diff --git a/backend/src/config/env.js b/backend/src/config/env.js
index 988d9bf83..a615c474d 100644
--- a/backend/src/config/env.js
+++ b/backend/src/config/env.js
@@ -72,11 +72,35 @@ module.exports = {
   // --- Archive extraction ---
   MAX_EXTRACTED_ARCHIVE_SIZE: process.env.MAX_EXTRACTED_ARCHIVE_SIZE?.trim() || null,
   MAX_ARCHIVE_ENTRIES: Number(process.env.MAX_ARCHIVE_ENTRIES) || 100000,
+  MAX_BROWSABLE_ARCHIVE_SIZE: process.env.MAX_BROWSABLE_ARCHIVE_SIZE?.trim() || null,
+  ARCHIVE_CACHE_MAX_SIZE: process.env.ARCHIVE_CACHE_MAX_SIZE?.trim() || null,
   ARCHIVE_EXTENSIONS: process.env.ARCHIVE_EXTENSIONS || '',
   // --- Folder size index ---
   FOLDER_SIZE_MODE: process.env.FOLDER_SIZE_MODE?.trim().toLowerCase() || 'off',
   FOLDER_SIZE_MODE_SET:
     typeof process.env.FOLDER_SIZE_MODE === 'string' && process.env.FOLDER_SIZE_MODE.trim() !== '',
+  // Lightweight process and cgroup diagnostics, off by default. When enabled the
+  // sampler logs only anomalous intervals unless explicitly told otherwise.
+  PERFORMANCE_DIAGNOSTICS_ENABLED:
+    normalizeBoolean(process.env.PERFORMANCE_DIAGNOSTICS_ENABLED) ?? false,
+  PERFORMANCE_DIAGNOSTICS_INTERVAL_MS:
+    process.env.PERFORMANCE_DIAGNOSTICS_INTERVAL_MS != null
+      ? Number(process.env.PERFORMANCE_DIAGNOSTICS_INTERVAL_MS)
+      : 15000,
+  PERFORMANCE_DIAGNOSTICS_LOG_EVERY_INTERVAL:
+    normalizeBoolean(process.env.PERFORMANCE_DIAGNOSTICS_LOG_EVERY_INTERVAL) ?? false,
+  PERFORMANCE_DIAGNOSTICS_CPU_THRESHOLD:
+    process.env.PERFORMANCE_DIAGNOSTICS_CPU_THRESHOLD != null
+      ? Number(process.env.PERFORMANCE_DIAGNOSTICS_CPU_THRESHOLD)
+      : 75,
+  PERFORMANCE_DIAGNOSTICS_RSS_THRESHOLD_MB:
+    process.env.PERFORMANCE_DIAGNOSTICS_RSS_THRESHOLD_MB != null
+      ? Number(process.env.PERFORMANCE_DIAGNOSTICS_RSS_THRESHOLD_MB)
+      : 768,
+  PERFORMANCE_DIAGNOSTICS_EVENT_LOOP_DELAY_MS:
+    process.env.PERFORMANCE_DIAGNOSTICS_EVENT_LOOP_DELAY_MS != null
+      ? Number(process.env.PERFORMANCE_DIAGNOSTICS_EVENT_LOOP_DELAY_MS)
+      : 250,
   FOLDER_SIZE_EXCLUDE_PATHS: process.env.FOLDER_SIZE_EXCLUDE_PATHS || '',
   FOLDER_SIZE_CONCURRENCY: Number(process.env.FOLDER_SIZE_CONCURRENCY) || 6,
   FOLDER_SIZE_NETWORK_CONCURRENCY: Number(process.env.FOLDER_SIZE_NETWORK_CONCURRENCY) || 2,
@@ -96,6 +120,7 @@ module.exports = {
   SEARCH_INDEX_CPU_PERCENT: Number(process.env.SEARCH_INDEX_CPU_PERCENT) || null,
   SEARCH_INDEX_MEMORY_MB: Number(process.env.SEARCH_INDEX_MEMORY_MB) || null,
   SEARCH_INDEX_EXCLUDE: process.env.SEARCH_INDEX_EXCLUDE?.trim() || null,
+  PREVIEW_MAX_RENDER_SIZE: process.env.PREVIEW_MAX_RENDER_SIZE?.trim() || null,
   SEARCH_INDEX_REBUILD: normalizeBoolean(process.env.SEARCH_INDEX_REBUILD) ?? false,
   SEARCH_INDEX_RECONCILE_MS: Number(process.env.SEARCH_INDEX_RECONCILE_MS) || null,
   SEARCH_TIMEOUT_MS: Number(process.env.SEARCH_TIMEOUT_MS) || null,
diff --git a/backend/src/config/index.js b/backend/src/config/index.js
index 4bc9da340..3dbf58a73 100644
--- a/backend/src/config/index.js
+++ b/backend/src/config/index.js
@@ -562,6 +562,23 @@ const archives = (() => {
       return Number.isFinite(parsed) && parsed > 0 ? parsed : 32 * 1024 * 1024 * 1024;
     })(),
     maxEntries: env.MAX_ARCHIVE_ENTRIES,
+    // A compound archive — a .tar.gz and its family — is two archives, and the
+    // inner one has to be decompressed before anything inside it can be named.
+    // Above this it is not: browsing a backup by unpacking it first would
+    // betray the whole point, and extracting it is the operation that exists
+    // for that. The number is the inner archive's own declared size, so the
+    // refusal comes before anything is written.
+    browseMaxBytes: (() => {
+      const parsed = parseByteSize(env.MAX_BROWSABLE_ARCHIVE_SIZE);
+      return Number.isFinite(parsed) && parsed > 0 ? parsed : 2 * 1024 * 1024 * 1024;
+    })(),
+    // What those decompressed copies may take up altogether. They are a
+    // convenience and are made again whenever they are missing, so the least
+    // recently opened goes first when this is passed.
+    cacheMaxBytes: (() => {
+      const parsed = parseByteSize(env.ARCHIVE_CACHE_MAX_SIZE);
+      return Number.isFinite(parsed) && parsed > 0 ? parsed : 8 * 1024 * 1024 * 1024;
+    })(),
   };
   if (!raw) return { extensions: DEFAULT_ARCHIVE_EXTENSIONS, ...limits };
   // 'zip,iso' replaces the default list; '+udf,squashfs' extends it.
@@ -661,7 +678,49 @@ const folderSize = {
   rebuild: env.FOLDER_SIZE_REBUILD,
 };
 
+// --- Runtime diagnostics ---
+// --- Runtime diagnostics ---
+const atLeast = (value, minimum, fallback) =>
+  Number.isFinite(value) && value >= minimum ? value : fallback;
+
+const performanceDiagnostics = {
+  enabled: env.PERFORMANCE_DIAGNOSTICS_ENABLED,
+  intervalMs: atLeast(env.PERFORMANCE_DIAGNOSTICS_INTERVAL_MS, 5000, 15000),
+  logEveryInterval: env.PERFORMANCE_DIAGNOSTICS_LOG_EVERY_INTERVAL,
+  cpuThreshold: atLeast(env.PERFORMANCE_DIAGNOSTICS_CPU_THRESHOLD, 1, 75),
+  rssThresholdMb: atLeast(env.PERFORMANCE_DIAGNOSTICS_RSS_THRESHOLD_MB, 1, 768),
+  eventLoopDelayThresholdMs: atLeast(env.PERFORMANCE_DIAGNOSTICS_EVENT_LOOP_DELAY_MS, 1, 250),
+};
+
+/**
+ * How much of a document the preview will render.
+ *
+ * Not the same question as what the editor will open, and the difference is
+ * why this is a setting of its own. The editor streams text into a code view;
+ * the preview parses the document, sanitises the HTML it produces and then
+ * hands the browser every node to lay out — all on the one thread the
+ * interface has. A six-megabyte markdown file opens in the editor and freezes
+ * the tab in the preview, on the same machine, from the same file.
+ *
+ * It was hard-coded before this, which meant someone who raised
+ * EDITOR_MAX_FILESIZE in good faith was refused at a number that appeared in
+ * no setting and no document.
+ *
+ * Generous by default because freezing is no longer the failure mode: the
+ * preview renders in slices of a frame and hands the browser back between
+ * them. What is left is the weight of the document in the tab, which is a
+ * reader's problem rather than an application's. And the preview reads through
+ * the editor's endpoint, so EDITOR_MAX_FILESIZE already caps what can reach
+ * it — this only bites when it is set lower than that.
+ */
+const previewMaxRenderBytes = (() => {
+  const parsed = parseByteSize(env.PREVIEW_MAX_RENDER_SIZE);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 16 * 1024 * 1024;
+})();
+
 module.exports = {
+  performanceDiagnostics,
+  preview: { maxRenderBytes: previewMaxRenderBytes },
   folderSize,
   webauthn,
   activity,
diff --git a/backend/src/openapi/paths/files.js b/backend/src/openapi/paths/files.js
index 33ba89711..07854e1c1 100644
--- a/backend/src/openapi/paths/files.js
+++ b/backend/src/openapi/paths/files.js
@@ -132,6 +132,16 @@ module.exports = {
       },
     }),
   },
+  '/api/files/recent-destinations': {
+    get: op({
+      id: 'listRecentDestinations',
+      summary: 'Folders this account recently copied or moved into',
+      description: 'Only those it can still reach.',
+      tag: TAG,
+      access: 'account',
+      responses: { 200: json(obj({ items: arrayOf(str()) }, ['items'])), ...errors(401) },
+    }),
+  },
   '/api/files/delete-impact': {
     post: op({
       id: 'describeDeletion',
diff --git a/backend/src/routes/auth.js b/backend/src/routes/auth.js
index 1df37e6ca..03af9b840 100644
--- a/backend/src/routes/auth.js
+++ b/backend/src/routes/auth.js
@@ -14,6 +14,7 @@ const logger = require('../utils/logger');
 const {
   countUsers,
   createLocalUser,
+  getById,
   attemptLocalLogin,
   changeLocalPassword,
   addLocalPassword,
@@ -28,15 +29,13 @@ const {
   twoFactorStatus,
   verifySecondFactor,
 } = require('../services/users');
-const { incrementFailedAttempts, clearLock, isLocked } = require('../services/users/lockout');
-const { issueCode, redeemCode, isValidChallenge } = require('../services/oidcMobileBridge');
-const rateLimit = require('express-rate-limit');
-const asyncHandler = require('../utils/asyncHandler');
-const { startAuthenticatedSession } = require('../utils/authenticatedSession');
 const passkeys = require('../services/users/passkeys');
-const activityLog = require('../services/activityLog');
 const apiTokens = require('../services/apiTokens');
+const activityLog = require('../services/activityLog');
 const { WebAuthnError } = require('../utils/webauthn');
+const { issueCode, redeemCode, isValidChallenge } = require('../services/oidcMobileBridge');
+const rateLimit = require('express-rate-limit');
+const asyncHandler = require('../utils/asyncHandler');
 const {
   ValidationError,
   UnauthorizedError,
@@ -46,116 +45,9 @@ const {
   ServiceUnavailableError,
 } = require('../errors/AppError');
 const { ErrorCodes } = require('../errors/errorCodes');
-
-/**
- * The relying party: who is asking for a passkey, and where from.
- *
- * A key is bound to a domain, and the browser refuses to use it anywhere else.
- * The domain is taken from the public address when one is configured and from
- * the request otherwise, because a deployment reached by several names would
- * otherwise bind every key to whichever one was written down.
- */
-const relyingParty = (req) => {
-  const known = uniqueOrigins(publicConfig.origins || []);
-  const origins = known.length
-    ? known
-    : uniqueOrigins([`${req.protocol}://${req.get('host') || ''}`]);
-
-  let rpId = webauthnConfig.rpId;
-  if (!rpId) {
-    try {
-      rpId = new URL(publicConfig.url || origins[0] || '').hostname;
-    } catch (_) {
-      rpId = null;
-    }
-  }
-  if (!rpId) rpId = req.hostname;
-  return { rpId, rpName: webauthnConfig.rpName, origins };
-};
-
-/**
- * Keep the question until the answer arrives, and spend it then.
- *
- * In the session, not in a table: it belongs to one browser and one moment.
- * Spending it means taking it away — an answer is worth one sign-in, and a
- * challenge still lying about is one somebody else can answer with a recording
- * of the first.
- */
-const rememberChallenge = (req, purpose, challenge) =>
-  new Promise((resolve, reject) => {
-    if (!req.session) {
-      reject(new Error('A passkey needs a session to ask its question in.'));
-      return;
-    }
-    req.session.webauthn = { purpose, challenge, at: Date.now() };
-    req.session.save((error) => (error ? reject(error) : resolve()));
-  });
-
-const spendChallenge = (req, purpose) => {
-  const held = req.session?.webauthn;
-  if (req.session) delete req.session.webauthn;
-  if (!held || held.purpose !== purpose) return null;
-  if (Date.now() - (Number(held.at) || 0) > passkeys.CEREMONY_TIMEOUT_MS) return null;
-  return held.challenge;
-};
-
-/** Every refusal reads the same from outside, and says what happened in the log. */
-const refusePasskey = (error) => {
-  if (!(error instanceof WebAuthnError)) throw error;
-  if (error.status === 409) throw new ValidationError(error.message);
-  logger.warn({ reason: error.message }, 'A passkey was refused');
-  throw new UnauthorizedError('That passkey was not accepted.', ErrorCodes.AUTH_PASSKEY_REJECTED);
-};
-
-/**
- * How long the second step stays open.
- *
- * Long enough to find a phone, pick the app and read the digits; short enough
- * that a machine walked away from is not a sign-in waiting to be finished by
- * whoever sits down next.
- */
-const SECOND_STEP_MS = 5 * 60 * 1000;
-
-/**
- * The password was right, and the account wants a code as well.
- *
- * Deliberately not a signed-in session with a flag on it: nothing but
- * `localUserId` signs anybody in, and this state does not set it. The session
- * is regenerated here for the same reason it is regenerated at the end — an id
- * somebody planted in the browser must not be the one that finishes the
- * sign-in.
- */
-const startSecondStep = (req, userId) =>
-  new Promise((resolve, reject) => {
-    if (!req.session) {
-      reject(new Error('No session to hold the second step in.'));
-      return;
-    }
-    req.session.regenerate((error) => {
-      if (error) {
-        reject(error);
-        return;
-      }
-      req.session.pendingTotpUserId = userId;
-      req.session.pendingTotpSince = Date.now();
-      req.session.save((saveError) => (saveError ? reject(saveError) : resolve()));
-    });
-  });
-
-/** The account halfway through signing in here, or null. */
-const secondStepUserId = (req) => {
-  const userId = req.session?.pendingTotpUserId;
-  if (!userId) return null;
-  const since = Number(req.session.pendingTotpSince) || 0;
-  if (Date.now() - since > SECOND_STEP_MS) return null;
-  return userId;
-};
-
-const forgetSecondStep = (req) => {
-  if (!req.session) return;
-  delete req.session.pendingTotpUserId;
-  delete req.session.pendingTotpSince;
-};
+const { startAuthenticatedSession } = require('../utils/authenticatedSession');
+const { incrementFailedAttempts, clearLock, isLocked } = require('../services/users/lockout');
+const { clientAddress } = require('../utils/clientAddress');
 
 const rateLimitHandler = (req, res, next, options) => {
   const retryAfterSeconds = Math.ceil(options.windowMs / 1000);
@@ -218,6 +110,56 @@ const oneSetupAtATime = (task) => {
   return run;
 };
 
+/**
+ * How long the second step stays open.
+ *
+ * Long enough to find a phone, pick the app and read the digits; short enough
+ * that a machine walked away from is not a sign-in waiting to be finished by
+ * whoever sits down next.
+ */
+const SECOND_STEP_MS = 5 * 60 * 1000;
+
+/**
+ * The password was right, and the account wants a code as well.
+ *
+ * Deliberately not a signed-in session with a flag on it: nothing but
+ * `localUserId` signs anybody in, and this state does not set it. The session
+ * is regenerated here for the same reason it is regenerated at the end — an id
+ * somebody planted in the browser must not be the one that finishes the
+ * sign-in.
+ */
+const startSecondStep = (req, userId) =>
+  new Promise((resolve, reject) => {
+    if (!req.session) {
+      reject(new Error('A second factor needs a session to wait in.'));
+      return;
+    }
+    req.session.regenerate((error) => {
+      if (error) {
+        reject(error);
+        return;
+      }
+      req.session.pendingTotpUserId = userId;
+      req.session.pendingTotpSince = Date.now();
+      req.session.save((saveError) => (saveError ? reject(saveError) : resolve()));
+    });
+  });
+
+/** The account halfway through signing in here, or null. */
+const secondStepUserId = (req) => {
+  const userId = req.session?.pendingTotpUserId;
+  if (!userId) return null;
+  const since = Number(req.session.pendingTotpSince) || 0;
+  if (Date.now() - since > SECOND_STEP_MS) return null;
+  return userId;
+};
+
+const forgetSecondStep = (req) => {
+  if (!req.session) return;
+  delete req.session.pendingTotpUserId;
+  delete req.session.pendingTotpSince;
+};
+
 const respondWithUser = async (req, res) => {
   const user = await getRequestUser(req);
   res.json({ user });
@@ -251,10 +193,10 @@ router.get('/status', async (req, res) => {
 
   res.json({
     requiresSetup,
+    strategies,
     // A reload in the middle of signing in lands back on the code, rather than
     // on a password screen that would start the whole thing again.
     totpPending: Boolean(secondStepUserId(req)),
-    strategies,
     authEnabled: auth.enabled,
     authMode,
     authenticated: auth.enabled ? Boolean(isEoc || hasLocal) : true,
@@ -290,9 +232,8 @@ router.post(
     await startAuthenticatedSession(req, user.id);
 
     // Clear guest session cookie when user sets up account
-    // Both paths: the cookie has been set on `/api` and on `/`, and a guest
-    // session left behind on the other one outlives the sign-in that should
-    // have ended it.
+    // Clear both scopes: the cookie used to be set on /api, and browsers
+    // still holding that one would otherwise keep it.
     res.clearCookie('guestSession', { path: '/' });
     res.clearCookie('guestSession', { path: '/api' });
 
@@ -300,22 +241,33 @@ router.post(
   })
 );
 
-// Local login with email + password
+// Local login with an email address or a username, and a password
 router.post(
   '/login',
   loginLimiter,
   asyncHandler(async (req, res) => {
     refuseWithoutPasswordSignIn();
-    const { email, password, username } = req.body || {};
-    // Support both email and username (backward compatibility)
-    const emailOrUsername = email || username;
+    const { identifier, email, password, username } = req.body || {};
+    // `email` and `username` are the older field names; both carried whatever
+    // was typed into the one box on the sign-in screen.
+    const typed = identifier || email || username;
 
-    let user = null;
+    let user;
     try {
-      user = await attemptLocalLogin({ email: emailOrUsername, password });
+      user = await attemptLocalLogin({ identifier: typed, password });
     } catch (e) {
       if (e?.status === 423) {
-        throw new RateLimitError(e.message, e.until);
+        // Seconds in `retryAfter`, which is what the interface reads, with the
+        // deadline itself beside it, under a code of its own so the message
+        // translates. The ISO date used to sit in `retryAfter` under a generic
+        // code, and the sign-in screen could say neither how long nor in what
+        // language.
+        const lockedUntil = e.until || null;
+        const msLeft = lockedUntil ? Date.parse(lockedUntil) - Date.now() : NaN;
+        const retryAfter = Number.isFinite(msLeft) ? Math.max(1, Math.ceil(msLeft / 1000)) : null;
+        const locked = new RateLimitError(e.message, retryAfter, ErrorCodes.AUTH_ACCOUNT_LOCKED);
+        if (lockedUntil) locked.details = { ...locked.details, lockedUntil };
+        throw locked;
       }
       throw e;
     }
@@ -324,7 +276,7 @@ router.post(
         action: 'sign-in',
         outcome: 'refused',
         // The name that was typed, not one this server confirmed exists.
-        actor: String(emailOrUsername || '').slice(0, 200) || 'unknown',
+        actor: String(typed || '').slice(0, 200) || 'unknown',
         detail: { method: 'password' },
         req,
       });
@@ -332,9 +284,9 @@ router.post(
     }
 
     // The password was right and the account asks for a code as well. Nothing
-    // about who they are is answered here: that an account has a second factor
-    // is not something to tell whoever guessed a password correctly, so the
-    // answer carries the question and nothing else.
+    // about who they are is answered here: an account that has a second factor
+    // is not something to tell anybody who guessed a password correctly, so
+    // the answer carries the question and nothing else.
     if (await twoFactorRequired(user.id)) {
       await startSecondStep(req, user.id);
       res.json({ totpRequired: true });
@@ -345,9 +297,8 @@ router.post(
     await activityLog.record({ action: 'sign-in', user, detail: { method: 'password' }, req });
 
     // Clear guest session cookie when user logs in
-    // Both paths: the cookie has been set on `/api` and on `/`, and a guest
-    // session left behind on the other one outlives the sign-in that should
-    // have ended it.
+    // Clear both scopes: the cookie used to be set on /api, and browsers
+    // still holding that one would otherwise keep it.
     res.clearCookie('guestSession', { path: '/' });
     res.clearCookie('guestSession', { path: '/api' });
 
@@ -355,56 +306,305 @@ router.post(
   })
 );
 
-/** The passkeys on this account, so they can be named and taken away. */
+/**
+ * The second step: the code from the phone, or one off the paper.
+ *
+ * Wrong codes count against the same lockout a wrong password does, so the
+ * second factor is not a place to guess a million times at six digits while
+ * the first one is bounded.
+ */
+router.post(
+  '/login/totp',
+  loginLimiter,
+  asyncHandler(async (req, res) => {
+    refuseWithoutPasswordSignIn();
+    const userId = secondStepUserId(req);
+    if (!userId) {
+      forgetSecondStep(req);
+      throw new UnauthorizedError(
+        'That sign-in is no longer waiting for a code. Sign in again.',
+        ErrorCodes.AUTH_INVALID_CREDENTIALS
+      );
+    }
+
+    if (await isLocked(userId)) {
+      throw new RateLimitError(
+        'Account is temporarily locked due to failed login attempts.',
+        null,
+        ErrorCodes.AUTH_ACCOUNT_LOCKED
+      );
+    }
+
+    const { code } = req.body || {};
+    const outcome = await verifySecondFactor({ userId, code });
+    if (!outcome.ok) {
+      await incrementFailedAttempts(userId);
+      await activityLog.record({
+        action: 'sign-in',
+        outcome: 'refused',
+        userId,
+        actor: (await getById(userId))?.username || userId,
+        detail: { method: 'code' },
+        req,
+      });
+      throw new UnauthorizedError('That code is not right.', ErrorCodes.AUTH_INVALID_TOTP_CODE);
+    }
+
+    await clearLock(userId);
+    forgetSecondStep(req);
+    await startAuthenticatedSession(req, userId);
+
+    res.clearCookie('guestSession', { path: '/' });
+    res.clearCookie('guestSession', { path: '/api' });
+
+    const user = await getRequestUser(req);
+    await activityLog.record({
+      action: 'sign-in',
+      user,
+      detail: { method: outcome.usedRecoveryCode ? 'recovery code' : 'code' },
+      req,
+    });
+    res.json({
+      user,
+      usedRecoveryCode: Boolean(outcome.usedRecoveryCode),
+      recoveryCodesLeft: outcome.recoveryCodesLeft ?? null,
+    });
+  })
+);
+
+/** Whether this account asks for a code, and how many recovery codes are left. */
 router.get(
-  '/passkeys',
+  '/totp',
   asyncHandler(async (req, res) => {
     const me = await getRequestUser(req);
     if (!me) throw new UnauthorizedError('Authentication required.');
-    res.json({ passkeys: await passkeys.listPasskeys(me.id) });
+    res.json(await twoFactorStatus(me.id));
   })
 );
 
