diff --git a/.dockerignore b/.dockerignore
index ac00749..26604c2 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -30,3 +30,14 @@ eslint.config.mjs
 
 # OS metadata
 .DS_Store
+
+# Site content — gallery.yaml, settings.yaml, pages, journal entries,
+# credentials (install.json, .setup-token), contact messages, proofing links,
+# analytics and backups. The container mounts content/ as a volume, so none of
+# it belongs in the build context: a local build from a checkout with a live
+# content/ would otherwise bake all of it into the image layers, where the
+# mounted volume hides it but `docker save` or a push hands it out. Only the
+# tracked templates are let through; the Dockerfile copies them by name.
+content
+!content/*.example
+!content/journal/*.example
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c28339c..922ab52 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
 
       - name: Install dependencies
@@ -115,7 +115,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
 
       - name: Install dependencies
diff --git a/.gitignore b/.gitignore
index 142eb55..702f9f6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,6 +92,9 @@ content/.setup-token
 content/messages/
 # Google Fonts cached by /api/fonts (lib/fonts.ts)
 content/.fonts/
+# Content pages (lib/admin/pages-service.ts) and the uploaded favicon
+content/pages/
+content/favicon.svg
 
 # ── Internal Dev Docs ────────────────────────────────
 docs/dev/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ab7433..55d000f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,289 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 Releases up to and including v0.9.2 are documented in the
 [GitHub releases](https://github.com/ralksta/immich-folio/releases).
 
+## [0.20.0] — 2026-10-02
+
+### Security
+
+- **Original downloads no longer carry the photo's location**
+  ([#828](https://github.com/ralksta/immich-folio/pull/828),
+  [GHSA-g4xf-4285-4cv4](https://github.com/ralksta/immich-folio/security/advisories/GHSA-g4xf-4285-4cv4),
+  low). The rest of the site never shows more than city and country, but the
+  single download, the album ZIP and the proofing ZIP handed out originals with
+  their GPS coordinates. JPEG, HEIC/HEIF and AVIF originals are now edited in
+  place as they stream: the GPS block in EXIF, every GPS or latitude/longitude
+  property in XMP, and place names below city level (XMP `Location`,
+  `Sublocation` and similar, IPTC 2:92) are overwritten. Camera, lens,
+  exposure, dates, copyright and IPTC, the ICC profile and the image data stay
+  exactly as they were, and so does the file length; nothing is re-encoded.
+  Extended XMP, C2PA manifests and unknown vendor segments, which can hold
+  their own location records, are blanked whole, and a file whose metadata
+  cannot be read safely is refused (`404`, or left out of the ZIP and logged)
+  rather than sent. RAW/DNG, PNG, TIFF, WebP and video are delivered as Immich
+  stores them, GPS included; a new doctor check, `download-metadata`, names the
+  download albums that contain such files and how many of them Immich has a
+  location for.
+
+- **Locally built Docker images no longer contain the checkout's `content/`**
+  ([#805](https://github.com/ralksta/immich-folio/pull/805)). A `docker build`
+  from a live checkout copied `content/` into the image three ways, so its
+  layers held `install.json` (Immich API key, site secret, admin password
+  hash), `.setup-token`, contact messages, proofing links, journal entries and
+  every backup. The running container hid them behind the mounted volume, but
+  `docker save` or a push to a registry handed them out. `.dockerignore` now
+  excludes `content/`, the builder drops the copy the standalone trace makes,
+  and the image ships only the `*.example` templates. The GHCR images are
+  built from a clean clone and were never affected. See the upgrade notes.
+
+- **View statistics are gated on a password-locked site**
+  ([#810](https://github.com/ralksta/immich-folio/pull/810)).
+  `POST /api/analytics/track` accepted hits while the site password was set,
+  so anyone could write paths of their choosing into `content/analytics.json`.
+  It now answers like every other gated route. Visitors who unlocked the site
+  are counted as before.
+
+### Added
+
+- **1:1 zoom in the lightbox**
+  ([#830](https://github.com/ralksta/immich-folio/pull/830), closes
+  [#467](https://github.com/ralksta/immich-folio/issues/467); requested in
+  [#587](https://github.com/ralksta/immich-folio/issues/587) by
+  [@ImScheinox](https://github.com/ImScheinox)). Visitors can zoom a photo to
+  one image pixel per screen pixel to judge sharpness: double-click or
+  double-tap, the magnifier button, pinch, Ctrl + scroll wheel, or `+`, `-`
+  and `0`. Zoom stops at 1:1, dragging pans, `Esc` returns to fit before it
+  closes the viewer, and swiping to the next photo is off while zoomed. The
+  full-resolution file is fetched on the first zoom gesture only, never on
+  opening the viewer or for neighbouring photos. JPEG and AVIF zoom into the
+  original, HEIC, RAW and other formats a browser cannot show into Immich's
+  full-size rendition, both with the location removed as for downloads; PNG,
+  WebP, GIF and video are not zoomable. On touch devices photos above 50
+  megapixels get no zoom control, since decoding them takes 200 MB or more.
+  Zoom is off by default: `zoom: true` in `settings.yaml` (Settings → General
+  → _Photo zoom_) turns it on, and a subpage or album can override it either
+  way (album → subpage → site; _Inherit / On / Off_ in the page builder). It
+  is offered on album pages, not in essays, journal entries or proofing links.
+  `GET /api/zoom/…` re-checks the allowlist, every password gate and the zoom
+  setting of the route, is limited to 20 files a minute per visitor and is
+  never cached by a CDN. A new doctor check, `zoom-renditions`, warns when
+  Immich has no full-size previews for zoomable photos. See
+  `docs/gallery-config.md#photo-zoom` and the upgrade notes.
+
+- **Five new theme presets: Kunsthalle, Ma, Cyanotype, Salon and Birch**
+  ([#816](https://github.com/ralksta/immich-folio/pull/816),
+  [#824](https://github.com/ralksta/immich-folio/pull/824)). _Kunsthalle_ hangs
+  photos on a neutral grey gallery wall with a numbered wall label under each
+  work (album number, the Immich description where captions are published,
+  and camera · lens). _Ma_ is washi paper, sumi ink and one vermilion seal,
+  with wide negative space and a vertical hero subtitle. _Cyanotype_ sets the
+  site like a Prussian-blue drawing sheet with registration marks and ruled
+  title blocks. _Salon_ is an oxblood picture gallery with a fine fillet round
+  each work. _Birch_ is Scandinavian daylight in green-tinted greys, with no
+  uppercase anywhere. Each has a dark and a light palette whose text reaches
+  4.5:1 on every surface, including the accent used as text. Under
+  `photoFrame: passepartout`, Kunsthalle and Salon get mats toned to their
+  wall instead of black or white. Recommended grid layouts per preset are in
+  `docs/theming.md`. Presets are now declared once in
+  `lib/config/presets.ts`, and a test checks every place that cannot import
+  it.
+
+- **Photos edited in Immich are shown as edited**
+  ([#832](https://github.com/ralksta/immich-folio/pull/832), closes
+  [#831](https://github.com/ralksta/immich-folio/issues/831)). Crops and
+  rotations made in Immich's editor were ignored everywhere: Immich keeps an
+  edit apart from the file and applies it only when asked. Folio now asks for
+  the edited rendition in the grid, the lightbox, the zoom, share images, the
+  map and downloads, and lays the grid out with the edited proportions. An
+  edited photo is downloaded as Immich renders the edit, a full-resolution
+  JPEG without EXIF, named `.jpg`. Only edited photos get a new image URL; see
+  the upgrade notes and `docs/deployment.md#edits-made-in-immich`.
+
+### Changed
+
+- **The Impressum, the privacy page and the contact form are reachable on a
+  password-locked site**
+  ([#819](https://github.com/ralksta/immich-folio/pull/819)). The site
+  password rewrote every page to the gate, but a German Impressum has to be
+  reachable directly. `/impressum`, `/privacy` and `/contact` now pass the
+  gate, render without header, navigation or footer, and contain no album
+  names or asset tokens; `POST /api/contact` accepts messages with its rate
+  limit, honeypot and validation unchanged. The gate page links the Impressum
+  and the privacy page when they exist. A page that is switched off still
+  answers `404`, and every other path stays gated.
+
+- **Unknown pages answer a real 404**
+  ([#812](https://github.com/ralksta/immich-folio/pull/812)). An unknown slug,
+  a subpage with `enabled: false`, a draft content page and an unknown album
+  under a subpage rendered the not-found page with status `200`, because the
+  loading skeleton was streamed before the page could decide. The decision is
+  now made first, with no extra Immich request, and the skeleton still covers
+  the slow album load. A locked subpage shows its gate for any album slug below
+  it, so a 404 does not reveal which albums sit behind the password. Every 404
+  has the translated not-found title and a single `noindex`. Hidden subpages
+  and their albums are now `noindex`, and a subpage with several albums gets
+  its own description. On a client-side navigation to a subpage or album, the
+  skeleton now appears after one server round trip instead of at once.
+
+- **Grid photos show their passepartout mat**
+  ([#814](https://github.com/ralksta/immich-folio/pull/814)).
+  `photoFrame: passepartout`, the default frame of Studio, Classic and Noir,
+  never showed its mat: the photo covered it, and the EXIF line meant for the
+  mat sat on top of the photo. The photo now sits inside the mat, uncropped in
+  masonry, with the EXIF line printed in the band below it. Justified rows stay
+  aligned, and the row spacing is no longer doubled in the uniform, showcase,
+  filmstrip, editorial-flow and justified layouts. Mat colours are tokens per
+  mode and reach 4.5:1 for the caption in every preset. The `shadow` and
+  `none` frames are pixel-identical to before.
+
+- **Text and controls reach WCAG contrast**
+  ([#804](https://github.com/ralksta/immich-folio/pull/804),
+  [#818](https://github.com/ralksta/immich-folio/pull/818)). The accent is a
+  fill colour, and as text it fell below 4.5:1 on dark pages (Studio Modern's
+  red at 3.66:1). Accent-coloured text now uses a variant lightened or
+  darkened just until it passes on the mode's surfaces; an accent that already
+  passes, your own included, is unchanged, and fills and underlines keep the
+  accent itself. Form inputs have visible borders, every control shows the
+  same focus ring, the Minimal hero navigation is readable over the photo, the
+  journal draft badge reaches 4.5:1 in light mode, and scrollbars and form
+  controls follow the colour mode. Studio Modern's light muted text moves from
+  `#73736e` to `#6d6d68`.
+
+- **Settings the site would bend are refused on save**
+  ([#803](https://github.com/ralksta/immich-folio/pull/803)). Like the site
+  URL, accent and grid values in 0.19.0, `contact.retentionDays` outside
+  1–365, `theme.radius` outside 0–64 and header links without a label or an
+  http(s) URL are now marked in the form and refused with `400`, instead of
+  being clamped or dropped silently when the site renders. `npm run doctor`
+  now runs the `settings-values` check, which it skipped before.
+
+- **The privacy facts cover proofing links**
+  ([#826](https://github.com/ralksta/immich-folio/pull/826)). The facts next to
+  the privacy editor said proofing selections are never sent to the server,
+  which has not been true since proofing links. A new _Proofing links_ fact
+  lists what a link stores in `content/proofing.json` and for how long, and
+  names the webhook host as a third party when `PROOFING_WEBHOOK_URL` is set.
+
+- **The admin has one content width**
+  ([#820](https://github.com/ralksta/immich-folio/pull/820)). Pages, Overview,
+  Diagnostics, Analytics and Messages ended at different edges; they now share
+  one 1280px column. The analytics headings and numbers use the admin font and
+  fit a phone, the favicon upload is a styled, keyboard-reachable button with a
+  preview, and the _Visual Blocks / Raw Markdown_ and _Desktop / Mobile_
+  toggles show which mode is active.
+
+- **How colour profiles reach visitors is documented**
+  ([#823](https://github.com/ralksta/immich-folio/pull/823), closes
+  [#468](https://github.com/ralksta/immich-folio/issues/468)). Folio streams
+  Immich's renditions unchanged, and sRGB and Display P3 photos arrive
+  correctly. AVIF originals tagged only with a BT.2020 colour tag, typical of
+  Lightroom AVIF exports, are shown 13–37% less saturated, because Immich
+  ignores that tag when it builds its renditions; this is tracked in
+  [#827](https://github.com/ralksta/immich-folio/issues/827). See
+  `docs/deployment.md#colour-profiles`.
+
+### Fixed
+
+- **The colour mode is right on the first paint**
+  ([#808](https://github.com/ralksta/immich-folio/pull/808)). A visitor who
+  chose light mode, or a light OS with `mode: auto`, saw a dark page until the
+  scripts loaded. A small inline script now applies the stored choice or the
+  OS setting before the first paint, on every page including the password gate
+  and the admin, and `mode: auto` follows an OS switch while the page is open.
+
+- **Admin backups and unsaved-changes markers**
+  ([#807](https://github.com/ralksta/immich-folio/pull/807)). Renaming a page
+  or journal entry listed it in Backups as a deleted entry, and restoring that
+  brought the old slug back; the history now follows the renamed file. A save
+  that changes nothing no longer takes a backup and pushes out a real one.
+  _Unsaved changes_ in the settings and the page builder clears when an edit is
+  reverted. A journal text paragraph whose line starts with `![` is escaped,
+  so it is no longer turned into a broken photo block on the next load.
+
+- **The admin for keyboards and screen readers**
+  ([#813](https://github.com/ralksta/immich-folio/pull/813),
+  [#817](https://github.com/ralksta/immich-folio/pull/817)). Drag handles in
+  the page builder carry the sortable role and a name (_Reorder Pricing_), so
+  rows no longer nest a button inside a button, and drag announcements name
+  pages, albums and hero photos instead of internal IDs. The journal's
+  _+ Pick_ slot is a button. The site title field shows what an empty title
+  really falls back to. Theme card descriptions match the presets, the
+  _Typographic_ hero card no longer shows photos the hero never renders, and
+  _Cover_ has a preview.
+
+- **Map, proofing and lightbox details**
+  ([#811](https://github.com/ralksta/immich-folio/pull/811),
+  [#810](https://github.com/ralksta/immich-folio/pull/810)). Map markers are
+  named for screen readers ("Yufu, Japan, 46 photos"), and the map header
+  counts only the albums the viewer can open. Proofing bars follow the preset's
+  corner radius, grid hearts use the lightbox's favourite colour, and the
+  header and proofing bar no longer show through the lightbox. ZIP entries are
+  dated with the photo's capture time instead of the time the archive was
+  built.
+
+- **Share previews, journal and photo links**
+  ([#809](https://github.com/ralksta/immich-folio/pull/809)). `/about` shared
+  no image and now uses the portrait; `/journal` previewed as the home page and
+  now has its own card. A draft entry shows its _Draft_ badge to the admin, and
+  machine-readable journal dates are marked up as `<time>`. A `?photo=` link
+  that matches no photo is removed from the address bar.
+
+- **Footer and EXIF lines**
+  ([#806](https://github.com/ralksta/immich-folio/pull/806)). On short pages
+  the footer sits at the bottom of the window instead of mid-screen. The
+  aperture sign stays `ƒ` under presets that set EXIF in capitals, a phone's
+  lens no longer repeats the camera model ("iPhone 14 Pro back triple camera"),
+  and long EXIF lines on Studio Modern tiles are cut with an ellipsis instead
+  of mid-letter.
+
+### Upgrade notes
+
+**Zoom is opt-in.** Nothing changes until `zoom: true` is set for the site, a
+subpage or an album ([#830](https://github.com/ralksta/immich-folio/pull/830)).
+Every zoom sends a full-resolution file (commonly 5–25 MB) from Immich through
+Folio and is never cached by a CDN, so on a slow or metered uplink switch it on
+only where it is needed. For HEIC and RAW photos, turn on Immich's
+_Administration → Settings → Image Settings → Full-size image_ in JPEG format
+and run _Generate Thumbnails_; without it those photos show the zoom button but
+answer "Full resolution is not available for this photo". The doctor's
+`zoom-renditions` check tells you.
+
+**Edited photos get a new image URL once**
+([#832](https://github.com/ralksta/immich-folio/pull/832)). Only photos edited
+in Immich carry the new `e` parameter; every other URL is unchanged, so no
+`IMAGE_CACHE_VERSION` bump is needed. A CDN keyed on the full query string,
+as `docs/deployment.md#cdn-mode` asks, picks it up; one keyed on selected
+parameters must add `e`. After a fresh edit in Immich the photo shows
+edited once Folio's album cache refreshes (`CACHE_TTL`, _Clear cache_, or the
+webhook).
+
+**Docker images built from a checkout**
+([#805](https://github.com/ralksta/immich-folio/pull/805)). With
+`./content:/app/content` mounted, as in the documented `docker-compose.yml`,
+there is nothing to do. If you ran a self-built image without that mount,
+mount it now; content is no longer in the image. If you ever pushed or shared
+an image built from a checkout with live content, rebuild it, delete the old
+tags and stop distributing them, and treat what was in `content/` as exposed:
+rotate the Immich API key and `AUTH_SECRET` and change the admin password.
+
+**On a password-locked site, `/impressum`, `/privacy` and `/contact` are
+public** ([#819](https://github.com/ralksta/immich-folio/pull/819)), and the
+contact form accepts messages. Switch a page off (`legal.enabled`,
+`privacy.enabled`, `contact.enabled`) if it should not be reachable.
+
+**Grids with `photoFrame: passepartout` look different**
+([#814](https://github.com/ralksta/immich-folio/pull/814)): the mat and the
+EXIF band below each photo are now visible, which makes tiles slightly taller.
+This is the default frame of Studio, Classic and Noir.
+
+**Review your privacy policy if you use proofing links**
+([#826](https://github.com/ralksta/immich-folio/pull/826)); the new fact under
+Settings → Legal says what they store.
+
+**The Immich API key stays read-only.** Zoom and edited photos read the same
+kinds of Immich endpoints as before (renditions and originals); the key needs
+no new permission and no write access, as documented under _Immich API Key
+Permissions_ in the README.
+
 ## [0.19.1] — 2026-10-01
 
 ### Security
diff --git a/Dockerfile b/Dockerfile
index 95ab9b5..9ff6943 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -24,6 +24,13 @@ ENV AUTH_SECRET="build-placeholder"
 
 RUN npm run build
 
+# The standalone trace copies content/ along: proxy.ts and instrumentation.ts
+# read it through runtime paths, which the tracer resolves to the whole
+# directory. .dockerignore already keeps a checkout's content out of this
+# stage; dropping the traced copy makes sure the runner below gets content/
+# from nowhere but the templates it copies by name.
+RUN rm -rf .next/standalone/content
+
 # ── Runtime ───────────────────────────────────────
 FROM base AS runner
 WORKDIR /app
@@ -38,7 +45,16 @@ RUN adduser --system --uid 1001 nextjs
 RUN apk add --no-cache su-exec
 
 COPY --from=builder /app/public ./public
-COPY --from=builder /app/content ./content
+
+# content/ ships with the templates only. The site's own files come from the
+# volume mounted at /app/content; with an empty volume the app shows the setup
+# screen and the wizard writes into it. Copying the templates by name rather
+# than the whole directory keeps a checkout's real content (credentials,
+# contact messages, proofing links, backups) out of the image even if a build
+# context ever includes it — .dockerignore is the first line of that.
+RUN mkdir -p content/journal
+COPY --from=builder /app/content/*.example ./content/
+COPY --from=builder /app/content/journal/*.example ./content/journal/
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 COPY --chmod=755 docker-entrypoint.sh ./docker-entrypoint.sh
@@ -46,13 +62,19 @@ COPY --chmod=755 docker-entrypoint.sh ./docker-entrypoint.sh
 # `npm run doctor` — the config doctor for the terminal (#521). It is the tool
 # for the case where the app will not start, so it has to be in the runtime
 # image rather than only in a checkout. Node 22.18+ strips the types itself,
-# so this is the whole of it: the entry point, the pure checks it imports, and
-# js-yaml, which the standalone bundle inlines rather than leaving on disk.
-# The standalone build copies package.json verbatim, so the script entry is
-# already there.
+# so this is the whole of it: the entry point, every module it imports at
+# runtime, and js-yaml, which the standalone bundle inlines rather than leaving
+# on disk. The standalone build copies package.json verbatim, so the script
+# entry is already there. scripts/__tests__/doctor-image.test.ts walks the
+# import graph and fails when a module of it is missing from this list.
 COPY --from=builder /app/scripts/doctor.mjs ./scripts/doctor.mjs
 COPY --from=builder /app/scripts/doctor.mts ./scripts/doctor.mts
 COPY --from=builder /app/lib/admin/doctor.ts ./lib/admin/doctor.ts
+COPY --from=builder /app/lib/config/settingValues.ts ./lib/config/settingValues.ts
+COPY --from=builder /app/lib/config/schema.ts ./lib/config/schema.ts
+COPY --from=builder /app/lib/config/theme.ts ./lib/config/theme.ts
+COPY --from=builder /app/lib/config/presets.ts ./lib/config/presets.ts
+COPY --from=builder /app/lib/siteUrl.ts ./lib/siteUrl.ts
 COPY --from=deps /app/node_modules/js-yaml ./node_modules/js-yaml
 
 # Content dir must be writable for admin saves (ownership fixed at runtime)
diff --git a/README.md b/README.md
index 720b670..06d2413 100644
--- a/README.md
+++ b/README.md
@@ -13,7 +13,7 @@
 
 A self-hosted portfolio powered by [Immich](https://immich.app). It acts as a **secure reverse proxy** between your visitors and your private Immich instance: your Immich server stays on your local network, completely invisible to the outside world, while your albums are published as a gallery you control.
 
-**Latest: v0.19.1** — private proofing links for clients, custom content pages and a round of security fixes. → [What's New](#whats-new)
+**Latest: v0.20.0** — 1:1 zoom in the lightbox, five new theme presets, Immich edits shown as edited, and no GPS in downloads. → [What's New](#whats-new)
 
 ## Contents
 
@@ -40,7 +40,7 @@ A self-hosted portfolio powered by [Immich](https://immich.app). It acts as a **
 - **Justified rows** _(experimental)_ — every row fills the width at one shared height, aspect ratios intact, nothing cropped
 - **Per-subpage grid overrides** — each subpage can define its own columns, gap, aspect ratio, and layout mode, and individual albums can override that again _(experimental)_
 - **Cover focal points** _(experimental)_ — decide which part of a cover survives the crop
-- **Fullscreen lightbox** — keyboard and swipe navigation, EXIF panel, adjacent image preloading
+- **Fullscreen lightbox** — keyboard and swipe navigation, EXIF panel, adjacent image preloading, and opt-in 1:1 zoom to full resolution for checking sharpness ([guide](docs/gallery-config.md#photo-zoom))
 - **EXIF metadata on hover** — camera body, lens, focal length, aperture, shutter speed, ISO shown directly on the grid
 - **ThumbHash placeholders** — instant blurred previews while full images load
 
@@ -66,9 +66,9 @@ A self-hosted portfolio powered by [Immich](https://immich.app). It acts as a **
 - **Unlisted subpages** _(experimental)_ — reachable by direct link, absent from the navigation
 - **Subpage on/off toggle** — take a page offline without deleting it
 - **External navigation links** _(experimental)_ — point the header at a shop, a blog, or a social profile
-- **Client proofing** — clients favorite photos and export the selection; picks are encoded in the URL, nothing is stored server-side
+- **Client proofing** — clients favorite photos and export the selection; picks stay in the visitor's browser and the URL, with nothing stored server-side (proofing links, below, do save them)
 - **Client proofing links** — a private link per client and album, picks saved server-side, a submit that locks the selection and pings you via webhook, expiry dates, download limits, and a Lightroom-ready export of the chosen file names ([guide](docs/gallery-config.md#client-proofing-links))
-- **Originals delivery** — per-album opt-in lets visitors download a whole album or their proofing selection as a ZIP of the originals
+- **Originals delivery** — per-album opt-in lets visitors download a whole album or their proofing selection as a ZIP of the originals, with GPS coordinates removed from JPEG, HEIC and AVIF files
 - **Lightbox watermark** — configurable overlay on fullscreen images
 - **Six interface languages** — English, German, French, Spanish, Italian and Dutch for everything visitors see
 - **Privacy-friendly analytics** — cookieless view counts, no third parties, can be switched off
@@ -261,7 +261,7 @@ Long-form storytelling with fullbleed photos, side-by-side pairs and grids, quot
 
 ### Theming
 
-Seven built-in presets with distinct visual identities — or mix and match with fine-grained control over colors, fonts, corners, photo frames, hero layout, and grid style.
+Twelve built-in presets with distinct visual identities — or mix and match with fine-grained control over colors, fonts, corners, photo frames, hero layout, and grid style.
 
 **Studio Modern** is the default: Leica precision rebuilt around the Archivo grotesque, with IBM Plex Mono for every piece of photographic metadata, hairline rules, zero radius, and red as signal only.
 
@@ -272,7 +272,8 @@ Seven built-in presets with distinct visual identities — or mix and match with
 <p align="center"><em>Studio Modern, dark and light — every preset ships both, and visitors switch with a toggle in the navigation bar.</em></p>
 
 ```yaml
-theme: studio-modern # or: studio, minimal, editorial, classic, noir, monograph
+theme: studio-modern # or: studio, minimal, editorial, classic, noir, monograph,
+#   kunsthalle, ma, cyanotype, salon, birch
 ```
 
 → **[View all Themes & Configuration Guide](docs/theming.md)**
@@ -344,15 +345,15 @@ own password, separate from any album passwords, and writes straight to
 
 ## What's New
 
-v0.19.0 — client proofing links, content pages and a big quality pass:
+v0.20.0 — zoom, five new presets and photos as you edited them:
 
-- **Private proofing links for clients** — one link per client and album, with an optional expiry, download limit and ZIP; the selection is saved on the server, the client submits it, and you export the picks as a Lightroom or Capture One filter
-- **Custom content pages** — `content/pages/<slug>.md` pages (pricing, workshops, anything) written in the journal editor and placed in the menu next to your subpages
-- **A calmer admin** — library search and multi-select in the photo picker, a warning instead of a silent overwrite when a file changed elsewhere, settings from the environment shown as locked, and invalid values refused on save
-- **Better on phones and in light mode** — no sideways scrolling, a menu whenever the navigation does not fit, readable lightbox controls, and an accessibility baseline (reduced motion, focus handling, touch targets)
-- **Security fixes** — media URLs stop working once a photo leaves the site, offline subpages are unpublished everywhere, and the sitemap skips protected journal entries ([advisories](https://github.com/ralksta/immich-folio/security/advisories))
+- **1:1 zoom in the lightbox** — double-click, pinch or press `+` to see a photo at full resolution and judge its sharpness; off by default, switched on for the site, a page or a single album ([guide](docs/gallery-config.md#photo-zoom))
+- **Five new theme presets** — Kunsthalle (a grey gallery wall with numbered wall labels), Ma, Cyanotype, Salon and Birch, each in dark and light; the passepartout mat of Studio, Classic and Noir is finally visible too
+- **Edits made in Immich show up** — crops and rotations from Immich's editor appear in the grid, the lightbox, share images and downloads
+- **No GPS in downloads** — original downloads and ZIPs keep camera data and colour profile but lose the coordinates and sub-city place names ([advisory](https://github.com/ralksta/immich-folio/security/advisories/GHSA-g4xf-4285-4cv4))
+- **Legal pages on a locked site** — with a site password set, the Impressum, the privacy page and the contact form stay reachable, and unknown pages answer a real 404
 
-**Upgrade note:** image URLs change once (browser and CDN caches refill by themselves), at most two ZIP downloads run at once per visitor — set `TRUSTED_PROXY_HOPS` behind a reverse proxy — and changes made inside Immich now show after `CACHE_TTL` or _Clear cache_. Details in the [changelog](CHANGELOG.md).
+**Upgrade note:** zoom needs `zoom: true`, and for HEIC/RAW photos Immich's _Full-size image_ setting in JPEG format. If you build the Docker image yourself, keep `content/` mounted as a volume; if you ever pushed a self-built image, see the [changelog](CHANGELOG.md) for what to rotate.
 
 Security fixes ship in normal releases, so **running the latest release is the
 recommended baseline**.
diff --git a/app/loading.tsx b/app/(home)/loading.tsx
similarity index 51%
rename from app/loading.tsx
rename to app/(home)/loading.tsx
index cf3690f..d2fff7c 100644
--- a/app/loading.tsx
+++ b/app/(home)/loading.tsx
@@ -1,8 +1,14 @@
 /**
  * Instant shell for the homepage.
+ *
+ * It lives in the (home) route group, not in app/, on purpose. A loading.tsx
+ * in app/ wraps every route below the root layout in a Suspense boundary, and
+ * a page inside one streams its 200 before it can call notFound() — which made
+ * every unknown slug the catch-all answers a soft 404. See
+ * app/[...path]/page.tsx.
  */
 
-import styles from './loading.module.css';
+import styles from '../loading.module.css';
 import { getServerDictionary } from '@/lib/i18n/server';
 
 export default function Loading() {
diff --git a/app/page.tsx b/app/(home)/page.tsx
similarity index 99%
rename from app/page.tsx
rename to app/(home)/page.tsx
index 77121e8..fedba1c 100644
--- a/app/page.tsx
+++ b/app/(home)/page.tsx
@@ -118,7 +118,7 @@ export default async function HomePage() {
       const ph = asset ? assetPlaceholder(asset) : null;
       const exif = asset ? await heroExifLine(asset, config.exif) : undefined;
       return {
-        src: imageUrl(id, 'preview'),
+        src: imageUrl(asset ?? id, 'preview'),
         ...(ph ? { blurDataURL: ph.blurDataURL } : {}),
         ...(exif ? { exif } : {}),
       };
diff --git a/app/[...path]/EssayView.tsx b/app/[...path]/EssayView.tsx
index 4734ff2..5ec33bc 100644
--- a/app/[...path]/EssayView.tsx
+++ b/app/[...path]/EssayView.tsx
@@ -14,7 +14,7 @@ import { essayPhotoSequence } from '@/lib/essaySequence';
 import type { PhotoItem } from './PhotoGrid';
 import './essay.css';
 import { useDictionary } from '@/components/I18nProvider';
-import { formatJournalDate } from '@/lib/journalDate';
+import { formatJournalDate, journalDateTime } from '@/lib/journalDate';
 
 /**
  * The map block is the only thing in an essay that needs Leaflet, and most
@@ -145,7 +145,7 @@ function EssayViewContent({
               background: 'none',
               border: 'none',
               cursor: 'pointer',
-              color: isFav ? '#ff4d4f' : 'rgba(255,255,255,0.85)',
+              color: isFav ? 'var(--lightbox-fav)' : 'rgba(255,255,255,0.85)',
               filter: 'drop-shadow(0 2px 4px rgba(0,0,0,0.6))',
             }}
           >
@@ -253,7 +253,7 @@ function EssayViewContent({
                       background: 'none',
                       border: 'none',
                       cursor: 'pointer',
-                      color: isFav ? '#ff4d4f' : 'rgba(255,255,255,0.85)',
+                      color: isFav ? 'var(--lightbox-fav)' : 'rgba(255,255,255,0.85)',
                       filter: 'drop-shadow(0 2px 4px rgba(0,0,0,0.6))',
                     }}
                   >
@@ -409,16 +409,19 @@ function EssayViewContent({
   // The story's photos that are selected, not the whole stored set (see PhotoGrid).
   const selectedCount = proofing ? proofing.getSelectedTokens().length : 0;
 
+  const dateText = formatJournalDate(essay.frontmatter.date, t.dateLocale);
+  const dateTime = journalDateTime(essay.frontmatter.date);
+
   return (
     <div className="essay-container">
       <header className="essay-header">
         {displayTitle && <h1 className="essay-header__title">{displayTitle}</h1>}
         {displaySubtitle && <p className="essay-header__subtitle">{displaySubtitle}</p>}
-        {(essay.frontmatter.author || essay.frontmatter.date) && (
+        {(essay.frontmatter.author || dateText) && (
           <div className="essay-header__meta">
-            {[essay.frontmatter.author, formatJournalDate(essay.frontmatter.date, t.dateLocale)]
-              .filter(Boolean)
-              .join(' • ')}
+            {essay.frontmatter.author}
+            {essay.frontmatter.author && dateText && ' • '}
+            {dateText && (dateTime ? <time dateTime={dateTime}>{dateText}</time> : dateText)}
           </div>
         )}
       </header>
@@ -465,7 +468,7 @@ function EssayViewContent({
             alignItems: 'center',
             gap: '12px',
             padding: '8px 16px',
-            borderRadius: '30px',
+            borderRadius: 'var(--radius-lg)',
             background: 'var(--bg-card, #1e1e1e)',
             color: 'var(--text-primary, #ffffff)',
             border: '1px solid var(--border-subtle, rgba(255,255,255,0.15))',
diff --git a/app/[...path]/PathSkeleton.tsx b/app/[...path]/PathSkeleton.tsx
new file mode 100644
index 0000000..abd79bc
--- /dev/null
+++ b/app/[...path]/PathSkeleton.tsx
@@ -0,0 +1,28 @@
+/**
+ * Placeholder for album and subpage content while Immich answers. These routes
+ * are force-dynamic and wait on a live Immich round-trip — up to
+ * IMMICH_TIMEOUT_MS when the server is struggling — so without this the viewer
+ * stares at a blank page.
+ *
+ * This used to be app/[...path]/loading.tsx. It is a Suspense fallback inside
+ * the page now, placed after the page has decided whether the path exists: a
+ * loading.tsx wraps the whole page, so the skeleton went out with a 200 before
+ * the page could call notFound().
+ */
+
+import styles from '../loading.module.css';
+import { getServerDictionary } from '@/lib/i18n/server';
+
+export function PathSkeleton() {
+  const t = getServerDictionary();
+  return (
+    <>
+      <div className={styles.heading} aria-hidden="true" />
+      <div className={styles.grid} role="status" aria-label={t.common.loadingPhotos}>
+        {Array.from({ length: 9 }).map((_, i) => (
+          <div key={i} className={styles.tile} />
+        ))}
+      </div>
+    </>
+  );
+}
diff --git a/app/[...path]/PhotoGrid.tsx b/app/[...path]/PhotoGrid.tsx
index e47710e..6104787 100644
--- a/app/[...path]/PhotoGrid.tsx
+++ b/app/[...path]/PhotoGrid.tsx
@@ -20,6 +20,9 @@ import { useProofing } from '@/components/useProofing';
 import { ProofingProvider, ProofingModal, ProofSessionControls } from '@/components/ProofingLazy';
 import { useDictionary } from '@/components/I18nProvider';
 import { parsePhotoHash, parsePhotoQuery, buildPhotoQuery } from '@/lib/photoHash';
+import { justifiedTileStyle } from '@/lib/justifiedRow';
+
+const pad2 = (n: number) => String(n).padStart(2, '0');
 
 export interface PhotoItem {
   id: string;
@@ -40,6 +43,14 @@ export interface PhotoItem {
   caption?: string;
   /** Present only when the surrounding album offers its originals (#475). */
   downloadUrl?: string;
+  /**
+   * The full-resolution image for the lightbox zoom, fetched only when the
+   * visitor zooms (#467). Present only where zoom resolves on and the photo
+   * has a zoomable source; the size is the image's pixel size, upright.
+   */
+  zoomUrl?: string;
+  zoomWidth?: number;
+  zoomHeight?: number;
 }
 
 interface PhotoGridProps {
@@ -114,11 +125,25 @@ function PhotoGridInner({
       setLightboxIndex(byToken);
       return;
     }
+    // A `photo` that names no photo in this album — mistyped, truncated by a
+    // messenger, or a position like `?photo=5` (that was never a format) —
+    // opens nothing, so it should not stay in the address bar to be copied
+    // and shared on. Checked against the whole album, not `displayedAssets`:
+    // a real photo that the "selected only" filter hides is still a valid link.
+    if (token !== null && !assets.some((a) => a.id === token)) {
+      window.history.replaceState(
+        null,
+        '',
+        window.location.pathname +
+          buildPhotoQuery(window.location.search, null) +
+          window.location.hash,
+      );
+    }
     const idx = parsePhotoHash(window.location.hash);
     if (idx !== null && idx < displayedAssets.length) {
       setLightboxIndex(idx);
     }
-  }, [displayedAssets]);
+  }, [assets, displayedAssets]);
 
   // ── Sync the URL's `photo` param when the lightbox state changes ──
   useEffect(() => {
@@ -211,25 +236,31 @@ function PhotoGridInner({
 
   // Keyboard navigation and the scroll lock live in <Lightbox/>.
 
+  // A work's catalogue number on the wall label is its place in the album,
+  // not in the current view: the "selected only" filter must not renumber it.
+  const albumPosition = useMemo(() => new Map(assets.map((a, i) => [a.id, i + 1])), [assets]);
+
   const gridItems = useMemo(() => {
     return displayedAssets.map((asset, index) => {
       const isFav = proofing ? proofing.isFavorite(asset.id) : false;
+      // A focal length alone is not a label, as before.
+      const exifLine =
+        asset.camera || asset.lens
+          ? [asset.camera, asset.lens, asset.focalLength].filter(Boolean).join(' · ')
+          : '';
 
       // Justified rows: the flex sizing must sit on the outermost grid child,
       // which is the FadeIn wrapper — not the .photo-grid__item inside it.
-      // Aspect ratio drives both grow factor and basis; ~3:2 fallback for
-      // assets without dimensions (e.g. videos) keeps the row math sane.
-      const justifiedAr = asset.aspectRatio || 1.5;
       const justifiedStyle: React.CSSProperties | undefined =
-        layout === 'justified'
-          ? {
-              flexGrow: justifiedAr,
-              flexBasis: `calc(var(--grid-row-height, 300px) * ${justifiedAr})`,
-            }
-          : undefined;
+        layout === 'justified' ? justifiedTileStyle(asset.aspectRatio) : undefined;
 
       return (
-        <FadeIn key={asset.id} delay={index < 12 ? index * 50 : 0} style={justifiedStyle}>
+        <FadeIn
+          key={asset.id}
+          as="figure"
+          delay={index < 12 ? index * 50 : 0}
+          style={justifiedStyle}
+        >
           <div
             className={`photo-grid__item${
               layout === 'showcase' && index === 0 ? ' photo-grid__featured' : ''
@@ -247,23 +278,30 @@ function PhotoGridInner({
             aria-label={t.lightbox.openPhoto(index + 1)}
             aria-haspopup="dialog"
             style={{
-              ...(asset.dominantColor ? { backgroundColor: asset.dominantColor } : {}),
               ...((layout === 'masonry' || layout === 'showcase') && asset.aspectRatio
                 ? { aspectRatio: `${asset.aspectRatio}` }
                 : {}),
               position: 'relative',
             }}
           >
-            <Image
-              src={asset.thumbUrl}
-              alt={asset.caption ?? ''}
-              fill
-              sizes="(max-width: 600px) 50vw, (max-width: 1000px) 33vw, 25vw"
-              loading={index < 6 ? 'eager' : 'lazy'}
-              {...(asset.blurDataURL
-                ? { placeholder: 'blur' as const, blurDataURL: asset.blurDataURL }
-                : {})}
-            />
+            {/* The photo's own box. Without a frame it covers the whole tile;
+                under passepartout globals.css insets it by the mat, so `fill`
+                and the placeholder colour stay on the photo, not on the mat. */}
+            <div
+              className="photo-grid__media"
+              style={asset.dominantColor ? { backgroundColor: asset.dominantColor } : undefined}
+            >
+              <Image
+                src={asset.thumbUrl}
+                alt={asset.caption ?? ''}
+                fill
+                sizes="(max-width: 600px) 50vw, (max-width: 1000px) 33vw, 25vw"
+                loading={index < 6 ? 'eager' : 'lazy'}
+                {...(asset.blurDataURL
+                  ? { placeholder: 'blur' as const, blurDataURL: asset.blurDataURL }
+                  : {})}
+              />
+            </div>
 
             {proofing && (
               <button
@@ -288,7 +326,7 @@ function PhotoGridInner({
                   background: 'none',
                   border: 'none',
                   cursor: 'pointer',
-                  color: isFav ? '#ff4d4f' : 'rgba(255,255,255,0.85)',
+                  color: isFav ? 'var(--lightbox-fav)' : 'rgba(255,255,255,0.85)',
                   filter: 'drop-shadow(0 2px 4px rgba(0,0,0,0.6))',
                   padding: 0,
                 }}
@@ -314,16 +352,35 @@ function PhotoGridInner({
                 </svg>
               </div>
             )}
-            {(asset.camera || asset.lens) && (
+            {exifLine && (
               <div className="photo-grid__item-exif" aria-hidden="true">
-                {[asset.camera, asset.lens, asset.focalLength].filter(Boolean).join(' · ')}
+                {exifLine}
               </div>
             )}
           </div>
+
+          {/* The wall label under the photo, outside the tile and its clip.
+              globals.css hides it; a preset that hangs its photos as works
+              (kunsthalle) shows it. It carries only what the site already
+              publishes for the photo: its number, the caption that is the
+              image's alt text (absent unless the `caption` EXIF group is on),
+              and the EXIF line. The number and EXIF repeat the tile's own
+              label and the lightbox, so they stay out of the figure's name. */}
+          <figcaption className="photo-grid__label">
+            <span className="photo-grid__label-no" aria-hidden="true">
+              {pad2(albumPosition.get(asset.id) ?? index + 1)}
+            </span>
+            {asset.caption && <span className="photo-grid__label-title">{asset.caption}</span>}
+            {exifLine && (
+              <span className="photo-grid__label-exif" aria-hidden="true">
+                {exifLine}
+              </span>
+            )}
+          </figcaption>
         </FadeIn>
       );
     });
-  }, [displayedAssets, layout, openLightbox, proofing, t]);
+  }, [albumPosition, displayedAssets, layout, openLightbox, proofing, t]);
 
   // Photos of this album that are selected. Not `favorites.size`: the stored set
   // can also hold a photo since removed, or a favourite from another album whose
@@ -368,7 +425,7 @@ function PhotoGridInner({
             alignItems: 'center',
             gap: '12px',
             padding: '8px 16px',
-            borderRadius: '30px',
+            borderRadius: 'var(--radius-lg)',
             background: 'var(--bg-card, #1e1e1e)',
             color: 'var(--text-primary, #ffffff)',
             border: '1px solid var(--border-subtle, rgba(255,255,255,0.15))',
@@ -386,7 +443,7 @@ function PhotoGridInner({
               color: proofing.isFilterActive ? 'var(--on-accent, #fff)' : 'var(--text-primary)',
               border: 'none',
               padding: '6px 14px',
-              borderRadius: '20px',
+              borderRadius: 'var(--radius-md)',
               fontSize: '0.85rem',
               fontWeight: 500,
               cursor: 'pointer',
diff --git a/app/[...path]/SubpageGridView.tsx b/app/[...path]/SubpageGridView.tsx
index 788ca65..0489e2d 100644
--- a/app/[...path]/SubpageGridView.tsx
+++ b/app/[...path]/SubpageGridView.tsx
@@ -1,6 +1,6 @@
 import Link from 'next/link';
 import Image from 'next/image';
-import { imageUrl } from '@/lib/urls';
+import { imageUrl, type ImageRef } from '@/lib/urls';
 import { SubpageSectionConfig } from '@/lib/config';
 import { getServerDictionary } from '@/lib/i18n/server';
 import { BackLink } from '@/components/BackLink';
@@ -11,6 +11,8 @@ interface SubpageAlbum {
   albumName: string;
   assetCount: number;
   albumThumbnailAssetId: string | null;
+  /** The cover asset as Immich has it, so an edited cover gets its edit marker (#831). */
+  cover?: ImageRef;
   /** EXPERIMENTAL: focal point for the cover crop (CSS object-position) */
   coverPosition?: string;
 }
@@ -73,7 +75,7 @@ function AlbumGrid({
             >
               {album.albumThumbnailAssetId ? (
                 <Image
-                  src={imageUrl(album.albumThumbnailAssetId, 'preview')}
+                  src={imageUrl(album.cover ?? album.albumThumbnailAssetId, 'preview')}
                   alt=""
                   fill
                   sizes="(max-width: 600px) 100vw, (max-width: 1000px) 50vw, 33vw"
diff --git a/app/[...path]/__tests__/not-found-status.test.ts b/app/[...path]/__tests__/not-found-status.test.ts
new file mode 100644
index 0000000..aecec17
--- /dev/null
+++ b/app/[...path]/__tests__/not-found-status.test.ts
@@ -0,0 +1,181 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { Suspense, isValidElement, type ReactElement } from 'react';
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * Next sends the status with the first byte, and the first byte goes out as
+ * soon as a Suspense fallback renders. The catch-all used to sit inside
+ * loading.tsx boundaries (app/ and app/[...path]/), so its skeleton streamed
+ * as a 200 before the page could call notFound(): `/nope`, an offline subpage,
+ * a draft content page and `/<subpage>/<unknown>` were all soft 404s — the
+ * not-found page with a 200.
+ *
+ * The page now decides whether the path exists before it renders a boundary,
+ * and only then streams the skeleton around the part that fetches photos.
+ */
+
+const NOT_FOUND = new Error('NEXT_NOT_FOUND');
+
+vi.mock('next/navigation', () => ({
+  notFound: () => {
+    throw NOT_FOUND;
+  },
+}));
+vi.mock('next/headers', () => ({
+  cookies: async () => ({ get: () => undefined }),
+}));
+
+const admin = vi.hoisted(() => ({ signedIn: false }));
+vi.mock('@/lib/admin/auth', () => ({ isAdminAuthenticated: async () => admin.signedIn }));
+vi.mock('@/lib/i18n/server', async () => {
+  const { getDictionary } = await import('@/lib/i18n');
+  return { getServerDictionary: () => getDictionary('en') };
+});
+
+const locked = vi.hoisted(() => ({ keys: new Set<string>() }));
+vi.mock('@/lib/auth', () => ({
+  isProtected: (key: string) => locked.keys.has(key),
+  isAuthenticated: () => false,
+  withoutLockedAlbums: <T>(albums: T[]) => albums,
+}));
+
+const pages = vi.hoisted(() => ({
+  access: new Map<string, 'open' | 'draft' | 'locked'>(),
+}));
+vi.mock('../contentPage', () => ({
+  contentPageAccess: vi.fn(async (slug: string) => pages.access.get(slug) ?? null),
+  contentPageMetadata: vi.fn(async () => null),
+  renderContentPage: vi.fn(async () => null),
+}));
+
+const ICELAND = {
+  id: 'album-1',
+  albumName: 'Iceland',
+  slug: 'iceland',
+  assets: [],
+  albumThumbnailAssetId: null,
+};
+
+const immich = vi.hoisted(() => ({
+  isSubpageSlug: vi.fn(),
+  getSubpageAlbums: vi.fn(),
+  findAlbumBySlug: vi.fn(),
+  getAlbumBySlug: vi.fn(),
+  getStandaloneAlbums: vi.fn(async () => []),
+  getSubpages: vi.fn(async () => []),
+  getAssetInfo: vi.fn(async () => null),
+}));
+vi.mock('@/lib/immich', () => ({ immich }));
+
+import PathPage from '../page';
+import { PathSkeleton } from '../PathSkeleton';
+
+const call = (segments: string[]) => ({
+  params: Promise.resolve({ path: segments }),
+  searchParams: Promise.resolve({}),
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  admin.signedIn = false;
+  locked.keys.clear();
+  pages.access = new Map([
+    ['about-us', 'open'],
+    ['pricing', 'draft'],
+    ['members', 'locked'],
+  ]);
+  // `dubai` is `enabled: false`: isSubpageSlug() and every lookup skip it.
+  immich.isSubpageSlug.mockImplementation((slug: string) =>
+    ['travel', 'vault', 'empty'].includes(slug),
+  );
+  immich.getSubpageAlbums.mockImplementation(async (slug: string) => {
+    if (slug === 'empty') return { subpage: { slug, name: 'Empty', albumIds: [] }, albums: [] };
+    if (slug === 'travel' || slug === 'vault') {
+      return { subpage: { slug, name: slug, albumIds: ['album-1'] }, albums: [ICELAND] };
+    }
+    return null;
+  });
+  immich.findAlbumBySlug.mockImplementation(async (slug: string, subpage?: string) =>
+    slug === 'iceland' && (subpage === undefined || subpage === 'travel' || subpage === 'vault')
+      ? ICELAND
+      : null,
+  );
+  immich.getAlbumBySlug.mockResolvedValue(ICELAND);
+});
+
+describe('catch-all not-found status', () => {
+  it.each([
+    ['an unknown slug', ['nope']],
+    ['a long made-up slug', ['this-is-a-long-made-up-slug-that-names-nothing-at-all-0123456789']],
+    ['a disabled subpage', ['dubai']],
+    ['a draft content page', ['pricing']],
+    ['a subpage without published albums', ['empty']],
+    ['an unknown album under a real subpage', ['travel', 'nope']],
+    ['an album under a disabled subpage', ['dubai', 'iceland']],
+    ['a three-segment path', ['x', 'y', 'z']],
+  ])('calls notFound() for %s before anything can stream', async (_, segments) => {
+    await expect(PathPage(call(segments))).rejects.toBe(NOT_FOUND);
+    // No photo was fetched: the decision came from the album list alone.
+    expect(immich.getAlbumBySlug).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ['a subpage', ['travel']],
+    ['an album under a subpage', ['travel', 'iceland']],
+    ['a standalone album', ['iceland']],
+    ['a content page', ['about-us']],
+    ['a locked content page (its gate renders)', ['members']],
+  ])('streams %s behind the skeleton, deciding first', async (_, segments) => {
+    const element = (await PathPage(call(segments))) as ReactElement<{ fallback: ReactElement }>;
+
+    expect(isValidElement(element)).toBe(true);
+    expect(element.type).toBe(Suspense);
+    expect(element.props.fallback.type).toBe(PathSkeleton);
+    // The asset fetch — the slow part — happens inside the boundary.
+    expect(immich.getAlbumBySlug).not.toHaveBeenCalled();
+  });
+
+  it('does not tell a visitor without the password which albums a locked subpage holds', async () => {
+    locked.keys.add('vault');
+
+    const known = await PathPage(call(['vault', 'iceland']));
+    const unknown = await PathPage(call(['vault', 'no-such-album']));
+
+    expect((known as ReactElement).type).toBe(Suspense);
+    expect((unknown as ReactElement).type).toBe(Suspense);
+    expect(immich.findAlbumBySlug).not.toHaveBeenCalled();
+  });
+
+  it('lets a locked subpage show its gate even before its albums are known', async () => {
+    locked.keys.add('empty');
+    const element = await PathPage(call(['empty']));
+    expect((element as ReactElement).type).toBe(Suspense);
+  });
+
+  it('leaves a signed-in admin the diagnostic banner instead of the 404', async () => {
+    admin.signedIn = true;
+    const element = await PathPage(call(['nope']));
+    expect((element as ReactElement).type).toBe(Suspense);
+    // ...but never for a path deeper than the catch-all serves.
+    await expect(PathPage(call(['x', 'y', 'z']))).rejects.toBe(NOT_FOUND);
+  });
+
+  it('surfaces an Immich outage as an error, never as a missing album', async () => {
+    const outage = new Error('Immich unavailable');
+    immich.findAlbumBySlug.mockRejectedValue(outage);
+
+    await expect(PathPage(call(['iceland']))).rejects.toBe(outage);
+    await expect(PathPage(call(['travel', 'iceland']))).rejects.toBe(outage);
+  });
+
+  it('has no loading.tsx above it, which would stream the 200 first', () => {
+    // A loading file wraps every route below its folder in a Suspense
+    // boundary, and nothing the page does inside one can change the status.
+    const appDir = path.join(process.cwd(), 'app');
+    for (const dir of [appDir, path.join(appDir, '[...path]')]) {
+      const loading = fs.readdirSync(dir).filter((name) => /^loading\.(t|j)sx?$/.test(name));
+      expect(loading, dir).toEqual([]);
+    }
+  });
+});
diff --git a/app/[...path]/__tests__/path-depth.test.ts b/app/[...path]/__tests__/path-depth.test.ts
index dfcf11e..669adf6 100644
--- a/app/[...path]/__tests__/path-depth.test.ts
+++ b/app/[...path]/__tests__/path-depth.test.ts
@@ -1,4 +1,5 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ReactElement } from 'react';
 
 /**
  * The catch-all answers one segment (subpage, content page, standalone album)
@@ -24,6 +25,7 @@ const immich = vi.hoisted(() => ({
   isSubpageSlug: vi.fn((slug: string) => slug === 'travel'),
   getSubpageAlbums: vi.fn(),
   getAlbumBySlug: vi.fn(),
+  findAlbumBySlug: vi.fn(),
   getStandaloneAlbums: vi.fn(async () => []),
   getSubpages: vi.fn(async () => []),
   getAssetInfo: vi.fn(async () => null),
@@ -49,6 +51,7 @@ const call = (path: string[]) => ({
 beforeEach(() => {
   vi.clearAllMocks();
   immich.getAlbumBySlug.mockResolvedValue(ALBUM);
+  immich.findAlbumBySlug.mockResolvedValue(ALBUM);
   immich.getSubpageAlbums.mockResolvedValue({
     subpage: { slug: 'travel', name: 'Travel', albumIds: ['album-1', 'album-2'] },
     albums: [ALBUM, { ...ALBUM, id: 'album-2', slug: 'norway', albumName: 'Norway' }],
@@ -61,6 +64,7 @@ describe('catch-all path depth', () => {
     async (path) => {
       await expect(PathPage(call(path))).rejects.toBe(NOT_FOUND);
       expect(immich.getAlbumBySlug).not.toHaveBeenCalled();
+      expect(immich.findAlbumBySlug).not.toHaveBeenCalled();
       expect(immich.getSubpageAlbums).not.toHaveBeenCalled();
     },
   );
@@ -72,7 +76,13 @@ describe('catch-all path depth', () => {
   });
 
   it('still renders one and two segments', async () => {
-    await expect(PathPage(call(['iceland']))).resolves.toBeTruthy();
-    await expect(PathPage(call(['travel', 'iceland']))).resolves.toBeTruthy();
+    for (const path of [['iceland'], ['travel', 'iceland']]) {
+      // The page decides, then hands the rendering to the content inside its
+      // Suspense boundary; run that too.
+      const shell = (await PathPage(call(path))) as ReactElement<{ children: ReactElement }>;
+      const content = shell.props.children as ReactElement<object>;
+      const render = content.type as (props: object) => Promise<unknown>;
+      await expect(render(content.props)).resolves.toBeTruthy();
+    }
   });
 });
diff --git a/app/[...path]/__tests__/photo-deeplink-invalid.test.tsx b/app/[...path]/__tests__/photo-deeplink-invalid.test.tsx
new file mode 100644
index 0000000..0d353dc
--- /dev/null
+++ b/app/[...path]/__tests__/photo-deeplink-invalid.test.tsx
@@ -0,0 +1,73 @@
+// @vitest-environment jsdom
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { render, screen, cleanup } from '@testing-library/react';
+import { PhotoGrid, type PhotoItem } from '../PhotoGrid';
+
+/**
+ * A `?photo=` that names no photo in the album opened nothing and stayed in
+ * the address bar, to be copied and shared on (P-16). It is removed now; a
+ * valid deep link still opens its photo.
+ */
+
+vi.mock('next/image', () => ({
+  // eslint-disable-next-line @next/next/no-img-element
+  default: ({ alt }: { alt?: string }) => <img alt={alt ?? ''} />,
+}));
+vi.mock('@/components/FadeIn', () => ({
+  FadeIn: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+}));
+
+const photo = (id: string): PhotoItem => ({
+  id,
+  type: 'image',
+  thumbUrl: `/t/${id}`,
+  previewUrl: `/p/${id}`,
+  exifUrl: `/e/${id}`,
+  aspectRatio: 1.5,
+});
+
+const ASSETS = [photo('a1'), photo('a2'), photo('a3')];
+
+beforeEach(() => {
+  const store = new Map<string, string>();
+  vi.stubGlobal('localStorage', {
+    getItem: (k: string) => store.get(k) ?? null,
+    setItem: (k: string, v: string) => void store.set(k, String(v)),
+    removeItem: (k: string) => void store.delete(k),
+  });
+});
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+describe('?photo= on load', () => {
+  it('opens the photo a valid token names', () => {
+    window.history.replaceState(null, '', '/wedding?photo=a2');
+    render(<PhotoGrid assets={ASSETS} albumName="Wedding" />);
+    expect(screen.getByRole('dialog')).toBeTruthy();
+    expect(window.location.search).toBe('?photo=a2');
+  });
+
+  it('drops a token that names no photo, keeping other parameters', () => {
+    window.history.replaceState(null, '', '/wedding?preview=true&photo=bogus');
+    render(<PhotoGrid assets={ASSETS} albumName="Wedding" />);
+    expect(screen.queryByRole('dialog')).toBeNull();
+    expect(window.location.pathname + window.location.search).toBe('/wedding?preview=true');
+  });
+
+  it('drops a position-style ?photo=5, which was never a format', () => {
+    window.history.replaceState(null, '', '/wedding?photo=5');
+    render(<PhotoGrid assets={ASSETS} albumName="Wedding" />);
+    expect(screen.queryByRole('dialog')).toBeNull();
+    expect(window.location.search).toBe('');
+  });
+
+  it('still honours a legacy #photo-N hash next to a bad token', () => {
+    window.history.replaceState(null, '', '/wedding?photo=bogus#photo-3');
+    render(<PhotoGrid assets={ASSETS} albumName="Wedding" />);
+    expect(screen.getByRole('dialog')).toBeTruthy();
+    expect(new URLSearchParams(window.location.search).get('photo')).toBe('a3');
+  });
+});
diff --git a/app/[...path]/__tests__/photo-wall-label.test.tsx b/app/[...path]/__tests__/photo-wall-label.test.tsx
new file mode 100644
index 0000000..a8008c6
--- /dev/null
+++ b/app/[...path]/__tests__/photo-wall-label.test.tsx
@@ -0,0 +1,126 @@
+// @vitest-environment jsdom
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { render, screen, cleanup, fireEvent } from '@testing-library/react';
+import { PhotoGrid, type PhotoItem } from '../PhotoGrid';
+
+/**
+ * Kunsthalle's wall label was the EXIF overlay with a CSS-counter number in
+ * front of it, so a photo without camera or lens got no label and no number.
+ * Each photo is now a <figure> with a figcaption that always carries its
+ * number; globals.css hides it outside the presets that show it.
+ */
+
+vi.mock('next/image', () => ({
+  // eslint-disable-next-line @next/next/no-img-element
+  default: ({ alt }: { alt?: string }) => <img alt={alt ?? ''} />,
+}));
+vi.mock('@/components/FadeIn', () => ({
+  FadeIn: ({
+    children,
+    as: Wrapper = 'div',
+  }: {
+    children: React.ReactNode;
+    as?: 'div' | 'figure';
+  }) => <Wrapper>{children}</Wrapper>,
+}));
+
+const photo = (id: string, extra: Partial<PhotoItem> = {}): PhotoItem => ({
+  id,
+  type: 'image',
+  thumbUrl: `/t/${id}`,
+  previewUrl: `/p/${id}`,
+  exifUrl: `/e/${id}`,
+  aspectRatio: 1.5,
+  ...extra,
+});
+
+const ASSETS = [
+  photo('a1', { camera: 'Leica M11', lens: 'Summicron 35', focalLength: '35mm' }),
+  photo('a2'),
+  photo('a3', { caption: 'Cloister at dusk' }),
+  photo('a4', { focalLength: '50mm' }),
+];
+
+let store: Map<string, string>;
+
+beforeEach(() => {
+  store = new Map<string, string>();
+  vi.stubGlobal('localStorage', {
+    getItem: (k: string) => store.get(k) ?? null,
+    setItem: (k: string, v: string) => void store.set(k, String(v)),
+    removeItem: (k: string) => void store.delete(k),
+    clear: () => store.clear(),
+  });
+  window.history.replaceState(null, '', '/kloster');
+});
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+const labels = (container: HTMLElement) =>
+  [...container.querySelectorAll('figure > figcaption.photo-grid__label')] as HTMLElement[];
+
+describe('photo wall label', () => {
+  it('numbers every photo, with or without EXIF', () => {
+    const { container } = render(<PhotoGrid assets={ASSETS} />);
+    const numbers = labels(container).map(
+      (l) => l.querySelector('.photo-grid__label-no')?.textContent,
+    );
+    expect(numbers).toEqual(['01', '02', '03', '04']);
+  });
+
+  it('sits next to the tile, not inside its clipped box', () => {
+    const { container } = render(<PhotoGrid assets={ASSETS} />);
+    for (const label of labels(container)) {
+      expect(label.closest('.photo-grid__item')).toBeNull();
+      expect(label.previousElementSibling?.classList.contains('photo-grid__item')).toBe(true);
+    }
+  });
+
+  it('carries the caption only where one is published, and names the figure with it', () => {
+    const { container } = render(<PhotoGrid assets={ASSETS} />);
+    const titles = labels(container).map(
+      (l) => l.querySelector('.photo-grid__label-title')?.textContent ?? null,
+    );
+    expect(titles).toEqual([null, null, 'Cloister at dusk', null]);
+    // The same text the photo already publishes as its alt text.
+    expect(container.querySelector('img[alt="Cloister at dusk"]')).not.toBeNull();
+    // What assistive tech reads off the label (the figure's name, by HTML-AAM)
+    // is the caption alone.
+    const spoken = (l: HTMLElement) =>
+      [...l.children]
+        .filter((c) => c.getAttribute('aria-hidden') !== 'true')
+        .map((c) => c.textContent)
+        .join('');
+    expect(labels(container).map(spoken)).toEqual(['', '', 'Cloister at dusk', '']);
+  });
+
+  it('prints the EXIF line only for a camera or lens, as the tile does', () => {
+    const { container } = render(<PhotoGrid assets={ASSETS} />);
+    const exif = labels(container).map(
+      (l) => l.querySelector('.photo-grid__label-exif')?.textContent ?? null,
+    );
+    expect(exif).toEqual(['Leica M11 · Summicron 35 · 35mm', null, null, null]);
+  });
+
+  it('keeps the number and EXIF, which repeat the tile and lightbox, out of the figure name', () => {
+    const { container } = render(<PhotoGrid assets={ASSETS} />);
+    const [first] = labels(container);
+    expect(first.querySelector('.photo-grid__label-no')?.getAttribute('aria-hidden')).toBe('true');
+    expect(first.querySelector('.photo-grid__label-exif')?.getAttribute('aria-hidden')).toBe(
+      'true',
+    );
+  });
+
+  it('keeps a photo’s album number when the favourites filter hides the others', async () => {
+    store.set('folio_fav_kloster', JSON.stringify(['a3']));
+    const { container } = render(<PhotoGrid assets={ASSETS} proofing albumName="Kloster" />);
+    fireEvent.click(await screen.findByText('❤️ 1 Selected'));
+    const numbers = labels(container).map(
+      (l) => l.querySelector('.photo-grid__label-no')?.textContent,
+    );
+    expect(numbers).toEqual(['03']);
+  });
+});
diff --git a/app/[...path]/__tests__/photoItems-edited.test.ts b/app/[...path]/__tests__/photoItems-edited.test.ts
new file mode 100644
index 0000000..f7bd4d7
--- /dev/null
+++ b/app/[...path]/__tests__/photoItems-edited.test.ts
@@ -0,0 +1,65 @@
+import { describe, it, expect, vi } from 'vitest';
+import type { ImmichAsset } from '@/lib/immich';
+
+/**
+ * #831: a photo edited in Immich (crop, rotate) reaches the grid, the
+ * lightbox and the zoom as edited — an image URL with the edit marker, the
+ * edited proportions, and the edited full-size rendition behind the zoom.
+ */
+
+vi.mock('@/lib/config', () => ({
+  getConfig: () => ({ authSecret: 'test-auth-secret-32-chars-long-min' }),
+  getConfigOrNull: () => null,
+}));
+
+const { toPhotoItems } = await import('../photoItems');
+
+const exif = (w: number, h: number, orientation: string | null = null) =>
+  ({ exifImageWidth: w, exifImageHeight: h, orientation }) as ImmichAsset['exifInfo'];
+
+const asset = (over: Partial<ImmichAsset>): ImmichAsset => ({
+  id: '11111111-1111-1111-1111-111111111111',
+  type: 'IMAGE',
+  originalFileName: 'scan.jpg',
+  originalMimeType: 'image/jpeg',
+  thumbhash: null,
+  fileCreatedAt: '2020-07-24T11:13:27.000Z',
+  isTrashed: false,
+  ...over,
+});
+
+const ALBUM = '22222222-2222-2222-2222-222222222222';
+
+describe('toPhotoItems for photos edited in Immich (#831)', () => {
+  // Measured on Immich 3.2: a scan stored 1076×723, rotated 270° in Immich.
+  const rotated = asset({
+    isEdited: true,
+    updatedAt: '2026-09-04T19:22:09.220Z',
+    width: 723,
+    height: 1076,
+    exifInfo: exif(1076, 723),
+  });
+
+  it('marks the edited photo’s URLs and gives it the edited proportions', () => {
+    const [item] = toPhotoItems([rotated], false, false);
+    expect(item.thumbUrl).toMatch(/[?&]e=[0-9a-z]+(&|$)/);
+    expect(item.previewUrl).toBe(item.thumbUrl);
+    expect(item.aspectRatio).toBeCloseTo(723 / 1076);
+  });
+
+  it('leaves a photo that is not edited exactly as it was', () => {
+    const [item] = toPhotoItems(
+      [asset({ width: 1076, height: 723, exifInfo: exif(1076, 723) })],
+      false,
+      false,
+    );
+    expect(item.thumbUrl).toMatch(/\?size=preview$/);
+    expect(item.aspectRatio).toBeCloseTo(1076 / 723);
+  });
+
+  it('offers zoom at the edited size', () => {
+    const [item] = toPhotoItems([rotated], false, false, undefined, ALBUM);
+    expect(item.zoomUrl).toMatch(/^\/api\/zoom\//);
+    expect([item.zoomWidth, item.zoomHeight]).toEqual([723, 1076]);
+  });
+});
diff --git a/app/[...path]/__tests__/subpage-metadata.test.ts b/app/[...path]/__tests__/subpage-metadata.test.ts
new file mode 100644
index 0000000..e1310ec
--- /dev/null
+++ b/app/[...path]/__tests__/subpage-metadata.test.ts
@@ -0,0 +1,123 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+/**
+ * Two gaps in a subpage's `<head>`:
+ *
+ * - A `hidden: true` subpage is reachable by link only — off the nav, the
+ *   home page and the sitemap — yet it and its albums inherited the layout's
+ *   `index, follow`, so a crawler that found the link indexed it anyway.
+ * - A subpage with more than one album had no description of its own and fell
+ *   back to the site-wide one; an album page describes itself by its photo
+ *   count.
+ */
+
+vi.mock('next/headers', () => ({
+  cookies: async () => ({ get: () => undefined }),
+}));
+vi.mock('@/lib/admin/auth', () => ({ isAdminAuthenticated: async () => false }));
+vi.mock('@/lib/i18n/server', async () => {
+  const { getDictionary } = await import('@/lib/i18n');
+  return { getServerDictionary: () => getDictionary('en') };
+});
+vi.mock('@/lib/ogImage', () => ({ ogImageUrl: () => '/api/og?sig=x' }));
+vi.mock('../contentPage', () => ({
+  contentPageAccess: vi.fn(async () => null),
+  contentPageMetadata: vi.fn(async () => null),
+  renderContentPage: vi.fn(async () => null),
+}));
+vi.mock('@/lib/auth', () => ({
+  isProtected: () => false,
+  isAuthenticated: () => false,
+  withoutLockedAlbums: <T>(albums: T[]) => albums,
+}));
+
+const config = vi.hoisted(() => ({
+  subpages: [] as { slug: string; hidden?: boolean }[],
+  seo: { noFollow: false },
+}));
+vi.mock('@/lib/config', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/lib/config')>();
+  return { ...actual, getConfig: () => config };
+});
+
+const album = (id: string, name: string) => ({
+  id,
+  albumName: name,
+  slug: name.toLowerCase(),
+  assets: [{ id: `${id}-a`, type: 'IMAGE' }],
+  albumThumbnailAssetId: null,
+});
+const ICELAND = album('album-1', 'Iceland');
+const NORWAY = album('album-2', 'Norway');
+
+const subpages: Record<string, { subtitle?: string; albums: ReturnType<typeof album>[] }> = {
+  travel: { albums: [ICELAND, NORWAY] },
+  trips: { subtitle: 'Where the road went', albums: [ICELAND, NORWAY] },
+  private: { albums: [ICELAND, NORWAY] },
+  handover: { albums: [ICELAND] },
+};
+
+const immich = vi.hoisted(() => ({
+  isSubpageSlug: vi.fn(),
+  getSubpageAlbums: vi.fn(),
+  getAlbumBySlug: vi.fn(),
+}));
+vi.mock('@/lib/immich', () => ({ immich }));
+
+import { generateMetadata } from '../page';
+
+const meta = (path: string[]) =>
+  generateMetadata({ params: Promise.resolve({ path }), searchParams: Promise.resolve({}) });
+
+beforeEach(() => {
+  config.subpages = [
+    { slug: 'travel' },
+    { slug: 'trips' },
+    { slug: 'private', hidden: true },
+    { slug: 'handover', hidden: true },
+  ];
+  config.seo.noFollow = false;
+  immich.isSubpageSlug.mockImplementation((slug: string) => slug in subpages);
+  immich.getSubpageAlbums.mockImplementation(async (slug: string) => {
+    const sp = subpages[slug];
+    return sp ? { subpage: { slug, name: slug, subtitle: sp.subtitle }, albums: sp.albums } : null;
+  });
+  immich.getAlbumBySlug.mockImplementation(
+    async (slug: string) => [ICELAND, NORWAY].find((a) => a.slug === slug) ?? null,
+  );
+});
+
+describe('hidden subpages stay out of search results', () => {
+  it.each([
+    ['a hidden multi-album subpage', ['private']],
+    ['a hidden single-album subpage', ['handover']],
+    ['an album below a hidden subpage', ['private', 'iceland']],
+  ])('marks %s noindex', async (_, path) => {
+    const m = await meta(path);
+    expect(m.robots).toEqual({ index: false, follow: true });
+  });
+
+  it('keeps the site-wide nofollow on a hidden subpage', async () => {
+    config.seo.noFollow = true;
+    expect((await meta(['private'])).robots).toEqual({ index: false, follow: false });
+  });
+
+  it('leaves a visible subpage, its albums and standalone albums to the layout', async () => {
+    expect((await meta(['travel'])).robots).toBeUndefined();
+    expect((await meta(['travel', 'iceland'])).robots).toBeUndefined();
+    expect((await meta(['iceland'])).robots).toBeUndefined();
+  });
+});
+
+describe('multi-album subpage description', () => {
+  it('describes the subpage by its album count when it has no subtitle', async () => {
+    const m = await meta(['travel']);
+    expect(m.description).toBe('travel — 2 albums');
+    expect(m.openGraph?.description).toBe('travel — 2 albums');
+  });
+
+  it('prefers the subtitle when there is one', async () => {
+    const m = await meta(['trips']);
+    expect(m.description).toBe('Where the road went');
+  });
+});
diff --git a/app/[...path]/contentPage.tsx b/app/[...path]/contentPage.tsx
index 6f158c7..14c5670 100644
--- a/app/[...path]/contentPage.tsx
+++ b/app/[...path]/contentPage.tsx
@@ -20,7 +20,7 @@ import PasswordGate from '@/components/PasswordGate';
 import { EssayView } from './EssayView';
 import { buildEssayPayload } from './essayPayload';
 
-type Access = 'open' | 'draft' | 'locked';
+export type Access = 'open' | 'draft' | 'locked';
 
 async function accessFor(page: PageRecord): Promise<Access> {
   const { draft, password } = page.parsed.frontmatter;
@@ -34,6 +34,16 @@ async function accessFor(page: PageRecord): Promise<Access> {
   return 'open';
 }
 
+/**
+ * How this request may see the page `slug`, or null when there is none. Read
+ * by routeExists() before the catch-all streams: a draft is a 404 to everyone
+ * but an admin, and that has to be known while the status can still say so.
+ */
+export async function contentPageAccess(slug: string): Promise<Access | null> {
+  const page = await readPage(slug).catch(() => null);
+  return page ? accessFor(page) : null;
+}
+
 /**
  * Metadata for `/<slug>` when it is a page, or null when it is not.
  *
diff --git a/app/[...path]/essayPayload.ts b/app/[...path]/essayPayload.ts
index a58dfed..9cb83e4 100644
--- a/app/[...path]/essayPayload.ts
+++ b/app/[...path]/essayPayload.ts
@@ -178,8 +178,8 @@ export async function buildEssayPayload(
       return {
         id: encodeAssetId(a.id),
         type: isVideo ? 'video' : 'image',
-        thumbUrl: imageUrl(a.id, 'preview'),
-        previewUrl: imageUrl(a.id, 'preview'),
+        thumbUrl: imageUrl(a, 'preview'),
+        previewUrl: imageUrl(a, 'preview'),
         ...(isVideo ? { videoUrl: videoUrl(a.id) } : {}),
         exifUrl: exifUrl(a.id),
         ...(ph ? { blurDataURL: ph.blurDataURL, dominantColor: ph.dominantColor } : {}),
diff --git a/app/[...path]/loading.tsx b/app/[...path]/loading.tsx
deleted file mode 100644
index 3d7c8db..0000000
--- a/app/[...path]/loading.tsx
+++ /dev/null
@@ -1,22 +0,0 @@
-/**
- * Instant shell for album and subpage routes. These are force-dynamic and wait
- * on a live Immich round-trip — up to IMMICH_TIMEOUT_MS when the server is
- * struggling — so without this the viewer stares at a blank page.
- */
-
-import styles from '../loading.module.css';
-import { getServerDictionary } from '@/lib/i18n/server';
-
-export default function Loading() {
-  const t = getServerDictionary();
-  return (
-    <>
-      <div className={styles.heading} aria-hidden="true" />
-      <div className={styles.grid} role="status" aria-label={t.common.loadingPhotos}>
-        {Array.from({ length: 9 }).map((_, i) => (
-          <div key={i} className={styles.tile} />
-        ))}
-      </div>
-    </>
-  );
-}
diff --git a/app/[...path]/page.tsx b/app/[...path]/page.tsx
index 9e20fb6..129e5ba 100644
--- a/app/[...path]/page.tsx
+++ b/app/[...path]/page.tsx
@@ -13,6 +13,7 @@
  * Three or more segments: 404.
  */
 
+import { Suspense } from 'react';
 import { cookies } from 'next/headers';
 import type { Metadata } from 'next';
 import { immich, type ImmichAsset } from '@/lib/immich';
@@ -28,6 +29,7 @@ import {
   hasExifPanelContent,
   normalizeSlug,
   resolveProofing,
+  resolveZoom,
   type GridConfig,
 } from '@/lib/config';
 import { isProtected, isAuthenticated, withoutLockedAlbums } from '@/lib/auth';
@@ -49,6 +51,8 @@ import { resolveEssayFile, generatedEssayCaption } from '@/lib/essaySource';
 import { getServerDictionary } from '@/lib/i18n/server';
 import { contentPageMetadata, renderContentPage } from './contentPage';
 import { loadAlbumBlocks } from './essayPayload';
+import { isLocked, routeExists } from './routeExists';
+import { PathSkeleton } from './PathSkeleton';
 
 // Render at request time — requires live Immich connection
 export const dynamic = 'force-dynamic';
@@ -58,20 +62,6 @@ interface PathPageProps {
   searchParams?: Promise<{ [key: string]: string | string[] | undefined }>;
 }
 
-/**
- * Whether `key` is password-protected and this request has not unlocked it.
- * generateMetadata runs unconditionally — unlike the page body, nothing
- * downstream of it stops a real title, photo count or cover image from
- * reaching an unauthenticated `<head>` unless this is checked first
- * (GHSA-fvgv-97g3-wjr7).
- */
-async function isLocked(key: string, type: 'subpage' | 'album'): Promise<boolean> {
-  if (!isProtected(key, type)) return false;
-  const cookieStore = await cookies();
-  const getCookie = (name: string) => cookieStore.get(name)?.value;
-  return !isAuthenticated(key, getCookie, type);
-}
-
 /**
  * Metadata for a path that names nothing this site publishes. The title is
  * the dictionary's, never the requested slug: generateMetadata runs for any
@@ -111,15 +101,17 @@ export async function generateMetadata({ params, searchParams }: PathPageProps):
   // Each branch follows the page body's order of gates and 404s, and takes
   // the title only from site-authored text (an album or subpage name). A
   // branch that finds nothing, or finds it locked, returns early, so the
-  // requested slug never becomes a title or share-card text.
+  // requested slug never becomes a title or share-card text. isLocked() comes
+  // first because generateMetadata runs unconditionally: nothing downstream
+  // stops a real title, photo count or cover image from reaching an
+  // unauthenticated `<head>` otherwise (GHSA-fvgv-97g3-wjr7).
   const slug = path[0];
+  const t = getServerDictionary();
   let title: string;
   let subtitle = '';
   let description: string | undefined = undefined;
   const photoCount = (assets: ImmichAsset[]) =>
-    getServerDictionary().common.photos(
-      assets.filter((a) => a.type === 'IMAGE' || a.type === 'VIDEO').length,
-    );
+    t.common.photos(assets.filter((a) => a.type === 'IMAGE' || a.type === 'VIDEO').length);
 
   if (path.length === 1 && immich.isSubpageSlug(slug)) {
     if (await isLocked(slug, 'subpage')) return lockedMetadata();
@@ -135,6 +127,9 @@ export async function generateMetadata({ params, searchParams }: PathPageProps):
       if (photoAssetId) photoAsset = album.assets.find((a) => a.id === photoAssetId);
     } else {
       title = result.subpage.title || result.subpage.name;
+      // A cover grid has no photo count to describe it by; without this it
+      // inherited the site-wide description.
+      description ??= `${title} — ${t.common.albums(result.albums.length)}`;
     }
   } else if (path.length === 2) {
     if (await isLocked(slug, 'subpage')) return lockedMetadata();
@@ -162,11 +157,19 @@ export async function generateMetadata({ params, searchParams }: PathPageProps):
     photoAsset?.exifInfo?.description?.trim() ||
     description ||
     (subtitle ? `${title} — ${subtitle}` : undefined);
-  const ogImage = photoAsset ? imageUrl(photoAsset.id, 'preview') : ogImageUrl(title, subtitle);
+  const ogImage = photoAsset ? imageUrl(photoAsset, 'preview') : ogImageUrl(title, subtitle);
+
+  // A hidden subpage is reachable by link only: out of the nav, the home page
+  // and the sitemap. Indexing it, or an album below it, would undo that.
+  const config = getConfig();
+  const hidden =
+    (path.length === 2 || immich.isSubpageSlug(slug)) &&
+    config.subpages.some((sp) => sp.slug === slug && sp.hidden === true);
 
   return {
     title,
     description: ogDescription,
+    ...(hidden ? { robots: { index: false, follow: !config.seo.noFollow } } : {}),
     openGraph: {
       title,
       description: ogDescription,
@@ -187,13 +190,22 @@ export async function generateMetadata({ params, searchParams }: PathPageProps):
  * claim without one (#472).
  */
 function structuredDataFor(
-  album: { albumName: string; description?: string; albumThumbnailAssetId?: string | null },
+  album: {
+    albumName: string;
+    description?: string;
+    albumThumbnailAssetId?: string | null;
+    assets?: ImmichAsset[];
+  },
   path: string,
   photoCount: number,
 ) {
   const config = getConfig();
-  const cover = album.albumThumbnailAssetId
-    ? absoluteUrl(config.siteUrl, imageUrl(album.albumThumbnailAssetId, 'preview'))
+  const coverId = album.albumThumbnailAssetId;
+  // The album's own copy of its cover, when it has one, so an edit made in
+  // Immich reaches the URL (#831).
+  const coverAsset = coverId ? album.assets?.find((a) => a.id === coverId) : undefined;
+  const cover = coverId
+    ? absoluteUrl(config.siteUrl, imageUrl(coverAsset ?? coverId, 'preview'))
     : null;
   return albumStructuredData({
     siteUrl: config.siteUrl,
@@ -241,12 +253,39 @@ async function getAlbumHeroData(
   const asset = await immich.getAssetInfo(heroAssetId);
   const ph = asset ? assetPlaceholder(asset) : null;
   return {
-    heroImageUrl: imageUrl(heroAssetId, 'preview'),
+    heroImageUrl: imageUrl(asset ?? heroAssetId, 'preview'),
     heroBlurDataURL: ph?.blurDataURL,
   };
 }
 
-export default async function PathPage({ params, searchParams }: PathPageProps) {
+/**
+ * Decides whether the path exists before anything streams, then renders the
+ * content behind the skeleton.
+ *
+ * The order is the point. Next sends the status with the first byte, and the
+ * first byte goes out as soon as a Suspense fallback renders. A notFound()
+ * thrown after that can only add a noindex tag to a 200 (a "soft 404"), which
+ * is what every unknown slug got while this page sat inside a loading.tsx
+ * boundary. routeExists() needs only the config and the album list the header
+ * nav already waited for, so the check costs no time; the album's photos, the
+ * slow part, still load behind the skeleton.
+ *
+ * PathContent keeps its own notFound() calls as the backstop for what the
+ * check cannot see, such as an album removed from Immich since the list was
+ * cached. Those are still soft.
+ */
+export default async function PathPage(props: PathPageProps) {
+  const { path: rawPath } = await props.params;
+  if (!(await routeExists(rawPath?.map(normalizeSlug)))) notFound();
+
+  return (
+    <Suspense fallback={<PathSkeleton />}>
+      <PathContent {...props} />
+    </Suspense>
+  );
+}
+
+async function PathContent({ params, searchParams }: PathPageProps) {
   // Next hands catch-all segments over percent-encoded, so a non-ASCII slug
   // ("/家族相册") would never match a stored one. Decode once, here, and every
   // comparison downstream works on the same form (#522).
@@ -299,6 +338,10 @@ export default async function PathPage({ params, searchParams }: PathPageProps)
   // reached without a subpage follow the global setting.
   const proofingFor = (subpage?: { proofing?: boolean }) =>
     resolveProofing(subpage, config.proofing.enabled);
+  // Lightbox zoom (#467): album, then the subpage it is shown on, then the
+  // site setting. The album id goes to toPhotoItems() when it resolves on.
+  const zoomAlbumFor = (albumId: string, subpage?: { zoom?: boolean }) =>
+    resolveZoom(config, albumId, subpage) ? albumId : undefined;
 
   // EXPERIMENTAL: per-album grid override — merged over the subpage grid so
   // the precedence is global < subpage < album.
@@ -352,6 +395,7 @@ export default async function PathPage({ params, searchParams }: PathPageProps)
       config.exif.onHover && config.exif.camera,
       config.exif.caption,
       config.albumDownloads[album.id] ? album.id : undefined,
+      zoomAlbumFor(album.id, subpageData?.subpage),
     );
 
     // Password gate for protected albums
@@ -575,6 +619,7 @@ export default async function PathPage({ params, searchParams }: PathPageProps)
         config.exif.onHover && config.exif.camera,
         config.exif.caption,
         config.albumDownloads[album.id] ? album.id : undefined,
+        zoomAlbumFor(album.id, result.subpage),
       );
 
       // Password gate for protected albums
@@ -619,14 +664,23 @@ export default async function PathPage({ params, searchParams }: PathPageProps)
       };
     });
 
-    // Batch-fetch ThumbHash for album cover placeholders
-    const coverPlaceholders = await Promise.all(
-      albumsWithHero.map(async (album) => {
-        if (!album.albumThumbnailAssetId) return null;
-        const asset = await immich.getAssetInfo(album.albumThumbnailAssetId);
-        return asset ? assetPlaceholder(asset) : null;
-      }),
+    // Batch-fetch the cover assets: ThumbHash for the placeholders, and
+    // whether the cover was edited in Immich, which its URL has to say (#831).
+    const coverAssets = await Promise.all(
+      albumsWithHero.map((album) =>
+        album.albumThumbnailAssetId ? immich.getAssetInfo(album.albumThumbnailAssetId) : null,
+      ),
     );
+    const coverPlaceholders = coverAssets.map((asset) => (asset ? assetPlaceholder(asset) : null));
+    const albumsWithCover = albumsWithHero.map((album, i) => {
+      const asset = coverAssets[i];
+      return asset
+        ? {
+            ...album,
+            cover: { id: asset.id, isEdited: asset.isEdited, updatedAt: asset.updatedAt },
+          }
+        : album;
+    });
 
     // 1-based position among the enabled subpages — drives the header kicker.
     const enabledSubpages = config.subpages.filter((sp) => sp.enabled !== false);
@@ -646,7 +700,7 @@ export default async function PathPage({ params, searchParams }: PathPageProps)
         slug={slug}
         title={result.subpage.title || result.subpage.name}
         subtitle={result.subpage.subtitle}
-        albums={albumsWithHero}
+        albums={albumsWithCover}
         coverPlaceholders={coverPlaceholders}
         sections={result.subpage.sections}
         gridStyle={buildCoverGridStyle(result.subpage.coverGrid)}
@@ -687,6 +741,7 @@ export default async function PathPage({ params, searchParams }: PathPageProps)
     config.exif.onHover && config.exif.camera,
     config.exif.caption,
     config.albumDownloads[album.id] ? album.id : undefined,
+    zoomAlbumFor(album.id),
   );
 
   // Password gate for protected albums
diff --git a/app/[...path]/photoItems.ts b/app/[...path]/photoItems.ts
index 2efe573..2eb9117 100644
--- a/app/[...path]/photoItems.ts
+++ b/app/[...path]/photoItems.ts
@@ -16,7 +16,9 @@ import {
   exifUrl,
   imageUrl,
   videoUrl,
+  zoomUrl,
 } from '@/lib/urls';
+import { zoomDimensions, zoomSourceFor } from '@/lib/zoomSource';
 import type { PhotoItem } from './PhotoGrid';
 
 /**
@@ -32,6 +34,11 @@ export function toPhotoItems(
   showCaption: boolean,
   /** The album offering downloads, or undefined when it does not. */
   downloadAlbumId?: string,
+  /**
+   * The album whose page offers lightbox zoom, or undefined when zoom resolves
+   * off for it (#467). Each photo still has to be zoomable on its own.
+   */
+  zoomAlbumId?: string,
 ): PhotoItem[] {
   return assets
     .filter((a) => a.type === 'IMAGE' || a.type === 'VIDEO')
@@ -40,17 +47,25 @@ export function toPhotoItems(
       const exif = showExif && a.type === 'IMAGE' ? assetExifSummary(a) : undefined;
       const caption = assetCaption(a, showCaption);
       const isVideo = a.type === 'VIDEO';
+      const zoomSize = zoomAlbumId && zoomSourceFor(a) ? zoomDimensions(a) : undefined;
       return {
         id: encodeAssetId(a.id),
         type: isVideo ? 'video' : 'image',
-        thumbUrl: imageUrl(a.id, 'preview'),
-        previewUrl: imageUrl(a.id, 'preview'),
+        thumbUrl: imageUrl(a, 'preview'),
+        previewUrl: imageUrl(a, 'preview'),
         ...(isVideo ? { videoUrl: videoUrl(a.id) } : {}),
         exifUrl: exifUrl(a.id),
         ...(ph ? { blurDataURL: ph.blurDataURL, dominantColor: ph.dominantColor } : {}),
         ...(exif ?? {}),
         ...(caption ? { caption } : {}),
         ...(downloadAlbumId ? { downloadUrl: downloadUrl(downloadAlbumId, a.id) } : {}),
+        ...(zoomAlbumId && zoomSize
+          ? {
+              zoomUrl: zoomUrl(zoomAlbumId, a.id),
+              zoomWidth: zoomSize.width,
+              zoomHeight: zoomSize.height,
+            }
+          : {}),
         aspectRatio: assetAspectRatio(a),
       };
     });
diff --git a/app/[...path]/routeExists.ts b/app/[...path]/routeExists.ts
new file mode 100644
index 0000000..b18878e
--- /dev/null
+++ b/app/[...path]/routeExists.ts
@@ -0,0 +1,70 @@
+/**
+ * Whether the catch-all has anything to show for a path — asked before the
+ * page streams, so that a miss can still answer with a real 404.
+ *
+ * Next commits to the status with the first byte. The page used to sit inside
+ * a loading.tsx Suspense boundary, so the skeleton went out as a 200 and the
+ * notFound() that followed could only add a noindex tag: every unknown slug, an
+ * offline subpage, a draft content page and `/<subpage>/<unknown>` were soft
+ * 404s. The page now calls this first, outside any boundary, and only then
+ * streams the skeleton around the part that fetches photos.
+ *
+ * Cost: it reads the config, the album list and content/pages/. The album list
+ * is the one the header nav already waits for before the first byte, so this
+ * adds no Immich request and no latency; the album's assets — the slow part —
+ * are still fetched behind the skeleton.
+ *
+ * It mirrors the order of gates and 404s in the page body, and may be looser
+ * than the body, never stricter. A path it passes that the body then rejects
+ * only loses the status (an album that vanished from Immich between the list
+ * and the asset fetch stays a soft 404); a path it rejects that the body would
+ * render is a page nobody can open.
+ *
+ * Errors propagate. An Immich outage with no stale list to fall back on must
+ * surface as an error, never as "this album does not exist".
+ */
+
+import { cookies } from 'next/headers';
+import { immich } from '@/lib/immich';
+import { isAuthenticated, isProtected } from '@/lib/auth';
+import { isAdminAuthenticated } from '@/lib/admin/auth';
+import { contentPageAccess } from './contentPage';
+
+/** Whether `key` is password-protected and this request has not unlocked it. */
+export async function isLocked(key: string, type: 'subpage' | 'album'): Promise<boolean> {
+  if (!isProtected(key, type)) return false;
+  const cookieStore = await cookies();
+  const getCookie = (name: string) => cookieStore.get(name)?.value;
+  return !isAuthenticated(key, getCookie, type);
+}
+
+/** `path` is already slug-normalised, as the page hands it over. */
+export async function routeExists(path: readonly string[] | undefined): Promise<boolean> {
+  // One segment or two: nothing on this site lives deeper, for anyone.
+  if (!path || path.length === 0 || path.length > 2) return false;
+  if (await exists(path)) return true;
+  // Where a visitor gets the 404, a signed-in admin gets a diagnostic banner
+  // (or the draft content page).
+  return isAdminAuthenticated();
+}
+
+async function exists([first, second]: readonly string[]): Promise<boolean> {
+  if (second !== undefined) {
+    // A locked subpage shows its gate for any album slug below it. Answering
+    // 404 for the unknown ones would tell a visitor without the password which
+    // albums are behind it.
+    if (await isLocked(first, 'subpage')) return true;
+    return (await immich.findAlbumBySlug(second, first)) !== null;
+  }
+
+  if (immich.isSubpageSlug(first)) {
+    if (await isLocked(first, 'subpage')) return true;
+    const result = await immich.getSubpageAlbums(first);
+    return !!result && result.albums.length > 0;
+  }
+
+  const page = await contentPageAccess(first);
+  if (page) return page !== 'draft';
+
+  return (await immich.findAlbumBySlug(first)) !== null;
+}
diff --git a/app/__tests__/gate-page.test.tsx b/app/__tests__/gate-page.test.tsx
new file mode 100644
index 0000000..8d6c91c
--- /dev/null
+++ b/app/__tests__/gate-page.test.tsx
@@ -0,0 +1,72 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { renderToStaticMarkup } from 'react-dom/server';
+
+/**
+ * A locked site still serves /impressum and /privacy (proxy.ts, UNGATED_PAGES),
+ * and the gate is where a visitor who cannot get in finds them. A link to a
+ * page that is switched off would lead to a 404, so each appears only when its
+ * page exists.
+ */
+
+const config = {
+  siteTitle: 'Test Folio',
+  lang: 'en',
+  legal: { enabled: true },
+  privacy: { enabled: true },
+};
+let privacy = true;
+
+vi.mock('@/lib/config', () => ({
+  getConfig: () => config,
+  getConfigOrNull: () => config,
+}));
+vi.mock('@/lib/auth', () => ({
+  isSiteLocked: () => true,
+  SITE_AUTH_KEY: '__site__',
+}));
+vi.mock('@/lib/privacy', () => ({
+  privacyAvailable: () => privacy,
+}));
+
+import GatePage from '../gate/page';
+
+const html = () => renderToStaticMarkup(<GatePage />);
+
+describe('site gate page', () => {
+  beforeEach(() => {
+    config.lang = 'en';
+    config.legal.enabled = true;
+    privacy = true;
+  });
+
+  it('links the legal notice and the privacy policy', () => {
+    const out = html();
+    expect(out).toContain('href="/impressum"');
+    expect(out).toContain('href="/privacy"');
+    expect(out).toContain('aria-label="Legal information"');
+  });
+
+  it('leaves out a page that is switched off', () => {
+    config.legal.enabled = false;
+    expect(html()).not.toContain('href="/impressum"');
+    expect(html()).toContain('href="/privacy"');
+
+    config.legal.enabled = true;
+    privacy = false;
+    expect(html()).toContain('href="/impressum"');
+    expect(html()).not.toContain('href="/privacy"');
+  });
+
+  it('renders no empty link list when neither page exists', () => {
+    config.legal.enabled = false;
+    privacy = false;
+    expect(html()).not.toContain('<nav');
+  });
+
+  it('labels the links in the site language', () => {
+    config.lang = 'de';
+    const out = html();
+    expect(out).toContain('>Impressum</a>');
+    expect(out).toContain('>Datenschutz</a>');
+  });
+});
diff --git a/app/__tests__/not-found-metadata.test.ts b/app/__tests__/not-found-metadata.test.ts
new file mode 100644
index 0000000..4268824
--- /dev/null
+++ b/app/__tests__/not-found-metadata.test.ts
@@ -0,0 +1,29 @@
+import { describe, it, expect, vi } from 'vitest';
+
+/**
+ * A 404 decided before streaming — by proxy.ts, or by a page calling
+ * notFound() outside any Suspense boundary — is rendered from app/not-found.tsx
+ * inside the root layout, and Next takes its metadata from the layouts and
+ * that file, never from the page. Without metadata of its own the tab showed
+ * the bare site title, and the layout's `index, follow` sat next to Next's
+ * `noindex`; the soft-404 path meanwhile read "Not found".
+ */
+
+vi.mock('@/lib/i18n/server', async () => {
+  const { getDictionary } = await import('@/lib/i18n');
+  return { getServerDictionary: () => getDictionary('de') };
+});
+
+import * as notFoundModule from '../not-found';
+import { getDictionary } from '@/lib/i18n';
+
+describe('app/not-found.tsx metadata', () => {
+  it('titles a hard 404 from the dictionary and drops the layout robots tag', async () => {
+    const { generateMetadata } = notFoundModule as { generateMetadata?: () => unknown };
+    expect(typeof generateMetadata).toBe('function');
+    expect(await generateMetadata!()).toEqual({
+      title: getDictionary('de').error.notFoundTitle,
+      robots: null,
+    });
+  });
+});
diff --git a/app/about/__tests__/about-meta.test.ts b/app/about/__tests__/about-meta.test.ts
new file mode 100644
index 0000000..57ca062
--- /dev/null
+++ b/app/about/__tests__/about-meta.test.ts
@@ -0,0 +1,68 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+/**
+ * P-17: /about shared with no picture. A page's openGraph replaces the
+ * layout's whole, so leaving `images` out dropped the site card too.
+ */
+
+let aboutMd = '';
+
+vi.mock('fs', async (orig) => {
+  const actual = await orig<typeof import('fs')>();
+  return {
+    ...actual,
+    promises: {
+      ...actual.promises,
+      readFile: async (path: string, enc: string) =>
+        String(path).endsWith('about.md')
+          ? aboutMd
+          : actual.promises.readFile(path, enc as 'utf-8'),
+    },
+  };
+});
+vi.mock('@/lib/config', () => ({
+  getConfig: () => ({ authSecret: 'test-secret', aboutEnabled: true }),
+  getConfigOrNull: () => ({ lang: 'en' }),
+}));
+vi.mock('@/lib/urls', () => ({
+  imageUrl: (ref: string | { id: string; isEdited?: boolean }, size: string) =>
+    typeof ref === 'string'
+      ? `/api/image/tok-${ref}?size=${size}`
+      : `/api/image/tok-${ref.id}?size=${size}${ref.isEdited ? '&e=edit' : ''}`,
+  assetPlaceholder: () => null,
+}));
+const portraitAsset = vi.hoisted(() => ({ value: null as null | Record<string, unknown> }));
+vi.mock('@/lib/immich', () => ({
+  immich: { getAssetInfo: async () => portraitAsset.value },
+}));
+
+const { generateMetadata } = await import('../page');
+
+describe('/about metadata', () => {
+  beforeEach(() => {
+    aboutMd = '';
+    portraitAsset.value = null;
+  });
+
+  it('shares a portrait edited in Immich under its edited URL (#831)', async () => {
+    aboutMd = '---\nname: Ada\nportrait: portrait-uuid\n---\nHello.';
+    portraitAsset.value = { id: 'portrait-uuid', isEdited: true };
+    const m = await generateMetadata();
+    expect(m.openGraph?.images).toEqual(['/api/image/tok-portrait-uuid?size=preview&e=edit']);
+  });
+
+  it('uses the portrait as the share image', async () => {
+    aboutMd = '---\nname: Ada\nportrait: portrait-uuid\n---\nHello.';
+    const m = await generateMetadata();
+    expect(m.openGraph?.images).toEqual(['/api/image/tok-portrait-uuid?size=preview']);
+    expect(m.twitter?.images).toEqual(['/api/image/tok-portrait-uuid?size=preview']);
+  });
+
+  it('falls back to the generated card without a portrait', async () => {
+    aboutMd = '---\nname: Ada\n---\nHello.';
+    const m = await generateMetadata();
+    const [image] = m.openGraph?.images as string[];
+    expect(image).toMatch(/^\/api\/og\?/);
+    expect(new URL(image, 'https://x.test').searchParams.get('title')).toBe(m.title);
+  });
+});
diff --git a/app/about/page.tsx b/app/about/page.tsx
index 6a937a7..5835b41 100644
--- a/app/about/page.tsx
+++ b/app/about/page.tsx
@@ -9,6 +9,7 @@ import yaml from 'js-yaml';
 import Image from 'next/image';
 import type { Metadata } from 'next';
 import { imageUrl, assetPlaceholder } from '@/lib/urls';
+import { ogImageUrl } from '@/lib/ogImage';
 import { immich } from '@/lib/immich';
 import { getConfig } from '@/lib/config';
 import { getServerDictionary } from '@/lib/i18n/server';
@@ -56,6 +57,17 @@ export async function generateMetadata(): Promise<Metadata> {
   const t = getServerDictionary();
   const title = meta.name ? t.about.metaTitle(meta.name) : t.about.title;
   const description = body ? body.slice(0, 160).replace(/\s+/g, ' ').trim() : undefined;
+  // A page's openGraph replaces the layout's whole, images included, so
+  // leaving them out shared /about with no picture at all. The portrait is the
+  // obvious one (it is a published asset); without it, the generated card.
+  // The portrait's asset for its edit marker (#831), from the cache the page
+  // body reads as well.
+  const portraitAsset = meta.portrait
+    ? await immich.getAssetInfo(meta.portrait).catch(() => null)
+    : null;
+  const ogImage = meta.portrait
+    ? imageUrl(portraitAsset ?? meta.portrait, 'preview')
+    : ogImageUrl(title);
 
   return {
     title,
@@ -63,11 +75,13 @@ export async function generateMetadata(): Promise<Metadata> {
     openGraph: {
       title,
       description,
+      images: [ogImage],
     },
     twitter: {
       card: 'summary_large_image',
       title,
       description,
+      images: [ogImage],
     },
   };
 }
@@ -89,7 +103,7 @@ export default async function AboutPage() {
       <div className="about__portrait-col">
         {meta.portrait ? (
           <Image
-            src={imageUrl(meta.portrait, 'preview')}
+            src={imageUrl(portraitAsset ?? meta.portrait, 'preview')}
             alt={meta.name || t.about.portraitAlt}
             className="about__portrait"
             fill
diff --git a/app/admin/__tests__/SortableTiles.test.tsx b/app/admin/__tests__/SortableTiles.test.tsx
new file mode 100644
index 0000000..81b1a7b
--- /dev/null
+++ b/app/admin/__tests__/SortableTiles.test.tsx
@@ -0,0 +1,61 @@
+// @vitest-environment jsdom
+import { describe, it, expect, afterEach } from 'vitest';
+import { render, screen, cleanup } from '@testing-library/react';
+import { DndContext } from '@dnd-kit/core';
+import { SortableContext } from '@dnd-kit/sortable';
+import { SortablePageRow, SortableHeroTile } from '../components/page-builder/SortableTiles';
+import { dndAnnouncements } from '../components/dndAnnouncements';
+
+afterEach(cleanup);
+
+/**
+ * QA A-20: the sortable attributes (role="button", tabindex) sat on the whole
+ * row, which also holds the row's own button — nested interactive content. They
+ * belong on the drag handle. And the drag announcements read out internal ids.
+ */
+describe('sortable rows', () => {
+  it('put the sortable role on the handle, not around the row button', () => {
+    render(
+      <DndContext>
+        <SortableContext items={['page-pricing']}>
+          <SortablePageRow id="page-pricing" title="Pricing" isActive={false} onClick={() => {}} />
+        </SortableContext>
+      </DndContext>,
+    );
+    const handle = screen.getByLabelText('Reorder Pricing');
+    expect(handle.getAttribute('role')).toBe('button');
+    for (const button of screen.getAllByRole('button')) {
+      expect(button.parentElement?.closest('[role="button"]')).toBeNull();
+    }
+  });
+
+  it('keeps the hero tile remove button out of the handle', () => {
+    render(
+      <DndContext>
+        <SortableContext items={['hero-0']}>
+          <SortableHeroTile id="abc" index={0} onRemove={() => {}} />
+        </SortableContext>
+      </DndContext>,
+    );
+    const remove = screen.getByTitle('Remove');
+    expect(remove.parentElement?.closest('[role="button"]')).toBeNull();
+    expect(screen.getByLabelText('Reorder hero photo 1').getAttribute('role')).toBe('button');
+  });
+});
+
+describe('dndAnnouncements', () => {
+  const label = (id: string | number) => (id === 'page-pricing' ? 'page "Pricing"' : 'page "FAQ"');
+  const a = dndAnnouncements(label);
+  const active = { id: 'page-pricing' } as never;
+  const over = { id: 'subpage-3' } as never;
+
+  it('speaks the names the list shows, not the ids', () => {
+    expect(a.onDragStart({ active })).toBe('Picked up page "Pricing".');
+    expect(a.onDragEnd({ active, over } as never)).toBe(
+      'Page "Pricing" was dropped at the position of page "FAQ".',
+    );
+    expect(a.onDragCancel({ active, over: null } as never)).toBe(
+      'Moving page "Pricing" was cancelled.',
+    );
+  });
+});
diff --git a/app/admin/__tests__/album-entries-round-trip.test.ts b/app/admin/__tests__/album-entries-round-trip.test.ts
index 0031c25..3206ae7 100644
--- a/app/admin/__tests__/album-entries-round-trip.test.ts
+++ b/app/admin/__tests__/album-entries-round-trip.test.ts
@@ -35,6 +35,7 @@ const everyOption: Required<Omit<AlbumEntryObject, 'grid'>> & Pick<AlbumEntryObj
   assetOrder: ['33333333-3333-3333-3333-333333333333'],
   coverPosition: '50% 25%',
   download: true,
+  zoom: false,
   location: 'hidden',
   grid: { columns: 4, gap: 8, aspectRatio: '3/2', layout: 'masonry' },
 };
@@ -47,6 +48,17 @@ describe('album entry round trip', () => {
     expect(serialized).toEqual({ [uuid]: everyOption });
   });
 
