diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 2c91be5..53c9dbd 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -31,14 +31,16 @@ The Schuly **Microsoft plugin** is the only caller.
 - `entrance.http_client()` offers only `request`, `post`, `head` and `close`, takes a float timeout
   and reads every body into memory. Anything that must stay capped or be streamed uses
   `IMicrosoftHttpClients.download_client()` (httpx, HTTP/1.1, no redirects by default, no cookies kept,
-  because all accounts share it). Don't call `note.download` or `note.download_shared`: they hold the
+  because all accounts share it). `open_download` opens a pre-authorized link before the answer starts, so a refusal is a real status; it follows
+  redirects only through the host check, passes `Range` on and streams raw. `FileDownloads` keeps a link for 10 minutes, so a video's seeks cost no Graph calls. Don't call `note.download` or `note.download_shared`: they hold the
   whole file with no cap and no host check.
 - `except entrance.HTTPError` works alone, but it is a tuple: unpack it next to other types.
 - `TeamsFiles.download_url` stays: it serves the `shares/...` path chat files need, which OutNote's
   `download_url` can't. A folder is a 404 that says so; Graph's refusal at `/content` keeps its own
   status (403, 404, 415, 429).
 - One `OutNote` per account lives on its broker. A throttled call raises `GraphError` 429 after about
-  60 s, which `AccountRunner` answers as 429 with `Retry-After` (and any rotated token).
+  60 s, or at once with `retry=False`, which `AccountRunner` answers as 429 with `Retry-After` (and any rotated token) and logs as a warning with the masked route (`GraphCallTrail`). Keep ids and content out of that line. The chat file, thumbnail and message reads use `retry=False`: the caller waits, not a worker thread.
+- Graph throttles the single chat message read (`chats/{id}/messages/{id}`) far sooner than the list, so `ChatReader.file_ref` answers from what the list already said, then asks `note.chat_message` (Teams' own API, which falls back to that same read and may answer 429 for it), and when that refuses or lacks the file, the list.
 - `AccountRunner` strips `_native` from every result. No route calls OutNote's native reads today: chat
   messages stay on Graph's list because `ChatReader` and the callers need its attachments, mentions and
   reactions. `emails()` gets an explicit `$select` because the web's list shows `toRecipients`.
diff --git a/requirements.txt b/requirements.txt
index f06f40c..7622dae 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -2,7 +2,7 @@ fastapi==0.122.0
 uvicorn==0.38.0
 httpx==0.28.1
 python-multipart==0.0.20
-outnote==2.0.1
+outnote==2.2.0
 ms-entrance==2.0.0
 wreq==0.13.0
 python-docx==1.2.0
diff --git a/src/api/controllers/chats_controller.py b/src/api/controllers/chats_controller.py
index dec6b94..ad3a1b2 100644
--- a/src/api/controllers/chats_controller.py
+++ b/src/api/controllers/chats_controller.py
@@ -39,8 +39,8 @@ async def chat_hosted_content(self, chat_id: str, message_id: str, hosted_id: st
         return FileResponses.image(await self.mediator.send(GetChatHostedContentQuery(token, chat_id, message_id, hosted_id)))
 
     @router.get("/chats/{chat_id}/messages/{message_id}/files/{attachment_id}", tags=["Microsoft 365"], response_class=StreamingResponse, responses={200: {"content": {"application/octet-stream": {}}}})
-    async def chat_file(self, chat_id: str, message_id: str, attachment_id: str, token: str = Header(..., alias=HttpHeaders.REFRESH_TOKEN_HEADER)):
-        return FileResponses.stream(await self.mediator.send(GetChatFileQuery(token, chat_id, message_id, attachment_id)))
+    async def chat_file(self, chat_id: str, message_id: str, attachment_id: str, token: str = Header(..., alias=HttpHeaders.REFRESH_TOKEN_HEADER), byte_range: str | None = Header(None, alias="Range")):
+        return FileResponses.stream(await self.mediator.send(GetChatFileQuery(token, chat_id, message_id, attachment_id, byte_range)))
 
     @router.get("/chats/{chat_id}/messages/{message_id}/files/{attachment_id}/thumbnail", tags=["Microsoft 365"], response_class=Response, responses={200: {"content": {"image/jpeg": {}}}})
     async def chat_file_thumbnail(self, chat_id: str, message_id: str, attachment_id: str, token: str = Header(..., alias=HttpHeaders.REFRESH_TOKEN_HEADER), size: str = Query("medium")):
diff --git a/src/api/controllers/files_controller.py b/src/api/controllers/files_controller.py
index 8c04d1e..7b74839 100644
--- a/src/api/controllers/files_controller.py
+++ b/src/api/controllers/files_controller.py
@@ -78,9 +78,9 @@ async def drive_item_children(self, drive_id: str, item_id: str, response: Respo
         return await self.mediator.send(ListDriveItemChildrenQuery(token, drive_id, item_id, top))
 
     @router.get("/drives/{drive_id}/items/{item_id}/content", tags=["Teams files"], response_class=StreamingResponse, responses={200: {"content": {"application/octet-stream": {}}}})
-    async def drive_item_content(self, drive_id: str, item_id: str, token: str = Header(..., alias=HttpHeaders.REFRESH_TOKEN_HEADER)):
+    async def drive_item_content(self, drive_id: str, item_id: str, token: str = Header(..., alias=HttpHeaders.REFRESH_TOKEN_HEADER), byte_range: str | None = Header(None, alias="Range")):
         """The file's bytes as an attachment (<= 100 MB, no-store)."""
-        return FileResponses.stream(await self.mediator.send(GetDriveItemContentQuery(token, drive_id, item_id)))
+        return FileResponses.stream(await self.mediator.send(GetDriveItemContentQuery(token, drive_id, item_id, byte_range)))
 
     @router.get("/drives/{drive_id}/items/{item_id}/pdf", tags=["Files as PDF"], response_class=StreamingResponse, responses={200: {"content": {"application/pdf": {}}}})
     async def shared_drive_item_pdf(self, drive_id: str, item_id: str, token: str = Header(..., alias=HttpHeaders.REFRESH_TOKEN_HEADER)):
diff --git a/src/api/extensions/chats_extensions.py b/src/api/extensions/chats_extensions.py
index 94e7280..ca8610e 100644
--- a/src/api/extensions/chats_extensions.py
+++ b/src/api/extensions/chats_extensions.py
@@ -12,7 +12,6 @@
 from src.application.queries.get_chat_photo_query import GetChatPhotoQuery, GetChatPhotoHandler
 from src.application.queries.list_chat_messages_query import ListChatMessagesQuery, ListChatMessagesHandler
 from src.application.queries.list_chats_query import ListChatsQuery, ListChatsHandler
-from src.application.services.chat_file_lookup import ChatFileLookup
 from src.application.services.chat_html_sanitizer import ChatHtmlSanitizer
 from src.infrastructure.teams.chat_reader import ChatReader
 from src.infrastructure.teams.chat_sender import ChatSender
@@ -23,7 +22,6 @@ class ChatsExtensions:
     @staticmethod
     def add_chats(services: ServiceCollection) -> ServiceCollection:
         services.add_singleton(ChatHtmlSanitizer)
-        services.add_singleton(ChatFileLookup)
         services.add_singleton(ITeamsChat, TeamsChatClient)
         services.add_singleton(IChatReader, ChatReader)
         services.add_singleton(IChatSender, ChatSender)
diff --git a/src/api/extensions/files_extensions.py b/src/api/extensions/files_extensions.py
index 9b2c3cf..8fa4fbb 100644
--- a/src/api/extensions/files_extensions.py
+++ b/src/api/extensions/files_extensions.py
@@ -21,6 +21,7 @@
 from src.application.services.drive_file_text_reader import DriveFileTextReader
 from src.application.services.drive_item_checks import DriveItemChecks
 from src.infrastructure.files.file_text_extractor import FileTextExtractor
+from src.application.services.file_downloads import FileDownloads
 from src.infrastructure.graph.file_thumbnails import FileThumbnails
 from src.infrastructure.graph.pdf_converter import PdfConverter
 from src.infrastructure.graph.teams_files import TeamsFiles
@@ -34,6 +35,7 @@ def add_files(services: ServiceCollection) -> ServiceCollection:
         services.add_singleton(IFileTextExtractor, FileTextExtractor)
         services.add_singleton(ITeamsFiles, TeamsFiles)
         services.add_singleton(DriveItemChecks)
+        services.add_singleton(FileDownloads)
         services.add_singleton(DriveFileTextReader)
         services.add_singleton(AccountImageReader)
 
diff --git a/src/api/responses/file_responses.py b/src/api/responses/file_responses.py
index 3b2c4d0..609046c 100644
--- a/src/api/responses/file_responses.py
+++ b/src/api/responses/file_responses.py
@@ -21,7 +21,13 @@ def attachment(cls, content: BinaryContent) -> Response:
 
     @classmethod
     def stream(cls, content: FileStream) -> StreamingResponse:
-        return StreamingResponse(content.chunks, media_type=content.content_type, headers=cls._download_headers(content.file_name))
+        """Always an attachment that can't run, whatever the type: a `<video>` plays it all the same and a navigation downloads it."""
+        headers = {**cls._download_headers(content.file_name), "Accept-Ranges": "bytes"}
+        if content.content_length is not None:
+            headers["Content-Length"] = str(content.content_length)
+        if content.content_range:
+            headers["Content-Range"] = content.content_range
+        return StreamingResponse(content.chunks, status_code=content.status_code, media_type=content.content_type, headers=headers)
 
     @classmethod
     def image(cls, content: BinaryContent) -> Response:
diff --git a/src/application/abstractions/i_chat_reader.py b/src/application/abstractions/i_chat_reader.py
index e6780fc..cc73057 100644
--- a/src/application/abstractions/i_chat_reader.py
+++ b/src/application/abstractions/i_chat_reader.py
@@ -8,4 +8,7 @@ class IChatReader(ABC):
     """Graph chat messages made ready for the web."""
 
     @abstractmethod
-    def enrich(self, note: IGraphClient, broker: IAccountBroker, messages: list[dict]) -> list[dict]: ...
+    def enrich(self, note: IGraphClient, broker: IAccountBroker, messages: list[dict], chat_id: str | None = None) -> list[dict]: ...
+
+    @abstractmethod
+    def file_ref(self, note: IGraphClient, broker: IAccountBroker, chat_id: str, message_id: str, attachment_id: str) -> dict | None: ...
diff --git a/src/application/abstractions/i_file_thumbnails.py b/src/application/abstractions/i_file_thumbnails.py
index 0862312..69e36db 100644
--- a/src/application/abstractions/i_file_thumbnails.py
+++ b/src/application/abstractions/i_file_thumbnails.py
@@ -24,6 +24,9 @@ def image_type(self, head: bytes) -> str | None: ...
     @abstractmethod
     def safe_graph_id(self, value) -> bool: ...
 
+    @abstractmethod
+    def remember_item(self, broker: IAccountBroker, url: str, item: dict) -> None: ...
+
     @abstractmethod
     def chat_file_thumbnail(self, note: IGraphClient, broker: IAccountBroker, url: str, size: str) -> bytes | None: ...
 
diff --git a/src/application/abstractions/i_graph_client.py b/src/application/abstractions/i_graph_client.py
index 06ec0e0..65a2343 100644
--- a/src/application/abstractions/i_graph_client.py
+++ b/src/application/abstractions/i_graph_client.py
@@ -5,7 +5,7 @@ class IGraphClient(ABC):
     """What the application asks of a per-account Graph client. OutNote is registered as one by the infrastructure."""
 