 /**
- * Start making one.
+ * Draw a secret and show it, which turns nothing on.
  *
- * Signed in here with this account, like the second factor: a session the
- * identity provider opened is not one that adds a local way in.
+ * What comes back is shown once and never again: the phone keeps it, and the
+ * copy here is unreadable the moment it is written.
  */
 router.post(
-  '/passkeys/register/start',
+  '/totp/start',
   passwordLimiter,
   asyncHandler(async (req, res) => {
     refuseWithoutPasswordSignIn();
     const me = await getRequestUser(req);
     if (!me) throw new UnauthorizedError('Authentication required.');
     if (!req.session || req.session.localUserId !== me.id) {
-      throw new ForbiddenError('Sign in with your password to add a passkey.');
+      throw new ForbiddenError('Sign in with your password to set up a second factor.');
     }
 
-    const { rpId, rpName, origins } = relyingParty(req);
-    const options = await passkeys.beginRegistration({
+    const enrolment = await beginTwoFactorEnrolment({
       userId: me.id,
       account: me.email || me.username || me.id,
-      displayName: me.displayName || me.username || me.email || me.id,
-      rpId,
-      rpName,
     });
-    await rememberChallenge(req, 'register', options.challenge);
-    res.json({ options, origins });
+    res.json(enrolment);
   })
 );
 
-/** Keep it, if it answers the question this browser was just asked. */
+/** Turn it on, once a code proves the phone holds the same secret. */
 router.post(
-  '/passkeys/register/finish',
+  '/totp/confirm',
   passwordLimiter,
   asyncHandler(async (req, res) => {
-    refuseWithoutPasswordSignIn();
     const me = await getRequestUser(req);
     if (!me) throw new UnauthorizedError('Authentication required.');
-    if (!req.session || req.session.localUserId !== me.id) {
-      throw new ForbiddenError('Sign in with your password to add a passkey.');
+
+    const confirmed = await confirmTwoFactorEnrolment({ userId: me.id, code: req.body?.code });
+    if (!confirmed) {
+      throw new UnauthorizedError('That code is not right.', ErrorCodes.AUTH_INVALID_TOTP_CODE);
+    }
+    logger.info({ userId: me.id }, 'Two-factor authentication turned on');
+    await activityLog.record({ action: 'account.two-factor', user: me, detail: { on: true }, req });
+    res.json(confirmed);
+  })
+);
+
+/**
+ * New recovery codes, and the password to prove it is still the same person.
+ *
+ * A browser left unlocked is the case this is about: drawing new codes throws
+ * the old ones away, and somebody who sat down at a signed-in screen should
+ * not be able to leave with the only working set.
+ */
+router.post(
+  '/totp/recovery-codes',
+  passwordLimiter,
+  asyncHandler(async (req, res) => {
+    const me = await getRequestUser(req);
+    if (!me) throw new UnauthorizedError('Authentication required.');
+    if (!(await verifyLocalPassword({ userId: me.id, password: req.body?.password }))) {
+      throw new UnauthorizedError(
+        'That password is not right.',
+        ErrorCodes.AUTH_PASSWORD_INCORRECT
+      );
+    }
+
+    res.json({ recoveryCodes: await replaceRecoveryCodes(me.id) });
+  })
+);
+
+/** Off, with the password for the same reason. */
+router.delete(
+  '/totp',
+  passwordLimiter,
+  asyncHandler(async (req, res) => {
+    const me = await getRequestUser(req);
+    if (!me) throw new UnauthorizedError('Authentication required.');
+    if (!(await verifyLocalPassword({ userId: me.id, password: req.body?.password }))) {
+      throw new UnauthorizedError(
+        'That password is not right.',
+        ErrorCodes.AUTH_PASSWORD_INCORRECT
+      );
+    }
+
+    await disableTwoFactor(me.id);
+    logger.info({ userId: me.id }, 'Two-factor authentication turned off');
+    await activityLog.record({
+      action: 'account.two-factor',
+      user: me,
+      detail: { on: false },
+      req,
+    });
+    res.status(204).end();
+  })
+);
+
+/**
+ * The site a passkey is bound to, and the pages allowed to use one.
+ *
+ * A passkey is made for a name and signs only for that name — which is the
+ * phishing resistance, and also the reason an installation reached through two
+ * hostnames has to pick one. PUBLIC_URL answers it where it is set; where it
+ * is not, the name this request arrived on is the answer, which is right for
+ * the single-hostname installation that never configured anything. An operator
+ * who needs to settle it sets WEBAUTHN_RP_ID.
+ *
+ * Browsers refuse a passkey on an address that is not a name, and on a page
+ * that is not secure: a LAN IP or plain http offers nothing to bind to. That
+ * refusal happens in the browser, before this is reached.
+ */
+const relyingParty = (req) => {
+  const known = uniqueOrigins(publicConfig.origins || []);
+  const origins = known.length
+    ? known
+    : uniqueOrigins([`${req.protocol}://${req.get('host') || ''}`]);
+
+  let rpId = webauthnConfig.rpId;
+  if (!rpId) {
+    try {
+      rpId = new URL(publicConfig.url || origins[0] || '').hostname;
+    } catch (_) {
+      rpId = null;
+    }
+  }
+  if (!rpId) rpId = req.hostname;
+  return { rpId, rpName: webauthnConfig.rpName, origins };
+};
+
+/**
+ * Keep the question until the answer arrives, and spend it then.
+ *
+ * In the session, not in a table: it belongs to one browser and one moment.
+ * Spending it means taking it away — an answer is worth one sign-in, and a
+ * challenge still lying about is one somebody else can answer with a recording
+ * of the first.
+ */
+const rememberChallenge = (req, purpose, challenge) =>
+  new Promise((resolve, reject) => {
+    if (!req.session) {
+      reject(new Error('A passkey needs a session to ask its question in.'));
+      return;
+    }
+    req.session.webauthn = { purpose, challenge, at: Date.now() };
+    req.session.save((error) => (error ? reject(error) : resolve()));
+  });
+
+const spendChallenge = (req, purpose) => {
+  const held = req.session?.webauthn;
+  if (req.session) delete req.session.webauthn;
+  if (!held || held.purpose !== purpose) return null;
+  if (Date.now() - (Number(held.at) || 0) > passkeys.CEREMONY_TIMEOUT_MS) return null;
+  return held.challenge;
+};
+
+/** Every refusal reads the same from outside, and says what happened in the log. */
+const refusePasskey = (error, req) => {
+  if (!(error instanceof WebAuthnError)) throw error;
+  if (error.status === 409) {
+    throw new ValidationError(error.message);
+  }
+  logger.warn({ reason: error.message, ip: clientAddress(req) }, 'A passkey was refused');
+  // Not awaited: this is the throwing path, and a log line is not worth
+  // holding a refusal for. `record` never rejects.
+  activityLog.record({
+    action: 'sign-in',
+    outcome: 'refused',
+    actor: 'unknown',
+    detail: { method: 'passkey' },
+    req,
+  });
+  throw new UnauthorizedError(
+    'That passkey did not open anything here.',
+    ErrorCodes.AUTH_PASSKEY_REJECTED
+  );
+};
+
+/** The passkeys on this account. */
+router.get(
+  '/passkeys',
+  asyncHandler(async (req, res) => {
+    const me = await getRequestUser(req);
+    if (!me) throw new UnauthorizedError('Authentication required.');
+    res.json({ passkeys: await passkeys.listPasskeys(me.id) });
+  })
+);
+
+/**
+ * Start making one.
+ *
+ * Signed in here with this account, like the second factor: a session the
+ * identity provider opened is not one that adds a local way in.
+ */
+router.post(
+  '/passkeys/register/start',
+  passwordLimiter,
+  asyncHandler(async (req, res) => {
+    refuseWithoutPasswordSignIn();
+    const me = await getRequestUser(req);
+    if (!me) throw new UnauthorizedError('Authentication required.');
+    if (!req.session || req.session.localUserId !== me.id) {
+      throw new ForbiddenError('Sign in with your password to add a passkey.');
+    }
+
+    const { rpId, rpName, origins } = relyingParty(req);
+    const options = await passkeys.beginRegistration({
+      userId: me.id,
+      account: me.email || me.username || me.id,
+      displayName: me.displayName || me.username || me.email || me.id,
+      rpId,
+      rpName,
+    });
+    await rememberChallenge(req, 'register', options.challenge);
+    res.json({ options, origins });
+  })
+);
+
+/** Keep it, if it answers the question this browser was just asked. */
+router.post(
+  '/passkeys/register/finish',
+  passwordLimiter,
+  asyncHandler(async (req, res) => {
+    refuseWithoutPasswordSignIn();
+    const me = await getRequestUser(req);
+    if (!me) throw new UnauthorizedError('Authentication required.');
+    if (!req.session || req.session.localUserId !== me.id) {
+      throw new ForbiddenError('Sign in with your password to add a passkey.');
     }
 
     const challenge = spendChallenge(req, 'register');
@@ -429,7 +629,7 @@ router.post(
       });
       res.status(201).json({ passkey });
     } catch (error) {
-      refusePasskey(error);
+      refusePasskey(error, req);
     }
   })
 );
@@ -483,6 +683,12 @@ router.delete(
         'This is the only way into this account. Add a password, or another passkey, before removing it.'
       );
     }
+    await activityLog.record({
+      action: 'account.passkey',
+      user: me,
+      detail: { added: false },
+      req,
+    });
     res.status(204).end();
   })
 );
@@ -511,8 +717,8 @@ router.post(
  *
  * A passkey that was unlocked — a fingerprint, a face, a PIN — is already two
  * things: the device, and whoever can open it. That is why it satisfies an
- * account that asks for a second factor, and why one that was not unlocked does
- * not: that proves only that the device was there.
+ * account that asks for a second factor, and why one that was not unlocked
+ * does not: it proves only that the device was there.
  */
 router.post(
   '/login/passkey/finish',
@@ -535,7 +741,7 @@ router.post(
         expected: { challenge, origins, rpId },
       });
     } catch (error) {
-      refusePasskey(error);
+      refusePasskey(error, req);
     }
 
     if (await isLocked(outcome.userId)) {
@@ -554,9 +760,6 @@ router.post(
     }
 
     await startAuthenticatedSession(req, outcome.userId);
-    // Both paths: the cookie has been set on `/api` and on `/`, and a guest
-    // session left behind on the other one outlives the sign-in that should
-    // have ended it.
     res.clearCookie('guestSession', { path: '/' });
     res.clearCookie('guestSession', { path: '/api' });
 
@@ -564,185 +767,14 @@ router.post(
       { userId: outcome.userId, passkeyId: outcome.passkeyId },
       'Signed in with a passkey'
     );
-    const signedIn = await getRequestUser(req);
+    const user = await getRequestUser(req);
     await activityLog.record({
       action: 'sign-in',
-      user: signedIn,
+      user,
       detail: { method: 'passkey', passkey: outcome.name },
       req,
     });
-    res.json({ user: signedIn });
-  })
-);
-
-/**
- * The second step: the code from the phone, or one off the paper.
- *
- * Wrong codes count against the same lockout a wrong password does, so the
- * second factor is not a place to guess a million times at six digits while
- * the first one is bounded.
- */
-router.post(
-  '/login/totp',
-  loginLimiter,
-  asyncHandler(async (req, res) => {
-    refuseWithoutPasswordSignIn();
-    const userId = secondStepUserId(req);
-    if (!userId) {
-      forgetSecondStep(req);
-      throw new UnauthorizedError(
-        'That sign-in is no longer waiting for a code. Sign in again.',
-        ErrorCodes.AUTH_INVALID_CREDENTIALS
-      );
-    }
-
-    if (await isLocked(userId)) {
-      throw new RateLimitError(
-        'Account is temporarily locked due to failed login attempts.',
-        null,
-        ErrorCodes.AUTH_ACCOUNT_LOCKED
-      );
-    }
-
-    const { code } = req.body || {};
-    const outcome = await verifySecondFactor({ userId, code });
-    if (!outcome.ok) {
-      await incrementFailedAttempts(userId);
-      await activityLog.record({
-        action: 'sign-in',
-        outcome: 'refused',
-        userId,
-        detail: { method: 'code' },
-        req,
-      });
-      throw new UnauthorizedError('That code is not right.', ErrorCodes.AUTH_INVALID_TOTP_CODE);
-    }
-
-    await clearLock(userId);
-    forgetSecondStep(req);
-    await startAuthenticatedSession(req, userId);
-    // Both paths: the cookie has been set on `/api` and on `/`, and a guest
-    // session left behind on the other one outlives the sign-in that should
-    // have ended it.
-    res.clearCookie('guestSession', { path: '/' });
-    res.clearCookie('guestSession', { path: '/api' });
-
-    const signedIn = await getRequestUser(req);
-    await activityLog.record({
-      action: 'sign-in',
-      user: signedIn,
-      detail: { method: outcome.usedRecoveryCode ? 'recovery code' : 'code' },
-      req,
-    });
-    res.json({
-      user: signedIn,
-      usedRecoveryCode: Boolean(outcome.usedRecoveryCode),
-      recoveryCodesLeft: outcome.recoveryCodesLeft ?? null,
-    });
-  })
-);
-
-/** Whether this account asks for a code, and how many recovery codes are left. */
-router.get(
-  '/totp',
-  asyncHandler(async (req, res) => {
-    const me = await getRequestUser(req);
-    if (!me) throw new UnauthorizedError('Authentication required.');
-    res.json(await twoFactorStatus(me.id));
-  })
-);
-
-/**
- * Draw a secret and show it, which turns nothing on.
- *
- * What comes back is shown once and never again: the phone keeps it, and the
- * copy here is unreadable the moment it is written.
- */
-router.post(
-  '/totp/start',
-  passwordLimiter,
-  asyncHandler(async (req, res) => {
-    refuseWithoutPasswordSignIn();
-    const me = await getRequestUser(req);
-    if (!me) throw new UnauthorizedError('Authentication required.');
-    if (!req.session || req.session.localUserId !== me.id) {
-      throw new ForbiddenError('Sign in with your password to set up a second factor.');
-    }
-
-    res.json(
-      await beginTwoFactorEnrolment({
-        userId: me.id,
-        account: me.email || me.username || me.id,
-      })
-    );
-  })
-);
-
-/** Turn it on, once a code proves the phone holds the same secret. */
-router.post(
-  '/totp/confirm',
-  passwordLimiter,
-  asyncHandler(async (req, res) => {
-    const me = await getRequestUser(req);
-    if (!me) throw new UnauthorizedError('Authentication required.');
-
-    const confirmed = await confirmTwoFactorEnrolment({ userId: me.id, code: req.body?.code });
-    if (!confirmed) {
-      throw new UnauthorizedError('That code is not right.', ErrorCodes.AUTH_INVALID_TOTP_CODE);
-    }
-    logger.info({ userId: me.id }, 'Two-factor authentication turned on');
-    await activityLog.record({ action: 'account.two-factor', user: me, detail: { on: true }, req });
-    res.json(confirmed);
-  })
-);
-
-/**
- * New recovery codes, and the password to prove it is still the same person.
- *
- * A browser left unlocked is the case this is about: drawing new codes throws
- * the old ones away, and somebody who sat down at a signed-in screen should not
- * be able to leave with the only working set.
- */
-router.post(
-  '/totp/recovery-codes',
-  passwordLimiter,
-  asyncHandler(async (req, res) => {
-    const me = await getRequestUser(req);
-    if (!me) throw new UnauthorizedError('Authentication required.');
-    if (!(await verifyLocalPassword({ userId: me.id, password: req.body?.password }))) {
-      throw new UnauthorizedError(
-        'That password is not right.',
-        ErrorCodes.AUTH_PASSWORD_INCORRECT
-      );
-    }
-
-    res.json({ recoveryCodes: await replaceRecoveryCodes(me.id) });
-  })
-);
-
-/** Off, with the password for the same reason. */
-router.delete(
-  '/totp',
-  passwordLimiter,
-  asyncHandler(async (req, res) => {
-    const me = await getRequestUser(req);
-    if (!me) throw new UnauthorizedError('Authentication required.');
-    if (!(await verifyLocalPassword({ userId: me.id, password: req.body?.password }))) {
-      throw new UnauthorizedError(
-        'That password is not right.',
-        ErrorCodes.AUTH_PASSWORD_INCORRECT
-      );
-    }
-
-    await disableTwoFactor(me.id);
-    logger.info({ userId: me.id }, 'Two-factor authentication turned off');
-    await activityLog.record({
-      action: 'account.two-factor',
-      user: me,
-      detail: { on: false },
-      req,
-    });
-    res.status(204).end();
+    res.json({ user });
   })
 );
 
@@ -767,6 +799,7 @@ router.post(
       newPassword,
       keepSessionId: signedInHere ? req.sessionID : null,
     });
+    if (signedInHere) await startAuthenticatedSession(req, me.id);
     await activityLog.record({ action: 'account.password', user: me, req });
     res.status(204).end();
   })
@@ -1174,9 +1207,8 @@ router.post(
       throw new UnauthorizedError('User no longer exists.', ErrorCodes.AUTH_INVALID_CREDENTIALS);
     }
 
-    // Both paths: the cookie has been set on `/api` and on `/`, and a guest
-    // session left behind on the other one outlives the sign-in that should
-    // have ended it.
+    // Clear both scopes: the cookie used to be set on /api, and browsers still
+    // holding that one would otherwise keep it.
     res.clearCookie('guestSession', { path: '/' });
     res.clearCookie('guestSession', { path: '/api' });
     res.json({ user });
diff --git a/backend/src/routes/browse.js b/backend/src/routes/browse.js
index 1038237c8..5943ea983 100644
--- a/backend/src/routes/browse.js
+++ b/backend/src/routes/browse.js
@@ -126,6 +126,9 @@ router.get(
         sourceFolderName: pathParts[pathParts.length - 1] || '',
       };
     }
+    // Listings carry transient information such as active OnlyOffice sessions.
+    // Keep browser and proxy caches from serving an out-of-date directory view.
+    res.setHeader('Cache-Control', 'private, no-store');
 
     res.json(response);
   })
diff --git a/backend/src/routes/files/transfer.js b/backend/src/routes/files/transfer.js
index 3da76385c..b57a77949 100644
--- a/backend/src/routes/files/transfer.js
+++ b/backend/src/routes/files/transfer.js
@@ -1,8 +1,41 @@
 const { transferItems } = require('../../services/fileTransferService');
+const recentDestinations = require('../../services/recentDestinationsService');
+const { ACTIONS, authorizeAndResolve } = require('../../services/authorizationService');
+const fs = require('node:fs/promises');
 const asyncHandler = require('../../utils/asyncHandler');
 
 const router = require('express').Router();
 
+/**
+ * Where this user has recently moved or copied things.
+ *
+ * Filtered against what they can reach right now: a folder can be deleted or
+ * have its access revoked long after it was last used, and offering it as a
+ * destination would only produce a failure at the end of the flow. Anything
+ * gone is forgotten on the way out, so the list heals itself.
+ */
+router.get(
+  '/files/recent-destinations',
+  asyncHandler(async (req, res) => {
+    const paths = await recentDestinations.list(req.user?.id);
+    const context = { user: req.user, guestSession: req.guestSession };
+
+    const reachable = [];
+    for (const relativePath of paths) {
+      const { allowed, resolved } = await authorizeAndResolve(context, relativePath, ACTIONS.write);
+      const stats = resolved ? await fs.stat(resolved.absolutePath).catch(() => null) : null;
+
+      if (allowed && stats?.isDirectory()) {
+        reachable.push(relativePath);
+      } else {
+        await recentDestinations.forget(req.user?.id, relativePath);
+      }
+    }
+
+    res.json({ items: reachable });
+  })
+);
+
 router.post(
   '/files/copy',
   asyncHandler(async (req, res) => {
@@ -11,6 +44,11 @@ router.post(
       user: req.user,
       guestSession: req.guestSession,
     });
+    // Recorded from the transfer itself rather than asked of the client, so every
+    // route into a folder counts — the picker, a drag onto a favorite, a paste —
+    // and the list reflects where things really go.
+    await recentDestinations.record(req.user?.id, result.destination);
+
     res.json({ success: true, ...result });
   })
 );
@@ -23,6 +61,11 @@ router.post(
       user: req.user,
       guestSession: req.guestSession,
     });
+    // Recorded from the transfer itself rather than asked of the client, so every
+    // route into a folder counts — the picker, a drag onto a favorite, a paste —
+    // and the list reflects where things really go.
+    await recentDestinations.record(req.user?.id, result.destination);
+
     res.json({ success: true, ...result });
   })
 );
diff --git a/backend/src/routes/permissions.js b/backend/src/routes/permissions.js
index 0d005f38a..7d358795a 100644
--- a/backend/src/routes/permissions.js
+++ b/backend/src/routes/permissions.js
@@ -1,12 +1,12 @@
 const express = require('express');
 const fs = require('fs/promises');
-const { exec } = require('child_process');
+const { execFile } = require('child_process');
 const { promisify } = require('util');
 
 const { normalizeRelativePath } = require('../utils/pathUtils');
 const { ACTIONS, authorizeAndResolve } = require('../services/authorizationService');
-const logger = require('../utils/logger');
 const { ensureAdmin } = require('../middleware/ensureAdmin');
+const logger = require('../utils/logger');
 const asyncHandler = require('../utils/asyncHandler');
 const {
   ValidationError,
@@ -16,7 +16,21 @@ const {
 } = require('../errors/AppError');
 
 const router = express.Router();
-const execAsync = promisify(exec);
+// execFile never spawns a shell: user-supplied owner/group names and file paths
+// stay plain arguments instead of being interpolated into a command string.
+const execFileAsync = promisify(execFile);
+
+// POSIX-portable account name, or a numeric id. Rejecting anything else keeps
+// `chown` from receiving a value it would read as an option.
+const ACCOUNT_NAME_PATTERN = /^[a-zA-Z0-9_][a-zA-Z0-9._-]*$/;
+
+const ensureValidAccountName = (value, label) => {
+  if (value === undefined || value === null || value === '') return '';
+  if (typeof value !== 'string' || !ACCOUNT_NAME_PATTERN.test(value)) {
+    throw new ValidationError(`Invalid ${label} name.`);
+  }
+  return value;
+};
 
 /**
  * Get file permissions, owner, and group information
@@ -53,7 +67,7 @@ router.get(
       if (process.platform !== 'win32') {
         try {
           // Get owner name from uid
-          const { stdout: ownerOut } = await execAsync(`id -nu ${stats.uid}`);
+          const { stdout: ownerOut } = await execFileAsync('id', ['-nu', String(stats.uid)]);
           owner = ownerOut.trim();
         } catch (e) {
           logger.debug({ err: e }, 'Failed to get owner name');
@@ -61,7 +75,7 @@ router.get(
 
         try {
           // Get group name from gid
-          const { stdout: groupOut } = await execAsync(`id -gn ${stats.gid}`);
+          const { stdout: groupOut } = await execFileAsync('id', ['-gn', String(stats.gid)]);
           group = groupOut.trim();
         } catch (e) {
           logger.debug({ err: e }, 'Failed to get group name');
@@ -91,10 +105,8 @@ router.get(
  */
 router.post(
   '/permissions/chmod',
-  // Changing modes and ownership on a shared volume is an administration
-  // task: a plain write permission on a path is not consent to re-permission
-  // its tree. `ensureAdmin` says as much in its own comment, and these are the
-  // two routes it was written for.
+  // Changing modes on a shared volume is an administration task: a plain
+  // write permission on a path is not consent to re-permission its tree.
   ensureAdmin,
   asyncHandler(async (req, res) => {
     const { path: rawPath, mode, recursive } = req.body;
@@ -107,13 +119,16 @@ router.post(
       throw new ValidationError('Mode must be a 3-digit octal string (e.g., "755").');
     }
 