+  it('keeps zoom: false, which switches zoom off for the album (#467)', () => {
+    const parsed = parseAlbumEntries([{ [uuid]: { zoom: false } }]);
+    expect(parsed[0].zoom).toBe(false);
+    expect(hasAlbumOptions(parsed[0])).toBe(true);
+    expect(serializeAlbumEntries(parsed)).toEqual([{ [uuid]: { zoom: false } }]);
+  });
+
+  it('writes no zoom key while the album inherits', () => {
+    expect(serializeAlbumEntries([{ id: uuid, zoom: undefined }])).toEqual([uuid]);
+  });
+
   it('keeps map precision across a save', () => {
     const parsed = parseAlbumEntries([{ [uuid]: { location: 'city' } }]);
 
diff --git a/app/admin/__tests__/gallery-ops.test.ts b/app/admin/__tests__/gallery-ops.test.ts
index 10ec469..eaef27c 100644
--- a/app/admin/__tests__/gallery-ops.test.ts
+++ b/app/admin/__tests__/gallery-ops.test.ts
@@ -68,7 +68,7 @@ describe('hero, subpages and sections', () => {
 
   it('names a new subpage after its position and starts it empty', () => {
     const g = ops.addSubpage(state());
-    expect(g.subpages[3]).toEqual({ name: 'New Page 4', albums: [], sections: undefined });
+    expect(g.subpages[3]).toEqual({ name: 'New subpage 4', albums: [], sections: undefined });
   });
 
   it('adds, updates and removes sections', () => {
diff --git a/app/admin/__tests__/gallery-yaml.test.ts b/app/admin/__tests__/gallery-yaml.test.ts
index 80a3223..dbe68bf 100644
--- a/app/admin/__tests__/gallery-yaml.test.ts
+++ b/app/admin/__tests__/gallery-yaml.test.ts
@@ -138,6 +138,7 @@ const everySubpageKey: Required<SubpageYaml> = {
   sections: [{ title: 'North', description: 'Cold', albums: [B] }],
   password: 'scrypt:aa:bb',
   proofing: false,
+  zoom: true,
   essayFile: 'story',
   essayText: 'Text',
   enabled: false,
@@ -161,6 +162,18 @@ describe('subpage keys', () => {
   });
 });
 
+describe('subpage zoom (#467)', () => {
+  it('keeps zoom in either direction, and writes nothing when unset', () => {
+    const off = { name: 'Z', zoom: false, albums: [A] };
+    const on = { name: 'Z', zoom: true, albums: [A] };
+    expect(roundTrip({ subpages: [off] })).toEqual({ subpages: [off] });
+    expect(roundTrip({ subpages: [on] })).toEqual({ subpages: [on] });
+    expect(roundTrip({ subpages: [{ name: 'Z', albums: [A] }] })).toEqual({
+      subpages: [{ name: 'Z', albums: [A] }],
+    });
+  });
+});
+
 describe('content page references (#722)', () => {
   it('keeps `- page:` entries where they were among the subpages', () => {
     const yaml = {
diff --git a/app/admin/__tests__/sameDraft.test.ts b/app/admin/__tests__/sameDraft.test.ts
new file mode 100644
index 0000000..3b707c9
--- /dev/null
+++ b/app/admin/__tests__/sameDraft.test.ts
@@ -0,0 +1,35 @@
+import { describe, it, expect } from 'vitest';
+import { sameDraft } from '../components/sameDraft';
+
+/**
+ * "Unsaved changes" stayed up after an edit was typed back to the saved value
+ * (QA A-19): the editors only ever set their dirty flag. They now also compare
+ * with the saved state, which has to see through what an undone edit leaves.
+ */
+describe('sameDraft', () => {
+  it('is false for a real change', () => {
+    expect(sameDraft({ title: 'A' }, { title: 'B' })).toBe(false);
+    expect(sameDraft({ navLinks: [{ label: 'A' }] }, { navLinks: [] })).toBe(false);
+    expect(sameDraft({ albums: ['a', 'b'] }, { albums: ['b', 'a'] })).toBe(false);
+  });
+
+  it('ignores key order — a deleted key typed again moves to the end', () => {
+    expect(
+      sameDraft(
+        { theme: { accent: '#fff', preset: 'noir' } },
+        {
+          theme: { preset: 'noir', accent: '#fff' },
+        },
+      ),
+    ).toBe(true);
+  });
+
+  it('ignores the empty parent objects a settings edit creates', () => {
+    expect(sameDraft({ title: 'A', contact: {} }, { title: 'A' })).toBe(true);
+    expect(sameDraft({ theme: { fonts: {} } }, {})).toBe(true);
+  });
+
+  it('ignores undefined, which the YAML never holds', () => {
+    expect(sameDraft({ title: 'A', subtitle: undefined }, { title: 'A' })).toBe(true);
+  });
+});
diff --git a/app/admin/components/AnalyticsView.tsx b/app/admin/components/AnalyticsView.tsx
index e547070..72bd0e7 100644
--- a/app/admin/components/AnalyticsView.tsx
+++ b/app/admin/components/AnalyticsView.tsx
@@ -113,7 +113,8 @@ export default function AnalyticsView() {
           <div className="analytics-bar-chart">
             {daysList.map(({ date, pageviews }) => {
               const heightPct = Math.round((pageviews / maxDayViews) * 100);
-              const formattedDate = date.slice(5); // MM-DD
+              const month = date.slice(5, 8); // "MM-"
+              const day = date.slice(8); // "DD"
               return (
                 <div key={date} className="bar-col" title={`${date}: ${pageviews} views`}>
                   <div className="bar-wrapper">
@@ -125,7 +126,11 @@ export default function AnalyticsView() {
                       <span className="bar-val">{pageviews}</span>
                     </div>
                   </div>
-                  <span className="bar-label">{formattedDate}</span>
+                  <span className="bar-label">
+                    {/* Hidden at phone width, where only the day fits (A-18). */}
+                    <span className="bar-label-month">{month}</span>
+                    {day}
+                  </span>
                 </div>
               );
             })}
diff --git a/app/admin/components/DiagnosticsView.tsx b/app/admin/components/DiagnosticsView.tsx
index b5f34fb..18748f3 100644
--- a/app/admin/components/DiagnosticsView.tsx
+++ b/app/admin/components/DiagnosticsView.tsx
@@ -41,7 +41,11 @@ type AltTextData = AltTextReport & {
 /** Which group a doctor check belongs to. An unknown id lands in Content. */
 const GROUPS: { id: string; title: string; checks: string[] }[] = [
   { id: 'connection', title: 'Connection', checks: ['immich-api', 'album-ids'] },
-  { id: 'security', title: 'Security', checks: ['auth-secret', 'passwords', 'proxy-hops', 'cdn'] },
+  {
+    id: 'security',
+    title: 'Security',
+    checks: ['auth-secret', 'passwords', 'proxy-hops', 'cdn', 'download-metadata'],
+  },
   {
     id: 'content',
     title: 'Content',
@@ -54,6 +58,7 @@ const GROUPS: { id: string; title: string; checks: string[] }[] = [
       'contact',
       'privacy',
       'settings-values',
+      'zoom-renditions',
     ],
   },
 ];
@@ -75,12 +80,17 @@ const FIXES: Record<string, { label: string; href: string }> = {
   'album-ids': { label: 'Open pages', href: '/admin/pages' },
   'albums-shared': { label: 'Open pages', href: '/admin/pages' },
   'content-pages': { label: 'Open pages', href: '/admin/pages' },
+  'download-metadata': { label: 'Open pages', href: '/admin/pages' },
   legal: { label: 'Open settings', href: '/admin/settings/legal' },
   contact: { label: 'Open settings', href: '/admin/settings/legal' },
   privacy: { label: 'Open settings', href: '/admin/settings/legal' },
   // The href is replaced by the finding's own settingsSection.
   'settings-values': { label: 'Open settings', href: '/admin/settings/general' },
   'content-writable': { label: 'How to fix', href: `${DOCS}/docs/admin-panel.md#docker-usage` },
+  'zoom-renditions': {
+    label: 'How to set it up',
+    href: `${DOCS}/docs/gallery-config.md#photo-zoom`,
+  },
   'immich-api': {
     label: 'API key permissions',
     href: `${DOCS}/README.md#immich-api-key-permissions`,
diff --git a/app/admin/components/PageBuilder.tsx b/app/admin/components/PageBuilder.tsx
index 31eee88..317cc69 100644
--- a/app/admin/components/PageBuilder.tsx
+++ b/app/admin/components/PageBuilder.tsx
@@ -54,9 +54,11 @@ import { useLatest } from './useLatest';
 import { useVersionedSave } from './useVersionedSave';
 import type { GalleryVersionChange } from '@/lib/admin/pageRefs';
 import DraftNotice from './DraftNotice';
+import { sameDraft } from './sameDraft';
 import { reportIfSessionExpired } from './sessionExpiry';
 import { IconCamera, IconHome, IconPlus, IconSearch } from './Icons';
 import { useNotify } from './Notifications';
+import { dndAnnouncements } from './dndAnnouncements';
 
 /** Drop target id of the "Not in menu" group. */
 const OFF_MENU_ID = 'offmenu-zone';
@@ -83,7 +85,12 @@ export default function PageBuilder() {
    */
   const [loadError, setLoadError] = useState<string | null>(null);
   const [saving, setSaving] = useState(false);
-  const [dirty, setDirty] = useState(false);
+  /** Set by any edit; `dirty` below also asks whether the edits changed anything. */
+  const [edited, setDirty] = useState(false);
+  /** gallery.yaml as last loaded or saved — `serverState`, as state for the comparison. */
+  const [savedGallery, setSavedGallery] = useState<GalleryState | null>(null);
+  // Putting an edit back the way it was is not an unsaved change (QA A-19).
+  const dirty = edited && !(savedGallery && sameDraft(gallery, savedGallery));
   const [saveStatus, setSaveStatus] = useState<SaveStatus>(null);
   const [expandedSubpage, setExpandedSubpage] = useState<number | null>(null);
   /** What the panel shows while no subpage is selected (UX stage 4). */
@@ -205,6 +212,7 @@ export default function PageBuilder() {
       versionRef.current = typeof version === 'string' ? version : null;
       const parsed = parseGalleryYaml(raw);
       serverState.current = parsed;
+      setSavedGallery(parsed);
       const restored = draft.load(JSON.stringify(parsed));
       setGallery(restored ?? parsed);
       // Not merely "set when restored": on a reload after a backup restore the
@@ -335,6 +343,7 @@ export default function PageBuilder() {
         const written = (data.gallery ?? yamlData) as Record<string, unknown>;
         const asLoaded = parseGalleryYaml(JSON.parse(JSON.stringify(written)));
         serverState.current = asLoaded;
+        setSavedGallery(asLoaded);
         // Edited while the request was out: those edits are not saved yet, so
         // they stay dirty and are not replaced by the file as written.
         const editedMeanwhile = latestGallery.current !== sent;
@@ -490,6 +499,7 @@ export default function PageBuilder() {
     if (change && versionRef.current === change.from) versionRef.current = change.to;
     if (serverState.current) {
       serverState.current = op(serverState.current);
+      setSavedGallery(serverState.current);
       draft.saved(JSON.stringify(serverState.current));
     }
   }
@@ -639,6 +649,24 @@ export default function PageBuilder() {
     return found?.albumName || id.slice(0, 8) + '...';
   }
 
+  /** A sortable id as the list shows it, for the drag announcements (QA A-20). */
+  function dragLabel(id: string | number): string {
+    const key = String(id);
+    const subpage = /^subpage-(\d+)$/.exec(key);
+    if (subpage) return `page "${gallery.subpages[Number(subpage[1])]?.name || 'Untitled'}"`;
+    const page = /^page-(.+)$/.exec(key);
+    if (page) {
+      const found = pages.find((p) => p.slug === page[1]);
+      return `page "${found?.frontmatter.title || page[1]}"`;
+    }
+    const hero = /^hero-(\d+)$/.exec(key);
+    if (hero) return `homepage hero photo ${Number(hero[1]) + 1}`;
+    const album = /^album-(.+)-\d+$/.exec(key);
+    if (album) return `album "${getAlbumName(album[1])}"`;
+    return 'item';
+  }
+  const announcements = dndAnnouncements(dragLabel);
+
   function getAlbumCount(id: string): number {
     const found = immichAlbums.find((a) => a.id === id);
     return found?.assetCount || 0;
@@ -848,6 +876,7 @@ export default function PageBuilder() {
             sensors={sensors}
             collisionDetection={closestCenter}
             onDragEnd={handleMenuDragEnd}
+            accessibility={{ announcements }}
           >
             <div className="pb-group">
               <div className="pb-group-head">
@@ -1024,6 +1053,7 @@ export default function PageBuilder() {
                   sensors={sensors}
                   collisionDetection={closestCenter}
                   onDragEnd={handleAlbumDragEnd}
+                  accessibility={{ announcements }}
                 >
                   <SortableContext
                     items={filteredAlbums.map((a) => {
@@ -1071,7 +1101,7 @@ export default function PageBuilder() {
               <section className="builder-section">
                 <div className="builder-section-header">
                   <h2>
-                    <IconHome /> Homepage Hero
+                    <IconHome /> Hero photos
                   </h2>
                   <button
                     className="admin-btn admin-btn-sm"
@@ -1090,6 +1120,7 @@ export default function PageBuilder() {
                   sensors={sensors}
                   collisionDetection={closestCenter}
                   onDragEnd={handleHeroDragEnd}
+                  accessibility={{ announcements }}
                 >
                   <SortableContext
                     items={gallery.hero.map((_, i) => `hero-${i}`)}
diff --git a/app/admin/components/SettingsEditor.tsx b/app/admin/components/SettingsEditor.tsx
index c3e8b71..abc3e58 100644
--- a/app/admin/components/SettingsEditor.tsx
+++ b/app/admin/components/SettingsEditor.tsx
@@ -30,6 +30,7 @@ import SeoSection from './settings/SeoSection';
 import SecuritySection from './settings/SecuritySection';
 import AboutSection, { useAboutEditor } from './settings/AboutSection';
 import PageHeader from './PageHeader';
+import { sameDraft } from './sameDraft';
 
 const SETTINGS_SECTIONS = [
   { id: 'general', label: 'General' },
@@ -71,6 +72,8 @@ export default function SettingsEditor() {
   } | null>(null);
   /** Fields an environment variable overrides, path to variable name (#605). */
   const [envLocks, setEnvLocks] = useState<EnvLocks>({});
+  /** SITE_TITLE, the first fallback for an empty title (QA A-15). */
+  const [siteTitleEnv, setSiteTitleEnv] = useState<string | null>(null);
   const [loading, setLoading] = useState(true);
   /**
    * Set when the settings could not be fetched. It blocks saving, because an
@@ -79,7 +82,8 @@ export default function SettingsEditor() {
    */
   const [loadError, setLoadError] = useState<string | null>(null);
   const [saving, setSaving] = useState(false);
-  const [dirty, setDirty] = useState(false);
+  /** Set by any edit; `dirty` below also asks whether the edits changed anything. */
+  const [edited, setDirty] = useState(false);
   const [saveStatus, setSaveStatus] = useState<SaveStatus>(null);
 
   const about = useAboutEditor(activeSection === 'about');
@@ -88,6 +92,8 @@ export default function SettingsEditor() {
   // builder's and the journal's do (#592) — useUnsavedGuard only covers
   // leaving the browser.
   const [serverSettings, setServerSettings] = useState<Settings>({});
+  // Typing a value back to what was saved is not an unsaved change (QA A-19).
+  const dirty = edited && !sameDraft(settings, serverSettings);
   // The draft never sees `sitePassword`: sessionStorage is readable by any
   // script on the admin origin, and until it is saved (and hashed) the field
   // holds the password as typed. A restored draft takes the password from the
@@ -160,7 +166,13 @@ export default function SettingsEditor() {
             : `The server answered ${res.status}.`,
         );
       }
-      const { settings: data, siteUrl, envLocks: locks, version } = await res.json();
+      const {
+        settings: data,
+        siteUrl,
+        envLocks: locks,
+        version,
+        siteTitleEnv: titleEnv,
+      } = await res.json();
       const loaded: Settings = data || {};
       versionRef.current = typeof version === 'string' ? version : null;
       setServerSettings(loaded);
@@ -170,6 +182,7 @@ export default function SettingsEditor() {
       setDirty(restored !== null);
       setSiteUrlInfo(siteUrl ?? null);
       setEnvLocks(locks ?? {});
+      setSiteTitleEnv(typeof titleEnv === 'string' ? titleEnv : null);
     } catch (err) {
       console.error('Failed to load settings:', err);
       setLoadError(err instanceof Error ? err.message : 'The settings could not be loaded.');
@@ -407,7 +420,7 @@ export default function SettingsEditor() {
 
         {/* Content */}
         <div className="settings-content">
-          {activeSection === 'general' && <GeneralSection {...props} />}
+          {activeSection === 'general' && <GeneralSection {...props} siteTitleEnv={siteTitleEnv} />}
           {activeSection === 'theme' && <ThemeSection {...props} />}
           {activeSection === 'grid' && <GridSection {...props} />}
           {activeSection === 'footer' && <FooterSection {...props} />}
diff --git a/app/admin/components/__tests__/inflight-save-edits.test.tsx b/app/admin/components/__tests__/inflight-save-edits.test.tsx
index 8d6111d..d099d4e 100644
--- a/app/admin/components/__tests__/inflight-save-edits.test.tsx
+++ b/app/admin/components/__tests__/inflight-save-edits.test.tsx
@@ -249,11 +249,11 @@ describe('PageBuilder: edits made while a save is in flight', () => {
         </ConfirmProvider>
       </NotificationProvider>,
     );
-    fireEvent.click(await screen.findByRole('button', { name: /New subpage/ }));
+    fireEvent.click(await screen.findByRole('button', { name: 'New subpage' }));
     fireEvent.click(screen.getByRole('button', { name: 'Save Changes' }));
     await waitFor(() => expect(releasePut).not.toBeNull());
 
-    fireEvent.click(screen.getByRole('button', { name: /New subpage/ }));
+    fireEvent.click(screen.getByRole('button', { name: 'New subpage' }));
     await act(async () => releasePut!());
 
     await screen.findByText('Saved successfully!');
diff --git a/app/admin/components/__tests__/inline-markdown-fields.test.tsx b/app/admin/components/__tests__/inline-markdown-fields.test.tsx
index cf812c6..d8a2053 100644
--- a/app/admin/components/__tests__/inline-markdown-fields.test.tsx
+++ b/app/admin/components/__tests__/inline-markdown-fields.test.tsx
@@ -146,6 +146,26 @@ describe('journal editor: text blocks as markdown (A-5)', () => {
   });
 });
 
+describe('journal editor: mode toggles (A-18)', () => {
+  // Rendered as admin-btn-xs, the active mode carried admin-btn-primary, whose
+  // background the size class overrode: both modes looked the same.
+  it('mark the active mode, starting on Visual Blocks and Desktop', async () => {
+    await renderJournal();
+    const pressed = (name: string) =>
+      screen.getByRole('button', { name }).getAttribute('aria-pressed');
+
+    expect(pressed('Visual Blocks')).toBe('true');
+    expect(pressed('Raw Markdown')).toBe('false');
+    expect(pressed('Desktop')).toBe('true');
+    expect(pressed('Mobile')).toBe('false');
+
+    fireEvent.click(screen.getByRole('button', { name: 'Raw Markdown' }));
+    expect(pressed('Visual Blocks')).toBe('false');
+    expect(pressed('Raw Markdown')).toBe('true');
+    expect(screen.getByRole('button', { name: 'Raw Markdown' }).className).toContain('active');
+  });
+});
+
 describe('InlineMarkdownField', () => {
   function Harness({ initial }: { initial: string }) {
     const [html, setHtml] = useState(initial);
diff --git a/app/admin/components/__tests__/zoom-settings.test.tsx b/app/admin/components/__tests__/zoom-settings.test.tsx
new file mode 100644
index 0000000..3029c46
--- /dev/null
+++ b/app/admin/components/__tests__/zoom-settings.test.tsx
@@ -0,0 +1,67 @@
+// @vitest-environment jsdom
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, screen, cleanup, fireEvent } from '@testing-library/react';
+import GeneralSection from '../settings/GeneralSection';
+import ZoomOverrideField from '../fields/ZoomOverrideField';
+
+/**
+ * The admin switches for the lightbox zoom (#467): one site-wide toggle in
+ * Settings › General, and an inherit / on / off choice per page and album.
+ * The YAML they produce is covered by the page builder round-trip tests.
+ */
+
+afterEach(cleanup);
+
+describe('Settings › General › Photo zoom', () => {
+  const renderWith = (settings: Record<string, unknown>) => {
+    const update = vi.fn();
+    render(<GeneralSection settings={settings} update={update} updateMany={vi.fn()} />);
+    return { update, row: screen.getByRole('button', { name: /Photo zoom/ }) };
+  };
+
+  it('is shown off when settings.yaml says nothing, and switches it on', () => {
+    const { update, row } = renderWith({});
+    expect(row.getAttribute('aria-pressed')).toBe('false');
+    fireEvent.click(row);
+    expect(update).toHaveBeenCalledWith('zoom', true);
+  });
+
+  it('switches it off again', () => {
+    const { update, row } = renderWith({ zoom: true });
+    expect(row.getAttribute('aria-pressed')).toBe('true');
+    fireEvent.click(row);
+    expect(update).toHaveBeenCalledWith('zoom', false);
+  });
+});
+
+describe('ZoomOverrideField', () => {
+  const renderField = (value: boolean | undefined) => {
+    const onChange = vi.fn();
+    render(
+      <ZoomOverrideField
+        id="z"
+        value={value}
+        onChange={onChange}
+        inheritLabel="Inherit"
+        hint="hint"
+      />,
+    );
+    return { onChange, select: screen.getByLabelText('Photo zoom') as HTMLSelectElement };
+  };
+
+  it('shows the three states', () => {
+    expect(renderField(undefined).select.value).toBe('');
+    cleanup();
+    expect(renderField(true).select.value).toBe('on');
+    cleanup();
+    expect(renderField(false).select.value).toBe('off');
+  });
+
+  it('reports true, false, and undefined for inherit', () => {
+    const { onChange, select } = renderField(undefined);
+    fireEvent.change(select, { target: { value: 'on' } });
+    fireEvent.change(select, { target: { value: 'off' } });
+    fireEvent.change(select, { target: { value: '' } });
+    expect(onChange.mock.calls).toEqual([[true], [false], [undefined]]);
+  });
+});
diff --git a/app/admin/components/dndAnnouncements.ts b/app/admin/components/dndAnnouncements.ts
new file mode 100644
index 0000000..1c2a3b5
--- /dev/null
+++ b/app/admin/components/dndAnnouncements.ts
@@ -0,0 +1,28 @@
+import type { Announcements, UniqueIdentifier } from '@dnd-kit/core';
+
+/**
+ * Screen reader announcements for a sortable list, in words (QA A-20).
+ *
+ * dnd-kit's defaults read out the sortable ids — "Picked up draggable item
+ * subpage-3. Draggable item page-pricing was moved over droppable area
+ * subpage-1." Those ids are internal. `label` turns one into what the list
+ * shows, e.g. `page "Pricing"`.
+ */
+export function dndAnnouncements(label: (id: UniqueIdentifier) => string): Announcements {
+  return {
+    onDragStart: ({ active }) => `Picked up ${label(active.id)}.`,
+    onDragOver: ({ active, over }) =>
+      over
+        ? `${capitalise(label(active.id))} is at the position of ${label(over.id)}.`
+        : `${capitalise(label(active.id))} is no longer over the list.`,
+    onDragEnd: ({ active, over }) =>
+      over
+        ? `${capitalise(label(active.id))} was dropped at the position of ${label(over.id)}.`
+        : `${capitalise(label(active.id))} was dropped.`,
+    onDragCancel: ({ active }) => `Moving ${label(active.id)} was cancelled.`,
+  };
+}
+
+function capitalise(text: string): string {
+  return text.charAt(0).toUpperCase() + text.slice(1);
+}
diff --git a/app/admin/components/fields/ZoomOverrideField.tsx b/app/admin/components/fields/ZoomOverrideField.tsx
new file mode 100644
index 0000000..c345ff1
--- /dev/null
+++ b/app/admin/components/fields/ZoomOverrideField.tsx
@@ -0,0 +1,46 @@
+'use client';
+
+import type { ReactNode } from 'react';
+
+/**
+ * Lightbox zoom for one page or album (#467): inherit, on, or off.
+ *
+ * Three states rather than a switch, because `zoom: false` is a setting of its
+ * own — it switches zoom off here while the site (or the page) has it on —
+ * and a switch can only say true or absent. A select, like the layout
+ * override beside it, with inheriting as the empty value, so the YAML keeps no
+ * key until someone picks one.
+ */
+export default function ZoomOverrideField({
+  id,
+  value,
+  onChange,
+  inheritLabel,
+  hint,
+}: {
+  id: string;
+  value: boolean | undefined;
+  onChange: (value: boolean | undefined) => void;
+  inheritLabel: string;
+  hint: ReactNode;
+}) {
+  const current = value === true ? 'on' : value === false ? 'off' : '';
+  return (
+    <div className="admin-field">
+      <label htmlFor={id}>Photo zoom</label>
+      <select
+        id={id}
+        value={current}
+        onChange={(e) => {
+          const next = e.target.value;
+          onChange(next === 'on' ? true : next === 'off' ? false : undefined);
+        }}
+      >
+        <option value="">{inheritLabel}</option>
+        <option value="on">On — visitors can zoom to full resolution</option>
+        <option value="off">Off</option>
+      </select>
+      <span className="admin-field-hint">{hint}</span>
+    </div>
+  );
+}
diff --git a/app/admin/components/journal/BlockFields.tsx b/app/admin/components/journal/BlockFields.tsx
index 54ae1dc..96bcc20 100644
--- a/app/admin/components/journal/BlockFields.tsx
+++ b/app/admin/components/journal/BlockFields.tsx
@@ -116,12 +116,19 @@ export function BlockFields({
 
       {block.type === 'photo' && (
         <div style={{ display: 'flex', gap: '1rem', alignItems: 'center' }}>
-          <div
+          {/* A button, not a clickable div, so the keyboard reaches it. */}
+          <button
+            type="button"
+            aria-label={block.assetId ? 'Change photo' : 'Pick a photo'}
             style={{
               width: '140px',
               height: '96px',
               flexShrink: 0,
               background: 'rgba(0,0,0,0.3)',
+              border: 'none',
+              padding: 0,
+              color: 'inherit',
+              font: 'inherit',
               borderRadius: '6px',
               overflow: 'hidden',
               display: 'flex',
@@ -140,13 +147,13 @@ export function BlockFields({
               // eslint-disable-next-line @next/next/no-img-element
               <img
                 src={`/api/admin/thumbnail/${block.assetId}`}
-                alt="Thumb"
+                alt=""
                 style={{ width: '100%', height: '100%', objectFit: 'cover' }}
               />
             ) : (
               <span style={{ fontSize: '0.8rem', opacity: 0.6 }}>+ Pick</span>
             )}
-          </div>
+          </button>
 
           <div
             style={{
@@ -213,10 +220,16 @@ export function BlockFields({
             }}
           >
             {[0, 1].map((pIdx) => (
-              <div
+              <button
+                type="button"
                 key={pIdx}
+                aria-label={`${block.assetIds[pIdx] ? 'Change' : 'Pick'} photo ${pIdx + 1} of the pair`}
                 style={{
                   height: '90px',
+                  width: '100%',
+                  padding: 0,
+                  color: 'inherit',
+                  font: 'inherit',
                   background: 'rgba(0,0,0,0.3)',
                   borderRadius: '6px',
                   overflow: 'hidden',
@@ -241,13 +254,13 @@ export function BlockFields({
                   // eslint-disable-next-line @next/next/no-img-element
                   <img
                     src={`/api/admin/thumbnail/${block.assetIds[pIdx]}`}
-                    alt="Thumb"
+                    alt=""
                     style={{ width: '100%', height: '100%', objectFit: 'cover' }}
                   />
                 ) : (
                   <span style={{ fontSize: '0.8rem', opacity: 0.6 }}>+ Pick Photo #{pIdx + 1}</span>
                 )}
-              </div>
+              </button>
             ))}
           </div>
           <div>
diff --git a/app/admin/components/journal/JournalEditor.tsx b/app/admin/components/journal/JournalEditor.tsx
index 2a4d837..ee7c8fd 100644
--- a/app/admin/components/journal/JournalEditor.tsx
+++ b/app/admin/components/journal/JournalEditor.tsx
@@ -401,25 +401,26 @@ export function JournalEditor({ slug, mapEnabled, onBack, kind = 'journal' }: Jo
             onChange={(e) => handleFrontmatterChange({ title: e.target.value })}
           />
 
+          {/* The admin's segmented control (QA A-18). As `admin-btn-xs` buttons the
+              active one never showed: `.admin-btn-xs` sets its own background
+              after `.admin-btn-primary`, so both modes looked identical. */}
           <div
-            style={{
-              display: 'flex',
-              gap: '4px',
-              background: 'rgba(255,255,255,0.06)',
-              borderRadius: '6px',
-              padding: '2px',
-            }}
+            className="segmented-control segmented-control--sm"
+            role="group"
+            aria-label="Editor mode"
           >
             <button
               type="button"
-              className={`admin-btn admin-btn-xs ${editorMode === 'blocks' ? 'admin-btn-primary' : ''}`}
+              className={`segment-btn ${editorMode === 'blocks' ? 'active' : ''}`}
+              aria-pressed={editorMode === 'blocks'}
               onClick={() => setEditorMode('blocks')}
             >
               Visual Blocks
             </button>
             <button
               type="button"
-              className={`admin-btn admin-btn-xs ${editorMode === 'markdown' ? 'admin-btn-primary' : ''}`}
+              className={`segment-btn ${editorMode === 'markdown' ? 'active' : ''}`}
+              aria-pressed={editorMode === 'markdown'}
               onClick={() => setEditorMode('markdown')}
             >
               Raw Markdown
diff --git a/app/admin/components/journal/JournalPreview.tsx b/app/admin/components/journal/JournalPreview.tsx
index 3944b4d..88574fc 100644
--- a/app/admin/components/journal/JournalPreview.tsx
+++ b/app/admin/components/journal/JournalPreview.tsx
@@ -92,17 +92,24 @@ export function JournalPreview({ parsed, albumAssets }: JournalPreviewProps) {
         <span className="journal-preview-bar-label">
           <IconEye size={13} /> Realtime Theme Preview
         </span>
-        <div style={{ display: 'flex', gap: '4px' }}>
+        {/* Same control and same fix as the editor's mode toggle. */}
+        <div
+          className="segmented-control segmented-control--sm"
+          role="group"
+          aria-label="Preview width"
+        >
           <button
             type="button"
-            className={`admin-btn admin-btn-xs ${viewport === 'desktop' ? 'admin-btn-primary' : ''}`}
+            className={`segment-btn ${viewport === 'desktop' ? 'active' : ''}`}
+            aria-pressed={viewport === 'desktop'}
             onClick={() => setViewport('desktop')}
           >
             Desktop
           </button>
           <button
             type="button"
-            className={`admin-btn admin-btn-xs ${viewport === 'mobile' ? 'admin-btn-primary' : ''}`}
+            className={`segment-btn ${viewport === 'mobile' ? 'active' : ''}`}
+            aria-pressed={viewport === 'mobile'}
             onClick={() => setViewport('mobile')}
           >
             Mobile
diff --git a/app/admin/components/journal/JournalStudio.tsx b/app/admin/components/journal/JournalStudio.tsx
index fd0fe65..71cc3c4 100644
--- a/app/admin/components/journal/JournalStudio.tsx
+++ b/app/admin/components/journal/JournalStudio.tsx
@@ -110,11 +110,12 @@ export function JournalStudio({ slug: activeSlug, mapEnabled }: JournalStudioPro
     }
   };
 
-  const handleDelete = async (slug: string) => {
+  const handleDelete = async (slug: string, title?: string) => {
+    // Named by title, as the page delete is; the slug only when there is none.
     const ok = await confirm({
-      title: `Delete “${slug}”?`,
+      title: `Delete “${title || slug}”?`,
       message: 'A copy is kept and can be restored under Backups.',
-      confirmLabel: 'Delete',
+      confirmLabel: 'Delete entry',
       danger: true,
     });
     if (!ok) return;
@@ -244,7 +245,7 @@ export function JournalStudio({ slug: activeSlug, mapEnabled }: JournalStudioPro
                   <button
                     type="button"
                     className="admin-btn admin-btn-sm admin-btn-danger"
-                    onClick={() => handleDelete(entry.slug)}
+                    onClick={() => handleDelete(entry.slug, entry.frontmatter.title)}
                     title="Delete entry"
                     style={{ marginLeft: 'auto' }}
                   >
diff --git a/app/admin/components/journal/journal-studio.css b/app/admin/components/journal/journal-studio.css
index 428e407..b243973 100644
--- a/app/admin/components/journal/journal-studio.css
+++ b/app/admin/components/journal/journal-studio.css
@@ -1,8 +1,9 @@
 /* ── Journal Studio & Editor CSS ──────────────────────────────────── */
 
 /*
- * The studio is a full-width workspace: it breaks out of the 1120px
- * `.admin-main` column so the split view has room for editor *and* preview.
+ * The studio is a full-width workspace: it breaks out of the shared
+ * `--admin-content-width` column so the split view has room for editor *and*
+ * preview.
  */
 .admin-main:has(> .journal-studio),
 .admin-main:has(> .journal-editor-container) {
diff --git a/app/admin/components/page-builder/AlbumCard.tsx b/app/admin/components/page-builder/AlbumCard.tsx
index 90b106b..58f533f 100644
--- a/app/admin/components/page-builder/AlbumCard.tsx
+++ b/app/admin/components/page-builder/AlbumCard.tsx
@@ -38,7 +38,7 @@ export function SortableAlbumCard({
   };
 
   return (
-    <div ref={setNodeRef} style={style} {...attributes}>
+    <div ref={setNodeRef} style={style}>
       <AlbumCard
         album={album}
         name={name}
@@ -46,7 +46,7 @@ export function SortableAlbumCard({
         thumbnailId={thumbnailId}
         onRemove={onRemove}
         onEdit={onEdit}
-        dragListeners={listeners}
+        dragListeners={{ ...attributes, ...listeners }}
         highlighted={highlighted}
       />
     </div>
@@ -86,7 +86,12 @@ export default function AlbumCard({
     >
       <div className="album-tile-cover">
         {dragListeners && (
-          <div className="album-tile-drag" {...dragListeners} title="Drag to reorder">
+          <div
+            className="album-tile-drag"
+            {...dragListeners}
+            aria-label={`Reorder ${name}`}
+            title="Drag to reorder"
+          >
             <IconGripVertical size={18} className="svg-icon svg-drag" />
           </div>
         )}
diff --git a/app/admin/components/page-builder/AlbumDrawer.tsx b/app/admin/components/page-builder/AlbumDrawer.tsx
index d49c841..832ca24 100644
--- a/app/admin/components/page-builder/AlbumDrawer.tsx
+++ b/app/admin/components/page-builder/AlbumDrawer.tsx
@@ -6,6 +6,7 @@ import { Listbox } from '../Listbox';
 import { SORT_OPTIONS } from './sortOptions';
 import type { AlbumEntry, HeroPickerTarget, OrderEditorTarget } from './types';
 import PasswordField from '../fields/PasswordField';
+import ZoomOverrideField from '../fields/ZoomOverrideField';
 import { useModalDialog } from '@/hooks/useModalDialog';
 
 interface AlbumDrawerProps {
@@ -153,6 +154,14 @@ export default function AlbumDrawer({
                   </div>
                 </button>
               </div>
+
+              <ZoomOverrideField
+                id="album-zoom"
+                value={album.zoom}
+                onChange={(zoom) => onUpdate({ zoom })}
+                inheritLabel="Inherit from page / site settings"
+                hint="Lets visitors zoom into a photo in the viewer to check sharpness. JPEG and AVIF originals are shown without their GPS data; HEIC and RAW need Immich's full-size previews. PNG, WebP, GIF and photos edited in Immich are never zoomed. Applies where the album is listed here."
+              />
             </div>
 
             <div className="admin-sheet-col admin-sheet-col--divided">
diff --git a/app/admin/components/page-builder/SortableTiles.tsx b/app/admin/components/page-builder/SortableTiles.tsx
index 904cd27..7dc4f48 100644
--- a/app/admin/components/page-builder/SortableTiles.tsx
+++ b/app/admin/components/page-builder/SortableTiles.tsx
@@ -35,8 +35,17 @@ export function SortableHeroTile({
   };
 
   return (
-    <div ref={setNodeRef} style={style} className="hero-tile" {...attributes}>
-      <div className="hero-tile-drag" {...listeners} title="Drag to reorder">
+    <div ref={setNodeRef} style={style} className="hero-tile">
+      {/* The handle, not the tile, is the sortable control: the tile holds a
+          remove button, and a button inside role="button" is nested
+          interactive content (QA A-20). */}
+      <div
+        className="hero-tile-drag"
+        {...attributes}
+        {...listeners}
+        aria-label={`Reorder hero photo ${index + 1}`}
+        title="Drag to reorder"
+      >
         <IconGripVertical size={18} className="svg-icon svg-drag" />
       </div>
       <img src={`/api/admin/thumbnail/${id}`} alt="" loading="lazy" />
@@ -88,9 +97,14 @@ export function SortableSubpageTile({
       style={style}
       className={`subpage-tile ${isActive ? 'active' : ''}`}
       onClick={onClick}
-      {...attributes}
     >
-      <div className="subpage-tile-drag" {...listeners} title="Drag to reorder">
+      <div
+        className="subpage-tile-drag"
+        {...attributes}
+        {...listeners}
+        aria-label={`Reorder ${sp.name || 'page'}`}
+        title="Drag to reorder"
+      >
         <IconGripVertical size={18} className="svg-icon svg-drag" />
       </div>
 
@@ -185,9 +199,14 @@ export function SortableSubpageRow({
         zIndex: isDragging ? 10 : undefined,
       }}
       className={`pb-row ${isActive ? 'active' : ''} ${sp.enabled === false ? 'is-off' : ''}`}
-      {...attributes}
     >
-      <span className="pb-row-grip" {...listeners} title="Drag to reorder">
+      <span
+        className="pb-row-grip"
+        {...attributes}
+        {...listeners}
+        aria-label={`Reorder ${sp.name || 'page'}`}
+        title="Drag to reorder"
+      >
         <IconGripVertical size={14} />
       </span>
       <button type="button" className="pb-row-main" onClick={onClick} aria-current={isActive}>
@@ -252,9 +271,14 @@ export function SortablePageRow({
         zIndex: isDragging ? 10 : undefined,
       }}
       className={`pb-row ${isActive ? 'active' : ''} ${draft || missing ? 'is-off' : ''}`}
-      {...attributes}
     >
-      <span className="pb-row-grip" {...listeners} title="Drag to reorder">
+      <span
+        className="pb-row-grip"
+        {...attributes}
+        {...listeners}
+        aria-label={`Reorder ${title}`}
+        title="Drag to reorder"
+      >
         <IconGripVertical size={14} />
       </span>
       <button type="button" className="pb-row-main" onClick={onClick} aria-current={isActive}>
diff --git a/app/admin/components/page-builder/SubpageDrawer.tsx b/app/admin/components/page-builder/SubpageDrawer.tsx
index 21dc25d..979bf76 100644
--- a/app/admin/components/page-builder/SubpageDrawer.tsx
+++ b/app/admin/components/page-builder/SubpageDrawer.tsx
@@ -23,6 +23,7 @@ import {
 import AlbumCard, { SortableAlbumCard } from './AlbumCard';
 import SubpagePreview from './SubpagePreview';
 import PasswordField from '../fields/PasswordField';
+import ZoomOverrideField from '../fields/ZoomOverrideField';
 import {
   normalizeSubpageGrid,
   type ActiveEditAlbumAddress,
@@ -120,20 +121,20 @@ export default function SubpageDrawer({
           <h3 className="subpage-drawer-title">{sp.title || sp.name || 'Untitled Page'}</h3>
         </div>
         <div className="subpage-drawer-header-actions">
-          <div className="segmented-control" style={{ padding: '2px' }}>
+          <div className="segmented-control segmented-control--sm" role="group" aria-label="View">
             <button
               type="button"
               className={`segment-btn ${drawerMode === 'edit' ? 'active' : ''}`}
+              aria-pressed={drawerMode === 'edit'}
               onClick={() => onDrawerModeChange('edit')}
-              style={{ padding: '0.2rem 0.6rem', fontSize: '0.75rem' }}
             >
               <IconPencil size={14} /> Edit
             </button>
             <button
               type="button"
               className={`segment-btn ${drawerMode === 'preview' ? 'active' : ''}`}
+              aria-pressed={drawerMode === 'preview'}
               onClick={() => onDrawerModeChange('preview')}
-              style={{ padding: '0.2rem 0.6rem', fontSize: '0.75rem' }}
             >
               <IconSearch size={14} /> Live Preview
             </button>
@@ -189,7 +190,9 @@ export default function SubpageDrawer({
                       onChange={(e) =>
                         updateSubpage(spIndex, { title: e.target.value || undefined })
                       }
-                      placeholder="Display title (defaults to name)"
+                      // Short enough for the half-width column at any size; the
+                      // old "Display title (defaults to name)" was cut off (A-18).
+                      placeholder="Same as page name"
                     />
                   </div>
                   <div className="admin-field">
@@ -343,6 +346,19 @@ export default function SubpageDrawer({
                   </select>
                 </div>
 
+                {/* Zoom belongs to the album viewer; a photo essay has none. */}
+                {sp.grid?.layout !== 'essay' && sp.essayText == null && !sp.essayFile && (
+                  <div style={{ marginTop: '1rem' }}>
+                    <ZoomOverrideField
+                      id="subpage-zoom"
+                      value={sp.zoom}
+                      onChange={(zoom) => updateSubpage(spIndex, { zoom })}
+                      inheritLabel="Inherit from site settings"
+                      hint="Applies to every album on this page that does not set its own. Settings › General has the site-wide switch."
+                    />
+                  </div>
+                )}
+
                 {/* Album cover grid — hidden in essay mode, which
                                   renders a story instead of a cover grid. The
                                   album count is deliberately not checked: it
diff --git a/app/admin/components/page-builder/albumEntries.ts b/app/admin/components/page-builder/albumEntries.ts
index 0b967f4..6422f73 100644
--- a/app/admin/components/page-builder/albumEntries.ts
+++ b/app/admin/components/page-builder/albumEntries.ts
@@ -30,7 +30,9 @@ export function hasAlbumOptions(entry: AlbumEntry): boolean {
     entry.grid ||
     entry.coverPosition ||
     entry.location ||
-    entry.download,
+    entry.download ||
+    // `zoom: false` is an option too: it switches zoom off for this album.
+    entry.zoom !== undefined,
   );
 }
 
@@ -52,6 +54,7 @@ export function parseAlbumEntries(raw: RawAlbumEntry[] | undefined): AlbumEntry[
       coverPosition: value.coverPosition,
       location: value.location,
       download: value.download,
+      zoom: typeof value.zoom === 'boolean' ? value.zoom : undefined,
     };
   });
 }
@@ -82,6 +85,8 @@ export function serializeAlbumEntries(entries: AlbumEntry[]): RawAlbumEntry[] {
     // Same story as location: set by hand in YAML since #475, with no UI, so
     // the builder was turning original downloads back off on the next save.
     if (entry.download) val.download = entry.download;
+    // Both values mean something: false switches zoom off for this album.
+    if (entry.zoom !== undefined) val.zoom = entry.zoom;
     return { [entry.id]: val };
   });
 }
diff --git a/app/admin/components/page-builder/galleryOps.ts b/app/admin/components/page-builder/galleryOps.ts
index 8f5b88d..283f3e9 100644
--- a/app/admin/components/page-builder/galleryOps.ts
+++ b/app/admin/components/page-builder/galleryOps.ts
@@ -115,7 +115,7 @@ export const addSubpage = (g: GalleryState): GalleryState => ({
   ...g,
   subpages: [
     ...g.subpages,
-    { name: `New Page ${g.subpages.length + 1}`, albums: [], sections: undefined },
+    { name: `New subpage ${g.subpages.length + 1}`, albums: [], sections: undefined },
   ],
 });
 
diff --git a/app/admin/components/page-builder/galleryYaml.ts b/app/admin/components/page-builder/galleryYaml.ts
index 7926555..862c89f 100644
--- a/app/admin/components/page-builder/galleryYaml.ts
+++ b/app/admin/components/page-builder/galleryYaml.ts
@@ -62,6 +62,7 @@ export function parseGalleryYaml(raw: Record<string, unknown>): GalleryState {
       enabled: sp.enabled !== false,
       hidden: sp.hidden === true,
       proofing: typeof sp.proofing === 'boolean' ? sp.proofing : undefined,
+      zoom: typeof sp.zoom === 'boolean' ? sp.zoom : undefined,
       location: sp.location as string | undefined,
       essayText: sp.essayText as string | undefined,
       essayFile: sp.essayFile as string | undefined,
@@ -91,6 +92,7 @@ export function parseGalleryYaml(raw: Record<string, unknown>): GalleryState {
         enabled: sp.enabled !== false,
         hidden: sp.hidden === true,
         proofing: typeof sp.proofing === 'boolean' ? sp.proofing : undefined,
+        zoom: typeof sp.zoom === 'boolean' ? sp.zoom : undefined,
         location: sp.location as string | undefined,
         essayText: sp.essayText as string | undefined,
         essayFile: sp.essayFile as string | undefined,
@@ -127,6 +129,8 @@ export function serializeGallery(gallery: GalleryState): Record<string, unknown>
       if (sp.hidden === true) entry.hidden = true;
       // Both values mean something: false switches proofing off for this page.
       if (sp.proofing !== undefined) entry.proofing = sp.proofing;
+      // Likewise for zoom (#467).
+      if (sp.zoom !== undefined) entry.zoom = sp.zoom;
       if (sp.essayText) entry.essayText = sp.essayText;
       if (sp.essayFile) entry.essayFile = sp.essayFile;
       if (sp.grid) entry.grid = sp.grid;
diff --git a/app/admin/components/page-builder/types.ts b/app/admin/components/page-builder/types.ts
index e0ef16e..ab847cb 100644
--- a/app/admin/components/page-builder/types.ts
+++ b/app/admin/components/page-builder/types.ts
@@ -24,6 +24,11 @@ export interface AlbumEntry {
   location?: string;
   /** Whether visitors may download the originals from this album (#475). */
   download?: boolean;
+  /**
+   * Lightbox zoom for this album: true/false override the page and the site,
+   * undefined inherits (#467).
+   */
+  zoom?: boolean;
 }
 
 export interface Section {
@@ -43,6 +48,11 @@ export interface Subpage {
    * direction. No control in the builder yet; carried so a save keeps it.
    */
   proofing?: boolean;
+  /**
+   * Lightbox zoom for the albums on this page, over the site setting in either
+   * direction; undefined inherits (#467).
+   */
+  zoom?: boolean;
   /** EXPERIMENTAL: reachable by direct link, but not shown in navigation */
   hidden?: boolean;
   essayText?: string;
diff --git a/app/admin/components/sameDraft.ts b/app/admin/components/sameDraft.ts
new file mode 100644
index 0000000..efd9d9f
--- /dev/null
+++ b/app/admin/components/sameDraft.ts
@@ -0,0 +1,31 @@
+/**
+ * Whether an editor's state is still what was last loaded or saved (QA A-19).
+ *
+ * The editors set a dirty flag on every edit, so typing a value back to what
+ * it was left "Unsaved changes" up, the leave guard armed and the draft
+ * stored. Comparing against the saved state fixes that, but not by plain
+ * JSON: an edit that is undone does not always undo its shape. The settings
+ * form creates the parent object of a path it writes (`contact: {}`), and a
+ * key that is deleted and typed again moves to the end of its object. So the
+ * comparison ignores key order, `undefined` and empty objects — none of which
+ * reaches the YAML that is written.
+ */
+
+function canonical(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (value && typeof value === 'object') {
+    const out: Record<string, unknown> = {};
+    for (const key of Object.keys(value).sort()) {
+      const c = canonical((value as Record<string, unknown>)[key]);
+      if (c === undefined) continue;
+      if (c && typeof c === 'object' && !Array.isArray(c) && Object.keys(c).length === 0) continue;
+      out[key] = c;
+    }
+    return out;
+  }
+  return value;
+}
+
+export function sameDraft(a: unknown, b: unknown): boolean {
+  return JSON.stringify(canonical(a)) === JSON.stringify(canonical(b));
+}
diff --git a/app/admin/components/settings/FooterSection.tsx b/app/admin/components/settings/FooterSection.tsx
index d8981c1..444e1ba 100644
--- a/app/admin/components/settings/FooterSection.tsx
+++ b/app/admin/components/settings/FooterSection.tsx
@@ -1,9 +1,10 @@
 'use client';
 
 import * as Icons from '../Icons';
+import { FieldError } from './fields';
 import type { SectionProps } from './types';
 
-export default function FooterSection({ settings, update }: SectionProps) {
+export default function FooterSection({ settings, update, fieldErrors }: SectionProps) {
   return (
     <div className="settings-panel">
       <div className="settings-section-header">
@@ -67,9 +68,13 @@ export default function FooterSection({ settings, update }: SectionProps) {
       {(settings.navLinks || []).map((link, i) => (
         <div className="admin-field-row" key={i}>
           <div className="admin-field">
-            <label htmlFor="footer-label">Label</label>
+            <label htmlFor={`navlink-${i}-label`}>Label</label>
             <input
-              id="footer-label"
+              id={`navlink-${i}-label`}
+              aria-invalid={fieldErrors?.[`navLinks.${i}.label`] ? true : undefined}
+              aria-describedby={
+                fieldErrors?.[`navLinks.${i}.label`] ? `navlink-${i}-label-error` : undefined
+              }
               value={link.label || ''}
               onChange={(e) => {
                 const next = [...(settings.navLinks || [])];
@@ -78,11 +83,19 @@ export default function FooterSection({ settings, update }: SectionProps) {
               }}
               placeholder="Shop"
             />
+            <FieldError
+              id={`navlink-${i}-label-error`}
+              message={fieldErrors?.[`navLinks.${i}.label`]}
+            />
           </div>
           <div className="admin-field">
-            <label htmlFor="footer-url">URL</label>
+            <label htmlFor={`navlink-${i}-url`}>URL</label>
             <input
-              id="footer-url"
+              id={`navlink-${i}-url`}
+              aria-invalid={fieldErrors?.[`navLinks.${i}.url`] ? true : undefined}
+              aria-describedby={
+                fieldErrors?.[`navLinks.${i}.url`] ? `navlink-${i}-url-error` : undefined
+              }
               value={link.url || ''}
               onChange={(e) => {
                 const next = [...(settings.navLinks || [])];
@@ -91,6 +104,10 @@ export default function FooterSection({ settings, update }: SectionProps) {
               }}
               placeholder="https://shop.example.com"
             />
+            <FieldError
+              id={`navlink-${i}-url-error`}
+              message={fieldErrors?.[`navLinks.${i}.url`]}
+            />
           </div>
           <button
             type="button"
diff --git a/app/admin/components/settings/GeneralSection.tsx b/app/admin/components/settings/GeneralSection.tsx
index d826717..3886c89 100644
--- a/app/admin/components/settings/GeneralSection.tsx
+++ b/app/admin/components/settings/GeneralSection.tsx
@@ -4,18 +4,28 @@ import { useState } from 'react';
 import * as Icons from '../Icons';
 import type { SaveStatus } from '../SaveBar';
 import { resolveExifDisplay } from '@/lib/config/schema';
-import { SUPPORTED_LOCALES } from '@/lib/i18n';
+import { SUPPORTED_LOCALES, getDictionary, resolveLocale } from '@/lib/i18n';
 import { FeatureGroup, FeatureRow, SettingRow } from './fields';
 import type { SectionProps } from './types';
 import { useConfirm } from '../ConfirmDialog';
 
-export default function GeneralSection({ settings, update, updateMany }: SectionProps) {
+export default function GeneralSection({
+  settings,
+  update,
+  updateMany,
+  siteTitleEnv,
+}: SectionProps & { siteTitleEnv?: string | null }) {
   const confirm = useConfirm();
+  // What the site shows while the field is empty, resolved as getConfig does:
+  // SITE_TITLE, else the site language's word for a gallery (QA A-15).
+  const fallbackTitle = siteTitleEnv || getDictionary(resolveLocale(settings.lang)).common.gallery;
   // Collapsed by default: the four metadata switches are a detail of one
   // decision, and showing them permanently is what made the section a wall (#510).
   const [metadataOpen, setMetadataOpen] = useState(false);
   const [faviconUploading, setFaviconUploading] = useState(false);
   const [faviconStatus, setFaviconStatus] = useState<SaveStatus>(null);
+  /** Bumped after an upload or reset so the preview fetches the new icon. */
+  const [faviconVersion, setFaviconVersion] = useState(0);
 
   // Resolved the same way the site resolves it, so the switches show what a
   // visitor actually sees — including a config that only ever set the older
@@ -62,8 +72,14 @@ export default function GeneralSection({ settings, update, updateMany }: Section
           id="general-site-title"
           value={settings.title || ''}
           onChange={(e) => update('title', e.target.value)}
-          placeholder="My Portfolio"
+          placeholder={fallbackTitle}
+          aria-describedby="general-site-title-hint"
         />
+        <p id="general-site-title-hint" className="admin-field-hint">
+          {settings.title
+            ? 'Shown in the header, the browser tab and link previews.'
+            : `Empty, so the site shows “${fallbackTitle}”${siteTitleEnv ? ', from SITE_TITLE' : ''}.`}
+        </p>
       </div>
       <div className="admin-field">
         <label htmlFor="general-subtitle">Subtitle</label>
@@ -136,6 +152,13 @@ export default function GeneralSection({ settings, update, updateMany }: Section
             checked={settings.proofing?.enabled !== false}
             onToggle={() => update('proofing.enabled', settings.proofing?.enabled === false)}
           />
+          <FeatureRow
+            icon={<Icons.IconSearch size={15} />}
+            title="Photo zoom"
+            description="Visitors zoom into a photo to full resolution (1:1) to check sharpness. Pages and albums can override this"
+            checked={settings.zoom === true}
+            onToggle={() => update('zoom', !settings.zoom)}
+          />
         </div>
         {/* Shown even while proofing is off globally: a subpage can switch it
             on for itself (`proofing: true`), so the address still has to be
@@ -249,12 +272,30 @@ export default function GeneralSection({ settings, update, updateMany }: Section
       </FeatureGroup>
 
       <div className="admin-field favicon-field">
-        <span className="admin-field-label">Favicon</span>
+        <span className="admin-field-label" id="favicon-label">
+          Favicon
+        </span>
         <div className="favicon-row">
+          {/* eslint-disable-next-line @next/next/no-img-element -- the site's own icon route, a 32px preview */}
+          <img
+            className="favicon-preview"
+            src={`/api/favicon?v=${faviconVersion}`}
+            alt="Current favicon"
+            width={32}
+            height={32}
+          />
+          {/* The native file input stays the control — focusable, keyboard
+              operable, announced as a file picker — but is visually hidden;
+              its label is drawn as the admin's secondary button, with the
+              focus ring passed through (QA A-18). */}
           <input
+            id="favicon-file"
+            className="favicon-file-input"
             type="file"
             accept=".svg,.png,.ico,.jpg,.jpeg"
             disabled={faviconUploading}
+            aria-labelledby="favicon-label favicon-file-button"
+            aria-describedby="favicon-hint"
             onChange={async (e) => {
               const file = e.target.files?.[0];
               if (!file) return;
@@ -273,6 +314,7 @@ export default function GeneralSection({ settings, update, updateMany }: Section
                     ? { kind: 'success', message: data.message }
                     : { kind: 'error', message: `Error: ${data.error}` },
                 );
+                if (res.ok) setFaviconVersion((v) => v + 1);
               } catch {
                 setFaviconStatus({ kind: 'error', message: 'Error: Upload failed' });
               } finally {
@@ -281,9 +323,16 @@ export default function GeneralSection({ settings, update, updateMany }: Section
               }
             }}
           />
+          <label
+            htmlFor="favicon-file"
+            id="favicon-file-button"
+            className="admin-btn admin-btn-sm admin-btn-secondary favicon-upload-btn"
+          >
+            <Icons.IconImage size={14} /> Upload icon
+          </label>
           <button
             type="button"
-            className="admin-btn"
+            className="admin-btn admin-btn-sm admin-btn-secondary"
             disabled={faviconUploading}
             onClick={async () => {
               // Deletes the uploaded file at once, outside the staged form.
@@ -304,6 +353,7 @@ export default function GeneralSection({ settings, update, updateMany }: Section
                     ? { kind: 'success', message: data.message }
                     : { kind: 'error', message: `Error: ${data.error}` },
                 );
+                if (res.ok) setFaviconVersion((v) => v + 1);
               } catch {
                 setFaviconStatus({ kind: 'error', message: 'Error: Reset failed' });
               } finally {
@@ -318,7 +368,7 @@ export default function GeneralSection({ settings, update, updateMany }: Section
         {faviconStatus && (
           <p className={`save-message ${faviconStatus.kind}`}>{faviconStatus.message}</p>
         )}
-        <span className="admin-field-hint">
+        <span id="favicon-hint" className="admin-field-hint">
           SVG, PNG, ICO, or JPEG — max 512 kB. Stored in the content volume. Reset restores the
           bundled default.
         </span>
diff --git a/app/admin/components/settings/LegalSection.tsx b/app/admin/components/settings/LegalSection.tsx
index cec6d78..0ff8a04 100644
--- a/app/admin/components/settings/LegalSection.tsx
+++ b/app/admin/components/settings/LegalSection.tsx
@@ -5,9 +5,10 @@ import ToggleCard from '../fields/ToggleCard';
 import PrivacyEditor from '../PrivacyEditor';
 import EnvLockNote from '../fields/EnvLockNote';
 import { CONTACT_RETENTION_DEFAULT, CONTACT_RETENTION_MAX, isHttpUrl } from '@/lib/config/schema';
+import { FieldError } from './fields';
 import type { SectionProps } from './types';
 
-export default function LegalSection({ settings, update, envLocks }: SectionProps) {
+export default function LegalSection({ settings, update, envLocks, fieldErrors }: SectionProps) {
   const notifyLock = envLocks?.['contact.notifyUrl'];
   // The Impressum drops a non-http(s) contact URL with a warning in the server
   // log, where nobody looks; say it here instead.
@@ -237,6 +238,14 @@ export default function LegalSection({ settings, update, envLocks }: SectionProp
                   parseInt(e.target.value) || CONTACT_RETENTION_DEFAULT,
                 )
               }
+              aria-invalid={fieldErrors?.['contact.retentionDays'] ? true : undefined}
+              aria-describedby={
+                fieldErrors?.['contact.retentionDays'] ? 'contact-retention-error' : undefined
+              }
+            />
+            <FieldError
+              id="contact-retention-error"
+              message={fieldErrors?.['contact.retentionDays']}
             />
           </div>
         </div>
diff --git a/app/admin/components/settings/ThemeSection.tsx b/app/admin/components/settings/ThemeSection.tsx
index 6412b9b..1f0d690 100644
--- a/app/admin/components/settings/ThemeSection.tsx
+++ b/app/admin/components/settings/ThemeSection.tsx
@@ -4,10 +4,10 @@ import { useState, type CSSProperties } from 'react';
 import * as Icons from '../Icons';
 import OptionGrid, { toOptions } from '../fields/OptionGrid';
 import { DEFAULT_PRESET } from '@/lib/config/theme';
+import { PRESET_IDS, PRESET_REGISTRY } from '@/lib/config/presets';
 import { effectiveTheme, FeatureRow, FieldError } from './fields';
 import type { SectionProps } from './types';
 
-const PRESETS = ['studio-modern', 'studio', 'minimal', 'editorial', 'classic', 'noir', 'monograph'];
 const PHOTO_FRAMES = ['none', 'passepartout', 'shadow'];
 const HERO_STYLES = ['split', 'fullbleed', 'minimal', 'stacked', 'typographic', 'mosaic', 'cover'];
 
@@ -36,7 +36,7 @@ const HERO_STYLE_INFO: Record<string, { label: string; desc: string }> = {
   fullbleed: { label: 'Fullbleed', desc: 'Edge-to-edge full width banner' },
   minimal: { label: 'Minimal', desc: 'Centered title with subtle photo' },
   stacked: { label: 'Stacked', desc: 'Title stacked directly over photo' },
-  typographic: { label: 'Typographic', desc: 'Oversized magazine masthead' },
+  typographic: { label: 'Typographic', desc: 'Oversized text masthead, no photos' },
   mosaic: { label: 'Mosaic', desc: 'Dynamic photo collage layout' },
   cover: {
     label: 'Cover (Experimental)',
@@ -79,15 +79,26 @@ function HeroStylePreview({ value }: { value: string }) {
             <div className="hero-demo-photo banner" />
           </>
         )}
+        {/* Text only, like the hero it stands for: the typographic hero
+            renders no photo, so the card must not promise any. */}
         {value === 'typographic' && (
           <>
             <div className="demo-line title giant" />
-            <div className="hero-demo-grid2">
-              <div className="hero-demo-photo" />
-              <div className="hero-demo-photo" />
+            <div className="demo-line sub" />
+            <div className="hero-demo-divider" />
+            <div className="hero-demo-nav">
+              <div className="demo-line" />
+              <div className="demo-line" />
+              <div className="demo-line" />
             </div>
           </>
         )}
+        {value === 'cover' && (
+          <div className="hero-demo-full hero-demo-cover-splash">
+            <div className="demo-line title light" />
+            <div className="hero-demo-enter" />
+          </div>
+        )}
         {value === 'mosaic' && (
           <div className="hero-demo-mosaic">
             <div className="hero-demo-photo big" />
@@ -103,9 +114,10 @@ function HeroStylePreview({ value }: { value: string }) {
 }
 
 /**
- * Card metadata for the theme picker. `font`, `radius` and `frame` mirror the
- * real preset definitions in lib/config/theme.ts so the mini mockups show what
- * the preset actually does; `gap` is the visual density of its gallery grid.
+ * Card metadata for the theme picker, from the preset registry
+ * (lib/config/presets.ts). `font`, `radius` and `frame` are the preset's own
+ * values so the mini mockups show what the preset actually does; `gap` is the
+ * visual density of its gallery grid.
  */
 const THEME_INFO: Record<
   string,
@@ -121,92 +133,19 @@ const THEME_INFO: Record<
     frame: 'none' | 'passepartout' | 'shadow';
     gap: number;
   }
-> = {
-  studio: {
-    label: 'Studio',
-    desc: 'Clean, high-contrast grid with sans-serif type.',
-    bg: '#141414',
-    tile: '#242424',
-    accent: '#e60012',
-    font: 'Playfair Display',
-    type: 'serif',
-    radius: 0,
-    frame: 'passepartout',
-    gap: 4,
-  },
-  'studio-modern': {
-    label: 'Studio Modern',
-    desc: 'Leica precision: Archivo grotesque, mono EXIF, red signal accents.',
-    bg: '#121212',
-    tile: '#191919',
-    accent: '#e60012',
-    font: 'Archivo',
-    type: 'sans',
-    radius: 0,
-    frame: 'none',
-    gap: 3,
-  },
-  minimal: {
-    label: 'Minimal',
-    desc: 'Pure raw layouts with tiny gaps and high whitespace.',
-    bg: '#ffffff',
-    tile: '#f3f3f3',
-    accent: '#111111',
-    font: 'Geist',
-    type: 'sans',
-    radius: 0,
-    frame: 'none',
-    gap: 2,
-  },
-  editorial: {
-    label: 'Editorial',
-    desc: 'Warm backgrounds, elegant serifs and large headers.',
-    bg: '#fbf9f4',
-    tile: '#e5dfd4',
-    accent: '#b89053',
-    font: 'Bodoni Moda',
-    type: 'serif',
-    radius: 0,
-    frame: 'shadow',
-    gap: 8,
-  },
-  classic: {
-    label: 'Classic',
-    desc: 'Soft traditional photographer portfolio with shadows.',
-    bg: '#f7f7f7',
-    tile: '#ffffff',
-    accent: '#444444',
-    font: 'Cinzel',
-    type: 'serif',
-    radius: 12,
-    frame: 'passepartout',
-    gap: 7,
-  },
-  noir: {
-    label: 'Noir',
-    desc: 'High drama absolute pitch black, stark high-fashion look.',
-    bg: '#000000',
-    tile: '#151515',
-    accent: '#ffffff',
-    font: 'Libre Baskerville',
-    type: 'serif',
-    radius: 0,
-    frame: 'passepartout',
-    gap: 6,
-  },
-  monograph: {
-    label: 'Monograph',
-    desc: 'Typewriter monospace font, grid borders and document feel.',
-    bg: '#f4f4f6',
-    tile: '#ffffff',
-    accent: '#555555',
-    font: 'Instrument Serif',
-    type: 'mono',
-    radius: 0,
-    frame: 'none',
-    gap: 5,
-  },
-};
+> = Object.fromEntries(
+  PRESET_REGISTRY.map((p) => [
+    p.id,
+    {
+      label: p.label,
+      desc: p.description,
+      ...p.card,
+      font: p.theme.fonts.heading,
+      radius: p.theme.radius,
+      frame: p.theme.photoFrame,
+    },
+  ]),
+);
 
 /* The preset group sits below THEME_INFO on purpose. PRESET_OPTIONS is built
    at module evaluation and reads it through themeInfo(); declared above, it
@@ -232,7 +171,7 @@ function themeInfo(value: string) {
   );
 }
 
-const PRESET_OPTIONS = PRESETS.map((value) => ({
+const PRESET_OPTIONS = PRESET_IDS.map((value) => ({
   value,
   label: themeInfo(value).label,
   desc: themeInfo(value).desc,
diff --git a/app/admin/components/settings/types.ts b/app/admin/components/settings/types.ts
index c9824d2..72f790c 100644
--- a/app/admin/components/settings/types.ts
+++ b/app/admin/components/settings/types.ts
@@ -25,6 +25,8 @@ export interface Settings {
   transitions?: boolean;
   scrollToTop?: boolean;
   analytics?: boolean;
+  /** Lightbox zoom to full resolution (#467); off unless true. */
+  zoom?: boolean;
   theme?: {
     preset?: string;
     accent?: string;
diff --git a/app/admin/styles/analytics.css b/app/admin/styles/analytics.css
index 4d5c293..368a3dd 100644
--- a/app/admin/styles/analytics.css
+++ b/app/admin/styles/analytics.css
@@ -7,7 +7,6 @@
   display: flex;
   flex-direction: column;
   gap: 1.5rem;
-  max-width: 1100px;
 }
 
 .analytics-header {
@@ -54,11 +53,15 @@
   color: var(--admin-text-muted);
 }
 
+/* Set like the Overview's stat numbers. `--font-mono` was never defined, so
+   these fell through to the browser's bare `monospace`. Tabular figures keep
+   the digits aligned without it. */
 .metric-value {
   font-size: 1.8rem;
-  font-weight: 700;
+  font-weight: 500;
+  letter-spacing: -0.02em;
   color: var(--admin-text);
-  font-family: var(--font-mono, monospace);
+  font-variant-numeric: tabular-nums;
 }
 
 .metric-sub {
@@ -138,7 +141,8 @@
   font-size: 0.68rem;
   color: var(--admin-text-muted);
   margin-top: 0.5rem;
-  font-family: var(--font-mono, monospace);
+  font-variant-numeric: tabular-nums;
+  white-space: nowrap;
 }
 
 .analytics-top-pages {
@@ -154,14 +158,17 @@
 }
 
 .page-rank {
+  flex-shrink: 0;
   font-size: 0.8rem;
-  font-family: var(--font-mono, monospace);
+  font-variant-numeric: tabular-nums;
   color: var(--admin-text-muted);
   width: 24px;
 }
 
+/* min-width: 0 lets a long path wrap instead of pushing the page sideways. */
 .page-info {
   flex: 1;
+  min-width: 0;
   display: flex;
   flex-direction: column;
   gap: 0.35rem;
@@ -169,17 +176,23 @@
 
 .page-path-line {
   display: flex;
-  align-items: center;
+  align-items: baseline;
   justify-content: space-between;
+  gap: 0.75rem;
   font-size: 0.85rem;
 }
 
+/* Paths are the one thing here set in monospace, as slugs are elsewhere. */
 .page-path {
-  font-family: var(--font-mono, monospace);
+  min-width: 0;
+  overflow-wrap: anywhere;
+  font-family: var(--font-mono, ui-monospace, 'SF Mono', Menlo, monospace);
   color: var(--admin-text);
 }
 
 .page-count {
+  flex-shrink: 0;
+  white-space: nowrap;
   font-size: 0.75rem;
   color: var(--admin-text-muted);
 }
@@ -202,6 +215,32 @@
   transition: width 0.3s ease;
 }
 
+/* Phone width (QA A-18). The page was 513px wide at 390: a long path could
+   not wrap (fixed above), and fourteen "09-19" labels broke over two lines
+   under bars squeezed by 12px gaps. Panel padding and gaps tighten, and the
+   label drops the month, which every bar's title still carries. */
+@media (max-width: 640px) {
+  .analytics-panel {
+    padding: 1.25rem 1rem;
+  }
+
+  .analytics-bar-chart {
+    gap: 0.2rem;
+  }
+
+  .bar-col {
+    min-width: 0;
+  }
+
+  .bar-label-month {
+    display: none;
+  }
+
+  .top-page-row {
+    gap: 0.6rem;
+  }
+}
+
 .analytics-empty {
   margin: 0;
   padding: 2rem 1rem;
diff --git a/app/admin/styles/buttons.css b/app/admin/styles/buttons.css
index d5f47ab..0719bfd 100644
--- a/app/admin/styles/buttons.css
+++ b/app/admin/styles/buttons.css
@@ -85,6 +85,13 @@
   color: #fca5a5;
 }
 
+/* Small buttons carry short action labels ("+ Add Album", "Pick several");
+   broken over two lines in a tight row they read as two buttons. */
+.admin-btn-sm,
+.admin-btn-xs {
+  white-space: nowrap;
+}
+
 .admin-btn-sm {
   padding: 0 0.8rem;
   min-height: 30px;
diff --git a/app/admin/styles/diagnostics.css b/app/admin/styles/diagnostics.css
index c9aa82f..22551fd 100644
--- a/app/admin/styles/diagnostics.css
+++ b/app/admin/styles/diagnostics.css
@@ -3,9 +3,9 @@
 /* Each check is one line with a severity dot: the point is scanning a list for
    the ones that are not green, not reading prose. Green ones recede. */
 
+/* Fills the shared content column (--admin-content-width); the check details
+   keep their own 70ch measure below. */
 .diag-page {
-  max-width: 880px;
-  margin: 0 auto;
   display: flex;
   flex-direction: column;
   gap: 1.5rem;
diff --git a/app/admin/styles/favicon.css b/app/admin/styles/favicon.css
index 787123c..1860d60 100644
--- a/app/admin/styles/favicon.css
+++ b/app/admin/styles/favicon.css
@@ -9,11 +9,62 @@
 }
 
 .favicon-row {
+  position: relative;
   display: flex;
+  flex-wrap: wrap;
   align-items: center;
   gap: 0.5rem;
 }
 
-.favicon-row input[type='file'] {
-  font-size: 0.8rem;
+/* The current icon, on the input surface so a dark or a light icon both show. */
+.favicon-preview {
+  width: 32px;
+  height: 32px;
+  padding: 4px;
+  box-sizing: content-box;
+  object-fit: contain;
+  background: var(--admin-bg-input);
+  border: 1px solid var(--admin-border);
+  border-radius: 6px;
+}
+
+/* The native input stays in the tab order and the accessibility tree but out
+   of sight: its "Choose File / No file chosen" box was the one raw browser
+   control left in the admin (QA A-18). The label below is what is seen.
+   Doubled class to outrank `.admin-field input`, which sizes every input. */
+.admin-field .favicon-file-input.favicon-file-input {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip: rect(0 0 0 0);
+  clip-path: inset(50%);
+  white-space: nowrap;
+  border: 0;
+}
+
+/* A <label>, so `.admin-field label` (block, uppercase caption) reaches it
+   too; this puts the button back. */
+.admin-field .favicon-upload-btn {
+  display: inline-flex;
+  margin: 0;
+  font-size: 0.8rem;
+  font-weight: 500;
+  letter-spacing: normal;
+  text-transform: none;
+  cursor: pointer;
+}
+
+/* Focus lands on the hidden input; the ring is drawn on its label. */
+.favicon-file-input:focus-visible + .favicon-upload-btn {
+  outline: var(--admin-focus-ring);
+  outline-offset: 2px;
+}
+
+.favicon-file-input:disabled + .favicon-upload-btn {
+  opacity: 0.5;
+  cursor: not-allowed;
+  pointer-events: none;
 }
diff --git a/app/admin/styles/messages.css b/app/admin/styles/messages.css
index 654c3a5..e2612a8 100644
--- a/app/admin/styles/messages.css
+++ b/app/admin/styles/messages.css
@@ -4,7 +4,6 @@
   display: flex;
   flex-direction: column;
   gap: 1.25rem;
-  max-width: 900px;
 }
 
 .messages-count {
@@ -113,6 +112,7 @@
 }
 
 .messages-text {
+  max-width: 70ch;
   margin: 0 0 1rem;
   white-space: pre-wrap;
   line-height: 1.55;
diff --git a/app/admin/styles/redesign.css b/app/admin/styles/redesign.css
index af1545d..21d48b4 100644
--- a/app/admin/styles/redesign.css
+++ b/app/admin/styles/redesign.css
@@ -27,6 +27,14 @@
   --admin-sidebar-bg: #090909;
   --admin-radius: 4px;
   --admin-sidebar-width: 232px;
+  /* The one outer content column every workspace screen shares. Pages,
+     Overview and Diagnostics used to end at three different right edges
+     (QA A-18). Up to a 1592px window every screen simply fills the
+     workspace; wider, they all stop here instead of each at its own cap.
+     Text inside keeps its own narrower measure (the 70ch details). Only the
+     split editors (journal, content pages) break out of it. */
+  --admin-content-width: 1280px;
+  --admin-workspace-pad-x: 2.5rem;
   font-family: var(--admin-font);
 }
 
@@ -276,8 +284,8 @@
 }
 
 .admin-workspace {
-  max-width: 1180px;
-  padding: 2.25rem 2.5rem 6rem;
+  max-width: calc(var(--admin-content-width) + 2 * var(--admin-workspace-pad-x));
+  padding: 2.25rem var(--admin-workspace-pad-x) 6rem;
   margin: 0;
 }
 
@@ -338,21 +346,26 @@
 
 /* Section and field labels in the site's caption voice. */
 .admin-layout .admin-field > label,
-.admin-layout .settings-group-title,
-.admin-layout .analytics-section-title h3 {
+.admin-layout .settings-group-title {
   font-family: var(--admin-font-label);
   letter-spacing: 0.12em;
 }
 
+/* Panel headings are headings, not captions: the caption font made the
+   analytics titles a mixed-case line of monospace (QA A-18). They read like
+   the settings section headings; monospace stays with the paths. */
 .admin-layout .settings-section-header h3,
-.admin-layout .analytics-header h2 {
+.admin-layout .analytics-header h2,
+.admin-layout .analytics-section-title h3 {
+  font-family: var(--admin-font);
   font-weight: 500;
   letter-spacing: -0.01em;
 }
 
 /* Section icons stay neutral; the accent is not decoration. */
 .admin-layout .settings-section-header h3 svg,
-.admin-layout .analytics-header h2 svg {
+.admin-layout .analytics-header h2 svg,
+.admin-layout .analytics-section-title h3 svg {
   color: var(--admin-text-muted);
 }
 
@@ -463,6 +476,7 @@
 
 .overview-attention-detail {
   display: block;
+  max-width: 70ch;
   margin-top: 0.15rem;
   color: var(--admin-text-muted);
   font-size: 0.8rem;
@@ -625,8 +639,8 @@
 /* The journal list is an ordinary screen and gets the workspace column; only
    the editor (split view) needs the full width journal-studio.css gives it. */
 .admin-app .admin-main:has(> .journal-studio) {
-  max-width: 1180px;
-  padding: 2.25rem 2.5rem 6rem;
+  max-width: calc(var(--admin-content-width) + 2 * var(--admin-workspace-pad-x));
+  padding: 2.25rem var(--admin-workspace-pad-x) 6rem;
 }
 
 @media (max-width: 860px) {
@@ -701,12 +715,6 @@
 
 /* ── Page builder: structure list + panel (stage 4) ────────── */
 
-/* The builder uses the full workspace width: the list and the panel both
-   need room, and the panel carries the live preview. */
-.admin-app .admin-main:has(.pb-split) {
-  max-width: none;
-}
-
 .pb-split {
   display: grid;
   grid-template-columns: 300px minmax(0, 1fr);
diff --git a/app/admin/styles/settings-editor.css b/app/admin/styles/settings-editor.css
index 811dbfe..5697ba0 100644
--- a/app/admin/styles/settings-editor.css
+++ b/app/admin/styles/settings-editor.css
@@ -52,6 +52,9 @@
 
 .settings-content {
   min-width: 0;
+  /* Room below the last input for the floating save bar (fixed, ~4rem tall
+     at 1.5rem from the bottom), so it never sits on top of a field. */
+  padding-bottom: 6rem;
 }
 
 .settings-panel h3 {
diff --git a/app/admin/styles/shell.css b/app/admin/styles/shell.css
index c685ca9..aaedee4 100644
--- a/app/admin/styles/shell.css
+++ b/app/admin/styles/shell.css
@@ -81,7 +81,7 @@
   flex: 1;
   /* Extra bottom padding so the floating save bar never covers page content. */
   padding: 1.5rem 1.5rem 6rem;
-  max-width: 1120px;
+  max-width: calc(var(--admin-content-width) + 3rem);
   margin: 0 auto;
   width: 100%;
 }
diff --git a/app/admin/styles/theme-cards.css b/app/admin/styles/theme-cards.css
index a772d3d..afe94a1 100644
--- a/app/admin/styles/theme-cards.css
+++ b/app/admin/styles/theme-cards.css
@@ -142,12 +142,46 @@
 
 .hero-demo-typographic {
   flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 0.25rem;
 }
 
-.hero-demo-grid2 {
+.hero-demo-typographic .demo-line.title.giant {
+  height: 10px;
+  margin-bottom: 0;
+}
+
+.hero-demo-divider {
+  width: 12%;
+  height: 1px;
+  margin: 0.1rem 0;
+  background: var(--admin-text-muted);
+}
+
+.hero-demo-nav {
   display: flex;
-  gap: 0.25rem;
-  flex: 1;
+  flex-direction: column;
+  align-items: center;
+  gap: 0.2rem;
+  width: 100%;
+}
+
+.hero-demo-nav .demo-line {
+  width: 30%;
+  height: 2px;
+}
+
+.hero-demo-cover-splash {
+  flex-direction: column;
+  gap: 0.3rem;
+}
+
+.hero-demo-enter {
+  width: 22%;
+  height: 6px;
+  border: 1px solid #ffffff;
+  border-radius: 2px;
 }
 
 .hero-demo-mosaic {
@@ -322,6 +356,31 @@
   box-shadow: 0 2px 8px rgba(0, 0, 0, 0.2);
 }
 
+.segment-btn:focus-visible {
+  outline: var(--admin-focus-ring);
+  outline-offset: 1px;
+}
+
+/* Compact size for toolbars: the editor's Visual Blocks / Raw Markdown, its
+   preview's Desktop / Mobile and the subpage drawer's Edit / Live Preview.
+   Replaces the inline padding the drawer used to carry. */
+.segmented-control--sm {
+  padding: 2px;
+  gap: 2px;
+  border-radius: 8px;
+}
+
+.segmented-control--sm .segment-btn {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.35rem;
+  padding: 0.2rem 0.6rem;
+  min-height: 24px;
+  font-size: 0.75rem;
+  border-radius: 6px;
+  white-space: nowrap;
+}
+
 /* Accent Color Swatches */
 .accent-picker-wrapper {
   display: flex;
diff --git a/app/api/__tests__/site-gate.test.ts b/app/api/__tests__/site-gate.test.ts
index 6fb3158..1e8859b 100644
--- a/app/api/__tests__/site-gate.test.ts
+++ b/app/api/__tests__/site-gate.test.ts
@@ -38,9 +38,30 @@ const config = {
   albumPasswords: {},
   theme: { accent: '#e60012', fonts: { heading: 'Inter', body: 'Inter', caption: 'Inter' } },
   contact: { enabled: true, retentionDays: 90 },
+  legal: { enabled: true },
+  privacy: { enabled: true },
   siteUrl: null,
+  // Past the gate, /api/analytics/track would write content/analytics.json in
+  // the checkout; turned off, it answers without writing. The gate runs first,
+  // so the locked-site rows still exercise it.
+  analytics: false,
 };
 
+/*
+ * The contact route stores what it accepts under content/messages/ and pushes
+ * to contact.notifyUrl. Both are replaced here, so an accepted submission
+ * touches neither the checkout's content/ directory nor the network;
+ * validateContact stays real, honeypot and fill-time check included.
+ */
+const contactStore = vi.hoisted(() => ({
+  saveMessage: vi.fn(async (fields: Record<string, string>) => ({ id: 'x', ...fields })),
+  notifyNewMessage: vi.fn(async () => {}),
+}));
+vi.mock('@/lib/contact', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@/lib/contact')>()),
+  ...contactStore,
+}));
+
 vi.mock('@/lib/config', () => ({
   getConfig: () => config,
   getConfigOrNull: () => config,
@@ -99,6 +120,15 @@ const GATED: { name: string; call: () => Promise<Response> }[] = [
         { params: Promise.resolve({ album: 'tok', id: 'tok' }) } as never,
       ),
   },
+  {
+    // The lightbox zoom's full-resolution file (#467).
+    name: 'GET /api/zoom/[album]/[id]',
+    call: async () =>
+      (await import('../zoom/[album]/[id]/route')).GET(
+        request('/api/zoom/tok/tok') as never,
+        { params: Promise.resolve({ album: 'tok', id: 'tok' }) } as never,
+      ),
+  },
   // Client proofing links: the site password applies to clients as well.
   {
     name: 'PUT /api/proof/[token]/selection',
@@ -128,11 +158,15 @@ const GATED: { name: string; call: () => Promise<Response> }[] = [
       ),
   },
   {
-    // Stores whatever a visitor sends; a locked site accepts nothing from strangers.
-    name: 'POST /api/contact',
+    // Writes visitor-chosen paths into content/analytics.json. It used to be
+    // OPEN "to count the gate", but the layout mounts no tracker on the gate.
+    name: 'POST /api/analytics/track',
     call: async () =>
-      (await import('../contact/route')).POST(
-        new NextRequest('http://localhost/api/contact', { method: 'POST', body: '{}' }) as never,
+      (await import('../analytics/track/route')).POST(
+        new NextRequest('http://localhost/api/analytics/track', {
+          method: 'POST',
+          body: '{"path":"/"}',
+        }) as never,
       ),
   },
 ];
@@ -152,7 +186,8 @@ const OPEN: Record<string, string> = {
   install: 'the first-run wizard; setup-token gated, refuses once installed',
   'install/albums': 'the first-run wizard; setup-token gated, refuses once installed',
   webhook: 'server-to-server from Immich, HMAC-verified',
-  'analytics/track': 'counts a view of the gate itself; returns no content',
+  contact:
+    'the Impressum links the form as its second contact channel, and /contact is served to a locked site',
 };
 
 /** `GET /api/download/[album]/[id]` → `download/[album]/[id]`. */
@@ -253,6 +288,58 @@ describe('routes that must stay open', () => {
 
   // The password gate is set in the theme's fonts; locking them would render
   // the gate itself in fallback fonts. Three public font names give nothing away.
+  describe('POST /api/contact on a locked site', () => {
+    /** Own rate-limit bucket per case: the route allows three a minute per IP. */
+    const submit = (ip: string, fields: Record<string, unknown>) =>
+      import('../contact/route').then(({ POST }) =>
+        POST(
+          new NextRequest('http://localhost/api/contact', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'x-real-ip': ip },
+            body: JSON.stringify(fields),
+          }) as never,
+        ),
+      );
+    const valid = () => ({
+      name: 'Erika',
+      email: 'erika@example.com',
+      message: 'Wer betreibt diese Seite?',
+      website: '',
+      startedAt: Date.now() - 10_000,
+    });
+
+    beforeEach(() => {
+      config.sitePassword = 'letmein';
+      contactStore.saveMessage.mockClear();
+    });
+
+    // The Impressum links the form as its second contact channel, and the
+    // proxy serves /contact to a locked site; the endpoint has to take the post.
+    it('accepts a valid message without a session', async () => {
+      const res = await submit('10.0.0.1', valid());
+      expect(res.status).toBe(200);
+      expect(await res.json()).toEqual({ ok: true });
+      expect(contactStore.saveMessage).toHaveBeenCalledTimes(1);
+    });
+
+    it('still drops a filled honeypot and a form sent too fast, unsaved', async () => {
+      expect((await submit('10.0.0.2', { ...valid(), website: 'spam.example' })).status).toBe(200);
+      expect((await submit('10.0.0.2', { ...valid(), startedAt: Date.now() })).status).toBe(200);
+      expect(contactStore.saveMessage).not.toHaveBeenCalled();
+    });
+
+    it('still refuses an invalid message', async () => {
+      const res = await submit('10.0.0.3', { ...valid(), email: 'not-an-address' });
+      expect(res.status).toBe(400);
+      expect(contactStore.saveMessage).not.toHaveBeenCalled();
+    });
+
+    it('still rate-limits at three a minute', async () => {
+      for (let i = 0; i < 3; i++) expect((await submit('10.0.0.4', valid())).status).toBe(200);
+      expect((await submit('10.0.0.4', valid())).status).toBe(429);
+    });
+  });
+
   it('GET /api/fonts/css answers a locked site', async () => {
     config.sitePassword = 'letmein';
     const res = await (
@@ -271,3 +358,49 @@ describe('routes that must stay open', () => {
     expect(res.status).not.toBe(401);
   });
 });
+
+/*
+ * The pages, not the route handlers: proxy.ts gates those. Driven through the
+ * real lib/auth here, with the password set, rather than through a mocked
+ * isSiteUnlocked() as in lib/__tests__/proxy.test.ts.
+ */
+describe('legal and contact pages on a locked site', () => {
+  const page = async (path: string, cookie?: string) =>
+    (await import('@/proxy')).proxy(
+      new NextRequest(`http://localhost${path}`, cookie ? { headers: { cookie } } : {}),
+    );
+  const rewrittenTo = (res: Response) => res.headers.get('x-middleware-rewrite');
+
+  beforeEach(() => {
+    config.sitePassword = 'letmein';
+    config.legal.enabled = true;
+    config.privacy.enabled = true;
+    config.contact.enabled = true;
+  });
+
+  // The gate page is public and links both. A German Impressum has to be
+  // reachable directly, and neither page carries an album name or asset token.
+  it.each(['/impressum', '/privacy', '/contact'])(
+    '%s is served without the password',
+    async (path) => {
+      expect(rewrittenTo(await page(path))).toBeNull();
+    },
+  );
+
+  it('every other page is still rewritten to the gate', async () => {
+    for (const path of ['/', '/japan', '/journal', '/about', '/contact/x', '/impressum/x']) {
+      expect(rewrittenTo(await page(path)), path).toContain('/gate');
+    }
+  });
+
+  it('a switched-off legal or contact page is still a 404, not the gate', async () => {
+    config.legal.enabled = false;
+    config.privacy.enabled = false;
+    config.contact.enabled = false;
+    for (const path of ['/impressum', '/privacy', '/contact']) {
+      const res = await page(path);
+      expect(rewrittenTo(res), path).toBeNull();
+      expect(res.status, path).toBe(404);
+    }
+  });
+});
diff --git a/app/api/admin/__tests__/about-backup.test.ts b/app/api/admin/__tests__/about-backup.test.ts
index b278129..9dfa952 100644
--- a/app/api/admin/__tests__/about-backup.test.ts
+++ b/app/api/admin/__tests__/about-backup.test.ts
@@ -17,9 +17,9 @@ const fsMock = vi.hoisted(() => ({
   copyFile: vi.fn(async () => undefined),
   readdir: vi.fn(async () => []),
   unlink: vi.fn(async () => undefined),
-  writeFile: vi.fn(async () => undefined),
+  writeFile: vi.fn(async (..._args: unknown[]) => undefined),
   rename: vi.fn(async () => undefined),
-  readFile: vi.fn(async () => {
+  readFile: vi.fn(async (..._args: unknown[]): Promise<Buffer> => {
     throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' });
   }),
 }));
@@ -43,13 +43,14 @@ const put = (body: unknown) =>
  * brand-new file and the save went ahead with no snapshot (#630).
  */
 describe('PUT /api/admin/about backup handling', () => {
-  beforeEach(() => vi.clearAllMocks());
+  beforeEach(() => {
+    vi.clearAllMocks();
+    fs.readFile.mockImplementation(async () => {
+      throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' });
+    });
+  });
 
   it('saves a brand-new file with no backup', async () => {
-    vi.mocked(fs.access).mockRejectedValueOnce(
-      Object.assign(new Error('ENOENT'), { code: 'ENOENT' }),
-    );
-
     const res = await put({ meta: { name: 'Me' }, body: 'Hello' });
 
     expect(res.status).toBe(200);
@@ -58,6 +59,7 @@ describe('PUT /api/admin/about backup handling', () => {
   });
 
   it('aborts the save when the file exists but the backup copy fails', async () => {
+    vi.mocked(fs.readFile).mockResolvedValue(Buffer.from('---\nname: Old\n---\n'));
     vi.mocked(fs.copyFile).mockRejectedValueOnce(
       Object.assign(new Error('EACCES'), { code: 'EACCES' }),
     );
@@ -65,4 +67,15 @@ describe('PUT /api/admin/about backup handling', () => {
     await expect(put({ meta: { name: 'Me' }, body: 'Hello' })).rejects.toThrow('EACCES');
     expect(fs.writeFile).not.toHaveBeenCalled();
   });
+
+  it('takes no backup for a save that changes nothing (QA A-19)', async () => {
+    await put({ meta: { name: 'Me' }, body: 'Hello' });
+    const written = vi.mocked(fs.writeFile).mock.calls[0][1] as string;
+    vi.mocked(fs.writeFile).mockClear();
+
+    vi.mocked(fs.readFile).mockResolvedValue(Buffer.from(written));
+    const res = await put({ meta: { name: 'Me' }, body: 'Hello' });
+    expect(res.status).toBe(200);
+    expect(fs.copyFile).not.toHaveBeenCalled();
+  });
 });
diff --git a/app/api/admin/__tests__/doctor-zoom.test.ts b/app/api/admin/__tests__/doctor-zoom.test.ts
new file mode 100644
index 0000000..530d84f
--- /dev/null
+++ b/app/api/admin/__tests__/doctor-zoom.test.ts
@@ -0,0 +1,102 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+/**
+ * The doctor's zoom check (#467) samples one photo that zoom serves through
+ * Immich's full-size rendition. A rendition in a format the zoom route refuses
+ * (WebP) is not "fine" — the doctor used to say OK because one existed.
+ */
+
+vi.mock('@/lib/admin/auth', () => ({
+  isAdminEnabled: () => true,
+  isAdminAuthenticated: async () => true,
+  COOKIE_NAME: 'folio_admin_session',
+}));
+
+const ALBUM = '11111111-1111-1111-1111-111111111111';
+const config = {
+  needsCredentials: false,
+  trustedProxyHops: 0,
+  authSecret: 'x'.repeat(64),
+  albums: [ALBUM],
+  standaloneAlbums: [ALBUM],
+  standaloneAlbumZoom: {},
+  zoom: true,
+  albumOverrides: {},
+  albumDownloads: {},
+  subpages: [],
+  albumPasswords: {},
+  sitePassword: '',
+  immich: { apiUrl: 'https://immich.example/api', apiKey: 'key' },
+  immichTimeoutMs: 1000,
+  legal: { enabled: false, name: '', address: '', zipCity: '', country: '' },
+  contact: { enabled: false, retentionDays: 90 },
+  privacy: { enabled: true },
+};
+
+vi.mock('@/lib/config', () => ({
+  getConfig: () => config,
+  slugify: (name: string) => name.toLowerCase().replace(/[^a-z0-9]+/g, '-'),
+}));
+vi.mock('@/lib/env', () => ({ env: { AUTH_SECRET: 'x'.repeat(64) } }));
+vi.mock('@/lib/admin/journal-service', () => ({ listJournalEntries: async () => [] }));
+vi.mock('@/lib/admin/yaml-service', () => ({ readSettingsYaml: async () => null }));
+
+const immichMock = vi.hoisted(() => ({ getAlbum: vi.fn(), streamFullsize: vi.fn() }));
+vi.mock('@/lib/immich', () => ({ immich: immichMock }));
+
+import { GET } from '../doctor/route';
+import { NextRequest } from 'next/server';
+
+const zoomFinding = async () => {
+  const body = await (await GET(new NextRequest('http://localhost/api/admin/doctor'))).json();
+  return body.findings.find((f: { id: string }) => f.id === 'zoom-renditions');
+};
+
+const rendition = (contentType: string) => ({
+  stream: new ReadableStream(),
+  contentType,
+  contentLength: '10',
+});
+
+beforeEach(() => {
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async (url: string) =>
+      url.includes('/albums')
+        ? ({ ok: true, json: async () => [{ id: ALBUM, albumName: 'Trip' }] } as Response)
+        : ({ ok: true, json: async () => ({}) } as Response),
+    ),
+  );
+  immichMock.getAlbum.mockResolvedValue({
+    id: ALBUM,
+    albumName: 'Trip',
+    assets: [{ id: 'heic', type: 'IMAGE', originalMimeType: 'image/heic' }],
+  });
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.clearAllMocks();
+});
+
+describe('GET /api/admin/doctor — zoom renditions', () => {
+  it('is OK for a JPEG rendition', async () => {
+    immichMock.streamFullsize.mockResolvedValue(rendition('image/jpeg'));
+    expect((await zoomFinding())?.level).toBe('ok');
+    expect(immichMock.streamFullsize).toHaveBeenCalledWith('heic');
+  });
+
+  it('warns when Immich has none', async () => {
+    immichMock.streamFullsize.mockResolvedValue(null);
+    const finding = await zoomFinding();
+    expect(finding?.level).toBe('warn');
+    expect(finding?.title).toMatch(/no full-size preview/);
+  });
+
+  it('warns, asking for JPEG, when the rendition is WebP (review of #830)', async () => {
+    immichMock.streamFullsize.mockResolvedValue(rendition('image/webp'));
+    const finding = await zoomFinding();
+    expect(finding?.level).toBe('warn');
+    expect(finding?.title).toMatch(/not JPEG/);
+  });
+});
diff --git a/app/api/admin/about/route.ts b/app/api/admin/about/route.ts
index 9879b90..184db5b 100644
--- a/app/api/admin/about/route.ts
+++ b/app/api/admin/about/route.ts
@@ -6,6 +6,7 @@ import path from 'path';
 import yaml from 'js-yaml';
 import { atomicWrite } from '@/lib/atomicWrite';
 import {
+  needsBackup,
   VersionConflictError,
   assertVersion,
   baseVersionFrom,
@@ -90,15 +91,8 @@ export const PUT = withAdmin(async (request: Request) => {
       // brand-new file: the save went ahead with no snapshot taken (#630). Only
       // ENOENT means there is nothing to back up; anything else aborts the save
       // before it overwrites the live file.
-      let fileExists = true;
-      try {
-        await fs.access(filePath);
-      } catch (err) {
-        if ((err as NodeJS.ErrnoException & { code?: string }).code !== 'ENOENT') throw err;
-        fileExists = false;
-      }
-
-      if (fileExists) {
+      // A save that changes nothing takes no backup either (needsBackup).
+      if (await needsBackup(filePath, content)) {
         const backupDir = path.join(CONTENT_DIR, '.backups');
         await fs.mkdir(backupDir, { recursive: true });
         const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
diff --git a/app/api/admin/doctor/route.ts b/app/api/admin/doctor/route.ts
index 2cf2ef1..dcc8211 100644
--- a/app/api/admin/doctor/route.ts
+++ b/app/api/admin/doctor/route.ts
@@ -3,6 +3,9 @@ import { withAdmin } from '@/lib/admin/withAdmin';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { getConfig, slugify } from '@/lib/config';
+// From the pure schema module, like lib/auth.ts: tests stub the config barrel.
+import { resolveZoom } from '@/lib/config/schema';
+import { ZOOM_CONTENT_TYPES, zoomSourceFor } from '@/lib/zoomSource';
 import { env } from '@/lib/env';
 import { listJournalEntries } from '@/lib/admin/journal-service';
 import { readSettingsYaml } from '@/lib/admin/yaml-service';
@@ -11,6 +14,8 @@ import { readPrivacy } from '@/lib/privacy';
 import { listPageSlugsSync } from '@/lib/admin/pages-service';
 import { takenPageSlugs } from '@/lib/admin/pageSlugs';
 import { describeCollision, menuPageSlugs, pageSlugCollision } from '@/lib/pages';
+import { immich } from '@/lib/immich';
+import { isLocationScrubbable } from '@/lib/locationScrub';
 import {
   checkAlbumIds,
   checkAlbumSlugCollisions,
@@ -20,21 +25,26 @@ import {
   checkImmichCalls,
   checkContact,
   checkContentPages,
+  checkDownloadMetadata,
   checkLegal,
   checkPrivacy,
   checkSettingValues,
   checkPasswords,
   checkProxyHops,
   checkWritable,
+  checkZoomRenditions,
   countForwardedHops,
   PROXY_MARKER_HEADERS,
   worstLevel,
   type AlbumRef,
   type AlbumSlugGroup,
   type DoctorFinding,
+  type DownloadAlbumRef,
   type ContactRef,
   type LegalRef,
   type PasswordRef,
+  type ZoomAlbumRef,
+  type ZoomRenditionSample,
 } from '@/lib/admin/doctor';
 