     @abstractmethod
-    def get(self, path, params=None, client=None, raw=False): ...
+    def get(self, path, params=None, client=None, raw=False, retry=True): ...
 
     @abstractmethod
     def list(self, path, params=None, limit=None, client=None): ...
diff --git a/src/application/abstractions/i_microsoft_http_clients.py b/src/application/abstractions/i_microsoft_http_clients.py
index bbc752d..46d7292 100644
--- a/src/application/abstractions/i_microsoft_http_clients.py
+++ b/src/application/abstractions/i_microsoft_http_clients.py
@@ -1,5 +1,7 @@
 from abc import ABC, abstractmethod
-from collections.abc import Iterator
+from collections.abc import Callable
+
+from src.domain.files.file_stream import FileStream
 
 
 class IMicrosoftHttpClients(ABC):
@@ -9,7 +11,7 @@ class IMicrosoftHttpClients(ABC):
     def download_client(self): ...
 
     @abstractmethod
-    def stream_download(self, url: str, limit: int, follow_redirects: bool = True) -> Iterator[bytes]: ...
+    def open_download(self, url: str, limit: int, allowed: Callable[[str], bool], content_type: str, file_name: str, byte_range: str | None = None) -> FileStream: ...
 
     @abstractmethod
     async def post_form(self, url: str, data: dict, client=None) -> dict: ...
diff --git a/src/application/abstractions/i_teams_files.py b/src/application/abstractions/i_teams_files.py
index 67e1877..1664265 100644
--- a/src/application/abstractions/i_teams_files.py
+++ b/src/application/abstractions/i_teams_files.py
@@ -22,6 +22,15 @@ def fetch_bytes(self, url: str, cap: int) -> bytes: ...
     @abstractmethod
     def download_link(self, note: IGraphClient, path: str, item: dict) -> str: ...
 
+    @abstractmethod
+    def cached_download(self, broker: IAccountBroker, key: tuple) -> dict | None: ...
+
+    @abstractmethod
+    def remember_download(self, broker: IAccountBroker, key: tuple, target: dict) -> None: ...
+
+    @abstractmethod
+    def forget_download(self, broker: IAccountBroker, key: tuple) -> None: ...
+
     @abstractmethod
     def item_base(self, drive_id: str | None, item_id: str) -> str: ...
 
diff --git a/src/application/queries/get_chat_file_pdf_query.py b/src/application/queries/get_chat_file_pdf_query.py
index 0f4a68e..c1cc8e0 100644
--- a/src/application/queries/get_chat_file_pdf_query.py
+++ b/src/application/queries/get_chat_file_pdf_query.py
@@ -3,9 +3,9 @@
 from mediatorx import IQuery, IQueryHandler
 
 from src.application.abstractions.i_account_runner import IAccountRunner
+from src.application.abstractions.i_chat_reader import IChatReader
 from src.application.abstractions.i_file_thumbnails import IFileThumbnails
 from src.application.abstractions.i_pdf_converter import IPdfConverter
-from src.application.services.chat_file_lookup import ChatFileLookup
 from src.application.services.drive_item_checks import DriveItemChecks
 from src.application.services.graph_paths import GraphPaths
 from src.domain.errors.service_error import ServiceError
@@ -22,9 +22,9 @@ class GetChatFilePdfQuery(IQuery[SpooledPdf]):
 
 
 class GetChatFilePdfHandler(IQueryHandler[GetChatFilePdfQuery, SpooledPdf]):
-    def __init__(self, accounts: IAccountRunner, lookup: ChatFileLookup, thumbnails: IFileThumbnails, pdf: IPdfConverter, checks: DriveItemChecks):
+    def __init__(self, accounts: IAccountRunner, reader: IChatReader, thumbnails: IFileThumbnails, pdf: IPdfConverter, checks: DriveItemChecks):
         self._accounts = accounts
-        self._lookup = lookup
+        self._reader = reader
         self._thumbnails = thumbnails
         self._pdf = pdf
         self._checks = checks
@@ -35,7 +35,7 @@ async def handle(self, query: GetChatFilePdfQuery) -> SpooledPdf:
         GraphIds.check(query.attachment_id, GraphIds.ATTACHMENT_ID_PATTERN, "attachment_id")
 
         def convert(note, broker):
-            ref = self._lookup.find(note, query.chat_id, query.message_id, query.attachment_id)
+            ref = self._reader.file_ref(note, broker, query.chat_id, query.message_id, query.attachment_id)
             if ref is None:
                 raise ServiceError(404, "File not found in the message.")
             if not self._thumbnails.is_share_url(ref.get("contentUrl")):
diff --git a/src/application/queries/get_chat_file_query.py b/src/application/queries/get_chat_file_query.py
index 5eb294b..c8275e7 100644
--- a/src/application/queries/get_chat_file_query.py
+++ b/src/application/queries/get_chat_file_query.py
@@ -2,12 +2,11 @@
 
 from mediatorx import IQuery, IQueryHandler
 
-from src.application.abstractions.i_account_runner import IAccountRunner
-from src.application.abstractions.i_microsoft_http_clients import IMicrosoftHttpClients
+from src.application.abstractions.i_chat_reader import IChatReader
+from src.application.abstractions.i_file_thumbnails import IFileThumbnails
 from src.application.abstractions.i_teams_files import ITeamsFiles
-from src.application.services.chat_file_lookup import ChatFileLookup
-from src.application.services.content_names import ContentNames
 from src.application.services.drive_item_checks import DriveItemChecks
+from src.application.services.file_downloads import FileDownloads
 from src.application.services.graph_paths import GraphPaths
 from src.domain.errors.service_error import ServiceError
 from src.domain.files.file_limits import FileLimits
@@ -21,34 +20,35 @@ class GetChatFileQuery(IQuery[FileStream]):
     chat_id: str
     message_id: str
     attachment_id: str
+    byte_range: str | None = None
 
 
 class GetChatFileHandler(IQueryHandler[GetChatFileQuery, FileStream]):
-    def __init__(self, accounts: IAccountRunner, lookup: ChatFileLookup, files: ITeamsFiles, http: IMicrosoftHttpClients):
-        self._accounts = accounts
-        self._lookup = lookup
+    def __init__(self, reader: IChatReader, thumbnails: IFileThumbnails, files: ITeamsFiles, downloads: FileDownloads):
+        self._reader = reader
+        self._thumbnails = thumbnails
         self._files = files
-        self._http = http
+        self._downloads = downloads
 
     async def handle(self, query: GetChatFileQuery) -> FileStream:
         GraphIds.check(query.chat_id, GraphIds.CHAT_ID_PATTERN, "chat_id")
         GraphIds.check(query.message_id, GraphIds.MESSAGE_ID_PATTERN, "message_id")
         GraphIds.check(query.attachment_id, GraphIds.ATTACHMENT_ID_PATTERN, "attachment_id")
 
-        def resolve(note, broker):
-            ref = self._lookup.find(note, query.chat_id, query.message_id, query.attachment_id)
+        def read(note, broker):
+            ref = self._reader.file_ref(note, broker, query.chat_id, query.message_id, query.attachment_id)
             if ref is None:
                 raise ServiceError(404, "File not found in the message.")
-            item = note.get(GraphPaths.drive_item_path(ref["contentUrl"], "name,size,file,folder,@microsoft.graph.downloadUrl"))
+            path = GraphPaths.share_item_path(ref["contentUrl"])
+            # Throttled, this answers at once: the caller waits, rather than a worker thread.
+            item = note.get(path, retry=False)
             if item.get("folder") is not None:
                 raise ServiceError(404, DriveItemChecks.FOLDER_DETAIL)
             if (item.get("size") or 0) > FileLimits.MAX_CHAT_FILE_BYTES:
                 raise ServiceError(413, "The file is larger than 100 MB.")
-            url = self._files.download_link(note, f"shares/{GraphPaths.share_id(ref['contentUrl'])}/driveItem", item)
-            if not self._files.is_download_url(url):
-                raise ServiceError(502, "The file has an unexpected download location.")
-            return item, url
-
-        item, url = await self._accounts.run(query.refresh_token, resolve)
-        # The download URL is pre-authorized and short-lived; the bytes stream through without being held.
-        return FileStream(self._http.stream_download(url, FileLimits.MAX_CHAT_FILE_BYTES, follow_redirects=False), ContentNames.safe_content_type((item.get("file") or {}).get("mimeType")), ContentNames.safe_name(item.get("name")))
+            self._thumbnails.remember_item(broker, ref["contentUrl"], item)
+            return item, self._files.download_link(note, path, item)
+
+        key = ("chat", query.chat_id, query.message_id, query.attachment_id)
+        # The link is pre-authorized and short-lived; the bytes stream through without being held.
+        return await self._downloads.open(query.refresh_token, key, read, FileLimits.MAX_CHAT_FILE_BYTES, query.byte_range)
diff --git a/src/application/queries/get_chat_file_thumbnail_query.py b/src/application/queries/get_chat_file_thumbnail_query.py
index f7e12f1..00ba130 100644
--- a/src/application/queries/get_chat_file_thumbnail_query.py
+++ b/src/application/queries/get_chat_file_thumbnail_query.py
@@ -2,9 +2,9 @@
 
 from mediatorx import IQuery, IQueryHandler
 
+from src.application.abstractions.i_chat_reader import IChatReader
 from src.application.abstractions.i_file_thumbnails import IFileThumbnails
 from src.application.services.account_image_reader import AccountImageReader
-from src.application.services.chat_file_lookup import ChatFileLookup
 from src.domain.files.binary_content import BinaryContent
 from src.domain.validation.graph_ids import GraphIds
 