+    // Guests never reach this point: they have no req.user. Carrying a guest
+    // session on top of a real account does not make the account a guest.
     if (!req.user || !req.user.id) {
       throw new UnauthorizedError('Authentication required');
     }
-    // Guests never reach this point: they have no req.user. Carrying a guest
-    // session on top of a real account does not make the account a guest.
 
     const relativePath = normalizeRelativePath(rawPath);
+    if (relativePath.startsWith('share/')) {
+      throw new ForbiddenError('Permissions cannot be changed through a share.');
+    }
     const context = { user: req.user, guestSession: req.guestSession };
     const { allowed, accessInfo, resolved } = await authorizeAndResolve(
       context,
@@ -125,11 +140,14 @@ router.post(
     }
 
     try {
-      // Check if path exists
-      await fs.stat(resolved.absolutePath);
-
-      // Use chmod via Node.js built-in
-      const modeInt = parseInt(mode, 8);
+      const before = await fs.stat(resolved.absolutePath);
+
+      // The three digits set read, write and execute. The setuid, setgid and
+      // sticky bits are not among them, and `chmod` writes the whole mode it is
+      // given: unticking one box on a shared setgid folder, or on /tmp-like
+      // sticky one, would silently take those bits away. They are kept as the
+      // item already had them.
+      const modeInt = parseInt(mode, 8) | (before.mode & 0o7000);
       await fs.chmod(resolved.absolutePath, modeInt);
 
       // If recursive and directory, apply to all children
@@ -139,10 +157,12 @@ router.post(
           // Use chmod -R for recursive on Unix systems
           if (process.platform !== 'win32') {
             try {
-              await execAsync(`chmod -R ${mode} "${resolved.absolutePath}"`);
+              // No `--` separator here: BSD chmod (macOS) does not accept it.
+              // The path is always absolute, so it can never look like a flag.
+              await execFileAsync('chmod', ['-R', mode, resolved.absolutePath]);
             } catch (e) {
               logger.error({ err: e }, 'Failed to apply recursive chmod');
-              throw new Error('Failed to apply permissions recursively.');
+              throw new Error('Failed to apply permissions recursively.', { cause: e });
             }
           } else {
             // On Windows, we'd need to recursively walk the directory
@@ -176,10 +196,6 @@ router.post(
  */
 router.post(
   '/permissions/chown',
-  // Changing modes and ownership on a shared volume is an administration
-  // task: a plain write permission on a path is not consent to re-permission
-  // its tree. `ensureAdmin` says as much in its own comment, and these are the
-  // two routes it was written for.
   ensureAdmin,
   asyncHandler(async (req, res) => {
     const { path: rawPath, owner, group } = req.body;
@@ -192,12 +208,18 @@ router.post(
       throw new ValidationError('Either owner or group must be specified.');
     }
 
+    const safeOwner = ensureValidAccountName(owner, 'owner');
+    const safeGroup = ensureValidAccountName(group, 'group');
+
+    // Same as above: only a real account gets here.
     if (!req.user || !req.user.id) {
       throw new UnauthorizedError('Authentication required');
     }
-    // As above: a guest session beside an account is not a guest.
 
     const relativePath = normalizeRelativePath(rawPath);
+    if (relativePath.startsWith('share/')) {
+      throw new ForbiddenError('Ownership cannot be changed through a share.');
+    }
     const context = { user: req.user, guestSession: req.guestSession };
     const { allowed, accessInfo, resolved } = await authorizeAndResolve(
       context,
@@ -212,21 +234,27 @@ router.post(
       // Check if path exists
       await fs.stat(resolved.absolutePath);
 
-      // chown requires shell execution as Node.js doesn't have built-in owner/group change
-      // This requires elevated privileges on most systems
+      // Node has no built-in owner/group change by name, so the system tools do
+      // it. Arguments are passed as an array, never through a shell, and the
+      // account names were validated above so they cannot look like flags
+      // (the path is absolute, so it cannot either).
       if (process.platform !== 'win32') {
-        let chownCmd = '';
-
-        if (owner && group) {
-          chownCmd = `chown "${owner}:${group}" "${resolved.absolutePath}"`;
-        } else if (owner) {
-          chownCmd = `chown "${owner}" "${resolved.absolutePath}"`;
-        } else if (group) {
-          chownCmd = `chgrp "${group}" "${resolved.absolutePath}"`;
+        let command = '';
+        let args = [];
+
+        if (safeOwner && safeGroup) {
+          command = 'chown';
+          args = [`${safeOwner}:${safeGroup}`, resolved.absolutePath];
+        } else if (safeOwner) {
+          command = 'chown';
+          args = [safeOwner, resolved.absolutePath];
+        } else {
+          command = 'chgrp';
+          args = [safeGroup, resolved.absolutePath];
         }
 
         try {
-          await execAsync(chownCmd);
+          await execFileAsync(command, args);
           logger.info({ path: relativePath, owner, group }, 'Ownership changed');
         } catch (e) {
           logger.error({ err: e }, 'Failed to change ownership');
@@ -236,7 +264,7 @@ router.post(
               'Permission denied. Changing ownership typically requires root/admin privileges.'
             );
           }
-          throw new Error('Failed to change ownership: ' + e.message);
+          throw new Error('Failed to change ownership: ' + e.message, { cause: e });
         }
       } else {
         throw new ValidationError('Changing ownership is not supported on Windows.');
diff --git a/backend/src/routes/settings.js b/backend/src/routes/settings.js
index 7063be9c0..c3b32010f 100644
--- a/backend/src/routes/settings.js
+++ b/backend/src/routes/settings.js
@@ -3,54 +3,27 @@ const {
   getPublicSettings,
   getSettingsForUser,
   setUserSetting,
-  USER_SETTING_KEYS,
-  setSystemSetting,
-  getSettings,
+  setUserFolderSort,
+  setUserFolderView,
+  checkSystemSection,
+  mergeSystemSection,
+  replaceBranding,
+  WRITABLE_USER_SETTINGS,
 } = require('../services/settingsService');
+const { forgetReplacedLogo, replaceLogo } = require('../services/brandingLogo');
 const activityLog = require('../services/activityLog');
+const asyncHandler = require('../utils/asyncHandler');
 const { ensureAdmin } = require('../middleware/ensureAdmin');
-const { checkRulePath } = require('../services/accessControlService');
+const multer = require('multer');
 const { ValidationError } = require('../errors/AppError');
+const { describeBytes, explainMultipartRefusals } = require('../middleware/multipartRefusals');
 const folderSizeManager = require('../services/folderSizeManager');
 const searchIndexManager = require('../services/searchIndexManager');
-const asyncHandler = require('../utils/asyncHandler');
-const multer = require('multer');
 const featureSwitches = require('../services/featureSwitches');
-const { explainMultipartRefusals, describeBytes } = require('../middleware/multipartRefusals');
-const { replaceLogo, forgetReplacedLogo } = require('../services/brandingLogo');
-
-/**
- * A number somebody chose.
- *
- * Every numeric setting here has a floor above zero, and every one of them is
- * a field on a form: emptied, it arrives as 0. Stored, the sanitizer lifts it
- * to the floor — so clearing the trash retention used to leave a trash that
- * keeps one day and sweeps everything older within the hour, and clearing the
- * share of a volume left one percent. Nothing arriving means nothing chosen,
- * and what is stored stays.
- *
- * One reading for all of them rather than a condition per field, so a section
- * added later cannot be the one that forgot.
- */
-const chosenNumber = (value) => Number.isFinite(value) && value > 0;
+const { checkRulePath } = require('../services/accessControlService');
 
 const router = express.Router();
 
-// Middleware to check if user is admin
-const keepValid = (section, fields) => {
-  const update = {};
-  for (const [name, isAcceptable] of Object.entries(fields)) {
-    if (isAcceptable(section[name])) update[name] = section[name];
-  }
-  return update;
-};
-
-const isBoolean = (value) => typeof value === 'boolean';
-
-// An application name of spaces is no name: the header and the sign-in page showed
-// nothing where it belonged.
-const isName = (value) => typeof value === 'string' && value.trim() !== '';
-
 const LOGO_MAX_BYTES = 2 * 1024 * 1024;
 
 // Configure multer for logo uploads
@@ -72,6 +45,7 @@ const upload = multer({
 const acceptLogo = explainMultipartRefusals(upload.single('logo'), {
   LIMIT_FILE_SIZE: `A logo can be at most ${describeBytes(LOGO_MAX_BYTES)}.`,
 });
+
 /**
  * GET /api/branding
  * Returns public branding settings (no auth required)
@@ -169,277 +143,314 @@ router.post(
  * - Users can update their own user settings (user.*)
  * - Admins can update system settings (thumbnails, access, branding)
  */
-router.patch(
-  '/settings',
-  asyncHandler(async (req, res) => {
-    const payload = req.body || {};
-    const user = req.user;
-    const isAdmin = user && Array.isArray(user.roles) && user.roles.includes('admin');
-    const updated = {};
-
-    // User settings (all authenticated users can update)
-    if (payload.user && typeof payload.user === 'object' && user && user.id) {
-      const userUpdates = {};
-      for (const [key, value] of Object.entries(payload.user)) {
-        // Which keys are preferences is the settings service's to say: this
-        // route used to keep a second list of its own, and a preference added
-        // to one and not the other was silently dropped here.
-        if (USER_SETTING_KEYS.has(key)) {
-          userUpdates[key] = await setUserSetting(user.id, key, value);
-        }
-      }
-      if (Object.keys(userUpdates).length > 0) {
-        updated.user = userUpdates;
-      }
+/**
+ * Keep the fields of a section that arrived in a shape worth storing.
+ *
+ * A field nobody sent is not a field set to nothing, and a size that is not a
+ * number is a size nobody chose: both are left out, so the stored value stays
+ * what it was rather than becoming something the caller never asked for.
+ */
+const keepValid = (section, fields) => {
+  const update = {};
+  for (const [name, isAcceptable] of Object.entries(fields)) {
+    if (isAcceptable(section[name])) update[name] = section[name];
+  }
+  return update;
+};
+
+const isBoolean = (value) => typeof value === 'boolean';
+const isText = (value) => typeof value === 'string';
+
+// A size or a count of nothing, or of less than nothing, is what an emptied or
+// mistyped field sends, not a value anyone chose. The service would bring it up
+// to its lowest bound — a chunk size of 0 became 1 MiB — which replaced what
+// was stored with something nobody asked for. A positive value outside the
+// bounds is still brought within them there.
+const isPositiveNumber = (value) => Number.isFinite(value) && value > 0;
+
+// An application name of spaces is no name: the header and the sign-in page
+// showed nothing where it belonged.
+const isName = (value) => typeof value === 'string' && value.trim() !== '';
+
+/**
+ * Merge an update over what is stored, and give back the whole section.
+ *
+ * The merge is the service's, which reads the stored section and writes it
+ * back without yielding in between. Merging over the settings read at the
+ * start of the request, as this did, left two awaits between the read and the
+ * write: two saves of one section at once both started from the same stored
+ * value, and the second wrote over the first's field while telling the person
+ * who set it that it was saved. Branding already had its own reason for a
+ * read and a write in one step; every section has this one.
+ *
+ * @returns {Promise<object|null>} null when there was nothing to change, so a
+ *   caller can tell "no valid field" from "field set to its current value".
+ */
+const mergeSection = async (category, key, update) => {
+  if (Object.keys(update).length === 0) return null;
+  return mergeSystemSection(category, key, update);
+};
+
+/** A person's own preferences, which they may change whatever their role. */
+const applyUserPreferences = async (user, section) => {
+  const updates = {};
+
+  for (const [key, value] of Object.entries(section)) {
+    if (key === 'folderSort') {
+      const folderSorts = await setUserFolderSort(user.id, value?.path, value?.sort);
+      if (folderSorts) updates.folderSorts = folderSorts;
+    } else if (key === 'folderView') {
+      const folderViews = await setUserFolderView(user.id, value?.path, value?.view);
+      if (folderViews) updates.folderViews = folderViews;
+    } else if (WRITABLE_USER_SETTINGS.has(key)) {
+      updates[key] = await setUserSetting(user.id, key, value);
     }
+  }
 
-    // System settings (admin only)
-    if (isAdmin) {
-      const systemUpdates = {};
-
-      // Thumbnails settings
-      if (payload.thumbnails && typeof payload.thumbnails === 'object') {
-        const thumbnailsUpdate = {};
-        if (payload.thumbnails.enabled != null) {
-          thumbnailsUpdate.enabled = Boolean(payload.thumbnails.enabled);
-        }
-        if (chosenNumber(payload.thumbnails.size)) {
-          thumbnailsUpdate.size = payload.thumbnails.size;
-        }
-        if (chosenNumber(payload.thumbnails.quality)) {
-          thumbnailsUpdate.quality = payload.thumbnails.quality;
-        }
-        if (chosenNumber(payload.thumbnails.concurrency)) {
-          thumbnailsUpdate.concurrency = payload.thumbnails.concurrency;
-        }
-        if (Object.keys(thumbnailsUpdate).length > 0) {
-          const current = await getSettings();
-          await setSystemSetting('system', 'thumbnails', {
-            ...current.thumbnails,
-            ...thumbnailsUpdate,
-          });
-          systemUpdates.thumbnails = { ...current.thumbnails, ...thumbnailsUpdate };
-        }
-      }
+  return Object.keys(updates).length > 0 ? updates : null;
+};
 
-      // Access control rules, and whether they hold administrators. The two are
-      // saved apart on the settings page, so each is merged over what is stored
-      // rather than replacing the section: saving the rules used to drop the
-      // setting above them, and saving the setting used to drop the rules.
-      if (payload.access && typeof payload.access === 'object') {
-        const accessUpdate = {};
-        if (Array.isArray(payload.access.rules)) accessUpdate.rules = payload.access.rules;
-        if (typeof payload.access.applyToAdmins === 'boolean') {
-          accessUpdate.applyToAdmins = payload.access.applyToAdmins;
-        }
-        if (Object.keys(accessUpdate).length > 0) {
-          const current = await getSettings();
-          const merged = await setSystemSetting('system', 'access', {
-            ...current.access,
-            ...accessUpdate,
-          });
-          systemUpdates.access = merged;
-        }
-      }
+/**
+ * A section checked in one step and written in another.
+ *
+ * Both halves exist because one save carries several sections: a refusal in
+ * the third must not leave the first two stored. `check` answers what is to be
+ * written, or null when the section sends nothing this route stores, and it is
+ * where a refusal comes from. `write` stores it, and cannot refuse.
+ */
+const merging = (key, fields) => ({
+  check: (section) => keepValid(section, fields),
+  write: (update) => mergeSection('system', key, update),
+});
 
-      // Trash settings: only the fields that arrived in a usable shape are
-      // merged over what is stored; setSystemSetting sanitizes and clamps them.
-      if (payload.trash && typeof payload.trash === 'object') {
-        const trashUpdate = {};
-        if (typeof payload.trash.enabled === 'boolean') {
-          trashUpdate.enabled = payload.trash.enabled;
-        }
-        if (chosenNumber(payload.trash.retentionDays)) {
-          trashUpdate.retentionDays = payload.trash.retentionDays;
-        }
-        if (chosenNumber(payload.trash.maxPercent)) {
-          trashUpdate.maxPercent = payload.trash.maxPercent;
-        }
-        if (payload.trash.maxBytes === null || chosenNumber(payload.trash.maxBytes)) {
-          trashUpdate.maxBytes = payload.trash.maxBytes;
-        }
-        if (Object.keys(trashUpdate).length > 0) {
-          const current = await getSettings();
-          const merged = await setSystemSetting('system', 'trash', {
-            ...current.trash,
-            ...trashUpdate,
-          });
-          systemUpdates.trash = merged;
-        }
-      }
+const thumbnailsSection = merging('thumbnails', {
+  // Anything but a boolean used to be read as "on": "false" switched
+  // thumbnails on for everybody.
+  enabled: isBoolean,
+  size: isPositiveNumber,
+  quality: isPositiveNumber,
+  concurrency: isPositiveNumber,
+});
 
-      // Upload settings: whether uploads go out in chunks, and how big one is.
-      if (payload.uploads && typeof payload.uploads === 'object') {
-        const uploadsUpdate = {};
-        if (typeof payload.uploads.chunkedEnabled === 'boolean') {
-          uploadsUpdate.chunkedEnabled = payload.uploads.chunkedEnabled;
-        }
-        if (chosenNumber(payload.uploads.chunkSizeBytes)) {
-          uploadsUpdate.chunkSizeBytes = payload.uploads.chunkSizeBytes;
-        }
-        if (Object.keys(uploadsUpdate).length > 0) {
-          const current = await getSettings();
-          const merged = await setSystemSetting('system', 'uploads', {
-            ...current.uploads,
-            ...uploadsUpdate,
-          });
-          systemUpdates.uploads = merged;
-        }
-      }
+const uploadsSection = merging('uploads', {
+  chunkedEnabled: isBoolean,
+  chunkedAutoFallback: isBoolean,
+  chunkSizeBytes: isPositiveNumber,
+});
 
-      // File-version settings: only the fields that arrived usable are merged;
-      // setSystemSetting sanitizes and keeps them consistent.
-      if (payload.versions && typeof payload.versions === 'object') {
-        const versionsUpdate = {};
-        if (typeof payload.versions.enabled === 'boolean') {
-          versionsUpdate.enabled = payload.versions.enabled;
-        }
-        for (const key of [
-          'keepAllHours',
-          'hourlyDays',
-          'dailyDays',
-          'maxPerFile',
-          'sessionCheckpointMinutes',
-        ]) {
-          if (chosenNumber(payload.versions[key])) versionsUpdate[key] = payload.versions[key];
-        }
-        if (Object.keys(versionsUpdate).length > 0) {
-          const current = await getSettings();
-          const merged = await setSystemSetting('system', 'versions', {
-            ...current.versions,
-            ...versionsUpdate,
-          });
-          systemUpdates.versions = merged;
-        }
-      }
+// The trash's size cap is the one field where nothing is a value: null removes
+// the cap. Zero is not that — it is what an emptied field sends, and the
+// service read it as "no cap given" and put the default back.
+const isPositiveNumberOrNull = (value) => value === null || isPositiveNumber(value);
+
+// A retention of no days, or of fewer than none, is what an emptied or
+// mistyped field sends. The service brought each up to its lowest bound — a
+// retention of 0 became one day, of -5 became one day — in place of the ninety
+// the administrator had. The settings page refuses them with the same bounds;
+// this is what an API client used to see instead.
+const trashSection = merging('trash', {
+  enabled: isBoolean,
+  retentionDays: isPositiveNumber,
+  maxPercent: isPositiveNumber,
+  maxBytes: isPositiveNumberOrNull,
+});
 
-      // Activity log settings: the switch, and how long a line is kept.
-      if (payload.activity && typeof payload.activity === 'object') {
-        const activityUpdate = {};
-        if (typeof payload.activity.enabled === 'boolean') {
-          activityUpdate.enabled = payload.activity.enabled;
-        }
-        if (chosenNumber(payload.activity.retentionDays)) {
-          activityUpdate.retentionDays = payload.activity.retentionDays;
-        }
-        if (Object.keys(activityUpdate).length > 0) {
-          const current = await getSettings();
-          const merged = await setSystemSetting('system', 'activity', {
-            ...current.activity,
-            ...activityUpdate,
-          });
-          systemUpdates.activity = merged;
-        }
-      }
+const versionsSection = merging('versions', {
+  enabled: isBoolean,
+  keepAllHours: isPositiveNumber,
+  hourlyDays: isPositiveNumber,
+  dailyDays: isPositiveNumber,
+  maxPerFile: isPositiveNumber,
+  sessionCheckpointMinutes: isPositiveNumber,
+});
 
-      // The folders each background worker leaves alone. The list is stored
-      // and handed to the worker, which answers with the list it is really
-      // applying — the stored one plus whatever the environment set, which an
-      // administrator cannot take away from here.
-      for (const [key, manager] of [
-        ['folderSize', folderSizeManager],
-        ['searchIndex', searchIndexManager],
-      ]) {
-        const section = payload[key];
-        if (!section || typeof section !== 'object') continue;
-
-        // Whether the worker runs at all, which was decided by SEARCH_INDEX and
-        // FOLDER_SIZE_MODE alone: turning either on meant editing a file on the host
-        // and restarting, while every other setting beside them was a click (#9).
-        //
-        // The environment stays the floor. A variable somebody set decides, and a
-        // switch sent for it is refused in words naming the variable, rather than
-        // accepted and quietly ignored — "false" is a decision too, so an
-        // installation that turned the index off in its file has not left it to
-        // whoever next opens the page.
-        const field = key === 'searchIndex' ? 'enabled' : 'mode';
-        if (Object.prototype.hasOwnProperty.call(section, field)) {
-          const variable = key === 'searchIndex' ? 'SEARCH_INDEX' : 'FOLDER_SIZE_MODE';
-          if (featureSwitches.snapshot()[key].lockedBy) {
-            throw new ValidationError(
-              `${variable} is set in the environment, so this is decided there and not here.`
-            );
-          }
-          const requested =
-            key === 'searchIndex'
-              ? typeof section.enabled === 'boolean'
-                ? section.enabled
-                : undefined
-              : featureSwitches.FOLDER_SIZE_MODES.includes(section.mode)
-                ? section.mode
-                : undefined;
-          if (requested === undefined) {
-            throw new ValidationError(`${field} is not a value ${key} takes.`);
-          }
-          const current = await getSettings();
-          systemUpdates[key] = await setSystemSetting('system', key, {
-            ...current[key],
-            [field]: requested,
-          });
-          if (key === 'searchIndex') await featureSwitches.setSearchIndex(requested);
-          else await featureSwitches.setFolderSizeMode(requested);
-        }
-
-        if (!Array.isArray(section.excludedPaths)) continue;
-        const current = await getSettings();
-        const merged = await setSystemSetting('system', key, {
-          ...current[key],
-          excludedPaths: section.excludedPaths,
-        });
-        await manager.setAdminExclusions(merged.excludedPaths);
-        systemUpdates[key] = merged;
-      }
+const activitySection = merging('activity', {
+  enabled: isBoolean,
+  retentionDays: isPositiveNumber,
+});
 
-      // Branding settings
-      let previousLogoUrl;
-      if (payload.branding && typeof payload.branding === 'object') {
-        const brandingUpdate = {};
-        if (typeof payload.branding.appName === 'string') {
-          brandingUpdate.appName = payload.branding.appName;
-        }
-        if (typeof payload.branding.appLogoUrl === 'string') {
-          brandingUpdate.appLogoUrl = payload.branding.appLogoUrl;
-        }
-        if (typeof payload.branding.showPoweredBy === 'boolean') {
-          brandingUpdate.showPoweredBy = payload.branding.showPoweredBy;
-        }
-        if (Object.keys(brandingUpdate).length > 0) {
-          const current = await getSettings();
-          previousLogoUrl = current.branding?.appLogoUrl ?? null;
-          await setSystemSetting('branding', 'branding', {
-            ...current.branding,
-            ...brandingUpdate,
-          });
-          systemUpdates.branding = { ...current.branding, ...brandingUpdate };
-        }
-      }
+/**
+ * Branding is read and written in one step rather than merged over the
+ * settings read at the start of the request, because a logo it replaces is
+ * then removed: reset to the default, or pointed elsewhere, the old file would
+ * otherwise stay behind with nothing to serve or remove it.
+ */
+const brandingSection = {
+  check: (section) => {
+    const update = keepValid(section, {
+      appName: isName,
+      appLogoUrl: isText,
+      showPoweredBy: isBoolean,
+    });
+    return Object.keys(update).length > 0 ? update : null;
+  },
+  write: async (update) => {
+    const { previous, current } = await replaceBranding(update);
+    await forgetReplacedLogo(previous.appLogoUrl, current.appLogoUrl);
+  },
+};
 