 /**
@@ -130,6 +140,81 @@ export const GET = withAdmin(async (request: NextRequest) => {
         })),
       ];
       findings.push(checkAlbumSlugCollisions(slugGroups, config.albumOverrides, albums, slugify));
+
+      // Originals whose metadata a download cannot clean. Through the album
+      // cache, like the alt-text report; an album that cannot be read is
+      // already reported above and is skipped here.
+      const downloadAlbums: DownloadAlbumRef[] = [];
+      for (const id of config.albums.filter((albumId) => config.albumDownloads?.[albumId])) {
+        try {
+          const album = await immich.getAlbum(id);
+          if (!album) continue;
+          const uncleanable = album.assets.filter((asset) => !isLocationScrubbable(asset));
+          downloadAlbums.push({
+            id,
+            albumName: album.albumName,
+            uncleanable: uncleanable.length,
+            uncleanableWithLocation: uncleanable.filter(
+              (asset) => asset.exifInfo?.latitude != null && asset.exifInfo?.longitude != null,
+            ).length,
+          });
+        } catch {
+          // Immich unreachable: the connection check says so.
+        }
+      }
+      const downloads = checkDownloadMetadata(downloadAlbums);
+      if (downloads) findings.push(downloads);
+
+      // Lightbox zoom (#467): photos a browser cannot show need Immich's
+      // full-size rendition. Whether Immich has them is only known by asking,
+      // so one such photo is sampled. "On" here means on for any route to the
+      // album, standalone or through an enabled subpage.
+      const zoomAlbums: ZoomAlbumRef[] = [];
+      let renditionSample: ZoomRenditionSample | null = null;
+      try {
+        const zoomOn = (albumId: string) =>
+          (config.standaloneAlbums.includes(albumId) && resolveZoom(config, albumId)) ||
+          config.subpages.some(
+            (sp) =>
+              sp.enabled !== false &&
+              sp.albumIds.includes(albumId) &&
+              resolveZoom(config, albumId, sp),
+          );
+        let sample: string | undefined;
+        for (const id of config.albums.filter(zoomOn)) {
+          try {
+            const album = await immich.getAlbum(id);
+            if (!album) continue;
+            const viaRendition = album.assets.filter(
+              (asset) => zoomSourceFor(asset) === 'fullsize',
+            );
+            sample ??= viaRendition[0]?.id;
+            zoomAlbums.push({ id, albumName: album.albumName, needRendition: viaRendition.length });
+          } catch {
+            // Immich unreachable: the connection check says so.
+          }
+        }
+        if (sample) {
+          try {
+            const rendition = await immich.streamFullsize(sample);
+            if (!rendition) {
+              renditionSample = 'missing';
+            } else {
+              await (rendition.stream as ReadableStream).cancel().catch(() => {});
+              // The zoom route serves only what it can scrub: a WebP rendition
+              // exists, and is still refused.
+              const type = rendition.contentType.toLowerCase().split(';')[0].trim();
+              renditionSample = ZOOM_CONTENT_TYPES.has(type) ? 'ok' : { contentType: type };
+            }
+          } catch {
+            // Unknown; reported as nothing rather than as a false alarm.
+          }
+        }
+      } catch {
+        // Best-effort, like every check here: no finding rather than no report.
+      }
+      const zoomFinding = checkZoomRenditions(zoomAlbums, renditionSample);
+      if (zoomFinding) findings.push(zoomFinding);
     }
   }
 
diff --git a/app/api/admin/privacy/route.ts b/app/api/admin/privacy/route.ts
index 7411f8f..ab065d2 100644
--- a/app/api/admin/privacy/route.ts
+++ b/app/api/admin/privacy/route.ts
@@ -5,6 +5,7 @@ import { revalidatePath } from 'next/cache';
 import { withAdmin } from '@/lib/admin/withAdmin';
 import { atomicWrite } from '@/lib/atomicWrite';
 import {
+  needsBackup,
   VersionConflictError,
   assertVersion,
   baseVersionFrom,
@@ -17,6 +18,8 @@ import {
 import { getConfig } from '@/lib/config';
 import { env } from '@/lib/env';
 import { PRIVACY_FILENAME, processingFacts, readPrivacy, starterHeadings } from '@/lib/privacy';
+import { listSessions } from '@/lib/proofSessions';
+import { webhookUrl } from '@/lib/proofWebhook';
 
 const CONTENT_DIR = path.resolve(process.cwd(), 'content');
 const MAX_BACKUPS = 10;
@@ -35,6 +38,12 @@ export const GET = withAdmin(async () => {
       !!config.sitePassword ||
       config.subpages.some((sp) => !!sp.password) ||
       Object.values(config.albumPasswords).some(Boolean),
+    // An unreadable proofing.json may still hold client data: report it.
+    hasProofingLinks: await listSessions().then(
+      (sessions) => sessions.length > 0,
+      () => true,
+    ),
+    proofingWebhookUrl: webhookUrl(),
   });
   // Read before the text: a save landing between the two then makes the
   // version stale, which costs a spurious conflict, never a missed one.
@@ -70,15 +79,8 @@ export const PUT = withAdmin(async (request: Request) => {
 
       // Same rule as the about route (#630): only a missing file means there is
       // nothing to back up. Any other failure aborts before the live file changes.
-      let fileExists = true;
-      try {
-        await fs.access(filePath);
-      } catch (err) {
-        if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err;
-        fileExists = false;
-      }
-
-      if (fileExists) {
+      // A save that changes nothing takes no backup either (needsBackup).
+      if (await needsBackup(filePath, content)) {
         const backupDir = path.join(CONTENT_DIR, '.backups');
         await fs.mkdir(backupDir, { recursive: true });
         const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
diff --git a/app/api/admin/settings/route.ts b/app/api/admin/settings/route.ts
index d9bea20..f950b5d 100644
--- a/app/api/admin/settings/route.ts
+++ b/app/api/admin/settings/route.ts
@@ -40,6 +40,9 @@ export const GET = withAdmin(async () => {
       // Fields an environment variable overrides, as path → variable name. Only
       // the names: the values are secrets (a password, an ntfy topic) (#605).
       envLocks: resolveEnvLocks(env),
+      // What an empty title falls back to before the language default, so the
+      // General section can show the title the site really uses (QA A-15).
+      siteTitleEnv: env.SITE_TITLE || null,
     },
     { headers: { ETag: etag(version) } },
   );
diff --git a/app/api/admin/thumbnail/[id]/route.ts b/app/api/admin/thumbnail/[id]/route.ts
index 6d05c19..a0c7a8d 100644
--- a/app/api/admin/thumbnail/[id]/route.ts
+++ b/app/api/admin/thumbnail/[id]/route.ts
@@ -26,7 +26,10 @@ export const GET = withAdmin(
 
     try {
       const res = await fetch(
-        `${config.immich.apiUrl}/assets/${assetId}/thumbnail?size=thumbnail`,
+        // `edited=true`: the pickers show a photo as edited in Immich, like
+        // the site does (#831). For a photo that is not edited Immich returns
+        // the same bytes, so it needs no lookup first.
+        `${config.immich.apiUrl}/assets/${assetId}/thumbnail?size=thumbnail&edited=true`,
         {
           headers: {
             'x-api-key': config.immich.apiKey,
diff --git a/app/api/analytics/__tests__/track-route.test.ts b/app/api/analytics/__tests__/track-route.test.ts
index a122e95..4780d03 100644
--- a/app/api/analytics/__tests__/track-route.test.ts
+++ b/app/api/analytics/__tests__/track-route.test.ts
@@ -10,6 +10,8 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 
 vi.mock('@/lib/config', () => ({
   getConfigOrNull: vi.fn(() => ({ analytics: true })),
+  // The site gate reads it; no sitePassword, so the site is open.
+  getConfig: () => ({ analytics: true }),
 }));
 
 const checkRateLimit = vi.fn(
diff --git a/app/api/analytics/track/route.ts b/app/api/analytics/track/route.ts
index 7cf1e65..619214b 100644
--- a/app/api/analytics/track/route.ts
+++ b/app/api/analytics/track/route.ts
@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import fs from 'fs/promises';
 import path from 'path';
 import { getConfigOrNull } from '@/lib/config';
+import { siteLockResponse } from '@/lib/auth';
 import { atomicWrite } from '@/lib/atomicWrite';
 import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
 
@@ -79,6 +80,13 @@ async function saveAnalytics(data: AnalyticsData) {
 let writeQueue: Promise<void> = Promise.resolve();
 
 export async function POST(req: NextRequest) {
+  // A locked site accepts nothing from strangers, the same rule as
+  // /api/contact: without it anyone could write paths of their choosing into
+  // analytics.json. The gate page itself is not counted — the layout mounts
+  // no tracker there — so a visitor who unlocked the site loses nothing.
+  const locked = siteLockResponse(req);
+  if (locked) return locked;
+
   try {
     const config = getConfigOrNull();
     if (config?.analytics === false) {
diff --git a/app/api/contact/route.ts b/app/api/contact/route.ts
index ed6e929..85e6c02 100644
--- a/app/api/contact/route.ts
+++ b/app/api/contact/route.ts
@@ -8,7 +8,6 @@
 
 import { NextRequest, NextResponse } from 'next/server';
 import { getConfig } from '@/lib/config';
-import { siteLockResponse } from '@/lib/auth';
 import { notifyNewMessage, saveMessage, validateContact } from '@/lib/contact';
 import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
 
@@ -24,9 +23,10 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: 'Not found' }, { status: 404 });
   }
 
-  // The page sits behind the site password; so does the endpoint it posts to.
-  const locked = siteLockResponse(request);
-  if (locked) return locked;
+  // No site-lock check, on purpose: proxy.ts serves /contact to a locked site,
+  // because the Impressum links the form as its second contact channel. The
+  // honeypot, the fill-time check, the rate limit and the inbox cap below are
+  // what stand between a stranger and content/messages/, locked or not.
 
   const ip = getClientIp(request);
   const { success, resetAt } = checkRateLimit(`contact:${ip}`, CONTACT_RPM);
diff --git a/app/api/download/[album]/[id]/__tests__/route.test.ts b/app/api/download/[album]/[id]/__tests__/route.test.ts
new file mode 100644
index 0000000..6061d2a
--- /dev/null
+++ b/app/api/download/[album]/[id]/__tests__/route.test.ts
@@ -0,0 +1,185 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { NextRequest } from 'next/server';
+import {
+  LAT,
+  cameraHeic,
+  cameraJpeg,
+  chunked,
+  contains,
+  exifOf,
+  heicExif,
+  latin1,
+  parseTiff,
+  asciiOf,
+} from '@/lib/__tests__/fixtures/location';
+
+/**
+ * The single-original download serves the file without its location: GPS is
+ * removed from JPEG/HEIC/AVIF on the way through, camera data stays, and the
+ * length (and so Content-Length) does not change.
+ */
+
+vi.mock('@/lib/config', () => ({ getConfig: vi.fn() }));
+vi.mock('@/lib/tokens', () => ({ decodeAssetId: vi.fn((t: string) => t.replace('tok-', '')) }));
+vi.mock('@/lib/immich', () => ({
+  immich: { getAlbum: vi.fn(), streamAsset: vi.fn() },
+  ImmichUnavailableError: class ImmichUnavailableError extends Error {},
+}));
+vi.mock('@/lib/rate-limit', () => ({
+  checkRateLimit: vi.fn(() => ({ success: true, resetAt: 0 })),
+  getClientIp: vi.fn(() => '127.0.0.1'),
+  retryAfterSeconds: vi.fn(() => 60),
+}));
+vi.mock('@/lib/auth', () => ({
+  siteLockResponse: vi.fn(() => null),
+  isAlbumReachable: vi.fn(() => true),
+}));
+vi.mock('next/headers', () => ({
+  cookies: vi.fn(() => Promise.resolve({ get: () => undefined })),
+}));
+
+import { GET } from '../route';
+import { getConfig } from '@/lib/config';
+import { immich } from '@/lib/immich';
+
+const mockConfig = getConfig as unknown as ReturnType<typeof vi.fn>;
+const mockGetAlbum = immich.getAlbum as unknown as ReturnType<typeof vi.fn>;
+const mockStream = immich.streamAsset as unknown as ReturnType<typeof vi.fn>;
+
+const ALBUM = {
+  id: 'album',
+  albumName: 'Album',
+  assets: [{ id: 'asset', type: 'IMAGE', originalFileName: 'IMG_0001.JPG' }],
+};
+
+function original(data: Uint8Array, contentType: string) {
+  return {
+    stream: chunked(data, 1000),
+    contentType,
+    contentLength: String(data.length),
+  };
+}
+
+const download = () =>
+  GET(new NextRequest('http://localhost/api/download/tok-album/tok-asset'), {
+    params: Promise.resolve({ album: 'tok-album', id: 'tok-asset' }),
+  });
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mockConfig.mockReturnValue({ albums: ['album'], albumDownloads: { album: true } });
+  mockGetAlbum.mockResolvedValue(ALBUM);
+});
+
+describe('GET /api/download/[album]/[id]', () => {
+  it('serves a JPEG without GPS, camera data and length intact', async () => {
+    const { file } = cameraJpeg(true);
+    mockStream.mockResolvedValue(original(file, 'image/jpeg'));
+
+    const res = await download();
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-length')).toBe(String(file.length));
+    expect(res.headers.get('content-disposition')).toContain('IMG_0001.JPG');
+
+    const body = new Uint8Array(await res.arrayBuffer());
+    expect(body.length).toBe(file.length);
+    const tiff = parseTiff(exifOf(body)!);
+    expect(tiff.gps).toBeNull();
+    expect(tiff.ifd0.has(0x8825)).toBe(false);
+    expect(asciiOf(tiff.ifd0.get(0x0110))).toBe('Canon EOS R5');
+    expect(contains(body, LAT.value(true))).toBe(false);
+    expect(latin1(body)).not.toMatch(/exif:GPS/);
+    expect(latin1(body)).toContain('photoshop:City="Berlin"');
+  });
+
+  it('serves a HEIC without GPS', async () => {
+    const { file } = cameraHeic();
+    mockStream.mockResolvedValue(original(file, 'image/heic'));
+
+    const body = new Uint8Array(await (await download()).arrayBuffer());
+    expect(body.length).toBe(file.length);
+    const tiff = parseTiff(heicExif(body)!);
+    expect(tiff.gps).toBeNull();
+    expect(asciiOf(tiff.ifd0.get(0x010f))).toBe('Canon');
+  });
+
+  it('passes a format it does not edit through unchanged', async () => {
+    const png = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 1, 2, 3]);
+    mockStream.mockResolvedValue(original(png, 'image/png'));
+    const body = new Uint8Array(await (await download()).arrayBuffer());
+    expect(body).toEqual(png);
+  });
+
+  it('refuses a JPEG whose metadata it cannot locate', async () => {
+    mockStream.mockResolvedValue({
+      stream: new ReadableStream({
+        start(controller) {
+          // SOI, then an APP1 claiming more bytes than the file has.
+          controller.enqueue(new Uint8Array([0xff, 0xd8, 0xff, 0xe1, 0x40, 0x00, 0x45, 0x78]));
+          controller.close();
+        },
+      }),
+      contentType: 'image/jpeg',
+      contentLength: '8',
+    });
+    const res = await download();
+    expect(res.status).toBe(404);
+    expect(res.headers.get('cache-control')).toBe('no-store');
+  });
+
+  describe('a photo edited in Immich (#831)', () => {
+    const EDITED = {
+      id: 'album',
+      albumName: 'Album',
+      assets: [{ id: 'asset', type: 'IMAGE', originalFileName: 'IMG_9262.HEIC', isEdited: true }],
+    };
+
+    it('serves the edited rendition, named as the JPEG it is, without GPS', async () => {
+      mockGetAlbum.mockResolvedValue(EDITED);
+      // Immich's edited rendition carries no EXIF; one that did must still
+      // lose its GPS on the way through.
+      const { file } = cameraJpeg(true);
+      mockStream.mockResolvedValue(original(file, 'image/jpeg'));
+
+      const res = await download();
+      expect(res.status).toBe(200);
+      expect(mockStream).toHaveBeenCalledWith('asset', 'original', true);
+      expect(res.headers.get('content-type')).toBe('image/jpeg');
+      expect(res.headers.get('content-disposition')).toContain('IMG_9262.jpg');
+      expect(res.headers.get('content-disposition')).not.toContain('HEIC');
+      const body = new Uint8Array(await res.arrayBuffer());
+      expect(parseTiff(exifOf(body)!).gps).toBeNull();
+      expect(contains(body, LAT.value(true))).toBe(false);
+    });
+
+    it('keeps the name of an edited JPEG', async () => {
+      mockGetAlbum.mockResolvedValue({
+        ...EDITED,
+        assets: [{ ...EDITED.assets[0], originalFileName: 'scan.jpeg' }],
+      });
+      mockStream.mockResolvedValue(original(cameraJpeg(true).file, 'image/jpeg'));
+      const res = await download();
+      expect(res.headers.get('content-disposition')).toContain('scan.jpeg');
+    });
+
+    it('refuses an edited rendition the scrubber would pass through (review of #832)', async () => {
+      mockGetAlbum.mockResolvedValue(EDITED);
+      const webp = new TextEncoder().encode('RIFF\x10\x00\x00\x00WEBPVP8 ');
+      mockStream.mockResolvedValue(original(webp, 'image/webp'));
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      const res = await download();
+      expect(res.status).toBe(404);
+      expect(res.headers.get('cache-control')).toBe('no-store');
+      expect(warn.mock.calls.some((args) => String(args[0]).includes('Refused edited asset'))).toBe(
+        true,
+      );
+      warn.mockRestore();
+    });
+
+    it('asks for the original of a photo that is not edited exactly as before', async () => {
+      mockStream.mockResolvedValue(original(cameraJpeg(true).file, 'image/jpeg'));
+      await download();
+      expect(mockStream).toHaveBeenCalledWith('asset', 'original', false);
+    });
+  });
+});
diff --git a/app/api/download/[album]/[id]/route.ts b/app/api/download/[album]/[id]/route.ts
index 1746881..d70cbbf 100644
--- a/app/api/download/[album]/[id]/route.ts
+++ b/app/api/download/[album]/[id]/route.ts
@@ -15,6 +15,15 @@
  *
  * The last one is what stops one enabled album's URL being edited into a
  * download of any asset in the Immich instance.
+ *
+ * The file goes out as Immich stores it, minus its location: GPS coordinates
+ * are removed from JPEG, HEIC/HEIF and AVIF originals on the way through
+ * (lib/locationScrub.ts). Camera data, copyright and colour profile stay.
+ *
+ * A photo edited in Immich's editor is the exception (#831): it goes out as
+ * edited, which is Immich's full-resolution rendition of the edit — a JPEG
+ * without EXIF — named with a matching extension. It passes the same
+ * scrubber.
  */
 
 import { NextRequest, NextResponse } from 'next/server';
@@ -24,7 +33,8 @@ import { decodeAssetId } from '@/lib/tokens';
 import { getConfig } from '@/lib/config';
 import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
 import { isAlbumReachable, siteLockResponse } from '@/lib/auth';
-import { contentDisposition } from '@/lib/downloadName';
+import { contentDisposition, editedDownloadName } from '@/lib/downloadName';
+import { scrubLocationStream } from '@/lib/locationScrub';
 
 export const dynamic = 'force-dynamic';
 
@@ -104,7 +114,9 @@ export async function GET(
 
   let result;
   try {
-    result = await immich.streamAsset(assetId, 'original');
+    // A photo edited in Immich goes out as edited (#831): Immich's
+    // full-resolution edited rendition rather than the unedited camera file.
+    result = await immich.streamAsset(assetId, 'original', asset.isEdited === true);
   } catch (error) {
     if (error instanceof ImmichUnavailableError) {
       return NextResponse.json(
@@ -116,15 +128,50 @@ export async function GET(
   }
   if (!result) return notFound();
 
+  // Location out, everything else in. The head is read before a byte is sent,
+  // so a file whose metadata cannot be located is refused rather than leaked.
+  let scrubbed;
+  try {
+    scrubbed = await scrubLocationStream(result.stream as ReadableStream<Uint8Array>);
+  } catch (error) {
+    console.error(`[Download] Reading original ${assetId} failed:`, error);
+    return NextResponse.json(
+      { error: 'Immich is currently unavailable' },
+      { status: 503, headers: { 'Retry-After': '30', 'Cache-Control': 'no-store' } },
+    );
+  }
+  if (!scrubbed.ok) {
+    console.warn(
+      `[Download] Refused original ${assetId}: its location metadata could not be removed (${scrubbed.reason}).`,
+    );
+    return notFound();
+  }
+  // An edited photo is a rendition Immich made, which Folio expects as JPEG
+  // (#831). One in a format the scrubber passes through untouched (WebP,
+  // PNG) is not what was measured, and is refused rather than sent with
+  // whatever metadata it carries — as the zoom route does.
+  if (asset.isEdited === true && scrubbed.format === 'passthrough') {
+    await scrubbed.stream.cancel().catch(() => {});
+    console.warn(
+      `[Download] Refused edited asset ${assetId}: Immich sent ${result.contentType || 'no type'}, which is not a JPEG or HEIF-family file.`,
+    );
+    return notFound();
+  }
+
   const headers: Record<string, string> = {
     'Content-Type': result.contentType || 'application/octet-stream',
-    'Content-Disposition': contentDisposition(asset.originalFileName),
+    'Content-Disposition': contentDisposition(
+      asset.isEdited === true
+        ? editedDownloadName(asset.originalFileName, result.contentType)
+        : asset.originalFileName,
+    ),
     // Private: a download is authorised per visitor, so a shared cache must
     // not hand the file to the next one.
     'Cache-Control': 'private, no-store',
     'X-Content-Type-Options': 'nosniff',
   };
+  // Scrubbing overwrites in place, so the upstream length still holds.
   if (result.contentLength) headers['Content-Length'] = result.contentLength;
 
-  return new NextResponse(result.stream, { headers });
+  return new NextResponse(scrubbed.stream, { headers });
 }
diff --git a/app/api/download/[album]/archive/__tests__/route.test.ts b/app/api/download/[album]/archive/__tests__/route.test.ts
index 537963c..f29938f 100644
--- a/app/api/download/[album]/archive/__tests__/route.test.ts
+++ b/app/api/download/[album]/archive/__tests__/route.test.ts
@@ -1,5 +1,13 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { NextRequest } from 'next/server';
+import {
+  LAT,
+  cameraHeic,
+  cameraJpeg,
+  chunked,
+  contains,
+  latin1,
+} from '@/lib/__tests__/fixtures/location';
 
 /**
  * The archive route streams originals as a ZIP for either the whole album
@@ -430,3 +438,103 @@ describe('concurrent archives', () => {
     mockClientIp.mockReturnValue('127.0.0.1');
   });
 });
+
+/**
+ * The ZIP is stored uncompressed, so each entry's bytes appear in it as they
+ * are: what the scrubber left is exactly what a visitor unpacks.
+ */
+describe('location metadata', () => {
+  it('leaves GPS out of every original in the archive and keeps camera data', async () => {
+    const jpeg = cameraJpeg(false).file;
+    const heic = cameraHeic({ le: true }).file;
+    mockStream.mockImplementation((id: string) =>
+      Promise.resolve({
+        stream: chunked(id === 'asset-1' ? jpeg : heic, 512),
+        contentType: id === 'asset-1' ? 'image/jpeg' : 'image/heic',
+        contentLength: null,
+      }),
+    );
+
+    const zip = new Uint8Array(await (await GET(getReq(), params)).arrayBuffer());
+    expect(contains(zip, LAT.value(false))).toBe(false);
+    expect(contains(zip, LAT.value(true))).toBe(false);
+    const text = latin1(zip);
+    expect(text).not.toMatch(/exif:GPS/);
+    expect(text).not.toContain('52.520095');
+    expect(text.split('Canon EOS R5').length - 1).toBeGreaterThanOrEqual(2);
+    expect(text).toContain('photoshop:City="Berlin"');
+  });
+
+  it('leaves out an original whose metadata cannot be located, and goes on', async () => {
+    const broken = new Uint8Array([0xff, 0xd8, 0xff, 0xe1, 0x40, 0x00, 0x45, 0x78]);
+    mockStream.mockImplementation((id: string) =>
+      Promise.resolve(
+        id === 'asset-1'
+          ? { stream: chunked(broken, 8), contentType: 'image/jpeg', contentLength: null }
+          : originStream('second-original'),
+      ),
+    );
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const zip = latin1(new Uint8Array(await (await GET(getReq(), params)).arrayBuffer()));
+    // Visible in the server log: which asset, which album, and how many.
+    const logged = warn.mock.calls.map((args) => String(args[0]));
+    expect(logged.some((l) => l.includes('asset-1') && l.includes('Test Album'))).toBe(true);
+    expect(logged.some((l) => l.includes('missing 1 of 2'))).toBe(true);
+    warn.mockRestore();
+    expect(zip).not.toContain('photo-1.jpg');
+    expect(zip).toContain('photo-2.jpg');
+    expect(zip).toContain('second-original');
+  });
+
+  it('puts a photo edited in Immich in as edited, renamed, and without GPS (#831)', async () => {
+    mockGetAlbum.mockResolvedValue({
+      ...ALBUM,
+      assets: [
+        { id: 'asset-1', type: 'IMAGE', originalFileName: 'IMG_9262.HEIC', isEdited: true },
+        { id: 'asset-2', type: 'IMAGE', originalFileName: 'photo-2.jpg' },
+      ],
+    });
+    const jpeg = cameraJpeg(true).file;
+    mockStream.mockImplementation(() =>
+      Promise.resolve({
+        stream: chunked(jpeg, 512),
+        contentType: 'image/jpeg',
+        contentLength: null,
+      }),
+    );
+
+    const zip = new Uint8Array(await (await GET(getReq(), params)).arrayBuffer());
+    expect(mockStream).toHaveBeenCalledWith('asset-1', 'original', true);
+    expect(mockStream).toHaveBeenCalledWith('asset-2', 'original', false);
+    const text = latin1(zip);
+    expect(text).toContain('IMG_9262.jpg');
+    expect(text).not.toContain('IMG_9262.HEIC');
+    expect(contains(zip, LAT.value(true))).toBe(false);
+  });
+
+  it('leaves out an edited rendition the scrubber would pass through (review of #832)', async () => {
+    mockGetAlbum.mockResolvedValue({
+      ...ALBUM,
+      assets: [
+        { id: 'asset-1', type: 'IMAGE', originalFileName: 'IMG_9262.HEIC', isEdited: true },
+        { id: 'asset-2', type: 'IMAGE', originalFileName: 'photo-2.jpg' },
+      ],
+    });
+    const webp = new TextEncoder().encode('RIFF\x10\x00\x00\x00WEBPVP8 edited-webp');
+    mockStream.mockImplementation((id: string) =>
+      Promise.resolve(
+        id === 'asset-1'
+          ? { stream: chunked(webp, 64), contentType: 'image/webp', contentLength: null }
+          : originStream('second-original'),
+      ),
+    );
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const zip = latin1(new Uint8Array(await (await GET(getReq(), params)).arrayBuffer()));
+    const logged = warn.mock.calls.map((args) => String(args[0]));
+    expect(logged.some((l) => l.includes('edited asset asset-1'))).toBe(true);
+    warn.mockRestore();
+    expect(zip).not.toContain('edited-webp');
+    expect(zip).not.toContain('IMG_9262');
+    expect(zip).toContain('second-original');
+  });
+});
diff --git a/app/api/image/[id]/route.ts b/app/api/image/[id]/route.ts
index 9d004b5..a847876 100644
--- a/app/api/image/[id]/route.ts
+++ b/app/api/image/[id]/route.ts
@@ -33,6 +33,9 @@ const STRIP_VERSION = 's1';
  */
 const MAX_STRIP_BYTES = 64 * 1024 * 1024;
 
+/** The shape of lib/urls.ts editMarker(): a base-36 timestamp. */
+const EDIT_MARKER = /^[0-9a-z]{1,16}$/;
+
 export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   // ── Rate limiting ──────────────────────────────────
   const ip = getClientIp(request);
@@ -86,6 +89,18 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
     request.nextUrl.searchParams.get('w'),
   );
 
+  // Photos edited in Immich (#831) are always served as edited: the server
+  // asks for `edited=true` on every request, whatever the URL says, so a URL
+  // stripped of its marker cannot bring back what a crop removed. For a photo
+  // that is not edited Immich returns the same bytes (measured on 3.2), and
+  // the parameter exists in every supported Immich (since 2.5; Folio needs
+  // 3.0). The marker `e` that lib/urls.ts writes for edited photos is only a
+  // cache key: it gives the edited rendition a URL (and ETag) of its own, so
+  // an `immutable` copy of the unedited one is never reused. A value outside
+  // the marker's shape is ignored, so it cannot carry anything into the ETag.
+  const editParam = request.nextUrl.searchParams.get('e');
+  const edit = editParam && EDIT_MARKER.test(editParam) ? editParam : null;
+
   // ── Browser Cache Optimization ─────────────────────
   // Use the opaque token to generate a safe ETag without leaking Immich UUIDs.
   // IMAGE_CACHE_VERSION participates so that a bump is not defeated by a client
@@ -93,7 +108,7 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
   // `immutable`, so this only matters after expiry or a cache eviction, but a
   // matching ETag across two different URLs would be wrong either way.
   const cacheVersion = request.nextUrl.searchParams.get('v') ?? '';
-  const etag = `W/"${token}-${size}-${STRIP_VERSION}${cacheVersion ? `-${cacheVersion}` : ''}"`;
+  const etag = `W/"${token}-${size}-${STRIP_VERSION}${edit ? `-e${edit}` : ''}${cacheVersion ? `-${cacheVersion}` : ''}"`;
   if (request.headers.get('if-none-match') === etag) {
     return new NextResponse(null, {
       status: 304,
@@ -107,7 +122,7 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
 
   let result;
   try {
-    result = await immich.streamAsset(assetId, size);
+    result = await immich.streamAsset(assetId, size, true);
   } catch (error) {
     // An outage must not look like a deleted photo. These URLs are served with
     // `immutable` on success, and a bare 404 is heuristically cacheable — so
@@ -177,7 +192,7 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
       console.warn(
         `[Image API] Original von ${assetId} (${contentType}) nicht strippbar — liefere Preview.`,
       );
-      const preview = await immich.streamAsset(assetId, 'preview');
+      const preview = await immich.streamAsset(assetId, 'preview', true);
       if (!preview) {
         return NextResponse.json(
           { error: 'Asset not found' },
diff --git a/app/api/image/__tests__/image-route.test.ts b/app/api/image/__tests__/image-route.test.ts
index 9bab4b1..7110714 100644
--- a/app/api/image/__tests__/image-route.test.ts
+++ b/app/api/image/__tests__/image-route.test.ts
@@ -4,9 +4,12 @@ import { GET } from '../[id]/route';
 import { encodeAssetId } from '@/lib/tokens';
 import { immich, ImmichUnavailableError } from '@/lib/immich';
 
-const published = vi.hoisted(() => ({ value: true }));
+const published = vi.hoisted(() => ({ value: true, asked: [] as string[] }));
 vi.mock('@/lib/publishedAssets', () => ({
-  isPublishedAsset: async () => published.value,
+  isPublishedAsset: async (id: string) => {
+    published.asked.push(id);
+    return published.value;
+  },
 }));
 vi.mock('@/lib/admin/auth', () => ({
   isAdminAuthenticated: async () => false,
@@ -77,7 +80,72 @@ describe('GET /api/image/[id]', () => {
     mockStream.mockResolvedValue(fakeBody('image/jpeg'));
     const res = await call(encodeAssetId(ASSET_ID));
     expect(res.status).toBe(200);
-    expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview');
+    expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview', true);
+  });
+
+  describe('photos edited in Immich (#831)', () => {
+    beforeEach(() => {
+      published.asked = [];
+    });
+
+    it('asks Immich for the edit when the URL carries the edit marker', async () => {
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      const res = await call(encodeAssetId(ASSET_ID), '?size=preview&e=mf3k2abc');
+      expect(res.status).toBe(200);
+      expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview', true);
+    });
+
+    it('asks for the edited thumbnail too', async () => {
+      mockStream.mockResolvedValue(fakeBody('image/webp'));
+      await call(encodeAssetId(ASSET_ID), '?size=thumbnail&e=mf3k2abc');
+      expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'thumbnail', true);
+    });
+
+    it('shows the edit to a URL stripped of its marker: the server decides, not the URL', async () => {
+      // Review of #832: with the marker as the switch, dropping `&e=` from a
+      // URL brought back what the photographer had cropped out.
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      await call(encodeAssetId(ASSET_ID), '?size=preview&w=1440');
+      expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview', true);
+      mockStream.mockResolvedValue(fakeBody('image/webp'));
+      await call(encodeAssetId(ASSET_ID), '?size=thumbnail');
+      expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'thumbnail', true);
+      expect(mockStream).not.toHaveBeenCalledWith(ASSET_ID, expect.anything(), false);
+    });
+
+    it('is still gated by the published-asset check, which goes by the asset alone', async () => {
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      const res = await call(encodeAssetId(ASSET_ID), '?size=preview&e=mf3k2abc&w=1440');
+      expect(res.status).toBe(200);
+      expect(published.asked).toEqual([ASSET_ID]);
+
+      published.value = false;
+      try {
+        const refused = await call(encodeAssetId(ASSET_ID), '?size=preview&e=mf3k2abc');
+        expect(refused.status).toBe(404);
+      } finally {
+        published.value = true;
+      }
+    });
+
+    it('gives the edited rendition its own ETag', async () => {
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      const token = encodeAssetId(ASSET_ID);
+      const plain = (await call(token, '?size=preview')).headers.get('ETag');
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      const edited = (await call(token, '?size=preview&e=mf3k2abc')).headers.get('ETag');
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      const reEdited = (await call(token, '?size=preview&e=mf9zz001')).headers.get('ETag');
+      expect(new Set([plain, edited, reEdited]).size).toBe(3);
+    });
+
+    it('ignores a marker that is not one, and keeps it out of the ETag', async () => {
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      const token = encodeAssetId(ASSET_ID);
+      const res = await call(token, `?size=preview&e=${encodeURIComponent('"x", W/"y')}`);
+      expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview', true);
+      expect(res.headers.get('ETag')).not.toContain('y');
+    });
   });
 
   // Regression guard for the stored-XSS fix in c2fa8e7. An SVG served as
diff --git a/app/api/install/route.ts b/app/api/install/route.ts
index c6eae40..c32c51f 100644
--- a/app/api/install/route.ts
+++ b/app/api/install/route.ts
@@ -3,21 +3,13 @@ import { revalidatePath } from 'next/cache';
 import { completeInstall, isInstalled, normalizeApiBase, validateSetupToken } from '@/lib/install';
 import { invalidateConfigCache } from '@/lib/config';
 import { DEFAULT_PRESET } from '@/lib/config/theme';
+import { PRESET_IDS } from '@/lib/config/presets';
 import { immich } from '@/lib/immich';
 import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
 
 /** Install submissions per minute per IP — only live before install. */
 const INSTALL_RPM = 10;
 
-const THEME_PRESETS = [
-  'studio-modern',
-  'studio',
-  'minimal',
-  'editorial',
-  'classic',
-  'noir',
-  'monograph',
-];
 const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
 /** POST: run the install wizard's final step — verify, then write config. */
@@ -59,7 +51,7 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: 'Invalid Immich URL' }, { status: 400 });
   }
 
-  const theme = THEME_PRESETS.includes(body.theme) ? body.theme : DEFAULT_PRESET;
+  const theme = PRESET_IDS.includes(body.theme) ? body.theme : DEFAULT_PRESET;
 
   // Album selection is optional: an empty gallery is a valid install.
   const rawAlbums: unknown[] = Array.isArray(body.albums) ? (body.albums as unknown[]) : [];
diff --git a/app/api/map/route.ts b/app/api/map/route.ts
index a4edb3c..524ee46 100644
--- a/app/api/map/route.ts
+++ b/app/api/map/route.ts
@@ -140,7 +140,10 @@ export async function GET(request: NextRequest) {
         lat: position.lat,
         lng: position.lng,
         photoCount,
-        coverUrl: imageUrl(allowedAlbums[0].coverAssetId, 'thumbnail'),
+        coverUrl: imageUrl(
+          { id: allowedAlbums[0].coverAssetId, ...allowedAlbums[0].coverEdit },
+          'thumbnail',
+        ),
         albums: allowedAlbums.map((a) => ({
           name: a.name,
           url: a.subpageSlug ? `/${a.subpageSlug}/${a.slug}` : `/${a.slug}`,
diff --git a/app/api/zoom/[album]/[id]/__tests__/route.test.ts b/app/api/zoom/[album]/[id]/__tests__/route.test.ts
new file mode 100644
index 0000000..8238afb
--- /dev/null
+++ b/app/api/zoom/[album]/[id]/__tests__/route.test.ts
@@ -0,0 +1,279 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { NextRequest, NextResponse } from 'next/server';
+import {
+  LAT,
+  asciiOf,
+  cameraHeic,
+  cameraJpeg,
+  chunked,
+  contains,
+  exifOf,
+  heicExif,
+  latin1,
+  parseTiff,
+} from '@/lib/__tests__/fixtures/location';
+
+/**
+ * GET /api/zoom/[album]/[id] (#467): the full-resolution file behind the
+ * lightbox zoom. Every refusal is the same 404; the route checks are tested
+ * here, the per-route zoom/password resolution in lib/__tests__/auth-zoom.
+ */
+
+vi.mock('@/lib/config', () => ({ getConfig: vi.fn() }));
+vi.mock('@/lib/tokens', () => ({
+  decodeAssetId: vi.fn((t: string) => (t.startsWith('tok-') ? t.replace('tok-', '') : null)),
+}));
+vi.mock('@/lib/immich', () => ({
+  immich: { getAlbum: vi.fn(), streamAsset: vi.fn(), streamFullsize: vi.fn() },
+  ImmichUnavailableError: class ImmichUnavailableError extends Error {},
+}));
+vi.mock('@/lib/rate-limit', () => ({
+  checkRateLimit: vi.fn(() => ({ success: true, resetAt: 0 })),
+  getClientIp: vi.fn(() => '127.0.0.1'),
+  retryAfterSeconds: vi.fn(() => 60),
+}));
+vi.mock('@/lib/auth', () => ({
+  siteLockResponse: vi.fn(() => null),
+  isAlbumZoomReachable: vi.fn(() => true),
+}));
+vi.mock('@/lib/publishedAssets', () => ({ isPublishedAsset: vi.fn(async () => true) }));
+vi.mock('next/headers', () => ({
+  cookies: vi.fn(() => Promise.resolve({ get: () => undefined })),
+}));
+
+import { GET } from '../route';
+import { getConfig } from '@/lib/config';
+import { immich, ImmichUnavailableError } from '@/lib/immich';
+import { checkRateLimit } from '@/lib/rate-limit';
+import { isAlbumZoomReachable, siteLockResponse } from '@/lib/auth';
+import { isPublishedAsset } from '@/lib/publishedAssets';
+
+const mocked = <T>(fn: T) => fn as unknown as ReturnType<typeof vi.fn>;
+
+const asset = (id: string, originalMimeType: string, type = 'IMAGE') => ({
+  id,
+  type,
+  originalMimeType,
+  originalFileName: `${id}.bin`,
+});
+
+const ALBUM = {
+  id: 'album',
+  albumName: 'Album',
+  assets: [
+    asset('jpeg', 'image/jpeg'),
+    asset('avif', 'image/avif'),
+    asset('heic', 'image/heic'),
+    asset('png', 'image/png'),
+    asset('webp', 'image/webp'),
+    asset('mov', 'video/quicktime', 'VIDEO'),
+    { ...asset('edited', 'image/jpeg'), isEdited: true },
+    { ...asset('edited-heic', 'image/heic'), isEdited: true },
+  ],
+};
+
+function upstream(data: Uint8Array, contentType: string) {
+  return { stream: chunked(data, 1000), contentType, contentLength: String(data.length) };
+}
+
+const zoom = (assetToken = 'tok-jpeg', albumToken = 'tok-album') =>
+  GET(new NextRequest(`http://localhost/api/zoom/${albumToken}/${assetToken}`), {
+    params: Promise.resolve({ album: albumToken, id: assetToken }),
+  });
+
+/** A HEIF-family file branded as AVIF, as Lightroom writes one. */
+function avifFile() {
+  const { file } = cameraHeic();
+  const out = file.slice();
+  out.set([0x61, 0x76, 0x69, 0x66], 8); // major brand → 'avif'
+  return out;
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocked(getConfig).mockReturnValue({ albums: ['album'] });
+  mocked(immich.getAlbum).mockResolvedValue(ALBUM);
+});
+
+describe('refusals', () => {
+  it('answers a locked site with the lock, before anything else', async () => {
+    mocked(siteLockResponse).mockReturnValueOnce(
+      NextResponse.json(
+        { error: 'locked' },
+        { status: 401, headers: { 'Cache-Control': 'no-store' } },
+      ),
+    );
+    const res = await zoom();
+    expect(res.status).toBe(401);
+    expect(immich.getAlbum).not.toHaveBeenCalled();
+  });
+
+  it('rate-limits in its own bucket', async () => {
+    mocked(checkRateLimit).mockReturnValueOnce({ success: false, resetAt: Date.now() + 1000 });
+    const res = await zoom();
+    expect(res.status).toBe(429);
+    expect(res.headers.get('cache-control')).toBe('no-store');
+    expect(res.headers.get('retry-after')).toBe('60');
+    expect(checkRateLimit).toHaveBeenCalledWith('zoom:127.0.0.1', 20);
+  });
+
+  it.each([
+    ['an undecodable album token', () => zoom('tok-jpeg', 'garbage')],
+    ['an undecodable asset token', () => zoom('garbage')],
+  ])('refuses %s', async (_name, call) => {
+    const res = await call();
+    expect(res.status).toBe(404);
+    expect(res.headers.get('cache-control')).toBe('no-store');
+  });
+
+  it('refuses an album that is not on the allowlist', async () => {
+    mocked(getConfig).mockReturnValue({ albums: ['other'] });
+    expect((await zoom()).status).toBe(404);
+    expect(isAlbumZoomReachable).not.toHaveBeenCalled();
+  });
+
+  it('refuses when zoom is off, or the album is locked, hidden behind an offline page …', async () => {
+    // isAlbumZoomReachable covers each of those (lib/__tests__/auth-zoom).
+    mocked(isAlbumZoomReachable).mockReturnValueOnce(false);
+    const res = await zoom();
+    expect(res.status).toBe(404);
+    expect(isAlbumZoomReachable).toHaveBeenCalledWith('album', expect.any(Function));
+    expect(immich.streamAsset).not.toHaveBeenCalled();
+  });
+
+  it('refuses an asset the site no longer publishes', async () => {
+    mocked(isPublishedAsset).mockResolvedValueOnce(false);
+    expect((await zoom()).status).toBe(404);
+    expect(immich.getAlbum).not.toHaveBeenCalled();
+  });
+
+  it('refuses an asset from another album', async () => {
+    expect((await zoom('tok-elsewhere')).status).toBe(404);
+    expect(immich.streamAsset).not.toHaveBeenCalled();
+  });
+
+  it.each(['png', 'webp', 'mov'])('never streams a %s', async (id) => {
+    expect((await zoom(`tok-${id}`)).status).toBe(404);
+    expect(immich.streamAsset).not.toHaveBeenCalled();
+    expect(immich.streamFullsize).not.toHaveBeenCalled();
+  });
+
+  it('answers 503 while Immich is down', async () => {
+    mocked(immich.getAlbum).mockRejectedValueOnce(new ImmichUnavailableError('down'));
+    const res = await zoom();
+    expect(res.status).toBe(503);
+    expect(res.headers.get('cache-control')).toBe('no-store');
+  });
+});
+
+describe('the JPEG original', () => {
+  it('goes out without GPS, inline, privately cached, length intact', async () => {
+    const { file } = cameraJpeg(true);
+    mocked(immich.streamAsset).mockResolvedValue(upstream(file, 'image/jpeg'));
+
+    const res = await zoom();
+    expect(res.status).toBe(200);
+    expect(immich.streamAsset).toHaveBeenCalledWith('jpeg', 'original');
+    expect(immich.streamFullsize).not.toHaveBeenCalled();
+    expect(res.headers.get('content-type')).toBe('image/jpeg');
+    expect(res.headers.get('content-disposition')).toBe('inline');
+    expect(res.headers.get('x-content-type-options')).toBe('nosniff');
+    expect(res.headers.get('cache-control')).toBe('private, max-age=3600');
+    expect(res.headers.get('content-length')).toBe(String(file.length));
+
+    const body = new Uint8Array(await res.arrayBuffer());
+    expect(body.length).toBe(file.length);
+    const tiff = parseTiff(exifOf(body)!);
+    expect(tiff.gps).toBeNull();
+    expect(asciiOf(tiff.ifd0.get(0x0110))).toBe('Canon EOS R5');
+    expect(contains(body, LAT.value(true))).toBe(false);
+    expect(latin1(body)).not.toMatch(/exif:GPS/);
+  });
+
+  it('is refused when its metadata cannot be located', async () => {
+    mocked(immich.streamAsset).mockResolvedValue({
+      stream: chunked(new Uint8Array([0xff, 0xd8, 0xff, 0xe1, 0x40, 0x00, 0x45, 0x78]), 8),
+      contentType: 'image/jpeg',
+      contentLength: '8',
+    });
+    expect((await zoom()).status).toBe(404);
+  });
+
+  it('is refused when the bytes are not a JPEG at all', async () => {
+    // Labelled JPEG, actually a PNG: the scrubber would pass it through
+    // untouched, eXIf chunk and all.
+    const png = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 1, 2, 3]);
+    mocked(immich.streamAsset).mockResolvedValue(upstream(png, 'image/jpeg'));
+    expect((await zoom()).status).toBe(404);
+  });
+});
+
+describe('the AVIF original', () => {
+  it('goes out without GPS', async () => {
+    const file = avifFile();
+    mocked(immich.streamAsset).mockResolvedValue(upstream(file, 'image/avif'));
+    const res = await zoom('tok-avif');
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toBe('image/avif');
+    const body = new Uint8Array(await res.arrayBuffer());
+    expect(body.length).toBe(file.length);
+    expect(parseTiff(heicExif(body)!).gps).toBeNull();
+  });
+});
+
+describe('a HEIC (not browser-displayable)', () => {
+  it('uses Immich’s full-size rendition, scrubbed', async () => {
+    const { file } = cameraJpeg(false);
+    mocked(immich.streamFullsize).mockResolvedValue(upstream(file, 'image/jpeg'));
+    const res = await zoom('tok-heic');
+    expect(res.status).toBe(200);
+    expect(immich.streamFullsize).toHaveBeenCalledWith('heic', false);
+    expect(immich.streamAsset).not.toHaveBeenCalled();
+    const body = new Uint8Array(await res.arrayBuffer());
+    expect(parseTiff(exifOf(body)!).gps).toBeNull();
+  });
+
+  it('is 404 when Immich has no rendition', async () => {
+    mocked(immich.streamFullsize).mockResolvedValue(null);
+    const res = await zoom('tok-heic');
+    expect(res.status).toBe(404);
+    expect(res.headers.get('cache-control')).toBe('no-store');
+  });
+
+  it('never sends the HEIC original itself', async () => {
+    mocked(immich.streamFullsize).mockResolvedValue(upstream(cameraHeic().file, 'image/heic'));
+    expect((await zoom('tok-heic')).status).toBe(404);
+  });
+
+  it('refuses a WebP rendition, whose metadata is not scrubbed', async () => {
+    const webp = new TextEncoder().encode('RIFF\x10\x00\x00\x00WEBPVP8 ');
+    mocked(immich.streamFullsize).mockResolvedValue(upstream(webp, 'image/webp'));
+    expect((await zoom('tok-heic')).status).toBe(404);
+  });
+});
+
+describe('a photo edited in Immich (#831)', () => {
+  it.each(['edited', 'edited-heic'])(
+    'zooms a %s into the edited full-size rendition, never the original',
+    async (id) => {
+      // Immich's edited rendition is a JPEG; given one with GPS here, the
+      // scrubber still has to take it out.
+      const { file } = cameraJpeg(true);
+      mocked(immich.streamFullsize).mockResolvedValue(upstream(file, 'image/jpeg'));
+      const res = await zoom(`tok-${id}`);
+      expect(res.status).toBe(200);
+      expect(immich.streamFullsize).toHaveBeenCalledWith(id, true);
+      expect(immich.streamAsset).not.toHaveBeenCalled();
+      const body = new Uint8Array(await res.arrayBuffer());
+      expect(parseTiff(exifOf(body)!).gps).toBeNull();
+      expect(contains(body, LAT.value(true))).toBe(false);
+    },
+  );
+
+  it('is 404 when Immich has no edited rendition', async () => {
+    mocked(immich.streamFullsize).mockResolvedValue(null);
+    const res = await zoom('tok-edited');
+    expect(res.status).toBe(404);
+    expect(res.headers.get('cache-control')).toBe('no-store');
+  });
+});
diff --git a/app/api/zoom/[album]/[id]/route.ts b/app/api/zoom/[album]/[id]/route.ts
new file mode 100644
index 0000000..6bb273b
--- /dev/null
+++ b/app/api/zoom/[album]/[id]/route.ts
@@ -0,0 +1,181 @@
+/**
+ * The full-resolution image behind the lightbox zoom (#467).
+ *
+ * Shaped like the download route, and for the same reason: this hands out a
+ * file at full resolution, so it re-checks everything instead of treating the
+ * asset token as the capability the image proxy does.
+ *
+ *   - the album must be on the allowlist,
+ *   - the visitor must be able to reach it by a route on which zoom resolves
+ *     on — album, then subpage, then `zoom` in settings.yaml — with every
+ *     password gate on that route satisfied,
+ *   - the asset must currently be published and belong to that album, and
+ *   - it must have a zoomable source (lib/zoomSource.ts).
+ *
+ * What it sends:
+ *
+ *   - JPEG and AVIF originals as they are stored, minus their location: GPS and
+ *     sub-city place names are removed in place on the way through
+ *     (lib/locationScrub.ts), so the length still holds.
+ *   - For formats a browser cannot show (HEIC, RAW, TIFF, …), Immich's
+ *     full-size JPEG rendition, through the same scrubber. When Immich has
+ *     none — full-size previews switched off, or the asset not yet processed —
+ *     the answer is 404 and the lightbox stays on the preview.
+ *   - For a photo edited in Immich, whatever its format, the edited full-size
+ *     rendition (#831), through the same scrubber, so the zoom shows the crop
+ *     and rotation the preview shows.
+ *
+ * Whatever the source, only a file the scrubber recognised and cleaned goes
+ * out, and only as JPEG or AVIF. A format it passes through untouched (a PNG
+ * labelled as JPEG, a WebP rendition) is refused rather than sent with
+ * whatever metadata it carries.
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import { immich, ImmichUnavailableError } from '@/lib/immich';
+import { decodeAssetId } from '@/lib/tokens';
+import { getConfig } from '@/lib/config';
+import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
+import { isAlbumZoomReachable, siteLockResponse } from '@/lib/auth';
+import { isPublishedAsset } from '@/lib/publishedAssets';
+import { scrubLocationStream } from '@/lib/locationScrub';
+import { ZOOM_CONTENT_TYPES, zoomSourceFor } from '@/lib/zoomSource';
+
+export const dynamic = 'force-dynamic';
+
+/**
+ * Per client IP and minute. A zoom is one deliberate gesture per photo, and
+ * each answer is a full-resolution file off the Immich server — 7 MB for a
+ * 60 MP JPEG. Twenty a minute is a zoom every three seconds, sustained, which
+ * a visitor checking focus does not reach; a script pulling originals does.
+ * Below the download route's 30: a download is rarer still, but zooming is
+ * offered on whole albums that never opted into downloads.
+ */
+const ZOOM_RPM = 20;
+
+const NO_STORE = { 'Cache-Control': 'no-store' };
+
+/** One 404 for every refusal, so the response never says which check failed. */
+const notFound = () =>
+  NextResponse.json({ error: 'Not found' }, { status: 404, headers: NO_STORE });
+
+const unavailable = () =>
+  NextResponse.json(
+    { error: 'Immich is currently unavailable' },
+    { status: 503, headers: { ...NO_STORE, 'Retry-After': '30' } },
+  );
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ album: string; id: string }> },
+) {
+  const ip = getClientIp(request);
+  const rl = checkRateLimit(`zoom:${ip}`, ZOOM_RPM);
+  if (!rl.success) {
+    return NextResponse.json(
+      { error: 'Too many requests' },
+      {
+        status: 429,
+        headers: { ...NO_STORE, 'Retry-After': String(retryAfterSeconds(rl.resetAt)) },
+      },
+    );
+  }
+
+  const locked = siteLockResponse(request);
+  if (locked) return locked;
+
+  const { album: albumToken, id: assetToken } = await params;
+  const albumId = decodeAssetId(albumToken);
+  const assetId = decodeAssetId(assetToken);
+  if (!albumId || !assetId) return notFound();
+
+  const config = getConfig();
+  if (!config.albums.includes(albumId)) return notFound();
+
+  // Zoom on, and a route to the album the visitor could have taken. A route
+  // handler is reached without passing through the page, so the page's gates
+  // are asked again here.
+  const cookieStore = await cookies();
+  const getCookie = (name: string) => cookieStore.get(name)?.value;
+  if (!isAlbumZoomReachable(albumId, getCookie)) return notFound();
+
+  // Same membership test as the image proxy: an album taken offline or an
+  // asset removed from it stops being served at once, not after the cache.
+  if (!(await isPublishedAsset(assetId))) return notFound();
+
+  let album;
+  try {
+    album = await immich.getAlbum(albumId);
+  } catch (error) {
+    if (error instanceof ImmichUnavailableError) return unavailable();
+    throw error;
+  }
+  if (!album) return notFound();
+
+  // The asset has to be in the album that authorised the zoom.
+  const asset = album.assets.find((candidate) => candidate.id === assetId);
+  if (!asset) return notFound();
+
+  const source = zoomSourceFor(asset);
+  if (!source) return notFound();
+
+  let result;
+  try {
+    // An edited photo (#831) is zoomed into Immich's edited full-size
+    // rendition, never its original, which is the unedited file. Redirects
+    // are not followed here either: should Immich send one, it would be to a
+    // smaller rendition, which must not pass for full resolution.
+    result =
+      source === 'original'
+        ? await immich.streamAsset(assetId, 'original')
+        : await immich.streamFullsize(assetId, source === 'edited');
+  } catch (error) {
+    if (error instanceof ImmichUnavailableError) return unavailable();
+    throw error;
+  }
+  // For `fullsize` this is the common "Immich has no rendition" case.
+  if (!result) return notFound();
+
+  const contentType = result.contentType.toLowerCase().split(';')[0].trim();
+  if (!ZOOM_CONTENT_TYPES.has(contentType)) {
+    await (result.stream as ReadableStream).cancel().catch(() => {});
+    console.warn(`[Zoom] Refused ${assetId}: Immich sent ${contentType || 'no type'}.`);
+    return notFound();
+  }
+
+  let scrubbed;
+  try {
+    scrubbed = await scrubLocationStream(result.stream as ReadableStream<Uint8Array>);
+  } catch (error) {
+    console.error(`[Zoom] Reading ${source} ${assetId} failed:`, error);
+    return unavailable();
+  }
+  if (!scrubbed.ok) {
+    console.warn(
+      `[Zoom] Refused ${assetId}: its location metadata could not be removed (${scrubbed.reason}).`,
+    );
+    return notFound();
+  }
+  if (scrubbed.format === 'passthrough') {
+    // Labelled JPEG/AVIF, but not a file the scrubber knows how to clean.
+    await scrubbed.stream.cancel().catch(() => {});
+    console.warn(`[Zoom] Refused ${assetId}: not a JPEG or HEIF-family file.`);
+    return notFound();
+  }
+
+  const headers: Record<string, string> = {
+    'Content-Type': contentType,
+    // Shown in the page, never saved by a click.
+    'Content-Disposition': 'inline',
+    // Private: the answer depends on this visitor's cookies, so a shared cache
+    // (a CDN, a proxy) must not hand it to the next one. An hour in the
+    // visitor's own cache makes a second zoom into the same photo free.
+    'Cache-Control': 'private, max-age=3600',
+    'X-Content-Type-Options': 'nosniff',
+  };
+  // Scrubbing overwrites in place, so the upstream length still holds.
+  if (result.contentLength) headers['Content-Length'] = result.contentLength;
+
+  return new NextResponse(scrubbed.stream, { headers });
+}
diff --git a/app/contact/contact.css b/app/contact/contact.css
index bb4da5c..0cb6413 100644
--- a/app/contact/contact.css
+++ b/app/contact/contact.css
@@ -45,18 +45,14 @@
   width: 100%;
   padding: 12px 14px;
   background: var(--bg-secondary);
-  border: 1px solid var(--border-subtle);
+  border: 1px solid var(--input-border);
   border-radius: var(--radius-md);
   color: var(--text-primary);
   font-family: var(--font-sans);
   font-size: 1rem;
-  transition: border-color var(--transition-fast);
-}
-.contact-form__input:focus-visible {
-  outline: 2px solid var(--accent);
-  outline-offset: 2px;
-  border-color: var(--accent);
 }
+/* The ring itself comes from the global focus rule (app/tokens.css), the
+   same one every link and button draws. */
 textarea.contact-form__input {
   min-height: 10rem;
   resize: vertical;
diff --git a/app/gate/page.tsx b/app/gate/page.tsx
index eabc846..01ef91c 100644
--- a/app/gate/page.tsx
+++ b/app/gate/page.tsx
@@ -5,12 +5,22 @@
  * the site is locked, which is what keeps the requested page from rendering
  * at all — a gate in the layout would still let the page produce its RSC
  * payload, album names and asset tokens included.
+ *
+ * The legal notice and the privacy policy are the exception: the proxy serves
+ * them to a locked site, and this page links them, so a visitor who cannot get
+ * in can still see who runs the site.
+ *
+ * /contact is served to a locked site as well, but not linked from here: it is
+ * open because the Impressum names it as a contact channel, and the Impressum
+ * links it. A form under the password field would read as "ask for access".
  */
 
 import type { Metadata } from 'next';
 import { notFound } from 'next/navigation';
 import { getConfig } from '@/lib/config';
 import { isSiteLocked, SITE_AUTH_KEY } from '@/lib/auth';
+import { privacyAvailable } from '@/lib/privacy';
+import { getServerDictionary } from '@/lib/i18n/server';
 import PasswordGate from '@/components/PasswordGate';
 
 export const dynamic = 'force-dynamic';
@@ -24,5 +34,20 @@ export default function GatePage() {
   // password configured there is no gate to show.
   if (!isSiteLocked()) notFound();
 
-  return <PasswordGate slug={SITE_AUTH_KEY} title={getConfig().siteTitle} type="site" />;
+  const config = getConfig();
+  const t = getServerDictionary();
+  // Only the pages that exist: a link to a switched-off one would be a 404.
+  const legalLinks = [
+    ...(config.legal.enabled ? [{ href: '/impressum', label: t.legal.navLabel }] : []),
+    ...(privacyAvailable(config) ? [{ href: '/privacy', label: t.privacy.navLabel }] : []),
+  ];
+
+  return (
+    <PasswordGate
+      slug={SITE_AUTH_KEY}
+      title={config.siteTitle}
+      type="site"
+      legalLinks={legalLinks}
+    />
+  );
 }
diff --git a/app/globals.css b/app/globals.css
index d5a2b92..5d1ffed 100644
--- a/app/globals.css
+++ b/app/globals.css
@@ -5,6 +5,11 @@
 @import url('./themes/noir.css');
 @import url('./themes/monograph.css');
 @import url('./themes/studio-modern.css');
+@import url('./themes/kunsthalle.css');
+@import url('./themes/ma.css');
+@import url('./themes/cyanotype.css');
+@import url('./themes/salon.css');
+@import url('./themes/birch.css');
 
 @import url('./tokens.css');
 @import url('./leaflet.css');
@@ -27,7 +32,7 @@
 
 .skip-link:focus {
   top: 0;
-  outline: 2px solid var(--text-primary);
+  outline: 2px solid var(--focus-ring);
 }
 
 /* ── Screen-reader-only text ──────────────────────── */
@@ -207,6 +212,32 @@
   /* 56px header + 48px original padding */
 }
 
+/* Sticky footer: on a short page (a journal with two entries, the 404) the
+   footer used to end wherever the content did, floating mid-viewport. The
+   visitor chrome is a column whose <main> takes the spare height. Scoped to
+   pages that carry that chrome — the admin, the setup screen and the site
+   gate render straight into <body> and keep their own layout. The header,
+   skip link, lightbox and dialogs are fixed or absolute, so they stay out of
+   the column. */
+body:has(> #main-content) {
+  display: flex;
+  flex-direction: column;
+  min-height: 100vh;
+  min-height: 100dvh;
+}
+
+body:has(> #main-content) > .main {
+  flex: 1 0 auto;
+  /* A flex item with auto side margins shrinks to its content; the width
+     puts it back to full width, --max-width still caps it. */
+  width: 100%;
+}
+
+body:has(> #main-content) > .footer {
+  flex-shrink: 0;
+  width: 100%;
+}
+
 /* Simple CSS Page Fade-In (Replaces Framer Motion).
  *
  * Opacity only — no `transform`. A transform on `.main` (even the identity
@@ -391,6 +422,12 @@
   display: none;
 }
 
+/* The aperture sign inside EXIF lines (components/ExifText.tsx). Presets that
+   set EXIF in capitals would otherwise print "Ƒ/4". */
+.exif-fsign {
+  text-transform: none;
+}
+
 /* ── Hero: Fullbleed Layout ─────────────────────── */
 .hero--fullbleed {
   position: relative;
@@ -1537,6 +1574,13 @@
   opacity: 1;
 }
 
+/* The wall label (PhotoGrid's figcaption): number, caption, EXIF under the
+   photo. Hidden unless a preset hangs its photos with one (kunsthalle), so
+   every other preset lays out as if it were not there. */
+.photo-grid__label {
+  display: none;
+}
+
 /* Hover-only overlays leave keyboard and touch visitors out (#696). A tile
    with keyboard focus shows its overlay like a hovered one, and on devices
    without hover — phones, and tablets wider than the 640px mobile rules — the
@@ -1881,38 +1925,94 @@
   flex-shrink: 0;
 }
 
-/* ─ Passepartout photo frame ─ */
-[data-photo-frame='passepartout'] .photo-grid__item {
-  border: 1px solid rgba(255, 255, 255, 0.12);
-  padding: 8px 8px 24px;
-  margin-bottom: var(--grid-gap, 24px);
-  background: #111;
+/* ─ Photo box inside a grid tile ─ */
+/* Covers the tile (the box next/image `fill` used to take from the tile
+   itself) unless a frame sets the mat variables. Clips the hover zoom to the
+   photo, so it cannot spill onto a mat. */
+.photo-grid__media {
+  position: absolute;
+  inset: var(--photo-mat, 0px) var(--photo-mat, 0px) var(--photo-mat-caption, 0px);
   overflow: hidden;
 }
 
-[data-photo-frame='passepartout'][data-theme='light'] .photo-grid__item {
-  border-color: rgba(0, 0, 0, 0.1);
-  background: #fff;
+/* ─ Passepartout photo frame ─ */
+/* A mat board around each photo, with the EXIF line printed in the wider
+   bottom band like the caption under a print: always shown, never over the
+   photo. The tile is the mat; PhotoGrid's .photo-grid__media holds the photo
+   and is inset by the mat below (without a frame it covers the tile, the
+   variables being unset). The geometry lives in these variables so the grain
+   overlay and the justified row math (lib/justifiedRow.ts) inset by exactly
+   the same amounts. Colours are the --mat-* tokens in tokens.css. */
+[data-photo-frame='passepartout'] .photo-grid {
+  --photo-mat: 8px;
+  --photo-mat-caption: 32px;
+  --photo-mat-border: 1px;
+  /* Everything around the photo, border included, across and down. */
+  --photo-mat-x: calc(2 * (var(--photo-mat) + var(--photo-mat-border)));
+  --photo-mat-y: calc(var(--photo-mat) + var(--photo-mat-caption) + 2 * var(--photo-mat-border));
 }
 
-[data-photo-frame='passepartout'] .photo-grid__item-exif {
-  position: relative;
-  bottom: auto;
-  left: auto;
-  right: auto;
+/* Also reaches the essay images, which share the class but have no mat. */
+[data-photo-frame='passepartout'] .photo-grid__item {
+  border: 1px solid var(--mat-border);
+  padding: 8px 8px 24px;
+  margin-bottom: var(--grid-gap, 24px);
+  background: var(--mat-bg);
+  overflow: hidden;
+}
+
+[data-photo-frame='passepartout'] .photo-grid .photo-grid__item {
+  /* The aspect ratio a layout gives the tile (the photo's own in masonry) has
+     to size the photo, not the photo plus its mat. */
+  box-sizing: content-box;
+  border-width: var(--photo-mat-border);
+  padding: var(--photo-mat) var(--photo-mat) var(--photo-mat-caption);
+}
+
+/* The rule above re-adds the masonry row spacing; these layouts space their
+   rows with the grid or flex gap, and doubled it under this frame. */
+[data-photo-frame='passepartout'] .photo-grid--uniform .photo-grid__item,
+[data-photo-frame='passepartout'] .photo-grid--showcase .photo-grid__item,
+[data-photo-frame='passepartout'] .photo-grid--filmstrip .photo-grid__item,
+[data-photo-frame='passepartout'] .photo-grid--editorial-flow .photo-grid__item,
+[data-photo-frame='passepartout'] .photo-grid--justified .photo-grid__item {
+  margin-bottom: 0;
+}
+
+/* Justified tiles fill a wrapper whose size already counts the mat. */
+[data-photo-frame='passepartout'] .photo-grid--justified .photo-grid__item {
+  box-sizing: border-box;
+}
+
+[data-photo-frame='passepartout'] .photo-grid .photo-grid__item-play {
+  inset: var(--photo-mat) var(--photo-mat) var(--photo-mat-caption);
+}
+
+/* Specific enough to beat the presets' own EXIF styles (noir, monograph,
+   studio-modern), which are overlays meant for a frameless tile. */
+[data-photo-frame='passepartout'] .photo-grid .photo-grid__item-exif {
+  display: block;
+  position: absolute;
+  top: auto;
+  left: var(--photo-mat);
+  right: var(--photo-mat);
+  bottom: 0;
+  height: var(--photo-mat-caption);
+  line-height: var(--photo-mat-caption);
+  padding: 0;
   background: none;
-  padding: 8px 0 0;
-  color: var(--text-muted);
+  -webkit-backdrop-filter: none;
+  backdrop-filter: none;
+  transform: none;
+  color: var(--mat-text);
   font-family: var(--font-caption);
   font-style: italic;
   font-size: 0.75rem;
   letter-spacing: 0.02em;
-  white-space: normal;
-  opacity: 1;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
   text-align: center;
-}
-
-[data-photo-frame='passepartout'] .photo-grid__item:hover .photo-grid__item-exif {
   opacity: 1;
 }
 
@@ -1928,13 +2028,14 @@
 }
 
 /* ─ Film grain overlay ─ */
+/* Over the photo only: the passepartout mat variables, 0 without a frame. */
 [data-grain='true'] .photo-grid__item::after {
   content: '';
   position: absolute;
-  top: 8px;
-  left: 8px;
-  right: 8px;
-  bottom: 24px;
+  top: var(--photo-mat, 0px);
+  left: var(--photo-mat, 0px);
+  right: var(--photo-mat, 0px);
+  bottom: var(--photo-mat-caption, 0px);
   background-image: url("data:image/svg+xml,%3Csvg viewBox='0 0 256 256' xmlns='http://www.w3.org/2000/svg'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' baseFrequency='0.85' numOctaves='4' stitchTiles='stitch'/%3E%3C/filter%3E%3Crect width='100%25' height='100%25' filter='url(%23n)' opacity='0.04'/%3E%3C/svg%3E");
   background-size: 128px 128px;
   pointer-events: none;
@@ -1942,15 +2043,6 @@
   mix-blend-mode: overlay;
 }
 
-/* Grain without passepartout — fill the whole item */
-[data-grain='true'][data-photo-frame='none'] .photo-grid__item::after,
-[data-grain='true'][data-photo-frame='shadow'] .photo-grid__item::after {
-  top: 0;
-  left: 0;
-  right: 0;
-  bottom: 0;
-}
-
 /* ── Gallery Aesthetics (all themes) ─────────────── */
 
 /* Generous spacing — gallery exhibition feel */
@@ -2015,7 +2107,7 @@
 
 .hero__nav-link:hover {
   border-bottom-color: var(--accent);
-  color: var(--accent);
+  color: var(--accent-text);
 }
 
 /* Album cards */
@@ -2045,17 +2137,17 @@
 /* Accent hover effects (works with any accent color) */
 .header__nav-link:hover,
 .header__nav-link.active {
-  color: var(--accent);
+  color: var(--accent-text);
   border-bottom-color: var(--accent);
 }
 
 .footer__link:hover {
-  color: var(--accent);
+  color: var(--accent-text);
 }
 
 .scroll-to-top:hover {
   border-color: var(--accent);
-  color: var(--accent);
+  color: var(--accent-text);
 }
 
 /* ── Tablet (iPad, kleine Laptops) ─────────────────── */
@@ -2151,8 +2243,13 @@
     opacity: 1;
   }
 
-  [data-photo-frame='passepartout'] .photo-grid__item {
-    padding: 6px 6px 18px;
+  [data-photo-frame='passepartout'] .photo-grid {
+    --photo-mat: 6px;
+    --photo-mat-caption: 26px;
+  }
+
+  [data-photo-frame='passepartout'] .photo-grid .photo-grid__item-exif {
+    font-size: 0.6875rem;
   }
 
   /* Minimal: adjust fullbleed hero for mobile */
diff --git a/app/install/InstallWizard.tsx b/app/install/InstallWizard.tsx
index cce8421..c8a1a7f 100644
--- a/app/install/InstallWizard.tsx
+++ b/app/install/InstallWizard.tsx
@@ -5,6 +5,7 @@ import { useMemo, useState } from 'react';
 // Direct import from the theme module, not from '@/lib/config': the config
 // index pulls in `fs` and cannot be bundled into a client component.
 import { DEFAULT_PRESET } from '@/lib/config/theme';
+import { PRESET_REGISTRY } from '@/lib/config/presets';
 import '../admin/admin.css';
 import './install.css';
 
@@ -22,19 +23,11 @@ interface Props {
 
 const STEPS = ['Connect', 'Albums', 'Site', 'Finish'] as const;
 
-const THEME_OPTIONS = [
-  {
-    value: 'studio-modern',
-    label: 'Studio Modern',
-    description: 'Precision grotesque, hairline rules',
-  },
-  { value: 'studio', label: 'Studio', description: 'Classic portfolio, red accent' },
-  { value: 'minimal', label: 'Minimal', description: 'Bare-bones, monochrome' },
-  { value: 'editorial', label: 'Editorial', description: 'Magazine-style serif' },
-  { value: 'classic', label: 'Classic', description: 'Warm gold, traditional' },
-  { value: 'noir', label: 'Noir', description: 'Dark, high-contrast' },
-  { value: 'monograph', label: 'Monograph', description: 'Typographic, text-first' },
-];
+const THEME_OPTIONS = PRESET_REGISTRY.map((p) => ({
+  value: p.id,
+  label: p.label,
+  description: p.tagline,
+}));
 
 export function InstallWizard({ initialApiUrl, setupToken }: Props) {
   const [step, setStep] = useState(0);
diff --git a/app/journal/[slug]/page.tsx b/app/journal/[slug]/page.tsx
index dd8a7b9..6ce4dbe 100644
--- a/app/journal/[slug]/page.tsx
+++ b/app/journal/[slug]/page.tsx
@@ -9,12 +9,14 @@ import { isAuthenticated } from '@/lib/auth';
 import { journalNeighbours } from '@/lib/journalNav';
 import { getConfig } from '@/lib/config';
 import { imageUrl } from '@/lib/urls';
+import { immich } from '@/lib/immich';
 import { EssayView } from '@/app/[...path]/EssayView';
 import { JournalNav } from '@/components/JournalNav';
 import PasswordGate from '@/components/PasswordGate';
 import { BackLink } from '@/components/BackLink';
 import { getServerDictionary } from '@/lib/i18n/server';
 import crypto from 'crypto';
+import '../journal.css';
 
 export const dynamic = 'force-dynamic';
 
@@ -50,12 +52,18 @@ export async function generateMetadata({ params }: JournalDetailPageProps): Prom
 
   const title = blocked ? t.journal.title : frontmatter.title || slug;
   const description = blocked
-    ? t.journal.description
+    ? t.journal.subtitle
     : frontmatter.subtitle || t.journal.entryDescription;
 
+  // The cover's asset for its edit marker (#831); the page body asks for the
+  // same one, from the same cache.
+  const coverAsset =
+    !blocked && frontmatter.coverAssetId
+      ? await immich.getAssetInfo(frontmatter.coverAssetId).catch(() => null)
+      : null;
   const ogImages =
     !blocked && frontmatter.coverAssetId
-      ? [{ url: imageUrl(frontmatter.coverAssetId, 'preview') }]
+      ? [{ url: imageUrl(coverAsset ?? frontmatter.coverAssetId, 'preview') }]
       : [];
 
   return {
@@ -178,6 +186,14 @@ export default async function JournalDetailPage({ params }: JournalDetailPagePro
     <div style={{ paddingTop: '2rem' }}>
       <div style={{ maxWidth: '1100px', margin: '0 auto', padding: '0 1.5rem 1rem' }}>
         <BackLink href="/journal" label={getServerDictionary().common.backToJournal} />
+        {/* Only an admin gets this far with a draft. The index marks it; the
+            entry itself looked published, which is exactly what a draft
+            preview must not look like. */}
+        {frontmatter.draft && (
+          <span className="journal-card__draft-badge" style={{ marginLeft: '1rem' }}>
+            {getServerDictionary().journal.draft}
+          </span>
+        )}
       </div>
       <EssayView
         essay={essayForClient}
diff --git a/app/journal/__tests__/journal-meta-draft.test.tsx b/app/journal/__tests__/journal-meta-draft.test.tsx
new file mode 100644
index 0000000..01b941c
--- /dev/null
+++ b/app/journal/__tests__/journal-meta-draft.test.tsx
@@ -0,0 +1,94 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ReactElement, ReactNode } from 'react';
+
+/**
+ * P-17: /journal shared as the site's home page (no openGraph of its own), and
+ * its meta description was a sentence the page never showed.
+ * P-21: a draft entry, which only an admin can open, looked published — the
+ * index marks drafts, the entry page did not.
+ */
+
+const readJournalEntry = vi.fn();
+let admin = false;
+
+vi.mock('@/lib/admin/journal-service', () => ({
+  readJournalEntry: (slug: string) => readJournalEntry(slug),
+  listJournalEntries: async () => [],
+}));
+vi.mock('@/lib/admin/auth', () => ({ isAdminAuthenticated: async () => admin }));
+vi.mock('next/headers', () => ({
+  cookies: async () => ({ get: () => undefined }),
+}));
+vi.mock('next/navigation', () => ({
+  notFound: () => {
+    throw new Error('notFound');
+  },
+}));
+vi.mock('@/lib/config', () => ({
+  getConfig: () => ({ authSecret: 'test-secret', watermark: undefined }),
+  getConfigOrNull: () => ({ lang: 'en' }),
+}));
+vi.mock('@/app/[...path]/essayPayload', () => ({
+  buildEssayPayload: async () => ({
+    essay: { frontmatter: {}, blocks: [] },
+    images: [],
+    coverToken: undefined,
+  }),
+}));
+vi.mock('@/app/[...path]/EssayView', () => ({ EssayView: () => null }));
+vi.mock('@/components/JournalNav', () => ({ JournalNav: () => null }));
+vi.mock('@/components/BackLink', () => ({ BackLink: () => null }));
+vi.mock('@/components/PasswordGate', () => ({ default: function PasswordGate() {} }));
+
+const { default: JournalDetailPage } = await import('../[slug]/page');
+const { generateMetadata: indexMetadata } = await import('../page');
+const { getServerDictionary } = await import('@/lib/i18n/server');
+
+/** Every string rendered anywhere in an element tree. */
+function texts(node: ReactNode): string[] {
+  if (node === null || node === undefined || typeof node === 'boolean') return [];
+  if (typeof node === 'string' || typeof node === 'number') return [String(node)];
+  if (Array.isArray(node)) return node.flatMap(texts);
+  const el = node as ReactElement<{ children?: ReactNode }>;
+  return texts(el.props?.children);
+}
+
+describe('/journal metadata', () => {
+  it('shares as the journal, with the subtitle the page shows', () => {
+    const t = getServerDictionary();
+    const m = indexMetadata();
+    expect(m.title).toBe(t.journal.title);
+    expect(m.description).toBe(t.journal.subtitle);
+    expect(m.openGraph?.title).toBe(t.journal.title);
+    expect(m.openGraph?.description).toBe(t.journal.subtitle);
+    const images = m.openGraph?.images as string[];
+    expect(images).toHaveLength(1);
+    expect(new URL(images[0], 'https://x.test').searchParams.get('title')).toBe(t.journal.title);
+  });
+});
+
+describe('journal entry draft badge', () => {
+  beforeEach(() => {
+    admin = true;
+    readJournalEntry.mockReset();
+  });
+
+  const render = async () =>
+    texts((await JournalDetailPage({ params: Promise.resolve({ slug: 'trip' }) })) as ReactElement);
+
+  it('marks a draft for the admin previewing it', async () => {
+    readJournalEntry.mockResolvedValue({
+      slug: 'trip',
+      parsed: { frontmatter: { title: 'Trip', draft: true }, blocks: [] },
+    });
+    expect(await render()).toContain(getServerDictionary().journal.draft);
+  });
+
+  it('does not mark a published entry', async () => {
+    readJournalEntry.mockResolvedValue({
+      slug: 'trip',
+      parsed: { frontmatter: { title: 'Trip' }, blocks: [] },
+    });
+    expect(await render()).not.toContain(getServerDictionary().journal.draft);
+  });
+});
diff --git a/app/journal/journal.css b/app/journal/journal.css
index 13844ba..ae1fde4 100644
--- a/app/journal/journal.css
+++ b/app/journal/journal.css
@@ -54,7 +54,7 @@
   color: inherit;
   background: var(--bg-card, rgba(255, 255, 255, 0.03));
   border: 1px solid var(--border-subtle, rgba(255, 255, 255, 0.08));
-  border-radius: 12px;
+  border-radius: var(--radius-md);
   overflow: hidden;
   transition:
     transform 0.25s ease,
@@ -157,7 +157,7 @@
   display: inline-flex;
   align-items: center;
   gap: 4px;
-  color: var(--accent, #6366f1);
+  color: var(--accent-text);
   transition: gap 0.2s ease;
 }
 
@@ -168,9 +168,9 @@
 .journal-card__draft-badge {
   display: inline-block;
   padding: 2px 8px;
-  background: rgba(234, 179, 8, 0.15);
-  color: #eab308;
-  border-radius: 4px;
+  background: color-mix(in srgb, var(--warning) 15%, transparent);
+  color: var(--warning);
+  border-radius: var(--radius-sm);
   font-size: 0.7rem;
   font-weight: 600;
   text-transform: uppercase;
diff --git a/app/journal/page.tsx b/app/journal/page.tsx
index 611304f..b383447 100644
--- a/app/journal/page.tsx
+++ b/app/journal/page.tsx
@@ -3,12 +3,13 @@ import Image from 'next/image';
 import type { Metadata } from 'next';
 import { cookies } from 'next/headers';
 import { type JournalEntrySummary } from '@/lib/journal';
-import { formatJournalDate } from '@/lib/journalDate';
+import { formatJournalDate, journalDateTime } from '@/lib/journalDate';
 import { listJournalEntriesForRequest } from '@/lib/journal.server';
 import { isAdminAuthenticated } from '@/lib/admin/auth';
 import { isAuthenticated } from '@/lib/auth';
 import { immich } from '@/lib/immich';
 import { imageUrl, assetPlaceholder } from '@/lib/urls';
+import { ogImageUrl } from '@/lib/ogImage';
 import { BackLink } from '@/components/BackLink';
 import { IconBook } from '@/components/Icons';
 import { getServerDictionary } from '@/lib/i18n/server';
@@ -16,9 +17,22 @@ import './journal.css';
 
 export const dynamic = 'force-dynamic';
 
+/**
+ * Without an openGraph of its own the index inherited the layout's, so a
+ * shared /journal link previewed as the site's home page. The description is
+ * the subtitle the page shows, not a second sentence found nowhere on it.
+ */
 export function generateMetadata(): Metadata {
   const t = getServerDictionary();
-  return { title: t.journal.title, description: t.journal.description };
+  const title = t.journal.title;
+  const description = t.journal.subtitle;
+  const ogImage = ogImageUrl(title);
+  return {
+    title,
+    description,
+    openGraph: { title, description, images: [ogImage] },
+    twitter: { card: 'summary_large_image', title, description, images: [ogImage] },
+  };
 }
 
 interface EnrichedJournalEntry extends JournalEntrySummary {
@@ -58,7 +72,7 @@ export default async function JournalIndexPage() {
         const ph = asset ? assetPlaceholder(asset) : null;
         return {
           ...entry,
-          coverUrl: imageUrl(entry.frontmatter.coverAssetId, 'preview'),
+          coverUrl: imageUrl(asset ?? entry.frontmatter.coverAssetId, 'preview'),
           blurDataURL: ph?.blurDataURL,
           dominantColor: ph?.dominantColor,
         };
@@ -90,6 +104,7 @@ export default async function JournalIndexPage() {
         <div className="journal-grid">
           {enrichedEntries.map((entry) => {
             const dateStr = formatJournalDate(entry.frontmatter.date, t.dateLocale);
+            const dateTime = journalDateTime(entry.frontmatter.date);
 
             return (
               <Link key={entry.slug} href={`/journal/${entry.slug}`} className="journal-card">
@@ -117,7 +132,12 @@ export default async function JournalIndexPage() {
 
                 <div className="journal-card__content">
                   <div className="journal-card__meta">
-                    {dateStr && <span>{dateStr}</span>}
+                    {dateStr &&
+                      (dateTime ? (
+                        <time dateTime={dateTime}>{dateStr}</time>
+                      ) : (
+                        <span>{dateStr}</span>
+                      ))}
                     {dateStr && entry.readingTimeMinutes && <span>•</span>}
                     {entry.readingTimeMinutes && (
                       <span>{t.journal.minRead(entry.readingTimeMinutes)}</span>
diff --git a/app/layout.tsx b/app/layout.tsx
index 53f12e5..03b1fdb 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -15,11 +15,12 @@ import { ScrollToTop } from '@/components/ScrollToTop';
 import { Footer } from '@/components/Footer';
 import { SetupScreen } from '@/components/SetupScreen';
 import { getConfigOrNull, getThemeFontsUrl, AppConfig } from '@/lib/config';
-import { accentForMode, onAccent } from '@/lib/config/theme';
+import { accentForMode, accentText, onAccent } from '@/lib/config/theme';
 import { isAdminPath } from '@/lib/admin/paths';
 import { isInstallPath } from '@/lib/install';
 import { isSiteLocked, isSiteUnlocked } from '@/lib/auth';
 import { ogImageUrl } from '@/lib/ogImage';
+import { THEME_INIT_SCRIPT } from '@/lib/themeScript';
 // DevToolbarLoader is a Client Component (ssr: false is only allowed there)
 import { DevToolbarLoader } from '@/components/DevToolbarLoader';
 import AssetProtection from '@/components/AssetProtection';
@@ -81,7 +82,8 @@ export async function generateMetadata(): Promise<Metadata> {
 
 export default async function RootLayout({ children }: { children: React.ReactNode }) {
   const config = getConfigOrNull();
-  const pathname = (await headers()).get('x-pathname');
+  const requestHeaders = await headers();
+  const pathname = requestHeaders.get('x-pathname');
 
   // gallery.yaml exists but cannot be derived — an empty gallery, a nameless
   // subpage, a subpage with no albums. The admin page builder can write all
@@ -106,6 +108,8 @@ export default async function RootLayout({ children }: { children: React.ReactNo
     '--accent-light': accentForMode(theme, 'light'),
     '--on-accent-dark': onAccent(accentForMode(theme, 'dark')),
     '--on-accent-light': onAccent(accentForMode(theme, 'light')),
+    '--accent-text-dark': accentText(accentForMode(theme, 'dark'), 'dark'),
+    '--accent-text-light': accentText(accentForMode(theme, 'light'), 'light'),
     '--font-serif': `'${theme.fonts.heading}', Georgia, 'Times New Roman', serif`,
     '--font-sans': `'${theme.fonts.body}', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif`,
     '--font-caption': `'${theme.fonts.caption}', Georgia, serif`,
@@ -140,6 +144,10 @@ export default async function RootLayout({ children }: { children: React.ReactNo
    * (`app/gate/page.tsx`) that `proxy.ts` rewrites to; all the layout does is
    * strip the chrome around it, because a header listing every subpage would
    * give away the shape of a site that is supposed to be shut.
+   *
+   * The same holds for the pages the proxy serves to a locked site
+   * (`UNGATED_PAGES` in proxy.ts): /impressum, /privacy and /contact render
+   * bare here until the visitor has unlocked the site.
    */
   const cookieStore = await cookies();
   const siteGated =
@@ -158,11 +166,21 @@ export default async function RootLayout({ children }: { children: React.ReactNo
       /* The configured starting mode is rendered server-side so the first paint
          is already right; `auto` deliberately carries no data-theme and lets the
          inline script below decide from the OS. data-default-theme is what
-         ThemeToggle reads for a visitor who has never chosen (#512). */
+         that script and ThemeToggle read for a visitor who has never chosen
+         (#512). */
       {...(config.colorMode === 'auto' ? {} : { 'data-theme': config.colorMode })}
       data-default-theme={config.colorMode}
     >
       <head>
+        {/* Applies a stored or OS-derived mode before the first paint, on
+            every page this layout renders — the gate and /admin included.
+            The nonce is the one proxy.ts put in the CSP; without it the
+            script is blocked silently. */}
+        <script
+          nonce={requestHeaders.get('x-nonce') ?? undefined}
+          suppressHydrationWarning
+          dangerouslySetInnerHTML={{ __html: THEME_INIT_SCRIPT }}
+        />
         <link rel="stylesheet" href={fontsUrl} />
       </head>
       <body>
diff --git a/app/leaflet.css b/app/leaflet.css
index 668a4cd..74e4237 100644
--- a/app/leaflet.css
+++ b/app/leaflet.css
@@ -95,7 +95,7 @@
 
 .map-popup__album-link {
   font-size: 0.8125rem;
-  color: var(--accent, #e60012);
+  color: var(--accent-text);
   text-decoration: none;
   transition: opacity 0.15s;
 }
diff --git a/app/map/page.tsx b/app/map/page.tsx
index 5b7549d..15f7d3e 100644
--- a/app/map/page.tsx
+++ b/app/map/page.tsx
@@ -4,7 +4,9 @@
  */
 
 import { getConfig } from '@/lib/config';
-import { isListedSubpage, listedAlbumIds } from '@/lib/config/schema';
+import { visibleMapCounts } from '@/lib/mapService';
+import { isAuthenticated } from '@/lib/auth';
+import { cookies } from 'next/headers';
 import { notFound } from 'next/navigation';
 import { MapView } from '@/components/MapView';
 import { BackLink } from '@/components/BackLink';
@@ -21,7 +23,7 @@ export function generateMetadata(): Metadata {
   return { title: getServerDictionary().map.title };
 }
 
-export default function MapPage() {
+export default async function MapPage() {
   const config = getConfig();
   const t = getServerDictionary();
 
@@ -29,10 +31,14 @@ export default function MapPage() {
     notFound();
   }
 
-  // Counts what the map may show: a hidden subpage is reachable by direct
-  // link only, so neither it nor an album only it carries is counted.
-  const collectionCount = config.subpages.filter(isListedSubpage).length;
-  const albumCount = listedAlbumIds(config).size;
+  // Counts what the map may show this viewer: a hidden subpage is reachable
+  // by direct link only, and a password-protected subpage or album the
+  // viewer has not unlocked is dropped by /api/map — neither is counted.
+  const cookieStore = await cookies();
+  const { collections: collectionCount, albums: albumCount } = visibleMapCounts(
+    config,
+    (key, type) => isAuthenticated(key, (name) => cookieStore.get(name)?.value, type),
+  );
 
   return (
     <>
diff --git a/app/not-found.tsx b/app/not-found.tsx
index f11e6d6..e19263c 100644
--- a/app/not-found.tsx
+++ b/app/not-found.tsx
@@ -1,6 +1,21 @@
 import Link from 'next/link';
+import type { Metadata } from 'next';
 import { getServerDictionary } from '@/lib/i18n/server';
 
+/**
+ * The head of a 404 that was decided before streaming — by proxy.ts or by a
+ * page calling notFound() outside any Suspense boundary. Next then renders
+ * this file inside the root layout and takes the metadata from the layouts
+ * and from here, never from the page, so without this the tab read the bare
+ * site title while a soft 404 read "Not found".
+ *
+ * `robots: null` drops the layout's `index, follow`, which contradicted the
+ * `noindex` Next adds to every 404 on its own.
+ */
+export function generateMetadata(): Metadata {
+  return { title: getServerDictionary().error.notFoundTitle, robots: null };
+}
+
 /**
  * Rendered when a page calls notFound() — i.e. Immich answered and the album
  * or asset genuinely does not exist.
diff --git a/app/themes/birch.css b/app/themes/birch.css
new file mode 100644
index 0000000..2082286
--- /dev/null
+++ b/app/themes/birch.css
@@ -0,0 +1,195 @@
+/* ══════════════════════════════════════════════════════
+   THEME: Birch — Scandinavian daylight
+   ══════════════════════════════════════════════════════
+
+   Birch-white and pine-night over green-tinted greys (tokens.css), pine
+   and lichen as the only accent, Albert Sans throughout. The signature is
+   what is missing: no uppercase and no letter-spacing anywhere in the
+   interface, where every other preset uses tracked caps. Corners come from
+   the theme radius (6px). */
+
+/* ── Sentence case everywhere ─────────────────────── */
+/* :is() takes its most specific argument, so one rule outranks every base
+   and hero-specific caps rule it lists. */
+[data-preset='birch']
+  :is(
+    .header__nav-link,
+    .header__wordmark,
+    .hero__title,
+    .hero__subtitle,
+    .hero__nav-link,
+    .hero--stacked .hero__title,
+    .hero--stacked .hero__subtitle,
+    .hero--fullbleed .hero__subtitle,
+    .hero--mosaic .hero__title,
+    .hero--mosaic .hero__subtitle,
+    .hero--mosaic .hero__nav-link,
+    .hero__thumbnail-label,
+    .hero__thumbnail-index,
+    .hero__nav-index,
+    .section-label,
+    .album-header__title,
+    .album-header__meta,
+    .album-header__download,
+    .subpage-title,
+    .subpage-subtitle,
+    .subpage-section__title,
+    .subpage-section__desc,
+    .subpage-toc__num,
+    .subpage-toc__label,
+    .subpage-grid__item-title,
+    .subpage-grid__item-count,
+    .subpage-grid__item-badge,
+    .album-card__title,
+    .album-card__count,
+    .photo-grid__item-exif,
+    .footer__name,
+    .footer__legal-link,
+    .back-link
+  ) {
+  text-transform: none;
+  letter-spacing: 0;
+  font-style: normal;
+}
+
+/* ── Header ───────────────────────────────────────── */
+[data-preset='birch'] .header {
+  background: color-mix(in srgb, var(--bg-primary) 92%, transparent);
+  border-bottom-color: var(--border-subtle);
+}
+
+[data-preset='birch'] .header__nav-link {
+  font-size: 0.85rem;
+  font-weight: 500;
+  border-bottom-color: transparent;
+}
+
+[data-preset='birch'] .header__nav-link:hover {
+  border-bottom-color: transparent;
+}
+
+/* The active link sits in a soft pill rather than on an underline. */
+[data-preset='birch'] .header__nav-link.active {
+  border-bottom-color: transparent;
+  background: var(--bg-card-hover);
+  border-radius: 999px;
+}
+
+/* ── Type ─────────────────────────────────────────── */
+[data-preset='birch'] .hero__title,
+[data-preset='birch'] .album-header__title,
+[data-preset='birch'] .subpage-title {
+  font-weight: 500;
+}
+
+[data-preset='birch'] .section-label {
+  font-size: 0.85rem;
+  font-weight: 500;
+  color: var(--text-secondary);
+}
+
+/* ── Photo grid: soft corners, pill EXIF ──────────── */
+[data-preset='birch'] .photo-grid {
+  --grid-gap: 10px;
+}
+
+[data-preset='birch'] .photo-grid__item img {
+  transition: filter 300ms ease;
+}
+
+[data-preset='birch'] .photo-grid__item:hover img {
+  transform: none;
+  filter: brightness(1.03);
+}
+
+[data-preset='birch'] .photo-grid__item-exif {
+  left: 10px;
+  right: auto;
+  bottom: 10px;
+  max-width: calc(100% - 20px);
+  padding: 4px 10px;
+  border-radius: 999px;
+  background: color-mix(in srgb, var(--bg-card) 88%, transparent);
+  color: var(--text-primary);
+  font-size: 0.7rem;
+  font-weight: 500;
+  transition-duration: 300ms;
+}
+
+/* ── Covers: soft corners, a 2px lift ─────────────── */
+[data-preset='birch'] .subpage-grid {
+  --subpage-gap: 16px;
+}
+
+[data-preset='birch'] .subpage-grid__item,
+[data-preset='birch'] .album-card {
+  border-radius: var(--radius-sm);
+  transition: transform 300ms ease;
+}
+
+[data-preset='birch'] .subpage-grid__item:hover,
+[data-preset='birch'] .album-card:hover {
+  transform: translateY(-2px);
+}
+
+[data-preset='birch'] .subpage-grid__item:hover img {
+  transform: none;
+  filter: brightness(0.8);
+}
+
+[data-preset='birch'] .subpage-grid__item-title,
+[data-preset='birch'] .album-card__title {
+  font-weight: 500;
+}
+
+/* ── Stacked hero: the photo inset with soft corners ─ */
+[data-preset='birch'] .hero--stacked {
+  gap: 12px;
+  padding: 16px 24px 24px;
+}
+
+[data-preset='birch'] .hero__stacked-image {
+  border-radius: var(--radius-md);
+  overflow: hidden;
+}
+
+[data-preset='birch'] .hero--stacked .hero__title {
+  font-family: var(--font-serif);
+  font-weight: 500;
+}
+
+[data-preset='birch'] .hero--stacked .hero__subtitle {
+  font-size: 0.95rem;
+  color: rgba(255, 255, 255, 0.85);
+}
+
+[data-preset='birch'] .hero__thumbnail-strip {
+  gap: 8px;
+  background: none;
+}
+
+[data-preset='birch'] .hero__thumbnail-item {
+  padding: 10px 18px;
+  border-radius: 999px;
+  background: var(--bg-card);
+  border: 1px solid var(--border-subtle);
+}
+
+[data-preset='birch'] .hero__thumbnail-item:hover {
+  background: var(--bg-card-hover);
+}
+
+[data-preset='birch'] .hero__thumbnail-label {
+  font-size: 0.85rem;
+  font-weight: 500;
+}
+
+@media (max-width: 640px) {
+  [data-preset='birch'] .hero--stacked {
+    padding: 8px 12px 16px;
+  }
+
+  [data-preset='birch'] .hero__stacked-overlay {
+    padding: 32px 20px;
+  }
+}
diff --git a/app/themes/classic.css b/app/themes/classic.css
index c84c828..fe46269 100644
--- a/app/themes/classic.css
+++ b/app/themes/classic.css
@@ -51,7 +51,7 @@
   display: block;
   margin-top: 20px;
   font-size: 0.5rem;
-  color: var(--accent);
+  color: var(--accent-text);
   letter-spacing: 0;
 }
 
@@ -66,7 +66,7 @@
 }
 
 [data-preset='classic'] .hero__nav-link:hover {
-  color: var(--accent);
+  color: var(--accent-text);
   border-bottom-color: transparent;
 }
 
@@ -84,17 +84,6 @@
   transform: scale(1.01);
 }
 
-/* Warm passepartout override */
-[data-preset='classic'][data-photo-frame='passepartout'] .photo-grid__item {
-  background: #1a1816;
-  border-color: rgba(196, 154, 60, 0.12);
-}
-
-[data-preset='classic'][data-photo-frame='passepartout'][data-theme='light'] .photo-grid__item {
-  background: #fffdf5;
-  border-color: rgba(196, 154, 60, 0.2);
-}
-
 /* Album cards: warm rounded, gold hover */
 [data-preset='classic'] .album-card {
   border-radius: 12px;
@@ -135,12 +124,12 @@
 
 [data-preset='classic'] .section-label::before {
   content: '— ';
-  color: var(--accent);
+  color: var(--accent-text);
 }
 
 [data-preset='classic'] .section-label::after {
   content: ' —';
-  color: var(--accent);
+  color: var(--accent-text);
 }
 
 /* Album & Subpage header: elegant serif */
@@ -177,7 +166,7 @@
 
 [data-preset='classic'] .scroll-to-top:hover {
   border-color: var(--accent);
-  color: var(--accent);
+  color: var(--accent-text);
 }
 
 /* Subpage grid: warm borders */
@@ -202,7 +191,7 @@
   content: '◆';
   padding: 0 14px;
   font-size: 0.45rem;
-  color: var(--accent);
+  color: var(--accent-text);
 }
 
 [data-preset='classic'] .subpage-toc__num {
@@ -222,7 +211,7 @@
 }
 
 [data-preset='classic'] .subpage-toc__link:hover {
-  color: var(--accent);
+  color: var(--accent-text);
 }
 
 /* Section: ornamental centered divider rule */
@@ -259,5 +248,5 @@
   content: '—◆—';
   font-size: 0.55rem;
   letter-spacing: 0.2em;
-  color: var(--accent);
+  color: var(--accent-text);
 }
diff --git a/app/themes/cyanotype.css b/app/themes/cyanotype.css
new file mode 100644
index 0000000..47cf200
--- /dev/null
+++ b/app/themes/cyanotype.css
@@ -0,0 +1,278 @@
+/* ══════════════════════════════════════════════════════
+   THEME: Cyanotype — a Prussian-blue print, set like a drawing sheet
+   ══════════════════════════════════════════════════════
+
+   Ink-blue night in dark mode; in light mode every piece of text is
+   Prussian ink on cool paper (tokens.css). Jost for type, DM Mono 300 for
+   numbers and EXIF, ruled title blocks, registration marks, and sheets
+   indexed A-01, A-02. */
+
+[data-preset='cyanotype'] {
+  /* Registration marks sit on the photo, so they are light in both modes. */
+  --cy-reg: rgba(255, 255, 255, 0.75);
+}
+
+/* ── Header: one ruled line ───────────────────────── */
+[data-preset='cyanotype'] .header {
+  background: color-mix(in srgb, var(--bg-primary) 94%, transparent);
+  border-bottom: 1px solid var(--border-hover);
+}
+
+[data-preset='cyanotype'] .header__nav-link {
+  font-size: 0.68rem;
+  font-weight: 500;
+  letter-spacing: 0.16em;
+  text-transform: uppercase;
+  border-bottom-color: transparent;
+}
+
+[data-preset='cyanotype'] .header__nav-link:hover {
+  border-bottom-color: transparent;
+}
+
+[data-preset='cyanotype'] .header__nav-link.active {
+  color: var(--accent-text, var(--accent));
+  border-bottom-color: transparent;
+  text-decoration: underline;
+  text-decoration-thickness: 1px;
+  text-underline-offset: 6px;
+}
+
+/* ── Type ─────────────────────────────────────────── */
+[data-preset='cyanotype'] .hero__title,
+[data-preset='cyanotype'] .album-header__title,
+[data-preset='cyanotype'] .subpage-title {
+  font-weight: 300;
+  letter-spacing: -0.01em;
+  text-transform: none;
+}
+
+[data-preset='cyanotype'] .hero__subtitle,
+[data-preset='cyanotype'] .subpage-subtitle {
+  font-style: normal;
+}
+
+[data-preset='cyanotype'] .section-label,
+[data-preset='cyanotype'] .subpage-section__desc {
+  font-size: 0.68rem;
+  font-weight: 500;
+  letter-spacing: 0.16em;
+  text-transform: uppercase;
+  color: var(--text-secondary);
+}
+
+/* Title block: the album metadata as a ruled cell, in DM Mono. */
+[data-preset='cyanotype'] .album-header__meta {
+  display: inline-flex;
+  flex-wrap: wrap;
+  border: 1px solid var(--border-hover);
+  font-family: var(--font-caption);
+  font-size: 0.7rem;
+  font-weight: 300;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  color: var(--text-secondary);
+}
+
+[data-preset='cyanotype'] .album-header__meta > span {
+  padding: 6px 12px;
+}
+
+[data-preset='cyanotype'] .album-header__meta > span + span {
+  border-left: 1px solid var(--border-hover);
+}
+
+/* ── Photo grid: the architectural module ─────────── */
+[data-preset='cyanotype'] .photo-grid {
+  --grid-gap: 24px;
+}
+
+[data-preset='cyanotype'] .photo-grid__item:hover img {
+  transform: none;
+  filter: none;
+}
+
+/* Registration marks: four 12px corner ticks, faded in on hover and focus.
+   ::after belongs to the grain overlay, so they use ::before. */
+[data-preset='cyanotype'] .photo-grid__item::before {
+  content: '';
+  position: absolute;
+  inset: 8px;
+  z-index: 2;
+  pointer-events: none;
+  opacity: 0;
+  transition: opacity var(--transition-fast);
+  background:
+    linear-gradient(var(--cy-reg), var(--cy-reg)) left top / 12px 1px no-repeat,
+    linear-gradient(var(--cy-reg), var(--cy-reg)) left top / 1px 12px no-repeat,
+    linear-gradient(var(--cy-reg), var(--cy-reg)) right top / 12px 1px no-repeat,
+    linear-gradient(var(--cy-reg), var(--cy-reg)) right top / 1px 12px no-repeat,
+    linear-gradient(var(--cy-reg), var(--cy-reg)) left bottom / 12px 1px no-repeat,
+    linear-gradient(var(--cy-reg), var(--cy-reg)) left bottom / 1px 12px no-repeat,
+    linear-gradient(var(--cy-reg), var(--cy-reg)) right bottom / 12px 1px no-repeat,
+    linear-gradient(var(--cy-reg), var(--cy-reg)) right bottom / 1px 12px no-repeat;
+}
+
+[data-preset='cyanotype'] .photo-grid__item:hover::before,
+[data-preset='cyanotype'] .photo-grid__item:focus-visible::before {
+  opacity: 1;
+}
+
+[data-preset='cyanotype'] .photo-grid__item-exif {
+  font-family: var(--font-caption);
+  font-size: 0.65rem;
+  font-weight: 300;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  transition-duration: 200ms;
+}
+
+/* ── Covers: sheets with a caption bar ────────────── */
+[data-preset='cyanotype'] .subpage-grid {
+  --subpage-gap: 24px;
+}
+
+[data-preset='cyanotype'] .subpage-grid__item {
+  aspect-ratio: auto;
+  border: 1px solid var(--border-subtle);
+  background: var(--bg-card);
+  transition: border-color var(--transition-fast);
+}
+
+[data-preset='cyanotype'] .subpage-grid__item:hover {
+  border-color: var(--border-hover);
+}
+
+[data-preset='cyanotype'] .subpage-grid__item-media {
+  aspect-ratio: 3 / 2;
+  height: auto;
+}
+
+[data-preset='cyanotype'] .subpage-grid__item:hover img {
+  transform: none;
+  filter: none;
+}
+
+[data-preset='cyanotype'] .subpage-grid__item-overlay,
+[data-preset='cyanotype'] .subpage-grid__item-badge {
+  display: none;
+}
+
+[data-preset='cyanotype'] .subpage-grid__item-caption {
+  display: flex;
+  align-items: baseline;
+  gap: 14px;
+  padding: 12px 16px;
+  border-top: 1px solid var(--border-subtle);
+}
+
+[data-preset='cyanotype'] .subpage-grid__item-index,
+[data-preset='cyanotype'] .subpage-grid__item-caption-count {
+  font-family: var(--font-caption);
+  font-size: 0.68rem;
+  font-weight: 400;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  white-space: nowrap;
+}
+
+[data-preset='cyanotype'] .subpage-grid__item-index {
+  color: var(--accent-text, var(--accent));
+}
+
+[data-preset='cyanotype'] .subpage-grid__item-index::before,
+[data-preset='cyanotype'] .hero__nav-index::before {
+  content: 'A-';
+}
+
+[data-preset='cyanotype'] .subpage-grid__item-caption-title {
+  font-size: 0.95rem;
+  font-weight: 400;
+  color: var(--text-primary);
+}
+
+[data-preset='cyanotype'] .subpage-grid__item-caption-count {
+  margin-left: auto;
+  color: var(--text-muted);
+}
+
+[data-preset='cyanotype'] .album-card {
+  border: 1px solid var(--border-subtle);
+}
+
+[data-preset='cyanotype'] .album-card:hover {
+  transform: none;
+  border-color: var(--border-hover);
+}
+
+/* ── Split hero: sheet list and title block ───────── */
+[data-preset='cyanotype'] .hero--split .hero__content {
+  text-align: left;
+}
+
+[data-preset='cyanotype'] .hero--split .hero__nav {
+  align-items: stretch;
+  gap: 0;
+  border-top: 1px solid var(--border-hover);
+}
+
+[data-preset='cyanotype'] .hero--split .hero__nav-link {
+  display: flex;
+  align-items: baseline;
+  gap: 16px;
+  padding: 10px 0;
+  border-bottom: 1px solid var(--border-subtle);
+  font-weight: 400;
+  text-decoration: none;
+}
+
+[data-preset='cyanotype'] .hero--split .hero__nav-link:hover {
+  color: var(--accent-text, var(--accent));
+}
+
+[data-preset='cyanotype'] .hero .hero__nav-index {
+  display: inline-block;
+  font-family: var(--font-caption);
+  font-size: 0.68rem;
+  font-weight: 300;
+  color: var(--accent-text, var(--accent));
+}
+
+/* The hero EXIF chip, drawn as a cell of a drawing's title block. */
+[data-preset='cyanotype'] .hero--split .hero__exif-chip {
+  position: absolute;
+  left: 24px;
+  bottom: 24px;
+  z-index: 3;
+  display: inline-flex;
+  max-width: calc(100% - 96px);
+  padding: 6px 10px;
+  border: 1px solid var(--border-hover);
+  background: var(--bg-primary);
+  color: var(--text-secondary);
+  font-family: var(--font-caption);
+  font-size: 0.68rem;
+  font-weight: 300;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  pointer-events: none;
+}
+
+[data-preset='cyanotype'] .footer {
+  border-top: 1px solid var(--border-hover);
+}
+
+@media (max-width: 640px) {
+  [data-preset='cyanotype'] .photo-grid {
+    --grid-gap: 12px;
+  }
+
+  [data-preset='cyanotype'] .hero--split .hero__exif-chip {
+    left: 12px;
+    bottom: 12px;
+    max-width: calc(100% - 80px);
+  }
+}
diff --git a/app/themes/editorial.css b/app/themes/editorial.css
index f530cba..f54f19a 100644
--- a/app/themes/editorial.css
+++ b/app/themes/editorial.css
@@ -47,7 +47,7 @@
 }
 