@@ -19,9 +19,9 @@ class GetChatFileThumbnailQuery(IQuery[BinaryContent]):
 
 
 class GetChatFileThumbnailHandler(IQueryHandler[GetChatFileThumbnailQuery, BinaryContent]):
-    def __init__(self, images: AccountImageReader, lookup: ChatFileLookup, thumbnails: IFileThumbnails):
+    def __init__(self, images: AccountImageReader, reader: IChatReader, thumbnails: IFileThumbnails):
         self._images = images
-        self._lookup = lookup
+        self._reader = reader
         self._thumbnails = thumbnails
 
     async def handle(self, query: GetChatFileThumbnailQuery) -> BinaryContent:
@@ -31,7 +31,7 @@ async def handle(self, query: GetChatFileThumbnailQuery) -> BinaryContent:
         self._images.check_thumbnail_size(query.size)
 
         def fetch(note, broker):
-            ref = self._lookup.find(note, query.chat_id, query.message_id, query.attachment_id)
+            ref = self._reader.file_ref(note, broker, query.chat_id, query.message_id, query.attachment_id)
             if ref is None or not self._thumbnails.is_share_url(ref["contentUrl"]):
                 return None
             return self._thumbnails.chat_file_thumbnail(note, broker, ref["contentUrl"], query.size)
diff --git a/src/application/queries/get_drive_item_content_query.py b/src/application/queries/get_drive_item_content_query.py
index 484ab08..9678b5c 100644
--- a/src/application/queries/get_drive_item_content_query.py
+++ b/src/application/queries/get_drive_item_content_query.py
@@ -2,11 +2,9 @@
 
 from mediatorx import IQuery, IQueryHandler
 
-from src.application.abstractions.i_account_runner import IAccountRunner
-from src.application.abstractions.i_microsoft_http_clients import IMicrosoftHttpClients
 from src.application.abstractions.i_teams_files import ITeamsFiles
-from src.application.services.content_names import ContentNames
 from src.application.services.drive_item_checks import DriveItemChecks
+from src.application.services.file_downloads import FileDownloads
 from src.domain.errors.service_error import ServiceError
 from src.domain.files.file_stream import FileStream
 from src.domain.validation.graph_ids import GraphIds
@@ -17,28 +15,24 @@ class GetDriveItemContentQuery(IQuery[FileStream]):
     refresh_token: str = field(repr=False)
     drive_id: str
     item_id: str
+    byte_range: str | None = None
 
 
 class GetDriveItemContentHandler(IQueryHandler[GetDriveItemContentQuery, FileStream]):
-    def __init__(self, accounts: IAccountRunner, files: ITeamsFiles, checks: DriveItemChecks, http: IMicrosoftHttpClients):
-        self._accounts = accounts
+    def __init__(self, files: ITeamsFiles, checks: DriveItemChecks, downloads: FileDownloads):
         self._files = files
         self._checks = checks
-        self._http = http
+        self._downloads = downloads
 
     async def handle(self, query: GetDriveItemContentQuery) -> FileStream:
         GraphIds.check(query.drive_id, GraphIds.DRIVE_ID_PATTERN, "drive_id")
         GraphIds.check(query.item_id, GraphIds.DRIVE_ITEM_PATTERN, "item_id")
 
-        def resolve(note, broker):
+        def read(note, broker):
             item = note.get(self._files.item_base(query.drive_id, query.item_id), {"$select": "id,name,size,file,folder,@microsoft.graph.downloadUrl"})
             self._checks.check_file(item)
             if (item.get("size") or 0) > self._files.MAX_DOWNLOAD_BYTES:
                 raise ServiceError(413, "The file is larger than 100 MB.")
-            url = self._files.download_link(note, self._files.item_base(query.drive_id, query.item_id), item)
-            if not self._files.is_download_url(url):
-                raise ServiceError(502, "The file has an unexpected download location.")
-            return item, url
+            return item, self._files.download_link(note, self._files.item_base(query.drive_id, query.item_id), item)
 
-        item, url = await self._accounts.run(query.refresh_token, resolve)
-        return FileStream(self._http.stream_download(url, self._files.MAX_DOWNLOAD_BYTES, follow_redirects=False), ContentNames.safe_content_type((item.get("file") or {}).get("mimeType")), ContentNames.safe_name(item.get("name")))
+        return await self._downloads.open(query.refresh_token, ("drive", query.drive_id, query.item_id), read, self._files.MAX_DOWNLOAD_BYTES, query.byte_range)
diff --git a/src/application/queries/list_chat_messages_query.py b/src/application/queries/list_chat_messages_query.py
index f6829d3..ce128d8 100644
--- a/src/application/queries/list_chat_messages_query.py
+++ b/src/application/queries/list_chat_messages_query.py
@@ -22,4 +22,4 @@ def __init__(self, accounts: IAccountRunner, reader: IChatReader):
     async def handle(self, query: ListChatMessagesQuery) -> list[dict]:
         GraphIds.check(query.chat_id, GraphIds.CHAT_ID_PATTERN, "chat_id")
         # No $select: Graph answers 500 for chat messages when one is set.
-        return await self._accounts.run(query.refresh_token, lambda note, broker: self._reader.enrich(note, broker, note.list(f"me/chats/{query.chat_id}/messages", {"$top": min(query.top, 50)}, limit=query.top)))
+        return await self._accounts.run(query.refresh_token, lambda note, broker: self._reader.enrich(note, broker, note.list(f"me/chats/{query.chat_id}/messages", {"$top": min(query.top, 50)}, limit=query.top), query.chat_id))
diff --git a/src/application/services/chat_file_lookup.py b/src/application/services/chat_file_lookup.py
deleted file mode 100644
index 7f37207..0000000
--- a/src/application/services/chat_file_lookup.py
+++ /dev/null
@@ -1,14 +0,0 @@
-from src.application.abstractions.i_graph_client import IGraphClient
-from src.application.services.chat_html_sanitizer import ChatHtmlSanitizer
-from src.application.services.graph_paths import GraphPaths
-
-
-class ChatFileLookup:
-    """A file shared in a chat message, found by its attachment id."""
-
-    def __init__(self, html: ChatHtmlSanitizer):
-        self._html = html
-
-    def find(self, note: IGraphClient, chat_id: str, message_id: str, attachment_id: str) -> dict | None:
-        message = note.get(GraphPaths.message_path(chat_id, message_id))
-        return next((f for f in self._html.reference_files(message) if f.get("id") == attachment_id), None)
diff --git a/src/application/services/chat_html_sanitizer.py b/src/application/services/chat_html_sanitizer.py
index d05d882..c4819bb 100644
--- a/src/application/services/chat_html_sanitizer.py
+++ b/src/application/services/chat_html_sanitizer.py
@@ -108,6 +108,12 @@ class ChatHtmlSanitizer:
     GIF_HOSTS = frozenset({"media.giphy.com", "media0.giphy.com", "media1.giphy.com", "media2.giphy.com", "media3.giphy.com", "media4.giphy.com", "i.giphy.com", "media.tenor.com", "media1.tenor.com", "c.tenor.com"})
     STICKER_HOSTS = frozenset({"stickers.newfuture.cc"})
     GIPHY_ITEMTYPE = "http://schema.skype.com/Giphy"
+    QUOTE_KINDS = {"forwardedMessageReference": "forward", "messageReference": "reply"}
+    QUOTE_SENDER_NAME_FIELDS = ("originalSenderDisplayName", "senderDisplayName", "messageSenderDisplayName")
+    QUOTE_SENDER_FIELDS = ("originalSender", "messageSender", "sender", "from")
+    QUOTE_TIME_FIELDS = ("originalSentDateTime", "originalCreatedDateTime", "originalMessageDateTime", "originalMessageTime", "sentDateTime", "createdDateTime", "originalArrivalTime")
+    QUOTE_BODY_FIELDS = ("originalMessageContent", "originalContent", "originalMessage", "messageContent", "content", "body", "originalMessagePreview", "messagePreview", "preview")
+    MAX_QUOTE_FIELD_CHARS = 300
     CARD_PREFIX = "application/vnd.microsoft.card."
     MAX_CARD_CHARS = 64 * 1024
 
@@ -206,6 +212,65 @@ def reference_files(message: dict) -> list[dict]:
                 out.append({"id": a.get("id"), "name": a.get("name"), "contentUrl": a.get("contentUrl")})
         return out
 
+    @staticmethod
+    def quotes(message: dict) -> list[dict]:
+        """Forwarded messages and replies, which arrive as attachments: [{kind: "forward"|"reply", senderName, sentAt, content, contentType}], with no ids.
+
+        Graph documents only that a forward's `content` holds "the original message context", so several names are read. `content` goes to the client's message sanitizer like a message body."""
+        out = []
+        for a in message.get("attachments") or []:
+            kind = ChatHtmlSanitizer.QUOTE_KINDS.get(a.get("contentType"))
+            if kind is None:
+                continue
+            raw = a.get("content")
+            parsed = raw if isinstance(raw, dict) else None
+            if isinstance(raw, str) and len(raw) <= ChatHtmlSanitizer.MAX_CARD_CHARS:
+                try:
+                    parsed = json.loads(raw)
+                except ValueError:
+                    parsed = None
+            if not isinstance(parsed, dict):
+                parsed = {}
+            content, content_type = ChatHtmlSanitizer._quote_content(parsed)
+            quote = {"kind": kind, "senderName": ChatHtmlSanitizer._quote_sender(parsed), "sentAt": ChatHtmlSanitizer._first_text(parsed, ChatHtmlSanitizer.QUOTE_TIME_FIELDS), "content": content, "contentType": content_type}
+            if content is None and parsed:
+                quote["unread"] = sorted(k for k in parsed if isinstance(k, str) and k.isalnum())[:30]
+            out.append(quote)
+        return out
+
+    @staticmethod
+    def _first_text(values: dict, names: tuple[str, ...]) -> str | None:
+        return next((v[:ChatHtmlSanitizer.MAX_QUOTE_FIELD_CHARS] for v in (values.get(n) for n in names) if isinstance(v, str) and v.strip()), None)
+
+    @staticmethod
+    def _quote_sender(values: dict) -> str | None:
+        name = ChatHtmlSanitizer._first_text(values, ChatHtmlSanitizer.QUOTE_SENDER_NAME_FIELDS)
+        if name:
+            return name
+        for field_name in ChatHtmlSanitizer.QUOTE_SENDER_FIELDS:
+            sender = values.get(field_name)
+            if isinstance(sender, str) and sender.strip():
+                return sender[:ChatHtmlSanitizer.MAX_QUOTE_FIELD_CHARS]
+            if isinstance(sender, dict):
+                for who in (sender.get("user"), sender.get("application"), sender):
+                    name = ChatHtmlSanitizer._first_text(who, ("displayName",)) if isinstance(who, dict) else None
+                    if name:
+                        return name
+        return None
+
+    @staticmethod
+    def _quote_content(values: dict) -> tuple[str | None, str]:
+        for name in ChatHtmlSanitizer.QUOTE_BODY_FIELDS:
+            body = values.get(name)
+            if isinstance(body, dict):
+                kind, body = str(body.get("contentType") or "").lower(), body.get("content")
+            else:
+                kind = str(values.get(name + "Type") or values.get("contentType") or "").lower()
+            if isinstance(body, str) and body.strip():
+                is_html = kind == "html" or (kind != "text" and "<" in body and ">" in body)
+                return body[:ChatHtmlSanitizer.MAX_CARD_CHARS], "html" if is_html else "text"
+        return None, "text"
+
     @staticmethod
     def cards(message: dict) -> list[dict]:
         """Card attachments (adaptive cards, polls, sticker apps, link previews): [{id, contentType, teamsAppId, name, content, sticker}].
diff --git a/src/application/services/content_names.py b/src/application/services/content_names.py
index 1540a64..a4c3f42 100644
--- a/src/application/services/content_names.py
+++ b/src/application/services/content_names.py
@@ -1,3 +1,4 @@
+import posixpath
 import re
 
 
@@ -6,6 +7,13 @@ class ContentNames:
 
     CONTENT_TYPE_PATTERN = re.compile(r"[A-Za-z0-9][\w.+-]{0,126}/[A-Za-z0-9][\w.+-]{0,126}")
     ACTIVE_TYPE_PARTS = ("html", "svg", "xml", "javascript", "ecmascript", "multipart")
+    GENERIC_TYPES = ("", "application/octet-stream", "binary/octet-stream", "application/binary")
+    TYPES_BY_EXTENSION = {
+        "mp4": "video/mp4", "m4v": "video/mp4", "webm": "video/webm", "mov": "video/quicktime", "ogv": "video/ogg",
+        "mp3": "audio/mpeg", "m4a": "audio/mp4", "wav": "audio/wav", "ogg": "audio/ogg", "oga": "audio/ogg", "opus": "audio/ogg", "flac": "audio/flac", "aac": "audio/aac",
+        "png": "image/png", "jpg": "image/jpeg", "jpeg": "image/jpeg", "gif": "image/gif", "webp": "image/webp", "bmp": "image/bmp", "avif": "image/avif", "heic": "image/heic",
+        "pdf": "application/pdf",
+    }
 