-      if (Object.keys(systemUpdates).length > 0) {
-        Object.assign(updated, systemUpdates);
-        // Which settings, not what they were set to: values belong in the
-        // settings, and some of them are somebody's business alone.
-        await activityLog.record({
-          action: 'admin.settings',
-          user,
-          detail: { sections: Object.keys(systemUpdates) },
-          req,
-        });
-      }
+/**
+ * Access rules replace the list rather than merging into it, and they are the
+ * one section that refuses what it was sent: a rule with no folder, or a
+ * permission that is not one of the three, is answered rather than dropped.
+ * Which is why it is checked here, before any other section is written — a
+ * list sent as something that is not a list is still dropped, as it always
+ * was, because then there is nothing to store.
+ *
+ * The switch that holds administrators to every rule is saved from a control of
+ * its own, so each half is taken only when it was sent and merged over what is
+ * stored: saving the rules must not switch it off, and switching it must not
+ * empty the rules.
+ */
+const accessSection = {
+  check: (section) => {
+    const update = {};
+    if (Array.isArray(section.rules)) {
+      update.rules = checkSystemSection('access', { rules: section.rules }).rules;
+    }
+    if (section.applyToAdmins !== undefined) {
+      update.applyToAdmins = checkSystemSection('access', {
+        applyToAdmins: section.applyToAdmins,
+      }).applyToAdmins;
+    }
+    return Object.keys(update).length > 0 ? update : null;
+  },
+  write: (update) => mergeSystemSection('system', 'access', update),
+};
 
-      // The logo that was replaced is forgotten, and only once nothing points at it
-      // any more. Removing the files under a fixed name meant a logo could not be
-      // changed back, and a branding change that failed halfway took the logo in use
-      // with it.
-      if (previousLogoUrl !== undefined) {
-        const settingsNow = await getSettings();
-        await forgetReplacedLogo(previousLogoUrl, settingsNow.branding?.appLogoUrl);
+/**
+ * A background worker: the folders it leaves alone, and whether it runs.
+ *
+ * The list is stored and handed to the worker, which answers with the list it
+ * is actually applying — the stored one plus whatever the environment set,
+ * which an administrator cannot remove from here.
+ *
+ * The switch follows the same rule. When the environment set it, it is refused
+ * rather than quietly stored: an administrator who flips a switch and sees
+ * nothing happen deserves to be told which variable is in the way, and a page
+ * that shows the switch locked will not send it in the first place.
+ *
+ * @param {string} key          the settings section
+ * @param {object} manager      the worker, for its exclusions
+ * @param {string} field        `enabled` or `mode`
+ * @param {(value: *) => *} valid  the value to store, or undefined to refuse it
+ * @param {(value: *) => Promise} apply  switch the worker to it
+ * @param {string} variable     the environment variable that would lock it
+ */
+const background = ({ key, manager, field, valid, apply, variable }) => ({
+  check: (section) => {
+    const update = {};
+    if (Array.isArray(section.excludedPaths)) update.excludedPaths = section.excludedPaths;
+
+    if (Object.prototype.hasOwnProperty.call(section, field)) {
+      if (featureSwitches.snapshot()[key].lockedBy) {
+        throw new ValidationError(
+          `${variable} is set in the environment, so this is decided there and not here.`
+        );
       }
-    } else if (payload.thumbnails || payload.access || payload.branding) {
-      // Non-admin trying to update system settings
+      const value = valid(section[field]);
+      if (value === undefined) throw new ValidationError(`${field} is not a value ${key} takes.`);
+      update[field] = value;
+    }
+
+    return Object.keys(update).length ? update : null;
+  },
+  write: async (update) => {
+    const saved = await mergeSection('system', key, update);
+    if (!saved) return false;
+    if (update.excludedPaths) await manager.setAdminExclusions(saved.excludedPaths);
+    if (Object.prototype.hasOwnProperty.call(update, field)) await apply(saved[field]);
+    return true;
+  },
+});
+
+const searchIndexSection = background({
+  key: 'searchIndex',
+  manager: searchIndexManager,
+  field: 'enabled',
+  valid: (value) => (typeof value === 'boolean' ? value : undefined),
+  apply: (value) => featureSwitches.setSearchIndex(value),
+  variable: 'SEARCH_INDEX',
+});
+
+const folderSizeSection = background({
+  key: 'folderSize',
+  manager: folderSizeManager,
+  field: 'mode',
+  valid: (value) => (featureSwitches.FOLDER_SIZE_MODES.includes(value) ? value : undefined),
+  apply: (value) => featureSwitches.setFolderSizeMode(value),
+  variable: 'FOLDER_SIZE_MODE',
+});
+
+/** Every section only an administrator may write, and what writes it. */
+const SYSTEM_SECTIONS = {
+  thumbnails: thumbnailsSection,
+  access: accessSection,
+  uploads: uploadsSection,
+  trash: trashSection,
+  versions: versionsSection,
+  activity: activitySection,
+  branding: brandingSection,
+  folderSize: folderSizeSection,
+  searchIndex: searchIndexSection,
+};
+
+router.patch(
+  '/settings',
+  asyncHandler(async (req, res) => {
+    const payload = req.body || {};
+    const user = req.user;
+    const isAdmin = user && Array.isArray(user.roles) && user.roles.includes('admin');
+
+    // Asked before anything is written, not after. The user section used to be
+    // applied first and the refusal raised afterwards, so a payload carrying
+    // both a preference and a system setting answered 403 with the preference
+    // already saved — a request reported as refused that had changed something.
+    const wantsSystemSettings = Object.keys(SYSTEM_SECTIONS).some((name) => payload[name]);
+    if (!isAdmin && wantsSystemSettings) {
       return res.status(403).json({ error: 'Admin access required for system settings.' });
     }
 
-    // Return updated settings
+    // Every section is checked before any of them is written. A save carrying
+    // a valid section and a refused one used to store the first and then answer
+    // 400: a request reported as refused that had changed something, and left
+    // the page showing settings the server had only half taken.
+    const toWrite = [];
+    if (isAdmin) {
+      for (const [name, section] of Object.entries(SYSTEM_SECTIONS)) {
+        const sent = payload[name];
+        if (!sent || typeof sent !== 'object') continue;
+        const update = section.check(sent);
+        if (update !== null) toWrite.push([name, section, update]);
+      }
+    }
+
+    if (payload.user && typeof payload.user === 'object' && user?.id) {
+      await applyUserPreferences(user, payload.user);
+    }
+
+    // What was stored, not what was sent: a section whose every field was
+    // refused writes nothing, and a log line saying otherwise would send
+    // somebody looking for a change that never happened.
+    const stored = [];
+    for (const [name, section, update] of toWrite) {
+      if (await section.write(update)) stored.push(name);
+    }
+    if (stored.length) {
+      // Which settings, not what they were set to: values belong in the
+      // settings, and some of them are somebody's business alone.
+      await activityLog.record({
+        action: 'admin.settings',
+        user,
+        detail: { sections: stored },
+        req,
+      });
+    }
+
+    // Read back rather than assembled from what was written: the stored value
+    // is sanitised on its way out, so what the caller applies to its own state
+    // is what a later request would read.
     const finalSettings = await getSettingsForUser(user);
     res.json(finalSettings);
   })
diff --git a/backend/src/routes/shares.js b/backend/src/routes/shares.js
index 69a44b5b7..f2ca4d5f1 100644
--- a/backend/src/routes/shares.js
+++ b/backend/src/routes/shares.js
@@ -1,11 +1,11 @@
 const express = require('express');
-const { parseByteRange } = require('../utils/httpRange');
 const fs = require('fs/promises');
 const fss = require('fs');
 const path = require('path');
 const archiver = require('archiver');
 const rateLimit = require('express-rate-limit');
 const asyncHandler = require('../utils/asyncHandler');
+const { sendTextFile } = require('../utils/textFileResponse');
 const {
   ValidationError,
   UnauthorizedError,
@@ -32,23 +32,25 @@ const {
 const { createGuestSession } = require('../services/guestSessionService');
 const { normalizeRelativePath, parsePathSpace } = require('../utils/pathUtils');
 const { pathExists } = require('../utils/fsUtils');
+const { parseByteRange } = require('../utils/httpRange');
 const { resolvePathWithAccess, sharePasswordApplies } = require('../services/accessManager');
 const { extensions, mimeTypes } = require('../config/index');
+const env = require('../config/env');
 const { getSettings, getUserSettings } = require('../services/settingsService');
 const { listDirectoryItems } = require('../services/directoryListingService');
 const { encodeContentDisposition } = require('./files/utils');
 const { collectArchiveEntries, appendEntries } = require('../services/archiveTree');
 const logger = require('../utils/logger');
-
-const activityLog = require('../services/activityLog');
-const versions = require('../services/versions/operations');
-const { sendTextFile } = require('../utils/textFileResponse');
-const { clientAddress } = require('../utils/clientAddress');
 const {
   readTextFileHead,
   encodeText,
   MAX_EDITOR_FILE_SIZE,
 } = require('../services/textEditorService');
+const versions = require('../services/versions/operations');
+const activityLog = require('../services/activityLog');
+const versionsService = require('../services/versions');
+const { rightsFrom: versionRights } = versionsService;
+const { clientAddress } = require('../utils/clientAddress');
 
 const router = express.Router();
 
@@ -82,9 +84,27 @@ const guestSessionCookieOptions = (req) => ({
   maxAge: 24 * 60 * 60 * 1000, // 24 hours
   sameSite: 'lax',
   secure: req.secure === true,
-  path: '/api', // Ensure cookie is sent for all /api/* requests
+  // Root path, not /api: thumbnails are served from /static, and an <img>
+  // cannot carry the X-Guest-Session header the API client uses. Scoping the
+  // cookie to /api left share visitors with broken thumbnails.
+  path: '/',
 });
 
+/**
+ * Set the guest session cookie, clearing the /api-scoped one first.
+ *
+ * An earlier build scoped this cookie to /api. Browsers keep both when the
+ * path differs, and RFC 6265 sends the longer path first, so on every /api
+ * request cookie-parser would read the stale value and shadow the session we
+ * just created — a dead end the visitor could not fix by retyping the
+ * password. Deleting it here reaches exactly the people affected, since every
+ * share visitor goes through one of these three endpoints.
+ */
+const setGuestSessionCookie = (req, res, sessionId) => {
+  res.clearCookie('guestSession', { path: '/api' });
+  res.cookie('guestSession', sessionId, guestSessionCookieOptions(req));
+};
+
 const buildPublicBaseUrl = (req) => {
   const { public: publicConfig } = require('../config/index');
   return publicConfig.origin || `${req.protocol}://${req.get('host')}`;
@@ -212,7 +232,7 @@ const buildDirectFilePath = (shareToken, innerPath = '', mode = 'auto') => {
   const query = normalizedMode === 'auto' ? '' : `?mode=${encodeURIComponent(normalizedMode)}`;
   const pathPart = encodedInnerPath
     ? `/api/share/${encodedToken}/file/${encodedInnerPath}`
-    : `/api/share/${encodedToken}/file`;
+    : `/api/share/${encodedToken}`;
   return `${pathPart}${query}`;
 };
 
@@ -310,8 +330,8 @@ const streamResolvedDirectoryZip = async ({
   });
 
   archive.pipe(res);
-  // What the share lets its visitor see, not everything below its folder: a
-  // personal root and the paths an access rule hides stay out.
+  // What the share lets its visitor see, not everything below its folder: the
+  // trash zone, a personal root and the paths an access rule hides stay out.
   const stats = await fs.stat(absolutePath);
   const { entries } = await collectArchiveEntries(context, [
     {
@@ -338,6 +358,13 @@ router.post(
     const {
       sourcePath,
       accessMode = 'readonly',
+      allowDelete = true,
+      allowCreateFolder = true,
+      allowCreateFile = true,
+      allowUpload = true,
+      allowDownload = true,
+      versionsVisible,
+      versionsDownload,
       sharingType = 'anyone',
       password,
       userIds,
@@ -409,6 +436,13 @@ router.post(
       sourcePath: sourcePathForDb,
       isDirectory,
       accessMode,
+      allowDelete,
+      allowCreateFolder,
+      allowCreateFile,
+      allowUpload,
+      allowDownload,
+      versionsVisible,
+      versionsDownload,
       sharingType,
       password,
       userIds: sharingType === 'users' ? userIds : [],
@@ -416,6 +450,11 @@ router.post(
       label,
     });
 
+    // Generate share URL using PUBLIC_URL if configured, otherwise use request host
+    const baseUrl = buildPublicBaseUrl(req);
+    const shareUrl = `${baseUrl}/share/${share.shareToken}`;
+    const directFileUrl = `${baseUrl}${buildDirectFilePath(share.shareToken)}`;
+
     await activityLog.record({
       action: 'share.create',
       user: req.user,
@@ -424,11 +463,6 @@ router.post(
       req,
     });
 
-    // Generate share URL using PUBLIC_URL if configured, otherwise use request host
-    const baseUrl = buildPublicBaseUrl(req);
-    const shareUrl = `${baseUrl}/share/${share.shareToken}`;
-    const directFileUrl = `${baseUrl}${buildDirectFilePath(share.shareToken)}`;
-
     res.status(201).json({
       ...share,
       shareUrl,
@@ -475,6 +509,16 @@ router.get(
 router.get(
   '/:id',
   asyncHandler(async (req, res) => {
+    // This router is mounted under both /api/shares (management) and
+    // /api/share (public links). The exact public token URL must be handled
+    // here before the management endpoint can interpret the token as a share
+    // ID. Named public routes have an additional path segment and do not match
+    // this route.
+    if (req.baseUrl === '/api/share') {
+      req.params.token = req.params.id;
+      return handleDirectFileRequest(req, res);
+    }
+
     if (!req.user || !req.user.id) {
       throw new UnauthorizedError('Authentication required');
     }
@@ -527,6 +571,18 @@ router.put(
       updates.accessMode = req.body.accessMode;
     }
 
+    for (const key of [
+      'allowDelete',
+      'allowCreateFolder',
+      'allowCreateFile',
+      'allowUpload',
+      'allowDownload',
+      'versionsVisible',
+      'versionsDownload',
+    ]) {
+      if (key in req.body) updates[key] = req.body[key];
+    }
+
     if ('sharingType' in req.body) {
       updates.sharingType = req.body.sharingType;
     }
@@ -607,16 +663,14 @@ router.get(
       throw new NotFoundError('Share not found');
     }
 
-    // Return limited public info
+    // Return limited public info. requiresPassword mirrors the backend rule
+    // rather than hasPassword alone, so the router does not send the owner to
+    // a password prompt the API would have let them skip.
     res.json({
       shareToken: share.shareToken,
       label: share.label,
       isDirectory: share.isDirectory,
       hasPassword: share.hasPassword,
-      // Whether this caller has to type it: its owner does not, and neither
-      // does anybody when authentication is off. The interface asks for the
-      // password on this, rather than on hasPassword, so the owner is not sent
-      // to a prompt the server would have let them skip.
       requiresPassword: sharePasswordApplies(share, req.user),
       sharingType: share.sharingType,
       expiresAt: share.expiresAt,
@@ -650,22 +704,23 @@ router.post(
       if (share.sharingType === 'anyone') {
         const session = await createGuestSession({
           shareId: share.id,
-          ipAddress: req.ip,
+          ipAddress: clientAddress(req),
           userAgent: req.get('user-agent'),
         });
+        await trackShareAccess(share.id, { ipAddress: clientAddress(req) });
 
         // Set guest session cookie
-        res.cookie('guestSession', session.id, guestSessionCookieOptions(req));
+        setGuestSessionCookie(req, res, session.id);
 
         res.json({
           success: true,
           guestSessionId: session.id,
         });
         return;
-      } else {
-        // User-specific share without password still requires auth
-        throw new UnauthorizedError('Authentication required');
       }
+
+      // User-specific share without password still requires auth
+      throw new UnauthorizedError('Authentication required');
     }
 
     // Verify password
@@ -679,12 +734,13 @@ router.post(
     if (share.sharingType === 'anyone') {
       const session = await createGuestSession({
         shareId: share.id,
-        ipAddress: req.ip,
+        ipAddress: clientAddress(req),
         userAgent: req.get('user-agent'),
       });
+      await trackShareAccess(share.id, { ipAddress: clientAddress(req) });
 
       // Set guest session cookie
-      res.cookie('guestSession', session.id, guestSessionCookieOptions(req));
+      setGuestSessionCookie(req, res, session.id);
 
       res.json({
         success: true,
@@ -716,9 +772,6 @@ router.get(
       throw new ForbiddenError('Share has expired');
     }
 
-    // Track access
-    await trackShareAccess(share.id, { ipAddress: req.ip });
-
     // Check if user has permission
     if (share.sharingType === 'users') {
       if (!req.user || !req.user.id) {
@@ -751,12 +804,15 @@ router.get(
         // looking made the branch below ask for the password a second time,
         // for a share it had just been given.
         if (req.guestSession && req.guestSession.shareId === share.id) {
+          await trackShareAccess(share.id, { ipAddress: clientAddress(req) });
+
           return res.json({
             share: {
               shareToken: share.shareToken,
               label: share.label,
               sourcePath: `share/${share.shareToken}`,
               accessMode: share.accessMode,
+              allowDownload: share.allowDownload !== false,
               isDirectory: share.isDirectory,
             },
             guestSessionId: req.guestSession.id,
@@ -767,12 +823,13 @@ router.get(
         if (!share.hasPassword) {
           const session = await createGuestSession({
             shareId: share.id,
-            ipAddress: req.ip,
+            ipAddress: clientAddress(req),
             userAgent: req.get('user-agent'),
           });
+          await trackShareAccess(share.id, { ipAddress: clientAddress(req) });
 
           // Set guest session cookie (overwrites any existing session)
-          res.cookie('guestSession', session.id, guestSessionCookieOptions(req));
+          setGuestSessionCookie(req, res, session.id);
 
           return res.json({
             share: {
@@ -780,14 +837,17 @@ router.get(
               label: share.label,
               sourcePath: `share/${share.shareToken}`,
               accessMode: share.accessMode,
+              allowDownload: share.allowDownload !== false,
               isDirectory: share.isDirectory,
             },
             guestSessionId: session.id,
           });
-        } else {
-          throw new UnauthorizedError('Password verification required');
         }
+
+        throw new UnauthorizedError('Password verification required');
       }
+
+      await trackShareAccess(share.id, { ipAddress: clientAddress(req) });
     }
 
     // Return share access info
@@ -797,6 +857,7 @@ router.get(
         label: share.label,
         sourcePath: `share/${share.shareToken}`,
         accessMode: share.accessMode,
+        allowDownload: share.allowDownload !== false,
         isDirectory: share.isDirectory,
         expiresAt: share.expiresAt,
       },
@@ -805,36 +866,6 @@ router.get(
   })
 );
 
-/**
- * A file that left through a link.
- *
- * The share's own counters answer "how many"; this answers "which file, when,
- * and from where" — the question somebody actually asks the day a link turns
- * out to have been handed around. The person on the other end has no account,
- * so the actor is the link itself.
- */
-const recordShareDownload = ({ share, resolved, req }) =>
-  activityLog.record({
-    action: 'share.download',
-    user: req.user,
-    actor: req.user?.username || share.label || `link ${share.shareToken?.slice(0, 8)}`,
-    target: resolved.relativePath || share.sourcePath,
-    detail: { share: share.label || null, token: share.shareToken?.slice(0, 8) || null },
-    req,
-  });
-
-/**
- * The file a share link points at, and what this caller may do with it.
- *
- * Everything a request through a link has to get past before the file is
- * touched: the link itself, who is following it, and what the location
- * underneath still allows. Written once because three routes ask it — the
- * direct file, and the two the editor uses — and each asks for something
- * slightly different, which is what the options are.
- *
- * @returns the target, or null when the caller was redirected to the share's
- *   own door and there is nothing more for the route to do.
- */
 const resolveSharedFileTarget = async (
   req,
   res,
@@ -918,15 +949,32 @@ const resolveSharedFileTarget = async (
   return { share, innerPath, accessInfo, resolved, stats, context };
 };
 
+/**
+ * A file that left through a link.
+ *
+ * The share's own counters answer "how many"; this answers "which file, when,
+ * and from where" — the question somebody actually asks the day a link turns
+ * out to have been handed around. The person on the other end has no account,
+ * so the actor is the link itself.
+ */
+const recordShareDownload = ({ share, resolved, req }) =>
+  activityLog.record({
+    action: 'share.download',
+    user: req.user,
+    actor: req.user?.username || share.label || `link ${share.shareToken?.slice(0, 8)}`,
+    target: resolved.relativePath || share.sourcePath,
+    detail: { share: share.label || null, token: share.shareToken?.slice(0, 8) || null },
+    req,
+  });
+
 const handleDirectFileRequest = async (req, res) => {
-  const mode = normalizeDirectFileMode(req.query?.mode);
   const target = await resolveSharedFileTarget(req, res, { requireDownload: true });
   if (!target) return;
 
   const { share, resolved, stats, context } = target;
   if (stats.isDirectory()) {
-    // A folder leaving as a zip is a download like any other.
-    await trackShareDownload(share.id, { ipAddress: req.ip });
+    // Directories are always delivered as a ZIP attachment.
+    await trackShareDownload(share.id, { ipAddress: clientAddress(req) });
     await recordShareDownload({ share, resolved, req });
     await streamResolvedDirectoryZip({
       absolutePath: resolved.absolutePath,
@@ -942,27 +990,37 @@ const handleDirectFileRequest = async (req, res) => {
     return;
   }
 
-  await trackShareDownload(share.id, { ipAddress: req.ip });
-  await recordShareDownload({ share, resolved, req });
-  await streamResolvedFile({ absolutePath: resolved.absolutePath, stats, mode, req, res });
+  // Count the hit the way the client receives the file: inline previews are
+  // accesses, attachment deliveries (explicit download mode or formats the
+  // browser cannot display) are downloads — same split as POST /api/download.
+  const mode = normalizeDirectFileMode(req.query?.mode);
+  const { disposition } = getDirectFilePresentation(path.basename(resolved.absolutePath), mode);
+  if (disposition === 'attachment') {
+    await trackShareDownload(share.id, { ipAddress: clientAddress(req) });
+    await recordShareDownload({ share, resolved, req });
+  } else {
+    await trackShareAccess(share.id, { ipAddress: clientAddress(req) });
+  }
+  await streamResolvedFile({
+    absolutePath: resolved.absolutePath,
+    stats,
+    mode,
+    req,
+    res,
+  });
 };
 
 /**
  * GET /api/share/:token/file/* - Open a shared file directly.
  *
- * This keeps the same share rules as the Web UI but streams the target file
- * itself, letting the browser preview supported formats or download others.
+ * The exact /api/share/:token alias is handled by the mounted router's
+ * management route above. It intentionally calls this same handler so token,
+ * expiry, password, guest-session and permission checks cannot drift apart.
+ * Keep /file routes for existing external integrations.
  */
 router.get('/:token/file', asyncHandler(handleDirectFileRequest));
 router.get('/:token/file/{*splat}', asyncHandler(handleDirectFileRequest));
 
-/**
- * GET /api/share/:token/editor/* — read a shared text file, to edit it.
- *
- * The same rules as the direct file, and the same answer the editor gets
- * inside the application: the text, what it is called, and what this visitor
- * may do with it.
- */
 const handleSharedEditorRequest = async (req, res) => {
   const target = await resolveSharedFileTarget(req, res, { allowSharedFileName: true });
   if (!target) return;
@@ -985,12 +1043,12 @@ const handleSharedEditorRequest = async (req, res) => {
   });
 };
 
