;
+
+  await h.post(`/api/posts/${post.id}/publish`);
+
+  check("it queued exactly one follow-up", h.queued.length === 1, JSON.stringify(h.queued));
+  const job = h.queued[0]?.body ?? {};
+  check("aimed at the endpoint that re-checks, carrying this post",
+    /\/api\/internal\/publish$/.test(job.target_url || "") && job.payload?.post_id === post.id,
+    JSON.stringify(job));
+  check("a minute out, not immediately",
+    Math.round((Date.parse(job.run_at) - Date.now()) / 1000) >= 55, job.run_at);
+  check("and the schedule column is untouched — that job is the post's own",
+    h.row("SELECT queue_job_id FROM posts WHERE id = ?", post.id).queue_job_id === null);
+
+  // The follow-up lands and TikTok has made up its mind: it confirms, and asks
+  // for nothing further.
+  verdict = { status: "PUBLISH_COMPLETE", publicaly_available_post_id: ["7502"] };
+  await h.post(`/api/posts/${post.id}/publish`);
+  check("once it settles, nothing more is queued", h.queued.length === 1, JSON.stringify(h.queued));
+  check("and the post is published",
+    h.row("SELECT status FROM posts WHERE id = ?", post.id).status === "published");
+}
+
+section("A post TikTok never rules on stops rescheduling itself");
+{
+  // The ladder is the runaway guard: without it a publish_id the platform never
+  // settles would re-queue itself forever. Past the last rung the row keeps its
+  // ref and the author keeps the retry — nothing loops.
+  const h = await boot({ queue: true, tiktokStatus: () => ({ status: "PROCESSING_UPLOAD" }) });
+  const ch = await channels(h);
+  const post = (await h.post("/api/posts", {
+    content: "never settles",
+    channel_ids: [ch.tiktok.id],
+    media: [{ url: VIDEO, type: "video" }],
+  })).body;
+
+  await h.post(`/api/posts/${post.id}/publish`);
+  check("the first delivery queues a follow-up", h.queued.length === 1);
+
+  // Stand on the ladder's last rung, as a run of deliveries would have left us.
+  // The claim bumps attempts before the re-check reads it, so 4 here is the 5th
+  // and final delay.
+  h.db.prepare("UPDATE post_channels SET attempts = 4 WHERE post_id = ?").run(post.id);
+  await h.post(`/api/posts/${post.id}/publish`);
+  check("the last rung still queues one", h.queued.length === 2, JSON.stringify(h.queued.length));
+
+  await h.post(`/api/posts/${post.id}/publish`);
+  check("past it, nothing more is queued", h.queued.length === 2);
+  check("but the post keeps its id and its retry",
+    h.row("SELECT status, ref FROM post_channels WHERE post_id = ?", post.id).ref === "tt-1" &&
+    h.row("SELECT status FROM posts WHERE id = ?", post.id).status === "partial");
+}
+
+section("Without the managed queue, publishing still works — it just can't self-resolve");
+{
+  // The self-hosted case. Scheduling degrades to nothing, so the in-request
+  // poll is the only confirmation there is, and it must not take the post down
+  // with it when there's no queue to fall back on.
+  const h = await boot({ tiktokStatus: () => ({ status: "PROCESSING_UPLOAD" }) });
+  const ch = await channels(h);
+  const post = (await h.post("/api/posts", {
+    content: "no queue here",
+    channel_ids: [ch.tiktok.id],
+    media: [{ url: VIDEO, type: "video" }],
+  })).body;
+
+  const res = await h.post(`/api/posts/${post.id}/publish`);
+  check("the publish still succeeds as a request", res.status === 200);
+  check("nothing was queued", h.queued.length === 0);
+  check("and the row still holds the id, so a manual retry can confirm it",
+    h.row("SELECT status, ref FROM post_channels WHERE post_id = ?", post.id).ref === "tt-1");
+}
+
+report();