     @classmethod
     def safe_content_type(cls, value: str | None) -> str:
@@ -15,6 +23,14 @@ def safe_content_type(cls, value: str | None) -> str:
             return "application/octet-stream"
         return content_type
 
+    @classmethod
+    def media_type(cls, name: str | None, mime: str | None) -> str:
+        """What to serve a file as: Graph's type, or from the extension when Graph leaves it out or calls it generic. An active type stays opaque, and the map holds none."""
+        if (mime or "").split(";")[0].strip().lower() not in cls.GENERIC_TYPES:
+            return cls.safe_content_type(mime)
+        extension = posixpath.splitext(name or "")[1].lstrip(".").lower()
+        return cls.TYPES_BY_EXTENSION.get(extension, "application/octet-stream")
+
     @staticmethod
     def safe_name(name: str | None) -> str:
         cleaned = re.sub(r'[\x00-\x1f\x7f\\/:*?"<>|]', "_", name or "")
diff --git a/src/application/services/file_downloads.py b/src/application/services/file_downloads.py
new file mode 100644
index 0000000..e467203
--- /dev/null
+++ b/src/application/services/file_downloads.py
@@ -0,0 +1,48 @@
+import asyncio
+from collections.abc import Callable
+
+from src.application.abstractions.i_account_runner import IAccountRunner
+from src.application.abstractions.i_microsoft_http_clients import IMicrosoftHttpClients
+from src.application.abstractions.i_teams_files import ITeamsFiles
+from src.application.services.content_names import ContentNames
+from src.domain.errors.download_link_expired import DownloadLinkExpired
+from src.domain.errors.service_error import ServiceError
+from src.domain.files.byte_range import ByteRange
+from src.domain.files.file_stream import FileStream
+
+
+class FileDownloads:
+    """Opens a file's bytes for streaming. The link is kept per account for minutes, so a video's seeks don't each cost Graph calls; a link SharePoint refuses is replaced once."""
+
+    def __init__(self, accounts: IAccountRunner, files: ITeamsFiles, http: IMicrosoftHttpClients):
+        self._accounts = accounts
+        self._files = files
+        self._http = http
+
+    async def open(self, token: str, key: tuple, read: Callable, limit: int, byte_range: str | None) -> FileStream:
+        """`read(note, broker)` answers `(item, link)` when no link is kept."""
+
+        def target(note, broker, again=False):
+            kept = None if again else self._files.cached_download(broker, key)
+            if kept:
+                return kept
+            item, url = read(note, broker)
+            name = item.get("name")
+            found = {"url": url, "name": ContentNames.safe_name(name), "type": ContentNames.media_type(name, (item.get("file") or {}).get("mimeType"))}
+            self._files.remember_download(broker, key, found)
+            return found
+
+        found = await self._accounts.run(token, target)
+        try:
+            return await self._open(found, limit, byte_range)
+        except DownloadLinkExpired:
+            pass
+        found = await self._accounts.run(token, lambda note, broker: target(note, broker, again=True))
+        try:
+            return await self._open(found, limit, byte_range)
+        except DownloadLinkExpired:
+            await self._accounts.run(token, lambda note, broker: self._files.forget_download(broker, key))
+            raise ServiceError(502, "SharePoint refused the download.")
+
+    async def _open(self, found: dict, limit: int, byte_range: str | None) -> FileStream:
+        return await asyncio.to_thread(self._http.open_download, found["url"], limit, self._files.is_download_url, found["type"], found["name"], ByteRange.parse(byte_range))
diff --git a/src/application/services/graph_paths.py b/src/application/services/graph_paths.py
index aefbe2b..95e627e 100644
--- a/src/application/services/graph_paths.py
+++ b/src/application/services/graph_paths.py
@@ -15,6 +15,11 @@ def share_id(url: str) -> str:
     def drive_item_path(cls, url: str, select: str = DRIVE_ITEM_FIELDS) -> str:
         return f"shares/{cls.share_id(url)}/driveItem?$select={select}"
 
+    @classmethod
+    def share_item_path(cls, url: str) -> str:
+        """The whole drive item, the one form Graph always puts `@microsoft.graph.downloadUrl` in: a `$select` can leave it out and cost a second call."""
+        return f"shares/{cls.share_id(url)}/driveItem"
+
     @staticmethod
     def message_path(chat_id: str, message_id: str) -> str:
         return f"chats/{chat_id}/messages/{quote(message_id, safe='')}"
diff --git a/src/domain/errors/download_link_expired.py b/src/domain/errors/download_link_expired.py
new file mode 100644
index 0000000..97b6b04
--- /dev/null
+++ b/src/domain/errors/download_link_expired.py
@@ -0,0 +1,2 @@
+class DownloadLinkExpired(Exception):
+    """SharePoint refused a pre-authorized link, which is what an old one gets: ask Graph for a new one."""
diff --git a/src/domain/files/byte_range.py b/src/domain/files/byte_range.py
new file mode 100644
index 0000000..4ff3e69
--- /dev/null
+++ b/src/domain/files/byte_range.py
@@ -0,0 +1,25 @@
+import re
+
+
+class ByteRange:
+    """The one kind of `Range` a media player needs: `bytes=start-` or `bytes=start-end`. Anything else reads as no range, which HTTP allows."""
+
+    PATTERN = re.compile(r"bytes=(\d{1,15})-(\d{0,15})")
+    CONTENT_RANGE = re.compile(r"bytes (\d{1,15}-\d{1,15}|\*)/(\d{1,15}|\*)")
+
+    @classmethod
+    def parse(cls, value: str | None) -> str | None:
+        match = cls.PATTERN.fullmatch(value.strip()) if isinstance(value, str) else None
+        if match is None or (match[2] and int(match[2]) < int(match[1])):
+            return None
+        return match[0]
+
+    @classmethod
+    def total(cls, content_range: str | None) -> int | None:
+        """The whole file's size in a `Content-Range`, or None when it is unknown."""
+        match = cls.CONTENT_RANGE.fullmatch(content_range or "")
+        return int(match[2]) if match and match[2] != "*" else None
+
+    @classmethod
+    def safe_content_range(cls, content_range: str | None) -> str | None:
+        return content_range if content_range and cls.CONTENT_RANGE.fullmatch(content_range) else None
diff --git a/src/domain/files/file_stream.py b/src/domain/files/file_stream.py
index 9b63e69..71c593b 100644
--- a/src/domain/files/file_stream.py
+++ b/src/domain/files/file_stream.py
@@ -4,8 +4,11 @@
 
 @dataclass
 class FileStream:
-    """Bytes that stream through without being held."""
+    """Bytes that stream through without being held. A range answer carries status 206 and its `content_range`; `content_length` is what this answer's body holds, when known."""
 
     chunks: Iterator[bytes]
     content_type: str
     file_name: str
+    status_code: int = 200
+    content_length: int | None = None
+    content_range: str | None = None
diff --git a/src/infrastructure/graph/file_thumbnails.py b/src/infrastructure/graph/file_thumbnails.py
index 0bee8e3..34f89dd 100644
--- a/src/infrastructure/graph/file_thumbnails.py
+++ b/src/infrastructure/graph/file_thumbnails.py
@@ -105,21 +105,26 @@ def _resolve(self, note, broker, url: str) -> tuple[str, str] | None:
         if hit is not marker:
             return hit
         try:
-            item = note.get(GraphPaths.drive_item_path(url, "id,parentReference,file,size,webUrl"))
+            item = note.get(GraphPaths.drive_item_path(url, "id,parentReference,file,size,webUrl"), retry=False)
         except GraphError as ex:
             if ex.status in (400, 403, 404):
                 cache.set(key, None, self.ITEM_TTL)
                 return None
             raise
+        return self.remember_item(broker, url, item)
+
+    def remember_item(self, broker, url: str, item: dict) -> tuple[str, str] | None:
+        """Keeps the ids of a drive item already read, so its thumbnail needs no lookup of its own."""
         drive = ((item or {}).get("parentReference") or {}).get("driveId")
         item_id = (item or {}).get("id")
         found = (drive, item_id) if (item or {}).get("file") is not None and self.safe_graph_id(drive) and self.safe_graph_id(item_id) else None
-        cache.set(key, found, self.ITEM_TTL)
+        AccountCache.for_broker(broker).set(("share_item", url), found, self.ITEM_TTL)
         return found
 
     def _content(self, note, path: str) -> bytes | None:
         try:
-            data = note.get(path, raw="bytes")
+            # Throttled, this answers at once: a thumbnail is not worth a worker thread asleep for a minute.
+            data = note.get(path, raw="bytes", retry=False)
         except GraphError as ex:
             if ex.status in (400, 404, 415):
                 return None
diff --git a/src/infrastructure/graph/teams_files.py b/src/infrastructure/graph/teams_files.py
index 6169556..91f7702 100644
--- a/src/infrastructure/graph/teams_files.py
+++ b/src/infrastructure/graph/teams_files.py
@@ -28,6 +28,8 @@ class TeamsFiles(ITeamsFiles):
     MAX_DOWNLOAD_BYTES = 100 * 1024 * 1024
     FETCH_TIMEOUT = httpx.Timeout(120.0, connect=5.0)
     ITEM_FIELDS = "id,name,size,file,folder,webUrl,lastModifiedDateTime,createdDateTime,parentReference,lastModifiedBy,createdBy"
+    DOWNLOAD_HOST_SUFFIXES = (".sharepoint.com", ".files.1drv.com")  # a share link can be on personal OneDrive, whose files come from `*.files.1drv.com`
+    DOWNLOAD_LINK_TTL = 600  # the links last longer; a video's every seek must not cost a Graph call
     FORBIDDEN_PATH = re.compile(r"[%\\:#?\x00-\x1f\x7f]")
 
     def __init__(self, http: IMicrosoftHttpClients):
@@ -48,7 +50,7 @@ def valid_path(self, path) -> list[str]:
         return parts
 
     def is_download_url(self, url) -> bool:
-        """True only for an https SharePoint download URL: host ends with `.sharepoint.com`, default port, no credentials."""
+        """True only for an https SharePoint or personal OneDrive download URL: host under `DOWNLOAD_HOST_SUFFIXES`, default port, no credentials."""
         if not isinstance(url, str) or not url or len(url) > 8000 or any(ord(c) < 33 for c in url):
             return False
         try:
@@ -57,7 +59,7 @@ def is_download_url(self, url) -> bool:
         except ValueError:
             return False
         host = (parts.hostname or "").lower()
-        return parts.scheme == "https" and port in (None, 443) and not parts.username and not parts.password and host.endswith(".sharepoint.com")
+        return parts.scheme == "https" and port in (None, 443) and not parts.username and not parts.password and host.endswith(self.DOWNLOAD_HOST_SUFFIXES)
 
     def fetch_bytes(self, url: str, cap: int) -> bytes:
         """The bytes behind a pre-authorized download URL (no bearer token, no redirects), 413 past `cap`."""
@@ -105,6 +107,15 @@ def download_link(self, note, path: str, item: dict) -> str:
             raise ServiceError(502, "Microsoft did not offer a download link for this file.")
         return url
 
+    def cached_download(self, broker, key: tuple) -> dict | None:
+        return AccountCache.for_broker(broker).get(("download", key))
+
+    def remember_download(self, broker, key: tuple, target: dict) -> None:
+        AccountCache.for_broker(broker).set(("download", key), target, self.DOWNLOAD_LINK_TTL)
+
+    def forget_download(self, broker, key: tuple) -> None:
+        AccountCache.for_broker(broker).discard(lambda k: k == ("download", key))
+
     def item_base(self, drive_id: str | None, item_id: str) -> str:
         return f"drives/{self.seg(drive_id)}/items/{self.seg(item_id)}" if drive_id else f"me/drive/items/{self.seg(item_id)}"
 
diff --git a/src/infrastructure/microsoft/account_runner.py b/src/infrastructure/microsoft/account_runner.py
index 45a37e8..4b38fdf 100644
--- a/src/infrastructure/microsoft/account_runner.py
+++ b/src/infrastructure/microsoft/account_runner.py
@@ -1,4 +1,5 @@
 import asyncio
+import logging
 from collections.abc import Callable
 
 from outnote import GraphError
@@ -8,20 +9,27 @@
 from src.application.abstractions.i_token_rotation import ITokenRotation
 from src.application.services.retry_after import RetryAfter
 from src.domain.errors.service_error import ServiceError
+from src.infrastructure.logging_config import LoggerNames
+from src.infrastructure.microsoft.graph_call_trail import GraphCallTrail
 
 
 class AccountRunner(IAccountRunner):
     """Every read and write for an account goes through here: off the event loop, with the rotated token handed back and `_native` stripped."""
 