+/**
+ * GET /api/share/:token/editor/* - Read a shared text file.
+ */
 router.get('/:token/editor', asyncHandler(handleSharedEditorRequest));
 router.get('/:token/editor/{*splat}', asyncHandler(handleSharedEditorRequest));
 
-/**
- * PUT /api/share/:token/editor/* — save it back, when the link allows writing.
- */
 const handleSharedEditorSaveRequest = async (req, res) => {
   const target = await resolveSharedFileTarget(req, res, {
     requireWrite: true,
@@ -1003,9 +1061,10 @@ const handleSharedEditorSaveRequest = async (req, res) => {
   if (typeof content !== 'string') {
     throw new ValidationError('Text editor content must be a string.');
   }
-  // The editor's own text validation before anything is written, so a writable
-  // share cannot be used to modify a directory, a binary or an oversized file.
-  // It also says what the file is written in, so the save keeps that.
+  // Reuse the editor's text validation before writing so a writable share
+  // cannot be used to modify directories, binaries, or oversized files. It also
+  // says what the file is written in, so the save keeps that. From the head of
+  // the file: this asked for the whole of it, decoded, to read three bytes.
   const { encoding } = await readTextFileHead(resolved.absolutePath);
   const payload = encodeText(content, encoding);
   if (payload.length > MAX_EDITOR_FILE_SIZE) {
@@ -1072,7 +1131,8 @@ router.get(
     // Determine thumbnail settings
     const settings = await getSettings();
     const userSettings = req.user?.id ? await getUserSettings(req.user.id) : {};
-    const thumbsEnabled = settings?.thumbnails?.enabled !== false;
+    const thumbsEnabled =
+      env.THUMBNAILS_ENABLED !== false && settings?.thumbnails?.enabled !== false;
     const includeHiddenFiles = userSettings?.showHiddenFiles === true;
 
     // Directory share or navigating inside a directory share
@@ -1083,24 +1143,51 @@ router.get(
         shareCache.set(resolved.shareInfo.shareToken, resolved.shareInfo);
       }
       const userVolumeCache = new Map();
+      const marks =
+        userSettings?.showVersionMarks === false
+          ? null
+          : await versionsService.marksForFolder(resolved.absolutePath).catch((error) => {
+              logger.warn(
+                { err: error, path: resolved.absolutePath },
+                'File versions were not counted for a shared listing'
+              );
+              return null;
+            });
+
       const items = await listDirectoryItems({
         absoluteDir: resolved.absolutePath,
         parentLogicalPath: resolved.relativePath,
         context,
         thumbsEnabled,
-        excludeDownloadArtifacts: false,
         includeHiddenFiles,
         access: settings?.access || null,
         shareCache,
         userVolumeCache,
-        itemExtras: () => ({
+        itemExtras: ({ name, stats, access }) => ({
           access: {
             canRead: true,
             canWrite: accessInfo.canWrite,
             canDelete: accessInfo.canDelete,
+            canCreateFolder: accessInfo.canCreateFolder,
+            canCreateFile: accessInfo.canCreateFile,
             canShare: false,
-            canDownload: true,
+            // Follows the share rather than being hard true: otherwise every
+            // row in a share with downloads withheld still shows the button,
+            // and clicking it is the only way to find out.
+            canDownload: accessInfo.canDownload,
           },
+          // The same mark the browser shows, under the same rule: a share
+          // says nothing about a file's history unless its owner turned
+          // histories on for it.
+          ...(marks && stats?.isFile() && marks.get(name) && versionRights(access).see
+            ? {
+                versions: {
+                  count: marks.get(name).versions,
+                  bytes: marks.get(name).bytes,
+                  newest: marks.get(name).newest,
+                },
+              }
+            : null),
         }),
       });
 
@@ -1111,8 +1198,11 @@ router.get(
           canWrite: accessInfo.canWrite,
           canUpload: accessInfo.canUpload,
           canDelete: accessInfo.canDelete,
+          canCreateFolder: accessInfo.canCreateFolder,
+          canCreateFile: accessInfo.canCreateFile,
           canShare: false,
           canDownload: accessInfo.canDownload,
+          canSeeVersions: versionRights(accessInfo).see,
         },
         current: {
           isDirectory: true,
@@ -1169,8 +1259,11 @@ router.get(
         canWrite: accessInfo.canWrite,
         canUpload: false,
         canDelete: accessInfo.canDelete,
+        canCreateFolder: false,
+        canCreateFile: false,
         canShare: false,
         canDownload: accessInfo.canDownload,
+        canSeeVersions: versionRights(accessInfo).see,
       },
       current: {
         isDirectory: false,
diff --git a/backend/src/routes/usage.js b/backend/src/routes/usage.js
index f7c5060e8..067320eaa 100644
--- a/backend/src/routes/usage.js
+++ b/backend/src/routes/usage.js
@@ -1,28 +1,41 @@
 const express = require('express');
-const { promisify } = require('util');
-const { exec } = require('child_process');
+const fs = require('fs/promises');
 const { normalizeRelativePath } = require('../utils/pathUtils');
 const { resolvePathWithAccess } = require('../services/accessManager');
 const logger = require('../utils/logger');
 const asyncHandler = require('../utils/asyncHandler');
-const execp = promisify(exec);
 const router = express.Router();
 
-// Fast directory size using du command
-const dirSize = async (root) => {
+const toSafeNumber = (value) => {
+  const numeric = typeof value === 'bigint' ? Number(value) : Number(value);
+  return Number.isFinite(numeric) && numeric > 0 ? numeric : 0;
+};
+
+const getFilesystemUsage = async (root) => {
   try {
-    // -sb: summarize in bytes, don't follow symlinks
-    // This is orders of magnitude faster than fs.stat() recursion
-    const { stdout } = await execp(`du -sb "${root}"`, {
-      maxBuffer: 1024 * 1024 * 10, // 10MB buffer for large outputs
-    });
+    const stats = await fs.statfs(root);
+    const blockSize = toSafeNumber(stats.bsize);
+    const total = toSafeNumber(stats.blocks) * blockSize;
+    const free = toSafeNumber(stats.bavail) * blockSize;
+    const used = Math.max(0, total - free);
+    const percentUsed = total > 0 ? Math.min(100, Math.max(0, (used / total) * 100)) : 0;
 
-    // Output format: "12345\t/path/to/dir"
-    const size = parseInt(stdout.split('\t')[0], 10);
-    return size || 0;
+    return {
+      size: used,
+      used,
+      free,
+      total,
+      percentUsed,
+    };
   } catch (err) {
-    logger.debug(err);
-    return 0;
+    logger.debug({ err, root }, 'Failed to read filesystem usage');
+    return {
+      size: 0,
+      used: 0,
+      free: 0,
+      total: 0,
+      percentUsed: 0,
+    };
   }
 };
 
@@ -36,31 +49,18 @@ router.get(
     const { accessInfo, resolved } = await resolvePathWithAccess(context, inputRel);
 
     if (!accessInfo || !accessInfo.canAccess || !accessInfo.canRead) {
-      // Treat denied access the same as du failing; zero usage
-      return res.json({ path: inputRel, size: 0, free: 0, total: 0 });
+      return res.json({
+        path: inputRel,
+        size: 0,
+        used: 0,
+        free: 0,
+        total: 0,
+        percentUsed: 0,
+      });
     }
 
     const { absolutePath: abs, relativePath: rel } = resolved;
-
-    // Run both commands in parallel for maximum speed
-    const [size, dfResult] = await Promise.all([
-      dirSize(abs),
-      execp(`df -Pk "${abs}"`).catch(() => ({ stdout: '' })),
-    ]);
-
-    let total = 0,
-      free = 0;
-
-    if (dfResult.stdout) {
-      const line = dfResult.stdout.trim().split('\n').pop();
-      const parts = line.trim().split(/\s+/);
-      const totalKb = parseInt(parts[1], 10) || 0;
-      const availKb = parseInt(parts[3], 10) || 0;
-      total = totalKb * 1024;
-      free = availKb * 1024;
-    }
-
-    res.json({ path: rel, size, free, total });
+    res.json({ path: rel, ...(await getFilesystemUsage(abs)) });
   })
 );
 
diff --git a/backend/src/routes/userVolumes.js b/backend/src/routes/userVolumes.js
index 6437f33fe..d8890a943 100644
--- a/backend/src/routes/userVolumes.js
+++ b/backend/src/routes/userVolumes.js
@@ -144,7 +144,7 @@ router.get(
     let targetPath;
     try {
       targetPath = path.resolve(requestedPath);
-    } catch (err) {
+    } catch (_) {
       throw new ValidationError('Invalid path');
     }
 
@@ -152,7 +152,7 @@ router.get(
     let stats;
     try {
       stats = await fs.stat(targetPath);
-    } catch (err) {
+    } catch (_) {
       throw new NotFoundError('Path not found');
     }
 
@@ -164,7 +164,7 @@ router.get(
     let entries;
     try {
       entries = await fs.readdir(targetPath, { withFileTypes: true });
-    } catch (err) {
+    } catch (_) {
       throw new ForbiddenError('Cannot read directory');
     }
 
diff --git a/backend/src/routes/users.js b/backend/src/routes/users.js
index 9413843e7..52381f0c3 100644
--- a/backend/src/routes/users.js
+++ b/backend/src/routes/users.js
@@ -8,17 +8,18 @@ const {
   setLocalPasswordAdmin,
   deleteUser,
   getById,
-  countAdmins,
   disableTwoFactor,
+  twoFactorStatus,
 } = require('../services/users');
-const activityLog = require('../services/activityLog');
-const { ensureAdmin } = require('../middleware/ensureAdmin');
-const { clearLock } = require('../services/users/lockout');
-const { deleteAllPasskeys } = require('../services/users/passkeys');
 const asyncHandler = require('../utils/asyncHandler');
-const logger = require('../utils/logger');
 const { searchLocalUsers } = require('../services/userSearchService');
 const { NotFoundError, ValidationError, UnauthorizedError } = require('../errors/AppError');
+const { ensureAdmin } = require('../middleware/ensureAdmin');
+const { clearLock, listActiveLocks } = require('../services/users/lockout');
+const { deleteAllPasskeys } = require('../services/users/passkeys');
+const activityLog = require('../services/activityLog');
+const logger = require('../utils/logger');
+const { startAuthenticatedSession } = require('../utils/authenticatedSession');
 
 const router = express.Router();
 
@@ -52,8 +53,19 @@ router.get(
   '/users',
   ensureAdmin,
   asyncHandler(async (req, res) => {
-    const users = await listUsers();
-    res.json({ users });
+    const [users, locks] = await Promise.all([listUsers(), listActiveLocks()]);
+    // Locks are keyed on the account (see localAuth), so the list can say which
+    // account is locked and until when — the first question an administrator
+    // has when somebody cannot sign in. Whether a second factor is on is the
+    // second one, and the answer to "I have lost my phone".
+    const withFactors = await Promise.all(
+      users.map(async (user) => ({
+        ...user,
+        lockedUntil: locks.get(user.id) || null,
+        twoFactorEnabled: (await twoFactorStatus(user.id)).enabled,
+      }))
+    );
+    res.json({ users: withFactors });
   })
 );
 
@@ -139,39 +151,16 @@ router.post(
   asyncHandler(async (req, res) => {
     const { id } = req.params || {};
     const { newPassword } = req.body || {};
-    await setLocalPasswordAdmin({ userId: id, newPassword });
-    await activityLog.record({
-      action: 'admin.user',
-      user: req.user,
-      target: id,
-      detail: { passwordReset: true },
-      req,
-    });
-    res.status(204).end();
-  })
-);
-
-// DELETE /api/users/:id/lock - release an account locked by failed sign-ins (admin only)
-router.delete(
-  '/users/:id/lock',
-  ensureAdmin,
-  asyncHandler(async (req, res) => {
-    const { id } = req.params || {};
-    const existing = await getById(id);
-    if (!existing) {
-      throw new NotFoundError('User not found.');
-    }
-    // The count as well as the deadline. Left on the books, the failures would
-    // let the next typo lock the account straight back.
-    await clearLock(id);
-    logger.info({ adminId: req.user?.id, userId: id }, 'Sign-in lock released by an administrator');
-    await activityLog.record({
-      action: 'admin.user',
-      user: req.user,
-      target: existing.username || existing.email || id,
-      detail: { lockReleased: true },
-      req,
+    // Every session of the account ends. An administrator resetting their own
+    // password here is changing it, and keeps the session they did it from — on
+    // a new id, as a change from their own settings does.
+    const ownSession = Boolean(req.session) && req.session.localUserId === id;
+    await setLocalPasswordAdmin({
+      userId: id,
+      newPassword,
+      keepSessionId: ownSession ? req.sessionID : null,
     });
+    if (ownSession) await startAuthenticatedSession(req, id);
     res.status(204).end();
   })
 );
@@ -190,20 +179,13 @@ router.delete(
   asyncHandler(async (req, res) => {
     const { id } = req.params || {};
     const user = await getById(id);
-    if (!user) throw new NotFoundError('User not found.');
+    if (!user) throw new NotFoundError('User not found');
 
     const removed = await disableTwoFactor(id);
     logger.warn(
       { userId: id, by: req.user?.id || null, removed },
       'An administrator turned two-factor authentication off for an account'
     );
-    await activityLog.record({
-      action: 'admin.user',
-      user: req.user,
-      target: user.username || user.email || id,
-      detail: { twoFactorRemoved: true },
-      req,
-    });
     res.status(204).end();
   })
 );
@@ -223,7 +205,7 @@ router.delete(
   asyncHandler(async (req, res) => {
     const { id } = req.params || {};
     const user = await getById(id);
-    if (!user) throw new NotFoundError('User not found.');
+    if (!user) throw new NotFoundError('User not found');
 
     const removed = await deleteAllPasskeys(id);
     logger.warn(
@@ -241,6 +223,24 @@ router.delete(
   })
 );
 
+// DELETE /api/users/:id/lock - release an account locked by failed sign-ins (admin only)
+router.delete(
+  '/users/:id/lock',
+  ensureAdmin,
+  asyncHandler(async (req, res) => {
+    const { id } = req.params || {};
+    const existing = await getById(id);
+    if (!existing) {
+      throw new NotFoundError('User not found.');
+    }
+    // The count as well as the deadline. Left on the books, the failures would
+    // let the next typo lock the account straight back.
+    await clearLock(id);
+    logger.info({ adminId: req.user?.id, userId: id }, 'Sign-in lock released by an administrator');
+    res.status(204).end();
+  })
+);
+
 // DELETE /api/users/:id - remove a user (admin only)
 router.delete(
   '/users/:id',
@@ -251,18 +251,16 @@ router.delete(
     if (req.user?.id === id) {
       throw new ValidationError('You cannot delete your own account.');
     }
-    // Prevent removing last admin explicitly
     const existing = await getById(id);
     if (!existing) {
       throw new NotFoundError('User not found.');
     }
-    if (Array.isArray(existing.roles) && existing.roles.includes('admin')) {
-      const admins = await countAdmins();
-      if (admins <= 1) {
-        throw new ValidationError('Cannot remove the last admin.');
-      }
-    }
+    // The last administrator is protected by the service, so every caller of
+    // deleteUser gets the rule and not only this route. A second copy here
+    // read as the enforcement and was not: removing it changed nothing.
     await deleteUser({ userId: id });
+    // Written after the deletion, and it outlives it: the row names the
+    // account as text, and nothing cascades this log away.
     await activityLog.record({
       action: 'admin.user',
       user: req.user,
diff --git a/backend/src/routes/zip.js b/backend/src/routes/zip.js
index 7e09a4bfc..81ef7b9b7 100644
--- a/backend/src/routes/zip.js
+++ b/backend/src/routes/zip.js
@@ -29,6 +29,7 @@ const {
   archiveBaseName,
   normalizeArchivePassword,
 } = require('../services/archiveService');
+const folderSizeHooks = require('../services/folderSizeHooks');
 const {
   ensureArchiveWithinLimits,
   buildItemMetadata,
@@ -208,6 +209,7 @@ router.post(
         );
         // The archive has produced an entire new tree. Queue its index refresh,
         // but never hold the archive operation open on background filesystem I/O.
+        folderSizeHooks.onDirectoryTreeCreated(placed.path);
 
         const item = await buildItemMetadata(placed.path, parentRelativePath, placed.name);
         writeEvent({ type: 'done', success: true, item, items: [item] });
@@ -410,6 +412,8 @@ router.post(
         destinationAbsolutePath,
         requestedName
       );
+      const zipStats = await fs.stat(placed.path);
+      await folderSizeHooks.onFileWritten(placed.path, zipStats.size);
 
       const item = await buildItemMetadata(placed.path, normalizedDestination, placed.name);
       writeEvent({ type: 'done', success: true, item });
diff --git a/backend/src/server.js b/backend/src/server.js
index 4aa8dc520..db5bbaf44 100644
--- a/backend/src/server.js
+++ b/backend/src/server.js
@@ -22,6 +22,8 @@ const capabilities = require('./services/capabilities');
 const { installProcessFailureHandlers } = require('./utils/processFailures');
 const { sweepUnreferencedLogos } = require('./services/brandingLogo');
 const featureSwitches = require('./services/featureSwitches');
+const { reportLegacyCache } = require('./services/legacyCacheCheck');
+const performanceDiagnostics = require('./services/performanceDiagnostics');
 
 let server = null;
 
@@ -114,6 +116,16 @@ const startServer = async () => {
   expirySweep.unref?.();
   void sweepExpiredRecords();
 
+  // What early releases left in the cache directory: the database and app-config.json
+  // lived there up to 1.1.7, and an installation that skipped the releases in between
+  // comes up on a new, empty app.db with its accounts and shares sitting unread.
+  reportLegacyCache();
+
+  // A periodic record of what the process is costing — CPU, resident memory, event-loop
+  // delay, and the queues that can grow. Off unless PERFORMANCE_DIAGNOSTICS_ENABLED is
+  // set, and then it says only the intervals that look wrong.
+  performanceDiagnostics.start();
+
   // A logo left behind by a stop in the middle of a branding change, or by a
   // removal that failed, is 2 MB nothing can reach. Here, where nothing is being
   // placed, so a file under one of our names is a finished one.
@@ -130,6 +142,7 @@ const startServer = async () => {
     folderSizeManager.stop();
     trashMaintenance.stop();
     searchIndexManager.stop();
+    performanceDiagnostics.stop();
     server.close(() => {
       logger.info('Server closed');
       process.exit(0);
diff --git a/backend/src/services/accessControlService.js b/backend/src/services/accessControlService.js
index 12a51d96a..a2206f1aa 100644
--- a/backend/src/services/accessControlService.js
+++ b/backend/src/services/accessControlService.js
@@ -2,18 +2,22 @@ const fs = require('fs/promises');
 const path = require('path');
 
 const { directories } = require('../config/index');
-const { isInsidePersonalRoot, normalizeRelativePath } = require('../utils/pathUtils');
-const { getSettings, setSettings } = require('../services/settingsService');
+const { normalizeRelativePath, isInsidePersonalRoot } = require('../utils/pathUtils');
 const { ruleAppliesToAdmins } = require('../utils/accessRules');
+const { getSettings, setSettings } = require('../services/settingsService');
 
 /**
- * Whether this rule binds the caller.
+ * Whether a rule is one of the rules this caller is held to.
  *
- * An administrator used to sit outside read-only rules and inside hidden ones,
+ * An administrator used to be outside read-only rules and inside hidden ones,
  * which is neither and was written nowhere: a read-only rule left the Create
- * button on a folder for them and they wrote into it, while a hidden rule took
- * a folder away from the one account meant to manage it, with no way to say
- * otherwise. It is one switch now, the same whatever the rule grants.
+ * button there for them (nxzai/NextExplorer#407), while a hidden rule took the
+ * folder away from the one account meant to manage it. Each rule now says it,
+ * with one switch whatever it grants, and the setting above it applies them all
+ * to administrators at once.
+ *
+ * A rule an administrator is not held to is not a rule that lets them through:
+ * it is skipped, so a later rule still has its say.
  */
 const heldTo = (rule, { isAdmin, applyToAdmins }) => {
   if (!isAdmin) return true;
@@ -22,12 +26,12 @@ const heldTo = (rule, { isAdmin, applyToAdmins }) => {
 };
 
 /**
- * The rules, as a question that can be asked many times without reading them
- * again.
+ * Resolve a path against the access rules, for one caller.
  *
- * @param {{rules?: Array<object>, applyToAdmins?: boolean}} access the access
- *   section, rules and the setting above them together — not the rules alone,
- *   because whom a rule holds is decided by both.
+ * @param {{rules?: Array<object>, applyToAdmins?: boolean}} access the rules in
+ *   force and whether every one of them also holds administrators. An object
+ *   rather than the bare list, so a caller cannot pass the rules and quietly
+ *   lose the setting that decides who they bind.
  * @returns {(relativePath: string, who?: {isAdmin?: boolean}) => 'rw'|'ro'|'hidden'}
  */
 const createPermissionResolver = (access = {}) => {
@@ -42,19 +46,12 @@ const createPermissionResolver = (access = {}) => {
     for (const rule of normalizedRules) {
       const rulePath = normalizeRelativePath(rule.path || '');
       if (!rulePath) continue;
-      // A rule that does not hold this caller does not stand in the way of a
-      // later one either: it is passed over, not matched and waived.
       if (!heldTo(rule, { isAdmin, applyToAdmins })) continue;
 
-      if (rule.recursive) {
-        if (rel === rulePath || rel.startsWith(rulePath + '/')) {
-          return rule.permissions || 'rw';
-        }
-      } else {
-        if (rel === rulePath) {
-          return rule.permissions || 'rw';
-        }
-      }
+      const matches = rule.recursive
+        ? rel === rulePath || rel.startsWith(`${rulePath}/`)
+        : rel === rulePath;
+      if (matches) return rule.permissions || 'rw';
     }
 
     return 'rw';
@@ -62,7 +59,7 @@ const createPermissionResolver = (access = {}) => {
 };
 
 // Determine permission for a given relative path: 'rw' | 'ro' | 'hidden'
-const getPermissionForPath = async (relativePath, who) => {
+const getPermissionForPath = async (relativePath, who = {}) => {
   const settings = await getSettings();
   return createPermissionResolver(settings?.access)(relativePath, who);
 };
diff --git a/backend/src/services/accessManager.js b/backend/src/services/accessManager.js
index ce8096df1..6389ef691 100644
--- a/backend/src/services/accessManager.js
+++ b/backend/src/services/accessManager.js
@@ -18,18 +18,19 @@ const { auth, features, directories } = require('../config/index');
  * everyone is the same synthetic admin who already browses the whole
  * filesystem, so the prompt would only lock the share without protecting it.
  *
- * Everyone else is subject to it, and that includes a signed-in account: being
- * authenticated is not knowing the password. The check used to be "is there a
- * user or a guest session", so any account on the instance opening a protected
- * link walked straight past the prompt its owner set up.
+ * Everyone else is subject to it, and that includes a visitor with no account
+ * at all — the very people a public password is for. This used to require a
+ * user, so the predicate answered "no password here" for anonymous callers and
+ * each caller made up the difference on its own: one added `|| (hasPassword &&
+ * !user)` to what it reported, another let the case fall through to a later
+ * branch that happened to refuse. The protection was real and lived in two
+ * places under a name that promised one.
  */
 const sharePasswordApplies = (share, user) =>
   Boolean(share.hasPassword) &&
   auth.enabled !== false &&
   !(user && String(user.id) === String(share.ownerId));
 
