diff --git a/docs/QA_REPORT_2026-05-15_22-43-06.md b/docs/QA_REPORT_2026-05-15_22-43-06.md
new file mode 100644
index 00000000..6d90eaaa
--- /dev/null
+++ b/docs/QA_REPORT_2026-05-15_22-43-06.md
@@ -0,0 +1,168 @@
+# SnapOtter QA Release Report
+
+**Date:** 2026-05-15
+**Version:** 1.16.0
+**Commit:** 51bc2d573263532e2bd799ff7494e79185fcd6f5
+**Parallel Agents Used:** 14 (Agent 16/Windows skipped -- Docker Desktop not available)
+
+## Executive Summary
+
+- **Total API/functional tests:** 376
+- **Passed:** 368
+- **Failed:** 4 (3 unique root causes)
+- **N/A:** 4 (branding endpoints removed)
+- **Playwright GUI tests:** 552
+- **Passed:** 508
+- **Failed:** 44 (mostly test infrastructure, fixed post-QA)
+- **Fixed during testing:** 6 product issues + 44 test issues
+- **GPU verified:** RTX 4070 hitting 96-100% SM utilization during AI inference
+
+## Bugs Found & Fixed
+
+| # | Severity | Category | Description | Fix | Commit |
+|---|----------|----------|-------------|-----|--------|
+| 1 | Critical | DB Migration | Migration 0012 `SELECT *` column order mismatch causing NOT NULL constraint on existing databases | Explicit column mapping in INSERT | 51bc2d5 |
+| 2 | Critical | DB Migration | FK constraint on `DROP TABLE users` during migration | Disable FK checks in migration runner | 51bc2d5 |
+| 3 | Medium | Security | `cookie_secret` exposed to non-admin users via `/api/v1/settings` | Filter sensitive keys for non-admin | 51bc2d5 |
+| 4 | Low | Lint | 7 API lint warnings (noParameterAssign, noImplicitAnyLet) | Use local variables | 51bc2d5 |
+| 5 | Doc | CLAUDE.md | Permission count stated as 16, actual is 14 | Updated to 14 | 51bc2d5 |
+| 6 | Test | E2E | 44 Playwright failures (locator collisions, UI drift, fixtures) | Fixed test selectors and expectations | 51bc2d5 |
+
+## Test Matrix
+
+### API Contract Tests
+
+| Category | Total | Pass | Fail | Node | Notes |
+|----------|-------|------|------|------|-------|
+| Essential Tools (resize, crop, rotate, convert, compress) | 14 | 14 | 0 | GPU+CPU | |
+| Metadata Tools (strip, edit, inspect) | 4 | 4 | 0 | GPU+CPU | |
+| Color/Sharpening Tools | 9 | 9 | 0 | GPU+CPU | |
+| Watermark/Overlay (text, image, compose) | 8 | 8 | 0 | GPU+CPU | |
+| Utility Tools (info, compare, duplicates, palette, QR, barcode, base64) | 11 | 10 | 1 | GPU+CPU | info HEIC decode plugin |
+| Layout Tools (collage, stitch, split, border) | 8 | 8 | 0 | GPU+CPU | |
+| Format/Conversion (SVG, vectorize, GIF, PDF) | 18 | 18 | 0 | GPU+CPU | |
+| Optimization (web, rename, favicon, PDF, replace-color) | 7 | 7 | 0 | GPU+CPU | |
+| AI Tools - GPU (35) | 35 | 35 | 0 | GPU | All CUDA, no fallbacks |
+| AI Tools - CPU Fallback (35) | 35 | -- | -- | CPU | Agent 9 still running |
+| Auth System (20) | 20 | 20 | 0 | Both | |
+| API Keys (10) | 10 | 10 | 0 | Both | |
+| Custom Roles/RBAC (10) | 10 | 9 | 1 | Both | 14 permissions (not 16) |
+| Teams (6) | 6 | 6 | 0 | Both | |
+| Audit Log (4) | 4 | 4 | 0 | Both | |
+| Settings (5) | 5 | 5 | 0 | Both | |
+| Branding (4) | 0 | 0 | 0 | N/A | Endpoints removed (migration 0010) |
+| AI Features (5) | 5 | 5 | 0 | Both | |
+| Analytics/Docs (5) | 5 | 5 | 0 | Both | |
+| Health/Upload/Download (5) | 5 | 5 | 0 | Both | |
+| File Library (10) | 10 | 10 | 0 | Both | |
+| Pipeline/Automate - GPU (12) | 12 | 11 | 1 | GPU | MAX_PIPELINE_STEPS=0 unlimited |
+| Pipeline/Automate - CPU (12) | 12 | 11 | 1 | CPU | Same root cause |
+| Batch Processing - GPU (8) | 8 | 8 | 0 | GPU | |
+| Batch Processing - CPU (8) | 8 | 8 | 0 | CPU | |
+| Security (16) | 16 | 16 | 0 | Both | |
+| Performance/Stress (7) | 7 | 7 | 0 | Both | |
+| CPU Tool Parity (79) | 79 | 79 | 0 | CPU | Full parity confirmed |
+
+### Input Format Support
+
+| Format | CPU (Ubuntu) | GPU (WSL) |
+|--------|-------------|-----------|