+    log = logging.getLogger(LoggerNames.SERVICE)
+
     def __init__(self, clients: IGraphClientFactory, rotation: ITokenRotation):
         self._clients = clients
         self._rotation = rotation
 
     async def run(self, refresh_token: str, action: Callable[..., object]) -> object:
         note, broker = self._clients.build_client(refresh_token)
+        trail = GraphCallTrail(note)
         try:
-            data = await asyncio.to_thread(action, note, broker)
-        except ServiceError:
+            data = await asyncio.to_thread(action, trail, broker)
+        except ServiceError as ex:
+            if ex.status == 429:
+                self.log.warning("Graph throttled %s (Retry-After %s)", trail.route, (ex.headers or {}).get("Retry-After"))
             # The token may have rotated before the action refused; keep it for the caller.
             self._keep_rotated(broker, refresh_token)
             raise
@@ -31,7 +39,8 @@ async def run(self, refresh_token: str, action: Callable[..., object]) -> object
             if isinstance(ex, GraphError) and ex.status == 404:
                 raise ServiceError(404, "Not found in Microsoft 365.")
             if isinstance(ex, GraphError) and ex.status == 429:
-                # OutNote already waited about 60 s. The token may have rotated first; keep it for the caller.
+                # OutNote already waited up to about 60 s, unless the call asked it not to. The token may have rotated first; keep it for the caller.
+                self.log.warning("Graph throttled %s (Retry-After %s)", trail.route, ex.retry_after)
                 self._keep_rotated(broker, refresh_token)
                 raise ServiceError(429, "Microsoft is throttling this account; try again later.", headers={"Retry-After": RetryAfter.header(ex.retry_after)})
             raise ServiceError(502, f"Microsoft Graph error: {ex}")
diff --git a/src/infrastructure/microsoft/graph_call_trail.py b/src/infrastructure/microsoft/graph_call_trail.py
new file mode 100644
index 0000000..537c4ac
--- /dev/null
+++ b/src/infrastructure/microsoft/graph_call_trail.py
@@ -0,0 +1,29 @@
+class GraphCallTrail:
+    """Stands in for a client during one action and remembers what was last asked of it, so a throttled call can be named in the log.
+
+    A path is kept only with its known Graph words: everything else (ids, addresses, names, the query) becomes `*`, so nothing of the user's reaches the log."""
+
+    PATH_METHODS = frozenset({"get", "list", "post", "patch", "put", "delete", "redirect"})
+    GRAPH_WORDS = frozenset(
+        """me users chats messages hostedContents replies members shares driveItem drive drives items root children content thumbnails small medium large
+        photo photos $value teams channels filesFolder groups sites onenote notebooks sections pages mailFolders attachments events calendar search query $batch""".split()
+    )
+
+    def __init__(self, client):
+        self._client = client
+        self.route = "unknown"
+
+    def __getattr__(self, name):
+        attribute = getattr(self._client, name)
+        if not callable(attribute):
+            return attribute
+
+        def call(*args, **kwargs):
+            self.route = self.mask(args[0]) if name in self.PATH_METHODS and args and isinstance(args[0], str) else name
+            return attribute(*args, **kwargs)
+
+        return call
+
+    @classmethod
+    def mask(cls, path: str) -> str:
+        return "/".join(part if part in cls.GRAPH_WORDS else "*" for part in path.split("?")[0].strip("/").split("/"))
diff --git a/src/infrastructure/microsoft/microsoft_http_clients.py b/src/infrastructure/microsoft/microsoft_http_clients.py
index 07c72f2..09cd745 100644
--- a/src/infrastructure/microsoft/microsoft_http_clients.py
+++ b/src/infrastructure/microsoft/microsoft_http_clients.py
@@ -3,12 +3,18 @@
 import threading
 import time
 from http.cookiejar import DefaultCookiePolicy
+from urllib.parse import urljoin
 
 import entrance
 import httpx
 
 from src.application.abstractions.i_microsoft_http_clients import IMicrosoftHttpClients
 from src.application.options.microsoft_options import MicrosoftOptions
+from src.application.services.retry_after import RetryAfter
+from src.domain.errors.download_link_expired import DownloadLinkExpired
+from src.domain.errors.service_error import ServiceError
+from src.domain.files.byte_range import ByteRange
+from src.domain.files.file_stream import FileStream
 from src.infrastructure.logging_config import LoggerNames
 
 
@@ -16,6 +22,8 @@ class MicrosoftHttpClients(IMicrosoftHttpClients):
     """The shared keep-alive clients: one for capped or streamed bodies and one for the sign-in calls."""
 
     log = logging.getLogger(LoggerNames.SERVICE)
+    MAX_DOWNLOAD_REDIRECTS = 3
+    DOWNLOAD_TIMEOUT = httpx.Timeout(60.0, connect=5.0)
 
     def __init__(self, options: MicrosoftOptions):
         self._options = options
@@ -72,13 +80,61 @@ async def post_form(self, url: str, data: dict, client: httpx.AsyncClient | None
         finally:
             self.log.debug("POST %s took %.0f ms", url, (time.perf_counter() - started) * 1000)
 
-    def stream_download(self, url: str, limit: int, follow_redirects: bool = True):
-        """Yields a pre-authorized download URL's bytes in chunks (no bearer token is sent), stopping past `limit` bytes."""
-        with self.download_client().stream("GET", url, timeout=httpx.Timeout(60.0, connect=5.0), follow_redirects=follow_redirects) as r:
-            r.raise_for_status()
-            sent = 0
-            for chunk in r.iter_bytes(64 * 1024):
+    def open_download(self, url: str, limit: int, allowed, content_type: str, file_name: str, byte_range: str | None = None) -> FileStream:
+        """Opens a pre-authorized download URL (no bearer token is sent) and answers once its status and headers are known, so a refusal is a real status and not a broken 200.
+
+        Every hop must pass `allowed`. It asks for the bytes as they are (`identity`) and passes them on raw, so a `Range` and the lengths stay true. The body is read chunk by chunk as the caller asks for it."""
+        headers = {"Accept-Encoding": "identity"}
+        if byte_range:
+            headers["Range"] = byte_range
+        client = self.download_client()
+        for _ in range(self.MAX_DOWNLOAD_REDIRECTS + 1):
+            if not allowed(url):
+                raise ServiceError(502, "The file has an unexpected download location.")
+            r = client.send(client.build_request("GET", url, headers=headers, timeout=self.DOWNLOAD_TIMEOUT), stream=True, follow_redirects=False)
+            if not r.is_redirect:
+                return self._opened(r, limit, content_type, file_name)
+            location = r.headers.get("Location")
+            r.close()
+            if not location:
+                raise ServiceError(502, "The download failed (a redirect with no location).")
+            url = urljoin(url, location)
+        raise ServiceError(502, "The download failed (too many redirects).")
+
+    def _opened(self, r: httpx.Response, limit: int, content_type: str, file_name: str) -> FileStream:
+        status = r.status_code
+        if status in (200, 206):
+            content_range = ByteRange.safe_content_range(r.headers.get("Content-Range")) if status == 206 else None
+            if status == 206 and content_range is None:
+                r.close()
+                raise ServiceError(502, "The download failed (an unreadable range).")
+            length = int(r.headers["Content-Length"]) if r.headers.get("Content-Length", "").isdigit() else None
+            whole = ByteRange.total(content_range) if status == 206 else length
+            if (whole or 0) > limit or (length or 0) > limit:
+                r.close()
+                raise ServiceError(413, "The file is too large.")
+            return FileStream(self._body(r, limit), content_type, file_name, status, length, content_range)
+        if status == 416:
+            content_range = ByteRange.safe_content_range(r.headers.get("Content-Range"))
+            r.close()
+            return FileStream(iter(()), content_type, file_name, 416, 0, content_range)
+        retry_after = r.headers.get("Retry-After", "")
+        r.close()
+        if status in (401, 403, 410):
+            raise DownloadLinkExpired()
+        if status in (429, 503):
+            raise ServiceError(429, "Microsoft is throttling this download; try again later.", headers={"Retry-After": RetryAfter.header(float(retry_after) if retry_after.isdigit() else None)})
+        raise ServiceError(404 if status == 404 else 502, f"The download failed ({status}).")
+
+    @staticmethod
+    def _body(r: httpx.Response, limit: int):
+        """The body, broken off past `limit` rather than quietly cut short. Closing the iterator (a player that seeks elsewhere) closes the connection."""
+        sent = 0
+        try:
+            for chunk in r.iter_raw(64 * 1024):
                 sent += len(chunk)
                 if sent > limit:
-                    return
+                    raise ServiceError(413, "The file is too large.")
                 yield chunk
+        finally:
+            r.close()
diff --git a/src/infrastructure/teams/chat_reader.py b/src/infrastructure/teams/chat_reader.py
index fa55bc6..d3e543e 100644
--- a/src/infrastructure/teams/chat_reader.py
+++ b/src/infrastructure/teams/chat_reader.py
@@ -8,6 +8,8 @@
 
 import logging
 
+from outnote import GraphError
+
 from src.application.abstractions.i_chat_reader import IChatReader
 from src.application.abstractions.i_emoji_catalogue import IEmojiCatalogue
 from src.application.abstractions.i_file_thumbnails import IFileThumbnails
@@ -21,6 +23,9 @@ class ChatReader(IChatReader):
 
     log = logging.getLogger("schuly.microsoft")
     FILE_META_TTL = 3600
+    FILE_META_RETRY_TTL = 60  # after a failed lookup, so a list refreshed while Graph throttles doesn't ask again each time
+    CHAT_FILES_TTL = 6 * 3600
+    FILE_REF_TOP = 50
 
     def __init__(self, html: ChatHtmlSanitizer, emojis: IEmojiCatalogue, thumbnails: IFileThumbnails):
         self._html = html
@@ -39,27 +44,65 @@ def file_meta(self, note, broker, urls: list[str]) -> dict[str, dict]:
                 todo.append(url)
         if todo:
             try:
-                results = note.batch([GraphPaths.drive_item_path(u, "size,file") for u in todo])
+                results = note.batch([GraphPaths.drive_item_path(u, "id,size,file,parentReference") for u in todo])
             except Exception:
                 results = [None] * len(todo)
             for url, item in zip(todo, results):
                 if isinstance(item, dict):
                     meta = {"contentType": (item.get("file") or {}).get("mimeType"), "size": item.get("size")}
                     cache.set(("file_meta", url), meta, self.FILE_META_TTL)
+                    self._thumbnails.remember_item(broker, url, item)
                 else:
                     meta = {"contentType": None, "size": None}
+                    cache.set(("file_meta", url), meta, self.FILE_META_RETRY_TTL)
                 out[url] = meta
         return out
 