-const PERSONAL_SIDEWAYS = 'Personal folders are reached through the personal space';
-
 /**
  * Get comprehensive access information for a path
  * @param {Object} context - { user, guestSession, shareToken }
@@ -91,7 +92,7 @@ const getVolumeAccess = async (context, relativePath, options = {}) => {
     // The same rule as below, from the folder this account was assigned.
     const innerPath = relativePath.split('/').filter(Boolean).slice(1).join('/');
     if (reachesIntoPersonalRoot(userVolume.path, path.resolve(userVolume.path, innerPath))) {
-      return createDeniedAccess(PERSONAL_SIDEWAYS);
+      return createDeniedAccess('Personal folders are reached through the personal space');
     }
 
     // Use the volume's access mode
@@ -112,6 +113,7 @@ const getVolumeAccess = async (context, relativePath, options = {}) => {
       canDelete: !effectiveReadOnly,
       canUpload: !effectiveReadOnly,
       canCreateFolder: !effectiveReadOnly,
+      canCreateFile: !effectiveReadOnly,
       canShare: true,
       canDownload: true,
       isShared: false,
@@ -127,23 +129,22 @@ const getVolumeAccess = async (context, relativePath, options = {}) => {
   // Somebody's personal folder is not part of the volume, even where it sits
   // inside it — `<volume>/_users` by default. Resolving such a path already
   // refuses; this is the same answer for a caller who asks about a path it
-  // never resolves. The search is one: ripgrep and the index read the whole
-  // volume and ask only this whether each path may be shown, so an ordinary
-  // account searching the volume was offered another account's private
-  // files, by name and by the line that matched.
+  // never resolves. The search is one: it takes paths from the index, which
+  // reads the whole volume, and asks only this whether each may be shown. An
+  // ordinary account searching the volume was offered another account's
+  // private files, by name and by what they said.
   if (
     reachesIntoPersonalRoot(
       directories.volume,
       path.resolve(directories.volume, relativePath || '')
     )
   ) {
-    return createDeniedAccess(PERSONAL_SIDEWAYS);
+    return createDeniedAccess('Personal folders are reached through the personal space');
   }
 
   // Check access control rules. A rule that does not hold administrators was
   // already passed over while resolving, so what comes back is what binds this
-  // caller — and an administrator is no longer excused from it a second time
-  // here, which is how a read-only rule left them the Create button.
+  // caller: an administrator is no longer excused from it here.
   const permission = await getPerm(relativePath, { isAdmin });
   if (permission === 'hidden') {
     return createDeniedAccess('Path is hidden');
@@ -158,6 +159,7 @@ const getVolumeAccess = async (context, relativePath, options = {}) => {
     canDelete: !isReadOnly,
     canUpload: !isReadOnly,
     canCreateFolder: !isReadOnly,
+    canCreateFile: !isReadOnly,
     canShare: true,
     canDownload: true,
     isShared: false,
@@ -192,6 +194,7 @@ const getPersonalAccess = async (context, relativePath) => {
     canDelete: true,
     canUpload: true,
     canCreateFolder: true,
+    canCreateFile: true,
     canShare: true,
     canDownload: true,
     isShared: false,
@@ -202,163 +205,146 @@ const getPersonalAccess = async (context, relativePath) => {
 };
 
 /**
- * Get access info for share paths
+ * Whether the share itself may be opened, before anyone is considered.
+ *
+ * @returns {object|null} a denial, or null when the share is usable
  */
-const getShareAccess = async (context, shareToken, innerPath, options = {}) => {
-  const { user, guestSession } = context;
-  const permissionResolver =
-    typeof options.permissionResolver === 'function' ? options.permissionResolver : null;
-  // What a share opens is bound by the rules whoever follows the link is: the
-  // link is the lens, not the account behind it, so no rule is waived here for
-  // an administrator.
-  const getPerm = async (p) =>
-    permissionResolver
-      ? permissionResolver(p, { isAdmin: false })
-      : await getPermissionForPath(p, { isAdmin: false });
-  const shareCache = options && options.shareCache instanceof Map ? options.shareCache : null;
-  const userVolumeCache =
-    options && options.userVolumeCache instanceof Map ? options.userVolumeCache : null;
-
-  if (!shareToken) {
-    return createDeniedAccess('Share token is required');
-  }
-
-  // Validate share exists
-  let share = shareCache ? shareCache.get(shareToken) : null;
-  if (!share) {
-    share = await getShareByToken(shareToken);
-    if (shareCache && share) shareCache.set(shareToken, share);
-  }
-  if (!share) {
-    return createDeniedAccess('Share not found');
-  }
-
-  // Check expiration
-  if (isShareExpired(share)) {
-    return createDeniedAccess('Share has expired');
-  }
+const shareIsUnusable = (share) => {
+  if (!share) return createDeniedAccess('Share not found');
+  if (isShareExpired(share)) return createDeniedAccess('Share has expired');
+  return null;
+};
 
-  // Check sharing type and permissions
+/**
+ * Whether this caller may open it.
+ *
+ * The two sharing types ask different questions — one wants an account on the
+ * list, the other wants a session that came through the door — and anything
+ * else fails closed rather than falling through to the grant below.
+ *
+ * @returns {Promise<object|null>} a denial, or null when the caller may open it
+ */
+const callerMayNotOpen = async (share, { user, guestSession }) => {
   if (share.sharingType === 'users') {
-    // User-specific share requires authentication
-    if (!user || !user.id) {
-      return createDeniedAccess('Authentication required');
-    }
-
-    // Check if user has permission
+    if (!user || !user.id) return createDeniedAccess('Authentication required');
     const permitted = await hasUserPermission(share.id, user.id);
-    if (!permitted) {
-      return createDeniedAccess('Access denied');
-    }
-  } else if (share.sharingType === 'anyone') {
-    // Anyone shares require either user auth OR guest session
-    if (!user && !guestSession) {
-      // Password verification happens during share access/login
-      // If neither user nor guest session exists, they need to go through verification
-      return createDeniedAccess('Share access required');
-    }
+    return permitted ? null : createDeniedAccess('Access denied');
+  }
+
+  if (share.sharingType === 'anyone') {
+    // Password verification happens during share access; a caller with neither
+    // an account nor a guest session has been through neither.
+    if (!user && !guestSession) return createDeniedAccess('Share access required');
 
-    // If guest session exists, verify it belongs to this share
     if (guestSession && !user && guestSession.shareId !== share.id) {
       return createDeniedAccess('Invalid guest session for this share');
     }
 
-    // A guest session for this share is the proof the password was typed.
+    // Being signed in is not the same as knowing the password. Without this,
+    // any authenticated user opening a protected link skipped the prompt the
+    // owner set it up for.
     if (sharePasswordApplies(share, user)) {
       const verified = guestSession && guestSession.shareId === share.id;
       if (!verified) return createDeniedAccess('Password verification required');
     }
-  } else {
-    // Neither of the two types this knows: fail closed rather than fall
-    // through to the grant below.
-    return createDeniedAccess('Unknown sharing type');
+    return null;
   }
 
-  const isOwner = user && user.id === share.ownerId;
-  const shareReadWrite = share.accessMode === 'readwrite';
+  // Fail closed: a sharing type we do not know about must not fall through to
+  // the permission grant.
+  return createDeniedAccess('Unknown sharing type');
+};
 
-  // Cap share write permissions by the underlying source permission.
-  // This allows admin changes (hide/ro/user-volume readonly) to take effect immediately.
+/**
+ * What the location underneath still allows, which caps what the share grants.
+ *
+ * An administrator hiding a folder, marking it read-only or reassigning a
+ * personal volume takes effect on every existing link immediately, because the
+ * answer is read here on every request rather than frozen when the link was
+ * made.
+ *
+ * @returns {Promise<{denial: object}|{readOnly: boolean}>}
+ */
+const readSourceLimits = async (share, innerPath, { getPerm, userVolumeCache }) => {
   const isDirShare = Boolean(share.isDirectory);
   const safeInnerPath = typeof innerPath === 'string' ? innerPath : '';
-  let underlyingPermission = 'rw';
-  let underlyingReadOnly = false;
+  const under = (base) =>
+    isDirShare && safeInnerPath ? combineRelativePath(base, safeInnerPath) : base;
+
+  // Somebody's personal folder is not handed out by a share of a folder that
+  // holds it, any more than by the volume itself.
+  const personalRootDenial = (root, inner) =>
+    reachesIntoPersonalRoot(root, path.resolve(root, inner || ''))
+      ? { denial: createDeniedAccess('Personal folders are reached through the personal space') }
+      : null;
 
   if (share.sourceSpace === 'volume') {
-    const combined =
-      isDirShare && safeInnerPath
-        ? combineRelativePath(share.sourcePath, safeInnerPath)
-        : share.sourcePath;
-    // Somebody's personal folder is not handed out by a share of a folder that
-    // holds it, any more than by the volume itself.
-    if (
-      reachesIntoPersonalRoot(directories.volume, path.resolve(directories.volume, combined || ''))
-    ) {
-      return createDeniedAccess(PERSONAL_SIDEWAYS);
-    }
-    underlyingPermission = await getPerm(combined);
-    if (underlyingPermission === 'hidden') {
-      return createDeniedAccess('Path is hidden');
-    }
-    underlyingReadOnly = underlyingPermission === 'ro';
-  } else if (share.sourceSpace === 'user_volume') {
+    const refused = personalRootDenial(directories.volume, under(share.sourcePath));
+    if (refused) return refused;
+    // What a share opens is bound by the rules whoever follows the link is:
+    // the link is the lens, not the account behind it, so no rule is waived
+    // here for an administrator.
+    const permission = await getPerm(under(share.sourcePath), { isAdmin: false });
+    if (permission === 'hidden') return { denial: createDeniedAccess('Path is hidden') };
+    return { readOnly: permission === 'ro' };
+  }
+
+  if (share.sourceSpace === 'user_volume') {
     const [volumeId, ...rest] = String(share.sourcePath || '')
       .split('/')
       .filter(Boolean);
-    if (!volumeId) {
-      return createDeniedAccess('Share source volume is invalid');
-    }
+    if (!volumeId) return { denial: createDeniedAccess('Share source volume is invalid') };
+
     let userVolume = userVolumeCache ? userVolumeCache.get(volumeId) : null;
     if (!userVolume) {
       userVolume = await getVolumeById(volumeId);
       if (userVolumeCache && userVolume) userVolumeCache.set(volumeId, userVolume);
     }
-    if (!userVolume) {
-      return createDeniedAccess('Share source volume not found');
-    }
+    if (!userVolume) return { denial: createDeniedAccess('Share source volume not found') };
+
+    // A share may only hand out a volume its own owner holds: without this, an
+    // account that once had one assigned could go on sharing it afterwards.
     if (String(userVolume.userId) !== String(share.ownerId)) {
-      return createDeniedAccess('Share source volume mismatch');
+      return { denial: createDeniedAccess('Share source volume mismatch') };
     }
 
-    const baseWithinVolume = rest.join('/');
-    const combinedWithinVolume =
-      isDirShare && safeInnerPath
-        ? combineRelativePath(baseWithinVolume, safeInnerPath)
-        : baseWithinVolume;
-    if (
-      reachesIntoPersonalRoot(
-        userVolume.path,
-        path.resolve(userVolume.path, combinedWithinVolume || '')
-      )
-    ) {
-      return createDeniedAccess(PERSONAL_SIDEWAYS);
-    }
-    const logicalForRules = `${userVolume.label}${combinedWithinVolume ? `/${combinedWithinVolume}` : ''}`;
-    underlyingPermission = await getPerm(logicalForRules);
-    if (underlyingPermission === 'hidden') {
-      return createDeniedAccess('Path is hidden');
-    }
-    underlyingReadOnly = userVolume.accessMode === 'readonly' || underlyingPermission === 'ro';
+    const refused = personalRootDenial(userVolume.path, under(rest.join('/')));
+    if (refused) return refused;
+
+    const logicalForRules = `${userVolume.label}${under(rest.join('/')) ? `/${under(rest.join('/'))}` : ''}`;
+    const permission = await getPerm(logicalForRules, { isAdmin: false });
+    if (permission === 'hidden') return { denial: createDeniedAccess('Path is hidden') };
+    return { readOnly: userVolume.accessMode === 'readonly' || permission === 'ro' };
   }
 
-  const isReadWrite = shareReadWrite && !underlyingReadOnly;
+  return { readOnly: false };
+};
+
+/** What the share hands out, once the location underneath has had its say. */
+const grantFor = (share, { user, readOnly }) => {
+  const isReadWrite = share.accessMode === 'readwrite' && !readOnly;
 
   return {
     canAccess: true,
     canRead: true,
     canWrite: isReadWrite,
-    canDelete: isReadWrite,
-    canUpload: isReadWrite,
-    canCreateFolder: isReadWrite,
+    canDelete: isReadWrite && share.allowDelete !== false,
+    canUpload: isReadWrite && share.allowUpload !== false,
+    canCreateFolder: isReadWrite && share.allowCreateFolder !== false,
+    canCreateFile: isReadWrite && share.allowCreateFile !== false,
     canShare: false, // Cannot create shares within shares
-    canDownload: true,
+    // Deliberately not gated on `isReadWrite` like the others above it: a
+    // read-only share is exactly where withholding downloads means something —
+    // "read this" rather than "take a copy of this". Defaults to allowed, so
+    // every share made before this existed behaves as it always did.
+    canDownload: share.allowDownload !== false,
     isShared: true,
     shareInfo: {
       shareId: share.id,
       shareToken: share.shareToken,
       accessMode: isReadWrite ? 'readwrite' : 'readonly',
       expiresAt: share.expiresAt,
-      isOwner,
+      isOwner: Boolean(user && user.id === share.ownerId),
       label: share.label,
     },
     share, // Include full share object for path resolution (avoids duplicate DB query)
@@ -367,6 +353,60 @@ const getShareAccess = async (context, shareToken, innerPath, options = {}) => {
   };
 };
 
+/**
+ * What a caller may do with a path inside a share.
+ *
+ * Three questions in order, each answerable on its own: may this share be
+ * opened at all, may this caller open it, and what does the location underneath
+ * still allow. Only then is a grant composed. It was one function of fifty-three
+ * paths, which is fifty-three tests to know it — and the reason it is worth
+ * splitting is that it decides what a link hands out.
+ */
+/**
+ * The optional machinery a caller may hand in: a permission resolver, and two
+ * caches for a route that is asking about many paths at once. Normalised here
+ * so the decision below reads as the sequence of questions it is.
+ */
+const readOptions = (options = {}) => {
+  const permissionResolver =
+    typeof options.permissionResolver === 'function' ? options.permissionResolver : null;
+
+  return {
+    getPerm: async (p, who) =>
+      permissionResolver ? permissionResolver(p, who) : getPermissionForPath(p, who),
+    shareCache: options.shareCache instanceof Map ? options.shareCache : null,
+    userVolumeCache: options.userVolumeCache instanceof Map ? options.userVolumeCache : null,
+  };
+};
+
+/** The share this token names, from the caller's cache when it has one. */
+const loadShare = async (shareToken, shareCache) => {
+  const cached = shareCache ? shareCache.get(shareToken) : null;
+  if (cached) return cached;
+
+  const share = await getShareByToken(shareToken);
+  if (shareCache && share) shareCache.set(shareToken, share);
+  return share;
+};
+
+const getShareAccess = async (context, shareToken, innerPath, options = {}) => {
+  if (!shareToken) return createDeniedAccess('Share token is required');
+
+  const { getPerm, shareCache, userVolumeCache } = readOptions(options);
+  const share = await loadShare(shareToken, shareCache);
+
+  const unusable = shareIsUnusable(share);
+  if (unusable) return unusable;
+
+  const refused = await callerMayNotOpen(share, context);
+  if (refused) return refused;
+
+  const limits = await readSourceLimits(share, innerPath, { getPerm, userVolumeCache });
+  if (limits.denial) return limits.denial;
+
+  return grantFor(share, { user: context.user, readOnly: limits.readOnly });
+};
+
 /**
  * Helper to create a denied access object
  */
@@ -378,6 +418,7 @@ const createDeniedAccess = (reason) => {
     canDelete: false,
     canUpload: false,
     canCreateFolder: false,
+    canCreateFile: false,
     canShare: false,
     canDownload: false,
     isShared: false,
@@ -432,42 +473,12 @@ const resolvePathWithAccess = async (context, relativePath, options = {}) => {
   return { accessInfo, resolved };
 };
 
-/**
- * Check if user can create shares (only authenticated users, not guests)
- */
-const canCreateShare = (context) => {
-  const { user, guestSession } = context;
-
-  // Guests cannot create shares
-  if (guestSession) {
-    return false;
-  }
-
-  // Must be authenticated
-  return Boolean(user && user.id);
-};
-
-/**
- * Get context from request object
- */
-const getContextFromRequest = (req) => {
-  return {
-    user: req.user || null,
-    guestSession: req.guestSession || null,
-    shareToken: req.shareToken || null,
-  };
-};
-
 module.exports = {
   getAccessInfo,
-  getVolumeAccess,
   getPersonalAccess,
-  sharePasswordApplies,
   getShareAccess,
   canAccess,
   canWrite,
-  canCreateShare,
-  getContextFromRequest,
-  createDeniedAccess,
+  sharePasswordApplies,
   resolvePathWithAccess,
 };
diff --git a/backend/src/services/archiveExtraction.js b/backend/src/services/archiveExtraction.js
index d2bcbd3c9..0728003ec 100644
--- a/backend/src/services/archiveExtraction.js
+++ b/backend/src/services/archiveExtraction.js
@@ -6,6 +6,7 @@ const { placeWithoutOverwrite } = require('../utils/placeWithoutOverwrite');
 const { takeInventory } = require('../utils/ownedTree');
 const { ValidationError } = require('../errors/AppError');
 const { archives } = require('../config/index');
+const folderSizeHooks = require('./folderSizeHooks');
 
 /**
  * What is shared between extracting a whole archive and extracting part of one.
@@ -79,6 +80,13 @@ const extractIntoCurrentFolder = async ({
     );
     movedPaths.push({ path: destinationPath, inventory });
 
+    if (entry.isDirectory()) {
+      folderSizeHooks.onDirectoryTreeCreated(destinationPath);
+    } else {
+      const stats = await fs.stat(destinationPath);
+      folderSizeHooks.onFileWritten(destinationPath, stats.size);
+    }
+
     items.push(await buildItemMetadata(destinationPath, relativeParentPath, destinationName));
   }
 
diff --git a/backend/src/services/archiveTree.js b/backend/src/services/archiveTree.js
index d60071e30..07dd8db83 100644
--- a/backend/src/services/archiveTree.js
+++ b/backend/src/services/archiveTree.js
@@ -30,7 +30,7 @@ const { getSettings } = require('./settingsService');
  */
 const readAccess = async () => {
   const settings = await getSettings();
-  return settings?.access || null;
+  return settings?.access && typeof settings.access === 'object' ? settings.access : { rules: [] };
 };
 
 /**
@@ -42,8 +42,9 @@ const readAccess = async () => {
  */
 const collectArchiveEntries = async (context, sources) => {
   const access = await readAccess();
+  const rules = Array.isArray(access.rules) ? access.rules : [];
   const accessOptions = {
-    permissionResolver: access?.rules?.length ? createPermissionResolver(access) : undefined,
+    permissionResolver: rules.length ? createPermissionResolver(access) : undefined,
     shareCache: new Map(),
     userVolumeCache: new Map(),
   };
@@ -56,7 +57,7 @@ const collectArchiveEntries = async (context, sources) => {
     if (guardPersonalRoot && isInsidePersonalRoot(absolutePath)) return false;
     // With no rules, nothing below a readable folder is less readable than it:
     // every other decision was made once, for the source.
-    if (!access?.rules?.length) return true;
+    if (!rules.length) return true;
     const info = await getAccessInfo(context, logicalPath, accessOptions);
     return Boolean(info?.canAccess && info.canRead);
   };
diff --git a/backend/src/services/authorizationService.js b/backend/src/services/authorizationService.js
index a940b9e1b..dd11ac436 100644
--- a/backend/src/services/authorizationService.js
+++ b/backend/src/services/authorizationService.js
@@ -26,10 +26,8 @@ const actionToFlag = (action) => {
       return 'canUpload';
     case ACTIONS.createFolder:
       return 'canCreateFolder';
-    // Upstream expresses "may put a file here" as canUpload; a trash restore of
-    // a file asks for exactly that.
     case ACTIONS.createFile:
-      return 'canUpload';
+      return 'canCreateFile';
     case ACTIONS.rename:
       return 'canWrite';
     case ACTIONS.download:
diff --git a/backend/src/services/db.js b/backend/src/services/db.js
index 09b8189cd..228153f39 100644
--- a/backend/src/services/db.js
+++ b/backend/src/services/db.js
@@ -207,6 +207,9 @@ const ACTIVITY_DDL = `
   CREATE INDEX IF NOT EXISTS idx_activity_user ON activity_events(user_id, at DESC);
 `;
 
+const tableExists = (db, name) =>
+  Boolean(db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(name));
+
 const getDbPath = () => {
   const configDir = directories.config;
   // Generic app database for auth, shares, and user settings.
@@ -221,6 +224,176 @@ const generateId = () =>
     : `${Date.now().toString(36)}-${crypto.randomBytes(8).toString('hex')}`;
 const DEFAULT_FAVORITE_ICON = favorites.defaultIcon;
 