 [data-preset='editorial'] .hero__nav-link:hover {
-  color: var(--accent);
+  color: var(--accent-text);
   border-bottom-color: transparent;
 }
 
@@ -213,7 +213,7 @@
 }
 
 [data-preset='editorial'] .subpage-toc__link:hover {
-  color: var(--accent);
+  color: var(--accent-text);
 }
 
 /* Section: pull-quote accent border, large cinematic title */
diff --git a/app/themes/kunsthalle.css b/app/themes/kunsthalle.css
new file mode 100644
index 0000000..53053b1
--- /dev/null
+++ b/app/themes/kunsthalle.css
@@ -0,0 +1,370 @@
+/* ══════════════════════════════════════════════════════
+   THEME: Kunsthalle — photographs hung on a grey gallery wall
+   ══════════════════════════════════════════════════════
+
+   The grey surround (tokens.css) is the point: lighter than every dark
+   preset, darker than every light one, as in an ISO 3664 viewing booth.
+   Everything else is a museum signage system: one family (Libre Franklin),
+   sentence-case titles, small tracked labels, and petrol reserved for
+   wayfinding — links and hover, never decoration. */
+
+[data-preset='kunsthalle'] {
+  /* The hung shadow: a tight contact shadow plus a soft drop below. */
+  --kh-hang: 0 1px 2px rgba(0, 0, 0, 0.14), 0 14px 28px -14px rgba(0, 0, 0, 0.28);
+  --kh-hang-hover: 0 2px 4px rgba(0, 0, 0, 0.18), 0 20px 36px -16px rgba(0, 0, 0, 0.36);
+}
+
+[data-preset='kunsthalle'][data-theme='light'] {
+  --kh-hang: 0 1px 2px rgba(0, 0, 0, 0.1), 0 14px 28px -16px rgba(0, 0, 0, 0.22);
+  --kh-hang-hover: 0 2px 4px rgba(0, 0, 0, 0.12), 0 20px 36px -16px rgba(0, 0, 0, 0.3);
+}
+
+/* ── Header: wall colour, no rule ─────────────────── */
+[data-preset='kunsthalle'] .header {
+  background: color-mix(in srgb, var(--bg-primary) 94%, transparent);
+  border-bottom-color: transparent;
+}
+
+[data-preset='kunsthalle'] .header__wordmark {
+  display: flex;
+  align-items: center;
+  margin-right: 24px;
+  font-family: var(--font-serif);
+  font-size: 0.9rem;
+  font-weight: 600;
+  color: var(--text-primary);
+  white-space: nowrap;
+}
+
+[data-preset='kunsthalle'] .header__nav-link {
+  font-size: 0.8rem;
+  font-weight: 400;
+  letter-spacing: 0;
+  text-transform: none;
+}
+
+[data-preset='kunsthalle'] .header__nav-link:hover {
+  color: var(--accent-text, var(--accent));
+  border-bottom-color: transparent;
+}
+
+[data-preset='kunsthalle'] .header__nav-link.active {
+  color: var(--text-primary);
+  border-bottom-color: var(--text-primary);
+}
+
+/* ── Titles: sentence case, Franklin 500 ──────────── */
+[data-preset='kunsthalle'] .hero__title,
+[data-preset='kunsthalle'] .album-header__title,
+[data-preset='kunsthalle'] .subpage-title {
+  font-weight: 500;
+  letter-spacing: -0.01em;
+  text-transform: none;
+}
+
+[data-preset='kunsthalle'] .hero__subtitle,
+[data-preset='kunsthalle'] .album-header__meta,
+[data-preset='kunsthalle'] .subpage-subtitle {
+  font-style: normal;
+  letter-spacing: 0;
+  text-transform: none;
+}
+
+/* Labels: the small caps line on a wall text. */
+[data-preset='kunsthalle'] .section-label,
+[data-preset='kunsthalle'] .subpage-section__desc {
+  font-size: 0.68rem;
+  font-weight: 600;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: var(--text-secondary);
+}
+
+/* ── Photo grid: hung works with wall between them ── */
+/* Each photo hangs with a wall label below it: PhotoGrid's figcaption
+   (.photo-grid__label), in flow under the tile, so a long caption pushes the
+   next row down instead of running into it. The rows and columns between the
+   works are wall: at least 16px even when settings.yaml sets a tighter
+   grid.gap, which lands inline and beats the preset's 56px. */
+[data-preset='kunsthalle'] .photo-grid {
+  --grid-gap: 56px;
+  row-gap: max(var(--grid-gap), 16px);
+}
+
+[data-preset='kunsthalle'] .photo-grid .photo-grid__item {
+  margin-bottom: 0;
+  transition: box-shadow var(--transition-fast);
+}
+
+/* Masonry: the work and its label stay together in one column, and the
+   wall below them is the figure's, not the tile's. */
+[data-preset='kunsthalle'] .photo-grid--masonry > .fade-in {
+  break-inside: avoid;
+  margin-bottom: max(var(--grid-gap), 16px);
+}
+
+/* Justified: the tile keeps the row height and the label hangs below it,
+   so the figure grows rather than the photo shrinking. */
+[data-preset='kunsthalle'] .photo-grid--justified > .fade-in {
+  height: auto;
+}
+
+[data-preset='kunsthalle'] .photo-grid--justified .photo-grid__item {
+  height: var(--grid-row-height);
+}
+
+/* The shadow frame, retuned from a soft halo to a hung shadow. */
+[data-preset='kunsthalle'][data-photo-frame='shadow'] .photo-grid__item {
+  box-shadow: var(--kh-hang);
+}
+
+[data-preset='kunsthalle'][data-photo-frame='shadow'] .photo-grid__item:hover {
+  box-shadow: var(--kh-hang-hover);
+}
+
+/* Still photos: no zoom, no dimming. */
+[data-preset='kunsthalle'] .photo-grid__item:hover img {
+  transform: none;
+  filter: none;
+}
+
+/* The EXIF line moves from the photo to the wall label. Under passepartout
+   it stays printed on the mat (that frame's rule outranks this one), and the
+   label drops its copy below. */
+[data-preset='kunsthalle'] .photo-grid__item-exif {
+  display: none;
+}
+
+[data-preset='kunsthalle'][data-photo-frame='passepartout'] .photo-grid__label-exif {
+  display: none;
+}
+
+/* Wall label: catalogue number, the photo's caption when the site publishes
+   one, then camera and lens, in small Franklin on the wall. */
+[data-preset='kunsthalle'] .photo-grid__label {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  /* As wide as the photo and never wider: a filmstrip frame sizes to its
+     content, and a long caption must not stretch it. */
+  width: 0;
+  min-width: 100%;
+  padding-top: 12px;
+  font-family: var(--font-caption);
+  font-size: 0.68rem;
+  font-weight: 400;
+  letter-spacing: 0.01em;
+  line-height: 1.45;
+  color: var(--text-muted);
+  transition: color var(--transition-fast);
+}
+
+[data-preset='kunsthalle'] .photo-grid__label-no {
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  font-variant-numeric: tabular-nums;
+  color: var(--text-secondary);
+}
+
+[data-preset='kunsthalle'] .photo-grid__label-no::before {
+  content: 'No. ';
+}
+
+/* The caption reads as the work's title; three lines at most on the wall,
+   the lightbox has the rest. */
+[data-preset='kunsthalle'] .photo-grid__label-title {
+  display: -webkit-box;
+  -webkit-box-orient: vertical;
+  -webkit-line-clamp: 3;
+  line-clamp: 3;
+  overflow: hidden;
+  overflow-wrap: anywhere;
+  font-size: 0.8rem;
+  font-weight: 500;
+  letter-spacing: 0;
+  color: var(--text-primary);
+}
+
+[data-preset='kunsthalle'] .photo-grid__item:is(:hover, :focus-visible) + .photo-grid__label {
+  color: var(--text-secondary);
+}
+
+/* ── Album covers: hung, with a wall label below ──── */
+[data-preset='kunsthalle'] .subpage-grid {
+  --subpage-gap: 40px;
+}
+
+[data-preset='kunsthalle'] .subpage-grid__item {
+  aspect-ratio: auto;
+  overflow: visible;
+}
+
+[data-preset='kunsthalle'] .subpage-grid__item-media {
+  aspect-ratio: 3 / 2;
+  height: auto;
+  box-shadow: var(--kh-hang);
+  transition: box-shadow var(--transition-fast);
+}
+
+[data-preset='kunsthalle'] .subpage-grid__item:hover .subpage-grid__item-media {
+  box-shadow: var(--kh-hang-hover);
+}
+
+[data-preset='kunsthalle'] .subpage-grid__item:hover img {
+  transform: none;
+  filter: none;
+}
+
+[data-preset='kunsthalle'] .subpage-grid__item-overlay,
+[data-preset='kunsthalle'] .subpage-grid__item-badge {
+  display: none;
+}
+
+[data-preset='kunsthalle'] .subpage-grid__item-caption {
+  display: grid;
+  grid-template-columns: auto 1fr;
+  gap: 0 12px;
+  padding: 14px 0 0;
+  line-height: 1.4;
+}
+
+[data-preset='kunsthalle'] .subpage-grid__item-index {
+  grid-row: span 2;
+  font-size: 0.68rem;
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  color: var(--text-muted);
+  font-variant-numeric: tabular-nums;
+}
+
+[data-preset='kunsthalle'] .subpage-grid__item-index::before {
+  content: 'No. ';
+}
+
+[data-preset='kunsthalle'] .subpage-grid__item-caption-title {
+  font-size: 0.9rem;
+  font-weight: 500;
+  color: var(--text-primary);
+  transition: color var(--transition-fast);
+}
+
+[data-preset='kunsthalle'] .subpage-grid__item:hover .subpage-grid__item-caption-title {
+  color: var(--accent-text, var(--accent));
+}
+
+[data-preset='kunsthalle'] .subpage-grid__item-caption-count {
+  font-size: 0.72rem;
+  color: var(--text-muted);
+}
+
+/* Standalone album cards on the home page */
+[data-preset='kunsthalle'] .album-card {
+  border: none;
+  box-shadow: var(--kh-hang);
+}
+
+[data-preset='kunsthalle'] .album-card:hover {
+  transform: none;
+  box-shadow: var(--kh-hang-hover);
+}
+
+[data-preset='kunsthalle'] .album-card:hover .album-card__image {
+  transform: none;
+}
+
+/* ── Mosaic hero: a wall of works, the title below ── */
+[data-preset='kunsthalle'] .hero--mosaic {
+  min-height: 0;
+}
+
+[data-preset='kunsthalle'] .hero__mosaic-grid {
+  gap: 28px;
+  min-height: 0;
+  height: clamp(360px, 64vh, 760px);
+  padding: 40px 40px 0;
+  max-width: var(--max-width);
+  margin: 0 auto;
+}
+
+[data-preset='kunsthalle'] .hero__mosaic-cell {
+  box-shadow: var(--kh-hang);
+}
+
+[data-preset='kunsthalle'] .hero__mosaic-overlay {
+  position: static;
+  transform: none;
+  max-width: var(--max-width);
+  margin: 0 auto;
+  padding: 32px 40px 72px;
+  text-align: left;
+  background: none;
+  backdrop-filter: none;
+  -webkit-backdrop-filter: none;
+  border: none;
+  border-radius: 0;
+}
+
+[data-preset='kunsthalle'] .hero--mosaic .hero__title {
+  font-size: clamp(1.75rem, 3vw, 2.5rem);
+  font-weight: 500;
+  letter-spacing: -0.01em;
+  text-transform: none;
+  color: var(--text-primary);
+}
+
+[data-preset='kunsthalle'] .hero--mosaic .hero__subtitle {
+  font-size: 0.85rem;
+  font-weight: 400;
+  letter-spacing: 0;
+  text-transform: none;
+  color: var(--text-muted);
+  margin-bottom: 20px;
+}
+
+[data-preset='kunsthalle'] .hero--mosaic .hero__nav {
+  justify-content: flex-start;
+  gap: 8px 24px;
+}
+
+[data-preset='kunsthalle'] .hero--mosaic .hero__nav-link {
+  font-size: 0.85rem;
+  letter-spacing: 0;
+  text-transform: none;
+  color: var(--text-secondary);
+}
+
+[data-preset='kunsthalle'] .hero--mosaic .hero__nav-link:hover {
+  color: var(--accent-text, var(--accent));
+  border-bottom-color: var(--accent);
+}
+
+/* The other hero styles keep their own layout; only the type follows. */
+[data-preset='kunsthalle'] .hero__nav-link {
+  text-decoration-color: var(--border-hover);
+}
+
+/* ── Footer ───────────────────────────────────────── */
+[data-preset='kunsthalle'] .footer {
+  border-top-color: transparent;
+}
+
+@media (max-width: 640px) {
+  [data-preset='kunsthalle'] .header__wordmark {
+    display: none;
+  }
+
+  [data-preset='kunsthalle'] .photo-grid {
+    --grid-gap: 44px;
+  }
+
+  [data-preset='kunsthalle'] .hero__mosaic-grid {
+    gap: 16px;
+    height: 72vh;
+    height: 72svh;
+    padding: 24px 20px 0;
+  }
+
+  [data-preset='kunsthalle'] .hero__mosaic-overlay {
+    padding: 24px 20px 56px;
+  }
+}
diff --git a/app/themes/ma.css b/app/themes/ma.css
new file mode 100644
index 0000000..4035a6c
--- /dev/null
+++ b/app/themes/ma.css
@@ -0,0 +1,243 @@
+/* ══════════════════════════════════════════════════════
+   THEME: Ma — negative space as the material
+   ══════════════════════════════════════════════════════
+
+   Washi-grey paper (light) or sumi (dark), one vermilion seal. Space does
+   the work: two columns, 64px between photos, an asymmetric offset, slow
+   fades and no hover transforms. The only Japanese device is tategaki —
+   the hero subtitle set vertically on desktop. */
+
+/* ── Header: transparent, no rule ─────────────────── */
+[data-preset='ma'] .header {
+  background: color-mix(in srgb, var(--bg-primary) 92%, transparent);
+  border-bottom-color: transparent;
+}
+
+/* The hanko: the header dot as a small square seal. */
+[data-preset='ma'][data-header-dot='true'] .header__nav::before {
+  width: 9px;
+  height: 9px;
+  border-radius: 0;
+  margin-right: 14px;
+}
+
+[data-preset='ma'] .header__nav-link {
+  font-size: 0.78rem;
+  font-weight: 300;
+  letter-spacing: 0.08em;
+  text-transform: none;
+  border-bottom-color: transparent;
+}
+
+[data-preset='ma'] .header__nav-link:hover,
+[data-preset='ma'] .header__nav-link.active {
+  border-bottom-color: transparent;
+}
+
+/* The active link carries the seal instead of an underline. */
+[data-preset='ma'] .header__nav-link.active::before {
+  content: '';
+  display: inline-block;
+  width: 5px;
+  height: 5px;
+  margin-right: 8px;
+  vertical-align: 0.15em;
+  background: var(--accent);
+}
+
+/* ── Type ─────────────────────────────────────────── */
+[data-preset='ma'] body {
+  line-height: 1.8;
+}
+
+[data-preset='ma'] .hero__title,
+[data-preset='ma'] .album-header__title,
+[data-preset='ma'] .subpage-title {
+  font-weight: 300;
+  letter-spacing: 0;
+  text-transform: none;
+}
+
+[data-preset='ma'] .album-header__title,
+[data-preset='ma'] .subpage-title {
+  font-size: clamp(2.2rem, 4vw, 3.2rem);
+  line-height: 1.05;
+}
+
+[data-preset='ma'] .hero__subtitle,
+[data-preset='ma'] .album-header__meta,
+[data-preset='ma'] .subpage-subtitle {
+  font-style: normal;
+  font-weight: 300;
+  text-transform: none;
+}
+
+[data-preset='ma'] .section-label,
+[data-preset='ma'] .subpage-section__desc {
+  font-size: 0.68rem;
+  font-weight: 400;
+  letter-spacing: 0.12em;
+  color: var(--text-secondary);
+}
+
+/* Light mode: a faint paper fibre on the page, never on the photos. */
+[data-preset='ma'][data-theme='light'] body {
+  background-image: url("data:image/svg+xml,%3Csvg viewBox='0 0 256 256' xmlns='http://www.w3.org/2000/svg'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' baseFrequency='0.65' numOctaves='3' stitchTiles='stitch'/%3E%3C/filter%3E%3Crect width='100%25' height='100%25' filter='url(%23n)' opacity='0.025'/%3E%3C/svg%3E");
+  background-size: 256px 256px;
+}
+
+/* ── Photo grid: air, stillness ───────────────────── */
+[data-preset='ma'] .photo-grid {
+  --grid-gap: 64px;
+}
+
+[data-preset='ma'] .fade-in {
+  transition-duration: 900ms;
+  transition-timing-function: ease-out;
+}
+
+[data-preset='ma'] .photo-grid__item img {
+  transition: opacity 900ms ease-out;
+}
+
+[data-preset='ma'] .photo-grid__item:hover img {
+  transform: none;
+  filter: none;
+  opacity: 0.94;
+}
+
+/* Captions belong to the lightbox; the grid stays silent. */
+[data-preset='ma'] .photo-grid__item-exif {
+  display: none;
+}
+
+/* ── Covers ───────────────────────────────────────── */
+[data-preset='ma'] .subpage-grid {
+  --subpage-gap: 48px;
+}
+
+[data-preset='ma'] .subpage-grid__item:hover img,
+[data-preset='ma'] .album-card:hover .album-card__image {
+  transform: none;
+  filter: brightness(0.9);
+}
+
+[data-preset='ma'] .subpage-grid__item-title,
+[data-preset='ma'] .album-card__title {
+  font-family: var(--font-serif);
+  font-weight: 400;
+  letter-spacing: 0.02em;
+  text-transform: none;
+}
+
+[data-preset='ma'] .album-card {
+  border: none;
+}
+
+[data-preset='ma'] .album-card:hover {
+  transform: none;
+}
+
+[data-preset='ma'] .footer {
+  border-top-color: transparent;
+}
+
+/* ── Desktop: asymmetry and tategaki ──────────────── */
+@media (min-width: 1025px) {
+  /* Album and subpage content sits right of centre, a sixth of the width
+     left empty. The home hero is full width and keeps its own layout. */
+  [data-preset='ma'] .main:not(:has(.hero)) {
+    padding-left: max(40px, 14vw);
+  }
+}
+
+@media (min-width: 641px) {
+  /* Split hero: a narrow text column, the title set low, the photo inset
+     into the paper rather than running to the edges. */
+  [data-preset='ma'] .hero--split {
+    grid-template-columns: 1fr 2fr;
+  }
+
+  [data-preset='ma'] .hero--split .hero__left {
+    align-items: flex-end;
+    justify-content: flex-start;
+    padding: 64px 40px 96px max(40px, 6vw);
+  }
+
+  [data-preset='ma'] .hero--split .hero__content {
+    text-align: left;
+  }
+
+  [data-preset='ma'] .hero--split .hero__title {
+    font-size: clamp(2.6rem, 4.6vw, 4rem);
+    line-height: 0.98;
+    margin-bottom: 20px;
+  }
+
+  [data-preset='ma'] .hero--split .hero__nav {
+    align-items: flex-start;
+  }
+
+  [data-preset='ma'] .hero--split .hero__right {
+    margin: 56px 56px 56px 0;
+  }
+
+  /* Tategaki: the subtitle runs down a column of its own beside the title
+     and the links. Each line of the hero text sits in a FadeIn wrapper whose
+     transform would capture an absolutely positioned subtitle, so this is a
+     grid, not a position. */
+  [data-preset='ma'] .hero--split .hero__content {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) auto;
+    column-gap: 40px;
+    align-items: start;
+  }
+
+  [data-preset='ma'] .hero--split .hero__content > * {
+    grid-column: 1;
+  }
+
+  [data-preset='ma'] .hero--split .hero__content > :has(> .hero__subtitle) {
+    grid-column: 2;
+    grid-row: 1 / span 2;
+  }
+
+  [data-preset='ma'] .hero--split .hero__subtitle {
+    margin: 0;
+    writing-mode: vertical-rl;
+    white-space: nowrap;
+    font-size: 0.7rem;
+    letter-spacing: 0.3em;
+    color: var(--text-muted);
+  }
+
+  [data-preset='ma'] .hero--split .hero__subtitle::before {
+    content: '';
+    display: inline-block;
+    width: 7px;
+    height: 7px;
+    margin-bottom: 12px;
+    background: var(--accent);
+  }
+}
+
+[data-preset='ma'] .hero__nav-link {
+  font-size: 0.85rem;
+  font-weight: 300;
+  letter-spacing: 0.06em;
+  text-transform: none;
+}
+
+[data-preset='ma'] .hero__nav-link:hover {
+  border-bottom-color: transparent;
+}
+
+@media (max-width: 640px) {
+  [data-preset='ma'] .photo-grid {
+    --grid-gap: 24px;
+  }
+
+  [data-preset='ma'] .subpage-grid {
+    --subpage-gap: 32px;
+  }
+}
diff --git a/app/themes/minimal.css b/app/themes/minimal.css
index 0da5981..9e7cd0f 100644
--- a/app/themes/minimal.css
+++ b/app/themes/minimal.css
@@ -81,6 +81,27 @@
   color: var(--text-primary);
 }
 
+/* Over the photo the dimmed links sit on dark glass in both modes, so they
+   cannot take the page colours: half-opacity white came out near 3:1, and in
+   light mode the hover turned them --text-primary black on the dark glass.
+   Near-white on a denser glass (0.55 keeps 4.5:1 even over a white sky),
+   with the hover marked by an underline instead. */
+[data-preset='minimal'] .hero--fullbleed .hero__nav {
+  background: rgba(0, 0, 0, 0.55);
+}
+
+[data-preset='minimal'] .hero--fullbleed .hero__nav-link {
+  opacity: 1;
+  color: rgba(255, 255, 255, 0.92);
+}
+
+[data-preset='minimal'] .hero--fullbleed .hero__nav-link:hover {
+  color: #fff;
+  text-decoration: underline;
+  text-decoration-color: currentColor;
+  text-underline-offset: 4px;
+}
+
 [data-preset='minimal'] .hero__right {
   grid-column: 1;
   grid-row: 1;
diff --git a/app/themes/monograph.css b/app/themes/monograph.css
index 53fb2f5..1b3d93d 100644
--- a/app/themes/monograph.css
+++ b/app/themes/monograph.css
@@ -329,10 +329,6 @@
     opacity: 1;
   }
 
-  [data-photo-frame='passepartout'] .photo-grid__item {
-    padding: 6px 6px 18px;
-  }
-
   /* Minimal: adjust fullbleed hero for mobile */
   [data-preset='minimal'] .hero__left {
     padding: 20px 24px;
diff --git a/app/themes/noir.css b/app/themes/noir.css
index 8ebe27a..bea2887 100644
--- a/app/themes/noir.css
+++ b/app/themes/noir.css
@@ -45,6 +45,11 @@
   box-shadow: inset 0 0 60px rgba(0, 0, 0, 0.4);
 }
 
+/* Under passepartout the vignette darkens the photo, not the mat. */
+[data-preset='noir'][data-photo-frame='passepartout'] .photo-grid .photo-grid__item::before {
+  inset: var(--photo-mat) var(--photo-mat) var(--photo-mat-caption);
+}
+
 /* Film-edge EXIF labels */
 [data-preset='noir'] .photo-grid__item-exif {
   font-family: var(--font-caption);
@@ -123,7 +128,7 @@
   font-family: var(--font-caption);
   font-size: 0.55rem;
   letter-spacing: 0.12em;
-  color: var(--accent);
+  color: var(--accent-text);
   text-transform: uppercase;
 }
 
@@ -140,7 +145,7 @@
 }
 
 [data-preset='noir'] .subpage-toc__link:hover {
-  color: var(--accent);
+  color: var(--accent-text);
 }
 
 /* Section: amber hairline rule */
diff --git a/app/themes/salon.css b/app/themes/salon.css
new file mode 100644
index 0000000..25c846d
--- /dev/null
+++ b/app/themes/salon.css
@@ -0,0 +1,246 @@
+/* ══════════════════════════════════════════════════════
+   THEME: Salon — the oxblood picture gallery, done quietly
+   ══════════════════════════════════════════════════════
+
+   Velvet-dark and plaster-rose walls (tokens.css), Gloock titles that are
+   never italic, Work Sans text, and a fine fillet floating 6px outside each
+   photo. An outline is not clipped by the item's `overflow: hidden`, so
+   the fillet needs no extra markup. */
+
+/* ── Header ───────────────────────────────────────── */
+[data-preset='salon'] .header {
+  background: color-mix(in srgb, var(--bg-primary) 94%, transparent);
+  border-bottom-color: var(--border-subtle);
+}
+
+[data-preset='salon'] .header__wordmark {
+  display: flex;
+  align-items: center;
+  margin-right: 28px;
+  font-family: var(--font-serif);
+  font-size: 1.1rem;
+  font-weight: 400;
+  color: var(--text-primary);
+  white-space: nowrap;
+}
+
+[data-preset='salon'] .header__nav-link {
+  font-size: 0.72rem;
+  font-weight: 300;
+  letter-spacing: 0.04em;
+  text-transform: none;
+  border-bottom-color: transparent;
+}
+
+[data-preset='salon'] .header__nav-link:hover {
+  border-bottom-color: transparent;
+}
+
+[data-preset='salon'] .header__nav-link.active {
+  color: var(--accent-text, var(--accent));
+  border-bottom-color: transparent;
+}
+
+/* ── Type: Gloock, never italic ───────────────────── */
+[data-preset='salon'] .hero__title,
+[data-preset='salon'] .album-header__title,
+[data-preset='salon'] .subpage-title,
+[data-preset='salon'] .subpage-section__title {
+  font-family: var(--font-serif);
+  font-weight: 400;
+  font-style: normal;
+  letter-spacing: 0;
+  text-transform: none;
+}
+
+[data-preset='salon'] .album-header__title,
+[data-preset='salon'] .subpage-title {
+  font-size: clamp(2rem, 3.6vw, 3rem);
+  line-height: 1.08;
+}
+
+[data-preset='salon'] .hero__subtitle,
+[data-preset='salon'] .album-header__meta,
+[data-preset='salon'] .subpage-subtitle {
+  font-style: normal;
+}
+
+[data-preset='salon'] .section-label,
+[data-preset='salon'] .subpage-section__desc {
+  font-family: var(--font-caption);
+  font-size: 0.66rem;
+  font-weight: 500;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+  color: var(--text-secondary);
+}
+
+/* ── Photo grid: the fillet ───────────────────────── */
+[data-preset='salon'] .photo-grid {
+  --grid-gap: 24px;
+}
+
+[data-preset='salon'] .photo-grid__item {
+  outline: 1px solid color-mix(in srgb, var(--accent) 35%, transparent);
+  outline-offset: 6px;
+  transition: outline-color 600ms ease;
+}
+
+[data-preset='salon'] .photo-grid__item:hover {
+  outline-color: var(--accent);
+}
+
+/* Only the fillet reacts. */
+[data-preset='salon'] .photo-grid__item:hover img {
+  transform: none;
+  filter: none;
+}
+
+/* Captions stay out of the grid. */
+[data-preset='salon'] .photo-grid__item-exif {
+  display: none;
+}
+
+/* ── Covers: Gloock titles beneath ────────────────── */
+[data-preset='salon'] .subpage-grid {
+  --subpage-gap: 32px;
+}
+
+[data-preset='salon'] .subpage-grid__item {
+  aspect-ratio: auto;
+  overflow: visible;
+}
+
+[data-preset='salon'] .subpage-grid__item-media {
+  aspect-ratio: 4 / 3;
+  height: auto;
+  outline: 1px solid color-mix(in srgb, var(--accent) 35%, transparent);
+  outline-offset: 6px;
+  transition: outline-color 600ms ease;
+}
+
+[data-preset='salon'] .subpage-grid__item:hover .subpage-grid__item-media {
+  outline-color: var(--accent);
+}
+
+[data-preset='salon'] .subpage-grid__item:hover img {
+  transform: none;
+  filter: none;
+}
+
+[data-preset='salon'] .subpage-grid__item-overlay,
+[data-preset='salon'] .subpage-grid__item-badge,
+[data-preset='salon'] .subpage-grid__item-index {
+  display: none;
+}
+
+[data-preset='salon'] .subpage-grid__item-caption {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+  padding: 20px 0 0;
+}
+
+[data-preset='salon'] .subpage-grid__item-caption-title {
+  font-family: var(--font-serif);
+  font-size: 1.25rem;
+  line-height: 1.2;
+  color: var(--text-primary);
+}
+
+[data-preset='salon'] .subpage-grid__item-caption-count {
+  font-family: var(--font-caption);
+  font-size: 0.66rem;
+  font-weight: 500;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+  color: var(--text-muted);
+}
+
+[data-preset='salon'] .album-card {
+  border: none;
+  overflow: visible;
+  outline: 1px solid color-mix(in srgb, var(--accent) 35%, transparent);
+  outline-offset: 6px;
+  transition: outline-color 600ms ease;
+}
+
+[data-preset='salon'] .album-card:hover {
+  transform: none;
+  outline-color: var(--accent);
+}
+
+[data-preset='salon'] .album-card__title {
+  font-family: var(--font-serif);
+  font-weight: 400;
+  letter-spacing: 0;
+  text-transform: none;
+}
+
+/* ── Fullbleed hero: a scrim tinted from the wall ─── */
+[data-preset='salon'] .hero__fullbleed-overlay {
+  align-items: flex-start;
+  justify-content: flex-end;
+  text-align: left;
+  padding: 64px clamp(24px, 5vw, 72px);
+  background: linear-gradient(
+    0deg,
+    color-mix(in srgb, var(--bg-primary) 94%, transparent) 0%,
+    color-mix(in srgb, var(--bg-primary) 70%, transparent) 28%,
+    color-mix(in srgb, var(--bg-primary) 20%, transparent) 55%,
+    transparent 75%
+  );
+}
+
+[data-preset='salon'] .hero--fullbleed .hero__title {
+  color: var(--text-primary);
+  font-size: clamp(2.25rem, 6vw, 4.5rem);
+  line-height: 1.02;
+  text-shadow: none;
+}
+
+[data-preset='salon'] .hero--fullbleed .hero__subtitle {
+  color: var(--text-secondary);
+  font-weight: 300;
+  letter-spacing: 0.04em;
+  text-transform: none;
+  text-shadow: none;
+  margin-bottom: 24px;
+}
+
+[data-preset='salon'] .hero--fullbleed .hero__nav {
+  flex-direction: row;
+  flex-wrap: wrap;
+  gap: 6px 24px;
+  align-items: baseline;
+  padding: 0;
+  background: none;
+  backdrop-filter: none;
+  -webkit-backdrop-filter: none;
+  border: none;
+  border-radius: 0;
+}
+
+[data-preset='salon'] .hero--fullbleed .hero__nav-link {
+  color: var(--text-secondary);
+  text-decoration-color: color-mix(in srgb, var(--accent) 50%, transparent);
+}
+
+[data-preset='salon'] .hero--fullbleed .hero__nav-link:hover {
+  color: var(--accent-text, var(--accent));
+  text-decoration-color: var(--accent);
+}
+
+[data-preset='salon'] .footer {
+  border-top-color: var(--border-subtle);
+}
+
+@media (max-width: 640px) {
+  [data-preset='salon'] .header__wordmark {
+    display: none;
+  }
+
+  [data-preset='salon'] .photo-grid {
+    --grid-gap: 18px;
+  }
+}
diff --git a/app/themes/studio-modern.css b/app/themes/studio-modern.css
index 20725d8..6de8170 100644
--- a/app/themes/studio-modern.css
+++ b/app/themes/studio-modern.css
@@ -227,7 +227,7 @@
 }
 
 [data-preset='studio-modern'] .hero .hero__nav-link:hover {
-  color: var(--sm-accent);
+  color: var(--accent-text);
   border-bottom-color: var(--border-subtle);
 }
 
@@ -246,7 +246,7 @@
 }
 
 [data-preset='studio-modern'] .hero .hero__nav-link:first-child .hero__nav-index {
-  color: var(--sm-accent);
+  color: var(--accent-text);
 }
 
 [data-preset='studio-modern'] .hero .hero__nav-count {
@@ -353,7 +353,8 @@
 }
 
 [data-preset='studio-modern'] .hero--fullbleed .hero__nav-link:hover {
-  color: var(--sm-accent);
+  /* Dark glass in both modes, so the dark-mode text accent. */
+  color: var(--accent-text-dark, var(--accent-text));
 }
 
 [data-preset='studio-modern'] .hero--fullbleed .hero__nav-index {
@@ -362,7 +363,8 @@
 }
 
 [data-preset='studio-modern'] .hero--fullbleed .hero__nav-link:first-child .hero__nav-index {
-  color: var(--sm-accent);
+  /* Dark glass in both modes, so the dark-mode text accent. */
+  color: var(--accent-text-dark, var(--accent-text));
 }
 
 [data-preset='studio-modern'] .hero--fullbleed .hero__nav-count {
@@ -404,7 +406,7 @@
 }
 
 [data-preset='studio-modern'] .hero--minimal .hero__nav-link:hover {
-  color: var(--sm-accent);
+  color: var(--accent-text);
   border-bottom-color: var(--sm-accent);
 }
 
@@ -462,7 +464,7 @@
 }
 
 [data-preset='studio-modern'] .hero__thumbnail-item:hover .hero__thumbnail-label {
-  color: var(--sm-accent);
+  color: var(--accent-text);
 }
 
 [data-preset='studio-modern'] .hero__thumbnail-index {
@@ -473,7 +475,7 @@
 }
 
 [data-preset='studio-modern'] .hero__thumbnail-item:first-child .hero__thumbnail-index {
-  color: var(--sm-accent);
+  color: var(--accent-text);
 }
 
 [data-preset='studio-modern'] .hero__thumbnail-label {
@@ -588,7 +590,7 @@
 
 [data-preset='studio-modern'] .subpage-header__kicker {
   display: flex;
-  color: var(--sm-accent);
+  color: var(--accent-text);
   margin-bottom: 16px;
 }
 
@@ -657,7 +659,7 @@
   font-family: var(--font-caption);
   font-size: 0.6875rem;
   letter-spacing: 0.06em;
-  color: var(--sm-accent);
+  color: var(--accent-text);
 }
 
 [data-preset='studio-modern'] .subpage-grid__item-caption-title {
@@ -685,7 +687,7 @@
 
 [data-preset='studio-modern'] .subpage-toc__num {
   font-family: var(--font-caption);
-  color: var(--sm-accent);
+  color: var(--accent-text);
 }
 
 [data-preset='studio-modern'] .subpage-toc__label {
@@ -745,7 +747,7 @@
 }
 
 [data-preset='studio-modern'] .album-header__back:hover {
-  color: var(--sm-accent);
+  color: var(--accent-text);
 }
 
 [data-preset='studio-modern'] .album-header__back svg {
@@ -820,10 +822,12 @@
   transform: none;
 }
 
-/* EXIF-Chip statt Verlaufsband */
+/* EXIF-Chip statt Verlaufsband. A block, not a flex row: text-overflow only
+   applies to a block container, and as flex the line was cut off mid-letter
+   on narrow tiles instead of ending in an ellipsis. The dot is inline-block
+   and vertically centred on its own (.photo-grid__item-exif::before). */
 [data-preset='studio-modern'] .photo-grid__item-exif {
-  display: flex;
-  align-items: center;
+  display: block;
   padding: 8px 12px;
   background: var(--sm-chip-bg);
   backdrop-filter: blur(8px);
@@ -862,7 +866,7 @@
 }
 
 [data-preset='studio-modern'] .footer__legal-link:hover {
-  color: var(--sm-accent);
+  color: var(--accent-text);
 }
 
 [data-preset='studio-modern'] .footer__link {
@@ -955,7 +959,7 @@
   content: counter(sm-gear, decimal-leading-zero);
   font-family: var(--font-caption);
   font-size: 0.625rem;
-  color: var(--sm-accent);
+  color: var(--accent-text);
 }
 
 /* ── Map ────────────────────────────────────────────────────── */
@@ -1081,7 +1085,7 @@
   font-size: 0.6875rem;
   letter-spacing: 0.1em;
   text-transform: uppercase;
-  color: var(--sm-accent);
+  color: var(--accent-text);
 }
 
 /* ── Admin ──────────────────────────────────────────────────── */
diff --git a/app/tokens.css b/app/tokens.css
index d078d9f..40eb04b 100644
--- a/app/tokens.css
+++ b/app/tokens.css
@@ -36,6 +36,28 @@
   --accent: var(--accent-dark, #e60012);
   --accent-dim: color-mix(in srgb, var(--accent) 12%, transparent);
   --on-accent: var(--on-accent-dark, #ffffff);
+  /* The accent as a text colour: the layout lifts it to 4.5:1 per mode
+     (accentText() in lib/config/theme.ts). Fills, borders and underlines keep
+     --accent; anything that is read uses this. The fallbacks are that
+     function's output for the default red. */
+  --accent-text: var(--accent-text-dark, #ef5965);
+
+  /* One focus ring for everything a visitor can focus, inputs included. The
+     contact form and the password field drew an accent ring over an accent
+     border while every link and button drew this one. */
+  --focus-ring: var(--text-primary);
+
+  /* The border that marks an input as an input (WCAG 1.4.11, 3:1). The
+     --border-subtle hairline measured 1.15–1.29:1 against the page;
+     --text-muted is checked at 4.5:1 against both page surfaces in every
+     preset, so borrowing it clears the bar with margin. */
+  --input-border: var(--text-muted);
+
+  /* Status that is not an error: the journal's draft badge. Per mode, like
+     --error; #eab308 read 1.4:1 on the light pages. */
+  --warning: #eab308;
+
+  color-scheme: dark;
 
   /* Error and destructive text. One value per mode: no single red clears
      4.5:1 on both a near-black and a near-white page (the fixed reds these
@@ -62,6 +84,13 @@
      may be dark navy, neither of which marks anything on the overlay. */
   --lightbox-fav: #ff6b6b;
 
+  /* The passepartout photo frame: the mat board, its edge, and the EXIF line
+     printed on it. --mat-text is checked at 4.5:1 against --mat-bg for every
+     preset and mode (lib/__tests__/passepartout-mat.test.ts). */
+  --mat-bg: #111111;
+  --mat-border: rgba(255, 255, 255, 0.12);
+  --mat-text: var(--text-muted);
+
   --font-sans: 'DM Sans', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
   --font-serif: 'Playfair Display', Georgia, 'Times New Roman', serif;
   --font-caption: 'EB Garamond', Georgia, serif;
@@ -96,8 +125,15 @@
   --accent: var(--accent-light, #c8000f);
   --accent-dim: color-mix(in srgb, var(--accent) 12%, transparent);
   --on-accent: var(--on-accent-light, #ffffff);
+  --accent-text: var(--accent-text-light, #c8000f);
 
   --error: #c62828;
+  --warning: #7a5600;
+
+  --mat-bg: #ffffff;
+  --mat-border: rgba(0, 0, 0, 0.1);
+
+  color-scheme: light;
 }
 
 /* ── Studio Modern: Leica Precision Palette ──────── */
@@ -143,7 +179,10 @@
 
   --text-primary: #161614;
   --text-secondary: #5a5a55;
-  --text-muted: #73736e;
+  /* #73736e passed on the page and on cards but not on --bg-secondary
+     (4.17:1) or --bg-card-hover (4.36:1). Darkened in equal steps so the
+     warm tint stays: 4.55:1 on --bg-secondary now. */
+  --text-muted: #6d6d68;
 
   --border-subtle: rgba(0, 0, 0, 0.09);
   --border-hover: rgba(0, 0, 0, 0.25);
@@ -225,6 +264,13 @@
 
   --border-subtle: #2a2822;
   --border-hover: #3a3830;
+
+  /* A warm mat. Both modes set it: this block comes after the generic light
+     one, so a light value left out here would lose to the dark one. */
+  --mat-bg: #1a1816;
+  --mat-border: rgba(196, 154, 60, 0.12);
+  /* --text-muted, a step lighter: it is 4.48:1 on this mat. */
+  --mat-text: #8c826f;
 }
 
 [data-preset='classic'][data-theme='light'] {
@@ -240,6 +286,10 @@
 
   --border-subtle: #e5dfcf;
   --border-hover: #d0c8b5;
+
+  --mat-bg: #fffdf5;
+  --mat-border: rgba(196, 154, 60, 0.2);
+  --mat-text: var(--text-muted);
 }
 
 /* ── Noir: Darkroom Analog Palette ───────────────── */
@@ -304,6 +354,207 @@
   --border-hover: #cccccc;
 }
 
+/* ── Kunsthalle: Gallery Wall Palette ──────────── */
+[data-preset='kunsthalle'] {
+  --bg-primary: #2b2b29;
+  --bg-secondary: #242422;
+  --bg-card: #323230;
+  --bg-card-hover: #393937;
+  --bg-overlay: rgba(36, 36, 34, 0.98);
+
+  --text-primary: #f0efeb;
+  --text-secondary: #c6c4bd;
+  --text-muted: #aba9a2;
+
+  --border-subtle: #3d3d3a;
+  --border-hover: #55554f;
+
+  --max-width: 1240px;
+
+  /* The default #ff6b6b reaches only 4.2:1 on the lighter grey card; this is 5.1:1 on every surface. */
+  --error: #ff8a80;
+
+  /* A grey board a step lighter than the wall, not the default black mat.
+     Both modes set it: this block comes after the generic light one. The
+     caption on it is --text-muted, 5.07:1. */
+  --mat-bg: #373735;
+  --mat-border: rgba(255, 255, 255, 0.08);
+}
+
+[data-preset='kunsthalle'][data-theme='light'] {
+  --bg-primary: #dddcd8;
+  --bg-secondary: #d4d3ce;
+  --bg-card: #e8e7e3;
+  --bg-card-hover: #e2e1dd;
+  --bg-overlay: rgba(221, 220, 216, 0.96);
+
+  --text-primary: #1b1b19;
+  --text-secondary: #3f3e3a;
+  --text-muted: #52514c;
+
+  --border-subtle: #c9c8c3;
+  --border-hover: #aeada7;
+
+  /* The default #c62828 reaches only 4.1:1 on the grey wall; this is 5.0:1 on every surface. */
+  --error: #a61b1b;
+
+  /* Warning text on the grey wall: 5.3:1, where an amber of #7a5600 is 4.4:1. */
+  --warning: #6b4b00;
+
+  /* A pale grey board on the grey wall. Caption (--text-muted): 6.79:1. */
+  --mat-bg: #eeede9;
+  --mat-border: rgba(0, 0, 0, 0.12);
+}
+
+/* ── Ma: Washi / Sumi Palette ──────────────────── */
+[data-preset='ma'] {
+  --bg-primary: #1a1917;
+  --bg-secondary: #141311;
+  --bg-card: #21201d;
+  --bg-card-hover: #282623;
+  --bg-overlay: rgba(20, 19, 17, 0.98);
+
+  --text-primary: #ece7dd;
+  --text-secondary: #b5ad9f;
+  --text-muted: #978f82;
+
+  --border-subtle: #2c2a26;
+  --border-hover: #403d37;
+
+  --max-width: 1120px;
+}
+
+[data-preset='ma'][data-theme='light'] {
+  --bg-primary: #f0ede6;
+  --bg-secondary: #e7e3da;
+  --bg-card: #f6f4ef;
+  --bg-card-hover: #ebe7df;
+  --bg-overlay: rgba(240, 237, 230, 0.96);
+
+  --text-primary: #1f1d1a;
+  --text-secondary: #4d4943;
+  --text-muted: #66615a;
+
+  --border-subtle: #dcd7cc;
+  --border-hover: #c5bfb2;
+
+  /* The default #c62828 reaches only 4.4:1 on the washi secondary; this is 5.3:1 on every surface. */
+  --error: #b02020;
+}
+
+/* ── Cyanotype: Prussian Blue Palette ──────────── */
+[data-preset='cyanotype'] {
+  --bg-primary: #0e1621;
+  --bg-secondary: #0a111a;
+  --bg-card: #132030;
+  --bg-card-hover: #192839;
+  --bg-overlay: rgba(10, 17, 26, 0.98);
+
+  --text-primary: #e3eaf0;
+  --text-secondary: #a8b7c6;
+  --text-muted: #8898ab;
+
+  --border-subtle: #1d2a3a;
+  --border-hover: #2e4056;
+
+  --max-width: 1440px;
+}
+
+[data-preset='cyanotype'][data-theme='light'] {
+  --bg-primary: #eef2f4;
+  --bg-secondary: #e3e9ec;
+  --bg-card: #f7f9fa;
+  --bg-card-hover: #e9eef1;
+  --bg-overlay: rgba(238, 242, 244, 0.96);
+
+  --text-primary: #10243a;
+  --text-secondary: #34495f;
+  --text-muted: #4f6379;
+
+  --border-subtle: #d2dce2;
+  --border-hover: #b3c3cd;
+}
+
+/* ── Salon: Velvet / Plaster Palette ───────────── */
+[data-preset='salon'] {
+  --bg-primary: #1c1315;
+  --bg-secondary: #160f11;
+  --bg-card: #241a1c;
+  --bg-card-hover: #2c2023;
+  --bg-overlay: rgba(22, 15, 17, 0.98);
+
+  --text-primary: #f3eae7;
+  --text-secondary: #c5b1ad;
+  --text-muted: #aa938f;
+
+  --border-subtle: #34262a;
+  --border-hover: #4a383c;
+
+  --max-width: 1320px;
+
+  /* An oxblood board on the velvet wall, edged in the blush accent. Both
+     modes set it: this block comes after the generic light one. Caption
+     (--text-muted): 5.68:1. */
+  --mat-bg: #2e1a1e;
+  --mat-border: rgba(227, 163, 154, 0.16);
+}
+
+[data-preset='salon'][data-theme='light'] {
+  --bg-primary: #f5efec;
+  --bg-secondary: #ece3df;
+  --bg-card: #fbf8f6;
+  --bg-card-hover: #f1e9e5;
+  --bg-overlay: rgba(245, 239, 236, 0.96);
+
+  --text-primary: #271618;
+  --text-secondary: #573f42;
+  --text-muted: #6f5659;
+
+  --border-subtle: #e3d5d1;
+  --border-hover: #ccb8b3;
+
+  /* The default #c62828 reaches only 4.4:1 on the plaster secondary; this is 5.4:1 on every surface. */
+  --error: #b02020;
+
+  /* A plaster-rose board, rosier than the wall, edged in oxblood. Caption
+     (--text-muted): 5.38:1. */
+  --mat-bg: #f2e4df;
+  --mat-border: rgba(125, 31, 44, 0.16);
+}
+
+/* ── Birch: Birch / Pine Palette ───────────────── */
+[data-preset='birch'] {
+  --bg-primary: #121613;
+  --bg-secondary: #0e110f;
+  --bg-card: #181d19;
+  --bg-card-hover: #1f2520;
+  --bg-overlay: rgba(14, 17, 15, 0.98);
+
+  --text-primary: #e9eee9;
+  --text-secondary: #aab5ac;
+  --text-muted: #8d9a90;
+
+  --border-subtle: #232b25;
+  --border-hover: #364039;
+
+  --max-width: 1400px;
+}
+
+[data-preset='birch'][data-theme='light'] {
+  --bg-primary: #f3f5f1;
+  --bg-secondary: #e9ece6;
+  --bg-card: #fbfcfa;
+  --bg-card-hover: #eef1eb;
+  --bg-overlay: rgba(243, 245, 241, 0.96);
+
+  --text-primary: #19201b;
+  --text-secondary: #434e46;
+  --text-muted: #5b675e;
+
+  --border-subtle: #dce1d9;
+  --border-hover: #c1c8be;
+}
+
 /* ── Reset ────────────────────────────────────────── */
 *,
 *::before,
@@ -352,6 +603,6 @@ select:focus-visible,
 summary:focus-visible,
 [role='button']:focus-visible,
 [tabindex]:not([tabindex='-1']):focus-visible {
-  outline: 2px solid var(--text-primary);
+  outline: 2px solid var(--focus-ring);
   outline-offset: 2px;
 }
diff --git a/components/DevToolbar.tsx b/components/DevToolbar.tsx
index 7042831..353b018 100644
--- a/components/DevToolbar.tsx
+++ b/components/DevToolbar.tsx
@@ -17,8 +17,9 @@
 import React, { useState, useEffect, useCallback, useLayoutEffect } from 'react';
 import { IconPalette, IconX } from './Icons';
 import { getFontsCssUrl } from '@/lib/config/theme';
+import { PRESET_IDS, PRESET_REGISTRY } from '@/lib/config/presets';
 
-const PRESETS = ['studio', 'studio-modern', 'minimal', 'editorial', 'classic', 'noir', 'monograph'];
+const PRESETS = [...PRESET_IDS];
 const FRAMES = ['none', 'passepartout', 'shadow'];
 const HERO_STYLES = ['split', 'fullbleed', 'minimal', 'stacked', 'typographic', 'mosaic'];
 const GRID_LAYOUTS = ['masonry', 'uniform', 'showcase', 'filmstrip', 'editorial-flow'];
@@ -26,26 +27,13 @@ const ASPECT_RATIOS = ['1', '3/2', '2/3', '4/3', '16/9', 'auto'];
 
 type Tab = 'theme' | 'grid' | 'server';
 
-// Font stacks for each preset (must match THEME_PRESETS in config.ts)
-const PRESET_FONTS: Record<string, { heading: string; body: string; caption: string }> = {
-  studio: { heading: 'Playfair Display', body: 'DM Sans', caption: 'EB Garamond' },
-  'studio-modern': { heading: 'Archivo', body: 'Archivo', caption: 'IBM Plex Mono' },
-  minimal: { heading: 'Geist', body: 'Geist', caption: 'IBM Plex Mono' },
-  editorial: { heading: 'Bodoni Moda', body: 'Newsreader', caption: 'Spectral' },
-  classic: { heading: 'Cinzel', body: 'Crimson Pro', caption: 'Crimson Pro' },
-  noir: { heading: 'Libre Baskerville', body: 'Source Sans 3', caption: 'Space Mono' },
-  monograph: { heading: 'Instrument Serif', body: 'Inter', caption: 'IBM Plex Mono' },
-};
+// Font stacks and accents for each preset, from the preset registry.
+const PRESET_FONTS: Record<string, { heading: string; body: string; caption: string }> =
+  Object.fromEntries(PRESET_REGISTRY.map((p) => [p.id, p.theme.fonts]));
 
-const PRESET_ACCENTS: Record<string, string> = {
-  studio: 'var(--accent-studio, #e60012)',
-  'studio-modern': 'var(--accent-studio-modern, #e60012)',
-  minimal: 'var(--accent-minimal, #000000)',
-  editorial: 'var(--accent-editorial, #8B2500)',
-  classic: 'var(--accent-classic, #c49a3c)',
-  noir: 'var(--accent-noir, #ff6b35)',
-  monograph: 'var(--accent-monograph, #333333)',
-};
+const PRESET_ACCENTS: Record<string, string> = Object.fromEntries(
+  PRESET_REGISTRY.map((p) => [p.id, `var(--accent-${p.id}, ${p.theme.accent})`]),
+);
 
 function getAttr(attr: string): string {
   return document.documentElement.getAttribute(attr) ?? '';
diff --git a/components/ExifText.tsx b/components/ExifText.tsx
new file mode 100644
index 0000000..4b5664e
--- /dev/null
+++ b/components/ExifText.tsx
@@ -0,0 +1,26 @@
+import { Fragment } from 'react';
+import { APERTURE_SIGN } from '@/lib/exif';
+
+/**
+ * EXIF text with the aperture sign kept lowercase.
+ *
+ * Several presets set their EXIF lines in `text-transform: uppercase`, which
+ * maps "ƒ" to "Ƒ" — "Ƒ/4" is not how an aperture is written. The sign is
+ * wrapped in `.exif-fsign` (app/globals.css), which opts it out of the
+ * transform; the rest of the line keeps the preset's casing.
+ */
+export default function ExifText({ text }: { text: string }) {
+  const parts = text.split(APERTURE_SIGN);
+  // One wrapping span: the hero chip is a flex container, and loose text
+  // around the sign would become separate flex items that drop the spaces.
+  return (
+    <span>
+      {parts.map((part, i) => (
+        <Fragment key={i}>
+          {i > 0 && <span className="exif-fsign">{APERTURE_SIGN}</span>}
+          {part}
+        </Fragment>
+      ))}
+    </span>
+  );
+}
diff --git a/components/FadeIn.tsx b/components/FadeIn.tsx
index bf1fca3..280929a 100644
--- a/components/FadeIn.tsx
+++ b/components/FadeIn.tsx
@@ -20,10 +20,28 @@ interface FadeInProps {
   className?: string;
   /** Extra inline styles for the wrapper (e.g. flex sizing in justified grids) */
   style?: React.CSSProperties;
+  /**
+   * The wrapper element. `figure` lets a photo grid hang a figcaption next to
+   * the photo; the reset in tokens.css removes its default margins, so it
+   * lays out exactly like the div.
+   */
+  as?: 'div' | 'figure';
 }
 
-export function FadeIn({ children, delay = 0, direction = 'up', className, style }: FadeInProps) {
-  const ref = useRef<HTMLDivElement>(null);
+export function FadeIn({
+  children,
+  delay = 0,
+  direction = 'up',
+  className,
+  style,
+  as: Wrapper = 'div',
+}: FadeInProps) {
+  // HTMLElement, not HTMLDivElement: the wrapper may be a <figure>. Set
+  // through a callback, which either element's ref accepts.
+  const ref = useRef<HTMLElement | null>(null);
+  const setRef = useCallback((el: HTMLElement | null) => {
+    ref.current = el;
+  }, []);
 
   const reveal = useCallback(() => {
     ref.current?.classList.add('fade-in--visible');
@@ -54,12 +72,12 @@ export function FadeIn({ children, delay = 0, direction = 'up', className, style
   }, [reveal]);
 
   return (
-    <div
-      ref={ref}
+    <Wrapper
+      ref={setRef}
       className={`fade-in ${direction === 'up' ? 'fade-in--up' : ''} ${className ?? ''}`}
       style={{ ...style, transitionDelay: `${delay}ms` }}
     >
       {children}
-    </div>
+    </Wrapper>
   );
 }
diff --git a/components/HeroCarousel.tsx b/components/HeroCarousel.tsx
index cdf1671..2af4ea3 100644
--- a/components/HeroCarousel.tsx
+++ b/components/HeroCarousel.tsx
@@ -13,6 +13,7 @@
 import { useState, useEffect, useCallback, useSyncExternalStore } from 'react';
 import Image from 'next/image';
 import { useDictionary } from './I18nProvider';
+import ExifText from './ExifText';
 
 interface HeroImage {
   src: string;
@@ -138,7 +139,7 @@ function HeroExifChip({ text }: { text?: string }) {
   if (!text) return null;
   return (
     <span className="hero__exif-chip" aria-hidden="true">
-      {text}
+      <ExifText text={text} />
     </span>
   );
 }
diff --git a/components/LeafletMap.tsx b/components/LeafletMap.tsx
index 767bd18..2b1579a 100644
--- a/components/LeafletMap.tsx
+++ b/components/LeafletMap.tsx
@@ -21,6 +21,12 @@ export interface LeafletMarker {
   lng: number;
   /** Inner HTML of the marker icon — already escaped by the caller. */
   html: string;
+  /**
+   * The marker's accessible name and hover title (plain text, not HTML).
+   * Without it a screen reader announces only what the icon shows — for the
+   * location map, a bare photo count like "12".
+   */
+  label?: string;
   popupHtml?: string;
 }
 
@@ -115,7 +121,14 @@ export function LeafletMap({
                 iconAnchor: [16, 16],
                 popupAnchor: [0, -20],
               }),
+              ...(m.label ? { title: m.label } : {}),
             });
+            // Leaflet makes the icon a focusable role="button"; the label
+            // becomes its name once the element exists.
+            if (m.label) {
+              const label = m.label;
+              marker.on('add', () => marker.getElement()?.setAttribute('aria-label', label));
+            }
             if (m.popupHtml) marker.bindPopup(m.popupHtml, { maxWidth: 260, minWidth: 200 });
             return marker;
           }),
diff --git a/components/Lightbox.module.css b/components/Lightbox.module.css
index 79d2605..4123448 100644
--- a/components/Lightbox.module.css
+++ b/components/Lightbox.module.css
@@ -11,6 +11,17 @@
   animation: lightbox-fade-in var(--transition-normal) ease forwards;
 }
 
+/* The overlay is translucent (0.85–0.92), so the fixed page chrome under it
+   showed through: the header's wordmark and red dot, and the proofing bar,
+   as ghosts beside the photo. They cannot be used while the viewer is open,
+   so they are hidden for as long as it is mounted (it is portaled straight
+   into <body>). */
+:global(body):has(> .overlay) :global(.header),
+:global(body):has(> .overlay) :global(.proofing-sticky-bar),
+:global(body):has(> .overlay) :global(.scroll-to-top) {
+  visibility: hidden;
+}
+
 /* The overlay is dark in both modes — see "Studio-Inspired Lightbox Defaults"
    below and the studio-modern block, which both paint it near-black. In light
    mode the page's text tokens are near-black too, so every control that reads
@@ -634,7 +645,7 @@
 }
 
 :global([data-preset='studio-modern']) .close:hover {
-  color: var(--accent);
+  color: var(--accent-text-dark, var(--accent));
 }
 
 :global([data-preset='studio-modern']) .close svg {
@@ -660,7 +671,7 @@
 :global([data-preset='studio-modern']) .nav:hover {
   background: none;
   border-color: var(--accent);
-  color: var(--accent);
+  color: var(--accent-text-dark, var(--accent));
 }
 
 :global([data-preset='studio-modern']) .navPrev {
@@ -689,7 +700,7 @@
 :global([data-preset='studio-modern']) .infoToggle:hover {
   background: none;
   border-color: var(--accent);
-  color: var(--accent);
+  color: var(--accent-text-dark, var(--accent));
 }
 
 /* The EXIF strip owns the bottom edge in this preset, so the panel opens from
@@ -797,3 +808,123 @@
     right: 8px;
   }
 }
+
+/* ══ Zoom (#467) ═════════════════════════════════════════════════
+   The photo keeps its fit-size box; zooming is a transform on the images in
+   it (hooks/useZoom.ts), so the layout never moves. */
+
+/* The viewer owns every touch on a zoomable photo: a pinch zooms the photo,
+   not the page. Swipes still arrive as touch events (hooks/useSwipe.ts). */
+.zoomable {
+  touch-action: none;
+  cursor: zoom-in;
+}
+
+.zoomable.zoomed {
+  cursor: grab;
+}
+
+.zoomable.zoomed:active {
+  cursor: grabbing;
+}
+
+/* Once zoom has been used the photo may outgrow its box; the overlay, which
+   covers the viewport, does the clipping instead. */
+.zoomEngaged {
+  overflow: visible;
+}
+
+.overlayZoom {
+  overflow: hidden;
+}
+
+/* The full-resolution file sits exactly on the preview's box. It takes no
+   pointer events, so gestures always land on the same element. */
+.zoomImage {
+  position: absolute;
+  inset: 0;
+  width: 100%;
+  height: 100%;
+  object-fit: contain;
+  opacity: 0;
+  pointer-events: none;
+  user-select: none;
+  -webkit-user-drag: none;
+}
+
+.zoomImageLoaded {
+  opacity: 1;
+}
+
+.zoomToggle {
+  padding: 8px 10px;
+}
+
+.zoomSpinner {
+  display: inline-block;
+  width: 14px;
+  height: 14px;
+  border: 2px solid currentColor;
+  border-right-color: transparent;
+  border-radius: 50%;
+  animation: zoom-spin 800ms linear infinite;
+}
+
+@keyframes zoom-spin {
+  to {
+    transform: rotate(360deg);
+  }
+}
+
+/* "Not available" — a toast that fades on its own. */
+.zoomNotice {
+  position: fixed;
+  left: 50%;
+  bottom: 76px;
+  z-index: 1001;
+  max-width: min(28rem, calc(100vw - 32px));
+  padding: 8px 14px;
+  transform: translateX(-50%);
+  background: rgba(20, 20, 20, 0.92);
+  border: 1px solid rgba(255, 255, 255, 0.12);
+  border-radius: var(--radius-md);
+  color: rgba(255, 255, 255, 0.9);
+  font-family: var(--font-sans);
+  font-size: 0.8rem;
+  text-align: center;
+  pointer-events: none;
+  animation: zoom-notice 4s ease forwards;
+}
+
+@keyframes zoom-notice {
+  0%,
+  80% {
+    opacity: 1;
+  }
+
+  100% {
+    opacity: 0;
+  }
+}
+
+:global([data-preset='studio-modern']) .zoomNotice {
+  top: 76px;
+  bottom: auto;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  /* Still shown long enough to read, then gone without a fade. */
+  .zoomNotice {
+    animation: zoom-notice-static 4s steps(1, end) forwards;
+  }
+
+  .zoomSpinner {
+    animation-duration: 2s;
+  }
+}
+
+@keyframes zoom-notice-static {
+  to {
+    opacity: 0;
+  }
+}
diff --git a/components/Lightbox.tsx b/components/Lightbox.tsx
index e140c6d..81e4896 100644
--- a/components/Lightbox.tsx
+++ b/components/Lightbox.tsx
@@ -2,22 +2,25 @@
  * Lightbox — fullscreen image viewer with navigation and EXIF info.
  *
  * Features:
- * - Full-resolution image display
+ * - The 1440px preview, and — where zoom is on — the full-resolution file,
+ *   fetched only when the visitor zooms (#467; gestures in hooks/useZoom.ts)
  * - Previous/Next navigation (arrows + swipe)
  * - Close (Esc, click outside, X button)
  * - EXIF metadata panel (fetched on demand)
  * - Keyboard shortcut list (`?` or `h`), deliberately unadvertised
  * - Real fullscreen (`f`), where the browser offers it
- * - Preloads adjacent images
+ * - Preloads adjacent previews (never the full-resolution files)
  */
 
 'use client';
 
-import { useState, useEffect, useRef, useCallback } from 'react';
+import { useState, useEffect, useRef, useCallback, useSyncExternalStore } from 'react';
 import { createPortal } from 'react-dom';
 import type { PhotoItem } from '@/app/[...path]/PhotoGrid';
 import { useExif } from '@/hooks/useExif';
 import { useSwipe } from '@/hooks/useSwipe';
+import { useZoom } from '@/hooks/useZoom';
+import { zoomFitsDevice } from '@/lib/zoom';
 import styles from './Lightbox.module.css';
 import { useProofing } from './useProofing';
 import { IconHeart } from './Icons';
@@ -25,7 +28,7 @@ import { useDictionary } from './I18nProvider';
 // From lib/config/schema directly: lib/config/index.ts pulls in `fs`, which a
 // client component cannot import.
 import { resolveWatermarkOpacity } from '@/lib/config/schema';
-import { formatCamera } from '@/lib/exif';
+import { APERTURE_SIGN, formatCamera, formatLens } from '@/lib/exif';
 import { buildPhotoPermalink } from '@/lib/photoHash';
 import { trapTabKey } from '@/lib/focusTrap';
 import { canonicalImageUrl } from '@/lib/imageSize';
@@ -57,6 +60,23 @@ interface LightboxProps {
   showExifToggle?: boolean;
 }
 
+const COARSE_POINTER = '(pointer: coarse)';
+
+function subscribeCoarsePointer(onChange: () => void): () => void {
+  const query = window.matchMedia?.(COARSE_POINTER);
+  query?.addEventListener?.('change', onChange);
+  return () => query?.removeEventListener?.('change', onChange);
+}
+
+/** A touch device, where very large images are not offered for zoom. */
+function useCoarsePointer(): boolean {
+  return useSyncExternalStore(
+    subscribeCoarsePointer,
+    () => !!window.matchMedia?.(COARSE_POINTER)?.matches,
+    () => false,
+  );
+}
+
 export function Lightbox({
   assets,
   currentIndex,
@@ -89,8 +109,26 @@ export function Lightbox({
   const [slideshowSeconds, setSlideshowSeconds] = useState<SlideshowSpeed>(null);
   const overlayRef = useRef<HTMLDivElement>(null);
   const closeBtnRef = useRef<HTMLButtonElement>(null);
+  // State, not a ref: useZoom attaches its listeners when this element
+  // appears, which is after the portal mounts.
+  const [imageContainer, setImageContainer] = useState<HTMLDivElement | null>(null);
+  const previewRef = useRef<HTMLImageElement>(null);
 
   const current = assets[currentIndex];
+  const coarsePointer = useCoarsePointer();
+  const zoomable =
+    current.type === 'image' &&
+    !!current.zoomUrl &&
+    zoomFitsDevice(current.zoomWidth, current.zoomHeight, coarsePointer);
+  const zoom = useZoom({
+    photoKey: current.id,
+    naturalWidth: zoomable ? current.zoomWidth : undefined,
+    imageRef: previewRef,
+    surface: imageContainer,
+  });
+  const { zoomed, reset: resetZoom, zoomIn, zoomOut } = zoom;
+  /** The zoom control and keys are offered for this photo. */
+  const canZoom = zoomable && zoom.enabled;
   const proofing = useProofing();
   const isFav = proofing && current ? proofing.isFavorite(current.id) : false;
   const [mounted, setMounted] = useState(false);
@@ -199,11 +237,13 @@ export function Lightbox({
     setSlideshowSeconds((current) => nextSlideshowSpeed(current));
   }, []);
 
+  // Paused, not stopped, while zoomed: advancing would throw away the view
+  // someone is inspecting. Back at fit, the slideshow carries on.
   useEffect(() => {
-    if (slideshowSeconds === null) return;
+    if (slideshowSeconds === null || zoom.zoomed) return;
     const timer = setInterval(onNext, slideshowSeconds * 1000);
     return () => clearInterval(timer);
-  }, [slideshowSeconds, onNext]);
+  }, [slideshowSeconds, onNext, zoom.zoomed]);
 
   /*
    * Any deliberate move through the album stops the slideshow. Someone
@@ -297,9 +337,11 @@ export function Lightbox({
     preload(currentIndex - 1);
   }, [currentIndex, assets]);
 
+  // While zoomed one finger pans the photo, so it must not also navigate.
   const { handleTouchStart, handleTouchEnd } = useSwipe({
     onSwipeLeft: manualNext,
     onSwipeRight: manualPrev,
+    enabled: !zoom.zoomed,
   });
 
   /*
@@ -334,12 +376,13 @@ export function Lightbox({
       switch (action) {
         case 'close':
           // Innermost layer first: Esc dismisses the shortcut list, then leaves
-          // fullscreen, and only closes the viewer once nothing is stacked on
-          // top of it. Most browsers swallow this Esc to exit fullscreen
-          // themselves and never dispatch it — the middle branch is for the
-          // ones that do dispatch it, which would otherwise close the lightbox
-          // and leave the page behind it fullscreen.
+          // the zoom, then fullscreen, and only closes the viewer once nothing
+          // is stacked on top of it. Most browsers swallow this Esc to exit
+          // fullscreen themselves and never dispatch it — that branch is for
+          // the ones that do dispatch it, which would otherwise close the
+          // lightbox and leave the page behind it fullscreen.
           if (showShortcuts) setShowShortcuts(false);
+          else if (zoomed) resetZoom();
           else if (document.fullscreenElement) void document.exitFullscreen().catch(() => {});
           else onClose();
           break;
@@ -366,6 +409,15 @@ export function Lightbox({
           e.preventDefault();
           handleCopyLink();
           break;
+        case 'zoomIn':
+          if (canZoom) zoomIn();
+          break;
+        case 'zoomOut':
+          if (canZoom) zoomOut();
+          break;
+        case 'zoomReset':
+          if (zoomed) resetZoom();
+          break;
         case 'shortcutList':
           toggleShortcuts();
           break;
@@ -390,6 +442,11 @@ export function Lightbox({
     };
   }, [
     canFullscreen,
+    canZoom,
+    zoomed,
+    resetZoom,
+    zoomIn,
+    zoomOut,
     current,
     cycleSlideshow,
     handleCopyLink,
@@ -424,6 +481,7 @@ export function Lightbox({
     if (shortcut.availability === 'exifPanel') return showExifToggle;
     if (shortcut.availability === 'fullscreen') return canFullscreen;
     if (shortcut.availability === 'download') return Boolean(current?.downloadUrl);
+    if (shortcut.availability === 'zoom') return canZoom;
     return true;
   }).map((shortcut) => {
     let label: string = t.lightbox[shortcut.labelKey];
@@ -438,7 +496,7 @@ export function Lightbox({
 
   const lightboxJsx = (
     <div
-      className={styles.overlay}
+      className={`${styles.overlay}${zoom.requested ? ` ${styles.overlayZoom}` : ''}`}
       ref={overlayRef}
       onClick={handleOverlayClick}
       onTouchStart={handleTouchStart}
@@ -491,7 +549,15 @@ export function Lightbox({
 
       {/* Image or Video */}
       <div
-        className={styles.imageContainer}
+        ref={setImageContainer}
+        className={[
+          styles.imageContainer,
+          canZoom ? styles.zoomable : '',
+          zoom.zoomed ? styles.zoomed : '',
+          zoom.requested ? styles.zoomEngaged : '',
+        ]
+          .filter(Boolean)
+          .join(' ')}
         style={{
           backgroundColor: current.dominantColor || '#000',
           backgroundImage:
@@ -516,15 +582,41 @@ export function Lightbox({
         ) : (
           // eslint-disable-next-line @next/next/no-img-element
           <img
+            ref={previewRef}
             className={`${styles.image}${imageLoaded ? ` ${styles.imageLoaded}` : ''}`}
             src={canonicalImageUrl(current.previewUrl)}
             alt={current.caption ?? ''}
             draggable={false}
+            style={zoom.imageStyle}
             onLoad={() => setImageLoaded(true)}
             onError={() => console.error(`[Lightbox] Failed to load image: ${current.previewUrl}`)}
           />
         )}
 
+        {/*
+          The full-resolution file, mounted on the first zoom and not before.
+          It covers the preview's own box under the same transform, so when it
+          arrives it replaces the scaled-up preview without moving. Keyed by
+          the photo, so a new photo never shows the last one's file.
+        */}
+        {current.type === 'image' &&
+          current.zoomUrl &&
+          zoom.requested &&
+          zoom.status !== 'failed' && (
+            // eslint-disable-next-line @next/next/no-img-element
+            <img
+              key={current.id}
+              className={`${styles.zoomImage}${zoom.status === 'loaded' ? ` ${styles.zoomImageLoaded}` : ''}`}
+              src={current.zoomUrl}
+              alt=""
+              aria-hidden="true"
+              draggable={false}
+              style={zoom.imageStyle}
+              onLoad={(e) => zoom.onFullLoad(e.currentTarget)}
+              onError={zoom.onFullError}
+            />
+          )}
+
         {watermark?.enabled && watermark.text && (
           <div
             className={`${styles.watermark} ${
@@ -572,6 +664,19 @@ export function Lightbox({
           : t.lightbox.slideshowRunning(slideshowSeconds)}
       </p>
 
+      {/* Zoom loading, for screen readers; sighted visitors see the spinner
+          in the zoom button. */}
+      <p className="sr-only" role="status">
+        {zoom.zoomed && zoom.status === 'loading' ? t.lightbox.zoomLoading : ''}
+      </p>
+
+      {/* No full-resolution file: say so once, and stay on the preview. */}
+      {zoom.status === 'failed' && (
+        <div key={current.id} className={styles.zoomNotice} role="status">
+          {t.lightbox.zoomUnavailable}
+        </div>
+      )}
+
       {/*
         One bottom bar rather than five separately anchored controls.
         They used to carry hard-coded offsets, which broke in two ways: the
@@ -646,6 +751,40 @@ export function Lightbox({
         </div>
 
         <div className={`${styles.bottomBarGroup} ${styles.bottomBarRight}`}>
+          {/* Zoom to 1:1 and back (#467). Icon only: the bar is already full at
+              phone width, and the magnifier says what it does. */}
+          {canZoom && (
+            <button
+              className={`${styles.infoToggle} ${styles.zoomToggle}`}
+              onClick={() => zoom.toggle()}
+              aria-pressed={zoom.zoomed}
+              aria-busy={zoom.zoomed && zoom.status === 'loading'}
+              aria-label={zoom.zoomed ? t.lightbox.zoomOut : t.lightbox.zoomIn}
+              title={zoom.zoomed ? t.lightbox.zoomOutTitle : t.lightbox.zoomInTitle}
+            >
+              {zoom.zoomed && zoom.status === 'loading' ? (
+                <span className={styles.zoomSpinner} aria-hidden="true" />
+              ) : (
+                <svg
+                  aria-hidden="true"
+                  width="14"
+                  height="14"
+                  viewBox="0 0 24 24"
+                  fill="none"
+                  stroke="currentColor"
+                  strokeWidth="2"
+                  strokeLinecap="round"
+                  strokeLinejoin="round"
+                >
+                  <circle cx="11" cy="11" r="7" />
+                  <line x1="21" y1="21" x2="16" y2="16" />
+                  <line x1="8" y1="11" x2="14" y2="11" />
+                  {!zoom.zoomed && <line x1="11" y1="8" x2="11" y2="14" />}
+                </svg>
+              )}
+            </button>
+          )}
+
           {/* Proofing favorite button */}
           {proofing && current && (
             <button
@@ -711,10 +850,12 @@ export function Lightbox({
                   </span>
                 </div>
               )}
-              {exifData.lensModel && (
+              {formatLens(exifData.lensModel, exifData.model) && (
                 <div className={styles.exifRow}>
                   <span className={styles.exifLabel}>{t.lightbox.lens}</span>
-                  <span className={styles.exifValue}>{exifData.lensModel}</span>
+                  <span className={styles.exifValue}>
+                    {formatLens(exifData.lensModel, exifData.model)}
+                  </span>
                 </div>
               )}
               {exifData.focalLength && (
@@ -726,7 +867,9 @@ export function Lightbox({
               {exifData.fNumber && (
                 <div className={styles.exifRow}>
                   <span className={styles.exifLabel}>{t.lightbox.aperture}</span>
-                  <span className={styles.exifValue}>ƒ/{exifData.fNumber}</span>
+                  <span className={styles.exifValue}>
+                    <span className="exif-fsign">{APERTURE_SIGN}</span>/{exifData.fNumber}
+                  </span>
                 </div>
               )}
               {exifData.exposureTime && (
diff --git a/components/MapView.tsx b/components/MapView.tsx
index 98243fd..92e4e3a 100644
--- a/components/MapView.tsx
+++ b/components/MapView.tsx
@@ -83,6 +83,8 @@ export function MapView() {
           lat: loc.lat,
           lng: loc.lng,
           html: `<div class="map-marker">${loc.photoCount}</div>`,
+          // "Dźwirzyno, Polen, 12 Fotos" instead of a bare "12".
+          label: [heading, subheading, t.common.photos(loc.photoCount)].filter(Boolean).join(', '),
           popupHtml: `
           <div class="map-popup">
             <img src="${escapeHtml(loc.coverUrl)}" alt="${escapeHtml(heading)}" class="map-popup__cover" loading="lazy" />
diff --git a/components/PasswordGate.module.css b/components/PasswordGate.module.css
index eb0ce35..6698750 100644
--- a/components/PasswordGate.module.css
+++ b/components/PasswordGate.module.css
@@ -2,6 +2,7 @@
 
 .gate {
   display: flex;
+  flex-direction: column;
   align-items: center;
   justify-content: center;
   min-height: calc(100vh - var(--header-height));
@@ -43,23 +44,17 @@
   width: 100%;
   padding: 12px 16px;
   background: var(--bg-primary);
-  border: 1px solid var(--border-subtle);
+  border: 1px solid var(--input-border);
   border-radius: var(--radius-md);
   color: var(--text-primary);
   font-family: var(--font-sans);
   font-size: 0.9rem;
-  transition: border-color var(--transition-fast);
 }
 
-/* The base rule used to set `outline: none`, leaving a 1px border colour
-   change as the only focus signal. That is too little on a page whose only
-   purpose is typing, and a colour-only cue can be lost on colour-blind
-   visitors. The border change stays; the ring is added. */
-.input:focus-visible {
-  outline: 2px solid var(--accent);
-  outline-offset: 2px;
-  border-color: var(--accent);
-}
+/* No focus rule of its own: the global one in app/tokens.css draws the ring.
+   This used to add an accent ring on top of an accent border — two red
+   outlines on the one page whose only purpose is typing, and a different
+   signal from every other control on the site. */
 
 .input::placeholder {
   color: var(--text-muted);
@@ -114,6 +109,17 @@
   }
 }
 
+/* Legal links under the site gate's card: the footer the gate has no room
+   for. The links themselves take the footer's .footer__legal-link styling, so
+   every preset sets them the way it sets its footer. */
+.legal {
+  display: flex;
+  flex-wrap: wrap;
+  justify-content: center;
+  gap: 8px 20px;
+  margin-top: 24px;
+}
+
 /* ── Responsive ──────────────────────────────────── */
 @media (max-width: 640px) {
   .card {
diff --git a/components/PasswordGate.tsx b/components/PasswordGate.tsx
index f18fb74..2091324 100644
--- a/components/PasswordGate.tsx
+++ b/components/PasswordGate.tsx
@@ -6,6 +6,7 @@
  */
 
 import { useState } from 'react';
+import Link from 'next/link';
 import styles from './PasswordGate.module.css';
 import { useDictionary } from './I18nProvider';
 
@@ -13,6 +14,11 @@ interface PasswordGateProps {
   slug: string;
   title: string;
   type?: 'subpage' | 'album' | 'journal' | 'page' | 'site';
+  /**
+   * Links shown under the card. The site gate passes its legal pages here,
+   * which a locked site still serves (proxy.ts, UNGATED_PAGES).
+   */
+  legalLinks?: { href: string; label: string }[];
 }
 
 /** Whole seconds from a `Retry-After` header, or null when there is none. */
@@ -21,7 +27,12 @@ function retryAfterSeconds(res: Response): number | null {
   return Number.isFinite(seconds) && seconds > 0 ? seconds : null;
 }
 
-export default function PasswordGate({ slug, title, type = 'subpage' }: PasswordGateProps) {
+export default function PasswordGate({
+  slug,
+  title,
+  type = 'subpage',
+  legalLinks = [],
+}: PasswordGateProps) {
   const t = useDictionary();
   const [password, setPassword] = useState('');
   const [error, setError] = useState('');
@@ -119,6 +130,15 @@ export default function PasswordGate({ slug, title, type = 'subpage' }: Password
           </p>
         )}
       </div>
+      {legalLinks.length > 0 && (
+        <nav className={styles.legal} aria-label={t.password.legalNavAria}>
+          {legalLinks.map(({ href, label }) => (
+            <Link key={href} href={href} className="footer__legal-link">
+              {label}
+            </Link>
+          ))}
+        </nav>
+      )}
     </div>
   );
 }
diff --git a/components/ProofSessionControls.tsx b/components/ProofSessionControls.tsx
index b877bf1..77dcbe5 100644
--- a/components/ProofSessionControls.tsx
+++ b/components/ProofSessionControls.tsx
@@ -24,7 +24,7 @@ const barStyle: React.CSSProperties = {
   flexWrap: 'wrap',
   gap: '12px',
   padding: '8px 16px',
-  borderRadius: '30px',
+  borderRadius: 'var(--radius-lg)',
   background: 'var(--bg-card, #1e1e1e)',
   color: 'var(--text-primary, #ffffff)',
   border: '1px solid var(--border-subtle, rgba(255,255,255,0.15))',
@@ -111,7 +111,7 @@ export function ProofSessionControls() {
               color: isFilterActive ? 'var(--on-accent, #fff)' : 'var(--text-primary)',
               border: 'none',
               padding: '6px 14px',
-              borderRadius: '20px',
+              borderRadius: 'var(--radius-md)',
               fontSize: '0.85rem',
               fontWeight: 500,
               cursor: 'pointer',
diff --git a/components/ThemeToggle.tsx b/components/ThemeToggle.tsx
index 655183a..b1563fe 100644
--- a/components/ThemeToggle.tsx
+++ b/components/ThemeToggle.tsx
@@ -15,7 +15,7 @@
 
 'use client';
 
-import { useSyncExternalStore, useCallback } from 'react';
+import { useSyncExternalStore, useCallback, useEffect } from 'react';
 import { useDictionary } from './I18nProvider';
 
 type Theme = 'dark' | 'light';
@@ -57,16 +57,63 @@ function applyTheme(theme: Theme) {
   currentTheme = theme;
   if (typeof document !== 'undefined') {
     document.documentElement.setAttribute('data-theme', theme);
-    localStorage.setItem('theme', theme);
+    try {
+      localStorage.setItem('theme', theme);
+    } catch {
+      // Blocked site data: the switch still applies for this page view.
+    }
   }
   listeners.forEach((cb) => cb());
 }
 
-// Initialize from localStorage on module load (client-side only)
-if (typeof window !== 'undefined') {
-  const stored = localStorage.getItem('theme');
-  currentTheme = stored === 'light' || stored === 'dark' ? stored : configuredTheme();
+/** The visitor's own choice, if they made one and storage is readable. */
+function storedTheme(): Theme | null {
+  try {
+    const stored = localStorage.getItem('theme');
+    return stored === 'light' || stored === 'dark' ? stored : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * `mode: auto` follows the OS while the page is open, not only at load: a
+ * visitor whose system switches to dark at sunset sees the site follow.
+ * Nothing is stored, so the site keeps following — a stored choice (or a fixed
+ * configured mode) takes it out of the loop. Exported for the test.
+ */
+export function followSystemTheme() {
+  if (storedTheme() !== null) return;
+  const mode = document.documentElement.getAttribute('data-default-theme');
+  if (mode === 'light' || mode === 'dark') return;
+  currentTheme = systemTheme();
   document.documentElement.setAttribute('data-theme', currentTheme);
+  listeners.forEach((cb) => cb());
+}
+
+/**
+ * Re-resolve the mode once the component is mounted and write it back onto
+ * <html>. A hard 404 is served as Next's bare error shell: the inline script
+ * never runs there, the module above loaded before the layout's attributes
+ * existed, and the client render then writes the server's data-theme over
+ * whatever was applied. Without this, a visitor who stored light got a dark
+ * 404 page. Exported for the test.
+ */
+export function syncThemeFromDom() {
+  currentTheme = storedTheme() ?? configuredTheme();
+  document.documentElement.setAttribute('data-theme', currentTheme);
+  listeners.forEach((cb) => cb());
+}
+
+// Initialize on module load (client-side only). The inline script in the root
+// layout (lib/themeScript.ts) has already set data-theme by the same rules;
+// this brings the module state in line with it.
+if (typeof window !== 'undefined') {
+  currentTheme = storedTheme() ?? configuredTheme();
+  document.documentElement.setAttribute('data-theme', currentTheme);
+  window
+    .matchMedia?.('(prefers-color-scheme: light)')
+    ?.addEventListener?.('change', followSystemTheme);
 }
 
 export function ThemeToggle() {
@@ -74,6 +121,10 @@ export function ThemeToggle() {
   const t = useDictionary();
   const label = theme === 'dark' ? t.theme.switchToLight : t.theme.switchToDark;
 
+  useEffect(() => {
+    syncThemeFromDom();
+  }, []);
+
   const toggle = useCallback(() => {
     applyTheme(theme === 'dark' ? 'light' : 'dark');
   }, [theme]);
diff --git a/components/__tests__/LeafletMapLabels.test.tsx b/components/__tests__/LeafletMapLabels.test.tsx
index 6b3a742..6fedd8a 100644
--- a/components/__tests__/LeafletMapLabels.test.tsx
+++ b/components/__tests__/LeafletMapLabels.test.tsx
@@ -48,3 +48,31 @@ describe('localizedLeafletPrefix', () => {
     );
   });
 });
+
+describe('LeafletMap marker names', () => {
+  it('names a marker by its label, not by the count it shows', async () => {
+    const { container } = render(
+      <I18nProvider locale="de">
+        <LeafletMap
+          markers={[
+            {
+              lat: 54.16,
+              lng: 15.39,
+              html: '<div class="map-marker">12</div>',
+              label: 'Dźwirzyno, Polen, 12 Fotos',
+            },
+          ]}
+        />
+      </I18nProvider>,
+    );
+
+    const icon = await waitFor(() => {
+      const el = container.querySelector('.leaflet-marker-icon');
+      if (!el) throw new Error('marker not placed yet');
+      return el;
+    });
+    expect(icon.getAttribute('aria-label')).toBe('Dźwirzyno, Polen, 12 Fotos');
+    expect(icon.getAttribute('title')).toBe('Dźwirzyno, Polen, 12 Fotos');
+    expect(icon.getAttribute('role')).toBe('button');
+  });
+});
diff --git a/components/__tests__/LightboxZoom.test.tsx b/components/__tests__/LightboxZoom.test.tsx
new file mode 100644
index 0000000..60d7148
--- /dev/null
+++ b/components/__tests__/LightboxZoom.test.tsx
@@ -0,0 +1,259 @@
+// @vitest-environment jsdom
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { render, screen, cleanup, fireEvent, within } from '@testing-library/react';
+import { useState } from 'react';
+import { Lightbox } from '../Lightbox';
+import type { PhotoItem } from '@/app/[...path]/PhotoGrid';
+
+/**
+ * The lightbox zoom (#467), wired up: the control, the keys, Esc order,
+ * double-click, swipe while zoomed, and that the full-resolution file is
+ * requested only when the visitor zooms.
+ *
+ * jsdom does no layout, so the fit box is stubbed: every image is laid out at
+ * 1000×600, at the origin. A 6000px photo on a 1× screen is 1:1 at 6×.
+ */
+
+const photo = (id: string, extra: Partial<PhotoItem> = {}): PhotoItem => ({
+  id,
+  type: 'image',
+  thumbUrl: `/t/${id}`,
+  previewUrl: `/p/${id}`,
+  exifUrl: `/e/${id}`,
+  aspectRatio: 5 / 3,
+  ...extra,
+});
+
+const ZOOMABLE = photo('z1', { zoomUrl: '/api/zoom/a/z1', zoomWidth: 6000, zoomHeight: 3600 });
+const ZOOMABLE_2 = photo('z2', { zoomUrl: '/api/zoom/a/z2', zoomWidth: 6000, zoomHeight: 3600 });
+const PLAIN = photo('p1');
+const VIDEO: PhotoItem = {
+  ...photo('v1', { zoomUrl: '/api/zoom/a/v1', zoomWidth: 6000, zoomHeight: 3600 }),
+  type: 'video',
+  videoUrl: '/v/v1',
+};
+
+function Harness({
+  assets,
+  start = 0,
+  onClose = () => {},
+  onNextSpy,
+}: {
+  assets: PhotoItem[];
+  start?: number;
+  onClose?: () => void;
+  onNextSpy?: () => void;
+}) {
+  const [index, setIndex] = useState(start);
+  return (
+    <Lightbox
+      assets={assets}
+      currentIndex={index}
+      onClose={onClose}
+      onNext={() => {
+        onNextSpy?.();
+        setIndex((i) => (i + 1) % assets.length);
+      }}
+      onPrev={() => setIndex((i) => (i - 1 + assets.length) % assets.length)}
+    />
+  );
+}
+
+const restore: Array<() => void> = [];
+function stub<T extends object>(target: T, key: string, get: () => unknown) {
+  const original = Object.getOwnPropertyDescriptor(target, key);
+  Object.defineProperty(target, key, { configurable: true, get });
+  restore.push(() => {
+    if (original) Object.defineProperty(target, key, original);
+    else delete (target as Record<string, unknown>)[key];
+  });
+}
+
+beforeEach(() => {
+  stub(HTMLElement.prototype, 'offsetWidth', function (this: HTMLElement) {
+    return this.tagName === 'IMG' ? 1000 : 0;
+  });
+  stub(HTMLElement.prototype, 'offsetHeight', function (this: HTMLElement) {
+    return this.tagName === 'IMG' ? 600 : 0;
+  });
+  stub(window, 'devicePixelRatio', () => 1);
+  window.matchMedia = vi.fn(() => ({ matches: false })) as unknown as typeof window.matchMedia;
+});
+
+afterEach(() => {
+  cleanup();
+  while (restore.length) restore.pop()!();
+});
+
+const dialog = () => screen.getByRole('dialog');
+const preview = () => dialog().querySelector<HTMLImageElement>('img[src^="/p/"]')!;
+const fullImage = () => dialog().querySelector<HTMLImageElement>('img[src^="/api/zoom/"]');
+const zoomButton = () =>
+  within(dialog()).queryByRole('button', { name: /Zoom to full resolution|Fit the photo/ });
+const key = (k: string) => fireEvent.keyDown(document, { key: k });
+
+describe('the zoom control', () => {
+  it('is offered for a zoomable photo', () => {
+    render(<Harness assets={[ZOOMABLE]} />);
+    expect(zoomButton()).not.toBeNull();
+    expect(zoomButton()!.getAttribute('aria-pressed')).toBe('false');
+  });
+
+  it('is absent without a zoom source, and for a video', () => {
+    render(<Harness assets={[PLAIN, VIDEO]} />);
+    expect(zoomButton()).toBeNull();
+    fireEvent.click(screen.getByLabelText('Next photo'));
+    expect(zoomButton()).toBeNull();
+  });
+
+  it('toggles 1:1 and back', () => {
+    render(<Harness assets={[ZOOMABLE]} />);
+    fireEvent.click(zoomButton()!);
+    expect(zoomButton()!.getAttribute('aria-pressed')).toBe('true');
+    expect(preview().style.transform).toContain('scale(6)');
+    fireEvent.click(zoomButton()!);
+    expect(zoomButton()!.getAttribute('aria-pressed')).toBe('false');
+    expect(preview().style.transform).toContain('scale(1)');
+  });
+});
+
+describe('on a touch device (review of #830)', () => {
+  const coarse = () => {
+    window.matchMedia = vi.fn((q: string) => ({
+      matches: q === '(pointer: coarse)',
+    })) as unknown as typeof window.matchMedia;
+  };
+  const HUGE = photo('h1', { zoomUrl: '/api/zoom/a/h1', zoomWidth: 9520, zoomHeight: 6336 });
+
+  it('offers no zoom above 50 MP', () => {
+    coarse();
+    render(<Harness assets={[HUGE]} />);
+    expect(zoomButton()).toBeNull();
+    key('+');
+    expect(fullImage()).toBeNull();
+  });
+
+  it('still offers it for a smaller photo', () => {
+    coarse();
+    render(
+      <Harness
+        assets={[photo('s1', { zoomUrl: '/api/zoom/a/s1', zoomWidth: 4032, zoomHeight: 3024 })]}
+      />,
+    );
+    expect(zoomButton()).not.toBeNull();
+  });
+
+  it('keeps the large photo zoomable with a mouse', () => {
+    render(<Harness assets={[HUGE]} />);
+    expect(zoomButton()).not.toBeNull();
+  });
+});
+
+describe('the full-resolution file', () => {
+  it('is not requested on open or on the next photo', () => {
+    render(<Harness assets={[ZOOMABLE, ZOOMABLE_2]} />);
+    expect(fullImage()).toBeNull();
+    fireEvent.click(screen.getByLabelText('Next photo'));
+    expect(fullImage()).toBeNull();
+  });
+
+  it('is requested on the first zoom, under the same transform as the preview', () => {
+    render(<Harness assets={[ZOOMABLE]} />);
+    key('+');
+    const full = fullImage();
+    expect(full?.getAttribute('src')).toBe('/api/zoom/a/z1');
+    expect(full!.style.transform).toBe(preview().style.transform);
+  });
+
+  it('when missing, says so, returns to fit and withdraws the control', () => {
+    render(<Harness assets={[ZOOMABLE]} />);
+    key('+');
+    fireEvent.error(fullImage()!);
+    expect(screen.getByText('Full resolution is not available for this photo.')).toBeTruthy();
+    expect(zoomButton()).toBeNull();
+    expect(preview().style.transform).toContain('scale(1)');
+  });
+
+  it('starts over on the next photo', () => {
+    render(<Harness assets={[ZOOMABLE, ZOOMABLE_2]} />);
+    key('+');
+    expect(fullImage()).not.toBeNull();
+    fireEvent.click(screen.getByLabelText('Next photo'));
+    expect(fullImage()).toBeNull();
+    expect(preview().style.transform).toBe('');
+    expect(zoomButton()!.getAttribute('aria-pressed')).toBe('false');
+  });
+});
+
+describe('keys', () => {
+  it('+ / = zoom in by steps up to 1:1, - out, 0 resets', () => {
+    render(<Harness assets={[ZOOMABLE]} />);
+    key('+');
+    expect(preview().style.transform).toContain('scale(2)');
+    key('=');
+    expect(preview().style.transform).toContain('scale(4)');
+    key('+');
+    expect(preview().style.transform).toContain('scale(6)');
+    key('-');
+    expect(preview().style.transform).toContain('scale(3)');
+    key('0');
+    expect(preview().style.transform).toContain('scale(1)');
+  });
+
+  it('leave a photo without zoom alone', () => {
+    render(<Harness assets={[PLAIN]} />);
+    key('+');
+    expect(preview().style.transform).toBe('');
+  });
+
+  it('Esc leaves the zoom first, and closes the viewer only after that', () => {
+    const onClose = vi.fn();
+    render(<Harness assets={[ZOOMABLE]} onClose={onClose} />);
+    key('+');
+    key('Escape');
+    expect(onClose).not.toHaveBeenCalled();
+    expect(zoomButton()!.getAttribute('aria-pressed')).toBe('false');
+    key('Escape');
+    expect(onClose).toHaveBeenCalledTimes(1);
+  });
+
+  it('lists the zoom keys only where zoom is offered', () => {
+    const { unmount } = render(<Harness assets={[ZOOMABLE]} />);
+    key('?');
+    expect(screen.queryByText('Zoom in / out')).not.toBeNull();
+    unmount();
+    render(<Harness assets={[PLAIN]} />);
+    key('?');
+    expect(screen.queryByText('Zoom in / out')).toBeNull();
+  });
+});
+
+describe('gestures', () => {
+  it('double-click goes to 1:1 around the cursor, and back', () => {
+    render(<Harness assets={[ZOOMABLE]} />);
+    const surface = preview().parentElement!;
+    fireEvent.doubleClick(surface, { clientX: 600, clientY: 300 });
+    // Fit box centre (500, 300); the cursor 100px right of it stays put at 6×.
+    expect(preview().style.transform).toBe('translate3d(-500px, 0px, 0) scale(6)');
+    fireEvent.doubleClick(surface, { clientX: 600, clientY: 300 });
+    expect(preview().style.transform).toContain('scale(1)');
+  });
+
+  it('no swipe navigation while zoomed', () => {
+    const onNextSpy = vi.fn();
+    render(<Harness assets={[ZOOMABLE, ZOOMABLE_2]} onNextSpy={onNextSpy} />);
+    const swipeLeft = () => {
+      fireEvent.touchStart(dialog(), { touches: [{ clientX: 600, clientY: 300 }] });
+      fireEvent.touchEnd(dialog(), {
+        touches: [],
+        changedTouches: [{ clientX: 300, clientY: 300 }],
+      });
+    };
+    key('+');
+    swipeLeft();
+    expect(onNextSpy).not.toHaveBeenCalled();
+    key('0');
+    swipeLeft();
+    expect(onNextSpy).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/components/__tests__/ThemeToggle.test.tsx b/components/__tests__/ThemeToggle.test.tsx
new file mode 100644
index 0000000..1be36fd
--- /dev/null
+++ b/components/__tests__/ThemeToggle.test.tsx
@@ -0,0 +1,97 @@
+// @vitest-environment jsdom
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+/**
+ * `mode: auto` follows OS changes while the page is open (T-10/T-18), unless
+ * the visitor made a choice or the operator fixed a mode.
+ */
+
+let osLight = false;
+let onChange: (() => void) | null = null;
+
+// Node 26 defines its own global localStorage (undefined without
+// --localstorage-file), which shadows jsdom's; a Map-backed stub stands in.
+function stubStorage() {
+  const store = new Map<string, string>();
+  vi.stubGlobal('localStorage', {
+    getItem: (k: string) => store.get(k) ?? null,
+    setItem: (k: string, v: string) => void store.set(k, v),
+  });
+}
+
+beforeEach(() => {
+  vi.resetModules();
+  osLight = false;
+  onChange = null;
+  stubStorage();
+  document.documentElement.setAttribute('data-default-theme', 'auto');
+  document.documentElement.removeAttribute('data-theme');
+  vi.stubGlobal('matchMedia', (query: string) => ({
+    media: query,
+    get matches() {
+      return query === '(prefers-color-scheme: light)' ? osLight : false;
+    },
+    addEventListener: (_: string, cb: () => void) => {
+      onChange = cb;
+    },
+  }));
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+async function load() {
+  await import('../ThemeToggle');
+  return document.documentElement;
+}
+
+describe('ThemeToggle under mode: auto', () => {
+  it('follows the OS when it switches', async () => {
+    const html = await load();
+    expect(html.getAttribute('data-theme')).toBe('dark');
+    osLight = true;
+    onChange?.();
+    expect(html.getAttribute('data-theme')).toBe('light');
+    // Following the OS is not a choice — nothing is stored.
+    expect(localStorage.getItem('theme')).toBeNull();
+  });
+
+  it('keeps a stored choice when the OS switches', async () => {
+    localStorage.setItem('theme', 'dark');
+    const html = await load();
+    osLight = true;
+    onChange?.();
+    expect(html.getAttribute('data-theme')).toBe('dark');
+  });
+
+  it('keeps a fixed configured mode when the OS switches', async () => {
+    document.documentElement.setAttribute('data-default-theme', 'dark');
+    const html = await load();
+    osLight = true;
+    onChange?.();
+    expect(html.getAttribute('data-theme')).toBe('dark');
+  });
+});
+
+describe('ThemeToggle on a page rendered from the error shell', () => {
+  it('re-applies the stored mode after the client render overwrote it', async () => {
+    localStorage.setItem('theme', 'light');
+    const html = await load();
+    // The 404 shell's client render writes the server default back onto <html>.
+    html.setAttribute('data-theme', 'dark');
+    const { syncThemeFromDom } = await import('../ThemeToggle');
+    syncThemeFromDom();
+    expect(html.getAttribute('data-theme')).toBe('light');
+  });
+
+  it('picks up a configured mode that only appeared after the module loaded', async () => {
+    document.documentElement.removeAttribute('data-default-theme');
+    const html = await load();
+    expect(html.getAttribute('data-theme')).toBe('dark');
+    html.setAttribute('data-default-theme', 'light');
+    const { syncThemeFromDom } = await import('../ThemeToggle');
+    syncThemeFromDom();
+    expect(html.getAttribute('data-theme')).toBe('light');
+  });
+});
diff --git a/components/__tests__/colorTokens.test.ts b/components/__tests__/colorTokens.test.ts
index c4bf56d..fafbe49 100644
--- a/components/__tests__/colorTokens.test.ts
+++ b/components/__tests__/colorTokens.test.ts
@@ -69,6 +69,19 @@ function surfaces(preset: string, mode: 'dark' | 'light'): string[] {
   return SURFACES.map((s) => token(own, s) ?? token(base, s)!).filter((v) => v.startsWith('#'));
 }
 
+/**
+ * The --error a preset resolves to in one mode, in cascade order: a preset
+ * may set its own where the default red misses 4.5:1 on its surfaces. The
+ * preset's dark block comes after `[data-theme='light']` in tokens.css with
+ * the same specificity, so in light mode it beats the global light value.
+ */
+function errorToken(preset: string, mode: 'dark' | 'light'): string | undefined {
+  const dark = token(block(`[data-preset='${preset}']`), 'error');
+  if (mode === 'dark') return dark ?? token(ROOT, 'error');
+  const light = token(block(`[data-preset='${preset}'][data-theme='light']`), 'error');
+  return light ?? dark ?? token(LIGHT, 'error');
+}
+
 describe('--error (T-8)', () => {
   it('is defined for both modes', () => {
     expect(token(ROOT, 'error')).toBeDefined();
@@ -78,7 +91,7 @@ describe('--error (T-8)', () => {
   for (const preset of Object.keys(THEME_PRESETS)) {
     for (const mode of ['dark', 'light'] as const) {
       it(`${preset} (${mode}): clears 4.5:1 on every surface`, () => {
-        const error = parse(token(mode === 'dark' ? ROOT : LIGHT, 'error')!);
+        const error = parse(errorToken(preset, mode)!);
         for (const surface of surfaces(preset, mode)) {
           expect(ratio(error, parse(surface)), surface).toBeGreaterThanOrEqual(4.5);
         }
diff --git a/components/__tests__/useSwipe.test.tsx b/components/__tests__/useSwipe.test.tsx
new file mode 100644
index 0000000..a8d030a
--- /dev/null
+++ b/components/__tests__/useSwipe.test.tsx
@@ -0,0 +1,74 @@
+// @vitest-environment jsdom
+import { describe, it, expect, vi } from 'vitest';
+import { renderHook } from '@testing-library/react';
+import { useSwipe } from '@/hooks/useSwipe';
+
+/**
+ * A swipe is one finger (#467). A pinch that drifts sideways used to jump to
+ * the next photo, because only the first touch was ever looked at.
+ */
+
+type T = { clientX: number; clientY: number };
+const at = (x: number, y = 100): T => ({ clientX: x, clientY: y });
+const ev = (touches: T[], changedTouches: T[] = []) =>
+  ({ touches, changedTouches }) as unknown as TouchEvent;
+
+function setup(enabled = true) {
+  const onSwipeLeft = vi.fn();
+  const onSwipeRight = vi.fn();
+  const { result, rerender } = renderHook(
+    (props: { enabled: boolean }) =>
+      useSwipe({ onSwipeLeft, onSwipeRight, enabled: props.enabled }),
+    { initialProps: { enabled } },
+  );
+  return { onSwipeLeft, onSwipeRight, handlers: () => result.current, rerender };
+}
+
+describe('useSwipe', () => {
+  it('turns a one-finger horizontal drag into a swipe', () => {
+    const s = setup();
+    s.handlers().handleTouchStart(ev([at(300)]));
+    s.handlers().handleTouchEnd(ev([], [at(100)]));
+    expect(s.onSwipeLeft).toHaveBeenCalledTimes(1);
+
+    s.handlers().handleTouchStart(ev([at(100)]));
+    s.handlers().handleTouchEnd(ev([], [at(300)]));
+    expect(s.onSwipeRight).toHaveBeenCalledTimes(1);
+  });
+
+  it('ignores a pinch, however far it drifts', () => {
+    const s = setup();
+    // First finger down, second joins, both drift left, lift one by one.
+    s.handlers().handleTouchStart(ev([at(400)]));
+    s.handlers().handleTouchStart(ev([at(400), at(500)]));
+    s.handlers().handleTouchEnd(ev([at(150)], [at(250)]));
+    s.handlers().handleTouchEnd(ev([], [at(100)]));
+    expect(s.onSwipeLeft).not.toHaveBeenCalled();
+    expect(s.onSwipeRight).not.toHaveBeenCalled();
+  });
+
+  it('counts the next one-finger swipe again after a pinch', () => {
+    const s = setup();
+    s.handlers().handleTouchStart(ev([at(400), at(500)]));
+    s.handlers().handleTouchEnd(ev([], [at(100)]));
+    s.handlers().handleTouchStart(ev([at(300)]));
+    s.handlers().handleTouchEnd(ev([], [at(100)]));
+    expect(s.onSwipeLeft).toHaveBeenCalledTimes(1);
+  });
+
+  it('does nothing while disabled (the lightbox is zoomed)', () => {
+    const s = setup(false);
+    s.handlers().handleTouchStart(ev([at(300)]));
+    s.handlers().handleTouchEnd(ev([], [at(100)]));
+    expect(s.onSwipeLeft).not.toHaveBeenCalled();
+  });
+
+  it('ignores a gesture that started disabled even if it ends enabled', () => {
+    // Pinched out to fit and let go: the pan that preceded it is no swipe.
+    const s = setup(false);
+    s.handlers().handleTouchStart(ev([at(300)]));
+    s.rerender({ enabled: true });
+    s.handlers().handleTouchEnd(ev([], [at(100)]));
+    expect(s.onSwipeLeft).not.toHaveBeenCalled();
+  });
+});
diff --git a/content/gallery.yaml.example b/content/gallery.yaml.example
index 70ffb9f..c6f7242 100644
--- a/content/gallery.yaml.example
+++ b/content/gallery.yaml.example
@@ -56,6 +56,7 @@ subpages:
     subtitle: "A collection of 2026 highlights in 35mm film." # Optional: Sub-text for headers
     password: "your-password" # Optional protection
     # hidden: true # EXPERIMENTAL: reachable by direct link, but not shown in navigation
+    # zoom: true # 1:1 zoom in the lightbox for this page's albums (overrides settings.yaml)
     # coverGrid: # Optional: the album covers on this page (nothing else)
     #   columns: 3 # how many album covers per row on this page
     #   gap: 8 # spacing between the covers, in px — omit to keep the theme's own
@@ -83,6 +84,11 @@ subpages:
           #   album's password and that the asset really belongs to the
           #   album, so an edited URL cannot reach anything else.
           #
+          # zoom: false
+          #   1:1 zoom in the lightbox for this album, overriding the subpage
+          #   and `zoom` in settings.yaml in either direction. Applies where
+          #   this entry is: the same album on another page keeps its own.
+          #
           # location: city
           #   How precisely this album's photographs may be placed — on the
           #   map, and in the info panel of the viewer, which names the city
diff --git a/content/settings.yaml.example b/content/settings.yaml.example
index cc04e98..9fcadc1 100644
--- a/content/settings.yaml.example
+++ b/content/settings.yaml.example
@@ -28,7 +28,9 @@ lang: "en"
 # is still being built, or for a folio only ever shown to clients.
 # Log in once and the server log prints a scrypt: hash to paste back here.
 # The SITE_PASSWORD environment variable overrides this value.
-# /admin keeps its own password and is never behind this gate.
+# /admin keeps its own password and is never behind this gate. The legal
+# notice and the privacy page stay reachable too; the password page links them.
+# So does the contact form, which the legal notice links as a contact channel.
 # sitePassword: "scrypt:..."
 