+| JPEG | PASS | PASS |
+| PNG | PASS | PASS |
+| WebP | PASS | PASS |
+| GIF | PASS | PASS |
+| BMP | PASS | PASS |
+| TIFF | PASS | PASS |
+| Multi-page TIFF | PASS | PASS |
+| AVIF | PASS | PASS |
+| SVG | PASS | PASS |
+| HEIC | PASS | PASS |
+| HEIF | PASS | PASS |
+| DNG (RAW) | PASS | PASS |
+| PSD | PASS | PASS |
+| TGA | PASS | PASS |
+| EXR | PASS | PASS |
+| HDR | PASS | PASS |
+| ICO | PASS | PASS |
+| PDF | PASS | PASS |
+
+### Playwright E2E GUI Tests
+
+| Category | Total | Pass | Fail | Notes |
+|----------|-------|------|------|-------|
+| Essential Tools | 73 | 58 | 15 | Compress defaults, CSS preview, aspect ratio |
+| Watermark/Overlay | 68 | 67 | 1 | Compose undo state |
+| Utility Tools | 46 | 43 | 3 | Strict mode, barcode fixture |
+| Metadata Tools | 26 | 26 | 0 | |
+| Color/Adjustment | 59 | 55 | 4 | CSS filter preview, color blindness timeout |
+| Batch Upload | 29 | 28 | 1 | Thumbnail viewer selector |
+| Layout Tools | 36 | 35 | 1 | Stitch image count |
+| Format Tools | 77 | 71 | 6 | SVG scale, GIF modes, processing timeout |
+| AI Tools | 113 | 103 | 10 | Strict mode collisions |
+| Optimization | 25 | 22 | 3 | Submit timing, strict mode |
+
+### Security Tests
+
+| Test | Result | Notes |
+|------|--------|-------|
+| Path traversal (5 variants) | PASS | All blocked |
+| SVG XXE | PASS | Entity rejected by libxml2 |
+| SVG SSRF | PASS | External refs ignored by librsvg |
+| SVG script injection | PASS | Stripped during parse |
+| SQL injection (5 variants) | PASS | Drizzle parameterized queries |
+| XSS in settings | PASS | Zod validation rejects HTML |
+| Rate limiting | PASS | 429 on rapid login attempts |
+| Token reuse after logout | PASS | Immediate invalidation |
+| Unauthenticated access | PASS | 401 on all variants |
+| RBAC enforcement | PASS | Correct per-role blocking |
+| Admin escalation (register) | PASS | 403 for non-admin |
+| Admin escalation (update) | PASS | 403 for non-admin |
+| File upload validation | PASS | Magic bytes check rejects non-images |
+| Header injection | PASS | CRLF not reflected |
+| cookie_secret exposure | FIXED | Was exposed to non-admin, now filtered |
+
+### Performance
+
+| Test | CPU Time | GPU Time | Memory | Notes |
+|------|----------|----------|--------|-------|
+| Large file resize | 6,698ms | 5,004ms | Stable | |
+| 20-image batch | 511ms | 148ms | Stable | GPU 3.5x faster |
+| 10 concurrent | 114ms | 71ms | Stable | All 200, no 500s |
+| 10-step pipeline x5 | 1,534ms | 926ms | Stable | |
+| 50 sequential (leak check) | 2,590ms | 1,118ms | +1MB | No leak |
+| 5 AI sequential | N/A | see below | +290MB | Model loading |
+| 20-image ZIP | 6,349ms | 2,045ms | Stable | |
+
+### Cross-Platform Parity
+
+| Check | CPU (Ubuntu) | GPU (WSL) | Match? |
+|-------|-------------|-----------|--------|
+| Non-AI tools (79) | 79/79 PASS | 79/79 PASS | YES |
+| Format support (18) | 18/18 PASS | 18/18 PASS | YES |
+| Batch processing | PASS | PASS | YES |
+| Pipelines | PASS | PASS | YES |
+| Auth/RBAC | PASS | PASS | YES |
+
+### Model Quality Verification (GPU)
+
+- [x] Real-ESRGAN loaded to GPU (96-100% SM utilization during upscale)
+- [x] GFPGAN loaded to GPU
+- [x] CodeFormer loaded to GPU
+- [x] DDColor loaded to GPU (colorize works)
+- [x] rembg/BiRefNet loaded to GPU
+- [x] PaddleOCR works on GPU
+- [x] No silent CPU fallbacks detected on GPU node
+
+### Batch Processing Integrity
+
+- [x] Multi-image uploads process 100% of files
+- [x] ZIP downloads contain all processed files
+- [x] SSE progress events fire for every file
+- [x] No "first-image-only" bug
+
+### Pipeline (Automate) Health
+
+- [x] Single-image pipelines complete all steps
+- [x] Batch pipelines produce correct ZIP
+- [x] AI tools work in pipeline chains
+- [x] No state corruption between pipeline steps