+/**
+ * Where a user has recently moved or copied things to.
+ *
+ * Kept as history rather than a preference: the point is that the folders you
+ * actually use rise to the top of the destination picker without anyone
+ * curating a list. One row per user and path — using a destination again moves
+ * it up rather than adding a duplicate.
+ */
+const RECENT_DESTINATIONS_DDL = `
+  CREATE TABLE IF NOT EXISTS recent_destinations (
+    user_id TEXT NOT NULL,
+    path TEXT NOT NULL,
+    used_at DATETIME NOT NULL,
+    PRIMARY KEY (user_id, path)
+  );
+`;
+
+/**
+ * What a user chose for one folder: how to sort it, how to show it.
+ *
+ * A row per folder rather than one JSON blob per user. The blob had to be
+ * capped — it was read and rewritten whole on every change, and shipped
+ * entire on every load — so the hundred-and-first folder silently forgot the
+ * oldest. More importantly, a blob cannot be cleaned up: deleting a folder
+ * could not remove what everyone else had chosen for it, and renaming one left
+ * the preferences behind on a path that no longer existed.
+ */
+const FOLDER_PREFERENCES_DDL = `
+  CREATE TABLE IF NOT EXISTS folder_preferences (
+    user_id TEXT NOT NULL,
+    path TEXT NOT NULL,
+    sort_by TEXT,
+    sort_order TEXT,
+    view_mode TEXT,
+    updated_at DATETIME NOT NULL,
+    PRIMARY KEY (user_id, path)
+  );
+  CREATE INDEX IF NOT EXISTS idx_folder_preferences_path ON folder_preferences(path);
+`;
+
+/**
+ * Carry per-folder preferences out of the JSON blob they used to live in.
+ *
+ * They were two maps under `user_settings` — one for sorting, one for the view
+ * mode — capped at a hundred entries each because the whole blob was rewritten
+ * on every change. As rows they need no cap, and they can finally be cleaned up
+ * when the folder they describe is deleted or renamed.
+ *
+ * Best-effort: a preference that fails to migrate costs a folder its remembered
+ * sort, which is not worth failing a startup over.
+ */
+const migrateFolderPreferencesFromUserSettings = (db) => {
+  let rows;
+  try {
+    rows = db
+      .prepare(
+        "SELECT user_id, key, value FROM user_settings WHERE key IN ('folderSorts', 'folderViews')"
+      )
+      .all();
+  } catch (error) {
+    logger.debug({ err: error }, '[DB Migration] No folder preferences to carry over');
+    return;
+  }
+
+  const merged = new Map();
+  for (const row of rows) {
+    let parsed;
+    try {
+      parsed = JSON.parse(row.value);
+    } catch {
+      continue;
+    }
+    if (!parsed || typeof parsed !== 'object') continue;
+
+    for (const [folderPath, entry] of Object.entries(parsed)) {
+      if (!folderPath || !entry || typeof entry !== 'object') continue;
+
+      const key = `${row.user_id}\u0000${folderPath}`;
+      const current = merged.get(key) || {
+        userId: row.user_id,
+        path: folderPath,
+        sortBy: null,
+        sortOrder: null,
+        viewMode: null,
+        updatedAt: 0,
+      };
+
+      if (row.key === 'folderSorts' && typeof entry.by === 'string') {
+        current.sortBy = entry.by;
+        current.sortOrder = entry.order === 'desc' ? 'desc' : 'asc';
+      } else if (row.key === 'folderViews' && typeof entry.mode === 'string') {
+        current.viewMode = entry.mode;
+      }
+
+      const updatedAt = Number(entry.updatedAt);
+      if (Number.isFinite(updatedAt) && updatedAt > current.updatedAt) {
+        current.updatedAt = updatedAt;
+      }
+      merged.set(key, current);
+    }
+  }
+
+  if (merged.size === 0) return;
+
+  const insert = db.prepare(
+    `INSERT OR REPLACE INTO folder_preferences
+       (user_id, path, sort_by, sort_order, view_mode, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?)`
+  );
+
+  for (const entry of merged.values()) {
+    insert.run(
+      entry.userId,
+      entry.path,
+      entry.sortBy,
+      entry.sortOrder,
+      entry.viewMode,
+      new Date(entry.updatedAt || Date.now()).toISOString()
+    );
+  }
+
+  db.prepare("DELETE FROM user_settings WHERE key IN ('folderSorts', 'folderViews')").run();
+  logger.info({ count: merged.size }, '[DB Migration] Folder preferences moved to their own table');
+};
+
+const ensureShareOperationPermissionColumns = (db) => {
+  addColumnIfMissing(db, 'shares', 'allow_delete', 'allow_delete INTEGER NOT NULL DEFAULT 1');
+  addColumnIfMissing(
+    db,
+    'shares',
+    'allow_create_folder',
+    'allow_create_folder INTEGER NOT NULL DEFAULT 1'
+  );
+  addColumnIfMissing(
+    db,
+    'shares',
+    'allow_create_file',
+    'allow_create_file INTEGER NOT NULL DEFAULT 1'
+  );
+  addColumnIfMissing(db, 'shares', 'allow_upload', 'allow_upload INTEGER NOT NULL DEFAULT 1');
+  // Defaults to 1 so every share that already exists keeps working exactly as
+  // it did: withholding downloads is something an owner opts into, never
+  // something a migration decides for them.
+  addColumnIfMissing(db, 'shares', 'allow_download', 'allow_download INTEGER NOT NULL DEFAULT 1');
+
+  // What a share hands out of a file's history: the list of its versions, and
+  // the versions themselves. A link for anyone shows none until its owner says
+  // so; a share with named accounts shows what those accounts would see anyway,
+  // which is why the ones that exist already are switched on as they gain it.
+  const columns = new Set(
+    db
+      .prepare('PRAGMA table_info(shares)')
+      .all()
+      .map((column) => column.name)
+  );
+  for (const column of ['versions_visible', 'versions_download']) {
+    if (columns.has(column)) continue;
+    db.exec(`ALTER TABLE shares ADD COLUMN ${column} INTEGER NOT NULL DEFAULT 0`);
+    db.exec(`UPDATE shares SET ${column} = 1 WHERE sharing_type = 'users'`);
+  }
+};
+
+const PERSONAL_FOLDER_RESERVATIONS_DDL = `
+  CREATE TABLE IF NOT EXISTS personal_folder_reservations (
+    name TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL,
+    reserved_at TEXT NOT NULL
+  );
+`;
+
 const migrate = (db) => {
   // Simple schema versioning
   db.exec(`
@@ -665,6 +838,53 @@ const migrate = (db) => {
       );
       version = 19;
     }
+    if (version < 20) {
+      logger.info('[DB Migration] Migrating to v20: per-folder preferences as rows...');
+      db.exec(FOLDER_PREFERENCES_DDL);
+      migrateFolderPreferencesFromUserSettings(db);
+      db.prepare('INSERT OR REPLACE INTO meta(key, value) VALUES (?, ?)').run(
+        'schema_version',
+        String(20)
+      );
+      version = 20;
+    }
+    if (version < 21) {
+      logger.info('[DB Migration] Migrating to v21: the folders somebody files into...');
+      db.exec(RECENT_DESTINATIONS_DDL);
+      db.prepare('INSERT OR REPLACE INTO meta(key, value) VALUES (?, ?)').run(
+        'schema_version',
+        String(21)
+      );
+      version = 21;
+    }
+    if (version < 22) {
+      logger.info('[DB Migration] Migrating to v22: what a share permits, and when it was used...');
+      ensureShareOperationPermissionColumns(db);
+      addColumnIfMissing(db, 'shares', 'last_downloaded_at', 'last_downloaded_at DATETIME');
+      addColumnIfMissing(db, 'shares', 'last_download_ip', 'last_download_ip TEXT');
+      db.prepare('INSERT OR REPLACE INTO meta(key, value) VALUES (?, ?)').run(
+        'schema_version',
+        String(22)
+      );
+      version = 22;
+    }
+    if (version < 23) {
+      logger.info('[DB Migration] Migrating to v23: one personal folder per account...');
+      db.exec(PERSONAL_FOLDER_RESERVATIONS_DDL);
+      // Rows an account's deletion used to leave behind. None of these tables
+      // points at users through a foreign key, so nothing ever removed them.
+      if (tableExists(db, 'folder_preferences')) {
+        db.exec('DELETE FROM folder_preferences WHERE user_id NOT IN (SELECT id FROM users)');
+      }
+      if (tableExists(db, 'recent_destinations')) {
+        db.exec('DELETE FROM recent_destinations WHERE user_id NOT IN (SELECT id FROM users)');
+      }
+      db.prepare('INSERT OR REPLACE INTO meta(key, value) VALUES (?, ?)').run(
+        'schema_version',
+        String(23)
+      );
+      version = 23;
+    }
   })();
 };
 
@@ -866,9 +1086,7 @@ const ensureAnonymousUser = (db) => {
   }
 };
 
-const getDb = async () => {
-  if (dbInstance) return dbInstance;
-
+const openDb = async () => {
   const dbDir = directories.config;
   await ensureDir(dbDir);
   const dbPath = getDbPath();
@@ -938,11 +1156,67 @@ const getDb = async () => {
     logger.warn({ err }, '[DB] Failed to ensure the ONLYOFFICE editor session table');
   }
   ensureAnonymousUser(db);
-  dbInstance = db;
-  return dbInstance;
+  return db;
+};
+
+/**
+ * The application database, opened on first use.
+ *
+ * Everything that starts with the server asks for it at once. Each caller passed the
+ * check for an open database before the first one had finished opening it, and went on
+ * to open app.db again and run the migrations over it in parallel: four connections at
+ * every start, four sets of `CREATE TABLE IF NOT EXISTS`, and whichever finished last
+ * became the one everybody used. One opening is shared instead.
+ */
+let dbOpening = null;
+const getDb = async () => {
+  if (dbInstance) return dbInstance;
+  if (!dbOpening) {
+    dbOpening = openDb()
+      .then((db) => {
+        dbInstance = db;
+        return db;
+      })
+      .finally(() => {
+        dbOpening = null;
+      });
+  }
+  return dbOpening;
+};
+
+const closeDb = () => {
+  if (!dbInstance) return;
+  dbInstance.close();
+  dbInstance = null;
+};
+
+/**
+ * A statement prepared once per database and kept.
+ *
+ * `db.prepare` compiles the SQL every time it is called, and the hot paths — a listing
+ * asking whether each of a thousand rows is a favourite — called it per row. Kept in a
+ * WeakMap so the cache goes when the connection does, which is what a test that opens a
+ * database per case needs.
+ */
+const statementCache = new WeakMap();
+
+const prepared = (db, sql) => {
+  let cache = statementCache.get(db);
+  if (!cache) {
+    cache = new Map();
+    statementCache.set(db, cache);
+  }
+  let statement = cache.get(sql);
+  if (!statement) {
+    statement = db.prepare(sql);
+    cache.set(sql, statement);
+  }
+  return statement;
 };
 
 module.exports = {
+  closeDb,
+  prepared,
   getDb,
   getDbPath,
   // The index database keeps its own copy of this table, so it needs the same
diff --git a/backend/src/services/directoryListingService.js b/backend/src/services/directoryListingService.js
index 1e3c4e4c4..01e247fe9 100644
--- a/backend/src/services/directoryListingService.js
+++ b/backend/src/services/directoryListingService.js
@@ -2,7 +2,7 @@ const path = require('path');
 const fs = require('fs/promises');
 
 const { excludedFiles, extensions, hiddenFiles } = require('../config/index');
-const { combineRelativePath } = require('../utils/pathUtils');
+const { combineRelativePath, resolveLogicalPath } = require('../utils/pathUtils');
 const { getAccessInfo } = require('./accessManager');
 const { createPermissionResolver } = require('./accessControlService');
 const logger = require('../utils/logger');
@@ -41,28 +41,54 @@ const mapWithConcurrency = async (items, concurrency, mapper) => {
   return results;
 };
 
+/**
+ * Whether a symbolic link leads out of the space it sits in.
+ *
+ * Asked of the same resolver every operation goes through, so the listing and
+ * the operations cannot disagree: a link the resolver refuses is one nothing
+ * can be done through. A link it cannot follow at all — to nothing — is left to
+ * the stat that comes next, which skips it as before.
+ */
+const linkLeavesTheSpace = async (context, logicalPath, access) => {
+  try {
+    await resolveLogicalPath(logicalPath, {
+      user: context?.user || null,
+      guestSession: context?.guestSession || null,
+      share: access?.share || null,
+      userVolume: access?.userVolume || null,
+    });
+    return false;
+  } catch (error) {
+    return error?.statusCode === 403;
+  }
+};
+
 /**
  * List a directory and filter out entries that the caller cannot access.
  *
  * - Uses accessManager for per-child visibility (covers shares + user volumes + hidden rules).
  * - Does not throw for child-level failures; unreadable / inaccessible children are skipped.
+ * - A symbolic link that leads out of the space is listed as what it is — a link,
+ *   marked `link: 'outside'` — and never followed. It used to be described by
+ *   what it points at: the size and type of a file outside the volume, on a row
+ *   every action then refused with "Resolved path is outside the configured
+ *   volume root", with nothing on screen to say why.
  */
 const listDirectoryItems = async ({
   absoluteDir,
   parentLogicalPath,
   context,
   thumbsEnabled,
-  excludeDownloadArtifacts = false,
   includeHiddenFiles = false,
   itemExtras = null,
   access = null,
   shareCache = null,
   userVolumeCache = null,
 }) => {
-  // The whole access section rather than the rules alone: whom a rule holds is
-  // decided by the rule and by the setting above it together, so a resolver
-  // built from half of it would answer for the wrong caller.
-  const permissionResolver = access?.rules?.length ? createPermissionResolver(access) : null;
+  // The whole section, never the bare list: a caller handing over the rules
+  // alone would silently drop the setting that says whom they hold.
+  const permissionResolver =
+    Array.isArray(access?.rules) && access.rules.length ? createPermissionResolver(access) : null;
 
   const accessOptions = {
     ...(permissionResolver ? { permissionResolver } : null),
@@ -70,21 +96,40 @@ const listDirectoryItems = async ({
     ...(userVolumeCache instanceof Map ? { userVolumeCache } : null),
   };
 
+  /**
+   * Which entries carry the read-only mark: the ones a rule holds this caller
+   * to, and only where that starts.
+   *
+   * A rule was invisible until something was attempted in the folder it covers,
+   * and on an account no rule held it was never refused at all
+   * (nxzai/NextExplorer#407). The mark says it up front — but a recursive rule
+   * covers everything below it, and a lock on every row inside a folder that is
+   * already read-only says nothing the row above did not. So it is drawn where
+   * the restriction begins: on the entry whose folder is not itself read-only.
+   *
+   * Asked of the rules alone, not of the whole access decision: this mark is
+   * about a rule, and a volume read-only for another reason carries its own.
+   */
+  const isAdmin = Boolean(context?.user?.roles?.includes?.('admin'));
+  const ruleSays = (logicalPath) =>
+    permissionResolver ? permissionResolver(logicalPath || '', { isAdmin }) : 'rw';
+  const insideReadOnly = ruleSays(parentLogicalPath) === 'ro';
+
   const entries = await fs.readdir(absoluteDir);
 
   const filtered = entries
     .filter((name) => !excludedFiles.includes(name))
-    .filter((name) => includeHiddenFiles || !hiddenFiles.isHiddenName(name))
-    .filter((name) =>
-      excludeDownloadArtifacts ? path.extname(name).toLowerCase() !== '.download' : true
-    );
+    .filter((name) => includeHiddenFiles || !hiddenFiles.isHiddenName(name));
 
   const items = await mapWithConcurrency(filtered, LIST_DIRECTORY_CONCURRENCY, async (name) => {
     const filePath = path.join(absoluteDir, name);
+    const logicalChildPath = combineRelativePath(parentLogicalPath || '', name);
 
     let stats;
+    let entry;
     try {
-      stats = await fs.stat(filePath);
+      entry = await fs.lstat(filePath);
+      stats = entry.isSymbolicLink() ? null : entry;
     } catch (err) {
       if (['EPERM', 'EACCES', 'ENOENT', 'ELOOP'].includes(err?.code)) {
         logger.warn({ filePath, err }, 'Skipping unreadable entry');
@@ -93,12 +138,33 @@ const listDirectoryItems = async ({
       throw err;
     }
 
-    const logicalChildPath = combineRelativePath(parentLogicalPath || '', name);
     const childAccess = await getAccessInfo(context, logicalChildPath, accessOptions);
     if (!childAccess?.canAccess) {
       return null;
     }
 
+    if (!stats) {
+      if (await linkLeavesTheSpace(context, logicalChildPath, childAccess)) {
+        return {
+          name,
+          path: parentLogicalPath,
+          dateModified: entry.mtime,
+          size: null,
+          kind: toKind(entry, name),
+          link: 'outside',
+        };
+      }
+      try {
+        stats = await fs.stat(filePath);
+      } catch (err) {
+        if (['EPERM', 'EACCES', 'ENOENT', 'ELOOP'].includes(err?.code)) {
+          logger.warn({ filePath, err }, 'Skipping unreadable entry');
+          return null;
+        }
+        throw err;
+      }
+    }
+
     const kind = toKind(stats, name);
     const item = {
       name,
@@ -108,8 +174,6 @@ const listDirectoryItems = async ({
       kind,
     };
 
-    // Advisory only, and never a lock: who has this document open in an
-    // editor, so the row can say so and a move can ask first.
     if (stats.isFile()) {
       const activity = onlyofficeActivity.get(filePath);
       if (activity?.active) item.onlyofficeActivity = activity;
@@ -119,6 +183,9 @@ const listDirectoryItems = async ({
       item.supportsThumbnail = true;
     }
 
+    // `access`, as a volume held to reading says it: the same lock, the same reason.
+    if (!insideReadOnly && ruleSays(logicalChildPath) === 'ro') item.readOnly = 'access';
+
     if (typeof itemExtras === 'function') {
       Object.assign(item, itemExtras({ name, stats, kind, access: childAccess }) || {});
     }
diff --git a/backend/src/services/guestSessionService.js b/backend/src/services/guestSessionService.js
index 7d2978e1d..4d40fbd36 100644
--- a/backend/src/services/guestSessionService.js
+++ b/backend/src/services/guestSessionService.js
@@ -1,12 +1,5 @@
-const crypto = require('crypto');
 const { getDb } = require('./db');
-
-const nowIso = () => new Date().toISOString();
-
-const generateId = () =>
-  typeof crypto.randomUUID === 'function'
-    ? crypto.randomUUID()
-    : `${Date.now().toString(36)}-${crypto.randomBytes(8).toString('hex')}`;
+const { generateId, nowIso } = require('../utils/ids');
 
 // Default session duration: 24 hours
 const DEFAULT_SESSION_HOURS = 24;
@@ -67,24 +60,6 @@ const getGuestSession = async (sessionId) => {
   return toClientSession(row);
 };
 
-/**
- * Get all guest sessions for a share
- */
-const getGuestSessionsByShareId = async (shareId) => {
-  const db = await getDb();
-  const rows = db
-    .prepare(
-      `
-    SELECT * FROM guest_sessions
-    WHERE share_id = ?
-    ORDER BY created_at DESC
-  `
-    )
-    .all(shareId);
-
-  return rows.map(toClientSession);
-};
-
 /**
  * Check if a guest session is valid (exists and not expired)
  */
@@ -119,24 +94,6 @@ const updateGuestSessionActivity = async (sessionId) => {
   return result.changes > 0;
 };
 
-/**
- * Delete guest session
- */
-const deleteGuestSession = async (sessionId) => {
-  const db = await getDb();
-  const result = db.prepare('DELETE FROM guest_sessions WHERE id = ?').run(sessionId);
-  return result.changes > 0;
-};
-
-/**
- * Delete all guest sessions for a share
- */
-const deleteGuestSessionsByShareId = async (shareId) => {
-  const db = await getDb();
-  const result = db.prepare('DELETE FROM guest_sessions WHERE share_id = ?').run(shareId);
-  return result.changes;
-};
-
 /**
  * Clean up expired guest sessions
  */
@@ -153,74 +110,10 @@ const cleanupExpiredSessions = async () => {
   return result.changes;
 };
 
-/**
- * Get guest session count for a share
- */
-const getActiveSessionCount = async (shareId) => {
-  const db = await getDb();
-  const row = db
-    .prepare(
-      `
-    SELECT COUNT(*) as count
-    FROM guest_sessions
-    WHERE share_id = ? AND expires_at > ?
-  `
-    )
-    .get(shareId, nowIso());
-
-  return row?.count || 0;
-};
-
-/**
- * Extend guest session expiration
- */
-const extendGuestSession = async (sessionId, additionalHours = DEFAULT_SESSION_HOURS) => {
-  const session = await getGuestSession(sessionId);
-
-  if (!session) {
-    const e = new Error('Guest session not found');
-    e.status = 404;
-    throw e;
-  }
-
-  const currentExpiry = new Date(session.expiresAt);
-  const newExpiry = new Date(currentExpiry.getTime() + additionalHours * 60 * 60 * 1000);
-
-  const db = await getDb();
-  db.prepare(
-    `
-    UPDATE guest_sessions
-    SET expires_at = ?, last_activity_at = ?
-    WHERE id = ?
-  `
-  ).run(newExpiry.toISOString(), nowIso(), sessionId);
-
-  return getGuestSession(sessionId);
-};
-
-/**
- * Verify guest session belongs to a specific share
- */
-const verifyGuestSessionShare = async (sessionId, shareId) => {
-  const session = await getGuestSession(sessionId);
-
-  if (!session) {
-    return false;
-  }
-
-  return session.shareId === shareId;
-};
-
 module.exports = {
   createGuestSession,
   getGuestSession,
-  getGuestSessionsByShareId,
   isGuestSessionValid,
   updateGuestSessionActivity,
-  deleteGuestSession,
-  deleteGuestSessionsByShareId,
   cleanupExpiredSessions,
-  getActiveSessionCount,
-  extendGuestSession,
-  verifyGuestSessionShare,
 };
diff --git a/backend/src/services/indexDb.js b/backend/src/services/indexDb.js
index 1e078c2a4..fe1524d3e 100644
--- a/backend/src/services/indexDb.js
+++ b/backend/src/services/indexDb.js
@@ -78,14 +78,8 @@ const metaValue = (db, key) => {
   }
 };
 