 # What a first-time visitor sees: dark (default), light, or auto to follow
@@ -62,6 +64,11 @@ scrollToTop: true
 #   enabled: true
 #   allowMailto: true
 
+# Lightbox zoom to full resolution (1:1), for checking sharpness. Off unless
+# set: it serves the full-resolution file (location removed). gallery.yaml can
+# switch it per subpage and per album, either way.
+# zoom: true
+
 # Watermark overlay on the lightbox. opacity is a fraction: 0.5 = 50%.
 # watermark:
 #   enabled: true
@@ -71,7 +78,7 @@ scrollToTop: true
 
 # ── Theme configuration ──────────────────────────────────────────
 # Presets: studio-modern (default), studio, minimal, editorial, classic,
-#          noir, monograph
+#          noir, monograph, kunsthalle, ma, cyanotype, salon, birch
 theme:
   preset: "studio-modern"
   # accent: "#e60012"
diff --git a/docs/README.md b/docs/README.md
index b34fc4a..eb19ea4 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -8,7 +8,7 @@ a quick start.
 | Guide                                          | Covers                                                                                                                  |
 | ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
 | **[Gallery Configuration](gallery-config.md)** | `gallery.yaml` and `settings.yaml` — albums, subpages, sections, photo order, passwords, grid, SEO, proofing, watermark |
-| **[Theming](theming.md)**                      | The seven presets, custom colours and fonts, hero styles, grid layouts, with screenshots                                |
+| **[Theming](theming.md)**                      | The twelve presets, custom colours and fonts, hero styles, grid layouts, with screenshots                               |
 | **[Journal & Photo Essays](journal.md)**       | Long-form storytelling — file format, block syntax, drafts, per-entry passwords, Journal Studio                         |
 | **[Admin Panel](admin-panel.md)**              | The visual editor at `/admin` — pages, journal, settings, analytics, backups, security                                  |
 | **[Deployment](deployment.md)**                | Setup wizard internals, Docker, health check, reverse proxy, behaviour during an Immich outage                          |
diff --git a/docs/deployment.md b/docs/deployment.md
index 6a63975..ace5b0e 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -18,6 +18,8 @@ For the quick path — clone, `npm run dev`, open `/install` — see the
 - [Behaviour when Immich is Unreachable](#behaviour-when-immich-is-unreachable)
 - [Reverse Proxy](#reverse-proxy)
 - [CDN Mode](#cdn-mode)
+- [Edits made in Immich](#edits-made-in-immich)
+- [Colour Profiles](#colour-profiles)
 
 ## What the Setup Wizard Writes
 
@@ -230,8 +232,9 @@ Folio URL, then:
 
 - **Cache `/api/image/*` and `/api/video/*`**, and nothing else. Pages are
   rendered per request, and other routes check cookies.
-- **Include the full query string in the cache key.** `size`, `w` and the
-  `IMAGE_CACHE_VERSION` buster `v` all select a different file.
+- **Include the full query string in the cache key.** `size`, `w`, the edit
+  marker `e` and the `IMAGE_CACHE_VERSION` buster `v` all select a different
+  file.
 - **Respect the origin's `Cache-Control`.** Photos come back
   `public, max-age=31536000, immutable`; errors (429, 503, 404) come back
   `no-store` and must not be cached.
@@ -256,7 +259,63 @@ links, not the image URLs themselves.
 
 **Changing a photo.** A CDN keeps immutable responses for as long as a browser
 does. Bump `IMAGE_CACHE_VERSION` after regenerating thumbnails in Immich, which
-changes every URL at once, or purge the CDN.
+changes every URL at once, or purge the CDN. Edits made in Immich's editor need
+neither: see [Edits made in Immich](#edits-made-in-immich).
 
 The Content-Security-Policy allows the CDN's origin for `img-src` and
 `media-src` automatically.
+
+## Edits made in Immich
+
+Photos edited in Immich's own editor (crop, rotate) appear as edited
+everywhere: in the grid, the lightbox, the zoom, share images, the map and
+downloads. Immich keeps an edit apart from the file and applies it only when
+asked to, so Folio always asks for the edited rendition (for a photo that is
+not edited, Immich returns the same file either way; the parameter exists
+since Immich 2.5, below the 3.0 that Folio requires), and lays the grid out
+with the edited proportions.
+
+The image URL of an edited photo carries an extra `e` parameter, derived from
+when the photo last changed in Immich, to the second. Image responses are cached as
+`immutable` for a year and the asset ID stays the same through an edit, so
+without it browsers and CDNs would keep showing the photo as it was before.
+Only edited photos get a new URL; all other URLs stay as they are. A later
+edit changes the parameter again, once Folio's album cache has picked it up
+(`CACHE_TTL`).
+
+Downloads of an edited photo are Immich's rendition of the edit: a
+full-resolution JPEG without EXIF, named `.jpg`. Should Immich hand out the
+edit in a format the location scrubber does not handle (WebP, PNG), the photo
+is not downloaded rather than sent unchecked; a ZIP goes on without it and the
+server log names it.
+
+## Colour Profiles
+
+Visitors only ever get Immich's own renditions: the `thumbnail` for grid tiles
+and the `preview` for everything larger. Folio streams those bytes unchanged.
+It never decodes or re-encodes a photo, so whatever colour profile Immich
+embeds is what the browser sees, and colour fidelity is decided by how Immich
+builds its renditions.
+
+Immich's relevant setting is `image.colorspace` (Administration → Settings →
+Image Settings), `p3` by default. Measured on Immich 3.2.0 with `p3`, thumbnail
+as WebP and preview as JPEG:
+
+| Original                                         | Thumbnail                    | Preview                      | Colours                  |
+| ------------------------------------------------ | ---------------------------- | ---------------------------- | ------------------------ |
+| JPEG, sRGB ICC profile                           | sRGB                         | sRGB                         | correct                  |
+| HEIC from an iPhone, Display P3 ICC profile      | Display P3                   | Display P3                   | correct, wide gamut kept |
+| AVIF, no ICC profile, CICP (`nclx`) BT.2020 tags | sRGB (P3 for an iPhone shot) | sRGB (P3 for an iPhone shot) | 13–37% less saturated    |
+
+The last row is a loss in Immich, not in Folio. Immich ignores the CICP colour
+description of these AVIF files and labels the BT.2020 pixel values as sRGB (or
+Display P3) without converting them, so the browser shows them flatter than the
+original (mean chroma, compared with the decoded original). The files measured
+were AVIF exports, two of them confirmably from Lightroom. Exporting with an
+embedded ICC profile, or as JPEG or HEIC, should avoid it, since ICC-tagged
+originals came through correctly, but that has not been tested. Adobe RGB
+originals were not part of the measurement.
+
+After changing `image.colorspace` or replacing originals, regenerate thumbnails
+in Immich and bump `IMAGE_CACHE_VERSION`, since browsers and CDNs keep the old
+renditions as `immutable`.
diff --git a/docs/gallery-config.md b/docs/gallery-config.md
index f9f5dda..7bdc282 100644
--- a/docs/gallery-config.md
+++ b/docs/gallery-config.md
@@ -36,6 +36,7 @@ cp content/settings.yaml.example content/settings.yaml
 - [Navigation Links](#navigation-links)
 - [Client Proofing](#client-proofing)
 - [Client Proofing Links](#client-proofing-links)
+- [Photo Zoom](#photo-zoom)
 - [Image Protection & Watermark](#image-protection--watermark)
 - [SEO](#seo)
 - [Footer](#footer)
@@ -122,6 +123,7 @@ subpages:
 | `grid`      | object  | Grid override for the photos on this page — see [Grid Layout](#grid-layout)                      |
 | `coverGrid` | object  | Grid override for the album covers on this page — see [Album covers](#album-covers-on-a-subpage) |
 | `proofing`  | boolean | Enables [client proofing](#client-proofing) on this page                                         |
+| `zoom`      | boolean | [Photo zoom](#photo-zoom) for the albums on this page, over the site setting                     |
 | `essayFile` | string  | Render a Markdown essay instead of a grid — see [Journal & Photo Essays](journal.md)             |
 | `essayText` | string  | Essay Markdown inline; written by the admin block editor                                         |
 | `enabled`   | boolean | `false` takes the page offline without deleting it                                               |
@@ -218,6 +220,7 @@ albums:
 | `grid`          | **Experimental.** Grid override for this album only                           |
 | `coverPosition` | **Experimental.** Focal point for the cover crop                              |
 | `download`      | Offer originals for download — see [Originals download](#originals-download)  |
+| `zoom`          | [Photo zoom](#photo-zoom) for this album, over its page and the site setting  |
 
 ### Per-album grid (experimental)
 
@@ -270,6 +273,19 @@ so an edited URL cannot reach anything else. The ZIP keeps the original
 filenames (deduplicated on collision) and is streamed, so album size does not
 drive memory use.
 
+Originals keep their metadata except their location. JPEG, HEIC/HEIF and AVIF
+files are delivered with camera, lens, exposure, copyright/IPTC and colour
+profile intact, but with GPS coordinates removed from EXIF and XMP; the image
+data itself is not touched. Other formats (RAW, DNG, PNG, TIFF, WebP, video) are
+delivered exactly as Immich stores them, including any GPS. The diagnostics page
+warns when a download album contains such files.
+
+A photo edited in Immich's own editor (crop, rotate) is downloaded as edited,
+not as the camera file. Immich renders the edit as a full-resolution JPEG
+without EXIF, so that file has no camera data either, and its name gets a
+`.jpg` extension (`IMG_0001.HEIC` arrives as `IMG_0001.jpg`). It passes the
+same location scrubber.
+
 One visitor (by client IP, see `TRUSTED_PROXY_HOPS`) can have at most two ZIPs
 downloading at once, album and proofing downloads counted together; a third
 gets a "too many requests" page until one finishes. A ZIP whose download stops
@@ -323,13 +339,17 @@ for a login form would still have let the page produce its payload, album names
 and image tokens included. The public API routes carry the same check
 themselves, since route handlers do not pass through the proxy.
 
-Three things stay reachable on a locked site:
+These stay reachable on a locked site:
 
-| Path          | Why                                                                      |
-| ------------- | ------------------------------------------------------------------------ |
-| `/api/health` | A health probe runs without cookies; gating it takes the container down. |
-| `/admin`      | It has its own password, and it is where `sitePassword` is set.          |
-| `/install`    | A fresh deployment has to be configurable before it can be locked.       |
+| Path                       | Why                                                                                                                                   |
+| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| `/api/health`              | A health probe runs without cookies; gating it takes the container down.                                                              |
+| `/admin`                   | It has its own password, and it is where `sitePassword` is set.                                                                       |
+| `/install`                 | A fresh deployment has to be configurable before it can be locked.                                                                    |
+| `/impressum`, `/privacy`   | The password page is public and links them; a German Impressum must be reachable directly. Neither shows an album or the site's menu. |
+| `/contact`, `/api/contact` | The Impressum links the form as its second contact channel. Honeypot, fill-time check and rate limit apply as on an open site.        |
+
+A legal or contact page that is switched off is still a 404 on a locked site.
 
 A locked site also serves `noindex, nofollow` regardless of the SEO settings —
 there is nothing there for a crawler.
@@ -480,6 +500,7 @@ map: true # the interactive world map at /map
 transitions: true # smooth page transitions between routes
 scrollToTop: true # floating back-to-top arrow on long pages
 analytics: true # cookieless view counts, see below
+zoom: false # 1:1 zoom in the lightbox, see Photo Zoom
 
 about:
   enabled: true # the /about page, rendered from content/about.md
@@ -495,6 +516,7 @@ about:
 | `transitions`   | on      |                                             |
 | `scrollToTop`   | on      |                                             |
 | `analytics`     | on      |                                             |
+| `zoom`          | **off** | Opt-in, see [Photo Zoom](#photo-zoom)       |
 | `about.enabled` | on      | Needs a `content/about.md` to show anything |
 
 ### Colour mode
@@ -709,6 +731,103 @@ PROOFING_WEBHOOK_URL=https://discord.com/api/webhooks/…
   `Referer`.
 - A subpage slugged `proof` would be hidden behind this route.
 
+## Photo Zoom
+
+Visitors can zoom into a photo in the lightbox to full resolution — one image
+pixel per screen pixel, which is what judging sharpness takes. Off by default:
+it hands out the full-resolution file, so it is switched on deliberately.
+
+```yaml
+# settings.yaml — the site-wide default
+zoom: true
+```
+
+A subpage and an album can each override it, in either direction. The most
+specific setting wins: **album → subpage → site**. An album's `zoom:` belongs to
+the entry it is written on: an album listed on two pages can have zoom on one
+and off on the other, and each page keeps its own choice. Listed twice on the
+same page (in two sections), `false` wins.
+
+```yaml
+# gallery.yaml
+subpages:
+  - name: Clients
+    zoom: true # every album on this page, unless it says otherwise
+    albums:
+      - 'album-uuid':
+          zoom: false # not this one
+```
+
+In the admin panel the switch is under **Settings › General › Portfolio
+Features**, and the page and album drawers in the page builder have an
+_Inherit / On / Off_ choice.
+
+**Using it.** Double-click (or double-tap) zooms to 1:1 around the point
+clicked and back to fit; so does the magnifier button in the lightbox bar.
+Pinch, or Ctrl + scroll wheel / trackpad pinch, zooms continuously between fit
+and 1:1 — never further, since enlarging past 1:1 only interpolates pixels and
+makes good focus look soft. Drag (or one finger) pans; `+` / `-` step, `0` and
+`Esc` go back to fit (a second `Esc` closes the viewer). Swiping to the next
+photo is off while zoomed, and changing photos resets the zoom.
+
+**What is shown.** The full-resolution file is requested only when a visitor
+zooms — never on opening the viewer, and never for the neighbouring photos.
+Until it arrives the preview is shown enlarged, with a small spinner on the
+zoom button.
+
+| Original                           | Zoom shows                                     |
+| ---------------------------------- | ---------------------------------------------- |
+| JPEG, AVIF                         | The original, with its location removed        |
+| HEIC/HEIF, RAW/DNG, TIFF, JPEG XL… | Immich's full-size rendition, location removed |
+| PNG, WebP, GIF                     | Not zoomable — their metadata is not scrubbed  |
+| Edited in Immich (crop, rotate)    | Immich's edited full-size rendition            |
+| Video                              | Not zoomable                                   |
+
+Location is removed the same way as for [originals download](#originals-download):
+GPS coordinates and place names below city level are overwritten in place;
+camera data and colour profile stay. A file whose metadata cannot be read is
+refused rather than sent.
+
+Formats a browser cannot display need Immich's **full-size preview**
+(_Administration › Settings › Image Settings › Full-size image_, JPEG format).
+Immich generates it only while that setting is on, so turn it on and run the
+_Generate Thumbnails_ job for existing photos. Without it, those photos show
+the zoom button but answer "Full resolution is not available for this photo",
+and the viewer stays on the preview. Immich does not say whether a rendition
+exists until it is asked, so Folio cannot hide the button in advance.
+
+AVIF originals tagged only with a BT.2020 colour tag (typical of Lightroom AVIF
+exports) can look more saturated at 1:1 than in the preview: Immich's preview
+ignores that tag and comes out desaturated (#827), while the browser shows the
+original as tagged. The original is the accurate one.
+
+A photo edited in Immich's own editor zooms into the edit, never into its
+original: Immich keeps the edit apart from the file, so the original is the
+unedited photo and whatever a crop removed would come back at 1:1. Immich has
+a full-resolution rendition of every edit, whether or not full-size previews
+are switched on, so edited photos do not depend on that setting.
+
+On touch devices, photos above **50 megapixels** get no zoom control. Showing a
+photo at 1:1 means decoding all of it — 200 MB of memory at 50 MP, 240 MB for a
+60 MP frame — which phones and tablets do not reliably survive. With a mouse or
+trackpad there is no limit.
+
+Zoom is offered on album pages, including the album pages under a photo-essay
+subpage (`/<page>/<album>`). The essay itself, journal entries and client
+proofing links do not have it.
+
+The zoom route re-checks the album allowlist, every password gate on a route to
+the album, the zoom setting for that route, and that the photo is published and
+belongs to the album. Answers are `Cache-Control: private` (browser only, one
+hour, never a CDN), and each visitor can open 20 full-resolution files a minute.
+
+**Bandwidth.** Every zoom sends a full-resolution file from Immich through
+Folio to the visitor — commonly 5–25 MB per photo (a 60 MP JPEG is about
+20 MB). At the rate limit of 20 a minute, one visitor can pull several hundred
+megabytes a minute, and none of it is cached at a CDN. That is why zoom is off
+by default; on a metered or slow uplink, switch it on only for the pages that
+need it.
+
 ## Image Protection & Watermark
 
 ```yaml
@@ -915,6 +1034,7 @@ The endpoints where a high limit would be the wrong default are fixed and not co
 | `POST /api/admin/auth` | 5                  |
 | `POST /api/auth`       | 10                 |
 | `/api/install`         | 10                 |
+| `/api/zoom`            | 20                 |
 | `/api/og`              | 30                 |
 | `/api/install/albums`  | 30                 |
 | `/api/webhook`         | 60                 |
diff --git a/docs/theming.md b/docs/theming.md
index 8d658d4..72ea3e9 100644
--- a/docs/theming.md
+++ b/docs/theming.md
@@ -24,6 +24,11 @@ you get `studio-modern`, the default.
 | **classic**       | Gilded gallery, warm luxury    | 🟡 `#c49a3c` | Cinzel + Crimson Pro              | Minimal     | Passepartout | ✗     |
 | **noir**          | Darkroom analog, film noir     | 🟠 `#ff6b35` | Libre Baskerville + Source Sans 3 | Fullbleed   | Passepartout | ✓     |
 | **monograph**     | Typographic, book-like         | ⬛ `#333333` | Instrument Serif + Inter          | Typographic | None         | ✗     |
+| **kunsthalle**    | Grey gallery wall, wall labels | 🔵 `#1d545c` | Libre Franklin                    | Mosaic      | Shadow       | ✗     |
+| **ma**            | Japanese restraint, washi/sumi | 🔴 `#b0381f` | Cormorant + Hanken Grotesk        | Split       | None         | ✗     |
+| **cyanotype**     | Prussian blue, drawing sheet   | 🔵 `#1a4d88` | Jost + DM Mono                    | Split       | None         | ✗     |
+| **salon**         | Oxblood salon, fine fillet     | 🟤 `#7d1f2c` | Gloock + Work Sans                | Fullbleed   | None         | ✗     |
+| **birch**         | Nordic daylight, soft corners  | 🟢 `#2c5d44` | Albert Sans                       | Stacked     | None         | ✗     |
 
 **`studio-modern` is the default** if no theme is specified.
 
@@ -82,6 +87,16 @@ their accent, fonts and framing in both modes.
 
 **Monograph** — Type-first book design with no hero image. Features an 8rem serif title, numbered photo indices via CSS counters, slide-up EXIF captions, hairline dividers, and generous whitespace. Feels like an artist monograph.
 
+**Kunsthalle** — Photographs hung on a neutral grey gallery wall, the surround ISO 3664 viewing booths use because white pushes photos darker and black pushes them lighter: lighter than every dark preset, darker than every light one. Libre Franklin in all three slots like museum signage, sentence-case titles, a wall label under every photo (its number in the album, “No. 07”, then the photo's caption when `exif.caption` publishes one, then camera · lens), a tight hung shadow and 56px of wall between works. With `photoFrame: passepartout` the mat is a grey board toned to the wall, and the camera line stays printed on the mat. The mosaic hero is a wall of works with the exhibition title below it; petrol is kept for wayfinding (links and hover). Suits fine-art series, documentary and black and white. Pairs best with `layout: masonry`.
+
+**Ma** — Japanese restraint: negative space as the material. Warm washi-grey paper in light mode (not cream), sumi ink in dark, and a single vermilion accent shaped as a square hanko seal in the header, before the active link and the hero kicker. Cormorant Garamond 300 titles stand in for a Mincho, Hanken Grotesk 300 carries the text; the hero subtitle runs vertically (tategaki) on desktop, the split hero sits asymmetric with the photo inset in the paper, and album pages are offset to the right with 64px of air between photos. No EXIF in the grid, no hover transforms, slow fades. Suits landscape, film and black and white. Pairs best with `layout: masonry` and `columns: 2`; the washi look needs `mode: light`.
+
+**Cyanotype** — A Prussian-blue print: ink-blue night in dark mode, and in light mode every piece of text in Prussian ink on cool paper instead of black. Set like an architectural drawing sheet: Jost (geometric, Bauhaus line) for type, DM Mono 300 for EXIF and numbers, a ruled title block for the hero EXIF chip and the album metadata, registration marks on the photo corners on hover, and hero links and album covers indexed as sheets (A-01, A-02). Suits architecture, urban and night work, blue hour and interiors. Pairs best with `layout: uniform` and `aspectRatio: "3/2"`.
+
+**Salon** — The oxblood picture gallery of a 19th-century museum, done quietly: velvet-dark and plaster-rose walls, Gloock titles (never italic), Work Sans text, and a fine fillet line floating 6px outside every photo that brightens to the accent on hover. With `photoFrame: passepartout` the mat is an oxblood board in dark mode and plaster rose in light mode. The fullbleed hero uses a scrim tinted from the wall colour instead of black, with the title bottom left. A tinted surround changes how colour is judged: right for portrait, wedding and fashion work, wrong for colour-critical landscape work. Pairs best with `layout: showcase`.
+
+**Birch** — Scandinavian daylight: birch-white and pine-night over green-tinted greys, with pine and lichen as the only accent. Albert Sans throughout and no uppercase or letter-spacing anywhere in the interface, where every other preset uses tracked caps. Soft 6px corners on photos and covers, EXIF as a pill chip on hover, a stacked hero with the photo inset and sentence-case strip labels. Suits landscape, outdoor, hiking, travel and family work. Pairs best with `layout: justified` (experimental) or `masonry`.
+
 ## Custom Theme
 
 Start from any preset and override individual properties:
@@ -242,6 +257,8 @@ The album-cover grid on a subpage is sized by two CSS custom properties on
 The column count follows the configuration, the spacing belongs to the look.
 `monograph` sets 1px, `minimal` and `editorial` 2px, `studio-modern` 20px;
 `classic` and `noir` set nothing and get the 4px default from `globals.css`.
+Of the later presets, `kunsthalle` sets 40px, `ma` 48px, `cyanotype` 24px,
+`salon` 32px and `birch` 16px.
 A custom preset does the same:
 
 ```css
diff --git a/hooks/useSwipe.ts b/hooks/useSwipe.ts
index 60061f4..90bc29f 100644
--- a/hooks/useSwipe.ts
+++ b/hooks/useSwipe.ts
@@ -4,19 +4,54 @@ interface UseSwipeProps {
   onSwipeLeft: () => void;
   onSwipeRight: () => void;
   threshold?: number;
+  /**
+   * False while a swipe must not navigate — the lightbox while zoomed, where
+   * one finger pans the photo (#467). Read when the touch starts and when it
+   * ends, so a gesture that began zoomed never turns into a swipe.
+   */
+  enabled?: boolean;
 }
 
-export function useSwipe({ onSwipeLeft, onSwipeRight, threshold = 60 }: UseSwipeProps) {
+/**
+ * A one-finger horizontal swipe.
+ *
+ * Anything with a second finger is not a swipe: a pinch that drifts sideways
+ * used to be read as one and jump to the next photo, because only the first
+ * touch was ever looked at. Once a second finger lands, the whole touch
+ * sequence is ignored, up to the moment the last finger lifts.
+ */
+export function useSwipe({
+  onSwipeLeft,
+  onSwipeRight,
+  threshold = 60,
+  enabled = true,
+}: UseSwipeProps) {
   const touchStartX = useRef<number>(0);
   const touchStartY = useRef<number>(0);
+  /** The current touch sequence is out: multi-touch, or started while disabled. */
+  const ignored = useRef(false);
 
-  const handleTouchStart = useCallback((e: React.TouchEvent | TouchEvent) => {
-    touchStartX.current = e.touches[0].clientX;
-    touchStartY.current = e.touches[0].clientY;
-  }, []);
+  const handleTouchStart = useCallback(
+    (e: React.TouchEvent | TouchEvent) => {
+      if (e.touches.length > 1) {
+        ignored.current = true;
+        return;
+      }
+      ignored.current = !enabled;
+      touchStartX.current = e.touches[0].clientX;
+      touchStartY.current = e.touches[0].clientY;
+    },
+    [enabled],
+  );
 
   const handleTouchEnd = useCallback(
     (e: React.TouchEvent | TouchEvent) => {
+      // Fingers still down: the sequence is not over yet.
+      if (e.touches.length > 0) return;
+      const skip = ignored.current || !enabled;
+      ignored.current = false;
+      if (skip) return;
+
       const dx = e.changedTouches[0].clientX - touchStartX.current;
       const dy = e.changedTouches[0].clientY - touchStartY.current;
 
@@ -25,7 +60,7 @@ export function useSwipe({ onSwipeLeft, onSwipeRight, threshold = 60 }: UseSwipe
         else onSwipeLeft();
       }
     },
-    [onSwipeLeft, onSwipeRight, threshold],
+    [onSwipeLeft, onSwipeRight, threshold, enabled],
   );
 
   return { handleTouchStart, handleTouchEnd };
diff --git a/hooks/useZoom.ts b/hooks/useZoom.ts
new file mode 100644
index 0000000..68eaa4b
--- /dev/null
+++ b/hooks/useZoom.ts
@@ -0,0 +1,484 @@
+'use client';
+
+/**
+ * Gesture wiring for the lightbox zoom (#467). The geometry is in lib/zoom.ts;
+ * this hook measures the page, listens to the pointer, wheel and Safari
+ * gesture events on the photo, and keeps the view.
+ *
+ * Pointer events throughout, never native drag: AssetProtection cancels
+ * `dragstart` on every image when image dragging is disabled, which would
+ * leave a drag-based pan dead on exactly the sites that care most about their
+ * photos.
+ *
+ * The full-resolution file is asked for the first time the view leaves fit —
+ * never before, and never for a neighbour. Until it arrives the preview is
+ * shown scaled up, so a gesture answers at once; the file then takes its
+ * place in the same box under the same transform, so nothing moves.
+ */
+
+import { useCallback, useEffect, useRef, useState, type RefObject } from 'react';
+import {
+  FIT_VIEW,
+  canZoom,
+  clampView,
+  isZoomed,
+  maxZoomScale,
+  panBy,
+  pinchView,
+  stepView,
+  toggleView,
+  viewTransform,
+  zoomAround,
+  type FitBox,
+  type Point,
+  type Viewport,
+  type ZoomView,
+} from '@/lib/zoom';
+
+export type ZoomStatus = 'idle' | 'loading' | 'loaded' | 'failed';
+
+interface UseZoomOptions {
+  /** Identifies the photo on screen; a new one resets the zoom. */
+  photoKey: string;
+  /**
+   * Width in pixels of the full-resolution image, upright. Undefined when the
+   * photo cannot be zoomed, which switches every gesture off.
+   */
+  naturalWidth?: number;
+  /** The photo at fit size: measured for the geometry, and where gestures land. */
+  imageRef: RefObject<HTMLImageElement | null>;
+  /**
+   * The element that receives the gestures (the photo's container). An
+   * element rather than a ref: the lightbox renders nothing until it has
+   * mounted, so the listeners have to be attached when the element appears,
+   * not when the hook first runs.
+   */
+  surface: HTMLElement | null;
+}
+
+/** Two taps closer than this in time and space are a double-tap. */
+const DOUBLE_TAP_MS = 300;
+const DOUBLE_TAP_PX = 30;
+/** A pointer that moved further than this was a drag, not a tap. */
+const TAP_SLOP_PX = 10;
+/** The `+` / `-` step. */
+const KEY_STEP = 2;
+/** Wheel delta per e-fold of zoom; see onWheel. */
+const WHEEL_DIVISOR = 300;
+
+type Gesture =
+  | { kind: 'none' }
+  | { kind: 'pan'; pointerId: number; start: Point; startView: ZoomView }
+  | { kind: 'pinch'; startView: ZoomView; startMid: Point; startDistance: number };
+
+function prefersReducedMotion(): boolean {
+  return (
+    typeof window !== 'undefined' &&
+    !!window.matchMedia?.('(prefers-reduced-motion: reduce)').matches
+  );
+}
+
+export function useZoom({ photoKey, naturalWidth, imageRef, surface }: UseZoomOptions) {
+  const enabled = !!naturalWidth && naturalWidth > 0;
+
+  const [view, setViewState] = useState<ZoomView>(FIT_VIEW);
+  const [animate, setAnimate] = useState(false);
+  const [status, setStatus] = useState<ZoomStatus>('idle');
+
+  // A new photo starts at fit, with nothing requested. Adjusted while
+  // rendering rather than in an effect, so the new photo never renders once
+  // with the old one's transform.
+  const [shownKey, setShownKey] = useState(photoKey);
+  if (shownKey !== photoKey) {
+    setShownKey(photoKey);
+    setViewState(FIT_VIEW);
+    setAnimate(false);
+    setStatus('idle');
+  }
+
+  // The handlers below are attached once per photo and read the latest values
+  // from refs, so a pan does not re-subscribe on every frame.
+  const viewRef = useRef<ZoomView>(FIT_VIEW);
+  const naturalRef = useRef(naturalWidth ?? 0);
+  const statusRef = useRef<ZoomStatus>('idle');
+  useEffect(() => {
+    viewRef.current = view;
+    statusRef.current = status;
+  });
+  useEffect(() => {
+    naturalRef.current = naturalWidth ?? 0;
+  }, [photoKey, naturalWidth]);
+
+  /** The fit box, the viewport and the 1:1 scale, measured now. */
+  const measure = useCallback((): {
+    fit: FitBox;
+    viewport: Viewport;
+    maxScale: number;
+  } | null => {
+    const img = imageRef.current;
+    const parent = img?.parentElement;
+    if (!img || !parent || !img.offsetWidth || !img.offsetHeight) return null;
+    // Layout sizes, not getBoundingClientRect() of the image: that includes
+    // the zoom transform. The container is never transformed.
+    const rect = parent.getBoundingClientRect();
+    const fit = {
+      width: img.offsetWidth,
+      height: img.offsetHeight,
+      cx: rect.left + img.offsetLeft + img.offsetWidth / 2,
+      cy: rect.top + img.offsetTop + img.offsetHeight / 2,
+    };
+    const viewport = { width: window.innerWidth, height: window.innerHeight };
+    const maxScale = maxZoomScale(naturalRef.current, fit.width, window.devicePixelRatio || 1);
+    return { fit, viewport, maxScale };
+  }, [imageRef]);
+
+  /** Show a view. `animated` for discrete steps; gestures follow the finger. */
+  const apply = useCallback((next: ZoomView, animated: boolean) => {
+    viewRef.current = next;
+    setAnimate(animated && !prefersReducedMotion());
+    setViewState(next);
+    if (isZoomed(next) && statusRef.current === 'idle') {
+      statusRef.current = 'loading';
+      setStatus('loading');
+    }
+  }, []);
+
+  const usable = useCallback(() => {
+    if (!enabled || statusRef.current === 'failed') return null;
+    const m = measure();
+    return m && canZoom(m.maxScale) ? m : null;
+  }, [enabled, measure]);
+
+  /** Fit ↔ 1:1 around a point; around the photo's centre without one. */
+  const toggle = useCallback(
+    (point?: Point) => {
+      const m = usable();
+      if (!m) {
+        if (isZoomed(viewRef.current)) apply(FIT_VIEW, true);
+        return;
+      }
+      const at = point ?? { x: m.fit.cx, y: m.fit.cy };
+      apply(toggleView(viewRef.current, at, m.fit, m.viewport, m.maxScale), true);
+    },
+    [apply, usable],
+  );
+
+  const step = useCallback(
+    (factor: number) => {
+      const m = usable();
+      if (!m) return;
+      apply(stepView(viewRef.current, factor, m.fit, m.viewport, m.maxScale), true);
+    },
+    [apply, usable],
+  );
+
+  const zoomIn = useCallback(() => step(KEY_STEP), [step]);
+  const zoomOut = useCallback(() => step(1 / KEY_STEP), [step]);
+  const reset = useCallback(() => apply(FIT_VIEW, true), [apply]);
+
+  /** The full-resolution file arrived: correct 1:1 if the estimate was off. */
+  const onFullLoad = useCallback(
+    (img: HTMLImageElement) => {
+      const before = measure();
+      if (img.naturalWidth > 0) naturalRef.current = img.naturalWidth;
+      statusRef.current = 'loaded';
+      setStatus('loaded');
+      const after = measure();
+      if (!before || !after || before.maxScale === after.maxScale) return;
+      const current = viewRef.current;
+      // Someone who asked for 1:1 still gets 1:1 against the real size.
+      const atMax = Math.abs(current.scale - before.maxScale) < 1e-3;
+      const next = atMax
+        ? zoomAround(
+            current,
+            after.maxScale,
+            { x: after.viewport.width / 2, y: after.viewport.height / 2 },
+            after.fit,
+            after.viewport,
+            after.maxScale,
+          )
+        : clampView(current, after.fit, after.viewport, after.maxScale);
+      apply(next, false);
+    },
+    [apply, measure],
+  );
+
+  /** No full-resolution file (Immich has none, or the request failed). */
+  const onFullError = useCallback(() => {
+    statusRef.current = 'failed';
+    setStatus('failed');
+    apply(FIT_VIEW, false);
+  }, [apply]);
+
+  // A resized window changes the fit box under the view; starting over at fit
+  // is simpler and less surprising than re-deriving the pan.
+  useEffect(() => {
+    if (!enabled) return;
+    const onResize = () => {
+      if (isZoomed(viewRef.current)) apply(FIT_VIEW, false);
+    };
+    window.addEventListener('resize', onResize);
+    return () => window.removeEventListener('resize', onResize);
+  }, [enabled, apply]);
+
+  // ── Gestures ──────────────────────────────────────────────────────────────
+  useEffect(() => {
+    if (!enabled || !surface) return;
+
+    const pointers = new Map<number, Point>();
+    const downs = new Map<number, { t: number; x: number; y: number; moved: boolean }>();
+    let gesture: Gesture = { kind: 'none' };
+    /** Two fingers were down at some point of the current touch sequence. */
+    let multi = false;
+    let lastTap: { t: number; x: number; y: number } | null = null;
+    let lastPointerType = '';
+
+    const midAndDistance = () => {
+      const [a, b] = [...pointers.values()];
+      return {
+        mid: { x: (a.x + b.x) / 2, y: (a.y + b.y) / 2 },
+        distance: Math.hypot(a.x - b.x, a.y - b.y),
+      };
+    };
+
+    const startPan = (pointerId: number, at: Point) => {
+      gesture = { kind: 'pan', pointerId, start: at, startView: viewRef.current };
+    };
+
+    const onPointerDown = (e: PointerEvent) => {
+      lastPointerType = e.pointerType;
+      if (e.pointerType === 'mouse' && e.button !== 0) return;
+      if (statusRef.current === 'failed') return;
+      const at = { x: e.clientX, y: e.clientY };
+      pointers.set(e.pointerId, at);
+      downs.set(e.pointerId, { t: e.timeStamp, ...at, moved: false });
+      try {
+        surface.setPointerCapture(e.pointerId);
+      } catch {
+        // Synthetic events (tests) have no active pointer to capture.
+      }
+
+      if (pointers.size === 2) {
+        multi = true;
+        const { mid, distance } = midAndDistance();
+        gesture = {
+          kind: 'pinch',
+          startView: viewRef.current,
+          startMid: mid,
+          startDistance: distance,
+        };
+      } else if (pointers.size === 1 && isZoomed(viewRef.current)) {
+        startPan(e.pointerId, at);
+        // No text selection or image drag behind a mouse pan.
+        if (e.pointerType === 'mouse') e.preventDefault();
+      }
+    };
+
+    const onPointerMove = (e: PointerEvent) => {
+      if (!pointers.has(e.pointerId)) return;
+      const at = { x: e.clientX, y: e.clientY };
+      pointers.set(e.pointerId, at);
+      const down = downs.get(e.pointerId);
+      if (down && Math.hypot(at.x - down.x, at.y - down.y) > TAP_SLOP_PX) down.moved = true;
+
+      if (gesture.kind === 'pinch' && pointers.size >= 2) {
+        const m = measure();
+        if (!m || !canZoom(m.maxScale)) return;
+        const { mid, distance } = midAndDistance();
+        const g = gesture;
+        apply(
+          pinchView(
+            g.startView,
+            g.startMid,
+            g.startDistance,
+            mid,
+            distance,
+            m.fit,
+            m.viewport,
+            m.maxScale,
+          ),
+          false,
+        );
+      } else if (gesture.kind === 'pan' && gesture.pointerId === e.pointerId) {
+        const m = measure();
+        if (!m) return;
+        const g = gesture;
+        apply(
+          panBy(g.startView, at.x - g.start.x, at.y - g.start.y, m.fit, m.viewport, m.maxScale),
+          false,
+        );
+      }
+    };
+
+    const onPointerEnd = (e: PointerEvent) => {
+      if (!pointers.has(e.pointerId)) return;
+      const down = downs.get(e.pointerId);
+      pointers.delete(e.pointerId);
+      downs.delete(e.pointerId);
+
+      if (gesture.kind === 'pinch') {
+        if (pointers.size === 1 && isZoomed(viewRef.current)) {
+          const [[id, at]] = [...pointers.entries()];
+          startPan(id, at);
+        } else if (pointers.size < 2) {
+          gesture = { kind: 'none' };
+        }
+        // A pinch let go just above fit lands on fit.
+        if (pointers.size === 0 && !isZoomed(viewRef.current)) apply(FIT_VIEW, false);
+      } else if (gesture.kind === 'pan' && pointers.size === 0) {
+        gesture = { kind: 'none' };
+      }
+
+      const wasTap =
+        e.type === 'pointerup' &&
+        e.pointerType !== 'mouse' &&
+        !multi &&
+        down &&
+        !down.moved &&
+        e.timeStamp - down.t < DOUBLE_TAP_MS;
+      if (pointers.size === 0) multi = false;
+      if (!wasTap) return;
+
+      // Double-tap: a second tap close to the first, soon after it.
+      if (
+        lastTap &&
+        e.timeStamp - lastTap.t < DOUBLE_TAP_MS &&
+        Math.hypot(e.clientX - lastTap.x, e.clientY - lastTap.y) < DOUBLE_TAP_PX
+      ) {
+        lastTap = null;
+        toggle({ x: e.clientX, y: e.clientY });
+      } else {
+        lastTap = { t: e.timeStamp, x: e.clientX, y: e.clientY };
+      }
+    };
+
+    // Mouse only: touch has its own double-tap above, and some browsers also
+    // synthesise a dblclick from it, which would toggle straight back.
+    const onDoubleClick = (e: MouseEvent) => {
+      if (lastPointerType && lastPointerType !== 'mouse') return;
+      e.preventDefault();
+      toggle({ x: e.clientX, y: e.clientY });
+    };
+
+    // Ctrl+wheel is how Chrome, Firefox and Edge report a trackpad pinch (and
+    // what a mouse user presses to zoom); a plain wheel pans once zoomed.
+    const onWheel = (e: WheelEvent) => {
+      if (statusRef.current === 'failed') return;
+      const perLine = e.deltaMode === 1 ? 16 : e.deltaMode === 2 ? window.innerHeight : 1;
+      if (e.ctrlKey) {
+        const m = measure();
+        if (!m || !canZoom(m.maxScale)) return;
+        e.preventDefault();
+        // A trackpad pinch sends many small deltas, a mouse wheel one large
+        // one per notch (100 or more): about 1.4× a notch, never more than
+        // 2× per event, so a single notch cannot jump straight to 1:1.
+        const factor = Math.min(2, Math.max(0.5, Math.exp((-e.deltaY * perLine) / WHEEL_DIVISOR)));
+        const current = viewRef.current;
+        const next = zoomAround(
+          current,
+          current.scale * factor,
+          { x: e.clientX, y: e.clientY },
+          m.fit,
+          m.viewport,
+          m.maxScale,
+        );
+        apply(isZoomed(next) ? next : FIT_VIEW, false);
+      } else if (isZoomed(viewRef.current)) {
+        const m = measure();
+        if (!m) return;
+        e.preventDefault();
+        apply(
+          panBy(
+            viewRef.current,
+            -e.deltaX * perLine,
+            -e.deltaY * perLine,
+            m.fit,
+            m.viewport,
+            m.maxScale,
+          ),
+          false,
+        );
+      }
+    };
+
+    // Safari reports a trackpad pinch as gesture events, not as ctrl+wheel.
+    // On iOS the same events accompany a two-finger touch, which the pointer
+    // handlers already follow — so they are only used with no pointer down.
+    let gestureStart: ZoomView | null = null;
+    type SafariGesture = Event & { scale: number; clientX: number; clientY: number };
+    const onGestureStart = (e: Event) => {
+      if (pointers.size > 0 || statusRef.current === 'failed') return;
+      e.preventDefault();
+      gestureStart = viewRef.current;
+    };
+    const onGestureChange = (e: Event) => {
+      if (!gestureStart || pointers.size > 0) return;
+      e.preventDefault();
+      const g = e as SafariGesture;
+      const m = measure();
+      if (!m || !canZoom(m.maxScale)) return;
+      const next = zoomAround(
+        viewRef.current,
+        gestureStart.scale * g.scale,
+        { x: g.clientX, y: g.clientY },
+        m.fit,
+        m.viewport,
+        m.maxScale,
+      );
+      apply(isZoomed(next) ? next : FIT_VIEW, false);
+    };
+    const onGestureEnd = () => {
+      gestureStart = null;
+    };
+
+    surface.addEventListener('pointerdown', onPointerDown);
+    surface.addEventListener('pointermove', onPointerMove);
+    surface.addEventListener('pointerup', onPointerEnd);
+    surface.addEventListener('pointercancel', onPointerEnd);
+    surface.addEventListener('dblclick', onDoubleClick);
+    surface.addEventListener('wheel', onWheel, { passive: false });
+    surface.addEventListener('gesturestart', onGestureStart);
+    surface.addEventListener('gesturechange', onGestureChange);
+    surface.addEventListener('gestureend', onGestureEnd);
+    return () => {
+      surface.removeEventListener('pointerdown', onPointerDown);
+      surface.removeEventListener('pointermove', onPointerMove);
+      surface.removeEventListener('pointerup', onPointerEnd);
+      surface.removeEventListener('pointercancel', onPointerEnd);
+      surface.removeEventListener('dblclick', onDoubleClick);
+      surface.removeEventListener('wheel', onWheel);
+      surface.removeEventListener('gesturestart', onGestureStart);
+      surface.removeEventListener('gesturechange', onGestureChange);
+      surface.removeEventListener('gestureend', onGestureEnd);
+    };
+  }, [enabled, photoKey, surface, measure, apply, toggle]);
+
+  const zoomed = isZoomed(view);
+  /** The full-resolution image is in the page (requested, loading or shown). */
+  const requested = status !== 'idle';
+
+  return {
+    /** Gestures do something for this photo. */
+    enabled: enabled && status !== 'failed',
+    zoomed,
+    status,
+    requested,
+    /**
+     * Inline style for both images. Absent until zoom has been used on this
+     * photo, so the stylesheet's own entry animation is left alone.
+     */
+    imageStyle:
+      zoomed || requested
+        ? {
+            transform: viewTransform(view),
+            transition: animate ? 'transform 220ms cubic-bezier(0.2, 0.7, 0.3, 1)' : 'none',
+          }
+        : undefined,
+    toggle,
+    zoomIn,
+    zoomOut,
+    reset,
+    onFullLoad,
+    onFullError,
+  };
+}
diff --git a/lib/__tests__/accent-text.test.ts b/lib/__tests__/accent-text.test.ts
new file mode 100644
index 0000000..36d8bae
--- /dev/null
+++ b/lib/__tests__/accent-text.test.ts
@@ -0,0 +1,148 @@
+import { describe, it, expect } from 'vitest';
+import fs from 'fs';
+import path from 'path';
+import {
+  THEME_PRESETS,
+  resolveTheme,
+  accentForMode,
+  accentText,
+  contrastRatio,
+} from '../config/theme';
+
+/**
+ * Accent-coloured text (`--accent-text`), input borders and the draft badge
+ * are checked against every hex surface token of each preset and mode, read
+ * from app/tokens.css — the studio-modern red measured 3.66:1 as text on its
+ * own dark page, and the input hairlines 1.15–1.29:1.
+ */
+const root = process.cwd();
+const tokens = fs.readFileSync(path.join(root, 'app', 'tokens.css'), 'utf8');
+
+function block(selector: string): string {
+  const escaped = selector.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`(?:^|\\n)${escaped}\\s*\\{([^}]*)\\}`).exec(tokens)?.[1] ?? '';
+}
+
+function tokenIn(css: string, name: string): string | undefined {
+  return new RegExp(`${name}:\\s*(#[0-9a-fA-F]{3,6})\\b`).exec(css)?.[1];
+}
+
+type Mode = 'dark' | 'light';
+const SURFACES = ['--bg-primary', '--bg-secondary', '--bg-card', '--bg-card-hover'];
+
+/** A preset's own value for a token, falling back to the mode's defaults. */
+function token(preset: string, mode: Mode, name: string): string {
+  const own =
+    mode === 'dark'
+      ? tokenIn(block(`[data-preset='${preset}']`), name)
+      : tokenIn(block(`[data-preset='${preset}'][data-theme='light']`), name);
+  const fallback = tokenIn(block(mode === 'dark' ? ':root' : "[data-theme='light']"), name);
+  const value = own ?? fallback;
+  if (!value) throw new Error(`${name} missing for ${preset}/${mode}`);
+  return value;
+}
+
+const MODES: Mode[] = ['dark', 'light'];
+
+describe('accentText', () => {
+  for (const name of Object.keys(THEME_PRESETS)) {
+    for (const mode of MODES) {
+      it(`${name} (${mode}): accent text reaches 4.5:1 on every surface`, () => {
+        const text = accentText(accentForMode(resolveTheme(name), mode), mode);
+        for (const surface of SURFACES) {
+          expect(contrastRatio(text, token(name, mode, surface))!).toBeGreaterThanOrEqual(4.5);
+        }
+      });
+    }
+  }
+
+  it('lifts the studio-modern red on dark and darkens it on light', () => {
+    // #e60012 is 3.66:1 on #121212 — the reported failure.
+    expect(contrastRatio('#e60012', '#121212')!).toBeLessThan(4.5);
+    const dark = accentText('#e60012', 'dark');
+    const light = accentText('#e60012', 'light');
+    expect(dark).not.toBe('#e60012');
+    expect(light).not.toBe('#e60012');
+    expect(contrastRatio(dark, '#121212')!).toBeGreaterThanOrEqual(4.5);
+    expect(contrastRatio(light, '#fafaf8')!).toBeGreaterThanOrEqual(4.5);
+  });
+
+  it('keeps an accent that already passes', () => {
+    expect(accentText('#ffffff', 'dark')).toBe('#ffffff');
+    expect(accentText('#000000', 'light')).toBe('#000000');
+    expect(accentText('#c8c8c8', 'dark')).toBe('#c8c8c8');
+  });
+
+  it('reaches AA for any owner accent, including ones near the page colour', () => {
+    const samples = ['#000000', '#0a1f44', '#1d4ed8', '#ffea00', '#ffffff', '#808080', '#6366f1'];
+    for (const accent of samples) {
+      expect(contrastRatio(accentText(accent, 'dark'), '#262626')!).toBeGreaterThanOrEqual(4.5);
+      expect(contrastRatio(accentText(accent, 'light'), '#e8e8e3')!).toBeGreaterThanOrEqual(4.5);
+    }
+  });
+
+  it('widens short hex and passes non-hex through', () => {
+    expect(accentText('#fff', 'dark')).toBe('#ffffff');
+    expect(accentText('red', 'dark')).toBe('red');
+  });
+
+  it('matches the fallbacks written into tokens.css', () => {
+    expect(tokens).toContain(
+      `--accent-text: var(--accent-text-dark, ${accentText('#e60012', 'dark')})`,
+    );
+    expect(tokens).toContain(
+      `--accent-text: var(--accent-text-light, ${accentText('#c8000f', 'light')})`,
+    );
+  });
+});
+
+describe('public styles use the text token for accent-coloured text', () => {
+  const files = [
+    'app/globals.css',
+    'app/leaflet.css',
+    'app/journal/journal.css',
+    'app/contact/contact.css',
+    ...fs.readdirSync(path.join(root, 'app', 'themes')).map((f) => `app/themes/${f}`),
+    ...fs
+      .readdirSync(path.join(root, 'components'))
+      .filter((f) => f.endsWith('.module.css'))
+      .map((f) => `components/${f}`),
+  ];
+
+  for (const file of files) {
+    it(`${file} has no text coloured with the raw accent`, () => {
+      const css = fs.readFileSync(path.join(root, file), 'utf8');
+      expect(css).not.toMatch(/(^|[^-])color:\s*var\(--(sm-)?accent[,)]/m);
+    });
+  }
+});
+
+describe('mode tokens', () => {
+  it('declares a color-scheme per mode', () => {
+    expect(block(':root')).toMatch(/color-scheme:\s*dark/);
+    expect(block("[data-theme='light']")).toMatch(/color-scheme:\s*light/);
+  });
+
+  it('input borders reach 3:1 on the page surfaces (WCAG 1.4.11)', () => {
+    expect(block(':root')).toMatch(/--input-border:\s*var\(--text-muted\)/);
+    for (const name of Object.keys(THEME_PRESETS)) {
+      for (const mode of MODES) {
+        const border = token(name, mode, '--text-muted');
+        for (const surface of ['--bg-primary', '--bg-secondary']) {
+          expect(contrastRatio(border, token(name, mode, surface))!).toBeGreaterThanOrEqual(3);
+        }
+      }
+    }
+  });
+
+  it('the warning colour reads at 4.5:1 on every surface', () => {
+    for (const name of Object.keys(THEME_PRESETS)) {
+      for (const mode of MODES) {
+        const warning = token(name, mode, '--warning');
+        for (const surface of SURFACES) {
+          expect(contrastRatio(warning, token(name, mode, surface))!).toBeGreaterThanOrEqual(4.5);
+        }
+      }
+    }
+  });
+});
diff --git a/lib/__tests__/auth-zoom.test.ts b/lib/__tests__/auth-zoom.test.ts
new file mode 100644
index 0000000..1436501
--- /dev/null
+++ b/lib/__tests__/auth-zoom.test.ts
@@ -0,0 +1,139 @@
+import { describe, it, expect, vi } from 'vitest';
+
+/**
+ * isAlbumZoomReachable (#467): the zoom route's gate. A route to the album the
+ * visitor could have taken, with every password on it given, on which zoom
+ * resolves on — asked per route, not as two separate questions.
+ */
+
+const ID = (n: number) => `00000000-0000-0000-0000-00000000000${n}`;
+
+const config = vi.hoisted(() => ({
+  immich: { apiKey: 'k' },
+  authSecret: 'test-auth-secret-32-chars-long-min',
+  zoom: false,
+  standaloneAlbumZoom: {} as Record<string, boolean>,
+  standaloneAlbums: [] as string[],
+  albumPasswords: {} as Record<string, string>,
+  subpages: [] as Array<Record<string, unknown>>,
+}));
+
+vi.mock('@/lib/config', () => ({ getConfig: () => config }));
+
+import { authenticate, isAlbumZoomReachable } from '@/lib/auth';
+
+const none = () => undefined;
+
+async function cookieFor(key: string, password: string, type: 'subpage' | 'album' = 'subpage') {
+  const header = (await authenticate(key, password, type))!;
+  const [name, rest] = header.split('=');
+  const token = rest.split(';')[0];
+  return (asked: string) => (asked === name ? token : undefined);
+}
+
+function setup(partial: Partial<typeof config>) {
+  Object.assign(config, {
+    zoom: false,
+    standaloneAlbumZoom: {},
+    standaloneAlbums: [],
+    albumPasswords: {},
+    subpages: [],
+    ...partial,
+  });
+}
+
+describe('isAlbumZoomReachable', () => {
+  it('is off by default', () => {
+    setup({ standaloneAlbums: [ID(1)] });
+    expect(isAlbumZoomReachable(ID(1), none)).toBe(false);
+  });
+
+  it('follows the site setting for a standalone album', () => {
+    setup({ zoom: true, standaloneAlbums: [ID(1)] });
+    expect(isAlbumZoomReachable(ID(1), none)).toBe(true);
+  });
+
+  it('refuses an album that is not published anywhere', () => {
+    setup({ zoom: true });
+    expect(isAlbumZoomReachable(ID(1), none)).toBe(false);
+  });
+
+  it('lets an album switch it off against the site', () => {
+    setup({ zoom: true, standaloneAlbums: [ID(1)], standaloneAlbumZoom: { [ID(1)]: false } });
+    expect(isAlbumZoomReachable(ID(1), none)).toBe(false);
+  });
+
+  it('lets a subpage switch it on for its albums', () => {
+    setup({ subpages: [{ name: 'S', slug: 's', albumIds: [ID(1)], zoom: true }] });
+    expect(isAlbumZoomReachable(ID(1), none)).toBe(true);
+  });
+
+  it('serves a hidden (link-only) subpage like any other', () => {
+    setup({ subpages: [{ name: 'S', slug: 's', albumIds: [ID(1)], zoom: true, hidden: true }] });
+    expect(isAlbumZoomReachable(ID(1), none)).toBe(true);
+  });
+
+  it('refuses an album whose only subpage is offline', () => {
+    setup({
+      zoom: true,
+      subpages: [{ name: 'S', slug: 's', albumIds: [ID(1)], enabled: false }],
+    });
+    expect(isAlbumZoomReachable(ID(1), none)).toBe(false);
+  });
+
+  it('asks for the subpage password', async () => {
+    setup({
+      zoom: true,
+      subpages: [{ name: 'S', slug: 's', albumIds: [ID(1)], password: 'pw' }],
+    });
+    expect(isAlbumZoomReachable(ID(1), none)).toBe(false);
+    expect(isAlbumZoomReachable(ID(1), await cookieFor('s', 'pw'))).toBe(true);
+  });
+
+  it('asks for the album’s own password as well', async () => {
+    setup({ zoom: true, standaloneAlbums: [ID(1)], albumPasswords: { [ID(1)]: 'apw' } });
+    expect(isAlbumZoomReachable(ID(1), none)).toBe(false);
+    expect(isAlbumZoomReachable(ID(1), await cookieFor(ID(1), 'apw', 'album'))).toBe(true);
+  });
+
+  it('reads the album entry’s zoom on the route it is written on (review of #830)', async () => {
+    // Open page: album entry says off. Password page: album entry says on.
+    setup({
+      subpages: [
+        { name: 'Public', slug: 'public', albumIds: [ID(1)], albumZoom: { [ID(1)]: false } },
+        {
+          name: 'Client',
+          slug: 'client',
+          albumIds: [ID(1)],
+          password: 'pw',
+          albumZoom: { [ID(1)]: true },
+        },
+      ],
+    });
+    expect(isAlbumZoomReachable(ID(1), none)).toBe(false);
+    expect(isAlbumZoomReachable(ID(1), await cookieFor('client', 'pw'))).toBe(true);
+  });
+
+  it('answers for an essay subpage’s albums like for any other page', () => {
+    // Their album page, /<subpage>/<album>, offers zoom by the same rule.
+    setup({
+      subpages: [
+        { name: 'E', slug: 'e', albumIds: [ID(1)], zoom: true, grid: { layout: 'essay' } },
+      ],
+    });
+    expect(isAlbumZoomReachable(ID(1), none)).toBe(true);
+  });
+
+  it('does not combine an open route without zoom with a locked one that has it', async () => {
+    // Open subpage, zoom off; locked subpage, zoom on. A visitor who has only
+    // been through the open one gets no zoom.
+    setup({
+      subpages: [
+        { name: 'Open', slug: 'open', albumIds: [ID(1)], zoom: false },
+        { name: 'Locked', slug: 'locked', albumIds: [ID(1)], zoom: true, password: 'pw' },
+      ],
+    });
+    expect(isAlbumZoomReachable(ID(1), none)).toBe(false);
+    expect(isAlbumZoomReachable(ID(1), await cookieFor('locked', 'pw'))).toBe(true);
+  });
+});
diff --git a/lib/__tests__/docker-content.test.ts b/lib/__tests__/docker-content.test.ts
new file mode 100644
index 0000000..3af43f3
--- /dev/null
+++ b/lib/__tests__/docker-content.test.ts
@@ -0,0 +1,121 @@
+import { describe, it, expect } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * A Docker build from a checkout used to bake the checkout's content/ into the
+ * image: `COPY . .` took it into the build stage, the standalone trace copied
+ * it along, and the runner copied the whole directory. At runtime the mounted
+ * volume hides it, but the layers still hold gallery.yaml, install.json (the
+ * Immich API key), contact messages, proofing links and every backup — and
+ * `docker save` or a push hands them out.
+ *
+ * Three places keep it out now: .dockerignore, the builder dropping the traced
+ * copy, and the runner copying the templates by name. These tests pin all
+ * three; the matcher below follows Docker's .dockerignore rules (last match
+ * wins, `!` re-includes, a pattern that matches a directory covers everything
+ * below it).
+ */
+
+const ROOT = path.join(__dirname, '..', '..');
+const dockerignore = fs.readFileSync(path.join(ROOT, '.dockerignore'), 'utf8');
+const dockerfile = fs.readFileSync(path.join(ROOT, 'Dockerfile'), 'utf8');
+
+type Rule = { negate: boolean; re: RegExp };
+
+function toRegExp(pattern: string): RegExp {
+  let out = '';
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i];
+    if (c === '*' && pattern[i + 1] === '*') {
+      out += '.*';
+      i++;
+      if (pattern[i + 1] === '/') i++;
+    } else if (c === '*') out += '[^/]*';
+    else if (c === '?') out += '[^/]';
+    else out += c.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  }
+  return new RegExp(`^${out}$`);
+}
+
+const rules: Rule[] = dockerignore
+  .split('\n')
+  .map((line) => line.trim())
+  .filter((line) => line && !line.startsWith('#'))
+  .map((line) => {
+    const negate = line.startsWith('!');
+    const pattern = path.posix.normalize((negate ? line.slice(1) : line).replace(/^\/+/, ''));
+    return { negate, re: toRegExp(pattern.replace(/\/$/, '')) };
+  });
+
+/** Whether Docker leaves `file` out of the build context. */
+function ignored(file: string): boolean {
+  const parts = file.split('/');
+  const candidates = parts.map((_, i) => parts.slice(0, i + 1).join('/'));
+  let result = false;
+  for (const rule of rules) {
+    if (candidates.some((candidate) => rule.re.test(candidate))) result = !rule.negate;
+  }
+  return result;
+}
+
+/** The part of the Dockerfile after `FROM … AS <stage>`, up to the next FROM. */
+function stage(name: string): string {
+  const match = dockerfile.match(
+    new RegExp(`^FROM .* AS ${name}\\n([\\s\\S]*?)(?=^FROM |(?![\\s\\S]))`, 'm'),
+  );
+  return match?.[1] ?? '';
+}
+
+describe('content/ stays out of the Docker image', () => {
+  it.each([
+    'content/gallery.yaml',
+    'content/settings.yaml',
+    'content/about.md',
+    'content/privacy.md',
+    'content/install.json',
+    'content/.setup-token',
+    'content/proofing.json',
+    'content/analytics.json',
+    'content/favicon.svg',
+    'content/messages/1727640000000-abc.json',
+    'content/pages/prices.md',
+    'content/journal/iceland.md',
+    'content/essays/old.md',
+    'content/.backups/gallery.yaml.2026-09-29T10-00-00.bak',
+    'content/journal/.backups/iceland.md.bak',
+    'content/.fonts/inter.woff2',
+    'content/gallery.yaml.screenshot-bak',
+  ])('leaves %s out of the build context', (file) => {
+    expect(ignored(file)).toBe(true);
+  });
+
+  it('keeps every tracked template in the build context', () => {
+    const templates = [
+      ...fs.readdirSync(path.join(ROOT, 'content')).map((f) => `content/${f}`),
+      ...fs.readdirSync(path.join(ROOT, 'content', 'journal')).map((f) => `content/journal/${f}`),
+    ].filter((f) => f.endsWith('.example'));
+    expect(templates).toContain('content/gallery.yaml.example');
+    expect(templates.filter(ignored)).toEqual([]);
+  });
+
+  it('still sends the source the build needs', () => {
+    expect(ignored('app/layout.tsx')).toBe(false);
+    expect(ignored('lib/config/index.ts')).toBe(false);
+    expect(ignored('package.json')).toBe(false);
+  });
+
+  it('drops the traced copy of content/ from the standalone output', () => {
+    expect(stage('builder')).toMatch(/^RUN rm -rf \.next\/standalone\/content$/m);
+  });
+
+  it('copies only the templates into the runtime content/', () => {
+    const runner = stage('runner');
+    expect(runner).not.toBe('');
+    const contentCopies = runner.split('\n').filter((line) => /^COPY .*content/.test(line));
+    expect(contentCopies.length).toBeGreaterThan(0);
+    for (const line of contentCopies) {
+      expect(line).toMatch(/\/app\/content\/(journal\/)?\*\.example /);
+    }
+  });
+});
diff --git a/lib/__tests__/doctor.test.ts b/lib/__tests__/doctor.test.ts
index 5f51a75..62554a7 100644
--- a/lib/__tests__/doctor.test.ts
+++ b/lib/__tests__/doctor.test.ts
@@ -15,6 +15,8 @@ import {
   checkPrivacy,
   checkContentPages,
   checkSettingValues,
+  checkDownloadMetadata,
+  checkZoomRenditions,
   worstLevel,
 } from '../admin/doctor';
 
@@ -499,5 +501,83 @@ describe('checkSettingValues (QA A-14)', () => {
     expect(checkSettingValues([{ field: 'url' }]).settingsSection).toBe('seo');
     expect(checkSettingValues([{ field: 'grid.gap' }]).settingsSection).toBe('grid');
     expect(checkSettingValues([{ field: 'theme.accent' }]).settingsSection).toBe('theme');
+    expect(checkSettingValues([{ field: 'theme.radius' }]).settingsSection).toBe('theme');
+    expect(checkSettingValues([{ field: 'contact.retentionDays' }]).settingsSection).toBe('legal');
+    expect(checkSettingValues([{ field: 'navLinks.3.url' }]).settingsSection).toBe('footer');
+  });
+
+  it('counts the header links as one setting however many entries fail', () => {
+    const f = checkSettingValues([
+      { field: 'navLinks.0.label' },
+      { field: 'navLinks.0.url' },
+      { field: 'navLinks.2.url' },
+    ]);
+    expect(f.title).toBe('The header links setting is ignored');
+  });
+});
+
+describe('checkDownloadMetadata', () => {
+  const album = (id: string, uncleanable: number, uncleanableWithLocation = 0) => ({
+    id,
+    albumName: `Album ${id}`,
+    uncleanable,
+    uncleanableWithLocation,
+  });
+
+  it('says nothing while no album offers downloads', () => {
+    expect(checkDownloadMetadata([])).toBeNull();
+  });
+
+  it('is ok when every original can be cleaned', () => {
+    const f = checkDownloadMetadata([album('a', 0), album('b', 0)])!;
+    expect(f.level).toBe('ok');
+    expect(f.id).toBe('download-metadata');
+    expect(f.detail).toContain('2 download albums');
+  });
+
+  it('warns about originals served with all their metadata, and names the albums', () => {
+    const f = checkDownloadMetadata([album('a', 0), album('b', 3, 2), album('c', 1)])!;
+    expect(f.level).toBe('warn');
+    expect(f.title).toBe('4 downloadable originals keep all metadata');
+    expect(f.detail).toContain('GPS');
+    expect(f.detail).toContain('Immich has a location for 2 of them');
+    expect(f.detail).toContain('Album b (3)');
+    expect(f.albumIds).toEqual(['b', 'c']);
+  });
+
+  it('leaves out the location count when Immich knows none', () => {
+    const f = checkDownloadMetadata([album('a', 1)])!;
+    expect(f.title).toBe('1 downloadable original keeps all metadata');
+    expect(f.detail).not.toContain('Immich has a location');
+  });
+});
+
+describe('checkZoomRenditions (#467)', () => {
+  const album = (id: string, needRendition: number) => ({ id, albumName: id, needRendition });
+
+  it('says nothing while no zoom album needs a rendition, or nothing is known', () => {
+    expect(checkZoomRenditions([], 'missing')).toBeNull();
+    expect(checkZoomRenditions([album('a', 0)], 'missing')).toBeNull();
+    expect(checkZoomRenditions([album('a', 3)], null)).toBeNull();
+  });
+
+  it('is fine when Immich has JPEG renditions', () => {
+    expect(checkZoomRenditions([album('a', 3)], 'ok')?.level).toBe('ok');
+  });
+
+  it('warns, naming the albums, when Immich has none', () => {
+    const finding = checkZoomRenditions([album('a', 3), album('b', 0), album('c', 1)], 'missing')!;
+    expect(finding.level).toBe('warn');
+    expect(finding.title).toMatch(/^4 photos cannot be zoomed/);
+    expect(finding.detail).toContain('Full-size');
+    expect(finding.albumIds).toEqual(['a', 'c']);
+  });
+
+  it('warns about a WebP rendition, which the zoom route refuses (review of #830)', () => {
+    const finding = checkZoomRenditions([album('a', 2)], { contentType: 'image/webp' })!;
+    expect(finding.level).toBe('warn');
+    expect(finding.title).toMatch(/not JPEG/);
+    expect(finding.detail).toContain('image/webp');
+    expect(finding.detail).toMatch(/Format to JPEG/);
   });
 });
diff --git a/lib/__tests__/downloadName.test.ts b/lib/__tests__/downloadName.test.ts
index e688a38..2a236ce 100644
--- a/lib/__tests__/downloadName.test.ts
+++ b/lib/__tests__/downloadName.test.ts
@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { safeDownloadName, contentDisposition } from '@/lib/downloadName';
+import { safeDownloadName, contentDisposition, editedDownloadName } from '@/lib/downloadName';
 
 const LF = String.fromCharCode(10);
 const CRLF = String.fromCharCode(13, 10);
@@ -85,3 +85,27 @@ describe('contentDisposition', () => {
     expect(contentDisposition(undefined)).toContain('filename="photo"');
   });
 });
+
+describe('editedDownloadName (#831)', () => {
+  it('names an edited HEIC after the JPEG Immich renders from it', () => {
+    expect(editedDownloadName('IMG_9262.HEIC', 'image/jpeg')).toBe('IMG_9262.jpg');
+    expect(editedDownloadName('DSC_0001.NEF', 'image/jpeg; charset=binary')).toBe('DSC_0001.jpg');
+  });
+
+  it('keeps a name that already fits', () => {
+    expect(editedDownloadName('scan.jpeg', 'image/jpeg')).toBe('scan.jpeg');
+    expect(editedDownloadName('IMG_0001.JPG', 'image/jpeg')).toBe('IMG_0001.JPG');
+    expect(editedDownloadName('shot.avif', 'image/avif')).toBe('shot.avif');
+  });
+
+  it('adds an extension to a name without one', () => {
+    expect(editedDownloadName('scan', 'image/jpeg')).toBe('scan.jpg');
+    expect(editedDownloadName('.hidden', 'image/jpeg')).toBe('.hidden.jpg');
+  });
+
+  it('leaves the name alone for a type it does not know', () => {
+    expect(editedDownloadName('clip.mov', 'video/quicktime')).toBe('clip.mov');
+    expect(editedDownloadName('IMG_1.HEIC', null)).toBe('IMG_1.HEIC');
+    expect(editedDownloadName(undefined, 'image/jpeg')).toBeUndefined();
+  });
+});
diff --git a/lib/__tests__/exif-lens.test.ts b/lib/__tests__/exif-lens.test.ts
new file mode 100644
index 0000000..8f4a52b
--- /dev/null
+++ b/lib/__tests__/exif-lens.test.ts
@@ -0,0 +1,69 @@
+import { describe, it, expect } from 'vitest';
+import { formatLens } from '../exif';
+import { assetExifSummary } from '../urls';
+import type { ImmichAsset } from '../immich';
+
+/**
+ * Phones report the device as the lens, so the tile overlay and the lightbox
+ * strip read "IPHONE 14 PRO · IPHONE 14 PRO BACK TRIPLE CAMERA 6.86MM F/1.78".
+ */
+describe('formatLens', () => {
+  it('drops a camera model the lens repeats', () => {
+    expect(formatLens('iPhone 14 Pro back triple camera 6.86mm f/1.78', 'iPhone 14 Pro')).toBe(
+      'back triple camera 6.86mm f/1.78',
+    );
+    expect(formatLens('IPHONE 14 PRO back camera', 'iPhone 14 Pro')).toBe('back camera');
+  });
+
+  it('removes the model anywhere in the lens, as a whole phrase', () => {
+    expect(formatLens('Wide iPhone 14 Pro 24mm', 'iPhone 14 Pro')).toBe('Wide 24mm');
+  });
+
+  it('does not match inside another word', () => {
+    expect(formatLens('Pixel 7 Pro camera', 'Pixel 7 P')).toBe('Pixel 7 Pro camera');
+    expect(formatLens('XF23mmF1.4 R', 'X')).toBe('XF23mmF1.4 R');
+  });
+
+  it('leaves a separate lens alone', () => {
+    expect(formatLens('RF24-70mm F2.8 L IS USM', 'Canon EOS R6')).toBe('RF24-70mm F2.8 L IS USM');
+  });
+
+  it('empties a lens that is only the model', () => {
+    expect(formatLens('iPhone 14 Pro', 'iPhone 14 Pro')).toBe('');
+  });
+
+  it('keeps the lens when there is no camera to repeat', () => {
+    expect(formatLens('iPhone 14 Pro back camera', null)).toBe('iPhone 14 Pro back camera');
+    expect(formatLens(null, 'iPhone 14 Pro')).toBe('');
+  });
+
+  it('treats regex characters in the model literally', () => {
+    expect(formatLens('Model (X) lens', 'Model (X)')).toBe('lens');
+    expect(formatLens('Model X lens', 'Model (X)')).toBe('Model X lens');
+  });
+});
+
+describe('assetExifSummary', () => {
+  const asset = (exif: Record<string, unknown>) =>
+    ({ exifInfo: exif }) as unknown as Pick<ImmichAsset, 'exifInfo'>;
+
+  it('does not repeat the camera in the tile lens', () => {
+    const summary = assetExifSummary(
+      asset({
+        model: 'iPhone 14 Pro',
+        lensModel: 'iPhone 14 Pro back triple camera 6.86mm f/1.78',
+        focalLength: 6.86,
+      }),
+    );
+    expect(summary).toEqual({
+      camera: 'iPhone 14 Pro',
+      lens: 'back triple camera 6.86mm f/1.78',
+      focalLength: '6.86mm',
+    });
+  });
+
+  it('omits a lens that only names the camera', () => {
+    const summary = assetExifSummary(asset({ model: 'iPhone 14 Pro', lensModel: 'iPhone 14 Pro' }));
+    expect(summary).toEqual({ camera: 'iPhone 14 Pro', lens: undefined, focalLength: undefined });
+  });
+});
diff --git a/lib/__tests__/fixtures/location.ts b/lib/__tests__/fixtures/location.ts
new file mode 100644
index 0000000..bde5a5f
--- /dev/null
+++ b/lib/__tests__/fixtures/location.ts
@@ -0,0 +1,492 @@
+/**
+ * Builders for real-world-shaped metadata fixtures: TIFF/EXIF with a GPS IFD
+ * in either byte order, XMP packets, JPEGs and HEIF files. Shared by
+ * lib/__tests__/locationScrub.test.ts and the download route tests.
+ */
+
+export const cat = (...parts: Uint8Array[]) => {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let o = 0;
+  for (const p of parts) {
+    out.set(p, o);
+    o += p.length;
+  }
+  return out;
+};
+export const bytes = (...n: number[]) => new Uint8Array(n);
+export const ascii = (s: string) => new Uint8Array([...s].map((c) => c.charCodeAt(0)));
+export const utf8 = (s: string) => new TextEncoder().encode(s);
+export const be16 = (n: number) => bytes((n >> 8) & 0xff, n & 0xff);
+export const be32 = (n: number) =>
+  bytes((n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff);
+
+/** Index of `needle` in `hay`, or -1. */
+export function indexOf(hay: Uint8Array, needle: Uint8Array, from = 0): number {
+  outer: for (let i = from; i + needle.length <= hay.length; i++) {
+    for (let k = 0; k < needle.length; k++) if (hay[i + k] !== needle[k]) continue outer;
+    return i;
+  }
+  return -1;
+}
+export const contains = (hay: Uint8Array, needle: Uint8Array) => indexOf(hay, needle) >= 0;
+export const latin1 = (b: Uint8Array) => Buffer.from(b).toString('latin1');
+
+// ── TIFF ─────────────────────────────────────────────────────────────────────
+
+export const TYPE = { BYTE: 1, ASCII: 2, SHORT: 3, LONG: 4, RATIONAL: 5, UNDEFINED: 7 } as const;
+const TYPE_SIZE: Record<number, number> = { 1: 1, 2: 1, 3: 2, 4: 4, 5: 8, 7: 1 };
+
+export type TiffEntry =
+  | { tag: number; type: number; count: number; value: (le: boolean) => Uint8Array }
+  | { tag: number; ifd: string };
+
+export interface TiffIfd {
+  name: string;
+  entries: TiffEntry[];
+  next?: string;
+}
+
+const u16 = (le: boolean, n: number) => (le ? bytes(n & 0xff, (n >> 8) & 0xff) : be16(n));
+const u32 = (le: boolean, n: number) =>
+  le ? bytes(n & 0xff, (n >>> 8) & 0xff, (n >>> 16) & 0xff, (n >>> 24) & 0xff) : be32(n);
+
+export const asciiValue = (s: string) => ({
+  type: TYPE.ASCII,
+  count: s.length + 1,
+  value: () => ascii(`${s}\0`),
+});
+export const shortValue = (...n: number[]) => ({
+  type: TYPE.SHORT,
+  count: n.length,
+  value: (le: boolean) => cat(...n.map((v) => u16(le, v))),
+});
+export const byteValue = (...n: number[]) => ({
+  type: TYPE.BYTE,
+  count: n.length,
+  value: () => bytes(...n),
+});
+export const rationalValue = (...pairs: Array<[number, number]>) => ({
+  type: TYPE.RATIONAL,
+  count: pairs.length,
+  value: (le: boolean) => cat(...pairs.flatMap(([a, b]) => [u32(le, a), u32(le, b)])),
+});
+export const undefinedValue = (data: Uint8Array) => ({
+  type: TYPE.UNDEFINED,
+  count: data.length,
+  value: () => data,
+});
+
+/** Lay out IFDs after the header, out-of-line values after the IFDs. */
+export function buildTiff(le: boolean, ifds: TiffIfd[]): Uint8Array {
+  const offsets = new Map<string, number>();
+  let pos = 8;
+  for (const ifd of ifds) {
+    offsets.set(ifd.name, pos);
+    pos += 2 + ifd.entries.length * 12 + 4;
+  }
+  const data: Uint8Array[] = [];
+  let dataPos = pos;
+  const tables: Uint8Array[] = [];
+  for (const ifd of ifds) {
+    const parts: Uint8Array[] = [u16(le, ifd.entries.length)];
+    for (const e of ifd.entries) {
+      if ('ifd' in e) {
+        parts.push(u16(le, e.tag), u16(le, TYPE.LONG), u32(le, 1), u32(le, offsets.get(e.ifd)!));
+        continue;
+      }
+      const value = e.value(le);
+      expectLength(value.length, TYPE_SIZE[e.type] * e.count);
+      parts.push(u16(le, e.tag), u16(le, e.type), u32(le, e.count));
+      if (value.length <= 4) {
+        const inline = new Uint8Array(4);
+        inline.set(value);
+        parts.push(inline);
+      } else {
+        parts.push(u32(le, dataPos));
+        data.push(value);
+        dataPos += value.length;
+        if (value.length % 2) {
+          data.push(bytes(0));
+          dataPos++;
+        }
+      }
+    }
+    parts.push(u32(le, ifd.next ? offsets.get(ifd.next)! : 0));
+    tables.push(cat(...parts));
+  }
+  const header = le
+    ? cat(ascii('II'), bytes(42, 0), u32(le, 8))
+    : cat(ascii('MM'), bytes(0, 42), u32(le, 8));
+  return cat(header, ...tables, ...data);
+}
+
+function expectLength(actual: number, expected: number) {
+  if (actual !== expected)
+    throw new Error(`fixture value is ${actual} bytes, expected ${expected}`);
+}
+
+export const LAT = rationalValue([52, 1], [31, 1], [1234, 100]);
+export const LON = rationalValue([13, 1], [24, 1], [5678, 100]);
+export const ALT = rationalValue([3456, 100]);
+
+/** A camera EXIF block: IFD0, EXIF IFD, GPS IFD and an IFD1. */
+export function cameraTiff(le: boolean, opts: { withGps?: boolean; xmp?: Uint8Array } = {}) {
+  const withGps = opts.withGps ?? true;
+  const ifd0: TiffEntry[] = [
+    { tag: 0x010f, ...asciiValue('Canon') },
+    { tag: 0x0110, ...asciiValue('Canon EOS R5') },
+    { tag: 0x0112, ...shortValue(1) },
+  ];
+  if (opts.xmp) ifd0.push({ tag: 0x02bc, ...undefinedValue(opts.xmp) });
+  ifd0.push({ tag: 0x8298, ...asciiValue('(c) Jane Doe') });
+  ifd0.push({ tag: 0x8769, ifd: 'exif' });
+  if (withGps) ifd0.push({ tag: 0x8825, ifd: 'gps' });
+
+  const ifds: TiffIfd[] = [
+    { name: 'ifd0', entries: ifd0, next: 'ifd1' },
+    {
+      name: 'exif',
+      entries: [
+        { tag: 0x829a, ...rationalValue([1, 250]) },
+        { tag: 0x829d, ...rationalValue([28, 10]) },
+        { tag: 0x8827, ...shortValue(100) },
+        { tag: 0xa434, ...asciiValue('RF24-70mm F2.8 L IS USM') },
+      ],
+    },
+  ];
+  if (withGps) {
+    ifds.push({
+      name: 'gps',
+      entries: [
+        { tag: 0x0000, ...byteValue(2, 3, 0, 0) },
+        { tag: 0x0001, ...asciiValue('N') },
+        { tag: 0x0002, ...LAT },
+        { tag: 0x0003, ...asciiValue('E') },
+        { tag: 0x0004, ...LON },
+        { tag: 0x0005, ...byteValue(0) },
+        { tag: 0x0006, ...ALT },
+      ],
+    });
+  }
+  ifds.push({ name: 'ifd1', entries: [{ tag: 0x0103, ...shortValue(6) }] });
+  return buildTiff(le, ifds);
+}
+
+export interface ParsedEntry {
+  type: number;
+  count: number;
+  value: Uint8Array;
+}
+export interface ParsedTiff {
+  ifd0: Map<number, ParsedEntry>;
+  exif: Map<number, ParsedEntry> | null;
+  gps: Map<number, ParsedEntry> | null;
+  ifd1: Map<number, ParsedEntry> | null;
+}
+
+/** A small, strict TIFF reader standing in for exiftool. */
+export function parseTiff(t: Uint8Array): ParsedTiff {
+  const le = t[0] === 0x49;
+  const r16 = (o: number) => (le ? t[o] | (t[o + 1] << 8) : (t[o] << 8) | t[o + 1]);
+  const r32 = (o: number) =>
+    le
+      ? (t[o] | (t[o + 1] << 8) | (t[o + 2] << 16) | (t[o + 3] << 24)) >>> 0
+      : ((t[o] << 24) | (t[o + 1] << 16) | (t[o + 2] << 8) | t[o + 3]) >>> 0;
+  if (r16(2) !== 42) throw new Error('not TIFF');
+  const readIfd = (off: number) => {
+    const map = new Map<number, ParsedEntry>();
+    const count = r16(off);
+    if (off + 2 + count * 12 + 4 > t.length) throw new Error('IFD out of bounds');
+    let lastTag = -1;
+    for (let i = 0; i < count; i++) {
+      const e = off + 2 + i * 12;
+      const tag = r16(e);
+      if (tag <= lastTag) throw new Error('IFD entries out of order');
+      lastTag = tag;
+      const type = r16(e + 2);
+      const n = r32(e + 4);
+      const size = TYPE_SIZE[type] * n;
+      const at = size <= 4 ? e + 8 : r32(e + 8);
+      if (at + size > t.length) throw new Error('value out of bounds');
+      map.set(tag, { type, count: n, value: t.slice(at, at + size) });
+    }
+    return { map, next: r32(off + 2 + count * 12) };
+  };
+  const ifd0 = readIfd(r32(4));
+  const ptr = (m: Map<number, ParsedEntry>, tag: number) => {
+    const e = m.get(tag);
+    return e
+      ? (le
+          ? e.value[0] | (e.value[1] << 8) | (e.value[2] << 16) | (e.value[3] << 24)
+          : (e.value[0] << 24) | (e.value[1] << 16) | (e.value[2] << 8) | e.value[3]) >>> 0
+      : 0;
+  };
+  const exifOff = ptr(ifd0.map, 0x8769);
+  const gpsOff = ptr(ifd0.map, 0x8825);
+  return {
+    ifd0: ifd0.map,
+    exif: exifOff ? readIfd(exifOff).map : null,
+    gps: gpsOff ? readIfd(gpsOff).map : null,
+    ifd1: ifd0.next ? readIfd(ifd0.next).map : null,
+  };
+}
+
+export const asciiOf = (e: ParsedEntry | undefined) =>
+  e ? latin1(e.value).replace(/\0+$/, '') : undefined;
+
+// ── XMP ──────────────────────────────────────────────────────────────────────
+
+export const XMP_PACKET = `<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>
+<x:xmpmeta xmlns:x="adobe:ns:meta/">
+ <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
+  <rdf:Description rdf:about=""
+    xmlns:exif="http://ns.adobe.com/exif/1.0/"
+    xmlns:tiff="http://ns.adobe.com/tiff/1.0/"
+    xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/"
+    xmlns:dc="http://purl.org/dc/elements/1.1/"
+    xmlns:Iptc4xmpExt="http://iptc.org/std/Iptc4xmpExt/2008-02-29/"
+    xmlns:drone-dji="http://www.dji.com/drone-dji/1.0/"
+    tiff:Make="Canon"
+    exif:GPSLatitude="52,31.2057N"
+    exif:GPSLongitude='13,24.0946E'
+    drone-dji:GpsLatitude="52.520095"
+    photoshop:City="Berlin"
+    photoshop:Country="Germany">
+   <exif:GPSAltitude>3456/100</exif:GPSAltitude>
+   <exif:GPSAltitudeRef>0</exif:GPSAltitudeRef>
+   <exif:GPSTimeStamp>2024-05-01T10:00:00Z</exif:GPSTimeStamp>
+   <exif:GPSVersionID/>
+   <dc:rights><rdf:Alt><rdf:li xml:lang="x-default">© Jane Doe</rdf:li></rdf:Alt></dc:rights>
+   <Iptc4xmpExt:LocationCreated>
+    <rdf:Bag>
+     <rdf:li rdf:parseType="Resource">
+      <Iptc4xmpExt:City>Berlin</Iptc4xmpExt:City>
+      <Iptc4xmpExt:GPSLatitude>52.520095</Iptc4xmpExt:GPSLatitude>
+      <Iptc4xmpExt:GPSLongitude>13.401577</Iptc4xmpExt:GPSLongitude>
+     </rdf:li>
+    </rdf:Bag>
+   </Iptc4xmpExt:LocationCreated>
+  </rdf:Description>
+ </rdf:RDF>
+</x:xmpmeta>
+<?xpacket end="w"?>`;
+
+/** Strings from the packet above that must not survive. */
+export const XMP_LOCATION_VALUES = [
+  '52,31.2057N',
+  '13,24.0946E',
+  '52.520095',
+  '13.401577',
+  '3456/100',
+];
+
+// ── JPEG ─────────────────────────────────────────────────────────────────────
+
+/** JPEG segment: FFxx <length incl. itself> <payload>. */
+export const seg = (marker: number, payload: Uint8Array) =>
+  cat(bytes(0xff, marker), be16(payload.length + 2), payload);
+
+export const exifSegment = (tiff: Uint8Array) => seg(0xe1, cat(ascii('Exif\0\0'), tiff));
+export const xmpSegment = (packet: string) =>
+  seg(0xe1, cat(ascii('http://ns.adobe.com/xap/1.0/\0'), utf8(packet)));
+
+export const SOS = cat(bytes(0xff, 0xda), be16(8), bytes(1, 1, 0, 0, 0x3f, 0));
+/** Entropy-coded data with byte stuffing and a restart marker. */
+export const SCAN = bytes(0x12, 0xff, 0x00, 0x34, 0xff, 0xd0, 0x56, 0x78, 0xff, 0x00, 0x9a);
+export const EOI = bytes(0xff, 0xd9);
+
+export const ICC = cat(ascii('ICC_PROFILE\0'), bytes(1, 1), ascii('colour profile bytes'));
+export const JFIF = cat(ascii('JFIF\0'), bytes(1, 2, 0, 0, 1, 0, 1, 0, 0));
+
+/** Photoshop APP13 with an IPTC record and an EXIF resource. */
+export function photoshopSegment(exif: Uint8Array) {
+  const iptc = cat(bytes(0x1c, 0x02, 0x74), be16(18), ascii('Copyright Jane Doe'));
+  const resource = (id: number, data: Uint8Array) =>
+    cat(
+      ascii('8BIM'),
+      be16(id),
+      bytes(0, 0),
+      be32(data.length),
+      data,
+      data.length % 2 ? bytes(0) : bytes(),
+    );
+  return seg(0xed, cat(ascii('Photoshop 3.0\0'), resource(0x0404, iptc), resource(0x0422, exif)));
+}
+
+/** A JPEG as a camera or phone writes it, with a second image appended (MPF). */
+export function cameraJpeg(le: boolean) {
+  const primaryHead = cat(
+    bytes(0xff, 0xd8),
+    seg(0xe0, JFIF),
+    exifSegment(cameraTiff(le)),
+    xmpSegment(XMP_PACKET),
+    seg(
+      0xe1,
+      cat(
+        ascii('http://ns.adobe.com/xmp/extension/\0'),
+        ascii('GUID'),
+        ascii('exif:GPSLatitude="1"'),
+      ),
+    ),
+    seg(0xe2, ICC),
+    seg(
+      0xeb,
+      cat(
+        ascii('JP'),
+        bytes(0, 1),
+        be32(1),
+        be32(40),
+        ascii('jumbjumd'),
+        ascii('c2pa GPS 52.520095'),
+      ),
+    ),
+    photoshopSegment(cameraTiff(!le)),
+    seg(0xdb, bytes(0, ...new Array(64).fill(1))),
+  );
+  const primary = cat(primaryHead, SOS, SCAN, EOI);
+  const secondary = cat(bytes(0xff, 0xd8), exifSegment(cameraTiff(le)), SOS, SCAN, EOI);
+  return {
+    file: cat(primary, secondary),
+    primaryHeadLength: primaryHead.length,
+    primaryLength: primary.length,
+  };
+}
+
+/** Every APPn segment of the JPEG at `soi`, up to SOS. */
+export function jpegSegments(b: Uint8Array, soi = 0) {
+  const out: Array<{ marker: number; payload: Uint8Array; start: number }> = [];
+  let pos = soi + 2;
+  while (pos + 4 <= b.length && b[pos] === 0xff && b[pos + 1] !== 0xda) {
+    const len = (b[pos + 2] << 8) | b[pos + 3];
+    out.push({ marker: b[pos + 1], payload: b.slice(pos + 4, pos + 2 + len), start: pos + 4 });
+    pos += 2 + len;
+  }
+  return out;
+}
+
+/** The TIFF block of the first EXIF APP1 in the JPEG at `soi`. */
+export function exifOf(b: Uint8Array, soi = 0): Uint8Array | null {
+  const s = jpegSegments(b, soi).find(
+    (x) => x.marker === 0xe1 && latin1(x.payload.slice(0, 6)) === 'Exif\0\0',
+  );
+  return s ? s.payload.slice(6) : null;
+}
+
+// ── HEIF ─────────────────────────────────────────────────────────────────────
+
+export const box = (type: string, ...content: Uint8Array[]) => {
+  const body = cat(...content);
+  return cat(be32(body.length + 8), ascii(type), body);
+};
+
+const infe = (id: number, type: string, extra: Uint8Array = bytes(0)) =>
+  box('infe', bytes(2, 0, 0, 0), be16(id), be16(0), ascii(type), extra);
+
+export const IMAGE_DATA = ascii('HEVC-IMAGE-DATA-THAT-MUST-NOT-CHANGE');
+
+/**
+ * A HEIC with an image item, an `Exif` item and an XMP `mime` item. Item data
+ * goes to `mdat`, or for `idatExif` the EXIF goes into `idat` (method 1).
+ * `metaLast` puts `meta` after `mdat`; `c2pa` appends a manifest `uuid` box.
+ */
+export function cameraHeic(
+  opts: {
+    le?: boolean;
+    idatExif?: boolean;
+    metaLast?: boolean;
+    c2pa?: boolean;
+    exifPayload?: Uint8Array;
+  } = {},
+) {
+  const le = opts.le ?? false;
+  const exifItem = opts.exifPayload ?? cat(be32(6), ascii('Exif\0\0'), cameraTiff(le));
+  const xmpItem = utf8(XMP_PACKET);
+
+  const ftyp = box('ftyp', ascii('heic'), be32(0), ascii('mif1heic'));
+  const iinf = box(
+    'iinf',
+    bytes(0, 0, 0, 0),
+    be16(3),
+    infe(1, 'hvc1'),
+    infe(2, 'Exif'),
+    infe(3, 'mime', cat(bytes(0), ascii('application/rdf+xml\0'))),
+  );
+  // iloc v1: offset_size 4, length_size 4, base_offset_size 0, index_size 0.
+  const entry = (id: number, method: number, offset: number, length: number) =>
+    cat(be16(id), be16(method), be16(0), be16(1), be32(offset), be32(length));
+  const buildMeta = (o: { image: number; exif: number; xmp: number }) =>
+    box(
+      'meta',
+      bytes(0, 0, 0, 0),
+      box('hdlr', bytes(0, 0, 0, 0), be32(0), ascii('pict'), be32(0), be32(0), be32(0), bytes(0)),
+      iinf,
+      box(
+        'iloc',
+        bytes(1, 0, 0, 0),
+        bytes(0x44, 0x00),
+        be16(3),
+        entry(1, 0, o.image, IMAGE_DATA.length),
+        entry(2, opts.idatExif ? 1 : 0, o.exif, exifItem.length),
+        entry(3, 0, o.xmp, xmpItem.length),
+      ),
+      ...(opts.idatExif ? [box('idat', exifItem)] : []),
+    );
+
+  const mdatBody = opts.idatExif ? cat(IMAGE_DATA, xmpItem) : cat(IMAGE_DATA, exifItem, xmpItem);
+  const metaLength = buildMeta({ image: 0, exif: 0, xmp: 0 }).length;
+  const mdatStart = ftyp.length + (opts.metaLast ? 0 : metaLength) + 8;
+  const offsets = {
+    image: mdatStart,
+    exif: opts.idatExif ? 0 : mdatStart + IMAGE_DATA.length,
+    xmp: mdatStart + IMAGE_DATA.length + (opts.idatExif ? 0 : exifItem.length),
+  };
+  const meta = buildMeta(offsets);
+  const mdat = box('mdat', mdatBody);
+  const c2pa = opts.c2pa
+    ? box(
+        'uuid',
+        bytes(
+          0xd8,
+          0xfe,
+          0xc3,
+          0xd6,
+          0x1b,
+          0x0e,
+          0x48,
+          0x3c,
+          0x92,
+          0x97,
+          0x58,
+          0x28,
+          0x87,
+          0x7e,
+          0xc4,
+          0x81,
+        ),
+        ascii('c2pa manifest GPS 52.520095'),
+      )
+    : bytes();
+  const file = opts.metaLast ? cat(ftyp, mdat, meta, c2pa) : cat(ftyp, meta, mdat, c2pa);
+  return { file, imageAt: offsets.image };
+}
+
+/** The TIFF block of the EXIF item, read back by its known offset prefix. */
+export function heicExif(file: Uint8Array): Uint8Array | null {
+  const at = indexOf(file, cat(be32(6), ascii('Exif\0\0')));
+  return at < 0 ? null : file.slice(at + 10);
+}
+
+/** Feed `data` as a stream cut into `size`-byte chunks. */
+export function chunked(data: Uint8Array, size: number): ReadableStream<Uint8Array> {
+  let pos = 0;
+  return new ReadableStream<Uint8Array>({
+    pull(controller) {
+      if (pos >= data.length) {
+        controller.close();
+        return;
+      }
+      controller.enqueue(data.slice(pos, pos + size));
+      pos += size;
+    },
+  });
+}
diff --git a/lib/__tests__/immich.test.ts b/lib/__tests__/immich.test.ts
index 2f08792..56a2d6b 100644
--- a/lib/__tests__/immich.test.ts
+++ b/lib/__tests__/immich.test.ts
@@ -251,6 +251,84 @@ describe('ImmichClient', () => {
       await expect(immich.streamAsset('asset-1')).rejects.toBeInstanceOf(ImmichUnavailableError);
     });
 