-    def enrich(self, note, broker, messages: list[dict]) -> list[dict]:
+    def file_ref(self, note, broker, chat_id: str, message_id: str, attachment_id: str) -> dict | None:
+        """A file shared in a message, found by its attachment id. The message list says what each message holds, so this needs no call while that is remembered.
+
+        Graph throttles the single-message read far sooner than the list, and every thumbnail, file and PDF of a chat used to cost one. `chat_message` asks Teams' own API first, which is undocumented and only falls back to that same read, so when it refuses or doesn't know the file, the list gets the last word."""
+        cache = AccountCache.for_broker(broker)
+        key = ("chat_files", chat_id, message_id)
+
+        def known():
+            return next((f for f in cache.get(key) or [] if f.get("id") == attachment_id), None)
+
+        found = known()
+        if found:
+            return found
+        try:
+            message = note.chat_message(chat_id, message_id)
+            self._remember_files(cache, chat_id, message or {}, self._html.reference_files(message or {}), message_id)
+            found = known()
+            if found:
+                return found
+        except GraphError as ex:
+            if ex.status != 429:
+                raise
+            self.log.warning("the chat message read was throttled (Retry-After %s); asking the list", ex.retry_after)
+        for message in note.list(f"me/chats/{chat_id}/messages", {"$top": self.FILE_REF_TOP}, limit=self.FILE_REF_TOP, retry=False) or []:
+            self._remember_files(cache, chat_id, message, self._html.reference_files(message))
+        return known()
+
+    def _remember_files(self, cache, chat_id: str | None, message: dict, files: list[dict], message_id: str | None = None) -> None:
+        message_id = message_id or message.get("id")
+        chat_id = chat_id or message.get("chatId")
+        if files and chat_id and message_id:
+            cache.set(("chat_files", chat_id, message_id), files, self.CHAT_FILES_TTL)
+
+    def enrich(self, note, broker, messages: list[dict], chat_id: str | None = None) -> list[dict]:
         files_by_message = {}
         urls = []
+        cache = AccountCache.for_broker(broker)
         for m in messages:
             files = self._html.reference_files(m)
             files_by_message[id(m)] = files
             urls += [f["contentUrl"] for f in files]
+            self._remember_files(cache, chat_id, m, files)
         meta = self.file_meta(note, broker, urls) if urls else {}
-        cat = self._catalogue() if any("emoji" in ((m.get("body") or {}).get("content") or "").lower() for m in messages) else None
+        quotes_by_message = {id(m): self._html.quotes(m) for m in messages}
+        cat = self._catalogue() if any("emoji" in ((m.get("body") or {}).get("content") or "").lower() or any("emoji" in (q["content"] or "").lower() for q in quotes_by_message[id(m)]) for m in messages) else None
         for m in messages:
             m["media"] = self._html.media(m)
             m["files"] = [self._file_view({**f, **meta.get(f["contentUrl"], {"contentType": None, "size": None})}) for f in files_by_message[id(m)]]
@@ -71,9 +114,22 @@ def enrich(self, note, broker, messages: list[dict]) -> list[dict]:
             else:
                 m["emojis"] = []
             m["cards"] = self._html.cards(m)
+            m["quotes"] = [self._quote_view(q, cat) for q in quotes_by_message[id(m)]]
+            # What a quote needs is in `quotes`; the rest of the raw JSON holds Microsoft's ids, which no caller may get.
+            for a in m.get("attachments") or []:
+                if a.get("contentType") in self._html.QUOTE_KINDS:
+                    a["content"] = None
             m.setdefault("importance", "normal")
         return messages
 