+    // #467: Immich answers a missing full-size rendition with a redirect — to
+    // the preview, or to the original for a web format. Neither may be passed
+    // off as the rendition, so the redirect is not followed.
+    it('streamFullsize does not follow Immich’s redirect, and reports no rendition', async () => {
+      const cancel = vi.fn(async () => {});
+      mockFetch.mockResolvedValueOnce({
+        ok: false,
+        status: 302,
+        body: { cancel },
+        headers: { get: () => '/api/assets/asset-1/thumbnail?size=preview' },
+      });
+      await expect(immich.streamFullsize('asset-1')).resolves.toBeNull();
+      const [url, init] = mockFetch.mock.calls.at(-1)!;
+      expect(url).toMatch(/\/assets\/asset-1\/thumbnail\?size=fullsize$/);
+      expect(init.redirect).toBe('manual');
+      expect(cancel).toHaveBeenCalled();
+    });
+
+    it('streamFullsize streams a rendition Immich has', async () => {
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        body: new ReadableStream(),
+        headers: { get: (h: string) => (h === 'Content-Type' ? 'image/jpeg' : '42') },
+      });
+      const result = await immich.streamFullsize('asset-1');
+      expect(result?.contentType).toBe('image/jpeg');
+    });
+
+    // #831: Immich applies an edit made in its editor only when asked.
+    describe('edited photos (#831)', () => {
+      const ok = () => ({
+        ok: true,
+        status: 200,
+        body: new ReadableStream(),
+        headers: { get: () => 'image/jpeg' },
+      });
+      const lastUrl = () => mockFetch.mock.calls.at(-1)![0] as string;
+
+      it.each([
+        ['thumbnail', '/assets/asset-1/thumbnail?size=thumbnail&edited=true'],
+        ['preview', '/assets/asset-1/thumbnail?size=preview&edited=true'],
+        ['original', '/assets/asset-1/original?edited=true'],
+      ] as const)('asks for the edited %s', async (size, path) => {
+        mockFetch.mockResolvedValueOnce(ok());
+        await immich.streamAsset('asset-1', size, true);
+        expect(lastUrl()).toBe(`http://immich.test/api${path}`);
+      });
+
+      it.each([
+        ['thumbnail', '/assets/asset-1/thumbnail?size=thumbnail'],
+        ['preview', '/assets/asset-1/thumbnail?size=preview'],
+        ['original', '/assets/asset-1/original'],
+      ] as const)('requests a %s that is not edited exactly as before', async (size, path) => {
+        mockFetch.mockResolvedValueOnce(ok());
+        await immich.streamAsset('asset-1', size);
+        expect(lastUrl()).toBe(`http://immich.test/api${path}`);
+        mockFetch.mockResolvedValueOnce(ok());
+        await immich.streamAsset('asset-1', size, false);
+        expect(lastUrl()).toBe(`http://immich.test/api${path}`);
+      });
+
+      it('asks for the edited full-size rendition, still without following redirects', async () => {
+        mockFetch.mockResolvedValueOnce(ok());
+        await immich.streamFullsize('asset-1', true);
+        expect(lastUrl()).toBe(
+          'http://immich.test/api/assets/asset-1/thumbnail?size=fullsize&edited=true',
+        );
+        expect(mockFetch.mock.calls.at(-1)![1].redirect).toBe('manual');
+      });
+    });
+
+    it('streamAsset still follows redirects', async () => {
+      mockFetch.mockResolvedValueOnce(streamRes(404));
+      await immich.streamAsset('asset-1', 'original');
+      expect(mockFetch.mock.calls.at(-1)![1].redirect).toBe('follow');
+    });
+
     it('streamVideo returns null for a genuinely missing video', async () => {
       mockFetch.mockResolvedValueOnce(streamRes(404));
       await expect(immich.streamVideo('asset-1')).resolves.toBeNull();
diff --git a/lib/__tests__/journal-backup.test.ts b/lib/__tests__/journal-backup.test.ts
index dd61421..2deaaab 100644
--- a/lib/__tests__/journal-backup.test.ts
+++ b/lib/__tests__/journal-backup.test.ts
@@ -36,6 +36,39 @@ afterEach(async () => {
 
 const entry = (title: string) => `---\ntitle: "${title}"\n---\n\nBody of ${title}\n`;
 
+describe('saveJournalEntry (QA A-19)', () => {
+  it('takes no backup for a save that changes nothing', async () => {
+    await service.writeJournalEntry('trip', entry('v0'));
+    await service.writeJournalEntry('trip', entry('v1'));
+    expect(await readdir(backupDir)).toHaveLength(1);
+    await service.writeJournalEntry('trip', entry('v1'));
+    expect(await readdir(backupDir)).toHaveLength(1);
+  });
+
+  it("keeps a renamed entry's history under its new slug, not as a deleted entry", async () => {
+    await writeFile(path.join(journalDir, 'trip.md'), entry('Trip'));
+    await service.saveJournalEntry('journey', entry('Journey'), { fromSlug: 'trip' });
+
+    const files = await readdir(journalDir);
+    expect(files).toContain('journey.md');
+    expect(files).not.toContain('trip.md');
+    const backups = await service.listJournalBackups();
+    expect(backups).toEqual([expect.objectContaining({ slug: 'journey', kind: 'save' })]);
+    await expect(readFile(path.join(backupDir, backups[0].filename), 'utf8')).resolves.toBe(
+      entry('Trip'),
+    );
+  });
+
+  it('retires a legacy copy of the renamed entry too', async () => {
+    await mkdir(essaysDir, { recursive: true });
+    await writeFile(path.join(essaysDir, 'trip.md'), entry('Trip'));
+    await service.saveJournalEntry('journey', entry('Journey'), { fromSlug: 'trip' });
+
+    await expect(readdir(essaysDir)).resolves.not.toContain('trip.md');
+    expect((await service.listJournalBackups()).map((b) => b.slug)).toEqual(['journey']);
+  });
+});
+
 describe('deleteJournalEntry', () => {
   it('keeps a .deleted.bak copy before removing the file', async () => {
     await writeFile(path.join(journalDir, 'trip.md'), entry('Trip'));
diff --git a/lib/__tests__/journal-text-escape.test.ts b/lib/__tests__/journal-text-escape.test.ts
new file mode 100644
index 0000000..80616a0
--- /dev/null
+++ b/lib/__tests__/journal-text-escape.test.ts
@@ -0,0 +1,58 @@
+import { describe, it, expect } from 'vitest';
+import {
+  parseJournalMarkdown,
+  serializeJournalMarkdown,
+  type JournalBlock,
+  type ParsedJournal,
+} from '../journal';
+
+const journal = (blocks: JournalBlock[]): ParsedJournal => ({
+  frontmatter: { title: 'T' },
+  blocks,
+  referencedAssetIds: [],
+});
+
+const roundTrip = (blocks: JournalBlock[]) =>
+  parseJournalMarkdown(serializeJournalMarkdown(journal(blocks))).blocks;
+
+/**
+ * A text block whose markdown began with `![` was written verbatim and came
+ * back from the next load as a photo block — its text gone, a broken photo in
+ * its place. The serializer now escapes such a line and the parser takes the
+ * escape off again.
+ */
+describe('text blocks that start like a photo', () => {
+  it('stay text across a save and a reload', () => {
+    const blocks = roundTrip([{ type: 'paragraph', html: '![draft] placeholder' }]);
+    expect(blocks).toEqual([{ type: 'paragraph', html: '![draft] placeholder' }]);
+  });
+
+  it('survive a second round trip unchanged', () => {
+    const once = roundTrip([{ type: 'paragraph', html: '![todo] <em>pick</em> a photo' }]);
+    expect(once).toEqual([{ type: 'paragraph', html: '![todo] <em>pick</em> a photo' }]);
+    expect(roundTrip(once)).toEqual(once);
+  });
+
+  it('keep a backslash that was really typed in front', () => {
+    const blocks = roundTrip([{ type: 'paragraph', html: '\\![not escaped] by accident' }]);
+    expect(blocks).toEqual([{ type: 'paragraph', html: '\\![not escaped] by accident' }]);
+  });
+
+  it('writes the escape into the file, and leaves real photos alone', () => {
+    const md = serializeJournalMarkdown(
+      journal([
+        { type: 'paragraph', html: '![draft]' },
+        { type: 'photo', assetId: 'abc', layout: 'wide' },
+      ]),
+    );
+    expect(md).toContain('\\![draft]');
+    expect(md).toContain('![abc:wide]()');
+    expect(parseJournalMarkdown(md).blocks.map((b) => b.type)).toEqual(['paragraph', 'photo']);
+  });
+
+  it('does not touch `![` in the middle of a paragraph', () => {
+    const md = serializeJournalMarkdown(journal([{ type: 'paragraph', html: 'see ![x]' }]));
+    expect(md).toContain('see ![x]');
+    expect(md).not.toContain('\\!');
+  });
+});
diff --git a/lib/__tests__/journalDate.test.ts b/lib/__tests__/journalDate.test.ts
index 838d0ec..b60609e 100644
--- a/lib/__tests__/journalDate.test.ts
+++ b/lib/__tests__/journalDate.test.ts
@@ -1,5 +1,5 @@
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-import { formatJournalDate } from '../journalDate';
+import { formatJournalDate, journalDateTime } from '../journalDate';
 
 /**
  * The /journal index formatted `new Date(frontmatter.date)` in the server's
@@ -49,3 +49,22 @@ describe('formatJournalDate', () => {
     expect(formatJournalDate('   ', 'en-US')).toBeNull();
   });
 });
+
+/** The `datetime` of the `<time>` the index and the entry header render (P-21). */
+describe('journalDateTime', () => {
+  it('gives the calendar day, without the time a value may carry', () => {
+    expect(journalDateTime('2026-03-15')).toBe('2026-03-15');
+    expect(journalDateTime(' 2026-03-15T23:30:00+01:00 ')).toBe('2026-03-15');
+  });
+
+  it('gives a year-month value as a month', () => {
+    expect(journalDateTime('2026-03')).toBe('2026-03');
+  });
+
+  it.each(['15.03.2026', 'Spring 2026', '2026-02-30', '2026-13', '', undefined])(
+    'has no machine-readable form for %s',
+    (raw) => {
+      expect(journalDateTime(raw)).toBeNull();
+    },
+  );
+});
diff --git a/lib/__tests__/justified-row.test.ts b/lib/__tests__/justified-row.test.ts
new file mode 100644
index 0000000..7070f0c
--- /dev/null
+++ b/lib/__tests__/justified-row.test.ts
@@ -0,0 +1,93 @@
+import { describe, it, expect } from 'vitest';
+import { justifiedTileStyle, JUSTIFIED_FALLBACK_RATIO } from '../justifiedRow';
+
+/**
+ * Evaluates a flex-basis calc() the way the browser would, with the custom
+ * properties a frame sets (or their fallbacks when it sets none).
+ */
+function basisPx(basis: string, vars: Record<string, number>): number {
+  const expr = basis
+    .replace(/var\(--([\w-]+),\s*([\d.]+)px\)/g, (_, name: string, fallback: string) =>
+      String(vars[name] ?? Number(fallback)),
+    )
+    .replace(/^calc/, '');
+  expect(expr).toMatch(/^[\d.\s()*+-]+$/);
+  return Function(`return ${expr}`)() as number;
+}
+
+/**
+ * Lays out one row the way `flex-wrap` does for a row that fits: every tile
+ * starts at its basis and the leftover width is shared by flex-grow.
+ */
+function layoutRow(ratios: number[], rowWidth: number, vars: Record<string, number>) {
+  const tiles = ratios.map((r) => justifiedTileStyle(r));
+  const bases = tiles.map((t) => basisPx(t.flexBasis, vars));
+  const free = rowWidth - bases.reduce((a, b) => a + b, 0);
+  const grow = tiles.reduce((a, t) => a + t.flexGrow, 0);
+  const rowHeight = vars['grid-row-height'] ?? 300;
+  return tiles.map((t, i) => {
+    const width = bases[i] + (free * t.flexGrow) / grow;
+    // The photo inside the tile, once the mat around it is taken off.
+    const photoW = width - (vars['photo-mat-x'] ?? 0);
+    const photoH = rowHeight - (vars['photo-mat-y'] ?? 0);
+    return { width, photoW, photoH };
+  });
+}
+
+describe('justifiedTileStyle', () => {
+  it('grows by the aspect ratio', () => {
+    expect(justifiedTileStyle(0.75).flexGrow).toBe(0.75);
+  });
+
+  it('falls back to ~3:2 for assets without dimensions', () => {
+    for (const ar of [undefined, 0, -1, NaN, Infinity]) {
+      expect(justifiedTileStyle(ar).flexGrow).toBe(JUSTIFIED_FALLBACK_RATIO);
+    }
+  });
+
+  it('is unchanged without a frame: row height times the ratio', () => {
+    const basis = justifiedTileStyle(1.5).flexBasis;
+    expect(basisPx(basis, {})).toBe(450);
+    expect(basisPx(basis, { 'grid-row-height': 240 })).toBe(360);
+  });
+
+  it('sizes the photo inside a passepartout mat, not the whole tile', () => {
+    // 8px mat, 32px caption band, 1px border: 18px across, 42px down.
+    const vars = { 'grid-row-height': 300, 'photo-mat-x': 18, 'photo-mat-y': 42 };
+    const basis = basisPx(justifiedTileStyle(1.5).flexBasis, vars);
+    expect(basis).toBe((300 - 42) * 1.5 + 18);
+  });
+
+  it('keeps every photo in a filled row at its own aspect ratio, scaled alike', () => {
+    const vars = { 'grid-row-height': 300, 'photo-mat-x': 18, 'photo-mat-y': 42 };
+    const ratios = [1.5, 0.6667, 1.7778];
+    // A row with no leftover width: every photo shows at exactly its ratio.
+    const exact = ratios.reduce((a, r) => a + (300 - 42) * r + 18, 0);
+    for (const tile of layoutRow(ratios, exact, vars).map(
+      (t, i) => t.photoW / t.photoH / ratios[i],
+    )) {
+      expect(tile).toBeCloseTo(1, 10);
+    }
+    // A row with leftover width: every photo widens by the same factor, so a
+    // portrait is not cropped harder than the landscapes beside it.
+    const stretched = layoutRow(ratios, exact + 120, vars).map(
+      (t, i) => t.photoW / t.photoH / ratios[i],
+    );
+    for (const s of stretched) expect(s).toBeCloseTo(stretched[0], 10);
+  });
+
+  it('would crop unevenly if the tile, mat included, were sized from the row height', () => {
+    // Regression guard for the formula itself: the old basis (row height ×
+    // ratio, no mat terms) gives photos in the same row different stretch.
+    const vars = { 'grid-row-height': 300, 'photo-mat-x': 18, 'photo-mat-y': 42 };
+    const ratios = [1.5, 0.6667];
+    const oldBases = ratios.map((r) => 300 * r);
+    const rowWidth = oldBases.reduce((a, b) => a + b, 0);
+    const oldStretch = oldBases.map((w, i) => (w - 18) / (300 - 42) / ratios[i]);
+    expect(Math.abs(oldStretch[0] - oldStretch[1])).toBeGreaterThan(0.05);
+    const nowStretch = layoutRow(ratios, rowWidth, vars).map(
+      (t, i) => t.photoW / t.photoH / ratios[i],
+    );
+    expect(nowStretch[0]).toBeCloseTo(nowStretch[1], 10);
+  });
+});
diff --git a/lib/__tests__/lightboxShortcuts.test.ts b/lib/__tests__/lightboxShortcuts.test.ts
index e1e4985..116a1f5 100644
--- a/lib/__tests__/lightboxShortcuts.test.ts
+++ b/lib/__tests__/lightboxShortcuts.test.ts
@@ -93,6 +93,13 @@ describe('lightboxActionFor', () => {
     expect(lightboxActionFor('H')).toBe('shortcutList');
   });
 
+  it('zooms with + (or = without Shift), - and 0 (#467)', () => {
+    expect(lightboxActionFor('+')).toBe('zoomIn');
+    expect(lightboxActionFor('=')).toBe('zoomIn');
+    expect(lightboxActionFor('-')).toBe('zoomOut');
+    expect(lightboxActionFor('0')).toBe('zoomReset');
+  });
+
   it('takes both cases of every letter key, since Shift must not matter', () => {
     for (const [lower, upper] of [
       ['i', 'I'],
diff --git a/lib/__tests__/locationScrub.test.ts b/lib/__tests__/locationScrub.test.ts
new file mode 100644
index 0000000..40cb78c
--- /dev/null
+++ b/lib/__tests__/locationScrub.test.ts
@@ -0,0 +1,612 @@
+import { describe, it, expect } from 'vitest';
+import {
+  scrubLocation,
+  scrubLocationStream,
+  scrubTiffGps,
+  scrubXmpLocation,
+  isLocationScrubbable,
+  Pending,
+  HEAD_CAP,
+} from '../locationScrub';
+import {
+  ALT,
+  ICC,
+  JFIF,
+  LAT,
+  LON,
+  SCAN,
+  XMP_LOCATION_VALUES,
+  XMP_PACKET,
+  ascii,
+  asciiOf,
+  be32,
+  bytes,
+  cameraHeic,
+  cameraJpeg,
+  cameraTiff,
+  cat,
+  chunked,
+  contains,
+  exifOf,
+  exifSegment,
+  heicExif,
+  indexOf,
+  jpegSegments,
+  latin1,
+  parseTiff,
+  seg,
+  SOS,
+  EOI,
+  utf8,
+  xmpSegment,
+  be16,
+} from './fixtures/location';
+
+const LAT_BYTES = (le: boolean) => LAT.value(le);
+const LON_BYTES = (le: boolean) => LON.value(le);
+const ALT_BYTES = (le: boolean) => ALT.value(le);
+
+/** Run the stream scrubber over `data`, delivered in `size`-byte chunks. */
+async function viaStream(data: Uint8Array, size: number): Promise<Uint8Array | null> {
+  const result = await scrubLocationStream(chunked(data, size));
+  if (!result.ok) return null;
+  return new Uint8Array(await new Response(result.stream).arrayBuffer());
+}
+
+/** Camera data that must come through untouched. */
+function expectCameraData(tiff: Uint8Array) {
+  const t = parseTiff(tiff);
+  expect(asciiOf(t.ifd0.get(0x010f))).toBe('Canon');
+  expect(asciiOf(t.ifd0.get(0x0110))).toBe('Canon EOS R5');
+  expect(asciiOf(t.ifd0.get(0x8298))).toBe('(c) Jane Doe');
+  expect(asciiOf(t.exif?.get(0xa434))).toBe('RF24-70mm F2.8 L IS USM');
+  expect(t.exif?.get(0x8827)).toBeDefined();
+  expect(t.ifd1?.get(0x0103)).toBeDefined(); // IFD1 still chained
+  return t;
+}
+
+function expectNoGps(tiff: Uint8Array, le: boolean) {
+  const t = parseTiff(tiff);
+  expect(t.ifd0.has(0x8825)).toBe(false);
+  expect(t.exif?.has(0x8825)).toBe(false);
+  expect(t.gps).toBeNull();
+  expect(contains(tiff, LAT_BYTES(le))).toBe(false);
+  expect(contains(tiff, LON_BYTES(le))).toBe(false);
+  expect(contains(tiff, ALT_BYTES(le))).toBe(false);
+}
+
+function expectXmpScrubbed(text: string) {
+  expect(text).not.toMatch(/:GPS|:Gps/);
+  for (const v of XMP_LOCATION_VALUES) expect(text).not.toContain(v);
+  expect(text).toContain('photoshop:City="Berlin"');
+  expect(text).toContain('photoshop:Country="Germany"');
+  expect(text).toContain('<Iptc4xmpExt:City>Berlin</Iptc4xmpExt:City>');
+  expect(text).toContain('© Jane Doe');
+  expect(text).toContain('tiff:Make="Canon"');
+}
+
+describe('scrubTiffGps', () => {
+  for (const le of [true, false]) {
+    const order = le ? 'little-endian (II)' : 'big-endian (MM)';
+
+    it(`removes the GPS IFD and keeps the camera tags, ${order}`, () => {
+      const tiff = cameraTiff(le);
+      const before = parseTiff(tiff);
+      expect(before.gps?.get(0x0002)).toBeDefined(); // the fixture really has GPS
+
+      const out = tiff.slice();
+      expect(scrubTiffGps(out, 0, out.length)).toBe(true);
+      expect(out.length).toBe(tiff.length);
+      expectNoGps(out, le);
+      const after = expectCameraData(out);
+      // Values are byte-identical, not just present.
+      for (const tag of [0x010f, 0x0110, 0x0112, 0x8298]) {
+        expect(after.ifd0.get(tag)).toEqual(before.ifd0.get(tag));
+      }
+      expect(after.exif).toEqual(before.exif);
+    });
+
+    it(`leaves a file without GPS byte-identical, ${order}`, () => {
+      const tiff = cameraTiff(le, { withGps: false });
+      const out = tiff.slice();
+      expect(scrubTiffGps(out, 0, out.length)).toBe(true);
+      expect(out).toEqual(tiff);
+    });
+  }
+
+  it('scrubs XMP embedded in TIFF tag 700', () => {
+    const tiff = cameraTiff(false, { xmp: utf8(XMP_PACKET) });
+    const out = tiff.slice();
+    expect(scrubTiffGps(out, 0, out.length)).toBe(true);
+    const xmp = parseTiff(out).ifd0.get(0x02bc)!;
+    expectXmpScrubbed(Buffer.from(xmp.value).toString('utf8'));
+  });
+
+  it('refuses what it cannot walk', () => {
+    const bad = (mutate: (t: Uint8Array) => void) => {
+      const t = cameraTiff(true);
+      mutate(t);
+      return scrubTiffGps(t, 0, t.length);
+    };
+    expect(bad((t) => t.set(ascii('XX'), 0))).toBe(false); // byte order
+    expect(bad((t) => (t[2] = 43))).toBe(false); // BigTIFF
+    expect(bad((t) => t.set([0xff, 0xff, 0, 0], 4))).toBe(false); // IFD0 out of range
+    expect(scrubTiffGps(bytes(0x49, 0x49), 0, 2)).toBe(false);
+  });
+
+  it('refuses a GPS IFD whose values point outside the block', () => {
+    const t = cameraTiff(false);
+    const gps = parseTiff(t);
+    expect(gps.gps).not.toBeNull();
+    // Find the GPSLatitude entry (tag 2, RATIONAL) and point it past the end.
+    const entry = indexOf(t, bytes(0x00, 0x02, 0x00, 0x05, 0x00, 0x00, 0x00, 0x03));
+    t.set(be32(0x7fffffff), entry + 8);
+    expect(scrubTiffGps(t, 0, t.length)).toBe(false);
+  });
+});
+
+describe('scrubXmpLocation', () => {
+  it('blanks every location property, keeps the length and the rest', () => {
+    const packet = utf8(XMP_PACKET);
+    const out = packet.slice();
+    expect(scrubXmpLocation(out, 0, out.length)).toBe(true);
+    expect(out.length).toBe(packet.length);
+    expectXmpScrubbed(Buffer.from(out).toString('utf8'));
+  });
+
+  it('leaves a packet without location untouched', () => {
+    const packet = utf8('<x:xmpmeta><rdf:Description photoshop:City="Berlin"/></x:xmpmeta>');
+    const out = packet.slice();
+    expect(scrubXmpLocation(out, 0, out.length)).toBe(true);
+    expect(out).toEqual(packet);
+  });
+
+  it('refuses an unclosed location element', () => {
+    const out = utf8('<rdf:Description><exif:GPSLatitude>52,31N</rdf:Description>');
+    expect(scrubXmpLocation(out, 0, out.length)).toBe(false);
+  });
+
+  it('refuses UTF-16, which it cannot read byte-wise', () => {
+    const out = new Uint8Array(Buffer.from('<exif:GPSLatitude>1</exif:GPSLatitude>', 'utf16le'));
+    expect(scrubXmpLocation(out, 0, out.length)).toBe(false);
+  });
+
+  it('tolerates trailing NUL padding', () => {
+    const out = cat(utf8('<a exif:GPSLatitude="1"/>'), bytes(0, 0, 0));
+    expect(scrubXmpLocation(out, 0, out.length)).toBe(true);
+    expect(latin1(out)).not.toContain('GPS');
+  });
+});
+
+describe('JPEG', () => {
+  for (const le of [true, false]) {
+    const order = le ? 'little-endian' : 'big-endian';
+
+    it(`removes location and keeps everything else, ${order} EXIF`, async () => {
+      const { file, primaryHeadLength, primaryLength } = cameraJpeg(le);
+      const out = (await scrubLocation(file))!;
+      expect(out).not.toBeNull();
+      expect(out.length).toBe(file.length);
+
+      // EXIF: GPS gone, camera data intact.
+      const tiff = exifOf(out)!;
+      expectNoGps(tiff, le);
+      expectCameraData(tiff);
+
+      // XMP: GPS gone, city/country/rights intact.
+      const xmp = jpegSegments(out).find((s) =>
+        latin1(s.payload).startsWith('http://ns.adobe.com/xap/1.0/'),
+      )!;
+      expectXmpScrubbed(Buffer.from(xmp.payload).toString('utf8'));
+
+      // JFIF and ICC are byte-identical.
+      const segs = jpegSegments(out);
+      expect(segs.find((s) => s.marker === 0xe0)!.payload).toEqual(JFIF);
+      expect(segs.find((s) => s.marker === 0xe2)!.payload).toEqual(ICC);
+
+      // Extended XMP and the C2PA manifest are zeroed whole.
+      const ext = segs.filter((s) => s.marker === 0xe1)[2];
+      expect(ext.payload.every((x) => x === 0)).toBe(true);
+      const jumbf = segs.find((s) => s.marker === 0xeb)!;
+      expect(jumbf.payload.every((x) => x === 0)).toBe(true);
+
+      // APP13: the IPTC record stays, its EXIF resource loses GPS.
+      const app13 = segs.find((s) => s.marker === 0xed)!;
+      expect(latin1(app13.payload)).toContain('Copyright Jane Doe');
+      const irbExif = app13.payload.slice(indexOf(app13.payload, ascii(le ? 'MM' : 'II')));
+      expectNoGps(irbExif, !le);
+      expectCameraData(irbExif);
+
+      // Scan data and everything after the primary head is identical apart
+      // from the appended image's metadata.
+      expect(out.slice(primaryHeadLength, primaryLength)).toEqual(
+        file.slice(primaryHeadLength, primaryLength),
+      );
+
+      // The appended (MPF) image: GPS gone there too, camera data kept.
+      const second = exifOf(out, primaryLength)!;
+      expectNoGps(second, le);
+      expectCameraData(second);
+      expect(out.slice(out.length - SCAN.length - 2)).toEqual(
+        file.slice(file.length - SCAN.length - 2),
+      );
+
+      // Nothing location-shaped anywhere in the file.
+      const text = latin1(out);
+      expect(text).not.toContain('52.520095');
+      expect(contains(out, LAT_BYTES(le))).toBe(false);
+      expect(contains(out, LAT_BYTES(!le))).toBe(false);
+    });
+  }
+
+  it('gives the same bytes however the stream is chunked', async () => {
+    const { file } = cameraJpeg(true);
+    const whole = (await scrubLocation(file))!;
+    for (const size of [1, 2, 3, 7, 64, 1000, 4096]) {
+      expect(await viaStream(file, size)).toEqual(whole);
+    }
+  });
+
+  it('zeroes an EXIF segment it cannot parse, and only that segment', async () => {
+    const broken = cat(ascii('MM'), bytes(0, 42), be32(0x7fffff00), ascii('GPS 52.520095'));
+    const file = cat(
+      bytes(0xff, 0xd8),
+      seg(0xe0, JFIF),
+      exifSegment(broken),
+      xmpSegment(XMP_PACKET),
+      seg(0xe2, ICC),
+      SOS,
+      SCAN,
+      EOI,
+    );
+    const out = (await scrubLocation(file))!;
+    expect(out.length).toBe(file.length);
+    const segs = jpegSegments(out);
+    expect(segs[1].payload.every((x) => x === 0)).toBe(true);
+    expectXmpScrubbed(Buffer.from(segs[2].payload).toString('utf8'));
+    expect(segs[3].payload).toEqual(ICC);
+    expect(latin1(out)).not.toContain('52.520095');
+  });
+
+  it('zeroes an unknown APP1 in the primary image', async () => {
+    const file = cat(bytes(0xff, 0xd8), seg(0xe1, ascii('FLIR\0GPS 52.520095')), SOS, SCAN, EOI);
+    const out = (await scrubLocation(file))!;
+    expect(latin1(out)).not.toContain('52.520095');
+  });
+
+  it('accepts fill bytes before a marker', async () => {
+    const file = cat(bytes(0xff, 0xd8, 0xff, 0xff), exifSegment(cameraTiff(true)), SOS, SCAN, EOI);
+    const out = (await scrubLocation(file))!;
+    expect(out).not.toBeNull();
+    expectNoGps(exifOf(cat(bytes(0xff, 0xd8), out.slice(4)))!, true);
+  });
+
+  it('refuses a JPEG whose head never reaches the image data', async () => {
+    const truncated = cat(bytes(0xff, 0xd8), exifSegment(cameraTiff(true))).slice(0, 60);
+    expect(await scrubLocation(truncated)).toBeNull();
+    const noSos = cat(bytes(0xff, 0xd8), seg(0xe0, JFIF));
+    expect(await scrubLocation(noSos)).toBeNull();
+    const garbage = cat(bytes(0xff, 0xd8), seg(0xe0, JFIF), bytes(0x12, 0x34, 0x56, 0x78));
+    expect(await scrubLocation(garbage)).toBeNull();
+  });
+});
+
+describe('HEIF / AVIF', () => {
+  const check = (out: Uint8Array, file: Uint8Array, imageAt: number, le: boolean) => {
+    expect(out.length).toBe(file.length);
+    const tiff = heicExif(out)!;
+    expect(tiff).not.toBeNull();
+    expectNoGps(tiff, le);
+    expectCameraData(tiff);
+    expectXmpScrubbed(latin1(out.slice(indexOf(out, ascii('<?xpacket')))));
+    expect(out.slice(imageAt, imageAt + 20)).toEqual(file.slice(imageAt, imageAt + 20));
+  };
+
+  for (const le of [true, false]) {
+    it(`removes location from the Exif and XMP items, ${le ? 'II' : 'MM'}`, async () => {
+      const { file, imageAt } = cameraHeic({ le });
+      check((await scrubLocation(file))!, file, imageAt, le);
+    });
+  }
+
+  it('handles EXIF stored in idat (construction method 1)', async () => {
+    const { file, imageAt } = cameraHeic({ idatExif: true });
+    check((await scrubLocation(file))!, file, imageAt, false);
+  });
+
+  it('handles a meta box after mdat', async () => {
+    const { file, imageAt } = cameraHeic({ metaLast: true });
+    check((await scrubLocation(file))!, file, imageAt, false);
+  });
+
+  it('zeroes a C2PA manifest box', async () => {
+    const { file } = cameraHeic({ c2pa: true });
+    const out = (await scrubLocation(file))!;
+    expect(latin1(out)).not.toContain('52.520095');
+    expect(latin1(out)).not.toContain('c2pa manifest');
+  });
+
+  it('gives the same bytes however the stream is chunked', async () => {
+    const { file } = cameraHeic({ c2pa: true });
+    const whole = (await scrubLocation(file))!;
+    for (const size of [1, 5, 13, 100, 4096]) {
+      expect(await viaStream(file, size)).toEqual(whole);
+    }
+    const { file: last } = cameraHeic({ metaLast: true, c2pa: true });
+    const lastWhole = (await scrubLocation(last))!;
+    for (const size of [1, 7, 333]) {
+      expect(await viaStream(last, size)).toEqual(lastWhole);
+    }
+  });
+
+  it('zeroes an Exif item it cannot parse', async () => {
+    const payload = cat(be32(6), ascii('Exif\0\0'), ascii('XXnot-a-tiff GPS 52.520095'));
+    const { file } = cameraHeic({ exifPayload: payload });
+    const out = (await scrubLocation(file))!;
+    expect(out.length).toBe(file.length);
+    expect(latin1(out)).not.toContain('52.520095');
+    expect(latin1(out)).not.toContain('not-a-tiff');
+  });
+
+  it('refuses a file whose meta box cannot be parsed', async () => {
+    const { file } = cameraHeic();
+    const broken = file.slice();
+    const iloc = indexOf(broken, ascii('iloc'));
+    broken.set([0xff, 0xff], iloc + 4 + 4 + 2); // item_count far beyond the box
+    expect(await scrubLocation(broken)).toBeNull();
+  });
+
+  it('refuses a truncated meta box', async () => {
+    const { file } = cameraHeic();
+    const meta = indexOf(file, ascii('meta'));
+    expect(await scrubLocation(file.slice(0, meta + 40))).toBeNull();
+  });
+});
+
+describe('other formats', () => {
+  it('passes PNG, TIFF/DNG, video and unknown bytes through unchanged', async () => {
+    const samples = [
+      cat(bytes(0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a), ascii('IHDR...GPS')),
+      cameraTiff(true),
+      cat(be32(20), ascii('ftypqt  '), be32(0), ascii('qt  '), ascii('moov....')),
+      ascii('image-bytes'),
+      bytes(),
+    ];
+    for (const sample of samples) {
+      const result = await scrubLocationStream(chunked(sample, 3));
+      expect(result.ok && result.format).toBe('passthrough');
+      expect(await viaStream(sample, 3)).toEqual(sample);
+    }
+  });
+
+  it('reports which formats it edits', async () => {
+    const jpeg = await scrubLocationStream(
+      chunked(cat(bytes(0xff, 0xd8), seg(0xe0, JFIF), SOS, EOI), 4),
+    );
+    expect(jpeg.ok && jpeg.format).toBe('jpeg');
+    const heic = await scrubLocationStream(chunked(cameraHeic().file, 4));
+    expect(heic.ok && heic.format).toBe('heif');
+  });
+});
+
+describe('isLocationScrubbable', () => {
+  it('judges by the original MIME type, then the file name', () => {
+    expect(isLocationScrubbable({ type: 'IMAGE', originalMimeType: 'image/jpeg' })).toBe(true);
+    expect(isLocationScrubbable({ type: 'IMAGE', originalMimeType: 'image/heic' })).toBe(true);
+    expect(isLocationScrubbable({ type: 'IMAGE', originalMimeType: 'image/avif' })).toBe(true);
+    expect(isLocationScrubbable({ type: 'IMAGE', originalMimeType: 'image/x-adobe-dng' })).toBe(
+      false,
+    );
+    expect(isLocationScrubbable({ type: 'IMAGE', originalMimeType: 'image/png' })).toBe(false);
+    expect(isLocationScrubbable({ type: 'VIDEO', originalMimeType: 'video/mp4' })).toBe(false);
+    expect(isLocationScrubbable({ type: 'IMAGE', originalFileName: 'IMG_0001.HEIC' })).toBe(true);
+    expect(isLocationScrubbable({ type: 'IMAGE', originalFileName: 'DSC_0001.NEF' })).toBe(false);
+  });
+});
+
+describe('XMP matching stays linear', () => {
+  const time = (packet: string) => {
+    const b = utf8(packet);
+    const started = performance.now();
+    const ok = scrubXmpLocation(b, 0, b.length);
+    return { ok, ms: performance.now() - started, text: latin1(b) };
+  };
+
+  it('scans long name runs without retrying at every character', () => {
+    for (const size of [64 * 1024, 1024 * 1024]) {
+      const run = time(`<x:xmpmeta exif:GPSLatitude="1">${'a'.repeat(size)}</x:xmpmeta>`);
+      expect(run.ok).toBe(true);
+      expect(run.text).not.toContain('GPS');
+      expect(run.ms).toBeLessThan(100);
+
+      const colons = time(`<x:xmpmeta exif:GPSLatitude="1">${'a:'.repeat(size / 2)}</x:xmpmeta>`);
+      expect(colons.ok).toBe(true);
+      expect(colons.ms).toBeLessThan(100);
+    }
+  });
+
+  it('blanks deeply nested location elements in one pass', () => {
+    const depth = 20000;
+    const nested = time(
+      `<x:xmpmeta>${'<exif:GPSArea>'.repeat(depth)}${'</exif:GPSArea>'.repeat(depth)}</x:xmpmeta>`,
+    );
+    expect(nested.ok).toBe(true);
+    expect(nested.text).not.toContain('GPS');
+    expect(nested.ms).toBeLessThan(100);
+  });
+});
+
+describe('place names below city level', () => {
+  const STREET = 'Hauptstrasse 12';
+
+  it('blanks sub-city XMP place names and keeps city, state and country', () => {
+    const packet = `<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF><rdf:Description rdf:about=""
+      Iptc4xmpCore:Location="${STREET}"
+      Iptc4xmpCore:CountryCode="DE"
+      photoshop:City="Berlin" photoshop:State="Berlin" photoshop:Country="Germany">
+     <xmpDM:shotLocation>${STREET}</xmpDM:shotLocation>
+     <Iptc4xmpExt:LocationShown><rdf:Bag><rdf:li rdf:parseType="Resource">
+      <Iptc4xmpExt:Sublocation>${STREET}</Iptc4xmpExt:Sublocation>
+      <Iptc4xmpExt:LocationName>Café am Markt</Iptc4xmpExt:LocationName>
+      <Iptc4xmpExt:City>Berlin</Iptc4xmpExt:City>
+      <Iptc4xmpExt:ProvinceState>Berlin</Iptc4xmpExt:ProvinceState>
+      <Iptc4xmpExt:CountryName>Germany</Iptc4xmpExt:CountryName>
+      <Iptc4xmpExt:CountryCode>DE</Iptc4xmpExt:CountryCode>
+     </rdf:li></rdf:Bag></Iptc4xmpExt:LocationShown>
+    </rdf:Description></rdf:RDF></x:xmpmeta>`;
+    const b = utf8(packet);
+    expect(scrubXmpLocation(b, 0, b.length)).toBe(true);
+    const text = Buffer.from(b).toString('utf8');
+    expect(b.length).toBe(utf8(packet).length);
+    expect(text).not.toContain(STREET);
+    expect(text).not.toContain('Café am Markt');
+    expect(text).not.toMatch(/:(Sub)?[Ll]ocation\b|shotLocation|LocationName/);
+    for (const kept of [
+      'Iptc4xmpCore:CountryCode="DE"',
+      'photoshop:City="Berlin"',
+      'photoshop:State="Berlin"',
+      'photoshop:Country="Germany"',
+      '<Iptc4xmpExt:City>Berlin</Iptc4xmpExt:City>',
+      '<Iptc4xmpExt:ProvinceState>Berlin</Iptc4xmpExt:ProvinceState>',
+      '<Iptc4xmpExt:CountryName>Germany</Iptc4xmpExt:CountryName>',
+      '<Iptc4xmpExt:CountryCode>DE</Iptc4xmpExt:CountryCode>',
+      '<Iptc4xmpExt:LocationShown>',
+    ]) {
+      expect(text).toContain(kept);
+    }
+  });
+
+  it('blanks the IIM sub-location (2:92) in place and keeps the rest of the record', async () => {
+    const dataset = (n: number, value: string) =>
+      cat(bytes(0x1c, 0x02, n), be16(value.length), ascii(value));
+    const iim = cat(
+      dataset(90, 'Berlin'),
+      dataset(92, STREET),
+      dataset(101, 'Germany'),
+      dataset(116, 'Copyright Jane Doe'),
+    );
+    const irb = cat(
+      ascii('Photoshop 3.0\0'),
+      ascii('8BIM'),
+      be16(0x0404),
+      bytes(0, 0),
+      be32(iim.length),
+      iim,
+      iim.length % 2 ? bytes(0) : bytes(),
+    );
+    const file = cat(bytes(0xff, 0xd8), seg(0xed, irb), SOS, SCAN, EOI);
+    const out = (await scrubLocation(file))!;
+    expect(out.length).toBe(file.length);
+    const text = latin1(out);
+    expect(text).not.toContain(STREET);
+    expect(text).toContain(`\x1c\x02\x5c\x00\x0f${' '.repeat(STREET.length)}`);
+    for (const kept of ['Berlin', 'Germany', 'Copyright Jane Doe']) expect(text).toContain(kept);
+  });
+});
+
+describe('vendor APPn segments', () => {
+  const GOPRO = cat(ascii('GoPro\0'), ascii('GPS5 52.520095 13.401577'));
+  const KODAK = cat(ascii('Meta\0\0'), ascii('GPS 52.520095'));
+  const MPF = cat(ascii('MPF\0'), ascii('MM'), bytes(0, 42), be32(8), ascii('mp-index'));
+  const ADOBE = cat(ascii('Adobe'), bytes(0, 100, 0, 0, 0, 0, 1));
+
+  const head = () =>
+    cat(
+      seg(0xe0, JFIF),
+      seg(0xe2, MPF),
+      seg(0xe2, ICC),
+      seg(0xe3, KODAK),
+      seg(0xe6, GOPRO),
+      seg(0xe0, ascii('AVI1\0GPS 52.520095')),
+      seg(0xee, ADOBE),
+    );
+
+  const check = (out: Uint8Array, soi: number) => {
+    const segs = jpegSegments(out, soi);
+    const payload = (marker: number, n = 0) => segs.filter((x) => x.marker === marker)[n].payload;
+    expect(payload(0xe0)).toEqual(JFIF);
+    expect(payload(0xe2, 0)).toEqual(MPF);
+    expect(payload(0xe2, 1)).toEqual(ICC);
+    expect(payload(0xee)).toEqual(ADOBE);
+    for (const zeroed of [payload(0xe3), payload(0xe6), payload(0xe0, 1)]) {
+      expect(zeroed.every((x) => x === 0)).toBe(true);
+    }
+  };
+
+  it('zeroes APPn segments off the allowlist and keeps JFIF, ICC, MPF and Adobe', async () => {
+    const primary = cat(bytes(0xff, 0xd8), head(), SOS, SCAN, EOI);
+    const secondary = cat(bytes(0xff, 0xd8), head(), SOS, SCAN, EOI);
+    const file = cat(primary, secondary);
+    const out = (await scrubLocation(file))!;
+    expect(out.length).toBe(file.length);
+    expect(latin1(out)).not.toContain('52.520095');
+    check(out, 0);
+    check(out, primary.length);
+    for (const size of [1, 9, 100]) expect(await viaStream(file, size)).toEqual(out);
+  });
+});
+
+describe('progressive JPEG', () => {
+  const DHT = seg(0xc4, bytes(0x10, ...new Array(16).fill(0), 0));
+
+  it('scrubs an APPn segment between scans, and only inside the image', async () => {
+    const trailer = cat(ascii('TRAILER'), bytes(0xff, 0xe1, 0x00, 0x10), ascii('not a segment!'));
+    const file = cat(
+      bytes(0xff, 0xd8),
+      seg(0xe0, JFIF),
+      SOS,
+      SCAN,
+      exifSegment(cameraTiff(true)),
+      xmpSegment(XMP_PACKET),
+      seg(0xe6, ascii('GoPro\0GPS5')),
+      DHT,
+      SOS,
+      SCAN,
+      EOI,
+      trailer,
+    );
+    const out = (await scrubLocation(file))!;
+    expect(out.length).toBe(file.length);
+    const between = indexOf(out, ascii('Exif\0\0'));
+    const tiff = parseTiff(out.slice(between + 6));
+    expect(tiff.gps).toBeNull();
+    expect(asciiOf(tiff.ifd0.get(0x010f))).toBe('Canon');
+    expect(latin1(out)).not.toMatch(/exif:GPS|GoPro/);
+    // Bytes after EOI that merely look like a marker are not touched.
+    expect(out.slice(out.length - trailer.length)).toEqual(trailer);
+    for (const size of [1, 3, 50, 777]) expect(await viaStream(file, size)).toEqual(out);
+  });
+});
+
+describe('padding between segments', () => {
+  it('accepts NUL padding and FF fill bytes between segments', async () => {
+    const file = cat(
+      bytes(0xff, 0xd8),
+      seg(0xe0, JFIF),
+      bytes(0, 0, 0),
+      exifSegment(cameraTiff(false)),
+      bytes(0xff, 0xff, 0xff),
+      seg(0xe2, ICC),
+      bytes(0x00),
+      SOS,
+      SCAN,
+      EOI,
+    );
+    const out = (await scrubLocation(file))!;
+    expect(out).not.toBeNull();
+    expect(out.length).toBe(file.length);
+    expect(contains(out, LAT_BYTES(false))).toBe(false);
+    expect(latin1(out)).toContain('Canon EOS R5');
+    expect(contains(out, ICC)).toBe(true);
+  });
+});
+
+describe('Pending', () => {
+  it('never allocates more than the head cap plus one chunk', () => {
+    const pending = new Pending();
+    const chunk = new Uint8Array(1024 * 1024);
+    while (pending.length < HEAD_CAP) pending.push(chunk);
+    pending.push(chunk);
+    expect(pending.capacity).toBeLessThanOrEqual(HEAD_CAP + chunk.length);
+  });
+});
diff --git a/lib/__tests__/mapService.test.ts b/lib/__tests__/mapService.test.ts
index aeee2f1..d242f84 100644
--- a/lib/__tests__/mapService.test.ts
+++ b/lib/__tests__/mapService.test.ts
@@ -28,7 +28,7 @@ vi.mock('@/lib/cache', () => ({
   cache: { get: () => undefined, set: () => {} },
 }));
 
-import { getMapData } from '@/lib/mapService';
+import { getMapData, visibleMapCounts } from '@/lib/mapService';
 import { listedAlbumIds } from '@/lib/config/schema';
 
 const ALBUM = { id: 'album-1', albumName: 'Trip', slug: 'trip' };
@@ -71,6 +71,24 @@ describe('getMapData coordinate filtering (#635)', () => {
     expect(locations[0].albums[0].photoCount).toBe(1);
   });
 
+  it('carries the cover’s edit state for its image URL (#831)', async () => {
+    const place = { latitude: 52.5, longitude: 13.4, city: 'Berlin', country: 'Germany' };
+    getAlbum.mockResolvedValue({
+      id: ALBUM.id,
+      assets: [{ ...asset('a', place), isEdited: true, updatedAt: '2026-09-04T19:22:09.220Z' }],
+    });
+    const [edited] = await getMapData();
+    expect(edited.albums[0].coverAssetId).toBe('a');
+    expect(edited.albums[0].coverEdit).toEqual({
+      isEdited: true,
+      updatedAt: '2026-09-04T19:22:09.220Z',
+    });
+
+    getAlbum.mockResolvedValue({ id: ALBUM.id, assets: [asset('b', place)] });
+    const [plain] = await getMapData();
+    expect(plain.albums[0].coverEdit).toBeUndefined();
+  });
+
   it('still excludes a photo with no coordinates at all', async () => {
     getAlbum.mockResolvedValue({
       id: ALBUM.id,
@@ -191,3 +209,42 @@ describe('listedAlbumIds', () => {
     expect([...ids].sort()).toEqual(['s', 'shared', 'v']);
   });
 });
+
+/**
+ * The /map header counted protected subpages and albums that /api/map drops
+ * for a viewer who has not unlocked them, so the numbers did not match the map.
+ */
+describe('visibleMapCounts', () => {
+  const site = {
+    standaloneAlbums: ['solo', 'locked-solo'],
+    subpages: [
+      { slug: 'travel', albumIds: ['t1', 't2'], enabled: true },
+      { slug: 'clients', albumIds: ['c1'], enabled: true },
+      { slug: 'offline', albumIds: ['o1'], enabled: false },
+      { slug: 'secret', albumIds: ['h1'], enabled: true, hidden: true },
+    ],
+  };
+  const lockedKeys = new Set(['subpage:clients', 'album:locked-solo', 'album:t2']);
+  const locked = (key: string, type: 'subpage' | 'album') => !lockedKeys.has(`${type}:${key}`);
+
+  it('counts everything listed when nothing is locked', () => {
+    expect(visibleMapCounts(site, () => true)).toEqual({ collections: 2, albums: 5 });
+  });
+
+  it('leaves out locked subpages, their albums and locked albums', () => {
+    // travel (t1), solo — clients, c1, locked-solo and t2 stay locked.
+    expect(visibleMapCounts(site, locked)).toEqual({ collections: 1, albums: 2 });
+  });
+
+  it('gates an album by the same subpage the map links it to', () => {
+    const shared = {
+      standaloneAlbums: [],
+      subpages: [
+        { slug: 'clients', albumIds: ['x'], enabled: true },
+        { slug: 'travel', albumIds: ['x'], enabled: true },
+      ],
+    };
+    // /api/map gates `x` by `clients`, its first listed subpage.
+    expect(visibleMapCounts(shared, locked).albums).toBe(0);
+  });
+});
diff --git a/lib/__tests__/pages-service.test.ts b/lib/__tests__/pages-service.test.ts
index 89c4d20..7a60f15 100644
--- a/lib/__tests__/pages-service.test.ts
+++ b/lib/__tests__/pages-service.test.ts
@@ -90,6 +90,30 @@ describe('pages-service', () => {
     expect((await service.readPage('workshops'))?.parsed.frontmatter.title).toBe('Workshops');
   });
 
+  it('takes no backup for a save that changes nothing (QA A-19)', async () => {
+    await service.writePage('pricing', page('v0'));
+    await service.writePage('pricing', page('v1'));
+    expect(await readdir(backupDir)).toHaveLength(1);
+    await service.writePage('pricing', page('v1'));
+    await service.writePage('pricing', page('v1'));
+    expect(await readdir(backupDir)).toHaveLength(1);
+  });
+
+  it("keeps a renamed page's history under its new slug, not as a deleted page (QA A-19)", async () => {
+    await service.writePage('pricing', page('Pricing'));
+    await service.savePage('rates', page('Rates'), { fromSlug: 'pricing' });
+
+    expect(await service.readPage('pricing')).toBeNull();
+    expect((await service.readPage('rates'))?.parsed.frontmatter.title).toBe('Rates');
+    const backups = await service.listPageBackups();
+    expect(backups).toEqual([expect.objectContaining({ slug: 'rates', kind: 'save' })]);
+
+    // Restoring it rolls the renamed page back instead of reviving the old slug.
+    await service.restorePageBackup(backups[0].filename);
+    expect((await service.readPage('rates'))?.parsed.frontmatter.title).toBe('Pricing');
+    expect(await service.readPage('pricing')).toBeNull();
+  });
+
   it('refuses to restore from a name it did not write', async () => {
     await expect(service.restorePageBackup('../gallery.yaml')).rejects.toThrow(/unrecognised/);
     await expect(service.restorePageBackup('pricing.md')).rejects.toThrow(/unrecognised/);
diff --git a/lib/__tests__/passepartout-mat.test.ts b/lib/__tests__/passepartout-mat.test.ts
new file mode 100644
index 0000000..55968fb
--- /dev/null
+++ b/lib/__tests__/passepartout-mat.test.ts
@@ -0,0 +1,100 @@
+import { describe, it, expect } from 'vitest';
+import fs from 'fs';
+import path from 'path';
+import { THEME_PRESETS, contrastRatio } from '../config/theme';
+
+/**
+ * The passepartout frame prints the EXIF line on the mat, in --mat-text on
+ * --mat-bg. Until v0.20.0 the mat never showed — the photo covered it, and the
+ * line sat on the photo at 1.3–2.4:1 — so its colours had never been checked.
+ *
+ * Tokens are resolved the way the cascade does on <html>, where every block
+ * of app/tokens.css matches at once: a preset's light block beats everything,
+ * then the later of the one-attribute blocks wins — and every preset block
+ * comes after the generic light block, so a preset that sets a mat token for
+ * dark mode only would carry it into light mode too.
+ */
+const css = fs.readFileSync(path.join(process.cwd(), 'app', 'tokens.css'), 'utf8');
+
+function block(selector: string): string | undefined {
+  const escaped = selector.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`(?:^|\\n)${escaped}\\s*\\{([^}]*)\\}`).exec(css)?.[1];
+}
+
+function declared(selector: string, name: string): string | undefined {
+  const body = block(selector);
+  if (!body) return undefined;
+  return new RegExp(`--${name}:\\s*([^;]+);`).exec(body)?.[1].trim();
+}
+
+function token(preset: string, mode: 'dark' | 'light', name: string): string | undefined {
+  const chain =
+    mode === 'dark'
+      ? [`[data-preset='${preset}']`, ':root']
+      : [
+          `[data-preset='${preset}'][data-theme='light']`,
+          `[data-preset='${preset}']`,
+          "[data-theme='light']",
+          ':root',
+        ];
+  for (const selector of chain) {
+    const value = declared(selector, name);
+    if (value === undefined) continue;
+    const ref = /^var\(--([\w-]+)\)$/.exec(value);
+    return ref ? token(preset, mode, ref[1]) : value;
+  }
+  return undefined;
+}
+
+// WCAG AA for text at the caption's size (0.6875–0.75rem).
+const TEXT_MIN = 4.5;
+
+describe('passepartout mat tokens', () => {
+  it('are defined for both modes', () => {
+    expect(declared(':root', 'mat-bg')).toBeDefined();
+    expect(declared("[data-theme='light']", 'mat-bg')).toBeDefined();
+  });
+
+  it('are no longer hard-coded in the theme files', () => {
+    const themes = path.join(process.cwd(), 'app', 'themes');
+    const globals = fs.readFileSync(path.join(process.cwd(), 'app', 'globals.css'), 'utf8');
+    const sources = [
+      globals,
+      ...fs.readdirSync(themes).map((f) => fs.readFileSync(path.join(themes, f), 'utf8')),
+    ];
+    for (const source of sources) {
+      for (const rule of source.matchAll(/\[data-photo-frame='passepartout'\][^{]*\{([^}]*)\}/g)) {
+        expect(rule[1]).not.toMatch(/(background|border|color)[^;]*#[0-9a-f]{3,6}/i);
+      }
+    }
+  });
+
+  for (const preset of Object.keys(THEME_PRESETS)) {
+    for (const mode of ['dark', 'light'] as const) {
+      it(`${preset} (${mode}): the EXIF line is readable on the mat`, () => {
+        const bg = token(preset, mode, 'mat-bg')!;
+        const fg = token(preset, mode, 'mat-text')!;
+        expect(bg).toMatch(/^#[0-9a-f]{6}$/i);
+        expect(fg).toMatch(/^#[0-9a-f]{6}$/i);
+        expect(contrastRatio(fg, bg)!).toBeGreaterThanOrEqual(TEXT_MIN);
+      });
+    }
+  }
+
+  it('keeps the light mat light in a preset that tints it', () => {
+    // classic sets a warm dark mat; without its own light value that dark
+    // mat would win over the generic light one.
+    expect(token('classic', 'light', 'mat-bg')).toBe('#fffdf5');
+    expect(token('classic', 'dark', 'mat-bg')).toBe('#1a1816');
+  });
+
+  it('tones the mat to the wall in the gallery presets', () => {
+    // kunsthalle hangs on grey, salon on oxblood and plaster rose; the default
+    // black and white boards cut a hole in either wall.
+    for (const preset of ['kunsthalle', 'salon']) {
+      expect(token(preset, 'dark', 'mat-bg')).not.toBe(token('studio', 'dark', 'mat-bg'));
+      expect(token(preset, 'light', 'mat-bg')).not.toBe(token('studio', 'light', 'mat-bg'));
+      expect(token(preset, 'dark', 'mat-bg')).not.toBe(token(preset, 'light', 'mat-bg'));
+    }
+  });
+});
diff --git a/lib/__tests__/preset-registry.test.ts b/lib/__tests__/preset-registry.test.ts
new file mode 100644
index 0000000..f59c770
--- /dev/null
+++ b/lib/__tests__/preset-registry.test.ts
@@ -0,0 +1,173 @@
+import { describe, it, expect } from 'vitest';
+import fs from 'fs';
+import path from 'path';
+import { PRESET_REGISTRY, PRESET_IDS } from '../config/presets';
+import {
+  THEME_PRESETS,
+  DEFAULT_PRESET,
+  resolveTheme,
+  contrastRatio,
+  accentForMode,
+} from '../config/theme';
+import { parseFamilies, MAX_FAMILIES } from '../fonts';
+
+/**
+ * A preset is declared once, in PRESET_REGISTRY. The places that cannot import
+ * the registry — the stylesheets, the docs, a plain-node script — are held to
+ * it here, so adding a preset fails loudly where a step was missed instead of
+ * shipping a preset with no palette or no stylesheet.
+ */
+const root = process.cwd();
+const read = (rel: string) => fs.readFileSync(path.join(root, rel), 'utf8');
+
+const tokensCss = read('app/tokens.css').replace(/\/\*[\s\S]*?\*\//g, '');
+const globalsCss = read('app/globals.css');
+
+/** Custom properties declared by the rule with exactly this selector. */
+function block(selector: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const m of tokensCss.matchAll(/([^{}]+)\{([^}]*)\}/g)) {
+    if (m[1].trim() !== selector) continue;
+    for (const d of m[2].matchAll(/(--[\w-]+)\s*:\s*([^;]+);/g)) out[d[1]] = d[2].trim();
+  }
+  return out;
+}
+
+/** The surface and text tokens a preset palette has to define in each mode. */
+const PALETTE_TOKENS = [
+  '--bg-primary',
+  '--bg-secondary',
+  '--bg-card',
+  '--bg-card-hover',
+  '--bg-overlay',
+  '--text-primary',
+  '--text-secondary',
+  '--text-muted',
+  '--border-subtle',
+  '--border-hover',
+];
+
+/**
+ * Surfaces the text tokens are held to 4.5:1 on. Light mode includes
+ * --bg-card-hover: studio-modern's light --text-muted (#73736e) measured 4.17:1
+ * on --bg-secondary and 4.36:1 on --bg-card-hover before it was darkened.
+ * Dark mode leaves --bg-card-hover out, where muted text sits at 4.1–4.3:1 in
+ * several presets.
+ */
+const TEXT_SURFACES = {
+  dark: ['--bg-primary', '--bg-secondary', '--bg-card'],
+  light: ['--bg-primary', '--bg-secondary', '--bg-card', '--bg-card-hover'],
+} as const;
+
+/**
+ * The first seven presets use their accent for dots, rules and fills, held to
+ * 3:1 by preset-contrast.test.ts. Presets added since also set links and
+ * labels in it, so their accent has to read as text: 4.5:1 on every surface.
+ */
+const ACCENT_AS_DECORATION_ONLY = new Set([
+  'studio-modern',
+  'studio',
+  'minimal',
+  'editorial',
+  'classic',
+  'noir',
+  'monograph',
+]);
+
+describe('preset registry', () => {
+  it('has unique ids and contains the default preset', () => {
+    expect(new Set(PRESET_IDS).size).toBe(PRESET_IDS.length);
+    expect(PRESET_IDS).toContain(DEFAULT_PRESET);
+  });
+
+  it('is what THEME_PRESETS and resolveTheme serve', () => {
+    expect(Object.keys(THEME_PRESETS)).toEqual([...PRESET_IDS]);
+    for (const id of PRESET_IDS) expect(resolveTheme(id).preset).toBe(id);
+  });
+
+  it('leaves only studio without its own styles', () => {
+    expect(PRESET_REGISTRY.filter((p) => !p.ownStyles).map((p) => p.id)).toEqual(['studio']);
+  });
+
+  it('keeps scripts/contrast-audit.mjs in step', () => {
+    const list = /const PRESETS = \[([^\]]*)\]/.exec(read('scripts/contrast-audit.mjs'))?.[1];
+    expect(list).toBeDefined();
+    const ids = [...list!.matchAll(/'([^']+)'/g)].map((m) => m[1]);
+    expect(ids).toEqual([...PRESET_IDS]);
+  });
+
+  for (const preset of PRESET_REGISTRY) {
+    describe(preset.id, () => {
+      it('has a label, an install tagline and an admin card description', () => {
+        expect(preset.label.trim()).not.toBe('');
+        expect(preset.tagline.trim()).not.toBe('');
+        expect(preset.description.trim()).not.toBe('');
+        for (const c of [preset.card.bg, preset.card.tile, preset.card.accent]) {
+          expect(c).toMatch(/^#[0-9a-f]{6}$/i);
+        }
+      });
+
+      it('names fonts lib/fonts.ts can serve', () => {
+        const { heading, body, caption } = preset.theme.fonts;
+        const families = parseFamilies([heading, body, caption]);
+        expect(families).not.toBeNull();
+        expect(families!.length).toBeLessThanOrEqual(MAX_FAMILIES);
+      });
+
+      it('is documented', () => {
+        expect(read('docs/theming.md')).toContain(`| **${preset.id}**`);
+        expect(read('content/settings.yaml.example')).toContain(preset.id);
+      });
+
+      if (!preset.ownStyles) return;
+
+      it('has a stylesheet that globals.css imports', () => {
+        expect(fs.existsSync(path.join(root, 'app/themes', `${preset.id}.css`))).toBe(true);
+        expect(globalsCss).toContain(`@import url('./themes/${preset.id}.css');`);
+      });
+
+      it('defines its palette in app/tokens.css for both colour modes', () => {
+        const dark = block(`[data-preset='${preset.id}']`);
+        const light = block(`[data-preset='${preset.id}'][data-theme='light']`);
+        for (const token of PALETTE_TOKENS) {
+          expect(dark[token], `${token} (dark)`).toBeDefined();
+          expect(light[token], `${token} (light)`).toBeDefined();
+        }
+      });
+
+      it('keeps its text tokens at 4.5:1 on every surface, in both modes', () => {
+        for (const mode of ['dark', 'light'] as const) {
+          const vars = {
+            ...block(`[data-preset='${preset.id}']`),
+            ...(mode === 'light' ? block(`[data-preset='${preset.id}'][data-theme='light']`) : {}),
+          };
+          for (const text of ['--text-primary', '--text-secondary', '--text-muted']) {
+            for (const surface of TEXT_SURFACES[mode]) {
+              const ratio = contrastRatio(vars[text], vars[surface]);
+              // Palettes written as rgba() are measured by the browser audit
+              // (npm run audit:contrast), not here.
+              if (ratio === null) continue;
+              expect(ratio, `${mode} ${text} on ${surface}`).toBeGreaterThanOrEqual(4.5);
+            }
+          }
+        }
+      });
+
+      if (ACCENT_AS_DECORATION_ONLY.has(preset.id)) return;
+
+      it('keeps its accent readable as text on every surface, in both modes', () => {
+        for (const mode of ['dark', 'light'] as const) {
+          const vars = {
+            ...block(`[data-preset='${preset.id}']`),
+            ...(mode === 'light' ? block(`[data-preset='${preset.id}'][data-theme='light']`) : {}),
+          };
+          const accent = accentForMode(resolveTheme(preset.id), mode);
+          for (const surface of ['--bg-primary', '--bg-secondary', '--bg-card']) {
+            const ratio = contrastRatio(accent, vars[surface]);
+            expect(ratio, `${mode} accent on ${surface}`).toBeGreaterThanOrEqual(4.5);
+          }
+        }
+      });
+    });
+  }
+});
diff --git a/lib/__tests__/privacy.test.ts b/lib/__tests__/privacy.test.ts
index b86dc93..044b66a 100644
--- a/lib/__tests__/privacy.test.ts
+++ b/lib/__tests__/privacy.test.ts
@@ -35,13 +35,16 @@ const config = (over: Partial<AppConfig> = {}) =>
     analytics: false,
     contact: { enabled: false, retentionDays: 90 },
     proofing: { enabled: false },
+    subpages: [],
     privacy: { enabled: true },
     ...over,
   }) as unknown as AppConfig;
 
 describe('processingFacts', () => {
   it('lists only what this installation actually does', () => {
-    const topics = processingFacts(config(), { hasPasswords: false }).map((f) => f.topic);
+    const topics = processingFacts(config(), { hasPasswords: false, hasProofingLinks: false }).map(
+      (f) => f.topic,
+    );
     expect(topics).toEqual(['Photos', 'Server log', 'Fonts', 'Browser storage']);
   });
 
@@ -51,7 +54,7 @@ describe('processingFacts', () => {
         map: true,
         contact: { enabled: true, retentionDays: 30, notifyUrl: 'https://ntfy.sh/secret' },
       }),
-      { hasPasswords: true, CDN_URL: 'https://cdn.example.net' },
+      { hasPasswords: true, hasProofingLinks: false, CDN_URL: 'https://cdn.example.net' },
     );
     const third = facts.filter((f) => f.thirdParty).map((f) => f.topic);
     // The notification carries nothing about the sender (#702), so the
@@ -65,8 +68,58 @@ describe('processingFacts', () => {
     expect(facts.some((f) => f.topic === 'Cookies')).toBe(true);
   });
 
+  it('keeps anonymous favourites in the browser, also when only a subpage turns them on', () => {
+    const storage = (c: AppConfig) =>
+      processingFacts(c, { hasPasswords: false, hasProofingLinks: false }).find(
+        (f) => f.topic === 'Browser storage',
+      )!.detail;
+    expect(storage(config())).not.toContain('favourites');
+    expect(storage(config({ proofing: { enabled: true } } as Partial<AppConfig>))).toContain(
+      'favourites',
+    );
+    const subpageOnly = config({
+      subpages: [{ proofing: true }],
+    } as unknown as Partial<AppConfig>);
+    expect(storage(subpageOnly)).toContain('favourites');
+    expect(storage(subpageOnly)).toContain('localStorage');
+  });
+
+  it('says that proofing links store the client’s selection on this server', () => {
+    const none = processingFacts(config({ proofing: { enabled: true } } as Partial<AppConfig>), {
+      hasPasswords: false,
+      hasProofingLinks: false,
+    });
+    expect(none.some((f) => f.topic === 'Proofing links')).toBe(false);
+
+    // Links do not depend on the proofing switch, so the fact does not either.
+    const facts = processingFacts(config(), { hasPasswords: false, hasProofingLinks: true });
+    const links = facts.find((f) => f.topic === 'Proofing links')!;
+    expect(links.detail).toContain('content/proofing.json');
+    expect(links.detail).toContain('client name');
+    expect(links.detail).toContain('until you delete the link');
+    expect(links.thirdParty).toBe(false);
+    expect(starterHeadings('de', facts)).toContain('## Bildauswahl durch Kunden');
+    expect(facts.find((f) => f.topic === 'Browser storage')!.detail).not.toContain(
+      'never sent to the server',
+    );
+  });
+
+  it('names the proofing webhook host, since its notification carries the client name', () => {
+    const links = processingFacts(config(), {
+      hasPasswords: false,
+      hasProofingLinks: true,
+      proofingWebhookUrl: 'https://discord.com/api/webhooks/123/secret',
+    }).find((f) => f.topic === 'Proofing links')!;
+    expect(links.thirdParty).toBe(true);
+    expect(links.detail).toContain('discord.com');
+    expect(links.detail).not.toContain('secret');
+  });
+
   it('turns the facts into headings in the site language, and nothing else', () => {
-    const facts = processingFacts(config({ map: true }), { hasPasswords: false });
+    const facts = processingFacts(config({ map: true }), {
+      hasPasswords: false,
+      hasProofingLinks: false,
+    });
     const de = starterHeadings('de', facts);
     expect(de).toContain('## Kartendienst');
     expect(de).not.toContain('Kontaktformular');
diff --git a/lib/__tests__/proxy.test.ts b/lib/__tests__/proxy.test.ts
index f91cbb2..ef7fe68 100644
--- a/lib/__tests__/proxy.test.ts
+++ b/lib/__tests__/proxy.test.ts
@@ -44,6 +44,7 @@ describe('proxy', () => {
   beforeEach(() => {
     mockUnlocked.mockReturnValue(true);
     mockCdnOrigin.mockReturnValue(null);
+    mockConfig.mockReturnValue(null);
   });
 
   describe('CDN mode', () => {
@@ -256,6 +257,44 @@ describe('proxy', () => {
       expect(rewrittenTo(run('/install'))).toBeNull();
     });
 
+    it('serves the legal notice and the privacy policy to a locked site', () => {
+      mockUnlocked.mockReturnValue(false);
+      mockConfig.mockReturnValue({
+        contact: { enabled: true },
+        legal: { enabled: true },
+        map: true,
+        privacy: { enabled: true },
+      });
+      // The gate page is public and links both; an Impressum behind a password
+      // is not "unmittelbar erreichbar". The pages still get their CSP.
+      // The contact form goes with them: the Impressum links it as its second
+      // contact channel.
+      for (const pathname of ['/impressum', '/privacy', '/contact']) {
+        const res = run(pathname);
+        expect(rewrittenTo(res)).toBeNull();
+        expect(res.headers.get('Content-Security-Policy')).toBeTruthy();
+      }
+      // Exact paths only: nothing below or beside them slips through.
+      for (const pathname of ['/', '/contact/x', '/impressum/x', '/privacy-trip', '/japan']) {
+        expect(rewrittenTo(run(pathname))).toContain('/gate');
+      }
+    });
+
+    it('still answers 404 for a legal or contact page that is switched off on a locked site', () => {
+      mockUnlocked.mockReturnValue(false);
+      mockConfig.mockReturnValue({
+        contact: { enabled: false },
+        legal: { enabled: false },
+        map: false,
+        privacy: { enabled: false },
+      });
+      for (const pathname of ['/impressum', '/privacy', '/contact']) {
+        const res = run(pathname);
+        expect(rewrittenTo(res)).toBeNull();
+        expect(res.status).toBe(404);
+      }
+    });
+
     it('does not rewrite the gate to itself', () => {
       mockUnlocked.mockReturnValue(false);
       expect(rewrittenTo(run('/gate'))).toBeNull();
@@ -346,11 +385,20 @@ describe('isKnownMissing', () => {
             ? hasRoute(path.join(dir, entry.name))
             : /^(page|route)\.(tsx?|jsx?)$/.test(entry.name),
         );
-    const routeDirs = fs
-      .readdirSync(appDir, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory() && entry.name !== '[...path]')
-      .filter((entry) => hasRoute(path.join(appDir, entry.name)))
-      .map((entry) => entry.name);
+    // A route group such as app/(home) adds no URL segment: its children are
+    // top-level routes themselves.
+    const topLevelDirs = (dir: string): string[] =>
+      fs
+        .readdirSync(dir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory() && entry.name !== '[...path]')
+        .flatMap((entry) =>
+          /^\(.*\)$/.test(entry.name)
+            ? topLevelDirs(path.join(dir, entry.name))
+            : hasRoute(path.join(dir, entry.name))
+              ? [entry.name]
+              : [],
+        );
+    const routeDirs = topLevelDirs(appDir);
     expect(routeDirs.length).toBeGreaterThan(5);
     for (const name of routeDirs) expect(TOP_LEVEL_ROUTES.has(name), name).toBe(true);
   });
diff --git a/lib/__tests__/settingValues.test.ts b/lib/__tests__/settingValues.test.ts
index 931dbba..6c2241e 100644
--- a/lib/__tests__/settingValues.test.ts
+++ b/lib/__tests__/settingValues.test.ts
@@ -1,6 +1,7 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi } from 'vitest';
 import { validateSettingValues } from '../config/settingValues';
 import { resolveTheme } from '../config/theme';
+import { resolveContact, sanitizeNavLinks } from '../config';
 import { normaliseSiteUrl } from '../siteUrl';
 
 const fields = (input: unknown) => validateSettingValues(input).map((e) => e.field);
@@ -50,4 +51,48 @@ describe('validateSettingValues', () => {
     expect(fields({ grid: { columns: 1, gap: 0 } })).toEqual([]);
     expect(fields({ grid: { columns: 6, gap: 48 } })).toEqual([]);
   });
+
+  it('refuses a corner radius resolveTheme would clamp, and only that', () => {
+    for (const radius of [-1, 65, 200, Number.NaN]) {
+      expect(fields({ theme: { radius } })).toEqual(['theme.radius']);
+      expect(resolveTheme({ preset: 'minimal', radius }).radius).not.toBe(radius);
+    }
+    for (const radius of [0, 8, 1.5, 64]) {
+      expect(fields({ theme: { radius } })).toEqual([]);
+      expect(resolveTheme({ preset: 'minimal', radius }).radius).toBe(radius);
+    }
+  });
+
+  it('refuses a retention resolveContact would round or clamp, and only that', () => {
+    for (const retentionDays of [0, -3, 366, 30.5]) {
+      expect(fields({ contact: { retentionDays } })).toEqual(['contact.retentionDays']);
+      expect(resolveContact({ retentionDays }).retentionDays).not.toBe(retentionDays);
+    }
+    for (const retentionDays of [1, 90, 365]) {
+      expect(fields({ contact: { retentionDays } })).toEqual([]);
+      expect(resolveContact({ retentionDays }).retentionDays).toBe(retentionDays);
+    }
+    expect(fields({ contact: { enabled: true } })).toEqual([]);
+  });
+
+  it('refuses exactly the header links sanitizeNavLinks drops, per input', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const links = [
+      { label: 'Shop', url: 'https://shop.example' },
+      { label: 'Blog', url: 'blog.example' },
+      { label: '  ', url: 'http://ok.example' },
+      { label: 'Evil', url: 'javascript:alert(1)' },
+      { label: '', url: '' },
+    ];
+    expect(fields({ navLinks: links })).toEqual([
+      'navLinks.1.url',
+      'navLinks.2.label',
+      'navLinks.3.url',
+      'navLinks.4.label',
+      'navLinks.4.url',
+    ]);
+    // The resolver keeps exactly the entries with no error.
+    expect(sanitizeNavLinks(links)).toEqual([{ label: 'Shop', url: 'https://shop.example' }]);
+    warn.mockRestore();
+  });
 });
diff --git a/lib/__tests__/themeScript.test.ts b/lib/__tests__/themeScript.test.ts
new file mode 100644
index 0000000..b56eac7
--- /dev/null
+++ b/lib/__tests__/themeScript.test.ts
@@ -0,0 +1,86 @@
+// @vitest-environment jsdom
+import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest';
+import { THEME_INIT_SCRIPT } from '../themeScript';
+
+/**
+ * The inline script that sets the colour mode before the first paint (T-10).
+ * Without it a visitor who stored "light" — or runs a light OS under
+ * `mode: auto` — saw the server's dark guess until ThemeToggle's bundle ran.
+ */
+
+let osLight = false;
+
+function run(defaultTheme: string | null, serverTheme: string | null = defaultTheme) {
+  const html = document.documentElement;
+  html.removeAttribute('data-theme');
+  html.removeAttribute('data-default-theme');
+  if (defaultTheme !== null) html.setAttribute('data-default-theme', defaultTheme);
+  if (serverTheme !== null && serverTheme !== 'auto') html.setAttribute('data-theme', serverTheme);
+  new Function(THEME_INIT_SCRIPT)();
+  return html.getAttribute('data-theme');
+}
+
+// Node 26 defines its own global localStorage (undefined without
+// --localstorage-file), which shadows jsdom's; a Map-backed stub stands in.
+function stubStorage() {
+  const store = new Map<string, string>();
+  vi.stubGlobal('localStorage', {
+    getItem: (k: string) => store.get(k) ?? null,
+    setItem: (k: string, v: string) => void store.set(k, v),
+  });
+}
+
+beforeEach(() => {
+  osLight = false;
+  stubStorage();
+  vi.stubGlobal('matchMedia', (query: string) => ({
+    media: query,
+    matches: query === '(prefers-color-scheme: light)' ? osLight : false,
+  }));
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+});
+
+describe('THEME_INIT_SCRIPT', () => {
+  it('applies a stored choice over the configured mode', () => {
+    localStorage.setItem('theme', 'light');
+    expect(run('dark')).toBe('light');
+    localStorage.setItem('theme', 'dark');
+    expect(run('light')).toBe('dark');
+  });
+
+  it('keeps the configured mode for a visitor who never chose', () => {
+    expect(run('light')).toBe('light');
+    expect(run('dark')).toBe('dark');
+  });
+
+  it('follows the OS under mode: auto', () => {
+    osLight = true;
+    expect(run('auto')).toBe('light');
+    osLight = false;
+    expect(run('auto')).toBe('dark');
+  });
+
+  it('ignores a stored value that is not a mode', () => {
+    localStorage.setItem('theme', 'purple');
+    osLight = true;
+    expect(run('auto')).toBe('light');
+  });
+
+  it('falls back to the configured mode when storage throws', () => {
+    vi.stubGlobal('localStorage', {
+      getItem: () => {
+        throw new Error('SecurityError');
+      },
+    });
+    expect(run('light')).toBe('light');
+  });
+
+  /** It is inlined as a string: a `</script>` inside would end it early. */
+  it('is safe to inline', () => {
+    expect(THEME_INIT_SCRIPT).not.toMatch(/<\/script/i);
+  });
+});
diff --git a/lib/__tests__/urls.test.ts b/lib/__tests__/urls.test.ts
index 3053d7e..5c43588 100644
--- a/lib/__tests__/urls.test.ts
+++ b/lib/__tests__/urls.test.ts
@@ -18,6 +18,7 @@ import {
   assetExifSummary,
   assetAspectRatio,
   assetCaption,
+  editMarker,
 } from '@/lib/urls';
 
 describe('imageUrl', () => {
@@ -32,6 +33,50 @@ describe('imageUrl', () => {
   });
 });
 
+describe('imageUrl for photos edited in Immich (#831)', () => {
+  const UPDATED = '2026-09-04T19:22:09.220Z';
+
+  it('adds the edit marker only for an edited photo', () => {
+    const marker = Math.floor(Date.parse(UPDATED) / 1000).toString(36);
+    expect(imageUrl({ id: 'id', isEdited: true, updatedAt: UPDATED })).toBe(
+      `/api/image/ENCODED_id?size=preview&e=${marker}`,
+    );
+    expect(imageUrl({ id: 'id', isEdited: true, updatedAt: UPDATED }, 'thumbnail')).toBe(
+      `/api/image/ENCODED_id?size=thumbnail&e=${marker}`,
+    );
+  });
+
+  it('leaves every other URL exactly as before', () => {
+    expect(imageUrl({ id: 'id', isEdited: false, updatedAt: UPDATED })).toBe(
+      '/api/image/ENCODED_id?size=preview',
+    );
+    expect(imageUrl({ id: 'id', updatedAt: UPDATED })).toBe('/api/image/ENCODED_id?size=preview');
+    expect(imageUrl({ id: 'id' })).toBe(imageUrl('id'));
+  });
+
+  it('changes the marker when the photo is edited again', () => {
+    const first = editMarker({ isEdited: true, updatedAt: UPDATED });
+    const again = editMarker({ isEdited: true, updatedAt: '2026-10-01T08:00:00.000Z' });
+    expect(first).toMatch(/^[0-9a-z]{1,16}$/);
+    expect(again).toMatch(/^[0-9a-z]{1,16}$/);
+    expect(again).not.toBe(first);
+  });
+
+  it('reveals the update time to the second only (review of #832)', () => {
+    const marker = editMarker({ isEdited: true, updatedAt: UPDATED });
+    expect(marker).toBe((Date.parse('2026-09-04T19:22:09Z') / 1000).toString(36));
+    expect(editMarker({ isEdited: true, updatedAt: '2026-09-04T19:22:09.999Z' })).toBe(marker);
+    expect(editMarker({ isEdited: true, updatedAt: '2026-09-04T19:22:10.000Z' })).not.toBe(marker);
+  });
+
+  it('still marks an edited photo whose update time is unknown', () => {
+    expect(editMarker({ isEdited: true })).toBe('1');
+    expect(editMarker({ isEdited: true, updatedAt: 'not a date' })).toBe('1');
+    expect(editMarker({ isEdited: false, updatedAt: UPDATED })).toBeNull();
+    expect(editMarker({})).toBeNull();
+  });
+});
+
 describe('exifUrl', () => {
   it('generates an EXIF API URL with encoded token', () => {
     expect(exifUrl('my-asset')).toBe('/api/exif/ENCODED_my-asset');
@@ -144,6 +189,68 @@ describe('assetAspectRatio', () => {
     expect(assetAspectRatio({ exifInfo: undefined })).toBeUndefined();
   });
 
+  /**
+   * #831, measured on Immich 3.2: EXIF keeps describing the stored file after
+   * an edit in Immich, while `width`/`height` follow the edit.
+   */
+  describe('a photo edited in Immich', () => {
+    const exif = (w: number, h: number, orientation: string | null = null) => ({
+      make: null,
+      model: null,
+      lensModel: null,
+      focalLength: null,
+      fNumber: null,
+      exposureTime: null,
+      iso: null,
+      exifImageWidth: w,
+      exifImageHeight: h,
+      orientation,
+      latitude: null,
+      longitude: null,
+      city: null,
+      state: null,
+      country: null,
+      dateTimeOriginal: null,
+      description: null,
+    });
+
+    it('takes a quarter turn from the edited size', () => {
+      // A scan stored 1076×723, rotated 270° in Immich: shown 723×1076.
+      expect(
+        assetAspectRatio({ isEdited: true, width: 723, height: 1076, exifInfo: exif(1076, 723) }),
+      ).toBeCloseTo(723 / 1076);
+    });
+
+    it('takes a crop from the edited size', () => {
+      // Stored 960×1280, cropped to 872×1132.
+      expect(
+        assetAspectRatio({ isEdited: true, width: 872, height: 1132, exifInfo: exif(960, 1280) }),
+      ).toBeCloseTo(872 / 1132);
+      // Stored 8064×6048 with orientation 6 (portrait), cropped to landscape.
+      expect(
+        assetAspectRatio({
+          isEdited: true,
+          width: 6048,
+          height: 4838,
+          exifInfo: exif(8064, 6048, '6'),
+        }),
+      ).toBeCloseTo(6048 / 4838);
+    });
+
+    it('keeps EXIF for a photo that is not edited', () => {
+      expect(
+        assetAspectRatio({ isEdited: false, width: 723, height: 1076, exifInfo: exif(3000, 2000) }),
+      ).toBe(1.5);
+    });
+
+    it('does not fall back to EXIF, which describes the unedited file (review of #832)', () => {
+      expect(assetAspectRatio({ isEdited: true, exifInfo: exif(3000, 2000) })).toBeUndefined();
+      expect(
+        assetAspectRatio({ isEdited: true, width: null, height: 0, exifInfo: exif(3000, 2000) }),
+      ).toBeUndefined();
+    });
+  });
+
   it('returns undefined when height is 0', () => {
     expect(
       assetAspectRatio({
diff --git a/lib/__tests__/yaml-write.test.ts b/lib/__tests__/yaml-write.test.ts
index ef98629..e563ade 100644
--- a/lib/__tests__/yaml-write.test.ts
+++ b/lib/__tests__/yaml-write.test.ts
@@ -11,7 +11,9 @@ vi.mock('fs/promises', () => ({
     unlink: vi.fn(async () => undefined),
     writeFile: vi.fn(async () => undefined),
     rename: vi.fn(async () => undefined),
-    readFile: vi.fn(),
+    readFile: vi.fn(async () => {
+      throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' });
+    }),
   },
 }));
 
@@ -95,7 +97,7 @@ describe('writeYamlFile backup failure', () => {
   });
 
   it('aborts the save when the file exists but the backup copy fails', async () => {
-    vi.mocked(fs.access).mockResolvedValueOnce(undefined);
+    vi.mocked(fs.readFile).mockResolvedValueOnce(Buffer.from('albums: []\n'));
     vi.mocked(fs.copyFile).mockRejectedValueOnce(
       Object.assign(new Error('EACCES'), { code: 'EACCES' }),
     );
@@ -105,7 +107,7 @@ describe('writeYamlFile backup failure', () => {
   });
 
   it('aborts when checking whether the file exists fails for a reason other than ENOENT', async () => {
-    vi.mocked(fs.access).mockRejectedValueOnce(
+    vi.mocked(fs.readFile).mockRejectedValueOnce(
       Object.assign(new Error('EACCES'), { code: 'EACCES' }),
     );
 
@@ -113,3 +115,24 @@ describe('writeYamlFile backup failure', () => {
     expect(fs.writeFile).not.toHaveBeenCalled();
   });
 });
+
+/**
+ * A save that changes nothing used to snapshot anyway; with ten backups kept,
+ * a few of those pushed the real ones out (QA A-19).
+ */
+describe('writeYamlFile no-op save', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('takes no backup when the file already holds exactly these bytes', async () => {
+    await writeGalleryYaml(gallery);
+    const written = vi.mocked(fs.writeFile).mock.calls[0][1] as string;
+
+    vi.mocked(fs.readFile).mockResolvedValueOnce(Buffer.from(written));
+    await writeGalleryYaml(gallery);
+    expect(fs.copyFile).not.toHaveBeenCalled();
+
+    vi.mocked(fs.readFile).mockResolvedValueOnce(Buffer.from(written + '# edited\n'));
+    await writeGalleryYaml(gallery);
+    expect(fs.copyFile).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/lib/__tests__/zipArchive.test.ts b/lib/__tests__/zipArchive.test.ts
index d0fb2e5..0057ecf 100644
--- a/lib/__tests__/zipArchive.test.ts
+++ b/lib/__tests__/zipArchive.test.ts
@@ -17,6 +17,7 @@ import {
   ARCHIVE_STALL_TIMEOUT_MS,
   MAX_CONCURRENT_ARCHIVES,
   __archivesInFlight,
+  entryDate,
   withArchiveSlot,
 } from '@/lib/zipArchive';
 import { immich, type ImmichAsset } from '@/lib/immich';
@@ -211,3 +212,55 @@ describe('archive stall timeout', () => {
     await vi.waitFor(() => expect(__archivesInFlight(ip)).toBe(0));
   });
 });
+
+/**
+ * F-16: every entry carried the time the ZIP was built. Each now carries the
+ * capture time, as the wall clock of the camera.
+ */
+describe('archive entry timestamps', () => {
+  /** The DOS date/time of every local file header, as `YYYY-MM-DD HH:MM:SS`. */
+  function entryTimes(bytes: Uint8Array): string[] {
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const out: string[] = [];
+    for (let i = 0; i + 30 <= bytes.length; i++) {
+      if (view.getUint32(i, true) !== 0x04034b50) continue;
+      const time = view.getUint16(i + 10, true);
+      const date = view.getUint16(i + 12, true);
+      const pad = (n: number) => String(n).padStart(2, '0');
+      out.push(
+        `${(date >> 9) + 1980}-${pad((date >> 5) & 15)}-${pad(date & 31)} ` +
+          `${pad(time >> 11)}:${pad((time >> 5) & 63)}:${pad((time & 31) * 2)}`,
+      );
+    }
+    return out;
+  }
+
+  it('dates each entry by when the photo was taken, on the camera clock', async () => {
+    const assets = [
+      {
+        id: 'a1',
+        originalFileName: 'a1.jpg',
+        // 14:30 in Berlin; the instant is 12:30 UTC.
+        localDateTime: '2024-05-01T14:30:10.000Z',
+        exifInfo: { dateTimeOriginal: '2024-05-01T12:30:10.000Z' },
+        fileCreatedAt: '2024-05-01T12:30:10.000Z',
+      },
+      {
+        id: 'a2',
+        originalFileName: 'a2.jpg',
+        exifInfo: { dateTimeOriginal: '2019-12-24T18:00:00.000Z' },
+        fileCreatedAt: '2020-01-01T00:00:00.000Z',
+      },
+      { id: 'a3', originalFileName: 'a3.jpg', fileCreatedAt: '2021-07-04T09:15:00.000Z' },
+    ] as unknown as ImmichAsset[];
+
+    const res = await start(freshIp(), assets);
+    const times = entryTimes(new Uint8Array(await res.arrayBuffer()));
+
+    expect(times).toEqual(['2024-05-01 14:30:10', '2019-12-24 18:00:00', '2021-07-04 09:15:00']);
+  });
+
+  it('falls back to the default for an asset with no usable date', () => {
+    expect(entryDate({ fileCreatedAt: 'not a date' } as unknown as ImmichAsset)).toBeUndefined();
+  });
+});
diff --git a/lib/__tests__/zoom-config.test.ts b/lib/__tests__/zoom-config.test.ts
new file mode 100644
index 0000000..a94b46f
--- /dev/null
+++ b/lib/__tests__/zoom-config.test.ts
@@ -0,0 +1,164 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('@/lib/env', () => ({
+  env: {
+    IMMICH_API_URL: 'http://localhost:2283',
+    IMMICH_API_KEY: 'test-key',
+    SITE_TITLE: 'Test',
+    SITE_SUBTITLE: '',
+    CACHE_TTL: 300,
+    RATE_LIMIT_RPM: 120,
+  },
+  normalizeApiUrl: (raw: string) => raw.replace(/\/+$/, ''),
+}));
+
+vi.mock('@/lib/secret', () => ({
+  resolveAuthSecret: () => 'test-auth-secret-32-chars-long-min',
+}));
+
+vi.mock('@/lib/config/parser', () => ({
+  loadYaml: vi.fn(),
+  clearYamlCache: vi.fn(),
+  validateUuid: (id: string) => id,
+}));
+
+import { deriveGallery, getConfig, invalidateConfigCache, resolveZoom } from '@/lib/config';
+import { loadYaml } from '@/lib/config/parser';
+import type { GalleryYaml } from '@/lib/config/schema';
+
+const A = '11111111-1111-1111-1111-111111111111';
+const B = '22222222-2222-2222-2222-222222222222';
+
+/**
+ * Lightbox zoom (#467): a site-wide switch in settings.yaml, off by default,
+ * overridden by a subpage and then by an album, each in either direction.
+ */
+describe('resolveZoom', () => {
+  const config = (zoom: boolean, standaloneAlbumZoom: Record<string, boolean> = {}) => ({
+    zoom,
+    standaloneAlbumZoom,
+  });
+
+  it('follows the site setting when nothing more specific is set', () => {
+    expect(resolveZoom(config(false), A)).toBe(false);
+    expect(resolveZoom(config(true), A)).toBe(true);
+    expect(resolveZoom(config(true), A, {})).toBe(true);
+  });
+
+  it('lets a subpage override the site, both ways', () => {
+    expect(resolveZoom(config(false), A, { zoom: true })).toBe(true);
+    expect(resolveZoom(config(true), A, { zoom: false })).toBe(false);
+  });
+
+  it('lets an album entry override its subpage and the site, both ways', () => {
+    expect(resolveZoom(config(false), A, { zoom: false, albumZoom: { [A]: true } })).toBe(true);
+    expect(resolveZoom(config(true), A, { zoom: true, albumZoom: { [A]: false } })).toBe(false);
+    // Only that album.
+    expect(resolveZoom(config(true), B, { zoom: true, albumZoom: { [A]: false } })).toBe(true);
+  });
+
+  it('reads the standalone override only for the standalone route', () => {
+    const c = config(true, { [A]: false });
+    expect(resolveZoom(c, A)).toBe(false);
+    // On a subpage the standalone entry has no say.
+    expect(resolveZoom(c, A, {})).toBe(true);
+  });
+});
+
+describe('deriveGallery keeps album zoom per route (review of #830)', () => {
+  /*
+   * The reported leak: one album on an open page with zoom off and on a
+   * password page with zoom on. A single map let the last entry decide for
+   * both, so the open page served zoom its owner had switched off.
+   */
+  const pages = (first: boolean) => {
+    const open = { name: 'Public', albums: [{ [A]: { zoom: false } }] };
+    const locked = { name: 'Client', password: 'pw', albums: [{ [A]: { zoom: true } }] };
+    return deriveGallery({ subpages: first ? [open, locked] : [locked, open] } as GalleryYaml);
+  };
+
+  it.each([true, false])('keeps each page’s own value (open page first: %s)', (openFirst) => {
+    const derived = pages(openFirst);
+    const open = derived.subpages.find((sp) => sp.slug === 'public')!;
+    const locked = derived.subpages.find((sp) => sp.slug === 'client')!;
+    const cfg = { zoom: false, standaloneAlbumZoom: derived.standaloneAlbumZoom };
+    expect(resolveZoom(cfg, A, open)).toBe(false);
+    expect(resolveZoom(cfg, A, locked)).toBe(true);
+  });
+
+  it('keeps a standalone entry apart from a subpage entry for the same album', () => {
+    const derived = deriveGallery({
+      albums: [{ [A]: { zoom: true } }],
+      subpages: [{ name: 'S', albums: [{ [A]: { zoom: false } }] }],
+    } as GalleryYaml);
+    expect(derived.standaloneAlbumZoom).toEqual({ [A]: true });
+    expect(derived.subpages[0].albumZoom).toEqual({ [A]: false });
+  });
+
+  it('collects section entries on their subpage, and false wins within one page', () => {
+    const derived = deriveGallery({
+      subpages: [
+        {
+          name: 'S',
+          albums: [{ [B]: { zoom: true } }],
+          sections: [
+            { title: 'One', albums: [{ [A]: { zoom: true } }] },
+            { title: 'Two', albums: [{ [A]: { zoom: false } }] },
+          ],
+        },
+        { name: 'T', albums: [A] },
+      ],
+    } as GalleryYaml);
+    expect(derived.subpages[0].albumZoom).toEqual({ [A]: false, [B]: true });
+    expect(derived.subpages[1].albumZoom).toBeUndefined();
+  });
+
+  it('ignores anything but a boolean', () => {
+    const odd = deriveGallery({ albums: [{ [A]: { zoom: 'yes' } }] } as unknown as GalleryYaml);
+    expect(odd.standaloneAlbumZoom).toEqual({});
+  });
+
+  it('keeps a subpage’s zoom in both gallery.yaml shapes', () => {
+    const list = deriveGallery({
+      subpages: [
+        { name: 'On', albums: [A], zoom: true },
+        { name: 'Off', albums: [B], zoom: false },
+        { name: 'Unset', albums: [A] },
+      ],
+    } as GalleryYaml);
+    expect(list.subpages.map((sp) => sp.zoom)).toEqual([true, false, undefined]);
+
+    const record = deriveGallery({
+      subpages: { Travel: { albums: [{ [A]: { zoom: false } }], zoom: true } },
+    } as unknown as GalleryYaml);
+    expect(record.subpages[0].zoom).toBe(true);
+    expect(record.subpages[0].albumZoom).toEqual({ [A]: false });
+  });
+});
+
+describe('the site setting', () => {
+  beforeEach(() => invalidateConfigCache());
+
+  const withSettings = (settings: Record<string, unknown>) =>
+    vi.mocked(loadYaml).mockImplementation((filename: string) => {
+      if (filename === 'gallery.yaml') return { albums: [{ [A]: { zoom: false } }] };
+      if (filename === 'settings.yaml') return settings;
+      return null;
+    });
+
+  it('is off unless settings.yaml says true', () => {
+    withSettings({});
+    expect(getConfig().zoom).toBe(false);
+    invalidateConfigCache();
+    withSettings({ zoom: 'true' });
+    expect(getConfig().zoom).toBe(false);
+    invalidateConfigCache();
+    withSettings({ zoom: true });
+    expect(getConfig().zoom).toBe(true);
+  });
+
+  it('carries the standalone album overrides into the config', () => {
+    withSettings({ zoom: true });
+    expect(getConfig().standaloneAlbumZoom).toEqual({ [A]: false });
+  });
+});
diff --git a/lib/__tests__/zoom.test.ts b/lib/__tests__/zoom.test.ts
new file mode 100644
index 0000000..340a84c
--- /dev/null
+++ b/lib/__tests__/zoom.test.ts
@@ -0,0 +1,203 @@
+import { describe, it, expect } from 'vitest';
+import {
+  FIT_VIEW,
+  canZoom,
+  clampView,
+  isZoomed,
+  maxZoomScale,
+  oneToOneScale,
+  panBy,
+  pinchView,
+  stepView,
+  toggleView,
+  TOUCH_ZOOM_MAX_PIXELS,
+  zoomFitsDevice,
+  zoomAround,
+  type FitBox,
+  type ZoomView,
+} from '../zoom';
+
+/**
+ * The lightbox zoom geometry (#467). A 1000×600 fit box centred in a
+ * 1200×800 viewport, showing a 6000×3600 photo: 1:1 is six times the fit size
+ * on a 1× screen, three times on a 2× one.
+ */
+const viewport = { width: 1200, height: 800 };
+const fit: FitBox = { cx: 600, cy: 400, width: 1000, height: 600 };
+const NATURAL = 6000;
+
+/** Where a photo point (offset from the box centre at fit) lands on screen. */
+const screenOf = (view: ZoomView, u: number, v: number) => ({
+  x: fit.cx + view.x + u * view.scale,
+  y: fit.cy + view.y + v * view.scale,
+});
+
+describe('1:1 scale', () => {
+  it('is one image pixel per device pixel', () => {
+    expect(oneToOneScale(NATURAL, 1000, 1)).toBe(6);
+    expect(oneToOneScale(NATURAL, 1000, 2)).toBe(3);
+    expect(oneToOneScale(NATURAL, 1000, 3)).toBe(2);
+  });
+
+  it('accounts for a fractional ratio', () => {
+    expect(oneToOneScale(NATURAL, 1000, 1.5)).toBeCloseTo(4);
+  });
+
+  it('treats a missing or nonsense ratio as 1', () => {
+    expect(oneToOneScale(NATURAL, 1000, 0)).toBe(6);
+    expect(oneToOneScale(NATURAL, 1000, NaN)).toBe(6);
+  });
+
+  it('never goes below fit', () => {
+    // A 1500px photo on a 3× screen is already shown beyond 1:1 at fit.
+    expect(oneToOneScale(1500, 1000, 3)).toBe(0.5);
+    expect(maxZoomScale(1500, 1000, 3)).toBe(1);
+    expect(canZoom(maxZoomScale(1500, 1000, 3))).toBe(false);
+    expect(canZoom(maxZoomScale(NATURAL, 1000, 2))).toBe(true);
+  });
+
+  it('is 1 when a size is unknown', () => {
+    expect(oneToOneScale(0, 1000, 1)).toBe(1);
+    expect(oneToOneScale(NATURAL, 0, 1)).toBe(1);
+  });
+});
+
+describe('clamping', () => {
+  const max = 6;
+
+  it('keeps the scale between fit and 1:1', () => {
+    expect(clampView({ scale: 10, x: 0, y: 0 }, fit, viewport, max).scale).toBe(6);
+    expect(clampView({ scale: 0.5, x: 30, y: 30 }, fit, viewport, max)).toEqual(FIT_VIEW);
+  });
+
+  it('never shows an empty band beside a photo larger than the viewport', () => {
+    // At 6× the box is 6000×3600: its left edge may go no further right than
+    // the viewport's left edge, and so on.
+    const v = clampView({ scale: 6, x: 99999, y: -99999 }, fit, viewport, max);
+    expect(fit.cx + v.x - (fit.width * 6) / 2).toBeCloseTo(0);
+    expect(fit.cy + v.y + (fit.height * 6) / 2).toBeCloseTo(viewport.height);
+  });
+
+  it('keeps a photo smaller than the viewport on screen, where it was', () => {
+    // 1.1× is 1100 wide in a 1200 viewport: it may move 50px either way.
+    const centred = clampView({ scale: 1.1, x: 0, y: 0 }, fit, viewport, max);
+    expect(centred.x).toBe(0);
+    const pushed = clampView({ scale: 1.1, x: 500, y: 0 }, fit, viewport, max);
+    expect(pushed.x).toBeCloseTo(50);
+  });
+
+  it('pans by a delta, within the same bounds', () => {
+    const start = { scale: 3, x: 0, y: 0 };
+    expect(panBy(start, 100, -50, fit, viewport, max)).toEqual({ scale: 3, x: 100, y: -50 });
+    // 3000 wide in 1200: at most 900 either side of centre.
+    expect(panBy(start, 5000, 0, fit, viewport, max).x).toBeCloseTo(900);
+  });
+});
+
+describe('zooming around a point', () => {
+  const max = 6;
+
+  it('keeps the photo point under the cursor where it was', () => {
+    const point = { x: 700, y: 450 };
+    // Photo point under the cursor at fit:
+    const u = point.x - fit.cx;
+    const v = point.y - fit.cy;
+    const next = zoomAround(FIT_VIEW, 3, point, fit, viewport, max);
+    expect(next.scale).toBe(3);
+    const after = screenOf(next, u, v);
+    expect(after.x).toBeCloseTo(point.x);
+    expect(after.y).toBeCloseTo(point.y);
+  });
+
+  it('keeps it fixed from an already zoomed, panned view too', () => {
+    const start = { scale: 2, x: -150, y: 80 };
+    const point = { x: 400, y: 300 };
+    const u = (point.x - fit.cx - start.x) / start.scale;
+    const v = (point.y - fit.cy - start.y) / start.scale;
+    const next = zoomAround(start, 4, point, fit, viewport, max);
+    const after = screenOf(next, u, v);
+    expect(after.x).toBeCloseTo(point.x);
+    expect(after.y).toBeCloseTo(point.y);
+  });
+
+  it('gives way to the clamp at the photo edge', () => {
+    // A point at the very corner cannot stay put without exposing the
+    // background, so the photo edge wins.
+    const next = zoomAround(FIT_VIEW, 6, { x: 100, y: 100 }, fit, viewport, max);
+    expect(fit.cx + next.x - (fit.width * 6) / 2).toBeCloseTo(0);
+  });
+
+  it('double-click goes to 1:1 at the point, and back to fit', () => {
+    const point = { x: 650, y: 420 };
+    const zoomed = toggleView(FIT_VIEW, point, fit, viewport, max);
+    expect(zoomed.scale).toBe(max);
+    expect(isZoomed(zoomed)).toBe(true);
+    const after = screenOf(zoomed, point.x - fit.cx, point.y - fit.cy);
+    expect(after.x).toBeCloseTo(point.x);
+    expect(toggleView(zoomed, point, fit, viewport, max)).toEqual(FIT_VIEW);
+  });
+
+  it('steps by a factor around the viewport centre, and snaps back to fit', () => {
+    const once = stepView(FIT_VIEW, 2, fit, viewport, max);
+    expect(once.scale).toBe(2);
+    expect(stepView(stepView(once, 2, fit, viewport, max), 2, fit, viewport, max).scale).toBe(6);
+    expect(stepView(once, 0.5, fit, viewport, max)).toEqual(FIT_VIEW);
+    expect(stepView(once, 0.51, fit, viewport, max)).toEqual(FIT_VIEW);
+  });
+});
+
+describe('pinch', () => {
+  const max = 6;
+
+  it('scales by how far the fingers spread, around their midpoint', () => {
+    const mid = { x: 640, y: 380 };
+    const next = pinchView(FIT_VIEW, mid, 100, mid, 250, fit, viewport, max);
+    expect(next.scale).toBeCloseTo(2.5);
+    const after = screenOf(next, mid.x - fit.cx, mid.y - fit.cy);
+    expect(after.x).toBeCloseTo(mid.x);
+    expect(after.y).toBeCloseTo(mid.y);
+  });
+
+  it('follows the midpoint as the fingers move', () => {
+    const startMid = { x: 600, y: 400 };
+    const mid = { x: 660, y: 430 };
+    const next = pinchView({ scale: 3, x: 0, y: 0 }, startMid, 100, mid, 100, fit, viewport, max);
+    expect(next).toEqual({ scale: 3, x: 60, y: 30 });
+  });
+
+  it('pinching back past fit lands on fit', () => {
+    const mid = { x: 600, y: 400 };
+    expect(pinchView({ scale: 2, x: 40, y: 0 }, mid, 200, mid, 50, fit, viewport, max)).toEqual(
+      FIT_VIEW,
+    );
+  });
+
+  it('cannot pinch beyond 1:1', () => {
+    const mid = { x: 600, y: 400 };
+    expect(pinchView(FIT_VIEW, mid, 10, mid, 1000, fit, viewport, max).scale).toBe(max);
+  });
+});
+
+describe('zoomFitsDevice (review of #830)', () => {
+  it('limits touch devices to 50 MP', () => {
+    expect(TOUCH_ZOOM_MAX_PIXELS).toBe(50_000_000);
+    // Leica Q3, 60 MP: not on a phone, fine with a mouse.
+    expect(zoomFitsDevice(9520, 6336, true)).toBe(false);
+    expect(zoomFitsDevice(9520, 6336, false)).toBe(true);
+    // iPhone, 12 MP; and exactly at the limit.
+    expect(zoomFitsDevice(4032, 3024, true)).toBe(true);
+    expect(zoomFitsDevice(10000, 5000, true)).toBe(true);
+  });
+
+  it('needs a size', () => {
+    expect(zoomFitsDevice(undefined, 100, false)).toBe(false);
+  });
+});
+
+describe('isZoomed', () => {
+  it('counts a hair above fit as fit', () => {
+    expect(isZoomed(FIT_VIEW)).toBe(false);
+    expect(isZoomed({ scale: 1.01, x: 0, y: 0 })).toBe(false);
+    expect(isZoomed({ scale: 1.5, x: 0, y: 0 })).toBe(true);
+  });
+});
diff --git a/lib/__tests__/zoomSource.test.ts b/lib/__tests__/zoomSource.test.ts
new file mode 100644
index 0000000..dfaae55
--- /dev/null
+++ b/lib/__tests__/zoomSource.test.ts
@@ -0,0 +1,143 @@
+import { describe, it, expect } from 'vitest';
+import { zoomDimensions, zoomSourceFor } from '../zoomSource';
+
+/**
+ * Which file the zoom may show (#467). The rule that matters most is the
+ * negative one: a format whose metadata the scrubber does not edit must never
+ * be served, whatever a browser could display.
+ */
+describe('zoomSourceFor', () => {
+  const image = (originalMimeType: string | null, originalFileName = 'x') => ({
+    type: 'IMAGE',
+    originalMimeType,
+    originalFileName,
+  });
+
+  it('serves JPEG and AVIF originals, which the scrubber cleans', () => {
+    expect(zoomSourceFor(image('image/jpeg'))).toBe('original');
+    expect(zoomSourceFor(image('image/jpg'))).toBe('original');
+    expect(zoomSourceFor(image('image/avif'))).toBe('original');
+    expect(zoomSourceFor(image('IMAGE/JPEG; charset=binary'))).toBe('original');
+  });
+
+  it('uses Immich’s rendition for what a browser cannot show', () => {
+    for (const mime of [
+      'image/heic',
+      'image/heif',
+      'image/x-adobe-dng',
+      'image/x-sony-arw',
+      'image/tiff',
+      'image/jxl',
+      'image/bmp',
+    ]) {
+      expect(zoomSourceFor(image(mime)), mime).toBe('fullsize');
+    }
+  });
+
+  it('never zooms PNG, WebP or GIF: their metadata would go out unscrubbed', () => {
+    for (const mime of ['image/png', 'image/webp', 'image/gif', 'image/svg+xml']) {
+      expect(zoomSourceFor(image(mime)), mime).toBeNull();
+    }
+  });
+
+  it('never zooms a video', () => {
+    expect(
+      zoomSourceFor({
+        type: 'VIDEO',
+        originalMimeType: 'video/quicktime',
+        originalFileName: 'a.mov',
+      }),
+    ).toBeNull();
+    // Even one mislabelled as an image type.
+    expect(zoomSourceFor({ type: 'VIDEO', originalMimeType: 'image/jpeg' })).toBeNull();
+  });
+
+  it('falls back to the file extension without a MIME type', () => {
+    expect(zoomSourceFor(image(null, 'L1001783.JPG'))).toBe('original');
+    expect(zoomSourceFor(image(null, 'export.avif'))).toBe('original');
+    expect(zoomSourceFor(image(null, 'IMG_6109.HEIC'))).toBe('fullsize');
+    expect(zoomSourceFor(image(null, 'scan.png'))).toBeNull();
+    expect(zoomSourceFor(image(null, 'no-extension'))).toBeNull();
+  });
+
+  it('zooms a photo edited in Immich into its edited rendition (#831)', () => {
+    // Immich serves the unedited file as the original: a crop would come
+    // undone. The edited full-size rendition matches the edited preview.
+    expect(zoomSourceFor({ ...image('image/jpeg'), isEdited: true })).toBe('edited');
+    expect(zoomSourceFor({ ...image('image/heic'), isEdited: true })).toBe('edited');
+    expect(zoomSourceFor({ ...image('image/jpeg'), isEdited: false })).toBe('original');
+    expect(zoomSourceFor({ ...image('image/heic'), isEdited: false })).toBe('fullsize');
+    // Edits never make a video zoomable.
+    expect(
+      zoomSourceFor({ type: 'VIDEO', originalMimeType: 'video/mp4', isEdited: true }),
+    ).toBeNull();
+  });
+
+  it('refuses a non-image MIME type on an image asset', () => {
+    expect(zoomSourceFor(image('application/octet-stream'))).toBeNull();
+  });
+});
+
+describe('zoomDimensions', () => {
+  it('gives an edited photo without its edited size no size at all (review of #832)', () => {
+    // EXIF describes the unedited file; a rotated photo would get the box of
+    // the unrotated one. No size means no zoom.
+    expect(
+      zoomDimensions({
+        isEdited: true,
+        exifInfo: { exifImageWidth: 1076, exifImageHeight: 723, orientation: null },
+      }),
+    ).toBeUndefined();
+  });
+
+  it('gives an edited photo its edited size, which is what its rendition has (#831)', () => {
+    // Measured on Immich 3.2: an iPhone HEIC stored 5712×4284 with
+    // orientation 6, turned back to landscape in Immich's editor. The edited
+    // full-size rendition is 5712×4284; EXIF alone would say 4284×5712.
+    expect(
+      zoomDimensions({
+        width: 5712,
+        height: 4284,
+        exifInfo: { exifImageWidth: 5712, exifImageHeight: 4284, orientation: '6' },
+      }),
+    ).toEqual({ width: 5712, height: 4284 });
+    // A crop: stored 8064×6048 (orientation 6), cropped to 6048×4838.
+    expect(
+      zoomDimensions({
+        width: 6048,
+        height: 4838,
+        exifInfo: { exifImageWidth: 8064, exifImageHeight: 6048, orientation: '6' },
+      }),
+    ).toEqual({ width: 6048, height: 4838 });
+  });
+
+  it('prefers Immich’s upright width and height', () => {
+    expect(
+      zoomDimensions({
+        width: 3024,
+        height: 4032,
+        exifInfo: { exifImageWidth: 4032, exifImageHeight: 3024, orientation: '6' },
+      }),
+    ).toEqual({ width: 3024, height: 4032 });
+  });
+
+  it('turns EXIF dimensions for a quarter-turn orientation', () => {
+    expect(
+      zoomDimensions({
+        exifInfo: { exifImageWidth: 4032, exifImageHeight: 3024, orientation: '6' },
+      }),
+    ).toEqual({ width: 3024, height: 4032 });
+    expect(
+      zoomDimensions({
+        exifInfo: { exifImageWidth: 7242, exifImageHeight: 4294, orientation: null },
+      }),
+    ).toEqual({ width: 7242, height: 4294 });
+  });
+
+  it('is undefined when nothing is known', () => {
+    expect(zoomDimensions({})).toBeUndefined();
+    expect(
+      zoomDimensions({ exifInfo: { exifImageWidth: 0, exifImageHeight: 10 } }),
+    ).toBeUndefined();
+  });
+});
diff --git a/lib/admin/contentVersion.ts b/lib/admin/contentVersion.ts
index 1d3c44b..77b2346 100644
--- a/lib/admin/contentVersion.ts
+++ b/lib/admin/contentVersion.ts
@@ -60,6 +60,19 @@ export async function fileVersion(filePath: string): Promise<string> {
   }
 }
 
+/**
+ * Whether a save of `content` has to back up the file at `filePath` first:
+ * not when there is no file yet, and not when the file already holds exactly
+ * these bytes. A save that changes nothing used to snapshot anyway, and with
+ * ten backups kept per file, a few no-op saves pushed out the real ones
+ * (QA A-19). Only ENOENT counts as "no file"; any other failure to read it
+ * throws, so the save stops before it overwrites the live file (#630).
+ */
+export async function needsBackup(filePath: string, content: string): Promise<boolean> {
+  const onDisk = await fileVersion(filePath);
+  return onDisk !== ABSENT_VERSION && onDisk !== versionOf(content);
+}
+
 /** The file changed on disk since the editor loaded it. */
 export class VersionConflictError extends Error {
   constructor(readonly currentVersion: string) {
diff --git a/lib/admin/doctor.ts b/lib/admin/doctor.ts
index 03c43a4..ce36dda 100644
--- a/lib/admin/doctor.ts
+++ b/lib/admin/doctor.ts
@@ -314,6 +314,124 @@ export function checkAlbumsShared(configured: string[], known: AlbumRef[]): Doct
   };
 }
 
+/** What the doctor needs to know about one album that offers downloads. */
+export interface DownloadAlbumRef {
+  id: string;
+  albumName: string;
+  /** Assets in a format whose metadata the download cannot clean (RAW, PNG, video, …). */
+  uncleanable: number;
+  /** Of those, how many Immich has coordinates for. */
+  uncleanableWithLocation: number;
+}
+
+/**
+ * Downloads remove GPS from JPEG, HEIC/HEIF and AVIF originals
+ * (lib/locationScrub.ts). Every other format is served exactly as Immich
+ * stores it, so an album that offers downloads and holds such files hands out
+ * whatever location they carry. The route decides which assets are cleanable;
+ * this module stays import-free for `npm run doctor`. Returns null while no
+ * album offers downloads.
+ */
+export function checkDownloadMetadata(albums: DownloadAlbumRef[]): DoctorFinding | null {
+  if (!albums.length) return null;
+  const affected = albums.filter((a) => a.uncleanable > 0);
+
+  if (!affected.length) {
+    return {
+      id: 'download-metadata',
+      level: 'ok',
+      title: 'Downloads go out without GPS',
+      detail: `Every original in the ${albums.length === 1 ? 'download album' : `${albums.length} download albums`} is JPEG, HEIC or AVIF, and is served with its location removed.`,
+    };
+  }
+
+  const files = affected.reduce((n, a) => n + a.uncleanable, 0);
+  const located = affected.reduce((n, a) => n + a.uncleanableWithLocation, 0);
+  return {
+    id: 'download-metadata',
+    level: 'warn',
+    title: `${files} downloadable ${files === 1 ? 'original keeps' : 'originals keep'} all metadata`,
+    detail:
+      'RAW, DNG, PNG, TIFF, WebP and video files are served exactly as stored, with any GPS ' +
+      `coordinates${located ? ` (Immich has a location for ${located} of them)` : ''}. ` +
+      'Turn off downloads or remove these files if their location should stay private: ' +
+      affected.map((a) => `${a.albumName} (${a.uncleanable})`).join(', '),
+    albumIds: affected.map((a) => a.id),
+  };
+}
+
+/** What the doctor needs to know about one album with lightbox zoom on (#467). */
+export interface ZoomAlbumRef {
+  id: string;
+  albumName: string;
+  /** Photos zoomed through Immich's full-size rendition (HEIC, RAW, TIFF, …). */
+  needRendition: number;
+}
+
+/**
+ * What the sampled full-size rendition turned out to be: `ok` (JPEG, which the
+ * zoom route serves), `missing` (Immich has none), or the content type of one
+ * the route refuses — a WebP rendition, when Immich's full-size format is set
+ * to WebP, since the location scrubber cannot clean WebP.
+ */
+export type ZoomRenditionSample = 'ok' | 'missing' | { contentType: string };
+
+/**
+ * Zoom shows JPEG and AVIF originals directly, but everything a browser cannot
+ * display needs Immich's full-size rendition, which Immich only generates while
+ * "Full-size image" is on in its image settings, and which the zoom route only
+ * serves as JPEG. Immich does not say whether a rendition exists until one is
+ * asked for, so the route samples one photo and passes what it found (null
+ * when it could not ask).
+ *
+ * Returns null when no zoom album holds such photos, or nothing is known.
+ */
+export function checkZoomRenditions(
+  albums: ZoomAlbumRef[],
+  sample: ZoomRenditionSample | null,
+): DoctorFinding | null {
+  const affected = albums.filter((a) => a.needRendition > 0);
+  if (!affected.length || sample === null) return null;
+  const photos = affected.reduce((n, a) => n + a.needRendition, 0);
+  const noun = photos === 1 ? 'photo' : 'photos';
+  const albumList = affected.map((a) => `${a.albumName} (${a.needRendition})`).join(', ');
+
+  if (sample === 'ok') {
+    return {
+      id: 'zoom-renditions',
+      level: 'ok',
+      title: 'Immich has full-size previews for zoom',
+      detail: `${photos} HEIC, RAW or similar ${noun} in zoom albums are zoomed through Immich's full-size rendition, with the location removed.`,
+    };
+  }
+  if (sample === 'missing') {
+    return {
+      id: 'zoom-renditions',
+      level: 'warn',
+      title: `${photos} ${noun} cannot be zoomed: Immich has no full-size preview`,
+      detail:
+        'HEIC, RAW and other formats a browser cannot show are zoomed through Immich’s full-size ' +
+        'rendition, and Immich has none (one photo sampled). Visitors see the zoom button and then ' +
+        '"not available". In Immich, turn on Administration › Settings › Image Settings › Full-size ' +
+        'image (JPEG), then run the Generate Thumbnails job for missing assets. Albums: ' +
+        albumList,
+      albumIds: affected.map((a) => a.id),
+    };
+  }
+  return {
+    id: 'zoom-renditions',
+    level: 'warn',
+    title: `${photos} ${noun} cannot be zoomed: Immich's full-size format is not JPEG`,
+    detail:
+      `Immich renders its full-size previews as ${sample.contentType || 'an unknown type'}, and ` +
+      'zoom only serves JPEG renditions — their location metadata is removed on the way out, which ' +
+      'Folio cannot do for WebP. Set Administration › Settings › Image Settings › Full-size image ' +
+      '› Format to JPEG, then run the Generate Thumbnails job. Albums: ' +
+      albumList,
+    albumIds: affected.map((a) => a.id),
+  };
+}
+
 /** One set of albums that will all be reachable under the same URL prefix. */
 export interface AlbumSlugGroup {
   /** e.g. "gallery.yaml albums" or `subpage "Trips"` */
@@ -567,18 +685,29 @@ export function checkContact(
 const SETTING_SECTIONS: Record<string, string> = {
   url: 'seo',
   'theme.accent': 'theme',
+  'theme.radius': 'theme',
   'grid.columns': 'grid',
   'grid.gap': 'grid',
+  'contact.retentionDays': 'legal',
+  navLinks: 'footer',
 };
 
 /** Human names for the same fields, for the finding's text. */
 const SETTING_LABELS: Record<string, string> = {
   url: 'Site URL',
   'theme.accent': 'accent colour',
+  'theme.radius': 'corner radius',
   'grid.columns': 'grid columns',
   'grid.gap': 'grid gap',
+  'contact.retentionDays': 'message retention',
+  navLinks: 'header links',
 };
 
+/** `navLinks.2.url` → `navLinks`: every header-link error is one setting. */
+function settingKey(field: string): string {
+  return field.startsWith('navLinks.') ? 'navLinks' : field;
+}
+
 /**
  * Values in settings.yaml the site does not use as written — an accent that is
  * not hex, a column count outside 1–6, a site URL that is not a full address.
@@ -592,21 +721,23 @@ export function checkSettingValues(errors: Array<{ field: string }>): DoctorFind
       id: 'settings-values',
       level: 'ok',
       title: 'Settings are used as written',
-      detail: 'Site URL, accent colour and grid values in settings.yaml are all valid.',
+      detail:
+        'Site URL, theme, grid, message retention and header links in settings.yaml are all valid.',
     };
   }
-  const names = errors.map((e) => SETTING_LABELS[e.field] ?? e.field);
+  const keys = [...new Set(errors.map((e) => settingKey(e.field)))];
+  const names = keys.map((key) => SETTING_LABELS[key] ?? key);
   return {
     id: 'settings-values',
     level: 'warn',
     title:
-      errors.length === 1
+      names.length === 1
         ? `The ${names[0]} setting is ignored`
-        : `${errors.length} settings are ignored`,
+        : `${names.length} settings are ignored`,
     detail:
       `settings.yaml holds a value the site cannot use for: ${names.join(', ')}. ` +
-      'It falls back to the default instead. Open the setting to see what it expects.',
-    settingsSection: SETTING_SECTIONS[errors[0].field],
+      'The site uses a default or the nearest allowed value instead. Open the setting to see what it expects.',
+    settingsSection: SETTING_SECTIONS[keys[0]],
   };
 }
 
diff --git a/lib/admin/journal-service.ts b/lib/admin/journal-service.ts
index dc624ea..9b53272 100644
--- a/lib/admin/journal-service.ts
+++ b/lib/admin/journal-service.ts
@@ -7,7 +7,13 @@ import fs from 'fs/promises';
 import nodeFs from 'fs';
 import path from 'path';
 import { atomicWrite } from '../atomicWrite';
-import { assertVersion, readVersioned, serializeContentWrite, versionOf } from './contentVersion';
+import {
+  assertVersion,
+  needsBackup,
+  readVersioned,
+  serializeContentWrite,
+  versionOf,
+} from './contentVersion';
 import { ParsedFileCache } from './parsedFileCache';
 import {
   parseJournalMarkdown,
@@ -296,16 +302,9 @@ export async function writeJournalEntry(slug: string, rawMarkdown: string): Prom
   // catch, so a `.backups/` a save couldn't write to looked exactly like a
   // brand-new entry: the save went ahead with no snapshot taken (#630). Only
   // ENOENT means there is nothing to back up; anything else aborts the save
-  // before it overwrites the live file.
-  let fileExists = true;
-  try {
-    await fs.access(filePath);
-  } catch (err) {
-    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err;
-    fileExists = false;
-  }
-
-  if (fileExists) {
+  // before it overwrites the live file. A save that changes nothing takes no
+  // backup either (needsBackup).
+  if (await needsBackup(filePath, rawMarkdown)) {
     await snapshotEntry(filePath, filename);
     await pruneEntryBackups(filename);
   }
@@ -378,12 +377,56 @@ export async function deleteJournalEntry(slug: string): Promise<boolean> {
   return deletedAny;
 }
 
+/**
+ * Move an entry to a new slug with new content: snapshot the old file under
+ * the new name, write the new file, then remove the old one from both
+ * content/journal/ and the legacy content/essays/. The route has already
+ * refused a rename onto an existing entry.
+ */
+async function renameJournalEntry(
+  fromSlug: string,
+  slug: string,
+  rawMarkdown: string,
+): Promise<void> {
+  if (!isValidSlug(fromSlug)) throw new Error(`Invalid journal slug: "${fromSlug}"`);
+  const fromFilename = `${fromSlug}.md`;
+  const fromPaths = [
+    containedPath(JOURNAL_DIR, fromFilename),
+    containedPath(LEGACY_ESSAYS_DIR, fromFilename),
+  ].filter((p): p is string => p !== null);
+  const existing: string[] = [];
+  for (const p of fromPaths) {
+    try {
+      await fs.access(p);
+      existing.push(p);
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err;
+    }
+  }
+  // The copy resolveJournalFilePath reads — content/journal/ over essays/.
+  if (existing.length > 0) {
+    await snapshotEntry(existing[0], `${slug}.md`);
+    await pruneEntryBackups(`${slug}.md`);
+  }
+  await writeJournalEntry(slug, rawMarkdown);
+  for (const p of existing) {
+    await fs.unlink(p).catch((err: NodeJS.ErrnoException) => {
+      if (err.code !== 'ENOENT') throw err;
+    });
+  }
+  if (existing.length > 0) console.log(`[Journal] ✏️ Renamed ${fromFilename} to ${slug}.md`);
+}
+
 /**
  * The editor's save (#601): write `slug`, refusing with a VersionConflictError
  * when the file the editor loaded — `fromSlug`'s, for a rename — is no longer
  * at `baseVersion`. A rename writes the new file and then deletes the old one.
  * Check, write and delete run in the content write queue, so another save
  * cannot land between them. Returns the version of what was written.
+ *
+ * A rename takes the entry's history along: the version before it is kept as
+ * a save backup of the new slug, not as a `.deleted` snapshot of the old one,
+ * which the Backup Manager listed as a deleted entry (QA A-19).
  */
 export function saveJournalEntry(
   slug: string,
@@ -397,8 +440,11 @@ export function saveJournalEntry(
       if (!loaded) throw new Error(`Invalid journal entry slug: "${fromSlug}"`);
       await assertVersion(loaded, options.baseVersion);
     }
-    await writeJournalEntry(slug, rawMarkdown);
-    if (fromSlug !== slug) await deleteJournalEntry(fromSlug);
+    if (fromSlug === slug) {
+      await writeJournalEntry(slug, rawMarkdown);
+    } else {
+      await renameJournalEntry(fromSlug, slug, rawMarkdown);
+    }
     return versionOf(rawMarkdown);
   });
 }
diff --git a/lib/admin/pages-service.ts b/lib/admin/pages-service.ts
index 1ceab91..898173c 100644
--- a/lib/admin/pages-service.ts
+++ b/lib/admin/pages-service.ts
@@ -11,7 +11,13 @@ import fs from 'fs/promises';
 import nodeFs from 'fs';
 import path from 'path';
 import { atomicWrite } from '../atomicWrite';
-import { assertVersion, readVersioned, serializeContentWrite, versionOf } from './contentVersion';
+import {
+  assertVersion,
+  needsBackup,
+  readVersioned,
+  serializeContentWrite,
+  versionOf,
+} from './contentVersion';
 import { isValidSlug, parseJournalMarkdown, type ParsedJournal } from '../journal';
 import type { PageSummary } from '../pages';
 import { ParsedFileCache } from './parsedFileCache';
@@ -199,15 +205,9 @@ export async function writePage(slug: string, rawMarkdown: string): Promise<void
   await fs.mkdir(pagesDir(), { recursive: true });
 
   // Only ENOENT means "nothing to back up"; any other failure aborts the save
-  // before it overwrites the live file (the journal's #630).
-  let exists = true;
-  try {
-    await fs.access(filePath);
-  } catch (err) {
-    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err;
-    exists = false;
-  }
-  if (exists) {
+  // before it overwrites the live file (the journal's #630). A save that
+  // changes nothing takes no backup either (needsBackup).
+  if (await needsBackup(filePath, rawMarkdown)) {
     await snapshotPage(filePath, filename);
     await prunePageBackups(filename);
   }
@@ -234,6 +234,33 @@ export async function deletePage(slug: string): Promise<boolean> {
   return true;
 }
 
+/**
+ * Move a page to a new slug with new content. The old file is snapshotted
+ * under the new name first, then the new file is written, then the old one
+ * removed — a failure part way leaves the old page in place. The route has
+ * already refused a rename onto an existing page.
+ */
+async function renamePage(fromSlug: string, slug: string, rawMarkdown: string): Promise<void> {
+  const fromPath = resolvePageFilePath(fromSlug);
+  if (!fromPath) throw new Error(`Invalid page slug: "${fromSlug}"`);
+  let fromExists = true;
+  try {
+    await fs.access(fromPath);
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err;
+    fromExists = false;
+  }
+  if (fromExists) {
+    await snapshotPage(fromPath, `${slug}.md`);
+    await prunePageBackups(`${slug}.md`);
+  }
+  await writePage(slug, rawMarkdown);
+  if (fromExists) {
+    await fs.unlink(fromPath);
+    console.log(`[Pages] ✏️ Renamed ${fromSlug}.md to ${slug}.md`);
+  }
+}
+
 /** Restore a page from one of its backups, returning the restored slug. */
 export async function restorePageBackup(backupFilename: string): Promise<string> {
   const match = PAGE_BACKUP_NAME.exec(backupFilename);
@@ -265,6 +292,11 @@ export async function restorePageBackup(backupFilename: string): Promise<string>
  * at `baseVersion`. A rename writes the new file and then deletes the old one.
  * Check, write and delete run in the content write queue, so another save
  * cannot land between them. Returns the version of what was written.
+ *
+ * A rename takes the page's history along: the version before it is kept as
+ * a save backup of the new slug, not as a `.deleted` snapshot of the old one.
+ * The Backup Manager used to list every rename as a deleted page, whose
+ * restore brought the old slug back next to the renamed page (QA A-19).
  */
 export function savePage(
   slug: string,
@@ -278,8 +310,11 @@ export function savePage(
       if (!loaded) throw new Error(`Invalid page slug: "${fromSlug}"`);
       await assertVersion(loaded, options.baseVersion);
     }
-    await writePage(slug, rawMarkdown);
-    if (fromSlug !== slug) await deletePage(fromSlug);
+    if (fromSlug === slug) {
+      await writePage(slug, rawMarkdown);
+    } else {
+      await renamePage(fromSlug, slug, rawMarkdown);
+    }
     return versionOf(rawMarkdown);
   });
 }
diff --git a/lib/admin/proofing-view.ts b/lib/admin/proofing-view.ts
index 609f21e..cbd14d5 100644
--- a/lib/admin/proofing-view.ts
+++ b/lib/admin/proofing-view.ts
@@ -86,7 +86,7 @@ export function picksFor(session: ProofSession, album: ImmichAlbum | null): Admi
       assetId: asset.id,
       position: index + 1,
       fileName: asset.originalFileName,
-      thumbUrl: imageUrl(asset.id, 'thumbnail'),
+      thumbUrl: imageUrl(asset, 'thumbnail'),
       ...(asset.localDateTime || asset.fileCreatedAt
         ? { takenAt: asset.localDateTime ?? asset.fileCreatedAt }
         : {}),
diff --git a/lib/admin/yaml-service.ts b/lib/admin/yaml-service.ts
index 276a96e..a55fc30 100644
--- a/lib/admin/yaml-service.ts
+++ b/lib/admin/yaml-service.ts
@@ -8,7 +8,13 @@ import path from 'path';
 import yaml from 'js-yaml';
 import { atomicWrite } from '../atomicWrite';
 import type { GalleryYaml, SettingsYaml } from '../config/schema';
-import { assertVersion, readVersioned, serializeContentWrite, versionOf } from './contentVersion';
+import {
+  assertVersion,
+  needsBackup,
+  readVersioned,
+  serializeContentWrite,
+  versionOf,
+} from './contentVersion';
 
 const CONTENT_DIR = path.join(process.cwd(), 'content');
 const MAX_BACKUPS = 10; // Keep last 10 backups per file
@@ -73,32 +79,6 @@ async function writeYamlFileNow(
   // Ensure content directory exists
   await fs.mkdir(CONTENT_DIR, { recursive: true });
 
-  // "No file yet" and "the backup could not be written" used to share one
-  // catch, so a `.backups/` a save couldn't write to (owned by root after a
-  // first start as root, say) looked exactly like a brand-new file: the save
-  // went ahead with no snapshot taken (#630). Only ENOENT means there is
-  // nothing to back up; anything else aborts the save before it overwrites
-  // the live file.
-  let fileExists = true;
-  try {
-    await fs.access(filePath);
-  } catch (err) {
-    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err;
-    fileExists = false;
-  }
-
-  if (fileExists) {
-    const backupDir = path.join(CONTENT_DIR, '.backups');
-    await fs.mkdir(backupDir, { recursive: true });
-
-    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
-    const backupName = `${filename}.${timestamp}.bak`;
-    await fs.copyFile(filePath, path.join(backupDir, backupName));
-
-    // Prune old backups
-    await pruneBackups(backupDir, filename);
-  }
-
   // Generate YAML content with header comment
   const header =
     filename === 'gallery.yaml'
@@ -114,6 +94,25 @@ async function writeYamlFileNow(
       sortKeys: false,
     });
 
+  // "No file yet" and "the backup could not be written" used to share one
+  // catch, so a `.backups/` a save couldn't write to (owned by root after a
+  // first start as root, say) looked exactly like a brand-new file: the save
+  // went ahead with no snapshot taken (#630). Only ENOENT means there is
+  // nothing to back up; anything else aborts the save before it overwrites
+  // the live file.
+  // A save that changes nothing takes no backup either (needsBackup).
+  if (await needsBackup(filePath, content)) {
+    const backupDir = path.join(CONTENT_DIR, '.backups');
+    await fs.mkdir(backupDir, { recursive: true });
+
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const backupName = `${filename}.${timestamp}.bak`;
+    await fs.copyFile(filePath, path.join(backupDir, backupName));
+
+    // Prune old backups
+    await pruneBackups(backupDir, filename);
+  }
+
   await atomicWrite(filePath, content);
 
   console.log(`[Admin] ✅ Saved ${filename}`);
diff --git a/lib/auth.ts b/lib/auth.ts
index 17701b9..9eda089 100644
--- a/lib/auth.ts
+++ b/lib/auth.ts
@@ -11,7 +11,7 @@ import crypto from 'crypto';
 import { getConfig, SubpageConfig } from './config';
 // From the pure schema module, not the config barrel: tests that stub out
 // '@/lib/config' wholesale would otherwise lose this helper.
-import { normalizeSlug } from './config/schema';
+import { normalizeSlug, resolveZoom } from './config/schema';
 import { verifyScrypt, generateScryptHash, isScryptHash, burnScrypt } from './password';
 
 const TOKEN_EXPIRY_HOURS = 24;
@@ -140,6 +140,41 @@ export function isAlbumReachable(
   return routes.some((sp) => isAuthenticated(sp.slug, getCookie, 'subpage'));
 }
 
+/**
+ * Whether this visitor may zoom into the album's photos (#467): there is a
+ * route to the album they could have taken — every gate on it satisfied, as in
+ * isAlbumReachable() — on which zoom resolves on.
+ *
+ * Per route, not per album: zoom is resolved against the subpage an album is
+ * shown on, and an album listed on two subpages can have it on one and off on
+ * the other. Asking "is zoom on anywhere" and "can the visitor get in
+ * anywhere" separately would let a visitor through an open subpage that has
+ * zoom off, on the strength of a locked one that has it on. The album entry's
+ * own override is per route too (resolveZoom).
+ *
+ * Essay subpages are not excluded. The essay itself offers no zoom, but each
+ * of its albums is still reachable as an album page at /<subpage>/<album>,
+ * which offers zoom by exactly this rule. The route answers what that page
+ * offers; refusing it here would break zoom there.
+ */
+export function isAlbumZoomReachable(
+  albumId: string,
+  getCookie: (name: string) => string | undefined,
+): boolean {
+  if (!isAuthenticated(albumId, getCookie, 'album')) return false;
+
+  const config = getConfig();
+  if (config.standaloneAlbums?.includes(albumId) && resolveZoom(config, albumId)) return true;
+
+  return config.subpages.some(
+    (sp) =>
+      sp.enabled !== false &&
+      sp.albumIds.includes(albumId) &&
+      resolveZoom(config, albumId, sp) &&
+      isAuthenticated(sp.slug, getCookie, 'subpage'),
+  );
+}
+
 /**
  * The albums this visitor may see the photographs of: every album without a
  * password of its own, plus the ones already unlocked.
diff --git a/lib/config/index.ts b/lib/config/index.ts
index d1fe25e..8b0f21b 100644
--- a/lib/config/index.ts
+++ b/lib/config/index.ts
@@ -277,6 +277,8 @@ export interface GalleryDerivation {
   albumGrids: Record<string, Partial<GridConfig>>;
   albumCoverPositions: Record<string, string>;
   albumDownloads: Record<string, boolean>;
+  /** Album zoom overrides on the standalone entries; subpages carry their own. */
+  standaloneAlbumZoom: Record<string, boolean>;
   albumLocationPrecision: Record<string, LocationPrecision>;
 }
 
@@ -302,6 +304,13 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
   const albumGrids: Record<string, Partial<GridConfig>> = {};
   const albumCoverPositions: Record<string, string> = {};
   const albumDownloads: Record<string, boolean> = {};
+  /**
+   * Per-album zoom overrides (#467), one map per route: the standalone entries
+   * here, each subpage's (sections included) on the subpage. An album listed on
+   * two pages can be zoomable on one and not the other; a single map would let
+   * whichever entry came last decide for both.
+   */
+  const standaloneAlbumZoom: Record<string, boolean> = {};
   const albumLocationPrecision: Record<string, LocationPrecision> = {};
 
   /** Returns null for an entry whose album ID is not a UUID; callers drop it. */
@@ -309,6 +318,7 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
     entry: string | Record<string, string | AlbumEntryObject>,
     context: string,
     inheritedLocation?: LocationPrecision,
+    zoomSink?: Record<string, boolean>,
   ): string | null {
     if (typeof entry === 'string') {
       if (inheritedLocation) albumLocationPrecision[entry] = inheritedLocation;
@@ -396,6 +406,13 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
       // handing out full-resolution originals because one client gallery
       // needed to (#475).
       if (value.download === true) albumDownloads[validatedUuid] = true;
+      // Both values mean something: `false` switches zoom off here even where
+      // the subpage or the site has it on (#467). Anything else is ignored.
+      // Written to the route this entry is on. Listed twice on one route (two
+      // sections of a page), the cautious answer wins: `false` stays `false`.
+      if (zoomSink && typeof value.zoom === 'boolean') {
+        zoomSink[validatedUuid] = zoomSink[validatedUuid] !== false && value.zoom;
+      }
       const location = parseLocation(value.location, `${context}: album ${validatedUuid} location`);
       if (location) albumLocationPrecision[validatedUuid] = location;
     }
@@ -407,9 +424,10 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
     entries: Array<string | Record<string, string | AlbumEntryObject>>,
     context: string,
     inheritedLocation?: LocationPrecision,
+    zoomSink?: Record<string, boolean>,
   ): string[] {
     return entries
-      .map((entry) => processAlbumEntry(entry, context, inheritedLocation))
+      .map((entry) => processAlbumEntry(entry, context, inheritedLocation, zoomSink))
       .filter((id): id is string => id !== null);
   }
 
@@ -429,7 +447,12 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
     return raw;
   }
 
-  const standaloneAlbumIds = processAlbumEntries(gallery.albums ?? [], 'gallery.yaml albums');
+  const standaloneAlbumIds = processAlbumEntries(
+    gallery.albums ?? [],
+    'gallery.yaml albums',
+    undefined,
+    standaloneAlbumZoom,
+  );
 
   let subpages: SubpageConfig[] = [];
   /** Menu order, subpages and `- page:` references interleaved (#722). */
@@ -465,6 +488,9 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
         throw new Error(`Subpage "(unnamed)" must have a name`);
       }
 
+      // This page's own album zoom overrides, sections included (#467).
+      const albumZoom: Record<string, boolean> = {};
+
       // Parse sections if present
       let sections: SubpageSectionConfig[] | undefined;
       let albumIds: string[];
@@ -478,6 +504,7 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
             sec.albums,
             `subpage "${sp.name}" section "${sec.title}"`,
             parseLocation(sp.location, `subpage "${sp.name}" location`),
+            albumZoom,
           ),
         }));
         // flat union of all section albums
@@ -487,6 +514,7 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
           sp.albums ?? [],
           `subpage "${sp.name}"`,
           parseLocation(sp.location, `subpage "${sp.name}" location`),
+          albumZoom,
         );
         albumIds = [...topLevel, ...albumIds];
       } else {
@@ -498,6 +526,7 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
           albums,
           `subpage "${sp.name}"`,
           parseLocation(sp.location, `subpage "${sp.name}" location`),
+          albumZoom,
         );
       }
 
@@ -510,6 +539,8 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
         sections,
         password: sp.password,
         proofing: sp.proofing,
+        zoom: typeof sp.zoom === 'boolean' ? sp.zoom : undefined,
+        ...(Object.keys(albumZoom).length ? { albumZoom } : {}),
         essayFile: sp.essayFile,
         essayText: sp.essayText,
         enabled: sp.enabled !== false,
@@ -533,6 +564,7 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
       }
       const sp = value as SubpageObjectValue;
       const albumEntries = sp.albums || [];
+      const albumZoom: Record<string, boolean> = {};
       return {
         name,
         slug: slugify(name),
@@ -542,9 +574,12 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
           albumEntries,
           `subpage "${name}"`,
           parseLocation(sp.location, `subpage "${name}" location`),
+          albumZoom,
         ),
         password: sp.password,
         proofing: sp.proofing,
+        zoom: typeof sp.zoom === 'boolean' ? sp.zoom : undefined,
+        ...(Object.keys(albumZoom).length ? { albumZoom } : {}),
         essayFile: sp.essayFile,
         essayText: sp.essayText,
         enabled: sp.enabled !== false,
@@ -618,6 +653,7 @@ export function deriveGallery(gallery: GalleryYaml): GalleryDerivation {
     albumGrids,
     albumCoverPositions,
     albumDownloads,
+    standaloneAlbumZoom,
     albumLocationPrecision,
   };
 }
@@ -740,6 +776,7 @@ function deriveConfig(): AppConfig {
       analytics: true,
       proofing: { enabled: false, allowMailto: false },
       aboutEnabled: true,
+      zoom: false,
       albumOverrides: {},
       albumDescriptions: {},
       albumPasswords: {},
@@ -749,6 +786,7 @@ function deriveConfig(): AppConfig {
       albumGrids: {},
       albumCoverPositions: {},
       albumDownloads: {},
+      standaloneAlbumZoom: {},
       albumLocationPrecision: {},
       navLinks: [],
       cacheTtl: env.CACHE_TTL * 1000,
@@ -778,6 +816,7 @@ function deriveConfig(): AppConfig {
     albumGrids,
     albumCoverPositions,
     albumDownloads,
+    standaloneAlbumZoom,
     albumLocationPrecision,
   } = deriveGallery(gallery);
 
@@ -864,6 +903,9 @@ function deriveConfig(): AppConfig {
     // writes it, so a fresh install put a nav link in front of an empty page
     // (#518). `enabled: false` still hides it even when the file is there.
     aboutEnabled: settings.about?.enabled !== false && aboutContentExists(),
+    // Opt-in: zoom serves originals, which a portfolio must not start doing
+    // because an upgrade added the feature (#467).
+    zoom: settings.zoom === true,
     albumOverrides,
     albumDescriptions,
     albumPasswords,
@@ -873,6 +915,7 @@ function deriveConfig(): AppConfig {
     albumGrids,
     albumCoverPositions,
     albumDownloads,
+    standaloneAlbumZoom,
     albumLocationPrecision,
     navLinks: sanitizeNavLinks(settings.navLinks),
     cacheTtl: env.CACHE_TTL * 1000,
diff --git a/lib/config/presets.ts b/lib/config/presets.ts
new file mode 100644
index 0000000..fbf7d84
--- /dev/null
+++ b/lib/config/presets.ts
@@ -0,0 +1,264 @@
+import type { ThemeConfig } from './schema';
+
+/**
+ * The built-in theme presets, declared once.
+ *
+ * Everything that lists presets reads this array: `THEME_PRESETS` and
+ * `resolveTheme()` (lib/config/theme.ts), the admin theme cards, the install
+ * wizard and its allowlist, and the dev toolbar. The parts that cannot import
+ * it — the palette blocks in app/tokens.css, app/themes/<id>.css and its
+ * `@import`, the docs table, scripts/contrast-audit.mjs — are checked against
+ * it by lib/__tests__/preset-registry.test.ts.
+ *
+ * Client-safe: no `fs`, so client components may import it.
+ */
+export interface PresetDefinition {
+  id: string;
+  label: string;
+  /** One line under the preset in the install wizard. */
+  tagline: string;
+  /** The admin theme card's description. */
+  description: string;
+  /** What the preset applies when settings.yaml overrides nothing. */
+  theme: Omit<ThemeConfig, 'preset'>;
+  /**
+   * The admin card's mini mockup. Font, radius and frame come from `theme`;
+   * `gap` is the visual density of the preset's gallery grid.
+   */
+  card: { bg: string; tile: string; accent: string; type: 'serif' | 'sans' | 'mono'; gap: number };
+  /**
+   * Whether the preset ships its own palette in app/tokens.css and its own
+   * app/themes/<id>.css. Only `studio` does not: it is the look the global
+   * defaults describe.
+   */
+  ownStyles: boolean;
+}
+
+export const PRESET_REGISTRY: readonly PresetDefinition[] = [
+  {
+    id: 'studio-modern',
+    label: 'Studio Modern',
+    tagline: 'Precision grotesque, hairline rules',
+    description: 'Leica precision: Archivo grotesque, mono EXIF, red signal accents.',
+    theme: {
+      accent: '#e60012',
+      fonts: { heading: 'Archivo', body: 'Archivo', caption: 'IBM Plex Mono' },
+      radius: 0,
+      photoFrame: 'none',
+      grain: false,
+      headerDot: true,
+      heroStyle: 'split',
+    },
+    card: { bg: '#121212', tile: '#191919', accent: '#e60012', type: 'sans', gap: 3 },
+    ownStyles: true,
+  },
+  {
+    id: 'studio',
+    label: 'Studio',
+    tagline: 'Classic portfolio, red accent',
+    description: 'Playfair Display serif headings over DM Sans, matted photos on black.',
+    theme: {
+      accent: '#e60012',
+      fonts: { heading: 'Playfair Display', body: 'DM Sans', caption: 'EB Garamond' },
+      radius: 0,
+      photoFrame: 'passepartout',
+      grain: true,
+      headerDot: true,
+      heroStyle: 'split',
+    },
+    card: { bg: '#141414', tile: '#242424', accent: '#e60012', type: 'serif', gap: 4 },
+    ownStyles: false,
+  },
+  {
+    id: 'minimal',
+    label: 'Minimal',
+    tagline: 'Bare-bones, monochrome',
+    description: 'Pure raw layouts with tiny gaps and high whitespace.',
+    theme: {
+      accent: '#000000',
+      accentDark: '#ffffff',
+      fonts: { heading: 'Geist', body: 'Geist', caption: 'IBM Plex Mono' },
+      radius: 0,
+      photoFrame: 'none',
+      grain: false,
+      headerDot: false,
+      heroStyle: 'fullbleed',
+    },
+    card: { bg: '#ffffff', tile: '#f3f3f3', accent: '#111111', type: 'sans', gap: 2 },
+    ownStyles: true,
+  },
+  {
+    id: 'editorial',
+    label: 'Editorial',
+    tagline: 'Magazine-style serif',
+    description: 'Warm backgrounds, elegant serifs and large headers.',
+    theme: {
+      accent: '#8B2500',
+      accentDark: '#d9602a',
+      fonts: { heading: 'Bodoni Moda', body: 'Newsreader', caption: 'Spectral' },
+      radius: 0,
+      photoFrame: 'shadow',
+      grain: false,
+      headerDot: false,
+      heroStyle: 'split',
+    },
+    card: { bg: '#fbf9f4', tile: '#e5dfd4', accent: '#b89053', type: 'serif', gap: 8 },
+    ownStyles: true,
+  },
+  {
+    id: 'classic',
+    label: 'Classic',
+    tagline: 'Warm gold, traditional',
+    description: 'Soft traditional portfolio: Cinzel capitals, rounded matted photos.',
+    theme: {
+      accent: '#c49a3c',
+      accentLight: '#8d6f2b',
+      fonts: { heading: 'Cinzel', body: 'Crimson Pro', caption: 'Crimson Pro' },
+      radius: 12,
+      photoFrame: 'passepartout',
+      grain: false,
+      headerDot: true,
+      heroStyle: 'minimal',
+    },
+    card: { bg: '#f7f7f7', tile: '#ffffff', accent: '#444444', type: 'serif', gap: 7 },
+    ownStyles: true,
+  },
+  {
+    id: 'noir',
+    label: 'Noir',
+    tagline: 'Dark, high-contrast',
+    description: 'High drama absolute pitch black, stark high-fashion look.',
+    theme: {
+      accent: '#ff6b35',
+      accentLight: '#c2410c',
+      fonts: { heading: 'Libre Baskerville', body: 'Source Sans 3', caption: 'Space Mono' },
+      radius: 0,
+      photoFrame: 'passepartout',
+      grain: true,
+      headerDot: false,
+      heroStyle: 'fullbleed',
+    },
+    card: { bg: '#000000', tile: '#151515', accent: '#ffffff', type: 'serif', gap: 6 },
+    ownStyles: true,
+  },
+  {
+    id: 'monograph',
+    label: 'Monograph',
+    tagline: 'Typographic, text-first',
+    description: 'Instrument Serif headlines, Inter text, mono captions: a quiet document feel.',
+    theme: {
+      accent: '#333333',
+      accentDark: '#c8c8c8',
+      fonts: { heading: 'Instrument Serif', body: 'Inter', caption: 'IBM Plex Mono' },
+      radius: 0,
+      photoFrame: 'none',
+      grain: false,
+      headerDot: false,
+      heroStyle: 'typographic',
+    },
+    card: { bg: '#f4f4f6', tile: '#ffffff', accent: '#555555', type: 'serif', gap: 5 },
+    ownStyles: true,
+  },
+  {
+    id: 'kunsthalle',
+    label: 'Kunsthalle',
+    tagline: 'Grey gallery wall, wall labels',
+    description:
+      'Photos hung on a neutral grey wall with museum wall labels. Libre Franklin, petrol links.',
+    theme: {
+      accent: '#1d545c',
+      accentDark: '#8cc3ca',
+      fonts: { heading: 'Libre Franklin', body: 'Libre Franklin', caption: 'Libre Franklin' },
+      radius: 0,
+      photoFrame: 'shadow',
+      grain: false,
+      headerDot: false,
+      heroStyle: 'mosaic',
+    },
+    card: { bg: '#2b2b29', tile: '#393937', accent: '#8cc3ca', type: 'sans', gap: 8 },
+    ownStyles: true,
+  },
+  {
+    id: 'ma',
+    label: 'Ma',
+    tagline: 'Japanese restraint, washi and sumi',
+    description:
+      'Negative space, washi-grey paper, sumi ink and one vermilion seal. Cormorant Garamond and Hanken Grotesk.',
+    theme: {
+      accent: '#b0381f',
+      accentDark: '#e8674c',
+      fonts: { heading: 'Cormorant Garamond', body: 'Hanken Grotesk', caption: 'Hanken Grotesk' },
+      radius: 0,
+      photoFrame: 'none',
+      grain: false,
+      headerDot: true,
+      heroStyle: 'split',
+    },
+    card: { bg: '#f0ede6', tile: '#e7e3da', accent: '#b0381f', type: 'serif', gap: 9 },
+    ownStyles: true,
+  },
+  {
+    id: 'cyanotype',
+    label: 'Cyanotype',
+    tagline: 'Prussian blue, drawing sheet',
+    description:
+      'A Prussian-blue print set like an architectural drawing: Jost, DM Mono, registration marks.',
+    theme: {
+      accent: '#1a4d88',
+      accentDark: '#8ccbeb',
+      fonts: { heading: 'Jost', body: 'Jost', caption: 'DM Mono' },
+      radius: 0,
+      photoFrame: 'none',
+      grain: false,
+      headerDot: false,
+      heroStyle: 'split',
+    },
+    card: { bg: '#0e1621', tile: '#192839', accent: '#8ccbeb', type: 'sans', gap: 4 },
+    ownStyles: true,
+  },
+  {
+    id: 'salon',
+    label: 'Salon',
+    tagline: 'Oxblood salon, fine fillet',
+    description:
+      'A 19th-century oxblood picture gallery with modern restraint: Gloock, Work Sans, a fillet round every photo.',
+    theme: {
+      accent: '#7d1f2c',
+      accentDark: '#e3a39a',
+      fonts: { heading: 'Gloock', body: 'Work Sans', caption: 'Work Sans' },
+      radius: 0,
+      photoFrame: 'none',
+      grain: false,
+      headerDot: false,
+      heroStyle: 'fullbleed',
+    },
+    card: { bg: '#1c1315', tile: '#2c2023', accent: '#e3a39a', type: 'serif', gap: 5 },
+    ownStyles: true,
+  },
+  {
+    id: 'birch',
+    label: 'Birch',
+    tagline: 'Nordic daylight, soft corners',
+    description:
+      'Scandinavian daylight: birch-white and pine-night, soft corners, sentence case, lichen green.',
+    theme: {
+      accent: '#2c5d44',
+      accentDark: '#9fc9a9',
+      fonts: { heading: 'Albert Sans', body: 'Albert Sans', caption: 'Albert Sans' },
+      radius: 6,
+      photoFrame: 'none',
+      grain: false,
+      headerDot: false,
+      heroStyle: 'stacked',
+    },
+    card: { bg: '#f3f5f1', tile: '#e9ece6', accent: '#2c5d44', type: 'sans', gap: 3 },
+    ownStyles: true,
+  },
+];
+
+/** Preset ids in registry order: the order every picker shows them in. */
+export const PRESET_IDS: readonly string[] = PRESET_REGISTRY.map((p) => p.id);
+
+export function getPresetDefinition(id: string): PresetDefinition | undefined {
+  return PRESET_REGISTRY.find((p) => p.id === id);
+}
diff --git a/lib/config/schema.ts b/lib/config/schema.ts
index 293629f..e15cb47 100644
--- a/lib/config/schema.ts
+++ b/lib/config/schema.ts
@@ -25,6 +25,13 @@ export interface SubpageConfig {
    */
   coverGrid?: Partial<GridConfig>;
   proofing?: boolean;
+  /** Lightbox zoom for the albums here, over the site setting (#467). */
+  zoom?: boolean;
+  /**
+   * Album zoom overrides written on this page's album entries (sections
+   * included). They apply on this page only; see resolveZoom().
+   */
+  albumZoom?: Record<string, boolean>;
   essayFile?: string;
   essayText?: string;
   enabled?: boolean;
@@ -40,6 +47,8 @@ export interface SubpageObjectValue {
   /** Album-cover tiles only; falls back to `grid` when unset (#523). */
   coverGrid?: Partial<GridConfig>;
   proofing?: boolean;
+  /** Lightbox zoom for the albums here, over the site setting (#467). */
+  zoom?: boolean;
   essayFile?: string;
   essayText?: string;
   enabled?: boolean;
@@ -279,6 +288,11 @@ export interface AppConfig {
     email?: string;
   };
   aboutEnabled: boolean;
+  /**
+   * Lightbox zoom to full resolution, site-wide (`zoom` in settings.yaml,
+   * off by default). Subpages and albums override it; see resolveZoom() (#467).
+   */
+  zoom: boolean;
   albumOverrides: Record<string, string>;
   albumDescriptions: Record<string, string>;
   albumPasswords: Record<string, string>;
@@ -293,6 +307,12 @@ export interface AppConfig {
   albumCoverPositions: Record<string, string>;
   /** Albums whose originals may be downloaded. Absent means no (#475). */
   albumDownloads: Record<string, boolean>;
+  /**
+   * Lightbox zoom overrides on the standalone album entries, either way.
+   * Absent means inherit (#467). Entries inside a subpage are kept on that
+   * subpage (`SubpageConfig.albumZoom`), so each route answers for itself.
+   */
+  standaloneAlbumZoom: Record<string, boolean>;
   /** Per-album map precision. Absent means `exact` (#469). */
   albumLocationPrecision: Record<string, LocationPrecision>;
   /** EXPERIMENTAL: external links appended to the header navigation. */
@@ -338,6 +358,33 @@ export interface AppConfig {
   };
 }
 
+/**
+ * Whether the lightbox offers zoom to full resolution for an album on one
+ * route (#467): the album standalone (no subpage), or on a given subpage.
+ *
+ * Most specific wins, in either direction: the album entry's own `zoom:` on
+ * that route, then the subpage, then `zoom` in settings.yaml (off by default).
+ * The same `??` chain as resolveProofing(), one level deeper — `zoom: false` on
+ * an album has to beat a subpage's `true`.
+ *
+ * The album override is per route on purpose. An album listed on an open page
+ * with `zoom: false` and on a password page with `zoom: true` must not become
+ * zoomable on the open one because the other entry happened to be read last.
+ *
+ * The page, the zoom route (isAlbumZoomReachable in lib/auth.ts) and the
+ * admin drawer (which edits the entry in its place) all read the same value.
+ * Lives here rather than in lib/config/index.ts so client-safe and test code
+ * that stubs the config barrel can still reach it.
+ */
+export function resolveZoom(
+  config: Pick<AppConfig, 'zoom' | 'standaloneAlbumZoom'>,
+  albumId: string,
+  subpage?: { zoom?: boolean; albumZoom?: Record<string, boolean> },
+): boolean {
+  if (subpage) return subpage.albumZoom?.[albumId] ?? subpage.zoom ?? config.zoom;
+  return config.standaloneAlbumZoom?.[albumId] ?? config.zoom;
+}
+
 export interface AlbumEntryObject {
   /** Optional: an entry may carry only a sort mode and no title override. */
   title?: string;
@@ -357,6 +404,11 @@ export interface AlbumEntryObject {
   coverPosition?: string;
   /** Offer the original file for download from the lightbox (#475). Off by default. */
   download?: boolean;
+  /**
+   * Lightbox zoom to full resolution for this album, over the subpage and
+   * site setting in either direction (#467). Absent inherits.
+   */
+  zoom?: boolean;
   /**
    * How precisely this album's photographs may be placed on the map:
    * `exact` (default), `city`, `country` or `hidden`. Narrowed to
@@ -403,6 +455,8 @@ export interface GallerySubpageYaml {
   }>;
   password?: string;
   proofing?: boolean;
+  /** Lightbox zoom for every album here that does not set its own (#467). */
+  zoom?: boolean;
   essayFile?: string;
   essayText?: string;
   enabled?: boolean;
@@ -447,6 +501,8 @@ export interface SettingsYaml {
   transitions?: boolean;
   scrollToTop?: boolean;
   analytics?: boolean;
+  /** Lightbox zoom to full resolution; off unless set (#467). */
+  zoom?: boolean;
   proofing?: {
     enabled?: boolean;
     allowMailto?: boolean;
diff --git a/lib/config/settingValues.ts b/lib/config/settingValues.ts
index ab7264f..7f69e5e 100644
--- a/lib/config/settingValues.ts
+++ b/lib/config/settingValues.ts
@@ -7,22 +7,37 @@
  * an input for, that meant a save of `accent: rot` or nine columns in a 1–6
  * field was reported as "Saved" while the site showed something else.
  *
- * This checks exactly those fields — the site URL, the accent, the grid
- * columns and gap — with the resolvers' own rules and bounds, so it can never
- * be stricter than what renders. Kept apart from settingsSchema.ts so the
+ * This checks the values a resolver bends — the site URL, the accent, the
+ * corner radius, the grid columns and gap, the message retention and the
+ * header links — with the resolvers' own rules and bounds, so it can never be
+ * stricter than what renders. Kept apart from settingsSchema.ts so the
  * settings form can run it as you type without bundling zod; the save route
- * runs it before writing, and the doctor over settings.yaml as it is.
+ * runs it before writing, and both doctors over settings.yaml as it is.
+ *
+ * `npm run doctor` imports this file under Node's own type stripping
+ * (scripts/doctor.mts), which resolves no extensionless paths: every relative
+ * import here carries its `.ts`, and the modules it pulls in may only
+ * `import type` from elsewhere. scripts/__tests__/doctor-cli.test.ts loads the
+ * graph in a real Node process and fails when that breaks.
  */
 
-import { normaliseSiteUrl } from '../siteUrl';
-import { isAccentHex } from './theme';
-import { PHOTO_GRID_COLUMNS_MAX, PHOTO_GRID_COLUMNS_MIN, PHOTO_GRID_GAP_MAX } from './schema';
+import { normaliseSiteUrl } from '../siteUrl.ts';
+import { isAccentHex, THEME_RADIUS_MAX } from './theme.ts';
+import {
+  CONTACT_RETENTION_MAX,
+  PHOTO_GRID_COLUMNS_MAX,
+  PHOTO_GRID_COLUMNS_MIN,
+  PHOTO_GRID_GAP_MAX,
+} from './schema.ts';
 import type { SettingsFieldError } from './settingsSchema';
 
 function inRange(value: unknown, min: number, max: number): boolean {
   return typeof value === 'number' && Number.isInteger(value) && value >= min && value <= max;
 }
 
+/** What sanitizeNavLinks (lib/config/index.ts) keeps as a link target. */
+const NAV_LINK_URL = /^https?:\/\//i;
+
 /** One error per offending field; an empty string counts as unset, as in the resolvers. */
 export function validateSettingValues(input: unknown): SettingsFieldError[] {
   if (!input || typeof input !== 'object') return [];
@@ -30,6 +45,8 @@ export function validateSettingValues(input: unknown): SettingsFieldError[] {
     url?: unknown;
     theme?: unknown;
     grid?: { columns?: unknown; gap?: unknown } | null;
+    contact?: { retentionDays?: unknown } | null;
+    navLinks?: unknown;
   };
   const errors: SettingsFieldError[] = [];
 
@@ -42,13 +59,33 @@ export function validateSettingValues(input: unknown): SettingsFieldError[] {
     });
   }
 
+  const theme =
+    s.theme && typeof s.theme === 'object'
+      ? (s.theme as { accent?: unknown; radius?: unknown })
+      : null;
+
   // resolveTheme: anything but hex falls back to the preset's accent.
-  const accent =
-    s.theme && typeof s.theme === 'object' ? (s.theme as { accent?: unknown }).accent : undefined;
+  const accent = theme?.accent;
   if (typeof accent === 'string' && accent.trim() !== '' && !isAccentHex(accent)) {
     errors.push({ field: 'theme.accent', message: 'Must be a hex colour such as #e60012.' });
   }
 
+  // resolveRadius clamps into 0–THEME_RADIUS_MAX. The panel has no input for
+  // it, so the message says where the value lives.
+  const radius = theme?.radius;
+  if (
+    radius != null &&
+    (typeof radius !== 'number' ||
+      !Number.isFinite(radius) ||
+      radius < 0 ||
+      radius > THEME_RADIUS_MAX)
+  ) {
+    errors.push({
+      field: 'theme.radius',
+      message: `Must be a number from 0 to ${THEME_RADIUS_MAX} (theme.radius in settings.yaml).`,
+    });
+  }
+
   // getConfig clamps both into these bounds (lib/config/index.ts).
   const grid = s.grid && typeof s.grid === 'object' ? s.grid : null;
   if (
@@ -67,5 +104,36 @@ export function validateSettingValues(input: unknown): SettingsFieldError[] {
     });
   }
 
+  // resolveContact rounds and clamps into 1–CONTACT_RETENTION_MAX.
+  const contact = s.contact && typeof s.contact === 'object' ? s.contact : null;
+  if (contact?.retentionDays != null && !inRange(contact.retentionDays, 1, CONTACT_RETENTION_MAX)) {
+    errors.push({
+      field: 'contact.retentionDays',
+      message: `Must be a whole number of days from 1 to ${CONTACT_RETENTION_MAX}.`,
+    });
+  }
+
+  // sanitizeNavLinks drops an entry without a label or without an http(s)
+  // URL, whole — so each half is reported against its own input.
+  if (Array.isArray(s.navLinks)) {
+    s.navLinks.forEach((entry: unknown, i) => {
+      const link = entry && typeof entry === 'object' ? (entry as Record<string, unknown>) : {};
+      const label = typeof link.label === 'string' ? link.label.trim() : '';
+      const url = typeof link.url === 'string' ? link.url.trim() : '';
+      if (!label) {
+        errors.push({
+          field: `navLinks.${i}.label`,
+          message: 'Needs a label, or the link is left out.',
+        });
+      }
+      if (!NAV_LINK_URL.test(url)) {
+        errors.push({
+          field: `navLinks.${i}.url`,
+          message: 'Must be a full http(s) address, or the link is left out.',
+        });
+      }
+    });
+  }
+
   return errors;
 }
diff --git a/lib/config/settingsSchema.ts b/lib/config/settingsSchema.ts
index ccb346e..6479e98 100644
--- a/lib/config/settingsSchema.ts
+++ b/lib/config/settingsSchema.ts
@@ -29,9 +29,10 @@
  * to the preset's own value for anything that is not the right type, which
  * covers hand-edited YAML as well as a save from this panel.
  *
- * **Values the panel offers an input for** are the exception, checked with the
- * resolvers' own rules in `settingValues.ts`: the site URL, the accent and the
- * grid columns and gap, which a save used to accept and the site then ignored.
+ * **Values a resolver would bend** are the exception, checked with the
+ * resolvers' own rules in `settingValues.ts`: the site URL, the accent, the
+ * corner radius, the grid columns and gap, the message retention and the
+ * header links, which a save used to accept and the site then ignored.
  *
  * **Unknown keys pass through.** There is no `schemaVersion` and no migration
  * code, so configurations older and newer than this build are both in the wild.
@@ -87,6 +88,7 @@ export const settingsSchema = z.looseObject({
   transitions: bool,
   scrollToTop: bool,
   analytics: bool,
+  zoom: bool,
 
   proofing: z.looseObject({ enabled: bool, allowMailto: bool, email: str }).optional(),
 
diff --git a/lib/config/theme.ts b/lib/config/theme.ts
index bd0cc6f..ce43bbd 100644
--- a/lib/config/theme.ts
+++ b/lib/config/theme.ts
@@ -1,85 +1,13 @@
 import type { ThemeConfig, SettingsYaml } from './schema';
+import { PRESET_REGISTRY } from './presets.ts';
 
 /** The preset used when none is configured. */
 export const DEFAULT_PRESET = 'studio-modern';
 
-export const THEME_PRESETS: Record<string, ThemeConfig> = {
-  'studio-modern': {
-    preset: 'studio-modern',
-    accent: '#e60012',
-    fonts: { heading: 'Archivo', body: 'Archivo', caption: 'IBM Plex Mono' },
-    radius: 0,
-    photoFrame: 'none',
-    grain: false,
-    headerDot: true,
-    heroStyle: 'split',
-  },
-  studio: {
-    preset: 'studio',
-    accent: '#e60012',
-    fonts: { heading: 'Playfair Display', body: 'DM Sans', caption: 'EB Garamond' },
-    radius: 0,
-    photoFrame: 'passepartout',
-    grain: true,
-    headerDot: true,
-    heroStyle: 'split',
-  },
-  minimal: {
-    preset: 'minimal',
-    accent: '#000000',
-    accentDark: '#ffffff',
-    fonts: { heading: 'Geist', body: 'Geist', caption: 'IBM Plex Mono' },
-    radius: 0,
-    photoFrame: 'none',
-    grain: false,
-    headerDot: false,
-    heroStyle: 'fullbleed',
-  },
-  editorial: {
-    preset: 'editorial',
-    accent: '#8B2500',
-    accentDark: '#d9602a',
-    fonts: { heading: 'Bodoni Moda', body: 'Newsreader', caption: 'Spectral' },
-    radius: 0,
-    photoFrame: 'shadow',
-    grain: false,
-    headerDot: false,
-    heroStyle: 'split',
-  },
-  classic: {
-    preset: 'classic',
-    accent: '#c49a3c',
-    accentLight: '#8d6f2b',
-    fonts: { heading: 'Cinzel', body: 'Crimson Pro', caption: 'Crimson Pro' },
-    radius: 12,
-    photoFrame: 'passepartout',
-    grain: false,
-    headerDot: true,
-    heroStyle: 'minimal',
-  },
-  noir: {
-    preset: 'noir',
-    accent: '#ff6b35',
-    accentLight: '#c2410c',
-    fonts: { heading: 'Libre Baskerville', body: 'Source Sans 3', caption: 'Space Mono' },
-    radius: 0,
-    photoFrame: 'passepartout',
-    grain: true,
-    headerDot: false,
-    heroStyle: 'fullbleed',
-  },
-  monograph: {
-    preset: 'monograph',
-    accent: '#333333',
-    accentDark: '#c8c8c8',
-    fonts: { heading: 'Instrument Serif', body: 'Inter', caption: 'IBM Plex Mono' },
-    radius: 0,
-    photoFrame: 'none',
-    grain: false,
-    headerDot: false,
-    heroStyle: 'typographic',
-  },
-};
+/** Every built-in preset by id, derived from PRESET_REGISTRY (lib/config/presets.ts). */
+export const THEME_PRESETS: Record<string, ThemeConfig> = Object.fromEntries(
+  PRESET_REGISTRY.map((p) => [p.id, { preset: p.id, ...p.theme }]),
+);
 
 export const VALID_PHOTO_FRAMES = ['none', 'passepartout', 'shadow'];
 export const VALID_HERO_STYLES = [
@@ -109,7 +37,7 @@ export const VALID_LAYOUTS = [
  * side of this field, are already checked against an allowlist; this is the
  * same treatment for the one numeric scalar in ThemeConfig.
  */
-const THEME_RADIUS_MAX = 64; // Presets top out at 16; generous but not unbounded.
+export const THEME_RADIUS_MAX = 64; // Presets top out at 16; generous but not unbounded.
 function resolveRadius(raw: unknown, fallback: number): number {
   if (typeof raw !== 'number' || !Number.isFinite(raw)) return fallback;
   return Math.min(THEME_RADIUS_MAX, Math.max(0, raw));
@@ -187,6 +115,50 @@ export function onAccent(accent: string): string {
   return toBlack > toWhite ? '#000000' : '#ffffff';
 }
 
+/**
+ * The surfaces accent-coloured text is checked against, one per mode: the
+ * lightest dark surface (`--bg-card-hover` of the brightest dark preset,
+ * rounded up) and the darkest light one (`--bg-secondary` of the studio
+ * light palette, rounded down). Clearing these clears every other surface of
+ * the same mode.
+ */
+const ACCENT_TEXT_SURFACE = { dark: '#262626', light: '#e8e8e3' } as const;
+const AA_TEXT = 4.5;
+
+function mixHex(a: string, b: string, weightB: number): string {
+  const channel = (hex: string, i: number) => parseInt(hex.slice(1 + i * 2, 3 + i * 2), 16);
+  return (
+    '#' +
+    [0, 1, 2]
+      .map((i) => Math.round(channel(a, i) * (1 - weightB) + channel(b, i) * weightB))
+      .map((c) => c.toString(16).padStart(2, '0'))
+      .join('')
+  );
+}
+
+/**
+ * Text in the accent colour (`--accent-text`), lifted to AA. A fill can be any
+ * accent: `--on-accent` picks the text on top of it. Text *in* the accent
+ * cannot choose its background, and the preset reds measured 3.5–3.7:1 on the
+ * dark pages (#e60012 on #121212). The accent is mixed toward white on dark
+ * and toward black on light, in 5% steps (the same mix `color-mix(in srgb)`
+ * makes), until it reaches 4.5:1 on that mode's worst surface — so an accent
+ * that already passes is returned unchanged, and every accent terminates at
+ * white or black at the latest. A non-hex value is returned as it is.
+ */
+export function accentText(accent: string, mode: 'dark' | 'light'): string {
+  const m = /^#([0-9a-f]{3}|[0-9a-f]{6})$/i.exec(accent.trim());
+  if (!m) return accent;
+  const hex = '#' + (m[1].length === 3 ? [...m[1]].map((c) => c + c).join('') : m[1]).toLowerCase();
+  const surface = ACCENT_TEXT_SURFACE[mode];
+  const target = mode === 'dark' ? '#ffffff' : '#000000';
+  for (let step = 0; step <= 20; step++) {
+    const candidate = mixHex(hex, target, step / 20);
+    if ((contrastRatio(candidate, surface) ?? 0) >= AA_TEXT) return candidate;
+  }
+  return target;
+}
+
 /** `String(theme.grain)`/`String(theme.headerDot)` become a `data-*` attribute
  * either way, but a non-boolean is a sign the value was never meant for this
  * field at all — a typo'd key one level up, say — so it falls back rather
diff --git a/lib/downloadName.ts b/lib/downloadName.ts
index 2ab92b5..f2dba1a 100644
--- a/lib/downloadName.ts
+++ b/lib/downloadName.ts
@@ -67,3 +67,34 @@ export function contentDisposition(name: string | undefined): string {
       .join('') || 'photo';
   return `attachment; filename="${ascii}"; filename*=UTF-8''${encodeURIComponent(safe)}`;
 }
+
+/** The extensions a rendition's content type is saved under; the first is used. */
+const EXTENSIONS: Record<string, readonly string[]> = {
+  'image/jpeg': ['jpg', 'jpeg', 'jpe', 'jfif'],
+  'image/webp': ['webp'],
+  'image/avif': ['avif'],
+  'image/png': ['png'],
+};
+
+/**
+ * The filename for a photo downloaded as edited in Immich (#831).
+ *
+ * Immich hands out an edited photo as a new rendition — a JPEG, measured
+ * against Immich 3.2 — not as the stored file, so an iPhone's `IMG_0001.HEIC`
+ * arrives as JPEG bytes. Keeping the name would leave a file the system opens
+ * with the wrong program, or not at all; the extension is changed to match
+ * what was sent. A name that already fits, or a type not listed here, is
+ * left alone.
+ */
+export function editedDownloadName(
+  name: string | undefined,
+  contentType: string | null | undefined,
+): string | undefined {
+  const type = (contentType ?? '').toLowerCase().split(';')[0].trim();
+  const extensions = EXTENSIONS[type];
+  if (!name || !extensions) return name;
+  const dot = name.lastIndexOf('.');
+  const stem = dot > 0 ? name.slice(0, dot) : name;
+  const current = dot > 0 ? name.slice(dot + 1).toLowerCase() : '';
+  return extensions.includes(current) ? name : `${stem}.${extensions[0]}`;
+}
diff --git a/lib/exif.ts b/lib/exif.ts
index 5e16319..169b511 100644
--- a/lib/exif.ts
+++ b/lib/exif.ts
@@ -31,3 +31,31 @@ export function formatCamera(make?: string | null, model?: string | null): strin
 
   return namesBrand ? cleanModel : `${cleanMake} ${cleanModel}`;
 }
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * The lens, without the camera it is built into.
+ *
+ * Phones report the whole device as the lens: an iPhone gives
+ * `model: "iPhone 14 Pro"` and `lensModel: "iPhone 14 Pro back triple camera
+ * 6.86mm f/1.78"`, so the tile and the lightbox strip read the model twice
+ * ("IPHONE 14 PRO · IPHONE 14 PRO BACK TRIPLE CAMERA …"). When the camera is
+ * shown next to it, the model is removed from the lens as a whole phrase
+ * (case-insensitive, never inside another word). A lens that is nothing but
+ * the model says nothing the camera does not, and becomes empty.
+ */
+export function formatLens(lens?: string | null, model?: string | null): string {
+  const cleanLens = lens?.trim() ?? '';
+  const cleanModel = model?.trim() ?? '';
+  if (!cleanLens || !cleanModel) return cleanLens;
+
+  const phrase = new RegExp(`(^|\\s)${escapeRegExp(cleanModel)}(?=\\s|$)`, 'i');
+  if (!phrase.test(cleanLens)) return cleanLens;
+  return cleanLens.replace(phrase, ' ').replace(/\s+/g, ' ').trim();
+}
+
+/** The aperture sign. `text-transform: uppercase` turns it into "Ƒ". */
+export const APERTURE_SIGN = 'ƒ';
diff --git a/lib/i18n/locales/de.ts b/lib/i18n/locales/de.ts
index 07f8987..326998d 100644
--- a/lib/i18n/locales/de.ts
+++ b/lib/i18n/locales/de.ts
@@ -98,6 +98,7 @@ export const de: Dictionary = {
       seconds
         ? `Zu viele Versuche – bitte in ${seconds} ${seconds === 1 ? 'Sekunde' : 'Sekunden'} erneut versuchen.`
         : 'Zu viele Versuche – bitte später erneut versuchen.',
+    legalNavAria: 'Rechtliche Hinweise',
   },
 
   about: {
@@ -132,7 +133,6 @@ export const de: Dictionary = {
     title: 'Journal',
     kicker: 'Geschichten & Essays',
     subtitle: 'Fotoessays, visuelle Geschichten und Notizen von unterwegs.',
-    description: 'Fotoessays, Reisegeschichten und Journale hinter den Kulissen.',
     entryDescription: 'Journal-Eintrag',
     empty: 'Noch keine Journal-Einträge veröffentlicht.',
     readStory: 'Geschichte lesen →',
@@ -186,6 +186,14 @@ export const de: Dictionary = {
     shortcutCopyLink: 'Link zum Foto kopieren',
     shortcutList: 'Diese Liste',
     shortcutClose: 'Ansicht schließen',
+    zoomIn: 'Auf volle Auflösung zoomen',
+    zoomInTitle: 'Auf volle Auflösung zoomen (+ oder Doppelklick)',
+    zoomOut: 'Foto an den Bildschirm anpassen',
+    zoomOutTitle: 'Einpassen (0 oder Esc)',
+    zoomLoading: 'Volle Auflösung wird geladen …',
+    zoomUnavailable: 'Für dieses Foto ist keine volle Auflösung verfügbar.',
+    shortcutZoom: 'Hinein- / herauszoomen',
+    shortcutZoomReset: 'Einpassen',
   },
 
   proofing: {
diff --git a/lib/i18n/locales/en.ts b/lib/i18n/locales/en.ts
index d51f9c5..d281b6f 100644
--- a/lib/i18n/locales/en.ts
+++ b/lib/i18n/locales/en.ts
@@ -99,6 +99,7 @@ export const en = {
       seconds
         ? `Too many attempts. Please try again in ${seconds} ${seconds === 1 ? 'second' : 'seconds'}.`
         : 'Too many attempts. Please try again later.',
+    legalNavAria: 'Legal information',
   },
 
   about: {
@@ -134,7 +135,6 @@ export const en = {
     title: 'Journal',
     kicker: 'Stories & Essays',
     subtitle: 'Photo essays, visual stories, and field notes.',
-    description: 'Photo essays, travel stories, and behind-the-scenes journals.',
     entryDescription: 'Journal entry',
     empty: 'No journal entries published yet.',
     readStory: 'Read Story →',
@@ -189,6 +189,16 @@ export const en = {
     shortcutCopyLink: 'Copy link to this photo',
     shortcutList: 'This list',
     shortcutClose: 'Close the viewer',
+    /** The zoom button (#467): to 1:1 from fit, and back. */
+    zoomIn: 'Zoom to full resolution',
+    zoomInTitle: 'Zoom to full resolution (+ or double-click)',
+    zoomOut: 'Fit the photo to the screen',
+    zoomOutTitle: 'Fit to screen (0 or Esc)',
+    zoomLoading: 'Loading full resolution…',
+    /** Immich has no full-resolution file the viewer may show for this photo. */
+    zoomUnavailable: 'Full resolution is not available for this photo.',
+    shortcutZoom: 'Zoom in / out',
+    shortcutZoomReset: 'Fit to screen',
   },
 
   proofing: {
diff --git a/lib/i18n/locales/es.ts b/lib/i18n/locales/es.ts
index a919ef9..44ba15d 100644
--- a/lib/i18n/locales/es.ts
+++ b/lib/i18n/locales/es.ts
@@ -98,6 +98,7 @@ export const es: Dictionary = {
       seconds
         ? `Demasiados intentos. Inténtalo de nuevo en ${seconds} ${seconds === 1 ? 'segundo' : 'segundos'}.`
         : 'Demasiados intentos. Inténtalo más tarde.',
+    legalNavAria: 'Información legal',
   },
 
   about: {
@@ -132,7 +133,6 @@ export const es: Dictionary = {
     title: 'Diario',
     kicker: 'Historias y ensayos',
     subtitle: 'Ensayos fotográficos, historias visuales y notas de campo.',
-    description: 'Ensayos fotográficos, relatos de viaje y diarios entre bastidores.',
     entryDescription: 'Entrada del diario',
     empty: 'Todavía no hay entradas publicadas.',
     readStory: 'Leer historia →',
@@ -186,6 +186,14 @@ export const es: Dictionary = {
     shortcutCopyLink: 'Copiar enlace a esta foto',
     shortcutList: 'Esta lista',
     shortcutClose: 'Cerrar el visor',
+    zoomIn: 'Ampliar a resolución completa',
+    zoomInTitle: 'Ampliar a resolución completa (+ o doble clic)',
+    zoomOut: 'Ajustar la foto a la pantalla',
+    zoomOutTitle: 'Ajustar a la pantalla (0 o Esc)',
+    zoomLoading: 'Cargando la resolución completa…',
+    zoomUnavailable: 'La resolución completa no está disponible para esta foto.',
+    shortcutZoom: 'Acercar / alejar',
+    shortcutZoomReset: 'Ajustar a la pantalla',
   },
 
   proofing: {
diff --git a/lib/i18n/locales/fr.ts b/lib/i18n/locales/fr.ts
index abf5fc1..49cb6ce 100644
--- a/lib/i18n/locales/fr.ts
+++ b/lib/i18n/locales/fr.ts
@@ -100,6 +100,7 @@ export const fr: Dictionary = {
       seconds
         ? `Trop de tentatives. Veuillez réessayer dans ${seconds} ${seconds === 1 ? 'seconde' : 'secondes'}.`
         : 'Trop de tentatives. Veuillez réessayer plus tard.',
+    legalNavAria: 'Informations légales',
   },
 
   about: {
@@ -134,7 +135,6 @@ export const fr: Dictionary = {
     title: 'Journal',
     kicker: 'Récits & essais',
     subtitle: 'Essais photographiques, récits visuels et notes de terrain.',
-    description: 'Essais photographiques, récits de voyage et coulisses.',
     entryDescription: 'Article du journal',
     empty: 'Aucun article publié pour le moment.',
     readStory: 'Lire le récit →',
@@ -189,6 +189,14 @@ export const fr: Dictionary = {
     shortcutCopyLink: 'Copier le lien de cette photo',
     shortcutList: 'Cette liste',
     shortcutClose: 'Fermer la visionneuse',
+    zoomIn: 'Zoomer en pleine résolution',
+    zoomInTitle: 'Zoomer en pleine résolution (+ ou double-clic)',
+    zoomOut: 'Ajuster la photo à l’écran',
+    zoomOutTitle: 'Ajuster à l’écran (0 ou Échap)',
+    zoomLoading: 'Chargement de la pleine résolution…',
+    zoomUnavailable: 'La pleine résolution n’est pas disponible pour cette photo.',
+    shortcutZoom: 'Zoom avant / arrière',
+    shortcutZoomReset: 'Ajuster à l’écran',
   },
 
   proofing: {
diff --git a/lib/i18n/locales/it.ts b/lib/i18n/locales/it.ts
index a47bf8b..70093f4 100644
--- a/lib/i18n/locales/it.ts
+++ b/lib/i18n/locales/it.ts
@@ -98,6 +98,7 @@ export const it: Dictionary = {
       seconds
         ? `Troppi tentativi. Riprova tra ${seconds} ${seconds === 1 ? 'secondo' : 'secondi'}.`
         : 'Troppi tentativi. Riprova più tardi.',
+    legalNavAria: 'Note legali',
   },
 
   about: {
@@ -132,7 +133,6 @@ export const it: Dictionary = {
     title: 'Diario',
     kicker: 'Storie e saggi',
     subtitle: 'Saggi fotografici, racconti visivi e appunti sul campo.',
-    description: 'Saggi fotografici, racconti di viaggio e diari dietro le quinte.',
     entryDescription: 'Articolo del diario',
     empty: 'Nessun articolo pubblicato per ora.',
     readStory: 'Leggi la storia →',
@@ -186,6 +186,14 @@ export const it: Dictionary = {
     shortcutCopyLink: 'Copia il link a questa foto',
     shortcutList: 'Questo elenco',
     shortcutClose: 'Chiudi il visualizzatore',
+    zoomIn: 'Ingrandisci alla risoluzione piena',
+    zoomInTitle: 'Ingrandisci alla risoluzione piena (+ o doppio clic)',
+    zoomOut: 'Adatta la foto allo schermo',
+    zoomOutTitle: 'Adatta allo schermo (0 o Esc)',
+    zoomLoading: 'Caricamento della risoluzione piena…',
+    zoomUnavailable: 'La risoluzione piena non è disponibile per questa foto.',
+    shortcutZoom: 'Ingrandisci / riduci',
+    shortcutZoomReset: 'Adatta allo schermo',
   },
 
   proofing: {
diff --git a/lib/i18n/locales/nl.ts b/lib/i18n/locales/nl.ts
index 3177714..530c19b 100644
--- a/lib/i18n/locales/nl.ts
+++ b/lib/i18n/locales/nl.ts
@@ -98,6 +98,7 @@ export const nl: Dictionary = {
       seconds
         ? `Te veel pogingen. Probeer het over ${seconds} ${seconds === 1 ? 'seconde' : 'seconden'} opnieuw.`
         : 'Te veel pogingen. Probeer het later opnieuw.',
+    legalNavAria: 'Juridische informatie',
   },
 
   about: {
@@ -132,7 +133,6 @@ export const nl: Dictionary = {
     title: 'Journal',
     kicker: 'Verhalen & essays',
     subtitle: 'Fotoessays, beeldverhalen en veldnotities.',
-    description: 'Fotoessays, reisverhalen en een kijkje achter de schermen.',
     entryDescription: 'Journalverhaal',
     empty: 'Er zijn nog geen verhalen gepubliceerd.',
     readStory: 'Lees het verhaal →',
@@ -187,6 +187,14 @@ export const nl: Dictionary = {
     shortcutCopyLink: 'Link naar deze foto kopiëren',
     shortcutList: 'Deze lijst',
     shortcutClose: 'De viewer sluiten',
+    zoomIn: 'Inzoomen op volledige resolutie',
+    zoomInTitle: 'Inzoomen op volledige resolutie (+ of dubbelklik)',
+    zoomOut: 'Foto aan het scherm aanpassen',
+    zoomOutTitle: 'Aan scherm aanpassen (0 of Esc)',
+    zoomLoading: 'Volledige resolutie laden…',
+    zoomUnavailable: 'Voor deze foto is geen volledige resolutie beschikbaar.',
+    shortcutZoom: 'In- / uitzoomen',
+    shortcutZoomReset: 'Aan scherm aanpassen',
   },
 
   proofing: {
diff --git a/lib/immich.ts b/lib/immich.ts
index ab1ae5f..877777a 100644
--- a/lib/immich.ts
+++ b/lib/immich.ts
@@ -48,11 +48,30 @@ export interface ImmichAsset {
   originalFileName: string;
   originalMimeType: string;
   thumbhash: string | null;
+  /**
+   * Pixel size as displayed, EXIF orientation already applied. Optional:
+   * older Immich responses omit it, and EXIF dimensions are the fallback.
+   */
+  width?: number | null;
+  height?: number | null;
   fileCreatedAt: string;
   /** Capture time in the photographer's local zone — Immich's timeline sort key. */
   localDateTime?: string;
   exifInfo?: ImmichExifInfo;
   isTrashed: boolean;
+  /**
+   * Edited in Immich's editor (crop, rotate, …). Immich still answers
+   * `/original` and the default thumbnail sizes with the *unedited* file; only
+   * `?edited=true` applies the edit — see streamAsset() and editMarker() in
+   * ./urls (#831). `width`/`height` above are the edited size, EXIF the
+   * stored one. Optional: older Immich has no editor.
+   */
+  isEdited?: boolean;
+  /**
+   * Last change to the asset in Immich. Read for edited photos only, as the
+   * cache marker of their image URLs (editMarker() in ./urls).
+   */
+  updatedAt?: string;
   /** Only surfaced in the admin pickers. Optional: older Immich responses omit it. */
   isFavorite?: boolean;
 }
@@ -108,6 +127,21 @@ function allowlistKey(config: AppConfig): string {
   return [...config.albums].sort().join(',');
 }
 
+/**
+ * The Immich path for an asset's bytes. `edited=true` is only added when the
+ * edit is wanted, so a photo that is not edited is requested exactly as it
+ * always was (#831).
+ */
+export function assetBinaryPath(
+  assetId: string,
+  size: ImageSize | 'fullsize',
+  edited = false,
+): string {
+  const id = encodeURIComponent(assetId);
+  if (size === 'original') return `/assets/${id}/original${edited ? '?edited=true' : ''}`;
+  return `/assets/${id}/thumbnail?size=${size}${edited ? '&edited=true' : ''}`;
+}
+
 // ── API Client ─────────────────────────────────────────────────
 
 class ImmichClient {
@@ -270,19 +304,54 @@ class ImmichClient {
 
   /**
    * Stream a binary response from Immich (for image proxying).
+   *
+   * `edited` asks for the photo as edited in Immich's editor (#831). Measured
+   * against Immich 3.2: without it, the thumbnail, the preview and the
+   * original are the unedited file. With it, an edited photo's thumbnail and
+   * preview carry the crop or rotation, and its original is Immich's
+   * full-resolution edited rendition — a JPEG without EXIF, not the camera
+   * file. For a photo that is not edited, `edited=true` returns the same
+   * bytes as without it.
    */
   async streamAsset(
     assetId: string,
     size: ImageSize = 'preview',
+    edited = false,
+  ): Promise<{ stream: ReadableStream; contentType: string; contentLength: string | null } | null> {
+    return this.streamBinary(assetId, assetBinaryPath(assetId, size, edited), 'follow');
+  }
+
+  /**
+   * Immich's full-size rendition of an asset, or null when there is none (#467).
+   *
+   * `GET /assets/:id/thumbnail?size=fullsize` never 404s for a missing
+   * rendition: measured against Immich 3.2, it answers 302 to the original for
+   * a web-compatible format, and 302 to the 1440px preview when full-size
+   * previews are switched off or the asset has not been processed since they
+   * were switched on. Following either redirect would pass a preview off as
+   * full resolution, or hand out an original the caller did not choose — so
+   * redirects are not followed, and any 3xx means "no rendition".
+   *
+   * `edited` asks for the edited rendition of a photo edited in Immich
+   * (#831). Measured against Immich 3.2, an edited photo has one at full
+   * resolution — a JPEG — whether or not full-size previews are switched on,
+   * and it is the same file `original?edited=true` returns.
+   */
+  async streamFullsize(
+    assetId: string,
+    edited = false,
+  ): Promise<{ stream: ReadableStream; contentType: string; contentLength: string | null } | null> {
+    return this.streamBinary(assetId, assetBinaryPath(assetId, 'fullsize', edited), 'manual');
+  }
+
+  private async streamBinary(
+    assetId: string,
+    endpoint: string,
+    redirect: 'follow' | 'manual',
   ): Promise<{ stream: ReadableStream; contentType: string; contentLength: string | null } | null> {
     const config = this.config;
     if (!this.hasCredentials(config)) return null;
 
-    const endpoint =
-      size === 'original'
-        ? `/assets/${encodeURIComponent(assetId)}/original`
-        : `/assets/${encodeURIComponent(assetId)}/thumbnail?size=${size}`;
-
     const url = `${config.immich.apiUrl}${endpoint}`;
 
     // Headers-only timeout, same reasoning as streamVideo: an original-size
@@ -296,8 +365,15 @@ class ImmichClient {
           'x-api-key': config.immich.apiKey,
         },
         signal: controller.signal,
+        redirect,
       });
 
+      // Only reachable with `redirect: 'manual'`: Immich has no such file.
+      if (res.status >= 300 && res.status < 400) {
+        await res.body?.cancel();
+        return null;
+      }
+
       if (!res.ok) {
         console.error(`[Immich] Failed to stream ${assetId}: ${res.status}`);
         // Neither branch below reads the body — an unconsumed one keeps its
@@ -734,7 +810,26 @@ class ImmichClient {
   }
 
   /**
-   * Find an album by its URL slug.
+   * Find an album by its URL slug, with its assets.
+   *
+   * The search set follows the route, never the whole allowlist: see
+   * findAlbumBySlug().
+   */
+  async getAlbumBySlug(
+    slug: string,
+    subpageSlug?: string,
+    forceFresh = false,
+  ): Promise<ImmichAlbum | null> {
+    const match = await this.findAlbumBySlug(slug, subpageSlug, forceFresh);
+    if (!match) return null;
+    return this.getAlbum(match.id, forceFresh);
+  }
+
+  /**
+   * The published album a URL slug names, from the album list alone — no asset
+   * fetch. The catch-all page asks this before it streams, to know whether a
+   * path exists while it can still answer 404; the list is the one the header
+   * nav already waits for, so the question costs no extra Immich request.
    *
    * The search set follows the route, never the whole allowlist: with a
    * subpageSlug it is that subpage's albums, without one it is the standalone
@@ -742,7 +837,7 @@ class ImmichClient {
    * top-level slug would answer for an album whose only route is a subpage —
    * past that subpage's password, and past `enabled: false`.
    */
-  async getAlbumBySlug(
+  async findAlbumBySlug(
     slug: string,
     subpageSlug?: string,
     forceFresh = false,
@@ -764,9 +859,7 @@ class ImmichClient {
     const searchSet = albums.filter((a) => routeIds.has(a.id));
 
     const wanted = normalizeSlug(slug);
-    const match = searchSet.find((a) => a.slug === wanted);
-    if (!match) return null;
-    return this.getAlbum(match.id, forceFresh);
+    return searchSet.find((a) => a.slug === wanted) ?? null;
   }
 
   /**
diff --git a/lib/journal.ts b/lib/journal.ts
index eebbd11..55ba597 100644
--- a/lib/journal.ts
+++ b/lib/journal.ts
@@ -453,6 +453,32 @@ function parsePhotoLine(chunk: string): { target: string; caption: string } | nu
   return { target, caption: rest.trim() };
 }
 
+/**
+ * A text line that begins like a photo reference. The serializer escapes it
+ * so a paragraph reading `![draft]` is not reloaded as a photo block — the
+ * parser splits a chunk at every line that starts with `![` and turns it into
+ * one (splitAtPhotoLines, parsePhotoLine). The escape is one backslash in
+ * front of whatever backslashes are already there, so a line that really
+ * starts with `\![` round-trips too. Only a line start needs it: elsewhere
+ * in a paragraph `![` means nothing to the parser.
+ */
+const PHOTO_LIKE_LINE = /^([ \t]*)(\\*)!\[/;
+const ESCAPED_PHOTO_LIKE_LINE = /^([ \t]*)\\(\\*)!\[/;
+
+function escapePhotoLikeLines(markdown: string): string {
+  return markdown
+    .split('\n')
+    .map((line) => line.replace(PHOTO_LIKE_LINE, '$1\\$2!['))
+    .join('\n');
+}
+
+function unescapePhotoLikeLines(markdown: string): string {
+  return markdown
+    .split(/\r?\n/)
+    .map((line) => line.replace(ESCAPED_PHOTO_LIKE_LINE, '$1$2!['))
+    .join('\n');
+}
+
 /** Parse Journal Markdown content into structured blocks */
 export function parseJournalMarkdown(rawContent: string): ParsedJournal {
   const { frontmatter, body } = parseFrontmatter(rawContent);
@@ -653,7 +679,7 @@ export function parseJournalMarkdown(rawContent: string): ParsedJournal {
     // 4. Standard Text Paragraph
     blocks.push({
       type: 'paragraph',
-      html: renderInlineMarkdown(chunk.replace(/\r?\n/g, ' ')),
+      html: renderInlineMarkdown(unescapePhotoLikeLines(chunk).replace(/\r?\n/g, ' ')),
     });
   }
 
@@ -703,7 +729,7 @@ export function serializeJournalMarkdown(journal: ParsedJournal): string {
         break;
       }
       case 'paragraph': {
-        lines.push(inlineHtmlToMarkdown(block.html));
+        lines.push(escapePhotoLikeLines(inlineHtmlToMarkdown(block.html)));
         break;
       }
       case 'quote': {
diff --git a/lib/journalDate.ts b/lib/journalDate.ts
index cde9804..a8a3635 100644
--- a/lib/journalDate.ts
+++ b/lib/journalDate.ts
@@ -47,3 +47,26 @@ export function formatJournalDate(raw: string | undefined, locale: string): stri
 
   return value;
 }
+
+/**
+ * The `datetime` attribute for a `<time>` around that display form: the
+ * calendar date (`2026-03-15`) or month (`2026-03`) it names, or null when
+ * the value is free text — `Spring 2026` has no machine-readable form, and a
+ * `<time>` carrying one would claim its text is a valid date string.
+ */
+export function journalDateTime(raw: string | undefined): string | null {
+  const value = raw?.trim();
+  if (!value) return null;
+  const day = DAY.exec(value);
+  if (day) {
+    // An impossible date (2026-02-30) is displayed as typed; the attribute
+    // must not claim it either.
+    return formatJournalDate(value, 'en') === value ? null : `${day[1]}-${day[2]}-${day[3]}`;
+  }
+  const month = MONTH.exec(value);
+  if (month) {
+    const m = Number(month[2]);
+    return m >= 1 && m <= 12 ? `${month[1]}-${month[2]}` : null;
+  }
+  return null;
+}
diff --git a/lib/justifiedRow.ts b/lib/justifiedRow.ts
new file mode 100644
index 0000000..ab38d29
--- /dev/null
+++ b/lib/justifiedRow.ts
@@ -0,0 +1,36 @@
+/**
+ * Flex sizing for one tile of the justified photo layout.
+ *
+ * Every tile in a row has the same height (--grid-row-height). Its basis is
+ * the width the photo needs at that height, and the leftover row width is
+ * shared out by `flex-grow`, which is also the aspect ratio, so every photo in
+ * the row widens by the same factor.
+ *
+ * A frame that puts a mat around the photo (passepartout) makes the tile
+ * larger than the photo: --photo-mat-x across, --photo-mat-y down, both set
+ * by the frame in globals.css and 0 without one. The basis therefore sizes
+ * the photo inside the mat and adds the mat back; basing the whole tile on
+ * the row height would give each photo the aspect ratio of its tile instead of
+ * its own, cropping portraits hardest.
+ *
+ * Client-safe: no imports, used by PhotoGrid.
+ */
+
+/** Assumed for assets without dimensions (videos), ~3:2. */
+export const JUSTIFIED_FALLBACK_RATIO = 1.5;
+
+export interface JustifiedTileStyle {
+  flexGrow: number;
+  flexBasis: string;
+}
+
+export function justifiedTileStyle(aspectRatio?: number): JustifiedTileStyle {
+  const ar =
+    aspectRatio && Number.isFinite(aspectRatio) && aspectRatio > 0
+      ? aspectRatio
+      : JUSTIFIED_FALLBACK_RATIO;
+  return {
+    flexGrow: ar,
+    flexBasis: `calc((var(--grid-row-height, 300px) - var(--photo-mat-y, 0px)) * ${ar} + var(--photo-mat-x, 0px))`,
+  };
+}
diff --git a/lib/lightboxShortcuts.ts b/lib/lightboxShortcuts.ts
index de6aced..75a5c06 100644
--- a/lib/lightboxShortcuts.ts
+++ b/lib/lightboxShortcuts.ts
@@ -27,7 +27,9 @@ export type ShortcutAvailability =
   /** Absent where the browser has no element fullscreen to give (iPhone). */
   | 'fullscreen'
   /** Only where the album offers its originals. */
-  | 'download';
+  | 'download'
+  /** Only where the photo on screen can be zoomed (#467). */
+  | 'zoom';
 