+    def _quote_view(self, quote: dict, cat) -> dict:
+        """A quote with its emojis made ready like a message's. `unread` names the fields of a shape Graph documents no further, so the first real one tells what to read; it holds no content."""
+        unread = quote.pop("unread", None)
+        if unread is not None:
+            self.log.warning("quoted message with no readable content; fields: %s", unread)
+        content, emojis = self._emojis.message_emojis(quote["content"], cat) if quote["contentType"] == "html" and quote["content"] else (quote["content"], [])
+        return {**quote, "content": content, "emojis": emojis}
+
     def _catalogue(self):
         # Emoji pictures work from the id alone, so a catalogue that can't be loaded only costs the frame counts.
         try:
diff --git a/tests/test_chat_media.py b/tests/test_chat_media.py
new file mode 100644
index 0000000..dc4140a
--- /dev/null
+++ b/tests/test_chat_media.py
@@ -0,0 +1,394 @@
+"""Chat images and videos: Range, content types, redirects, how few Graph calls a chat's files cost, the throttle log, and forwarded messages. A real local server stands in for SharePoint; no outside network, no real token."""
+
+import http.server
+import json
+import logging
+import re
+import threading
+
+import pytest
+from fastapi.testclient import TestClient
+from outnote import GraphError
+
+from src.api.app import app
+from src.application.services.chat_html_sanitizer import ChatHtmlSanitizer
+from src.application.services.content_names import ContentNames
+from src.domain.files.byte_range import ByteRange
+from tests.services import config, http_clients, outnote_client, teams_files
+
+H = {config.REFRESH_TOKEN_HEADER: "frt-1"}
+VIDEO = bytes(range(256)) * 400
+SHARE = "https://school.sharepoint.com/personal/a/Documents/clip.mp4"
+CHAT = "19:media@thread.v2"
+FILE_URL = f"/api/chats/{CHAT}/messages/171/files/a1"
+RAW_ID_PARTS = ("media@thread", "171", "a1", "school.sharepoint", "u!")
+
+
+class Sharepoint(http.server.BaseHTTPRequestHandler):
+    protocol_version = "HTTP/1.1"
+
+    def do_GET(self):
+        srv = self.server
+        srv.seen.append({"path": self.path, "range": self.headers.get("Range"), "encoding": self.headers.get("Accept-Encoding"), "auth": self.headers.get("Authorization")})
+        if self.path.startswith("/moved"):
+            return self._reply(302, Location="/video")
+        if self.path.startswith("/expired"):
+            return self._reply(403)
+        if self.path.startswith("/busy"):
+            return self._reply(429, Retry_After="33")
+        if self.path.startswith("/broken"):
+            return self._reply(500)
+        match = re.fullmatch(r"bytes=(\d+)-(\d*)", self.headers.get("Range") or "")
+        if not match:
+            return self._reply(200, VIDEO)
+        start = int(match[1])
+        if start >= len(VIDEO):
+            return self._reply(416, Content_Range=f"bytes */{len(VIDEO)}")
+        end = min(int(match[2]) if match[2] else len(VIDEO) - 1, len(VIDEO) - 1)
+        self._reply(206, VIDEO[start : end + 1], Content_Range=f"bytes {start}-{end}/{len(VIDEO)}")
+
+    def _reply(self, status, body=b"", **headers):
+        self.send_response(status)
+        for key, value in headers.items():
+            self.send_header(key.replace("_", "-"), value)
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, *a):
+        pass
+
+
+@pytest.fixture
+def sharepoint(monkeypatch):
+    srv = http.server.ThreadingHTTPServer(("127.0.0.1", 0), Sharepoint)
+    srv.daemon_threads = True
+    srv.seen = []
+    srv.url = f"http://127.0.0.1:{srv.server_address[1]}"
+    threading.Thread(target=srv.serve_forever, daemon=True).start()
+    monkeypatch.setattr(http_clients, "_download_client", None)
+    monkeypatch.setattr(teams_files, "is_download_url", lambda url: url.startswith(srv.url))
+    yield srv
+    client = http_clients._download_client
+    if client is not None:
+        client.close()
+    srv.shutdown()
+    srv.server_close()
+
+
+class Broker:
+    refresh_token = "frt-1"
+
+
+class Note:
+    """A chat whose one message holds one video. Counts every Graph call by route."""
+
+    def __init__(self, link=None, name="clip.mp4", mime="application/octet-stream"):
+        self.calls = []
+        self.link, self.name, self.mime = link, name, mime
+        self.message_status = None
+        self.listable = True
+        self.teams_status = None
+        self.teams_has_file = True
+
+    def attachment(self):
+        return {"id": "a1", "name": self.name, "contentType": "reference", "contentUrl": SHARE}
+
+    def get(self, path, params=None, raw=False, retry=True):
+        self.calls.append(path)
+        if "/messages/" in path:
+            if self.message_status:
+                raise GraphError(self.message_status, "refused", retry_after=62)
+            return {"id": "171", "attachments": [self.attachment()]}
+        if path.startswith("shares/"):
+            return {"id": "ITEM", "name": self.name, "size": len(VIDEO), "file": {"mimeType": self.mime}, "parentReference": {"driveId": "b!DRIVE"}, "@microsoft.graph.downloadUrl": self.link}
+        if "/thumbnails/" in path:
+            return b"\xff\xd8\xffthumbnail"
+        raise GraphError(404, "missing")
+
+    def list(self, path, params=None, limit=None, retry=True):
+        self.calls.append(path)
+        return [{"id": "171", "attachments": [self.attachment()]}] if self.listable else []
+
+    def batch(self, requests):
+        self.calls.append("$batch")
+        return [{"id": "ITEM", "size": len(VIDEO), "file": {"mimeType": self.mime}, "parentReference": {"driveId": "b!DRIVE"}} for _ in requests]
+
+    def chat_message(self, chat_id, message_id):
+        self.calls.append("chat_message")
+        if self.teams_status:
+            raise GraphError(self.teams_status, "refused", retry_after=62)
+        return {"id": message_id, "attachments": [self.attachment()] if self.teams_has_file else []}
+
+    def single_reads(self):
+        return [c for c in self.calls if "/messages/" in c and not c.endswith("/messages")]
+
+
+@pytest.fixture
+def chat(monkeypatch):
+    def build(note):
+        broker = Broker()
+        monkeypatch.setattr(outnote_client, "build_client", lambda frt: (note, broker))
+        return TestClient(app)
+
+    return build
+
+
+# --- Range and what a player needs ----------------------------------------------------------------
+
+
+def test_a_range_request_answers_206_with_only_those_bytes(chat, sharepoint):
+    client = chat(Note(sharepoint.url + "/video"))
+    r = client.get(FILE_URL, headers={**H, "Range": "bytes=1000-1999"})
+    assert r.status_code == 206 and r.content == VIDEO[1000:2000]
+    assert r.headers["content-range"] == f"bytes 1000-1999/{len(VIDEO)}"
+    assert r.headers["content-length"] == "1000" and r.headers["accept-ranges"] == "bytes"
+    assert sharepoint.seen[-1]["range"] == "bytes=1000-1999"
+
+
+def test_without_a_range_the_whole_file_comes_with_its_length_and_says_it_can_seek(chat, sharepoint):
+    r = chat(Note(sharepoint.url + "/video")).get(FILE_URL, headers=H)
+    assert r.status_code == 200 and r.content == VIDEO
+    assert r.headers["content-length"] == str(len(VIDEO)) and r.headers["accept-ranges"] == "bytes"
+    assert sharepoint.seen[-1]["range"] is None
+
+
+def test_a_range_past_the_end_stays_416(chat, sharepoint):
+    r = chat(Note(sharepoint.url + "/video")).get(FILE_URL, headers={**H, "Range": f"bytes={len(VIDEO)}-"})
+    assert r.status_code == 416 and r.headers["content-range"] == f"bytes */{len(VIDEO)}"
+
+
+@pytest.mark.parametrize("value", ["bytes=-500", "bytes=5-1", "bytes=0-1,5-9", "items=0-1", "bytes=0-1\r\nX: y", "x" * 200])
+def test_any_other_range_is_ignored_and_never_passed_on(value):
+    assert ByteRange.parse(value) is None
+
+
+def test_the_bytes_are_asked_for_uncompressed_and_with_no_token(chat, sharepoint):
+    chat(Note(sharepoint.url + "/video")).get(FILE_URL, headers=H)
+    assert sharepoint.seen[-1]["encoding"] == "identity" and sharepoint.seen[-1]["auth"] is None
+
+
+def test_seeking_costs_no_more_graph_calls(chat, sharepoint):
+    note = Note(sharepoint.url + "/video")
+    client = chat(note)
+    client.get(FILE_URL, headers={**H, "Range": "bytes=0-99"})
+    before = list(note.calls)
+    for start in (1000, 5000, 50000):
+        assert client.get(FILE_URL, headers={**H, "Range": f"bytes={start}-{start + 9}"}).status_code == 206
+    assert note.calls == before
+
+
+def test_a_file_response_still_cannot_run(chat, sharepoint):
+    r = chat(Note(sharepoint.url + "/video", name="clip.html", mime="text/html")).get(FILE_URL, headers=H)
+    assert r.headers["content-type"].startswith("application/octet-stream")
+    assert r.headers["content-security-policy"] == "sandbox; default-src 'none'"
+    assert r.headers["x-content-type-options"] == "nosniff" and r.headers["cache-control"] == "no-store"
+    assert r.headers["content-disposition"].startswith("attachment")
+
+
+# --- content types --------------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize("name,mime,expected", [
+    ("clip.mp4", "application/octet-stream", "video/mp4"),
+    ("clip.mp4", None, "video/mp4"),
+    ("clip.MOV", "", "video/quicktime"),
+    ("a.jpg", "application/octet-stream", "image/jpeg"),
+    ("clip.mp4", "video/mp4", "video/mp4"),
+    ("clip.bin", "application/octet-stream", "application/octet-stream"),
+    ("page.mp4", "text/html", "application/octet-stream"),
+    ("a.svg", "application/octet-stream", "application/octet-stream"),
+    ("a.html", None, "application/octet-stream"),
+])
+def test_the_type_served(name, mime, expected):
+    assert ContentNames.media_type(name, mime) == expected
+
+
+def test_an_mp4_graph_calls_generic_is_served_as_video(chat, sharepoint):
+    r = chat(Note(sharepoint.url + "/video")).get(FILE_URL, headers=H)
+    assert r.headers["content-type"].startswith("video/mp4")
+
+
+# --- redirects, refusals and hosts -----------------------------------------------------------------
+
+
+def test_a_download_link_that_redirects_is_followed(chat, sharepoint):
+    r = chat(Note(sharepoint.url + "/moved")).get(FILE_URL, headers=H)
+    assert r.status_code == 200 and r.content == VIDEO and [s["path"] for s in sharepoint.seen] == ["/moved", "/video"]
+
+
+def test_a_redirect_to_another_host_is_refused(chat, sharepoint, monkeypatch):
+    monkeypatch.setattr(teams_files, "is_download_url", lambda url: "/moved" in url)
+    r = chat(Note(sharepoint.url + "/moved")).get(FILE_URL, headers=H)
+    assert r.status_code == 502 and [s["path"] for s in sharepoint.seen] == ["/moved"]
+
+
+def test_a_refusal_is_a_status_and_not_a_broken_200(chat, sharepoint):
+    assert chat(Note(sharepoint.url + "/broken")).get(FILE_URL, headers=H).status_code == 502
+
+
+def test_a_throttled_download_passes_its_wait_on(chat, sharepoint):
+    r = chat(Note(sharepoint.url + "/busy")).get(FILE_URL, headers=H)
+    assert r.status_code == 429 and r.headers["retry-after"] == "33"
+
+
+def test_an_expired_link_is_replaced_once(chat, sharepoint):
+    note = Note(sharepoint.url + "/expired")
+    client = chat(note)
+    client.get(FILE_URL, headers=H)  # refused twice: the kept link is dropped
+    note.link = sharepoint.url + "/video"
+    assert client.get(FILE_URL, headers=H).status_code == 200
+
+
+@pytest.mark.parametrize("url,ok", [
+    ("https://school.sharepoint.com/x", True),
+    ("https://public.dm.files.1drv.com/x", True),
+    ("https://evil.example/x", False),
+    ("https://files.1drv.com.evil.example/x", False),
+    ("https://sharepoint.com.evil.example/x", False),
+    ("http://school.sharepoint.com/x", False),
+    ("https://u:p@school.sharepoint.com/x", False),
+    ("https://school.sharepoint.com:8443/x", False),
+])
+def test_the_download_host_check(url, ok):
+    assert teams_files.is_download_url(url) is ok
+
+
+# --- how few Graph calls a chat's files cost ------------------------------------------------------
+
+
+def test_files_listed_with_their_message_never_read_the_message_again(chat, sharepoint):
+    note = Note(sharepoint.url + "/video")
+    client = chat(note)
+    assert client.get(f"/api/chats/{CHAT}/messages", headers=H).status_code == 200
+    note.message_status = note.teams_status = 429  # as measured on a real account: this read is what Graph refuses
+    assert client.get(FILE_URL + "/thumbnail", headers=H).status_code == 200
+    assert client.get(FILE_URL, headers=H).status_code == 200
+    assert note.single_reads() == [] and "chat_message" not in note.calls
+
+
+def test_thumbnail_after_the_list_needs_only_the_thumbnail_call(chat, sharepoint):
+    note = Note(sharepoint.url + "/video")
+    client = chat(note)
+    client.get(f"/api/chats/{CHAT}/messages", headers=H)
+    note.calls.clear()
+    assert client.get(FILE_URL + "/thumbnail", headers=H).status_code == 200
+    assert len(note.calls) == 1 and "/thumbnails/" in note.calls[0]
+
+
+def test_an_unremembered_file_is_read_through_chat_message_once(chat, sharepoint):
+    note = Note(sharepoint.url + "/video")
+    client = chat(note)
+    assert client.get(FILE_URL + "/thumbnail", headers=H).status_code == 200
+    assert client.get(FILE_URL, headers=H).status_code == 200
+    assert note.calls.count("chat_message") == 1 and note.single_reads() == []
+
+
+def test_a_throttled_chat_message_falls_back_to_the_list(chat, sharepoint, caplog):
+    note = Note(sharepoint.url + "/video")
+    note.teams_status = 429
+    with caplog.at_level(logging.WARNING, logger="schuly.microsoft"):
+        assert chat(note).get(FILE_URL, headers=H).status_code == 200
+    assert "asking the list" in caplog.text and "media@thread" not in caplog.text
+
+
+def test_a_chat_message_without_the_file_falls_back_to_the_list(chat, sharepoint):
+    note = Note(sharepoint.url + "/video")
+    note.teams_has_file = False
+    assert chat(note).get(FILE_URL, headers=H).status_code == 200
+    assert f"me/chats/{CHAT}/messages" in note.calls
+
+
+def test_a_file_nothing_knows_is_a_404(chat, sharepoint):
+    note = Note(sharepoint.url + "/video")
+    note.teams_has_file = False
+    note.listable = False
+    assert chat(note).get(FILE_URL, headers=H).status_code == 404
+
+
+def test_a_real_refusal_of_chat_message_keeps_its_status(chat, sharepoint):
+    note = Note(sharepoint.url + "/video")
+    note.teams_status = 404
+    assert chat(note).get(FILE_URL, headers=H).status_code == 404
+
+
+def test_a_failed_file_lookup_on_the_list_is_not_asked_again_each_refresh(chat):
+    class Throttled(Note):
+        def batch(self, requests):
+            self.calls.append("$batch")
+            raise GraphError(429, "throttled", retry_after=60)
+
+    note = Throttled()
+    client = chat(note)
+    for _ in range(3):
+        client.get(f"/api/chats/{CHAT}/messages", headers=H)
+    assert note.calls.count("$batch") == 1
+
+
+# --- the throttle's real wait and the log line ------------------------------------------------------
+
+
+def test_graphs_wait_comes_through_and_the_log_names_the_call_with_nothing_of_the_user(chat, sharepoint, caplog):
+    class Refused(Note):
+        def get(self, path, params=None, raw=False, retry=True):
+            self.calls.append(path)
+            raise GraphError(429, "refused", retry_after=62)
+
+    note = Refused(sharepoint.url + "/video")
+    with caplog.at_level(logging.WARNING, logger="schuly.microsoft"):
+        r = chat(note).get(FILE_URL, headers=H)
+    assert r.status_code == 429 and r.headers["retry-after"] == "62"
+    lines = [rec.getMessage() for rec in caplog.records if "throttled" in rec.getMessage()]
+    assert lines == ["Graph throttled shares/*/driveItem (Retry-After 62)"]
+    for part in RAW_ID_PARTS + ("frt-1",):
+        assert part not in lines[0]
+
+
+def test_the_log_masks_everything_but_graph_words():
+    from src.infrastructure.microsoft.graph_call_trail import GraphCallTrail
+
+    assert GraphCallTrail.mask("shares/u!abc/driveItem?$select=name") == "shares/*/driveItem"
+    assert GraphCallTrail.mask("drives/b!x/items/01A/thumbnails/0/medium/content") == "drives/*/items/*/thumbnails/*/medium/content"
+    assert GraphCallTrail.mask("users/kid@school.ch/photos/64x64/$value") == "users/*/photos/*/$value"
+
+
+# --- forwarded messages and replies ---------------------------------------------------------------
+
+
+def forwarded(content):
+    return {"id": "m1", "body": {"contentType": "html", "content": '<attachment id="f1"></attachment>'}, "attachments": [{"id": "f1", "contentType": "forwardedMessageReference", "name": None, "contentUrl": None, "content": content}]}
+
+
+def test_a_forward_becomes_a_quote_with_its_sender_time_and_content():
+    content = json.dumps({"originalSender": {"user": {"id": "RAW-USER", "displayName": "Kylian B."}}, "originalSentDateTime": "2026-11-02T10:00:00Z", "originalMessageContent": "<p>hello</p>", "originalMessageId": "RAW-MSG"})
+    [quote] = ChatHtmlSanitizer.quotes(forwarded(content))
+    assert quote == {"kind": "forward", "senderName": "Kylian B.", "sentAt": "2026-11-02T10:00:00Z", "content": "<p>hello</p>", "contentType": "html"}
+    assert "RAW" not in json.dumps(quote)
+
+
+def test_a_reply_quote_reads_the_documented_preview():
+    message = {"attachments": [{"id": "1", "contentType": "messageReference", "content": json.dumps({"messageId": "1", "messagePreview": "see you", "messageSender": {"user": {"displayName": "Ana"}}})}]}
+    assert ChatHtmlSanitizer.quotes(message) == [{"kind": "reply", "senderName": "Ana", "sentAt": None, "content": "see you", "contentType": "text"}]
+
+
+@pytest.mark.parametrize("content", [None, "not json", "[1]", json.dumps({"somethingNew": "x"})])
+def test_a_quote_of_an_unknown_shape_is_still_a_quote_and_not_a_crash(content):
+    [quote] = ChatHtmlSanitizer.quotes(forwarded(content))
+    assert quote["kind"] == "forward" and quote["content"] is None
+
+
+def test_the_list_carries_quotes_with_their_emojis_and_asks_for_no_file(chat, caplog):
+    class ForwardNote(Note):
+        def list(self, path, params=None, limit=None, retry=True):
+            self.calls.append(path)
+            return [forwarded(json.dumps({"originalMessageContent": '<p><emoji id="smile" alt="x" title="Smile"></emoji></p>', "originalSender": {"user": {"displayName": "Kylian B."}}})), forwarded(json.dumps({"somethingNew": "secret text"}))]
+
+    note = ForwardNote()
+    with caplog.at_level(logging.WARNING, logger="schuly.microsoft"):
+        body = chat(note).get(f"/api/chats/{CHAT}/messages", headers=H).json()
+    quote = body[0]["quotes"][0]
+    assert quote["senderName"] == "Kylian B." and "<emoji" in quote["content"] and quote["emojis"][0]["key"] == "e0"
+    assert body[0]["attachments"][0]["content"] is None
+    assert body[0]["files"] == [] and "$batch" not in note.calls and not [c for c in note.calls if c.startswith("shares/")]
+    # The unknown shape names its fields so the real one can be read, and never its content.
+    assert "somethingNew" in caplog.text and "secret text" not in caplog.text
diff --git a/tests/test_emojis.py b/tests/test_emojis.py
index fc851ff..240bb2a 100644
--- a/tests/test_emojis.py
+++ b/tests/test_emojis.py
@@ -290,7 +290,13 @@ class ThumbNote:
     def __init__(self):
         self.calls, self.thumb, self.file = [], JPEG, True
 
-    def get(self, path, params=None, raw=False):
+    def chat_message(self, chat_id, message_id):
+        return self.get(f"chats/{chat_id}/messages/{message_id}")
+
+    def list(self, path, params=None, limit=None, retry=True):
+        return []
+
+    def get(self, path, params=None, raw=False, retry=True):
         self.calls.append(path)
         if path.startswith("me/chats") or "/messages/" in path:
             return {"id": "m1", "attachments": [{"id": "a1", "contentType": "reference", "contentUrl": SHAREPOINT, "name": "a.docx"}, {"id": "a2", "contentType": "reference", "contentUrl": "https://evil.example/a.docx", "name": "b.docx"}]}
diff --git a/tests/test_file_pdf.py b/tests/test_file_pdf.py
index 59ccf07..2de3083 100644
--- a/tests/test_file_pdf.py
+++ b/tests/test_file_pdf.py
@@ -38,7 +38,7 @@ def __init__(self, broker):
         self.uploaded = []
         self.deleted = []
 
-    def get(self, path, params=None, raw=False):
+    def get(self, path, params=None, raw=False, retry=True):
         self.broker("x")
         self.calls.append(("get", path))
         if path.startswith("me/drive/items/"):
@@ -52,7 +52,10 @@ def get(self, path, params=None, raw=False):
             return {"id": "SPITEM", "name": "Plan.docx", "size": 4096, "file": {}, "parentReference": {"driveId": "b!DRIVE"}}
         raise GraphError(404, "missing")
 
-    def list(self, path, params=None, limit=None):
+    def chat_message(self, chat_id, message_id):
+        return self.get(f"chats/{chat_id}/messages/{message_id}")
+
+    def list(self, path, params=None, limit=None, retry=True):
         self.calls.append(("list", path))
         if path.endswith("/attachments"):
             return self.attachments
diff --git a/tests/test_outnote2.py b/tests/test_outnote2.py
index b500f36..f5d7c3e 100644
--- a/tests/test_outnote2.py
+++ b/tests/test_outnote2.py
@@ -15,11 +15,13 @@
 
 from tests.services import AccountRunner, FileFetchError, ResourceTooLarge, Upload, _BrokerCache, chat_send, config, gifs, http_clients, onenote, outnote_client, profile, teams_files
 from src.api.app import app
+from src.domain.errors.service_error import ServiceError
 
 from tests.conftest import REAL_FETCH
 
 H = {config.REFRESH_TOKEN_HEADER: "frt-1"}
 CHUNK = 64 * 1024
+ANYWHERE = lambda url: True  # noqa: E731
 
 
 class Handler(http.server.BaseHTTPRequestHandler):
@@ -156,7 +158,7 @@ def failing(method, url, **kw):
 
 
 def test_a_download_streams_chunk_by_chunk_instead_of_loading_the_file(server, fresh_download_client):
-    stream = http_clients.stream_download(server.url + "/slow", 10 * CHUNK)
+    stream = http_clients.open_download(server.url + "/slow", 10 * CHUNK, ANYWHERE, "video/mp4", "a.mp4").chunks
     first = next(stream)  # the server holds the rest back until this arrives: a buffering client would hang here
     assert first and set(first) == {ord("a")} and len(first) <= CHUNK
     server.got_first.set()
@@ -164,9 +166,10 @@ def test_a_download_streams_chunk_by_chunk_instead_of_loading_the_file(server, f
     assert server.sent_rest_after_first and len(first) + len(rest) == 2 * CHUNK
 
 
-def test_a_download_stops_at_its_cap(server, fresh_download_client):
-    got = b"".join(http_clients.stream_download(server.url + "/big", CHUNK))
-    assert len(got) <= CHUNK
+def test_a_download_past_its_cap_is_refused_before_any_byte(server, fresh_download_client):
+    with pytest.raises(ServiceError) as big:
+        http_clients.open_download(server.url + "/big", CHUNK, ANYWHERE, "video/mp4", "a.mp4")
+    assert big.value.status == 413
 
 
 def test_fetch_bytes_refuses_past_its_cap_and_does_not_follow_redirects(server, fresh_download_client, monkeypatch):
@@ -180,15 +183,16 @@ def test_fetch_bytes_refuses_past_its_cap_and_does_not_follow_redirects(server,
     assert not any(s["path"] == "/landed" for s in server.seen)
 
 
-def test_stream_download_can_refuse_redirects(server, fresh_download_client):
-    with pytest.raises(Exception):
-        list(http_clients.stream_download(server.url + "/redirect", CHUNK, follow_redirects=False))
+def test_a_download_redirect_must_pass_the_host_check_again(server, fresh_download_client):
+    with pytest.raises(ServiceError) as refused:
+        http_clients.open_download(server.url + "/redirect", CHUNK, lambda url: "/landed" not in url, "video/mp4", "a.mp4")
+    assert refused.value.status == 502
     assert not any(s["path"] == "/landed" for s in server.seen)
 
 
 def test_the_shared_download_client_keeps_no_cookies_between_accounts(server, fresh_download_client):
-    list(http_clients.stream_download(server.url + "/cookie", CHUNK))
-    list(http_clients.stream_download(server.url + "/cookie", CHUNK))
+    list(http_clients.open_download(server.url + "/cookie", CHUNK, ANYWHERE, "video/mp4", "a.mp4").chunks)
+    list(http_clients.open_download(server.url + "/cookie", CHUNK, ANYWHERE, "video/mp4", "a.mp4").chunks)
     assert not any(s["headers"].get("Cookie") for s in server.seen)
     assert http_clients.download_client() is http_clients.download_client()
 
@@ -275,8 +279,14 @@ def __init__(self, status=None, folder=False):
         self.status, self.folder = status, folder
         self.select = []
 
-    def get(self, path, params=None):
-        self.select.append((params or {}).get("$select") or path.partition("$select=")[2])
+    def chat_message(self, chat_id, message_id):
+        return self.get(f"chats/{chat_id}/messages/{message_id}")
+
+    def list(self, path, params=None, limit=None, retry=True):
+        return [{"id": "1", "attachments": [{"id": "a1", "name": "f.docx", "contentType": "reference", "contentUrl": CONTENT_URL}]}]
+
+    def get(self, path, params=None, retry=True):
+        self.select.append((params or {}).get("$select") or path.partition("$select=")[2] or "the whole item")
         if "/messages/" in path:
             return {"attachments": [{"id": "a1", "name": "f.docx", "contentType": "reference", "contentUrl": CONTENT_URL}]}
         if self.folder:
@@ -299,7 +309,7 @@ def test_a_folder_says_it_is_a_folder_on_all_three_download_routes(monkeypatch,
     note = ServeNote(folder=True)
     r = route_with(monkeypatch, note, Rotating()).get(url, headers=H)
     assert r.status_code == 404 and "folder" in r.json()["detail"]
-    assert any("folder" in s for s in note.select)
+    assert any("folder" in s or s == "the whole item" for s in note.select)
 
 
 def test_the_fallback_link_still_gets_the_host_check(monkeypatch):
diff --git a/tests/test_reads.py b/tests/test_reads.py
index 504439f..979fc45 100644
--- a/tests/test_reads.py
+++ b/tests/test_reads.py
@@ -144,7 +144,7 @@ def fail(*args, **kwargs):
 def test_chat_messages_returns_graph_messages_and_rotated_token(chat_note):
     r = TestClient(app).get("/api/chats/19:abc@thread.v2/messages", headers=HEADERS, params={"top": 10})
     assert r.status_code == 200
-    assert r.json() == [{"id": "m1", "chat": "19:abc@thread.v2", "top": 10, "select": None, "media": [], "files": [], "cards": [], "emojis": [], "importance": "normal"}]
+    assert r.json() == [{"id": "m1", "chat": "19:abc@thread.v2", "top": 10, "select": None, "media": [], "files": [], "cards": [], "quotes": [], "emojis": [], "importance": "normal"}]
     assert r.headers[config.REFRESH_TOKEN_HEADER] == "rotated-frt"
 
 
diff --git a/tests/test_teams_files.py b/tests/test_teams_files.py
index 4de7dfc..26ab791 100644
--- a/tests/test_teams_files.py
+++ b/tests/test_teams_files.py
@@ -79,6 +79,15 @@ class Stream:
     def __init__(self, body, status=200):
         self.body, self.status_code = body, status
 
+    is_redirect = False
+    headers = {}
+
+    def close(self):
+        pass
+
+    def iter_raw(self, size):
+        return self.iter_bytes(size)
+
     def raise_for_status(self):
         pass
 
@@ -97,6 +106,13 @@ def stream(self, method, url, **kw):
         self.fetched.append((url, kw))
         yield Stream(self.body)
 
+    def build_request(self, method, url, **kw):
+        return url
+
+    def send(self, url, stream=False, follow_redirects=True):
+        self.fetched.append((url, {"follow_redirects": follow_redirects}))
+        return Stream(self.body)
+
 
 @pytest.fixture
 def env(monkeypatch):