 /**
  * What a key does. Closed on purpose: the viewer switches over this union
@@ -42,6 +44,9 @@ export type LightboxAction =
   | 'slideshow'
   | 'copyLink'
   | 'download'
+  | 'zoomIn'
+  | 'zoomOut'
+  | 'zoomReset'
   | 'shortcutList';
 
 export interface ShortcutBinding {
@@ -70,6 +75,8 @@ export interface LightboxShortcut {
     | 'shortcutSlideshow'
     | 'shortcutCopyLink'
     | 'shortcutDownload'
+    | 'shortcutZoom'
+    | 'shortcutZoomReset'
     | 'shortcutList'
     | 'shortcutClose';
   availability: ShortcutAvailability;
@@ -119,6 +126,24 @@ export const LIGHTBOX_SHORTCUTS: readonly LightboxShortcut[] = [
     availability: 'download',
     note: 'Only for albums with download: true in gallery.yaml.',
   },
+  {
+    // `=` is `+` without Shift on US and many other layouts; the numpad sends
+    // `+` and `-` directly. Ctrl/Cmd with these stays the browser's own zoom:
+    // the viewer only listens to bare keys.
+    bindings: [
+      { display: '+', eventKeys: ['+', '='], action: 'zoomIn' },
+      { display: '-', eventKeys: ['-'], action: 'zoomOut' },
+    ],
+    labelKey: 'shortcutZoom',
+    availability: 'zoom',
+    note: 'Only where zoom is on (settings, page or album) and the photo has a full-resolution source.',
+  },
+  {
+    bindings: [{ display: '0', eventKeys: ['0'], action: 'zoomReset' }],
+    labelKey: 'shortcutZoomReset',
+    availability: 'zoom',
+    note: 'Back to the whole photo. Esc does the same before it closes the viewer.',
+  },
   {
     // `h` is the escape hatch for layouts where `?` is awkward — and the one
     // key someone guesses without having been told.
diff --git a/lib/locationScrub.ts b/lib/locationScrub.ts
new file mode 100644
index 0000000..36d91c0
--- /dev/null
+++ b/lib/locationScrub.ts
@@ -0,0 +1,1250 @@
+/**
+ * Removes location from original downloads and leaves the rest of the file
+ * alone.
+ *
+ * Downloads are the deliverable, so camera, lens, exposure, copyright/IPTC and
+ * the ICC profile have to arrive with the file. GPS coordinates must not: the
+ * rest of the site shows city and country at most. This module removes just
+ * the location parts of the metadata and leaves the pixels untouched.
+ *
+ * Like lib/metadataStrip.ts it never moves a byte. Every change overwrites in
+ * place, so the length stays the same (Content-Length stays valid) and every
+ * absolute offset in the file still points where it did. That matters most for
+ * HEIF/AVIF, whose `iloc` box addresses item data by file offset.
+ *
+ * What is removed:
+ *
+ *   - EXIF (JPEG APP1, HEIF/AVIF `Exif` item, Photoshop IRB EXIF): the GPSInfo
+ *     pointer is taken out of its IFD and the GPS IFD is zeroed along with
+ *     every value it points to. The other tags keep their bytes and offsets.
+ *   - XMP (JPEG APP1, HEIF/AVIF `mime` item, TIFF tag 700, Photoshop IRB):
+ *     every property whose name starts with `GPS` or contains `Latitude` or
+ *     `Longitude`, in any namespace (`exif:GPS*`, `Iptc4xmpExt:GPS*`,
+ *     `drone-dji:GpsLatitude`, …), and every place name below city level
+ *     (`Location`, `Sublocation`, `shotLocation`, `LocationName`,
+ *     `LocationId`) is overwritten with spaces, element and attribute forms
+ *     alike. City, state and country stay.
+ *   - IPTC IIM (Photoshop APP13): the sub-location (2:92) is overwritten with
+ *     spaces. The rest of the record stays.
+ *   - APPn segments not on a short allowlist (JFIF, ICC, MPF, FlashPix,
+ *     Adobe, EXIF/XMP, Photoshop, non-C2PA APP11) are zeroed whole: vendor
+ *     segments such as GoPro's GPMF carry their own GPS records. So are
+ *     extended XMP and C2PA/JUMBF manifests: a manifest can carry an EXIF
+ *     assertion with coordinates, and changing any byte breaks its hash
+ *     binding anyway.
+ *   - APPn segments between the scans of a progressive JPEG, and JPEGs
+ *     embedded further down the file (MPF secondary images, EXIF thumbnails),
+ *     get the same treatment as the primary image's head.
+ *
+ * If parsing EXIF or XMP runs into anything unexpected, that whole segment or
+ * item is zeroed: losing the camera data is better than keeping the location.
+ *
+ * Only JPEG and the HEIF family (HEIC, HEIF, AVIF) are handled, detected from
+ * the bytes rather than a content type. Anything else passes through
+ * unchanged; the doctor (`checkDownloadMetadata`) names albums that offer such
+ * files for download.
+ *
+ * Memory: nothing is held longer than needed. A JPEG is held up to its first
+ * SOS, a HEIF up to the end of its `meta` box, then the file streams on and
+ * only the metadata item ranges are held while they pass. The head is capped
+ * at HEAD_CAP; a file whose metadata cannot be found within it is refused, not
+ * passed through.
+ */
+
+/** Same ceiling as the image route's MAX_STRIP_BYTES. */
+export const HEAD_CAP = 64 * 1024 * 1024;
+
+/** Largest EXIF/XMP item we hold in memory to edit; larger ones are zeroed. */
+const MAX_ITEM_BYTES = 16 * 1024 * 1024;
+
+/** How far a JPEG embedded later in the file is held to find its metadata. */
+const EMBEDDED_HEAD_CAP = 4 * 1024 * 1024;
+
+// ── Byte helpers ─────────────────────────────────────────────────────────────
+
+const u16be = (b: Uint8Array, i: number) => (b[i] << 8) | b[i + 1];
+const u32be = (b: Uint8Array, i: number) =>
+  ((b[i] << 24) | (b[i + 1] << 16) | (b[i + 2] << 8) | b[i + 3]) >>> 0;
+const fourcc = (b: Uint8Array, i: number) =>
+  String.fromCharCode(b[i], b[i + 1], b[i + 2], b[i + 3]);
+
+function startsWith(b: Uint8Array, at: number, text: string): boolean {
+  if (at < 0 || at + text.length > b.length) return false;
+  for (let k = 0; k < text.length; k++) {
+    if (b[at + k] !== text.charCodeAt(k)) return false;
+  }
+  return true;
+}
+
+function zero(b: Uint8Array, start: number, end: number): void {
+  const from = Math.max(0, Math.min(start, b.length));
+  const to = Math.max(0, Math.min(end, b.length));
+  if (to > from) b.fill(0, from, to);
+}
+
+/** Thrown by bounds-checked reads; always caught inside this module. */
+class Malformed extends Error {}
+
+// ── EXIF / TIFF ──────────────────────────────────────────────────────────────
+
+/** Byte size of one value of each TIFF field type. */
+const TIFF_TYPE_SIZE: Record<number, number> = {
+  1: 1, // BYTE
+  2: 1, // ASCII
+  3: 2, // SHORT
+  4: 4, // LONG
+  5: 8, // RATIONAL
+  6: 1, // SBYTE
+  7: 1, // UNDEFINED
+  8: 2, // SSHORT
+  9: 4, // SLONG
+  10: 8, // SRATIONAL
+  11: 4, // FLOAT
+  12: 8, // DOUBLE
+  13: 4, // IFD
+};
+
+const TAG_GPS_IFD = 0x8825;
+const TAG_EXIF_IFD = 0x8769;
+const TAG_INTEROP_IFD = 0xa005;
+const TAG_XMP = 0x02bc;
+
+/**
+ * Remove GPS from the TIFF structure in `b[start, end)` (an EXIF block,
+ * starting at its `II*\0` / `MM\0*` header). Returns false when the structure
+ * is not one we can walk safely; the caller then zeroes the whole block.
+ *
+ * Every IFD reachable from IFD0 (IFD1, the EXIF and interoperability IFDs) is
+ * searched for the GPSInfo pointer, not only IFD0: a reader that finds one in
+ * an unusual place still shows it.
+ */
+export function scrubTiffGps(b: Uint8Array, start: number, end: number): boolean {
+  try {
+    return scrubTiff(b, start, Math.min(end, b.length));
+  } catch {
+    return false;
+  }
+}
+
+function scrubTiff(b: Uint8Array, start: number, end: number): boolean {
+  const len = end - start;
+  if (start < 0 || len < 8) return false;
+
+  let le: boolean;
+  if (b[start] === 0x49 && b[start + 1] === 0x49) le = true;
+  else if (b[start] === 0x4d && b[start + 1] === 0x4d) le = false;
+  else return false;
+
+  const at = (o: number, n: number) => {
+    if (!Number.isInteger(o) || o < 0 || o + n > len) throw new Malformed();
+    return start + o;
+  };
+  const r16 = (o: number) => {
+    const p = at(o, 2);
+    return le ? b[p] | (b[p + 1] << 8) : (b[p] << 8) | b[p + 1];
+  };
+  const r32 = (o: number) => {
+    const p = at(o, 4);
+    return le
+      ? (b[p] | (b[p + 1] << 8) | (b[p + 2] << 16) | (b[p + 3] << 24)) >>> 0
+      : ((b[p] << 24) | (b[p + 1] << 16) | (b[p + 2] << 8) | b[p + 3]) >>> 0;
+  };
+  const w16 = (o: number, v: number) => {
+    const p = at(o, 2);
+    if (le) [b[p], b[p + 1]] = [v & 0xff, (v >> 8) & 0xff];
+    else [b[p], b[p + 1]] = [(v >> 8) & 0xff, v & 0xff];
+  };
+  const w32 = (o: number, v: number) => {
+    const p = at(o, 4);
+    const bytes = [(v >>> 24) & 0xff, (v >>> 16) & 0xff, (v >>> 8) & 0xff, v & 0xff];
+    if (le) bytes.reverse();
+    b.set(bytes, p);
+  };
+  /** Offset and byte size of an entry's value, inline or out of line. */
+  const valueOf = (entry: number): { off: number; size: number } | null => {
+    const typeSize = TIFF_TYPE_SIZE[r16(entry + 2)];
+    if (!typeSize) return null;
+    const size = typeSize * r32(entry + 4);
+    const off = size <= 4 ? entry + 8 : r32(entry + 8);
+    at(off, size);
+    return { off, size };
+  };
+
+  if (r16(2) !== 42) return false; // BigTIFF (43) and anything else: not ours
+
+  const queue = [r32(4)];
+  const seen = new Set<number>();
+  const gpsIfds: number[] = [];
+
+  while (queue.length) {
+    const ifd = queue.shift() as number;
+    if (ifd === 0 || seen.has(ifd)) continue;
+    if (seen.size >= 32) return false; // a real file has five at most
+    seen.add(ifd);
+
+    let count = r16(ifd);
+    const tableEnd = ifd + 2 + count * 12;
+    const next = r32(tableEnd);
+
+    for (let i = 0; i < count;) {
+      const entry = ifd + 2 + i * 12;
+      const tag = r16(entry);
+      if (tag === TAG_GPS_IFD) {
+        gpsIfds.push(r32(entry + 8));
+        // Pull the following entries up over this one. Their values are
+        // addressed by absolute offset, so nothing else has to move.
+        b.copyWithin(at(entry, 12), at(entry + 12, 0), at(ifd + 2 + count * 12, 0));
+        count--;
+        continue; // the next entry now sits at index i
+      }
+      if (tag === TAG_EXIF_IFD || tag === TAG_INTEROP_IFD) queue.push(r32(entry + 8));
+      if (tag === TAG_XMP) {
+        const value = valueOf(entry);
+        if (!value) return false;
+        const from = start + value.off;
+        if (!scrubXmpLocation(b, from, from + value.size)) zero(b, from, from + value.size);
+      }
+      i++;
+    }
+
+    const removed = (tableEnd - (ifd + 2 + count * 12)) / 12;
+    if (removed > 0) {
+      w16(ifd, count);
+      const newEnd = ifd + 2 + count * 12;
+      w32(newEnd, next);
+      zero(b, at(newEnd + 4, 0), at(tableEnd + 4, 0));
+    }
+    if (next) queue.push(next);
+  }
+
+  for (const gps of gpsIfds) {
+    if (gps === 0) continue;
+    const count = r16(gps);
+    const tableEnd = gps + 2 + count * 12;
+    at(gps, tableEnd - gps + 4);
+    for (let i = 0; i < count; i++) {
+      const value = valueOf(gps + 2 + i * 12);
+      if (!value) return false; // unknown type: its data cannot be located
+      if (value.size > 4) zero(b, start + value.off, start + value.off + value.size);
+    }
+    zero(b, start + gps, start + tableEnd + 4);
+  }
+  return true;
+}
+
+// ── XMP ──────────────────────────────────────────────────────────────────────
+
+/**
+ * Place names below city level. The site shows city and country at most, so
+ * `Iptc4xmpCore:Location`, `Iptc4xmpExt:Sublocation`, `xmpDM:shotLocation` and
+ * the name/ID of a location structure go; City, ProvinceState, CountryName and
+ * CountryCode stay.
+ */
+const PLACE_NAMES = new Set([
+  'location',
+  'sublocation',
+  'shotlocation',
+  'locationname',
+  'locationid',
+]);
+
+/** A property that pins down a place more precisely than city/country. */
+function isLocationName(local: string): boolean {
+  return (
+    /^gps/i.test(local) || /latitude|longitude/i.test(local) || PLACE_NAMES.has(local.toLowerCase())
+  );
+}
+
+const NAME = '[A-Za-z_][\\w.\\-]*';
+/**
+ * A prefixed name must start where no name character precedes it. Without
+ * this anchor `matchAll` retries at every character of a long name run, which
+ * is quadratic in the length of the packet.
+ */
+const QNAME_START = '(?<![\\w.:\\-])';
+/** Start tag, prefix optional: `<exif:GPSLatitude`, `<GPSLatitude`. */
+const START_TAG = new RegExp(`<(?:(${NAME}):)?(${NAME})(?=[\\s/>])`, 'g');
+/** Prefixed attribute with its quoted value. */
+const ATTRIBUTE = new RegExp(`${QNAME_START}(${NAME}):(${NAME})\\s*=\\s*("[^"]*"|'[^']*')`, 'g');
+/** Any prefixed name, for the final check. */
+const QNAME = new RegExp(`${QNAME_START}(${NAME}):(${NAME})`, 'g');
+
+/** Index just past the `>` closing the tag whose name ends at `from`, or -1. */
+function endOfTag(s: string, from: number): number {
+  let quote = '';
+  for (let i = from; i < s.length; i++) {
+    const c = s[i];
+    if (quote) {
+      if (c === quote) quote = '';
+    } else if (c === '"' || c === "'") quote = c;
+    else if (c === '<') return -1;
+    else if (c === '>') return i + 1;
+  }
+  return -1;
+}
+
+/** Index just past the end tag matching an element opened before `from`, or -1. */
+function endOfElement(s: string, qname: string, from: number): number {
+  const re = new RegExp(`<(/?)${qname.replace(/[.\\-]/g, '\\$&')}(?=[\\s/>])`, 'g');
+  re.lastIndex = from;
+  let depth = 1;
+  for (let m = re.exec(s); m; m = re.exec(s)) {
+    const tagEnd = endOfTag(s, m.index + m[0].length);
+    if (tagEnd < 0) return -1;
+    if (m[1] === '/') {
+      if (--depth === 0) return tagEnd;
+    } else if (s[tagEnd - 2] !== '/') {
+      depth++;
+    }
+    re.lastIndex = tagEnd;
+  }
+  return -1;
+}
+
+/**
+ * Overwrite every location property in the XMP packet at `b[start, end)` with
+ * spaces. Returns false when that cannot be done with confidence (not UTF-8,
+ * an unclosed element, a location name left over afterwards); the caller then
+ * zeroes the whole packet.
+ */
+export function scrubXmpLocation(b: Uint8Array, start: number, end: number): boolean {
+  end = Math.min(end, b.length);
+  if (start < 0 || start > end) return false;
+  // Trailing NUL padding is common; a NUL anywhere else means UTF-16/32,
+  // which the byte-wise matching below cannot read.
+  let contentEnd = end;
+  while (contentEnd > start && b[contentEnd - 1] === 0) contentEnd--;
+  if (b.subarray(start, contentEnd).includes(0)) return false;
+
+  // latin1 maps every byte to exactly one character, so string indices are
+  // byte offsets. Multi-byte UTF-8 only ever appears inside values.
+  const s = Buffer.from(b.buffer, b.byteOffset + start, contentEnd - start).toString('latin1');
+  const blanks: Array<[number, number]> = [];
+
+  // Start tags inside an element already blanked are skipped: its range
+  // covers them, and walking each nested one to its end tag again would be
+  // quadratic in the nesting depth.
+  let blankedUntil = 0;
+  for (const m of s.matchAll(START_TAG)) {
+    const [, prefix, local] = m;
+    if (m.index < blankedUntil) continue;
+    if (prefix === 'xmlns' || !isLocationName(local)) continue;
+    const tagEnd = endOfTag(s, m.index + m[0].length);
+    if (tagEnd < 0) return false;
+    if (s[tagEnd - 2] === '/') {
+      blanks.push([m.index, tagEnd]);
+      blankedUntil = tagEnd;
+      continue;
+    }
+    const close = endOfElement(s, prefix ? `${prefix}:${local}` : local, tagEnd);
+    if (close < 0) return false;
+    blanks.push([m.index, close]);
+    blankedUntil = close;
+  }
+  for (const m of s.matchAll(ATTRIBUTE)) {
+    if (m[1] === 'xmlns' || !isLocationName(m[2])) continue;
+    blanks.push([m.index, m.index + m[0].length]);
+  }
+
+  for (const [from, to] of blanks) b.fill(0x20, start + from, start + to);
+
+  if (!blanks.length) return true;
+  const after = Buffer.from(b.buffer, b.byteOffset + start, contentEnd - start).toString('latin1');
+  for (const m of after.matchAll(QNAME)) {
+    if (m[1] !== 'xmlns' && isLocationName(m[2])) return false;
+  }
+  for (const m of after.matchAll(START_TAG)) {
+    if (!m[1] && isLocationName(m[2])) return false;
+  }
+  return true;
+}
+
+// ── IPTC IIM ─────────────────────────────────────────────────────────────────
+
+/**
+ * IIM carries no coordinates, but dataset 2:92 (Sub-location) names the place
+ * below city level. Its value is overwritten with spaces; the record keeps its
+ * length, so every following dataset stays where it is. City (2:90), state
+ * (2:95) and country (2:100/2:101) stay.
+ */
+function scrubIim(b: Uint8Array, start: number, end: number): void {
+  let p = start;
+  while (p + 5 <= end && b[p] === 0x1c) {
+    const record = b[p + 1];
+    const dataset = b[p + 2];
+    let length = u16be(b, p + 3);
+    let value = p + 5;
+    if (length & 0x8000) {
+      const n = length & 0x7fff; // extended dataset: n bytes of length follow
+      if (n > 4 || value + n > end) break;
+      length = readUint(b, value, n, end);
+      value += n;
+    }
+    if (value + length > end) break;
+    if (record === 2 && dataset === 92) b.fill(0x20, value, value + length);
+    p = value + length;
+  }
+  // A layout we could not follow to the end: if a sub-location might be in
+  // the rest, the rest goes.
+  for (let i = p; i + 3 <= end; i++) {
+    if (b[i] === 0x1c && b[i + 1] === 0x02 && b[i + 2] === 92) {
+      zero(b, p, end);
+      return;
+    }
+  }
+}
+
+// ── Photoshop IRB (JPEG APP13) ───────────────────────────────────────────────
+
+const PHOTOSHOP_HEADER = 'Photoshop 3.0\0';
+
+/**
+ * APP13 keeps its IPTC record (IIM has no coordinates), minus the
+ * sub-location. It can also carry an EXIF block (resources 0x0422/0x0423) or
+ * XMP (0x0424), which are treated like their APP1 counterparts.
+ */
+function scrubPhotoshop(b: Uint8Array, start: number, end: number): void {
+  let p = start;
+  if (startsWith(b, p, PHOTOSHOP_HEADER)) p += PHOTOSHOP_HEADER.length;
+  while (p + 12 <= end && startsWith(b, p, '8BIM')) {
+    const id = u16be(b, p + 4);
+    const nameField = (b[p + 6] + 2) & ~1; // Pascal string, padded to even
+    const sizeAt = p + 6 + nameField;
+    if (sizeAt + 4 > end) break;
+    const size = u32be(b, sizeAt);
+    const dataStart = sizeAt + 4;
+    const dataEnd = Math.min(dataStart + size, end);
+    if (id === 0x0404) {
+      scrubIim(b, dataStart, dataEnd);
+    } else if (id === 0x0422 || id === 0x0423) {
+      if (!scrubTiffGps(b, dataStart, dataEnd)) zero(b, dataStart, dataEnd);
+    } else if (id === 0x0424) {
+      if (!scrubXmpLocation(b, dataStart, dataEnd)) zero(b, dataStart, dataEnd);
+    }
+    p = dataStart + size + (size & 1);
+  }
+  // A layout we could not follow to the end (or a continuation segment of an
+  // IRB split across several): if an EXIF or XMP resource might be in the
+  // rest, it goes.
+  for (let i = p; i + 6 <= end; i++) {
+    if (
+      startsWith(b, i, '8BIM') &&
+      b[i + 4] === 0x04 &&
+      (b[i + 5] === 0x22 || b[i + 5] === 0x23 || b[i + 5] === 0x24)
+    ) {
+      zero(b, p, end);
+      return;
+    }
+  }
+}
+
+// ── JPEG ─────────────────────────────────────────────────────────────────────
+
+const EXIF_HEADER = 'Exif\0';
+const XMP_HEADER = 'http://ns.adobe.com/xap/1.0/\0';
+
+type HeadWalk = { status: 'more' } | { status: 'done'; end: number } | { status: 'error' };
+
+/**
+ * Walk the marker segments of the JPEG whose SOI is at `soi`, up to SOS (or
+ * EOI), scrubbing each APPn segment on the way when `scrub` is set. With
+ * `scrub` false it only reports whether the head is complete.
+ */
+function walkJpegHead(b: Uint8Array, soi: number, limit: number, scrub: boolean): HeadWalk {
+  let pos = soi + 2;
+  for (;;) {
+    // Stray NUL padding between segments is skipped, as decoders do, and any
+    // number of 0xFF fill bytes may precede a marker.
+    while (pos < limit && b[pos] === 0x00) pos++;
+    while (pos + 1 < limit && b[pos] === 0xff && b[pos + 1] === 0xff) pos++;
+    if (pos + 1 >= limit) return { status: 'more' };
+    if (b[pos] !== 0xff) return { status: 'error' };
+    const marker = b[pos + 1];
+
+    if (marker === 0x01 || (marker >= 0xd0 && marker <= 0xd7)) {
+      pos += 2;
+      continue;
+    }
+    if (marker === 0xda || marker === 0xd9) return { status: 'done', end: pos };
+    if (marker === 0xd8 || marker === 0x00) return { status: 'error' };
+
+    if (pos + 4 > limit) return { status: 'more' };
+    const len = u16be(b, pos + 2);
+    if (len < 2) return { status: 'error' };
+    const payload = pos + 4;
+    const segmentEnd = pos + 2 + len;
+    if (segmentEnd > limit) return { status: 'more' };
+    if (scrub) scrubJpegSegment(b, marker, payload, segmentEnd);
+    pos = segmentEnd;
+  }
+}
+
+/**
+ * APPn segments that are kept as they are, by marker and payload signature.
+ * Vendor segments outside this list (GoPro APP6 GPMF, Kodak APP3 `Meta`, FLIR,
+ * …) can carry their own GPS records and are zeroed whole. MPF stays: it
+ * indexes the secondary images.
+ */
+const KEPT_APP_SEGMENTS: Record<number, string[]> = {
+  0xe0: ['JFIF\0', 'JFXX\0'],
+  0xe2: ['ICC_PROFILE\0', 'MPF\0', 'FPXR\0'],
+  0xee: ['Adobe'],
+};
+
+/** Scrub one marker segment's payload `b[start, end)`. Non-APPn markers are left alone. */
+function scrubJpegSegment(b: Uint8Array, marker: number, start: number, end: number): void {
+  if (marker < 0xe0 || marker > 0xef) return;
+  if (marker === 0xe1) {
+    if (startsWith(b, start, EXIF_HEADER) && end - start >= 6) {
+      if (!scrubTiffGps(b, start + 6, end)) zero(b, start, end);
+    } else if (startsWith(b, start, XMP_HEADER)) {
+      if (!scrubXmpLocation(b, start + XMP_HEADER.length, end)) zero(b, start, end);
+    } else {
+      // Extended XMP (chunks of a packet we cannot edit piecewise), or an
+      // APP1 we cannot vouch for.
+      zero(b, start, end);
+    }
+  } else if (marker === 0xed) {
+    scrubPhotoshop(b, start, end);
+  } else if (marker === 0xeb) {
+    // JUMBF (C2PA): "JP", box instance, sequence number, then the superbox.
+    // Other APP11 content (JPEG XT) is image data and stays.
+    if (startsWith(b, start, 'JP') && startsWith(b, start + 12, 'jumb')) zero(b, start, end);
+  } else if (!(KEPT_APP_SEGMENTS[marker] ?? []).some((sig) => startsWith(b, start, sig))) {
+    zero(b, start, end);
+  }
+}
+
+/**
+ * Scrub the JPEGs nested inside `b[from, to)` (EXIF and Photoshop thumbnails).
+ * Bytes that only look like an SOI are left alone unless a valid run of
+ * segments follows them.
+ */
+function scrubNestedHeads(b: Uint8Array, from: number, to: number): void {
+  const view = b.subarray(0, to);
+  for (let hit = findSoi(view, from); hit >= 0; hit = findSoi(view, hit + 2)) {
+    if (walkJpegHead(view, hit, to, false).status !== 'error') walkJpegHead(view, hit, to, true);
+  }
+}
+
+/** Next `FF D8 FF` (an SOI followed by a marker) at or after `from`, or -1. */
+function findSoi(b: Uint8Array, from: number): number {
+  for (let i = b.indexOf(0xff, from); i >= 0 && i + 2 < b.length; i = b.indexOf(0xff, i + 1)) {
+    if (b[i + 1] === 0xd8 && b[i + 2] === 0xff) return i;
+  }
+  return -1;
+}
+
+// ── HEIF / AVIF (ISOBMFF) ────────────────────────────────────────────────────
+
+/** Brands that mark an ISOBMFF file as a HEIF-family still image. */
+const HEIF_BRANDS = new Set([
+  'mif1',
+  'mif2',
+  'msf1',
+  'heic',
+  'heix',
+  'heim',
+  'heis',
+  'hevc',
+  'hevx',
+  'hevm',
+  'hevs',
+  'avif',
+  'avis',
+  'avio',
+]);
+
+const C2PA_UUID = 'd8fec3d61b0e483c92975828877ec481';
+const XMP_UUID = 'be7acfcb97a942e89c71999491e3afac';
+
+/** A byte range to edit. `zeroOnly` ranges are zeroed as they stream past. */
+interface Edit {
+  start: number;
+  end: number;
+  zeroOnly: boolean;
+  apply: (b: Uint8Array, start: number, end: number) => void;
+}
+
+const zeroEdit = (start: number, end: number): Edit => ({
+  start,
+  end,
+  zeroOnly: true,
+  apply: zero,
+});
+
+function exifItemEdit(start: number, end: number): Edit {
+  return {
+    start,
+    end,
+    zeroOnly: false,
+    // The item starts with a 4-byte offset to the TIFF header (ISO/IEC 23008-12).
+    apply(b, s, e) {
+      if (e - s >= 4) {
+        const tiff = s + 4 + u32be(b, s);
+        if (tiff < e && scrubTiffGps(b, tiff, e)) return;
+      }
+      zero(b, s, e);
+    },
+  };
+}
+
+function xmpEdit(start: number, end: number): Edit {
+  return {
+    start,
+    end,
+    zeroOnly: false,
+    apply(b, s, e) {
+      if (!scrubXmpLocation(b, s, e)) zero(b, s, e);
+    },
+  };
+}
+
+/** Read an unsigned big-endian integer of `n` bytes, bounds-checked. */
+function readUint(b: Uint8Array, at: number, n: number, limit: number): number {
+  if (at + n > limit) throw new Malformed();
+  let v = 0;
+  for (let k = 0; k < n; k++) v = v * 256 + b[at + k];
+  return v;
+}
+
+type Box = { type: string; start: number; content: number; end: number };
+
+/** The child boxes of `[from, to)`; throws on a box that overruns it. */
+function childBoxes(b: Uint8Array, from: number, to: number): Box[] {
+  const boxes: Box[] = [];
+  let pos = from;
+  while (pos + 8 <= to) {
+    let size = u32be(b, pos);
+    let content = pos + 8;
+    if (size === 1) {
+      size = readUint(b, pos + 8, 8, to);
+      content = pos + 16;
+    } else if (size === 0) {
+      size = to - pos;
+    }
+    if (size < content - pos || pos + size > to) throw new Malformed();
+    boxes.push({ type: fourcc(b, pos + 4), start: pos, content, end: pos + size });
+    pos += size;
+  }
+  return boxes;
+}
+
+/** A NUL-terminated string at `at`, and the index after its terminator. */
+function cString(b: Uint8Array, at: number, limit: number): [string, number] {
+  const text = (from: number, to: number) =>
+    Buffer.from(b.buffer, b.byteOffset + from, Math.max(0, to - from)).toString('latin1');
+  if (at >= limit) return ['', limit];
+  const nul = b.subarray(at, limit).indexOf(0);
+  if (nul < 0) return [text(at, limit), limit];
+  return [text(at, at + nul), at + nul + 1];
+}
+
+/** `zero`: an XMP packet we cannot edit in place (compressed), zeroed whole. */
+type ItemKind = 'exif' | 'xmp' | 'zero' | 'other';
+
+/** item_ID → what it is, from `iinf`. */
+function readItemKinds(b: Uint8Array, iinf: Box): Map<number, ItemKind> {
+  const kinds = new Map<number, ItemKind>();
+  const version = b[iinf.content];
+  const first = iinf.content + 4 + (version === 0 ? 2 : 4);
+  for (const infe of childBoxes(b, first, iinf.end)) {
+    if (infe.type !== 'infe') continue;
+    const v = b[infe.content];
+    let p = infe.content + 4;
+    let itemId: number;
+    let itemType = 'mime'; // versions 0/1 have no item_type; they read like `mime`
+    if (v >= 2) {
+      const idBytes = v === 2 ? 2 : 4;
+      itemId = readUint(b, p, idBytes, infe.end);
+      p += idBytes + 2; // + item_protection_index
+      if (p + 4 > infe.end) throw new Malformed();
+      itemType = fourcc(b, p);
+      p += 4;
+    } else {
+      itemId = readUint(b, p, 2, infe.end);
+      p += 4; // + item_protection_index
+    }
+
+    let kind: ItemKind = 'other';
+    if (itemType === 'Exif') kind = 'exif';
+    else if (itemType === 'mime') {
+      const [, afterName] = cString(b, p, infe.end);
+      const [contentType, afterType] = cString(b, afterName, infe.end);
+      const [encoding] = afterType < infe.end ? cString(b, afterType, infe.end) : [''];
+      if (contentType.trim().toLowerCase() === 'application/rdf+xml') {
+        kind = encoding ? 'zero' : 'xmp';
+      }
+    }
+    kinds.set(itemId, kind);
+  }
+  return kinds;
+}
+
+type Extent = { start: number; end: number };
+
+/** item_ID → absolute file ranges, from `iloc` (and `idat` for method 1). */
+function readItemExtents(b: Uint8Array, iloc: Box, idat: Box | undefined): Map<number, Extent[]> {
+  const out = new Map<number, Extent[]>();
+  const end = iloc.end;
+  const version = b[iloc.content];
+  if (version > 2) throw new Malformed();
+  let p = iloc.content + 4;
+  const sizes = readUint(b, p, 2, end);
+  const offsetSize = sizes >> 12;
+  const lengthSize = (sizes >> 8) & 0x0f;
+  const baseOffsetSize = (sizes >> 4) & 0x0f;
+  const indexSize = version > 0 ? sizes & 0x0f : 0;
+  p += 2;
+  const idBytes = version < 2 ? 2 : 4;
+  const itemCount = readUint(b, p, idBytes, end);
+  p += idBytes;
+
+  for (let i = 0; i < itemCount; i++) {
+    const itemId = readUint(b, p, idBytes, end);
+    p += idBytes;
+    let method = 0;
+    if (version > 0) {
+      method = readUint(b, p, 2, end) & 0x0f;
+      p += 2;
+    }
+    const dataRef = readUint(b, p, 2, end);
+    p += 2;
+    const baseOffset = readUint(b, p, baseOffsetSize, end);
+    p += baseOffsetSize;
+    const extentCount = readUint(b, p, 2, end);
+    p += 2;
+
+    const extents: Extent[] = [];
+    for (let e = 0; e < extentCount; e++) {
+      p += indexSize;
+      const offset = readUint(b, p, offsetSize, end);
+      p += offsetSize;
+      const length = readUint(b, p, lengthSize, end);
+      p += lengthSize;
+      if (method === 0) {
+        extents.push({ start: baseOffset + offset, end: baseOffset + offset + length });
+      } else if (method === 1) {
+        if (!idat) throw new Malformed();
+        const start = idat.content + baseOffset + offset;
+        if (start + length > idat.end) throw new Malformed();
+        extents.push({ start, end: start + length });
+      } else {
+        extents.push({ start: -1, end: -1 }); // item reference: not file bytes
+      }
+    }
+    // Data in another file (dref) is not in this one.
+    if (dataRef === 0) out.set(itemId, extents);
+  }
+  return out;
+}
+
+/** Edits for the EXIF and XMP items listed in the `meta` box. */
+function metaEdits(b: Uint8Array, meta: Box): Edit[] {
+  const children = childBoxes(b, meta.content + 4, meta.end); // FullBox
+  const iinf = children.find((x) => x.type === 'iinf');
+  const iloc = children.find((x) => x.type === 'iloc');
+  const idat = children.find((x) => x.type === 'idat');
+  if (!iinf || !iloc) return [];
+
+  const kinds = readItemKinds(b, iinf);
+  const extents = readItemExtents(b, iloc, idat);
+  const edits: Edit[] = [];
+  for (const [itemId, kind] of kinds) {
+    if (kind === 'other') continue;
+    const ranges = extents.get(itemId) ?? [];
+    if (ranges.some((r) => r.start < 0 || r.end <= r.start)) throw new Malformed();
+    for (const r of ranges) {
+      const single = ranges.length === 1 && r.end - r.start <= MAX_ITEM_BYTES;
+      if (!single || kind === 'zero') edits.push(zeroEdit(r.start, r.end));
+      else if (kind === 'exif') edits.push(exifItemEdit(r.start, r.end));
+      else edits.push(xmpEdit(r.start, r.end));
+    }
+  }
+  return edits;
+}
+
+type HeifPlan = { status: 'more' } | { status: 'fail' } | { status: 'plan'; edits: Edit[] };
+
+/**
+ * Find the top-level `meta` box and plan the edits for its items. Needs the
+ * whole `meta` box in `b`; asks for more until it is there.
+ */
+function planHeif(b: Uint8Array, eof: boolean): HeifPlan {
+  let pos = 0;
+  for (let guard = 0; guard < 100_000; guard++) {
+    if (pos + 8 > b.length) return eof ? { status: 'plan', edits: [] } : { status: 'more' };
+    let size = u32be(b, pos);
+    const type = fourcc(b, pos + 4);
+    let header = 8;
+    if (size === 1) {
+      if (pos + 16 > b.length) return eof ? { status: 'fail' } : { status: 'more' };
+      size = readUint(b, pos + 8, 8, b.length);
+      header = 16;
+    } else if (size === 0) {
+      if (type !== 'meta') return { status: 'plan', edits: [] }; // last box, no meta
+      if (!eof) return { status: 'more' };
+      size = b.length - pos;
+    }
+    if (size < header) return { status: 'fail' };
+    if (type === 'meta') {
+      if (pos + size > b.length) return eof ? { status: 'fail' } : { status: 'more' };
+      try {
+        const edits = metaEdits(b, { type, start: pos, content: pos + header, end: pos + size });
+        return { status: 'plan', edits };
+      } catch {
+        return { status: 'fail' };
+      }
+    }
+    pos += size;
+  }
+  return { status: 'fail' };
+}
+
+// ── Streaming ────────────────────────────────────────────────────────────────
+
+/**
+ * A format's in-place editor, driven by `scrubbedStream`. Given the bytes not
+ * yet sent (`buf`, starting at absolute offset `base`), it edits what it can
+ * and returns the absolute offset up to which the bytes are final. At `eof` it
+ * must finish everything.
+ */
+interface Scrubber {
+  advance(buf: Uint8Array, base: number, eof: boolean): number;
+}
+
+/**
+ * A growable byte buffer the stream holds back while a scrubber waits.
+ * Exported for tests.
+ */
+export class Pending {
+  private buf = new Uint8Array(0);
+  length = 0;
+
+  /** Bytes allocated, for tests. */
+  get capacity(): number {
+    return this.buf.length;
+  }
+
+  view(): Uint8Array {
+    return this.buf.subarray(0, this.length);
+  }
+
+  push(chunk: Uint8Array): void {
+    const needed = this.length + chunk.length;
+    if (needed > this.buf.length) {
+      // Doubling, but never past what a head may hold plus the chunk that
+      // crossed the cap: doubling alone ends near twice HEAD_CAP.
+      const target = Math.min(Math.max(64 * 1024, needed * 2), HEAD_CAP + chunk.length);
+      const grown = new Uint8Array(Math.max(needed, target));
+      grown.set(this.view());
+      this.buf = grown;
+    }
+    this.buf.set(chunk, this.length);
+    this.length += chunk.length;
+  }
+
+  /** Remove and return the first `n` bytes. */
+  take(n: number): Uint8Array {
+    const out = this.buf.slice(0, n);
+    const rest = this.buf.subarray(n, this.length);
+    if (this.buf.length > 1024 * 1024 && rest.length < this.buf.length / 4) {
+      // Give a large head's memory back once it has been sent.
+      this.buf = new Uint8Array(Math.max(64 * 1024, rest.length * 2));
+      this.buf.set(rest);
+    } else {
+      this.buf.copyWithin(0, n, this.length);
+    }
+    this.length -= n;
+    return out;
+  }
+}
+
+/** Reads a web stream chunk by chunk; `null` at the end. */
+class ChunkReader {
+  private reader: ReadableStreamDefaultReader<Uint8Array>;
+
+  constructor(stream: ReadableStream<Uint8Array>) {
+    this.reader = stream.getReader();
+  }
+
+  async read(): Promise<Uint8Array | null> {
+    for (;;) {
+      const { done, value } = await this.reader.read();
+      if (done) return null;
+      if (value && value.length) return value;
+    }
+  }
+
+  cancel(reason?: unknown): Promise<void> {
+    return this.reader.cancel(reason);
+  }
+}
+
+function scrubbedStream(
+  reader: ChunkReader,
+  pending: Pending,
+  scrubber: Scrubber,
+  initialEof: boolean,
+): ReadableStream<Uint8Array> {
+  let base = 0;
+  let eof = initialEof;
+  return new ReadableStream<Uint8Array>(
+    {
+      async pull(controller) {
+        for (;;) {
+          const view = pending.view();
+          let safe = scrubber.advance(view, base, eof);
+          if (eof) safe = base + view.length;
+          safe = Math.min(safe, base + view.length);
+          if (safe > base) {
+            controller.enqueue(pending.take(safe - base));
+            base = safe;
+            return;
+          }
+          if (eof) {
+            controller.close();
+            return;
+          }
+          const chunk = await reader.read();
+          if (chunk) pending.push(chunk);
+          else eof = true;
+        }
+      },
+      cancel(reason) {
+        return reader.cancel(reason);
+      },
+    },
+    { highWaterMark: 0 },
+  );
+}
+
+/**
+ * JPEG, from the primary image's first SOS on.
+ *
+ * Inside an image (`inScan`), markers are followed to its EOI: entropy-coded
+ * data cannot contain 0xFF followed by anything but 0x00 or a restart marker,
+ * so every other marker is a real segment. An APPn segment between the scans
+ * of a progressive JPEG is scrubbed like one in the head.
+ *
+ * After EOI, the trailer is searched for further JPEGs (MPF secondary images
+ * and the like), whose heads are held until complete, scrubbed, and followed
+ * to their own EOI in turn.
+ */
+class JpegScrubber implements Scrubber {
+  /** Absolute offset of the next byte to examine. */
+  private pos: number;
+  private inScan = true;
+
+  constructor(sos: number) {
+    this.pos = sos;
+  }
+
+  advance(buf: Uint8Array, base: number, eof: boolean): number {
+    const end = base + buf.length;
+    for (;;) {
+      const i = this.pos - base;
+      if (this.inScan) {
+        const ff = buf.indexOf(0xff, i);
+        if (ff < 0) {
+          this.pos = end;
+          return end;
+        }
+        // Hold a marker until its bytes are here.
+        const hold = () => {
+          this.pos = eof ? end : base + ff;
+          return eof ? end : base + ff;
+        };
+        if (ff + 1 >= buf.length) return hold();
+        const marker = buf[ff + 1];
+        if (marker === 0xff) {
+          this.pos = base + ff + 1; // fill byte
+        } else if (marker === 0x00 || marker === 0x01 || (marker >= 0xd0 && marker <= 0xd7)) {
+          this.pos = base + ff + 2; // stuffed byte, TEM or restart marker
+        } else if (marker === 0xd9) {
+          this.inScan = false;
+          this.pos = base + ff + 2;
+        } else if (marker === 0xd8) {
+          this.inScan = false; // an SOI without EOI before it: treat as trailer
+          this.pos = base + ff;
+        } else {
+          if (ff + 4 > buf.length) return hold();
+          const length = u16be(buf, ff + 2);
+          const segmentEnd = ff + 2 + length;
+          if (length < 2) {
+            this.pos = base + ff + 2;
+            continue;
+          }
+          if (segmentEnd > buf.length) {
+            if (!eof) return hold();
+            if (marker >= 0xe0 && marker <= 0xef) zero(buf, ff + 4, buf.length); // truncated
+            this.pos = end;
+            return end;
+          }
+          scrubJpegSegment(buf, marker, ff + 4, segmentEnd);
+          this.pos = base + segmentEnd;
+        }
+        continue;
+      }
+
+      const hit = findSoi(buf, i);
+      if (hit < 0) {
+        // Hold back a trailing FF or FF D8 that may start a pattern.
+        const n = buf.length;
+        const keep =
+          n >= 2 && buf[n - 2] === 0xff && buf[n - 1] === 0xd8
+            ? 2
+            : n >= 1 && buf[n - 1] === 0xff
+              ? 1
+              : 0;
+        this.pos = base + Math.max(i, n - keep);
+        return eof ? end : base + n - keep;
+      }
+      const head = walkJpegHead(buf, hit, buf.length, false);
+      if (head.status === 'more' && !eof && buf.length - hit < EMBEDDED_HEAD_CAP) {
+        this.pos = base + hit;
+        return base + hit; // hold from here until the head is complete
+      }
+      if (head.status === 'error') {
+        this.pos = base + hit + 2; // only looked like a JPEG
+        continue;
+      }
+      walkJpegHead(buf, hit, buf.length, true);
+      if (head.status === 'done') {
+        scrubNestedHeads(buf, hit + 2, head.end);
+        this.inScan = true;
+        this.pos = base + head.end;
+      } else {
+        // Over the cap, or the file ended: scrubbed what is here, move on.
+        scrubNestedHeads(buf, hit + 2, buf.length);
+        this.pos = base + hit + 2;
+      }
+    }
+  }
+}
+
+/** HEIF/AVIF: the planned item edits, plus top-level `uuid` boxes as they pass. */
+class HeifScrubber implements Scrubber {
+  private nextBox = 0;
+  private edits: Edit[];
+
+  constructor(edits: Edit[]) {
+    this.edits = [...edits].sort((a, b) => a.start - b.start);
+  }
+
+  private insert(edit: Edit): void {
+    const i = this.edits.findIndex((e) => e.start > edit.start);
+    if (i < 0) this.edits.push(edit);
+    else this.edits.splice(i, 0, edit);
+  }
+
+  advance(buf: Uint8Array, base: number, eof: boolean): number {
+    const end = base + buf.length;
+    let safe = end;
+
+    // Top-level boxes: a C2PA manifest or an XMP packet can sit in a `uuid`
+    // box anywhere in the file, usually after `mdat`.
+    while (this.nextBox < end) {
+      const rel = this.nextBox - base;
+      const avail = buf.length - rel;
+      if (avail < 8 || (u32be(buf, rel) === 1 && avail < 16)) {
+        if (eof) this.nextBox = Infinity;
+        else safe = Math.min(safe, this.nextBox);
+        break;
+      }
+      let size = u32be(buf, rel);
+      let header = 8;
+      if (size === 1) {
+        size = readUint(buf, rel + 8, 8, buf.length);
+        header = 16;
+      }
+      const type = fourcc(buf, rel + 4);
+      if (type === 'uuid' && avail < header + 16 && !eof) {
+        safe = Math.min(safe, this.nextBox);
+        break;
+      }
+      const boxEnd = size === 0 ? Infinity : this.nextBox + size;
+      if (size !== 0 && size < header) {
+        this.nextBox = Infinity; // malformed: stop walking, items are planned already
+        break;
+      }
+      if (type === 'uuid' && avail >= header + 16) {
+        const id = Buffer.from(buf.subarray(rel + header, rel + header + 16)).toString('hex');
+        const contentStart = this.nextBox + header + 16;
+        if (id === C2PA_UUID) this.insert(zeroEdit(contentStart, boxEnd));
+        else if (id === XMP_UUID) {
+          this.insert(
+            boxEnd - contentStart <= MAX_ITEM_BYTES
+              ? xmpEdit(contentStart, boxEnd)
+              : zeroEdit(contentStart, boxEnd),
+          );
+        }
+      }
+      this.nextBox = boxEnd;
+    }
+
+    // Edits, in file order.
+    const remaining: Edit[] = [];
+    let blocked = false;
+    for (const edit of this.edits) {
+      if (blocked || edit.start >= end) {
+        remaining.push(edit);
+        continue;
+      }
+      const from = Math.max(edit.start, base) - base;
+      const to = Math.min(edit.end, end) - base;
+      if (edit.zeroOnly) {
+        zero(buf, from, to);
+        if (edit.end > end) remaining.push(edit);
+        continue;
+      }
+      if (edit.end <= end || eof) {
+        edit.apply(buf, from, to);
+        continue;
+      }
+      // Hold everything from its start until the whole range is here.
+      safe = Math.min(safe, edit.start);
+      remaining.push(edit);
+      blocked = true;
+    }
+    this.edits = remaining;
+    return Math.max(base, safe);
+  }
+}
+
+// ── Entry point ──────────────────────────────────────────────────────────────
+
+export type LocationScrubResult =
+  | {
+      ok: true;
+      stream: ReadableStream<Uint8Array>;
+      /** 'passthrough' for formats this module does not edit. */
+      format: 'jpeg' | 'heif' | 'passthrough';
+    }
+  | { ok: false; reason: string };
+
+/**
+ * Wrap an original's byte stream so it comes out without location metadata.
+ *
+ * Reads the head before returning, so a file whose metadata cannot be located
+ * is refused (`ok: false`) before any response is committed. The source is
+ * cancelled in that case. Read errors propagate.
+ */
+export async function scrubLocationStream(
+  source: ReadableStream<Uint8Array>,
+): Promise<LocationScrubResult> {
+  const reader = new ChunkReader(source);
+  const pending = new Pending();
+  let eof = false;
+
+  const fill = async (n: number) => {
+    while (!eof && pending.length < n) {
+      const chunk = await reader.read();
+      if (chunk) pending.push(chunk);
+      else eof = true;
+    }
+  };
+  const refuse = async (reason: string): Promise<LocationScrubResult> => {
+    await reader.cancel().catch(() => {});
+    return { ok: false, reason };
+  };
+
+  // Eight bytes tell JPEG (FF D8 FF) from ISOBMFF (`ftyp` at 4). Asking for
+  // more would stall a short first chunk of a passthrough file.
+  await fill(8);
+  let b = pending.view();
+
+  if (b.length >= 3 && b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff) {
+    let sos = 0;
+    for (;;) {
+      b = pending.view();
+      const head = walkJpegHead(b, 0, b.length, false);
+      if (head.status === 'done') {
+        sos = head.end;
+        break;
+      }
+      if (head.status === 'error' || eof) return refuse('JPEG head could not be parsed');
+      if (pending.length > HEAD_CAP) return refuse('JPEG head exceeds the cap');
+      await fill(pending.length + 1);
+    }
+    walkJpegHead(b, 0, b.length, true);
+    scrubNestedHeads(b, 2, sos);
+    return {
+      ok: true,
+      format: 'jpeg',
+      stream: scrubbedStream(reader, pending, new JpegScrubber(sos), eof),
+    };
+  }
+
+  if (b.length >= 8 && fourcc(b, 4) === 'ftyp') {
+    const ftypSize = u32be(b, 0);
+    if (ftypSize < 16 || ftypSize > 4096) return refuse('unexpected ftyp box');
+    await fill(ftypSize);
+    b = pending.view();
+    if (b.length < ftypSize) return refuse('truncated ftyp box');
+    const brands = [fourcc(b, 8)];
+    for (let p = 16; p + 4 <= ftypSize; p += 4) brands.push(fourcc(b, p));
+    if (brands.some((brand) => HEIF_BRANDS.has(brand))) {
+      for (;;) {
+        b = pending.view();
+        const plan = planHeif(b, eof);
+        if (plan.status === 'plan') {
+          return {
+            ok: true,
+            format: 'heif',
+            stream: scrubbedStream(reader, pending, new HeifScrubber(plan.edits), eof),
+          };
+        }
+        if (plan.status === 'fail') return refuse('HEIF metadata could not be parsed');
+        if (pending.length > HEAD_CAP) return refuse('HEIF meta box beyond the cap');
+        await fill(pending.length + 1);
+      }
+    }
+  }
+
+  // Not a format we edit: send it as it is.
+  return {
+    ok: true,
+    format: 'passthrough',
+    stream: scrubbedStream(reader, pending, { advance: (buf, base) => base + buf.length }, eof),
+  };
+}
+
+/** Buffered convenience: scrub `bytes` and return the result, or null if refused. */
+export async function scrubLocation(bytes: Uint8Array): Promise<Uint8Array | null> {
+  const source = new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(bytes.slice());
+      controller.close();
+    },
+  });
+  const result = await scrubLocationStream(source);
+  if (!result.ok) return null;
+  return new Uint8Array(await new Response(result.stream).arrayBuffer());
+}
+
+// ── For the doctor ───────────────────────────────────────────────────────────
+
+const SCRUBBABLE_MIME = new Set([
+  'image/jpeg',
+  'image/jpg',
+  'image/heic',
+  'image/heif',
+  'image/avif',
+]);
+const SCRUBBABLE_EXT = /\.(jpe?g|jpe|jfif|heic|heif|hif|avif)$/i;
+
+/**
+ * Whether an Immich asset's original is a format this module cleans, judged
+ * from what the album response says about it (the stream itself is sniffed).
+ */
+export function isLocationScrubbable(asset: {
+  type?: string;
+  originalMimeType?: string | null;
+  originalFileName?: string | null;
+}): boolean {
+  if (asset.type && asset.type !== 'IMAGE') return false;
+  const mime = asset.originalMimeType?.toLowerCase().split(';')[0].trim();
+  if (mime) return SCRUBBABLE_MIME.has(mime);
+  return SCRUBBABLE_EXT.test(asset.originalFileName ?? '');
+}
diff --git a/lib/mapService.ts b/lib/mapService.ts
index a94209b..d5b9904 100644
--- a/lib/mapService.ts
+++ b/lib/mapService.ts
@@ -20,6 +20,52 @@ export interface MapAlbumEntry {
   latSum: number;
   lngSum: number;
   coverAssetId: string;
+  /** Set when the cover was edited in Immich, for its image URL's edit marker (#831). */
+  coverEdit?: { isEdited: true; updatedAt?: string };
+}
+
+interface MapConfig {
+  standaloneAlbums?: readonly string[];
+  subpages: ReadonlyArray<{
+    slug: string;
+    albumIds: readonly string[];
+    enabled?: boolean;
+    hidden?: boolean;
+  }>;
+}
+
+/**
+ * The subpage a marker links an album to, and whose password gates it on the
+ * map: the first listed one that carries it. Never an offline subpage (its URL
+ * is a 404 and its password guards nothing), and never a hidden one (the
+ * marker would publish its address).
+ */
+function mapSubpageFor(config: MapConfig, albumId: string) {
+  return config.subpages.find((s) => isListedSubpage(s) && s.albumIds.includes(albumId));
+}
+
+/**
+ * The counts the /map header prints, for this viewer.
+ *
+ * `/api/map` drops every album whose subpage or own password the viewer has
+ * not unlocked; the header counted them anyway, so a visitor read "3
+ * collections · 12 albums" above a map that showed two. Same rule here, the
+ * same subpage per album (`mapSubpageFor`), so the two cannot disagree.
+ * `isAllowed` is `isAuthenticated` bound to the request's cookies.
+ */
+export function visibleMapCounts(
+  config: MapConfig,
+  isAllowed: (key: string, type: 'subpage' | 'album') => boolean,
+): { collections: number; albums: number } {
+  const collections = config.subpages.filter(
+    (sp) => isListedSubpage(sp) && isAllowed(sp.slug, 'subpage'),
+  ).length;
+  let albums = 0;
+  for (const id of listedAlbumIds(config)) {
+    const sp = mapSubpageFor(config, id);
+    if ((!sp || isAllowed(sp.slug, 'subpage')) && isAllowed(id, 'album')) albums++;
+  }
+  return { collections, albums };
 }
 
 /** A clustered map marker — one per unique city/country. */
@@ -56,10 +102,7 @@ export async function getMapData(): Promise<MapLocation[]> {
       // Build a lookup: album ID → { name, slug, subpageSlug? }
       const albumMeta = new Map<string, { name: string; slug: string; subpageSlug?: string }>();
       for (const a of albums) {
-        // The subpage the marker links to, and whose password gates it. Never
-        // an offline one (its URL is a 404 and its password guards nothing),
-        // and never a hidden one: the marker would publish its address.
-        const sp = config.subpages.find((s) => isListedSubpage(s) && s.albumIds.includes(a.id));
+        const sp = mapSubpageFor(config, a.id);
         albumMeta.set(a.id, { name: a.albumName, slug: a.slug, subpageSlug: sp?.slug });
       }
 
@@ -107,6 +150,9 @@ export async function getMapData(): Promise<MapLocation[]> {
               latSum: 0,
               lngSum: 0,
               coverAssetId: asset.id,
+              ...(asset.isEdited === true
+                ? { coverEdit: { isEdited: true as const, updatedAt: asset.updatedAt } }
+                : {}),
             };
             byAlbum.set(album.id, entry);
           }
diff --git a/lib/privacy.ts b/lib/privacy.ts
index a7410ac..9102171 100644
--- a/lib/privacy.ts
+++ b/lib/privacy.ts
@@ -57,7 +57,18 @@ export interface ProcessingFact {
  */
 export function processingFacts(
   config: AppConfig,
-  env: { CDN_URL?: string; hasPasswords: boolean },
+  env: {
+    CDN_URL?: string;
+    hasPasswords: boolean;
+    /**
+     * At least one proofing link exists in content/proofing.json. Links are
+     * created in the admin panel whatever `proofing.enabled` says, so the
+     * setting cannot stand in for this.
+     */
+    hasProofingLinks: boolean;
+    /** PROOFING_WEBHOOK_URL, already parsed (lib/proofWebhook.ts). */
+    proofingWebhookUrl?: string | null;
+  },
 ): ProcessingFact[] {
   const facts: ProcessingFact[] = [
     {
@@ -115,13 +126,27 @@ export function processingFacts(
       thirdParty: false,
     });
   }
+  // A subpage's own `proofing: true` turns the hearts on even with the global
+  // switch off (resolveProofing), so the global flag alone would under-report.
+  const favourites = config.proofing.enabled || config.subpages.some((sp) => sp.proofing);
   facts.push({
     topic: 'Browser storage',
-    detail: `The colour-mode choice${
-      config.proofing.enabled ? ' and photo selections (proofing)' : ''
-    } are kept in the visitor’s own browser (localStorage) and never sent to the server.`,
+    detail: favourites
+      ? 'The colour-mode choice and the photos a visitor marks as favourites on an album are kept in the visitor’s own browser (localStorage). Folio does not store them on the server.'
+      : 'The colour-mode choice is kept in the visitor’s own browser (localStorage). Folio does not store it on the server.',
     thirdParty: false,
   });
+  if (env.hasProofingLinks) {
+    facts.push({
+      topic: 'Proofing links',
+      detail: `Each client proofing link (/proof/…) is stored on this server in content/proofing.json: the client name you entered, the photos the client selects, when the selection was last changed and submitted, and how many ZIP downloads were used. The data stays until you delete the link in the admin panel; an expired link stops working but keeps its data.${
+        env.proofingWebhookUrl
+          ? ` When the client submits, a notification with the client name, the album name and the number of selected photos goes to ${hostOf(env.proofingWebhookUrl)}.`
+          : ''
+      }`,
+      thirdParty: !!env.proofingWebhookUrl,
+    });
+  }
   if (env.CDN_URL) {
     facts.push({
       topic: 'CDN',
@@ -152,6 +177,7 @@ export function starterHeadings(lang: string, facts: ProcessingFact[]): string {
     topics.has('Map') ? h('Map', 'Kartendienst') : '',
     topics.has('Visitor statistics') ? h('Visitor statistics', 'Besucherstatistik') : '',
     topics.has('Contact form') ? h('Contact form', 'Kontaktformular') : '',
+    topics.has('Proofing links') ? h('Client proofing', 'Bildauswahl durch Kunden') : '',
     h('Cookies and browser storage', 'Cookies und lokaler Speicher'),
     topics.has('CDN') ? h('Content delivery network', 'Content Delivery Network') : '',
     h('Your rights', 'Ihre Rechte'),
diff --git a/lib/themeScript.ts b/lib/themeScript.ts
new file mode 100644
index 0000000..7cd13e1
--- /dev/null
+++ b/lib/themeScript.ts
@@ -0,0 +1,20 @@
+/**
+ * The colour mode, applied before the first paint.
+ *
+ * The server renders the configured mode onto <html> (`data-theme`, or nothing
+ * for `mode: auto`), but it cannot know a visitor's stored choice or their OS
+ * setting. ThemeToggle corrects both — once its bundle has loaded and run,
+ * which is after the page has already painted in the server's guess. A visitor
+ * who picked light saw a dark flash on every navigation.
+ *
+ * This script runs synchronously in <head>, so the attribute is right before
+ * the body is parsed. It must stay self-contained (it is inlined as a string)
+ * and carries the CSP nonce, since `proxy.ts` allows no other inline script.
+ * It is also the only thing that applies the mode on the site gate, which
+ * renders without the header and therefore without ThemeToggle.
+ *
+ * The rules match ThemeToggle: a stored choice wins, then the configured mode
+ * (`data-default-theme`), and `auto` — or no attribute at all — follows the OS.
+ * Storage can throw (blocked site data); the server's attribute then stands.
+ */
+export const THEME_INIT_SCRIPT = `(function(){try{var d=document.documentElement,t=null;try{t=localStorage.getItem('theme')}catch(e){}if(t!=='light'&&t!=='dark'){t=d.getAttribute('data-default-theme');if(t!=='light'&&t!=='dark'){t=window.matchMedia&&window.matchMedia('(prefers-color-scheme: light)').matches?'light':'dark'}}d.setAttribute('data-theme',t)}catch(e){}})();`;
diff --git a/lib/urls.ts b/lib/urls.ts
index 5ddc7ad..e4b0ef8 100644
--- a/lib/urls.ts
+++ b/lib/urls.ts
@@ -8,6 +8,7 @@ import { env } from './env';
 import { cdnBase } from './cdn';
 import { thumbHashToBlurDataUrl, thumbHashToDominantHex } from './thumbhash';
 import type { ImmichAsset } from './immich';
+import { formatLens } from './exif';
 
 /**
  * Optional cache-buster, appended to every image and video URL.
@@ -22,15 +23,56 @@ import type { ImmichAsset } from './immich';
  */
 const cacheBuster = env.IMAGE_CACHE_VERSION ? `&v=${env.IMAGE_CACHE_VERSION}` : '';
 
+/** What an image URL needs to know about an asset beyond its ID (#831). */
+export interface ImageRef {
+  id: string;
+  isEdited?: boolean | null;
+  updatedAt?: string | null;
+}
+
+/**
+ * The `e` parameter an edited photo's image URL carries, or null for a photo
+ * that is not edited (#831).
+ *
+ * Immich applies an edit made in its editor (crop, rotate) only when asked
+ * with `edited=true`. The image route always asks — the server decides that
+ * an edit is shown, not the URL. The marker is purely a cache key: the asset
+ * ID does not change when a photo is edited, so without it a browser or CDN
+ * that cached the unedited preview under the same URL would keep showing it
+ * for a year (`immutable`). Only edited photos get a new URL; every other URL
+ * stays as it was, which is why this is not a bump of IMAGE_CACHE_VERSION.
+ *
+ * The value is the asset's `updatedAt` in whole seconds, base 36 — precise
+ * enough to tell two edits apart, without publishing the millisecond. Immich regenerates an
+ * asset's thumbnails and ThumbHash (and, for a crop or a quarter turn, its
+ * dimensions) when an edit is applied or changed, which writes the asset and
+ * moves `updatedAt` — so a re-edit produces a new URL once the album cache
+ * (CACHE_TTL) has picked it up. Other updates to an edited photo move it too;
+ * that costs one refetch of that photo, nothing more.
+ */
+export function editMarker(asset: Omit<ImageRef, 'id'>): string | null {
+  if (asset.isEdited !== true) return null;
+  const time = asset.updatedAt ? Date.parse(asset.updatedAt) : NaN;
+  return Number.isFinite(time) && time >= 1000 ? Math.floor(time / 1000).toString(36) : '1';
+}
+
 /**
  * Generate a public image proxy URL for an asset. Absolute, on the CDN, when
  * CDN mode is on (lib/cdn.ts); relative otherwise.
+ *
+ * Pass the asset rather than its ID wherever it is at hand: only then can an
+ * edited photo get its edit marker (see editMarker()). A bare ID still shows
+ * the edit — the route always asks for it — but under the same URL as before
+ * the edit, so a copy cached earlier can outlive it.
  */
 export function imageUrl(
-  assetId: string,
+  asset: string | ImageRef,
   size: 'thumbnail' | 'preview' | 'original' = 'preview',
 ): string {
-  return `${cdnBase()}/api/image/${encodeAssetId(assetId)}?size=${size}${cacheBuster}`;
+  const ref = typeof asset === 'string' ? { id: asset } : asset;
+  const marker = editMarker(ref);
+  const edit = marker ? `&e=${marker}` : '';
+  return `${cdnBase()}/api/image/${encodeAssetId(ref.id)}?size=${size}${edit}${cacheBuster}`;
 }
 
 /**
@@ -92,7 +134,8 @@ export function assetExifSummary(asset: Pick<ImmichAsset, 'exifInfo'>): ExifSumm
   if (!exif) return undefined;
 
   const camera = exif.model || undefined;
-  const lens = exif.lensModel || undefined;
+  // A phone's lens names the phone again; the camera is already on the tile.
+  const lens = formatLens(exif.lensModel, exif.model) || undefined;
   const focalLength = exif.focalLength ? `${exif.focalLength}mm` : undefined;
 
   if (!camera && !lens && !focalLength) return undefined;
@@ -110,6 +153,19 @@ export function downloadUrl(albumId: string, assetId: string): string {
   return `/api/download/${encodeAssetId(albumId)}/${encodeAssetId(assetId)}`;
 }
 
+/**
+ * The full-resolution image the lightbox zooms into (#467).
+ *
+ * Shaped like downloadUrl() for the same reason: the route authorises the
+ * zoom against the album that offered it — allowlist, every password gate,
+ * zoom resolved on — and checks the asset belongs to it. Relative even in CDN
+ * mode: the answer depends on the visitor's cookies and is `private`, so it
+ * must not be cached at the edge.
+ */
+export function zoomUrl(albumId: string, assetId: string): string {
+  return `/api/zoom/${encodeAssetId(albumId)}/${encodeAssetId(assetId)}`;
+}
+
 /**
  * The endpoint that streams an album (or a selection of its assets) as a ZIP.
  *
@@ -160,8 +216,22 @@ const ROTATED_ORIENTATIONS = new Set([5, 6, 7, 8]);
  * Compute the natural aspect ratio (width / height) from EXIF dimensions,
  * as the image is displayed rather than as it is stored.
  * Returns undefined if dimensions are not available.
+ *
+ * A photo edited in Immich (#831) is the exception: its EXIF still describes
+ * the file as stored, before a crop or a quarter turn, while the edited
+ * rendition Folio shows has other proportions. Immich's top-level
+ * `width`/`height` are the edited, upright size, so those are used for it.
  */
-export function assetAspectRatio(asset: Pick<ImmichAsset, 'exifInfo'>): number | undefined {
+export function assetAspectRatio(
+  asset: Pick<ImmichAsset, 'exifInfo' | 'isEdited' | 'width' | 'height'>,
+): number | undefined {
+  if (asset.isEdited === true) {
+    // Without the edited size there is nothing right to say: EXIF would give
+    // the unedited proportions. Undefined leaves the layout's default ratio.
+    return asset.width && asset.height && asset.width > 0 && asset.height > 0
+      ? asset.width / asset.height
+      : undefined;
+  }
   const w = asset.exifInfo?.exifImageWidth;
   const h = asset.exifInfo?.exifImageHeight;
   if (!w || !h || h <= 0) return undefined;
diff --git a/lib/zipArchive.ts b/lib/zipArchive.ts
index 604cde6..ca2d90a 100644
--- a/lib/zipArchive.ts
+++ b/lib/zipArchive.ts
@@ -10,13 +10,14 @@ import { NextRequest, NextResponse } from 'next/server';
 import { Readable } from 'node:stream';
 import archiver from 'archiver';
 import { immich, type ImmichAsset } from '@/lib/immich';
-import { contentDisposition, safeDownloadName } from '@/lib/downloadName';
+import { contentDisposition, editedDownloadName, safeDownloadName } from '@/lib/downloadName';
 import { getClientIp } from '@/lib/rate-limit';
 import { getDictionary } from '@/lib/i18n';
 import { getLocale, getServerDictionary } from '@/lib/i18n/server';
 import { getConfigOrNull } from '@/lib/config';
 import { accentForMode, resolveTheme } from '@/lib/config/theme';
 import { env } from '@/lib/env';
+import { scrubLocationStream } from '@/lib/locationScrub';
 
 /** Escape a value interpolated into the refusal page. */
 function escapeHtml(value: string): string {
@@ -116,6 +117,26 @@ export const REFUSAL_PALETTES: Record<string, { dark: Palette; light: Palette }>
     dark: { bg: '#151515', text: '#e8e8e8', muted: '#a5a5a5' },
     light: { bg: '#fafafa', text: '#111111', muted: '#475569' },
   },
+  kunsthalle: {
+    dark: { bg: '#2b2b29', text: '#f0efeb', muted: '#c6c4bd' },
+    light: { bg: '#dddcd8', text: '#1b1b19', muted: '#3f3e3a' },
+  },
+  ma: {
+    dark: { bg: '#1a1917', text: '#ece7dd', muted: '#b5ad9f' },
+    light: { bg: '#f0ede6', text: '#1f1d1a', muted: '#4d4943' },
+  },
+  cyanotype: {
+    dark: { bg: '#0e1621', text: '#e3eaf0', muted: '#a8b7c6' },
+    light: { bg: '#eef2f4', text: '#10243a', muted: '#34495f' },
+  },
+  salon: {
+    dark: { bg: '#1c1315', text: '#f3eae7', muted: '#c5b1ad' },
+    light: { bg: '#f5efec', text: '#271618', muted: '#573f42' },
+  },
+  birch: {
+    dark: { bg: '#121613', text: '#e9eee9', muted: '#aab5ac' },
+    light: { bg: '#f3f5f1', text: '#19201b', muted: '#434e46' },
+  },
 };
 
 const HEX_COLOUR = /^#[0-9a-f]{3,8}$/i;
@@ -216,6 +237,28 @@ function uniqueEntryName(raw: string | undefined, used: Set<string>): string {
   return name;
 }
 
+/**
+ * The timestamp an entry carries: when the photo was taken, not when the ZIP
+ * was built. Without it every file unpacked with the download time, so a
+ * folder sorted by date lost the album's order.
+ *
+ * A ZIP stores a wall-clock time with no zone, and archiver writes the UTC
+ * fields of the Date it is given. Immich's `localDateTime` is exactly that
+ * shape — the capture time in the photographer's zone, written as if it were
+ * UTC — so it lands in the archive as the time on the camera, whatever zone
+ * the server runs in. `dateTimeOriginal` and `fileCreatedAt` are real instants
+ * and only the fallbacks. All three come with the album response: no extra
+ * Immich request. Undefined leaves archiver's default (now).
+ */
+export function entryDate(asset: ImmichAsset): Date | undefined {
+  for (const raw of [asset.localDateTime, asset.exifInfo?.dateTimeOriginal, asset.fileCreatedAt]) {
+    if (!raw) continue;
+    const date = new Date(raw);
+    if (!Number.isNaN(date.getTime())) return date;
+  }
+  return undefined;
+}
+
 /**
  * Append one entry, resolving once it has been written (or the archive has been
  * torn down because the visitor left).
@@ -232,7 +275,12 @@ function uniqueEntryName(raw: string | undefined, used: Set<string>): string {
  * that for a queued or half-read entry, and the upstream body would otherwise
  * hold its socket out of undici's pool until GC finalises it (#635).
  */
-function appendEntry(archive: archiver.Archiver, source: Readable, name: string): Promise<void> {
+function appendEntry(
+  archive: archiver.Archiver,
+  source: Readable,
+  name: string,
+  date?: Date,
+): Promise<void> {
   return new Promise<void>((resolve, reject) => {
     const cleanup = () => {
       archive.off('entry', onEntry);
@@ -259,7 +307,7 @@ function appendEntry(archive: archiver.Archiver, source: Readable, name: string)
     archive.once('entry', onEntry);
     archive.once('error', onError);
     archive.once('close', onClose);
-    archive.append(source, { name });
+    archive.append(source, date ? { name, date } : { name });
   });
 }
 
@@ -352,7 +400,8 @@ export async function withArchiveSlot(
 }
 
 /**
- * Stream `assets` as a ZIP of originals.
+ * Stream `assets` as a ZIP of originals, without their location metadata
+ * (lib/locationScrub.ts).
  *
  * archiver writes data descriptors, so entry sizes are never known up front and
  * memory stays flat no matter how large the album is. The loop pulls one
@@ -439,20 +488,65 @@ export function streamArchive(
   void (async () => {
     try {
       const used = new Set<string>();
+      // Originals refused by the location scrubber. The ZIP carries on without
+      // them, so the count is the only trace a visitor's archive came up short.
+      let dropped = 0;
       for (const asset of assets) {
         // The visitor left (or the archive failed): stop pulling originals.
         if (archive.destroyed) break;
-        const result = await immich.streamAsset(asset.id, 'original');
+        // Edited in Immich: the edit, not the unedited camera file (#831).
+        const edited = asset.isEdited === true;
+        const result = await immich.streamAsset(asset.id, 'original', edited);
         if (!result) continue;
         if (archive.destroyed) {
           // Left while the headers were on their way: release the body unread.
           await result.stream.cancel();
           break;
         }
+        // Location out, as for the single download. Only the head of each
+        // original is held while its metadata is found, so memory stays flat.
+        const scrubbed = await scrubLocationStream(result.stream as ReadableStream<Uint8Array>);
+        if (!scrubbed.ok) {
+          dropped++;
+          console.warn(
+            `[Download] Left asset ${asset.id} out of the archive "${albumName}": its location metadata could not be removed (${scrubbed.reason}).`,
+          );
+          continue;
+        }
+        // An edited photo's rendition is expected as JPEG (#831); one the
+        // scrubber passes through untouched stays out, as for the single
+        // download.
+        if (edited && scrubbed.format === 'passthrough') {
+          dropped++;
+          await scrubbed.stream.cancel().catch(() => {});
+          console.warn(
+            `[Download] Left edited asset ${asset.id} out of the archive "${albumName}": Immich sent ${result.contentType || 'no type'}, which is not a JPEG or HEIF-family file.`,
+          );
+          continue;
+        }
+        if (archive.destroyed) {
+          await scrubbed.stream.cancel();
+          break;
+        }
         const nodeStream = Readable.fromWeb(
-          result.stream as unknown as import('node:stream/web').ReadableStream,
+          scrubbed.stream as unknown as import('node:stream/web').ReadableStream,
+        );
+        await appendEntry(
+          archive,
+          nodeStream,
+          uniqueEntryName(
+            edited
+              ? editedDownloadName(asset.originalFileName, result.contentType)
+              : asset.originalFileName,
+            used,
+          ),
+          entryDate(asset),
+        );
+      }
+      if (dropped) {
+        console.warn(
+          `[Download] Archive "${albumName}" is missing ${dropped} of ${assets.length} originals; see the lines above for the asset IDs.`,
         );
-        await appendEntry(archive, nodeStream, uniqueEntryName(asset.originalFileName, used));
       }
       if (!archive.destroyed) await archive.finalize();
     } catch (err) {
diff --git a/lib/zoom.ts b/lib/zoom.ts
new file mode 100644
index 0000000..88acc93
--- /dev/null
+++ b/lib/zoom.ts
@@ -0,0 +1,234 @@
+/**
+ * Zoom geometry for the lightbox (#467). Pure, so it can be tested without a
+ * DOM; the gesture wiring lives in hooks/useZoom.ts.
+ *
+ * The model: the photo is laid out at its "fit" size, as the lightbox always
+ * shows it, and zooming applies `translate(x, y) scale(scale)` to that box
+ * with the transform origin at its centre. `scale: 1` is fit. Every
+ * coordinate is in CSS pixels relative to the viewport.
+ *
+ * The top of the range is 1:1 — one image pixel per *device* pixel, so the
+ * CSS size at 1:1 is the image width divided by devicePixelRatio. That is the
+ * view a sharpness check needs. Going further only interpolates pixels: it
+ * shows nothing the file does not hold and makes good focus look soft, so the
+ * range is clamped to [fit, 1:1] rather than [fit, 2 × 1:1].
+ */
+
+/** The current transform of the fit box. */
+export interface ZoomView {
+  scale: number;
+  /** Translation of the box centre, CSS px. */
+  x: number;
+  y: number;
+}
+
+/** Where the photo sits at fit: the centre of its box and its size, CSS px. */
+export interface FitBox {
+  cx: number;
+  cy: number;
+  width: number;
+  height: number;
+}
+
+export interface Viewport {
+  width: number;
+  height: number;
+}
+
+export interface Point {
+  x: number;
+  y: number;
+}
+
+/**
+ * The largest image offered for zoom on a touch device (coarse pointer), in
+ * pixels. Showing a photo at 1:1 means decoding all of it: 50 MP is 200 MB of
+ * RGBA, about what phones and tablets cope with alongside the page. Larger
+ * files (a 60 MP Leica Q3 frame, 240 MB decoded) get no zoom control there,
+ * rather than one that crashes the tab. Mouse and trackpad devices are not
+ * limited.
+ */
+export const TOUCH_ZOOM_MAX_PIXELS = 50_000_000;
+
+/** Whether a photo of this pixel size may be zoomed on this kind of device. */
+export function zoomFitsDevice(
+  width: number | undefined,
+  height: number | undefined,
+  coarsePointer: boolean,
+): boolean {
+  if (!width || !height) return false;
+  return !coarsePointer || width * height <= TOUCH_ZOOM_MAX_PIXELS;
+}
+
+/** The untouched view. */
+export const FIT_VIEW: ZoomView = Object.freeze({ scale: 1, x: 0, y: 0 });
+
+/**
+ * Below this the view counts as fit. Pinching back almost to fit should land
+ * on fit, not leave the photo a pixel off and swipe navigation switched off.
+ */
+const FIT_EPSILON = 0.02;
+
+export function isZoomed(view: ZoomView): boolean {
+  return view.scale > 1 + FIT_EPSILON;
+}
+
+/**
+ * The scale (relative to fit) at which one image pixel covers one device
+ * pixel. Below 1 when the photo is already shown at more than 1:1 — a small
+ * file on a large screen — which leaves nothing to zoom into.
+ */
+export function oneToOneScale(naturalWidth: number, fitWidth: number, dpr: number): number {
+  if (!(naturalWidth > 0) || !(fitWidth > 0)) return 1;
+  const ratio = dpr > 0 && Number.isFinite(dpr) ? dpr : 1;
+  return naturalWidth / ratio / fitWidth;
+}
+
+/** The top of the zoom range: 1:1, and never below fit. */
+export function maxZoomScale(naturalWidth: number, fitWidth: number, dpr: number): number {
+  return Math.max(1, oneToOneScale(naturalWidth, fitWidth, dpr));
+}
+
+/** Whether zooming would show anything the fit view does not. */
+export function canZoom(maxScale: number): boolean {
+  return maxScale > 1 + FIT_EPSILON;
+}
+
+export function clampScale(scale: number, maxScale: number): number {
+  if (!Number.isFinite(scale)) return 1;
+  return Math.min(Math.max(scale, 1), Math.max(1, maxScale));
+}
+
+/**
+ * The allowed range for one axis of the translation.
+ *
+ * A box larger than the viewport may move until its edge meets the viewport
+ * edge, never further — no empty band appears beside the photo. A box smaller
+ * than the viewport may move anywhere that keeps it fully on screen; that
+ * range always contains 0, so a photo that is barely zoomed stays where it was
+ * instead of jumping to the centre.
+ */
+function axisRange(centre: number, half: number, extent: number): [number, number] {
+  const a = half - centre;
+  const b = extent - centre - half;
+  return [Math.min(a, b), Math.max(a, b)];
+}
+
+/** Keep the photo covering the viewport (or fully on it), at a clamped scale. */
+export function clampView(
+  view: ZoomView,
+  fit: FitBox,
+  viewport: Viewport,
+  maxScale: number,
+): ZoomView {
+  const scale = clampScale(view.scale, maxScale);
+  if (scale <= 1) return { ...FIT_VIEW };
+  const [minX, maxX] = axisRange(fit.cx, (fit.width * scale) / 2, viewport.width);
+  const [minY, maxY] = axisRange(fit.cy, (fit.height * scale) / 2, viewport.height);
+  return {
+    scale,
+    x: Math.min(Math.max(view.x, minX), maxX),
+    y: Math.min(Math.max(view.y, minY), maxY),
+  };
+}
+
+/**
+ * Change the scale while the photo point under `point` stays under it — the
+ * cursor for a wheel or a double-click, the midpoint of two fingers for a
+ * pinch. Clamping can still move it at the edges, which is the price of never
+ * showing an empty band.
+ */
+export function zoomAround(
+  view: ZoomView,
+  nextScale: number,
+  point: Point,
+  fit: FitBox,
+  viewport: Viewport,
+  maxScale: number,
+): ZoomView {
+  const scale = clampScale(nextScale, maxScale);
+  // The photo point under `point`, as an offset from the box centre at scale 1.
+  const u = (point.x - fit.cx - view.x) / view.scale;
+  const v = (point.y - fit.cy - view.y) / view.scale;
+  return clampView(
+    { scale, x: point.x - fit.cx - u * scale, y: point.y - fit.cy - v * scale },
+    fit,
+    viewport,
+    maxScale,
+  );
+}
+
+/**
+ * The pinch step: the photo point that was under the fingers' midpoint when
+ * the pinch began follows the midpoint, at the start scale times how far the
+ * fingers spread. Computed from the start of the gesture rather than
+ * incrementally, so rounding cannot drift the photo away under the fingers.
+ */
+export function pinchView(
+  start: ZoomView,
+  startMid: Point,
+  startDistance: number,
+  mid: Point,
+  distance: number,
+  fit: FitBox,
+  viewport: Viewport,
+  maxScale: number,
+): ZoomView {
+  const factor = startDistance > 0 ? distance / startDistance : 1;
+  const scale = clampScale(start.scale * factor, maxScale);
+  const u = (startMid.x - fit.cx - start.x) / start.scale;
+  const v = (startMid.y - fit.cy - start.y) / start.scale;
+  return clampView(
+    { scale, x: mid.x - fit.cx - u * scale, y: mid.y - fit.cy - v * scale },
+    fit,
+    viewport,
+    maxScale,
+  );
+}
+
+/** Move the photo by a pointer delta, clamped. */
+export function panBy(
+  view: ZoomView,
+  dx: number,
+  dy: number,
+  fit: FitBox,
+  viewport: Viewport,
+  maxScale: number,
+): ZoomView {
+  return clampView({ ...view, x: view.x + dx, y: view.y + dy }, fit, viewport, maxScale);
+}
+
+/** Double-click / double-tap: fit ↔ 1:1, around the point. */
+export function toggleView(
+  view: ZoomView,
+  point: Point,
+  fit: FitBox,
+  viewport: Viewport,
+  maxScale: number,
+): ZoomView {
+  if (isZoomed(view)) return { ...FIT_VIEW };
+  return zoomAround(view, maxScale, point, fit, viewport, maxScale);
+}
+
+/**
+ * The `+` / `-` keys and the wheel: multiply the scale, around the centre of
+ * the viewport unless a point is given. A step that lands within reach of fit
+ * snaps to it.
+ */
+export function stepView(
+  view: ZoomView,
+  factor: number,
+  fit: FitBox,
+  viewport: Viewport,
+  maxScale: number,
+  point?: Point,
+): ZoomView {
+  const at = point ?? { x: viewport.width / 2, y: viewport.height / 2 };
+  const next = zoomAround(view, view.scale * factor, at, fit, viewport, maxScale);
+  return isZoomed(next) ? next : { ...FIT_VIEW };
+}
+
+/** The CSS transform for a view. */
+export function viewTransform(view: ZoomView): string {
+  return `translate3d(${view.x}px, ${view.y}px, 0) scale(${view.scale})`;
+}
diff --git a/lib/zoomSource.ts b/lib/zoomSource.ts
new file mode 100644
index 0000000..b825c1f
--- /dev/null
+++ b/lib/zoomSource.ts
@@ -0,0 +1,108 @@
+/**
+ * Which file the lightbox zoom (#467) may show for an asset, if any.
+ *
+ * Decided from what the album response already carries — the original's MIME
+ * type, else its file extension — so the page knows without asking Immich.
+ *
+ *   - `original`: JPEG and AVIF. The browser shows them as they are, and
+ *     lib/locationScrub.ts removes GPS and sub-city place names from both on
+ *     the way through.
+ *   - `fullsize`: formats a browser cannot show (HEIC/HEIF, RAW/DNG, TIFF,
+ *     JPEG XL, …). Immich's full-size rendition is a JPEG it renders from the
+ *     original, at the original's resolution — but only when "full-size
+ *     preview" is enabled in Immich's image settings and the asset has been
+ *     processed since. Whether it exists is not in the album response, so the
+ *     zoom route asks Immich when the visitor zooms and answers 404 when there
+ *     is none; the lightbox then says so and stays on the preview.
+ *   - `edited`: photos edited in Immich's editor (crop, rotate), whatever
+ *     their format (#831). Their original is the unedited file — whatever a
+ *     crop removed is still in it — so it is never used. Measured against
+ *     Immich 3.2, `thumbnail?size=fullsize&edited=true` is the edited photo at
+ *     full resolution, a JPEG without EXIF, and it exists whether or not
+ *     full-size previews are switched on. The preview Folio shows carries the
+ *     same edit, so the two share their geometry.
+ *   - `null`: not zoomable. Videos. And PNG, WebP and GIF: the browser could
+ *     show those originals, but the scrubber does not edit their metadata
+ *     (eXIf/iTXt chunks, RIFF EXIF/XMP chunks), so they would go out with any
+ *     GPS they carry. Immich has no rendition to fall back on either — its
+ *     full-size endpoint redirects web-compatible formats to the original.
+ *
+ * Client-safe: no `fs`, no Immich client.
+ */
+
+export type ZoomSource = 'original' | 'fullsize' | 'edited';
+
+/** Originals served as they are (after scrubbing). */
+const ORIGINAL_MIME = new Set(['image/jpeg', 'image/jpg', 'image/pjpeg', 'image/avif']);
+const ORIGINAL_EXT = /\.(jpe?g|jpe|jfif|avif)$/i;
+
+/** Browser-displayable, but their metadata is not scrubbed: never zoomed. */
+const UNSCRUBBED_MIME = new Set([
+  'image/png',
+  'image/webp',
+  'image/gif',
+  'image/svg+xml',
+  'image/apng',
+]);
+const UNSCRUBBED_EXT = /\.(png|apng|webp|gif|svg)$/i;
+
+/** What the zoom route may send back: the formats the two sources produce. */
+export const ZOOM_CONTENT_TYPES: ReadonlySet<string> = new Set(['image/jpeg', 'image/avif']);
+
+export function zoomSourceFor(asset: {
+  type?: string;
+  originalMimeType?: string | null;
+  originalFileName?: string | null;
+  isEdited?: boolean | null;
+}): ZoomSource | null {
+  if (asset.type !== 'IMAGE') return null;
+  if (asset.isEdited === true) return 'edited';
+  const mime = asset.originalMimeType?.toLowerCase().split(';')[0].trim();
+  if (mime) {
+    if (ORIGINAL_MIME.has(mime)) return 'original';
+    if (UNSCRUBBED_MIME.has(mime)) return null;
+    return mime.startsWith('image/') ? 'fullsize' : null;
+  }
+  const name = asset.originalFileName ?? '';
+  if (ORIGINAL_EXT.test(name)) return 'original';
+  if (UNSCRUBBED_EXT.test(name)) return null;
+  // No type and no recognisable extension: not enough to go on.
+  return /\.[a-z0-9]+$/i.test(name) ? 'fullsize' : null;
+}
+
+const ROTATED_ORIENTATIONS = new Set([5, 6, 7, 8]);
+
+/**
+ * The zoom image's pixel size as the browser will report it — upright, after
+ * the EXIF orientation is applied. The lightbox needs it before the file has
+ * loaded, so the first gesture can go straight to 1:1.
+ *
+ * Immich's top-level `width`/`height` are already upright, and for a photo
+ * edited in Immich they are the edited size — the size of the `edited`
+ * source; EXIF dimensions are as stored and are turned here. Undefined when neither is known — the asset
+ * is then not offered for zoom.
+ */
+export function zoomDimensions(asset: {
+  isEdited?: boolean | null;
+  width?: number | null;
+  height?: number | null;
+  exifInfo?: {
+    exifImageWidth?: number | null;
+    exifImageHeight?: number | null;
+    orientation?: string | null;
+  } | null;
+}): { width: number; height: number } | undefined {
+  if (asset.width && asset.height && asset.width > 0 && asset.height > 0) {
+    return { width: asset.width, height: asset.height };
+  }
+  // An edited photo (#831) has no fallback: EXIF describes the unedited file,
+  // and a wrong size would put the zoom image off the preview's box. No size,
+  // no zoom.
+  if (asset.isEdited === true) return undefined;
+  const w = asset.exifInfo?.exifImageWidth;
+  const h = asset.exifInfo?.exifImageHeight;
+  if (!w || !h || w <= 0 || h <= 0) return undefined;
+  return ROTATED_ORIENTATIONS.has(Number(asset.exifInfo?.orientation))
+    ? { width: h, height: w }
+    : { width: w, height: h };
+}
diff --git a/package-lock.json b/package-lock.json
index ee8b2a1..578ef2c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "immich-folio",
-  "version": "0.19.1",
+  "version": "0.20.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "immich-folio",
-      "version": "0.19.1",
+      "version": "0.20.0",
       "license": "MIT",
       "dependencies": {
         "@dnd-kit/core": "^6.3.1",
diff --git a/package.json b/package.json
index e778e07..145135c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "immich-folio",
-  "version": "0.19.1",
+  "version": "0.20.0",
   "license": "MIT",
   "scripts": {
     "dev": "next dev",
diff --git a/proxy.ts b/proxy.ts
index d0c7ab6..26bf9a5 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -13,6 +13,18 @@ import { cdnOrigin } from '@/lib/cdn';
 /** Where a locked-out visitor is rewritten to. */
 const GATE_PATH = '/gate';
 
+/**
+ * Pages a locked site still serves: the legal notice, the privacy policy and
+ * the contact form. The gate itself is public, and a German Impressum has to
+ * be reachable directly, not after a password, together with its second
+ * contact channel, which is often the contact form it links. None of the three
+ * carries an album name or an asset token, and the root layout drops the
+ * header and footer for a visitor who has not unlocked the site. A page that
+ * is switched off still answers 404 through isKnownMissing() below, so a
+ * disabled contact form is a 404 here, not the gate.
+ */
+export const UNGATED_PAGES: ReadonlySet<string> = new Set(['/impressum', '/privacy', '/contact']);
+
 /**
  * Site-wide password gate.
  *
@@ -32,6 +44,7 @@ function siteGate(request: NextRequest): NextResponse | null {
   // /install is the wizard a fresh deployment needs before it can have a
   // password at all. Locking either would be locking out the operator.
   if (isAdminPath(pathname) || isInstallPath(pathname) || pathname === GATE_PATH) return null;
+  if (UNGATED_PAGES.has(pathname)) return null;
 
   // A config that cannot be parsed makes getConfig() throw, and it throws in
   // here — before app/layout.tsx gets to call getConfigOrNull() and render the
@@ -85,12 +98,17 @@ export const TOP_LEVEL_ROUTES: ReadonlySet<string> = new Set([
 /**
  * Pages that are known not to exist before anything renders.
  *
- * app/loading.tsx makes every page stream, and a streamed response has sent
- * its 200 before the page gets to call notFound(). Next then marks the page
- * noindex, which keeps it out of search results, but the status stays 200.
- * For the fixed routes whose existence depends only on settings.yaml or a file
- * in content/journal/, the answer is known here, before streaming starts, so
- * they can get a real 404. Album and subpage slugs need Immich and stay soft.
+ * A page inside a loading.tsx boundary streams, and a streamed response has
+ * sent its 200 before the page gets to call notFound(). Next then marks the
+ * page noindex, which keeps it out of search results, but the status stays
+ * 200. For the fixed routes whose existence depends only on settings.yaml or a
+ * file in content/journal/, the answer is known here, before streaming starts,
+ * so they get a real 404 whatever boundaries sit above them.
+ *
+ * Album and subpage slugs need Immich and are not decided here. The catch-all
+ * page decides them itself before it streams (app/[...path]/routeExists.ts),
+ * which is why app/ has no loading.tsx of its own: the home page's skeleton
+ * lives in the app/(home) route group.
  *
  * The same holds for any path deeper than two segments that lands in the
  * catch-all: app/[...path] only serves `/<slug>` and `/<subpage>/<album>`, and
diff --git a/scripts/__tests__/doctor-cli.test.ts b/scripts/__tests__/doctor-cli.test.ts
index 68a5b6c..c640dc4 100644
--- a/scripts/__tests__/doctor-cli.test.ts
+++ b/scripts/__tests__/doctor-cli.test.ts
@@ -2,6 +2,8 @@ import { describe, it, expect, vi } from 'vitest';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { pathToFileURL } from 'node:url';
 import yaml from 'js-yaml';
 import type { CliFinding } from '../doctor.mts';
 import {
@@ -490,3 +492,44 @@ describe('gatherFindings — album checks (#629)', () => {
     }
   });
 });
+
+/**
+ * `npm run doctor` runs the settings-values check the panel runs (QA A-14).
+ * Under Vitest an extensionless import resolves fine, so the second test
+ * loads the script in a real Node process: that is the runtime which refuses
+ * one, and the reason the CLI could not run this check before.
+ */
+describe('gatherFindings — setting values (QA A-14)', () => {
+  it('warns about values the resolvers would clamp or replace', async () => {
+    const dir = tmpdir();
+    try {
+      fs.writeFileSync(
+        path.join(dir, 'settings.yaml'),
+        'theme:\n  accent: rot\ncontact:\n  retentionDays: 400\n',
+      );
+      const findings = await gatherFindings(dir, { INSTALL_CONTENT_DIR: dir });
+      const finding = findings.find((f) => f.id === 'settings-values');
+      expect(finding?.level).toBe('warn');
+      expect(finding?.detail).toContain('accent colour, message retention');
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('loads under Node type stripping, without a bundler resolving paths', () => {
+    const script = path.resolve(__dirname, '../doctor.mts');
+    const result = spawnSync(
+      process.execPath,
+      [
+        '--disable-warning=MODULE_TYPELESS_PACKAGE_JSON',
+        '--input-type=module',
+        '-e',
+        `const m = await import(${JSON.stringify(pathToFileURL(script).href)});` +
+          'process.stdout.write(typeof m.gatherFindings);',
+      ],
+      { encoding: 'utf8' },
+    );
+    expect(result.stderr).toBe('');
+    expect(result.stdout).toBe('function');
+  });
+});
diff --git a/scripts/__tests__/doctor-image.test.ts b/scripts/__tests__/doctor-image.test.ts
new file mode 100644
index 0000000..d6c4bf3
--- /dev/null
+++ b/scripts/__tests__/doctor-image.test.ts
@@ -0,0 +1,186 @@
+import { describe, it, expect } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * `npm run doctor` inside the shipped image runs the TypeScript sources with
+ * Node's own type stripping (#521). That holds two constraints no other test
+ * sees, because Vitest and the Next build resolve imports for themselves:
+ *
+ *  - every runtime relative import needs its file extension, or Node refuses
+ *    to load it (ERR_MODULE_NOT_FOUND);
+ *  - every file the script reaches has to be COPY'd into the runner stage of
+ *    the Dockerfile — the standalone bundle carries none of them, so a new
+ *    import in the doctor's graph is a module-not-found in production.
+ *
+ * Both are checked here by walking the import graph from the entry point, so
+ * a module that joins the graph later (a theme.ts that starts importing a
+ * neighbour, say) fails this test until the Dockerfile follows.
+ */
+
+const ROOT = path.resolve(__dirname, '../..');
+const ENTRY = 'scripts/doctor.mjs';
+const EXTENSIONS = ['.ts', '.mts', '.js', '.mjs'];
+
+/** Block comments and whole-line `//` comments — prose mentioning `from './x'`
+ *  must not count as an import. */
+function stripComments(source: string): string {
+  return source.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+}
+
+/** Runtime import specifiers of one module. `import type` / `export type`
+ *  are erased by type stripping and skipped; an `import { type X }` is not —
+ *  Node still loads that module, so it counts. */
+function runtimeImports(source: string): string[] {
+  const code = stripComments(source);
+  const specs: string[] = [];
+  const staticRe = /(?:^|[\n;])\s*(import|export)\s+(type\s+)?[^;'"]*?\bfrom\s*['"]([^'"]+)['"]/g;
+  for (const m of code.matchAll(staticRe)) {
+    if (!m[2]) specs.push(m[3]);
+  }
+  for (const m of code.matchAll(/(?:^|[\n;])\s*import\s*['"]([^'"]+)['"]/g)) specs.push(m[1]);
+  for (const m of code.matchAll(/\bimport\(\s*['"]([^'"]+)['"]\s*\)/g)) specs.push(m[1]);
+  return specs;
+}
+
+interface Closure {
+  files: string[];
+  packages: string[];
+  problems: string[];
+}
+
+function walkClosure(entry: string): Closure {
+  const files = new Set<string>();
+  const packages = new Set<string>();
+  const problems: string[] = [];
+  const queue = [entry];
+
+  while (queue.length) {
+    const rel = queue.shift() as string;
+    if (files.has(rel)) continue;
+    files.add(rel);
+    const source = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+    for (const spec of runtimeImports(source)) {
+      if (spec.startsWith('node:')) continue;
+      if (!spec.startsWith('.')) {
+        packages.add(
+          spec.startsWith('@') ? spec.split('/').slice(0, 2).join('/') : spec.split('/')[0],
+        );
+        continue;
+      }
+      let target = path.posix.join(path.posix.dirname(rel), spec);
+      if (!EXTENSIONS.includes(path.posix.extname(target))) {
+        problems.push(`${rel}: '${spec}' has no file extension`);
+        // Keep walking so one report lists every gap.
+        target = `${target}.ts`;
+      }
+      if (!fs.existsSync(path.join(ROOT, target))) {
+        problems.push(`${rel}: '${spec}' resolves to ${target}, which does not exist`);
+        continue;
+      }
+      queue.push(target);
+    }
+  }
+  return { files: [...files].sort(), packages: [...packages].sort(), problems };
+}
+
+interface CopyLine {
+  from: string | null;
+  sources: string[];
+  dest: string;
+}
+
+/** COPY instructions of the Dockerfile's `runner` stage, sources relative to
+ *  /app and destinations relative to its WORKDIR (/app). */
+function runnerCopies(): CopyLine[] {
+  const dockerfile = fs.readFileSync(path.join(ROOT, 'Dockerfile'), 'utf8').replace(/\\\n/g, ' ');
+  const stages = dockerfile.split(/^FROM\s+/m);
+  const runner = stages.find((stage) => /^\S+\s+AS\s+runner\b/i.test(stage));
+  if (!runner) throw new Error('Dockerfile has no runner stage');
+
+  const strip = (p: string) =>
+    p
+      .replace(/^\/app\//, '')
+      .replace(/^\.\//, '')
+      .replace(/\/$/, '');
+  return runner
+    .split('\n')
+    .filter((line) => /^COPY\s/i.test(line.trim()))
+    .map((line) => {
+      const tokens = line.trim().split(/\s+/).slice(1);
+      const from = tokens.find((t) => t.startsWith('--from='))?.slice('--from='.length) ?? null;
+      const paths = tokens.filter((t) => !t.startsWith('--'));
+      return { from, sources: paths.slice(0, -1).map(strip), dest: strip(paths[paths.length - 1]) };
+    });
+}
+
+/** Whether `file` lands at the same relative path in the image, either as
+ *  itself or inside a copied directory. */
+function isCopied(file: string, copies: CopyLine[], stage: string): boolean {
+  return copies.some(
+    (copy) =>
+      copy.from === stage &&
+      copy.sources.some(
+        (src) =>
+          (src === file && copy.dest === file) || (file.startsWith(`${src}/`) && copy.dest === src),
+      ),
+  );
+}
+
+describe('the doctor in the runtime image', () => {
+  const closure = walkClosure(ENTRY);
+
+  it('reaches the modules it is known to need', () => {
+    // A guard on the walker itself: if this shrinks, the parser broke rather
+    // than the graph.
+    expect(closure.files).toEqual(
+      expect.arrayContaining([
+        'scripts/doctor.mjs',
+        'scripts/doctor.mts',
+        'lib/admin/doctor.ts',
+        'lib/config/settingValues.ts',
+      ]),
+    );
+    expect(closure.packages).toContain('js-yaml');
+  });
+
+  it('writes every runtime relative import with its file extension', () => {
+    expect(closure.problems).toEqual([]);
+  });
+
+  it('copies every module of the graph into the runner stage', () => {
+    const copies = runnerCopies();
+    const missing = closure.files.filter((file) => !isCopied(file, copies, 'builder'));
+    expect(missing).toEqual([]);
+  });
+
+  it('copies every package the graph imports into the runner stage', () => {
+    const copies = runnerCopies();
+    const missing = closure.packages.filter(
+      (pkg) => !isCopied(`node_modules/${pkg}/package.json`, copies, 'deps'),
+    );
+    expect(missing).toEqual([]);
+  });
+});
+
+describe('runtimeImports', () => {
+  it('skips type-only imports and keeps inline type specifiers', () => {
+    const source = [
+      "import type { A } from './a';",
+      "export type { B } from './b';",
+      "import { type C, d } from './c.ts';",
+      "import { type E } from './e.ts';",
+      "export { f } from './f.ts';",
+      "import './g.ts';",
+      "const h = await import('js-yaml');",
+      "// import { x } from './commented';",
+      "/* import { y } from './block'; */",
+    ].join('\n');
+    expect(runtimeImports(source)).toEqual(['./c.ts', './e.ts', './f.ts', './g.ts', 'js-yaml']);
+  });
+
+  it('reads an import spread over several lines', () => {
+    expect(runtimeImports("import {\n  a,\n  type B,\n} from '../x.ts';")).toEqual(['../x.ts']);
+  });
+});
diff --git a/scripts/contrast-audit.mjs b/scripts/contrast-audit.mjs
index d7f44e8..6c592b7 100644
--- a/scripts/contrast-audit.mjs
+++ b/scripts/contrast-audit.mjs
@@ -26,8 +26,22 @@ import { chromium } from '@playwright/test';
 const require = createRequire(import.meta.url);
 const axeSource = readFileSync(require.resolve('axe-core/axe.min.js'), 'utf8');
 
-// Keep in sync with the presets in lib/config/theme.ts.
-const PRESETS = ['studio-modern', 'studio', 'minimal', 'editorial', 'classic', 'noir', 'monograph'];
+// Keep in sync with PRESET_REGISTRY in lib/config/presets.ts
+// (lib/__tests__/preset-registry.test.ts fails when they drift).
+const PRESETS = [
+  'studio-modern',
+  'studio',
+  'minimal',
+  'editorial',
+  'classic',
+  'noir',
+  'monograph',
+  'kunsthalle',
+  'ma',
+  'cyanotype',
+  'salon',
+  'birch',
+];
 const FIXED_PAGES = ['/about', '/map', '/impressum'];
 
 const print = (line = '') => process.stdout.write(line + '\n');
diff --git a/scripts/doctor.mts b/scripts/doctor.mts
index bc9d5f0..6c03fda 100644
--- a/scripts/doctor.mts
+++ b/scripts/doctor.mts
@@ -21,11 +21,16 @@
  * Node 22.18 unflagged native type stripping, so `node scripts/doctor.mts`
  * runs the TypeScript directly with no runner at all. It has one constraint:
  * no path aliases, and every relative import needs its file extension. That
- * rules out importing `lib/config` — but `lib/admin/doctor.ts` has no imports
- * whatsoever (it is pure functions over gathered inputs, written that way in
- * #491 precisely so a CLI could reuse it), so the entire TypeScript module
- * graph of this script is two files. Nothing is duplicated that judges: the
- * checks all come from `lib/admin/doctor.ts`.
+ * rules out importing `lib/config/index.ts` and most of its neighbours — but
+ * `lib/admin/doctor.ts` has no imports whatsoever (it is pure functions over
+ * gathered inputs, written that way in #491 precisely so a CLI could reuse
+ * it), and `lib/config/settingValues.ts` writes its few imports with the
+ * extension, onto modules that only `import type` further. So the TypeScript
+ * module graph of this script stays small, and nothing is duplicated that
+ * judges: the checks all come from `lib/admin/doctor.ts`, the setting values
+ * are judged by the same function the save route runs. A test in
+ * scripts/__tests__/doctor-cli.test.ts loads the graph in a real Node process,
+ * because Vitest resolves extensionless imports and would not notice.
  *
  * What *is* repeated here is the gathering — reading the filesystem and the
  * environment instead of a request, exactly as the issue described. It is
@@ -58,6 +63,7 @@ import {
   checkLegal,
   checkPrivacy,
   checkPasswords,
+  checkSettingValues,
   worstLevel,
   type AlbumRef,
   type DoctorFinding,
@@ -66,6 +72,7 @@ import {
   type LegalRef,
   type PasswordRef,
 } from '../lib/admin/doctor.ts';
+import { validateSettingValues } from '../lib/config/settingValues.ts';
 
 /**
  * `process.env`, minus the `NODE_ENV`-is-required augmentation Next adds to
@@ -707,7 +714,7 @@ export async function gatherFindings(cwd: string, env: EnvLike): Promise<CliFind
 
   findings.push(checkPasswords(passwords));
 
-  // ── Impressum ───────────────────────────────────────────────────────
+  // ── Impressum, privacy and setting values ───────────────────────────
   const settingsNode = settings.node;
   if (settingsNode && typeof settingsNode === 'object' && !Array.isArray(settingsNode)) {
     const node = settingsNode as Record<string, unknown>;
@@ -730,6 +737,9 @@ export async function gatherFindings(cwd: string, env: EnvLike): Promise<CliFind
       hasText: privacyText !== '',
     });
     if (privacy) findings.push(privacy);
+    // Values the resolvers would clamp or replace — the same check the panel's
+    // Diagnostics runs over the raw file.
+    findings.push(checkSettingValues(validateSettingValues(node)));
   }
 
   // ── Writability of the content volume ───────────────────────────────
diff --git a/scripts/screenshots.ts b/scripts/screenshots.ts
index e051c4a..4a91d62 100644
--- a/scripts/screenshots.ts
+++ b/scripts/screenshots.ts
@@ -56,13 +56,14 @@ import { spawn, type ChildProcess } from 'child_process';
 import fs from 'fs';
 import path from 'path';
 import yaml from 'js-yaml';
+import { PRESET_IDS } from '../lib/config/presets';
 import type { Browser, Page } from '@playwright/test';
 
 // Next reads .env.local itself; this script runs outside Next, so ADMIN_PASSWORD
 // and friends have to be pulled in explicitly. Must run before the constants below.
 loadEnvLocal();
 
-const THEMES = ['studio', 'studio-modern', 'minimal', 'editorial', 'classic', 'noir', 'monograph'];
+const THEMES = [...PRESET_IDS];
 const HERO_STYLES = ['split', 'fullbleed', 'minimal', 'stacked', 'typographic', 'mosaic'];
 const GRID_LAYOUTS = ['masonry', 'uniform', 'showcase', 'filmstrip', 'editorial-flow'];
 /** Preset used for everything that is not itself a theme comparison. */