-/**
- * An index database of this application's own, under the cache, and the write-
- * ahead files beside it. Nothing anybody put anywhere is ever in one, so it
- * does not go through the trash.
- */
 const removeFile = (file) => {
   for (const suffix of ['', '-wal', '-shm', '-journal']) {
-    // eslint-disable-next-line no-restricted-properties
     fs.rmSync(`${file}${suffix}`, { force: true });
   }
 };
diff --git a/backend/src/services/legacyCacheCheck.js b/backend/src/services/legacyCacheCheck.js
new file mode 100644
index 000000000..0a9f67950
--- /dev/null
+++ b/backend/src/services/legacyCacheCheck.js
@@ -0,0 +1,83 @@
+const fs = require('fs');
+const path = require('path');
+
+const { directories } = require('../config/index');
+const logger = require('../utils/logger');
+
+/**
+ * What early releases left in the cache directory, said out loud at start.
+ *
+ * Up to 1.1.7 the database and app-config.json lived in the cache directory.
+ * 1.1.8 moved them to the config directory and left links behind in their
+ * place; 2.0.3 removed that move from the entrypoint. So an installation that
+ * started on 1.1.7 or earlier and skipped the releases in between comes up on a
+ * new, empty app.db in /config, with its accounts and shares sitting unread in
+ * /cache — and nothing said so. The links, where an installation passed through
+ * 1.1.8 to 2.0.2, are harmless but look like data.
+ *
+ * Nothing is moved: which of two databases holds what matters cannot be told
+ * from here, and guessing wrong would overwrite the one in use. The log says
+ * where the old file is and what to do with it.
+ */
+
+const LEGACY_NAMES = ['app.db', 'app-config.json', 'extensions'];
+
+const readLinkOrNull = (file) => {
+  try {
+    return fs.readlinkSync(file);
+  } catch {
+    return null;
+  }
+};
+
+/** What is there, without following anything. */
+const inspectLegacyCache = (cacheDir = directories.cache) => {
+  const findings = [];
+  for (const name of LEGACY_NAMES) {
+    const file = path.join(cacheDir, name);
+    let stats;
+    try {
+      stats = fs.lstatSync(file);
+    } catch {
+      continue;
+    }
+    if (stats.isSymbolicLink()) {
+      findings.push({ name, path: file, kind: 'link', target: readLinkOrNull(file) });
+    } else if (name === 'app.db' && stats.isFile()) {
+      findings.push({ name, path: file, kind: 'database', sizeBytes: stats.size });
+    }
+  }
+  return findings;
+};
+
+const reportLegacyCache = ({
+  cacheDir = directories.cache,
+  configDir = directories.config,
+  log = logger,
+} = {}) => {
+  const findings = inspectLegacyCache(cacheDir);
+
+  const database = findings.find((finding) => finding.kind === 'database');
+  if (database) {
+    log.warn(
+      {
+        legacyDatabase: database.path,
+        sizeBytes: database.sizeBytes,
+        databaseInUse: path.join(configDir, 'app.db'),
+      },
+      'An app.db written by release 1.1.7 or earlier is in the cache directory, and nothing reads it: this server runs on the app.db in the config directory. If accounts, shares or favorites are missing, stop the container, back up both files, and copy the old one over the one in the config directory.'
+    );
+  }
+
+  const links = findings.filter((finding) => finding.kind === 'link');
+  if (links.length > 0) {
+    log.info(
+      { links: links.map((link) => `${link.path} -> ${link.target}`) },
+      'Links left in the cache directory by releases 1.1.8 to 2.0.2 are unused and can be deleted.'
+    );
+  }
+
+  return findings;
+};
+
+module.exports = { inspectLegacyCache, reportLegacyCache };
diff --git a/backend/src/services/performanceDiagnostics.js b/backend/src/services/performanceDiagnostics.js
new file mode 100644
index 000000000..0b3d65faa
--- /dev/null
+++ b/backend/src/services/performanceDiagnostics.js
@@ -0,0 +1,178 @@
+const fs = require('fs/promises');
+const { monitorEventLoopDelay, performance } = require('perf_hooks');
+
+const { performanceDiagnostics: config } = require('../config');
+const logger = require('../utils/logger');
+const thumbnailService = require('./thumbnailService');
+const folderSizeManager = require('./folderSizeManager');
+const fileTransferService = require('./fileTransferService');
+
+let timer = null;
+let previousSample = null;
+let eventLoopDelay = null;
+
+const toMb = (bytes) => Math.round((Number(bytes) || 0) / 1024 / 1024);
+
+const readText = async (filePath) => {
+  try {
+    return (await fs.readFile(filePath, 'utf8')).trim();
+  } catch (_) {
+    return null;
+  }
+};
+
+const readNumber = async (filePath) => {
+  const value = await readText(filePath);
+  if (value == null || value === 'max') return null;
+  const number = Number(value);
+  return Number.isFinite(number) ? number : null;
+};
+
+const readKeyValueFile = async (filePath, allowedKeys) => {
+  const content = await readText(filePath);
+  if (!content) return null;
+  const result = {};
+  for (const line of content.split('\n')) {
+    const [key, rawValue] = line.trim().split(/\s+/, 2);
+    if (!allowedKeys.has(key)) continue;
+    const value = Number(rawValue);
+    if (Number.isFinite(value)) result[key] = toMb(value);
+  }
+  return result;
+};
+
+const readCgroupMemory = async () => {
+  const v2Current = await readNumber('/sys/fs/cgroup/memory.current');
+  const v2Limit = await readNumber('/sys/fs/cgroup/memory.max');
+  const isV2 = v2Current != null;
+  const current = isV2
+    ? v2Current
+    : await readNumber('/sys/fs/cgroup/memory/memory.usage_in_bytes');
+  const limit = isV2 ? v2Limit : await readNumber('/sys/fs/cgroup/memory/memory.limit_in_bytes');
+  const stat = await readKeyValueFile(
+    isV2 ? '/sys/fs/cgroup/memory.stat' : '/sys/fs/cgroup/memory/memory.stat',
+    new Set(['anon', 'file', 'slab', 'slab_reclaimable', 'slab_unreclaimable', 'cache', 'rss'])
+  );
+
+  if (current == null && !stat) return null;
+  return {
+    currentMb: toMb(current),
+    ...(limit != null ? { limitMb: toMb(limit) } : {}),
+    ...(stat ? { statMb: stat } : {}),
+  };
+};
+
+const activeResourceCounts = () => {
+  if (typeof process.getActiveResourcesInfo !== 'function') return undefined;
+  return process.getActiveResourcesInfo().reduce((counts, name) => {
+    counts[name] = (counts[name] || 0) + 1;
+    return counts;
+  }, {});
+};
+
+const sample = async () => {
+  const now = performance.now();
+  const cpu = process.cpuUsage();
+  const memory = process.memoryUsage();
+  const [cgroupMemory, thumbnail, folderSize, transfers] = await Promise.all([
+    readCgroupMemory(),
+    // Each queue reports itself when it can. One that does not is a queue this
+    // installation has no report for, not a reason for the whole record to fail — a
+    // diagnostic that throws is a diagnostic that says nothing at the moment it is
+    // most wanted.
+    Promise.resolve(thumbnailService.getDiagnosticsSnapshot?.() ?? null),
+    Promise.resolve(folderSizeManager.getDiagnosticsSnapshot?.() ?? null),
+    Promise.resolve(fileTransferService.getDiagnosticsSnapshot?.() ?? null),
+  ]);
+
+  const elapsedMs = previousSample ? Math.max(1, now - previousSample.at) : null;
+  const cpuDeltaUs = previousSample
+    ? cpu.user - previousSample.cpu.user + (cpu.system - previousSample.cpu.system)
+    : null;
+  const cpuPercent =
+    elapsedMs != null && cpuDeltaUs != null
+      ? Math.round((cpuDeltaUs / 1000 / elapsedMs) * 100)
+      : null;
+  const loopDelayMs = eventLoopDelay
+    ? Number(eventLoopDelay.percentile(99) / 1e6).toFixed(1)
+    : null;
+  const eventLoopUtilization = previousSample?.eventLoopUtilization
+    ? performance.eventLoopUtilization(previousSample.eventLoopUtilization)
+    : null;
+
+  previousSample = {
+    at: now,
+    cpu,
+    eventLoopUtilization: performance.eventLoopUtilization(),
+  };
+  eventLoopDelay?.reset();
+
+  return {
+    cpuPercent,
+    ...(eventLoopUtilization
+      ? { eventLoopUtilizationPercent: Math.round(eventLoopUtilization.utilization * 100) }
+      : {}),
+    ...(loopDelayMs != null ? { eventLoopP99DelayMs: Number(loopDelayMs) } : {}),
+    memoryMb: {
+      rss: toMb(memory.rss),
+      heapUsed: toMb(memory.heapUsed),
+      heapTotal: toMb(memory.heapTotal),
+      external: toMb(memory.external),
+      arrayBuffers: toMb(memory.arrayBuffers),
+    },
+    cgroupMemory,
+    resources: activeResourceCounts(),
+    thumbnail,
+    folderSize,
+    transfers,
+  };
+};
+
+const isPressure = (snapshot) =>
+  (snapshot.cpuPercent ?? 0) >= config.cpuThreshold ||
+  snapshot.memoryMb.rss >= config.rssThresholdMb ||
+  (snapshot.eventLoopP99DelayMs ?? 0) >= config.eventLoopDelayThresholdMs;
+
+const start = () => {
+  if (!config.enabled || timer) return;
+
+  eventLoopDelay = monitorEventLoopDelay({ resolution: 20 });
+  eventLoopDelay.enable();
+  logger.info(
+    {
+      intervalMs: config.intervalMs,
+      cpuThreshold: config.cpuThreshold,
+      rssThresholdMb: config.rssThresholdMb,
+      eventLoopDelayThresholdMs: config.eventLoopDelayThresholdMs,
+      logEveryInterval: config.logEveryInterval,
+    },
+    'Performance diagnostics enabled'
+  );
+
+  const tick = () => {
+    sample()
+      .then((snapshot) => {
+        if (config.logEveryInterval || isPressure(snapshot)) {
+          logger.info(
+            { reason: isPressure(snapshot) ? 'resource-pressure' : 'interval', ...snapshot },
+            'Performance diagnostics'
+          );
+        }
+      })
+      .catch((err) => logger.debug({ err }, 'Performance diagnostics sample failed'));
+  };
+
+  tick();
+  timer = setInterval(tick, config.intervalMs);
+  if (typeof timer.unref === 'function') timer.unref();
+};
+
+const stop = () => {
+  if (timer) clearInterval(timer);
+  timer = null;
+  eventLoopDelay?.disable();
+  eventLoopDelay = null;
+  previousSample = null;
+};
+
+module.exports = { start, stop, sample };
diff --git a/backend/src/services/personalFolders.js b/backend/src/services/personalFolders.js
index 702b4a45f..a6e96de61 100644
--- a/backend/src/services/personalFolders.js
+++ b/backend/src/services/personalFolders.js
@@ -1,3 +1,7 @@
+const fs = require('fs');
+const path = require('path');
+
+const { directories } = require('../config/index');
 const { getUserFolderNameCandidates } = require('../utils/pathUtils');
 const logger = require('../utils/logger');
 
@@ -39,6 +43,32 @@ const takenNames = (db, userId) => {
   return new Set(rows.map((row) => row.name));
 };
 
+/**
+ * Whether a name is held for an account that was deleted.
+ *
+ * Deleting an account leaves its folder on disk, with what it kept there, its
+ * trash and its versions. Handing the name to the next account that derives it
+ * handed over that folder too. The name stays reserved for as long as the
+ * folder is there; an administrator frees it by removing or renaming the folder
+ * on the server, and the reservation goes the first time the name is asked for
+ * after that.
+ */
+const isReserved = (db, name) => {
+  // Names are claimed by the v15 migration, long before v20 creates this table;
+  // until it exists, nothing can have been reserved.
+  const hasTable = db
+    .prepare(
+      "SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'personal_folder_reservations'"
+    )
+    .get();
+  if (!hasTable) return false;
+  const row = db.prepare('SELECT name FROM personal_folder_reservations WHERE name = ?').get(name);
+  if (!row) return false;
+  if (fs.existsSync(path.join(directories.userRoot, name))) return true;
+  db.prepare('DELETE FROM personal_folder_reservations WHERE name = ?').run(name);
+  return false;
+};
+
 /**
  * Give this account a folder name of its own, and answer it. Idempotent: an
  * account that already holds one keeps it.
@@ -53,7 +83,7 @@ const claimPersonalFolderName = (db, user) => {
   const candidates = getUserFolderNameCandidates(user);
 
   for (const candidate of candidates) {
-    if (taken.has(candidate)) continue;
+    if (taken.has(candidate) || isReserved(db, candidate)) continue;
 
     try {
       db.prepare('UPDATE users SET personal_folder_name = ? WHERE id = ?').run(candidate, user.id);
@@ -61,7 +91,7 @@ const claimPersonalFolderName = (db, user) => {
       if (candidate !== candidates[0]) {
         logger.warn(
           { userId: user.id, preferred: candidates[0], assigned: candidate },
-          'Personal folder name was already taken by another account; assigned the next one'
+          'Personal folder name was taken, or kept for a deleted account; assigned the next one'
         );
       }
       return candidate;
diff --git a/backend/src/services/recentDestinationsService.js b/backend/src/services/recentDestinationsService.js
new file mode 100644
index 000000000..a363195b5
--- /dev/null
+++ b/backend/src/services/recentDestinationsService.js
@@ -0,0 +1,87 @@
+const { getDb } = require('./db');
+const logger = require('../utils/logger');
+
+/**
+ * The folders a user actually moves things into.
+ *
+ * The destination picker opens on a list rather than at the root, because the
+ * folder someone wants is nearly always one they have used before. Nobody
+ * curates that list: it is written by the transfers themselves, so it stays
+ * true to how the person really files things.
+ *
+ * Kept per user. A shared favourite is a deliberate bookmark; this is a trace
+ * of one person's habits, and showing someone else's would be both wrong and
+ * a small leak of where they work.
+ */
+
+const MAX_ENTRIES = 10;
+
+/** Note that a transfer landed here. Never throws: this is a convenience. */
+const record = async (userId, relativePath) => {
+  if (!userId || typeof relativePath !== 'string' || !relativePath.trim()) return;
+
+  try {
+    const db = await getDb();
+    const now = new Date().toISOString();
+
+    db.prepare(
+      `INSERT INTO recent_destinations (user_id, path, used_at)
+       VALUES (?, ?, ?)
+       ON CONFLICT(user_id, path) DO UPDATE SET used_at = excluded.used_at`
+    ).run(userId, relativePath, now);
+
+    // Trim to the most recent entries. Done on write so the table cannot grow
+    // for a user who never opens the picker.
+    db.prepare(
+      `DELETE FROM recent_destinations
+        WHERE user_id = ?
+          AND path NOT IN (
+            SELECT path FROM recent_destinations
+             WHERE user_id = ?
+             ORDER BY used_at DESC
+             LIMIT ?
+          )`
+    ).run(userId, userId, MAX_ENTRIES);
+  } catch (error) {
+    // A destination that fails to be remembered must never fail the transfer
+    // that reached it.
+    logger.debug({ err: error, relativePath }, 'Could not record recent destination');
+  }
+};
+
+/** Most recently used first. */
+const list = async (userId) => {
+  if (!userId) return [];
+
+  const db = await getDb();
+  return db
+    .prepare(
+      `SELECT path FROM recent_destinations
+        WHERE user_id = ?
+        ORDER BY used_at DESC
+        LIMIT ?`
+    )
+    .all(userId, MAX_ENTRIES)
+    .map((row) => row.path);
+};
+
+/** Drop a destination that no longer exists or is no longer reachable. */
+const forget = async (userId, relativePath) => {
+  if (!userId || !relativePath) return;
+
+  try {
+    const db = await getDb();
+    db.prepare('DELETE FROM recent_destinations WHERE user_id = ? AND path = ?').run(
+      userId,
+      relativePath
+    );
+  } catch (error) {
+    logger.debug({ err: error, relativePath }, 'Could not forget recent destination');
+  }
+};
+
+module.exports = {
+  record,
+  list,
+  forget,
+};
diff --git a/backend/src/services/searchCollector.js b/backend/src/services/searchCollector.js
index 64382d314..6318227c1 100644
--- a/backend/src/services/searchCollector.js
+++ b/backend/src/services/searchCollector.js
@@ -40,7 +40,9 @@ const collectResults = async ({
   const contentReserve = Math.max(1, limit - Math.floor(limit * NAME_SHARE));
 
   for await (const item of results) {
-    (item.matchLine ? contents : names).push(item);
+    // A content match the index vouched for without its line being read in
+    // time is still a content match, and is counted as one.
+    (item.matchLine || item.inContents ? contents : names).push(item);
 
     if (names.length < nameCap) continue;
     if (contents.length >= contentReserve) break;
diff --git a/backend/src/services/searchIndexer.js b/backend/src/services/searchIndexer.js
index 1c863f43d..d946d0380 100644
--- a/backend/src/services/searchIndexer.js
+++ b/backend/src/services/searchIndexer.js
@@ -31,7 +31,19 @@ const { containerMemoryLimitBytes } = require('../utils/containerMemory');
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
-const IGNORED_DIRECTORIES = new Set(['.git', 'node_modules', 'dist', 'build', '.cache']);
+/**
+ * Folders the pass does not walk into.
+ *
+ * Dot-folders only, and for one reason each: the application keeps its trash
+ * and its file versions in one of them, and the rest are somebody's hidden
+ * things, which the search refuses to show unless they asked. `.git`,
+ * `node_modules`, `dist` and `build` used to be here too — an editor's habits
+ * in a file server, where those are ordinary folder names somebody may have a
+ * year of work in, and nothing that decides what is not worth finding belongs
+ * in the source (#11). The administrator's exclusion list is where that is
+ * said.
+ */
+const isSkippedDirectoryName = (name) => name.startsWith('.');
 
 /**
  * How much of one document is worth indexing, and how much may be held at once.
@@ -61,10 +73,39 @@ const NON_TEXT_EXTENSIONS = new Set([
   ...extensions.rawImages,
   ...extensions.videos,
   ...extensions.audios,
-  'zip', 'rar', '7z', 'gz', 'bz2', 'xz', 'zst', 'tar', 'tgz', 'iso', 'dmg', 'jar',
-  'exe', 'dll', 'so', 'dylib', 'bin', 'o', 'a', 'class', 'pyc', 'wasm',
-  'ttf', 'otf', 'woff', 'woff2', 'eot',
-  'db', 'sqlite', 'sqlite3', 'mdb', 'pack', 'idx',
+  'zip',
+  'rar',
+  '7z',
+  'gz',
+  'bz2',
+  'xz',
+  'zst',
+  'tar',
+  'tgz',
+  'iso',
+  'dmg',
+  'jar',
+  'exe',
+  'dll',
+  'so',
+  'dylib',
+  'bin',
+  'o',
+  'a',
+  'class',
+  'pyc',
+  'wasm',
+  'ttf',
+  'otf',
+  'woff',
+  'woff2',
+  'eot',
+  'db',
+  'sqlite',
+  'sqlite3',
+  'mdb',
+  'pack',
+  'idx',
 ]);
 
 const extensionOf = (absolutePath) => path.extname(absolutePath).slice(1).toLowerCase();
@@ -182,6 +223,7 @@ const indexTree = async ({
   let pendingBytes = 0;
   let indexed = 0;
   let skipped = 0;
+  let folders = 0;
   let batches = 0;
   let interrupted = false;
 
@@ -351,7 +393,14 @@ const indexTree = async ({
     const batch = pending.splice(0, pending.length);
     pendingBytes = 0;
     writeBatch(batch);
-    indexed += batch.length;
+    // Counted apart: `indexed` has always meant files this pass had to read,
+    // and a folder row is written without opening anything. Folding the two
+    // together would make a volume of empty folders look like a volume that
+    // changes constantly.
+    for (const document of batch) {
+      if (document.isDirectory) folders += 1;
+      else indexed += 1;
+    }
     batches += 1;
 
     if (typeof onProgress === 'function' && Date.now() - lastReport >= progressMs) {
@@ -369,7 +418,9 @@ const indexTree = async ({
         skipped,
         batches,
         reindexed: reindexedKnown,
-        ...(worstFolder ? { rereadTopFolder: worstFolder.value, rereadTopCount: worstFolder.count } : {}),
+        ...(worstFolder
+          ? { rereadTopFolder: worstFolder.value, rereadTopCount: worstFolder.count }
+          : {}),
         ...cost(),
       });
     }
@@ -392,7 +443,7 @@ const indexTree = async ({
     for (const entry of entries) {
       throwIfAborted();
 
-      if (entry.name.startsWith('.') || IGNORED_DIRECTORIES.has(entry.name)) continue;
+      if (isSkippedDirectoryName(entry.name)) continue;
 
       const absolutePath = path.join(dirAbs, entry.name);
       const relativePath = dirRel ? `${dirRel}/${entry.name}` : entry.name;
@@ -400,16 +451,28 @@ const indexTree = async ({
       if (isExcluded(relativePath)) continue;
 
       if (entry.isDirectory()) {
-        // eslint-disable-next-line no-await-in-loop
+        // A row of its own, so a folder nobody has put anything in yet can be
+        // found by its name. Its own timestamps say nothing useful — a folder's
+        // mtime moves when its children do — so the row is written once and
+        // left alone.
+        seenHere.add(relativePath);
+        if (!store.getIndexedDocument(db, relativePath)) {
+          pending.push({
+            path: relativePath,
+            mtimeMs: 0,
+            size: 0,
+            text: null,
+            isDirectory: true,
+          });
+          if (pending.length >= batchSize) flush();
+        }
         await walk(absolutePath, relativePath);
         continue;
       }
       if (!entry.isFile()) continue;
 
-      // eslint-disable-next-line no-await-in-loop
       const stats = await fs.stat(absolutePath).catch(() => null);
       if (!stats) continue;
-      if (maxFileSizeBytes && stats.size > maxFileSizeBytes) continue;
 
       seenHere.add(relativePath);
 
@@ -418,7 +481,6 @@ const indexTree = async ({
       const known = store.getIndexedDocument(db, relativePath);
       if (store.isUpToDate(known, stats)) {
         skipped += 1;
-        // eslint-disable-next-line no-await-in-loop
         await payForTimeUsed();
         continue;
       }
@@ -453,24 +515,27 @@ const indexTree = async ({
         }
       }
 
-      // eslint-disable-next-line no-await-in-loop
-      const text = await readIndexableText(absolutePath, stats.size, scratch);
-      if (text === null || !text.trim()) continue;
+      // The size bound is on reading a file, not on knowing it is there. A
+      // two-gigabyte recording has no words worth keeping and a name somebody
+      // will look for, and the row costs what the stat above already paid.
+      const tooLargeToRead = maxFileSizeBytes && stats.size > maxFileSizeBytes;
+      const text = tooLargeToRead
+        ? null
+        : await readIndexableText(absolutePath, stats.size, scratch);
+      const indexable = text === null || !text.trim() ? null : capText(text);
 
-      const indexable = capText(text);
       pending.push({
         path: relativePath,
         mtimeMs: stats.mtimeMs,
         size: stats.size,
         text: indexable,
       });
-      pendingBytes += indexable.length;
+      pendingBytes += indexable ? indexable.length : 0;
 
       // Whichever ceiling is reached first. The byte one is what keeps a
       // handful of large documents from being held together.
       if (pending.length >= batchSize || pendingBytes >= MAX_TEXT_PER_BATCH) flush();
 
-      // eslint-disable-next-line no-await-in-loop
       await payForTimeUsed();
     }
 
@@ -516,6 +581,7 @@ const indexTree = async ({
   return {
     indexed,
     skipped,
+    folders,
     removed,
     batches,
     pauses,
@@ -538,29 +604,22 @@ const indexFile = async (db, relativePath, absolutePath) => {
     return { removed: true };
   }
 
-  const maxBytes = searchConfig?.maxFileSizeBytes ?? 0;
-  if (maxBytes && stats.size > maxBytes) {
-    store.removeDocument(db, relativePath);
-    return { skipped: true };
-  }
-
   if (store.isUpToDate(store.getIndexedDocument(db, relativePath), stats)) {
     return { unchanged: true };
   }
 
-  const text = await readIndexableText(absolutePath, stats.size);
-  if (text === null || !text.trim()) {
-    store.removeDocument(db, relativePath);
-    return { skipped: true };
-  }
+  const maxBytes = searchConfig?.maxFileSizeBytes ?? 0;
+  const text =
+    maxBytes && stats.size > maxBytes ? null : await readIndexableText(absolutePath, stats.size);
+  const indexable = text === null || !text.trim() ? null : capText(text);
 
   store.upsertDocument(db, {
     path: relativePath,
     mtimeMs: stats.mtimeMs,
     size: stats.size,
-    text: capText(text),
+    text: indexable,
   });
-  return { indexed: true };
+  return indexable ? { indexed: true } : { catalogued: true };
 };
 
 module.exports = { indexTree, indexFile, readIndexableText };
diff --git a/backend/src/services/settingsService.js b/backend/src/services/settingsService.js
index b274ccd04..346b5e167 100644
--- a/backend/src/services/settingsService.js
+++ b/backend/src/services/settingsService.js
@@ -1,61 +1,238 @@
-const { getDb } = require('./db');
-const env = require('../config/env');
-const { parseByteSize } = require('../utils/env');
+const { getDb, prepared } = require('./db');
+const { cachedForRequest } = require('../utils/requestContext');
 const { normalizeRelativePath } = require('../utils/pathUtils');
-const { ruleAppliesToAdmins } = require('../utils/accessRules');
+const { parseByteSize } = require('../utils/env');
+const env = require('../config/env');
 const folderSizeExclusions = require('./folderSizeExclusions');
 const searchIndexExclusions = require('./searchIndexExclusions');
-const storage = require('./storage/jsonStorage'); // Keep for backward compatibility fallback
+const { generateId } = require('../utils/ids');
+const { ValidationError } = require('../errors/AppError');
+const { ruleAppliesToAdmins } = require('../utils/accessRules');
+
+const MIN_UPLOAD_CHUNK_SIZE_BYTES = 1024 * 1024;
+const HARD_MAX_UPLOAD_CHUNK_SIZE_MIB = 512;
+const DEFAULT_UPLOAD_CHUNK_SIZE_BYTES = 8 * 1024 * 1024;
+
+// Per-folder preferences are kept per user, and bounded: one entry per folder
+// ever visited would otherwise grow without limit.
+const MAX_FOLDER_PREFERENCES = 100;
+const MAX_FOLDER_PATH_LENGTH = 1024;
+const MAX_SORT_FIELD_LENGTH = 128;
+
+// Admin-configurable upper bound (env MAX_CHUNK_SIZE_MIB), capped at the hard
+// ceiling. Used to clamp both the default and any saved chunk size.
+const resolveMaxChunkSizeBytes = () => {
+  const raw = Number(env.MAX_CHUNK_SIZE_MIB);
+  const mib =
+    Number.isFinite(raw) && raw >= 1
+      ? Math.min(Math.floor(raw), HARD_MAX_UPLOAD_CHUNK_SIZE_MIB)
+      : HARD_MAX_UPLOAD_CHUNK_SIZE_MIB;
+  return Math.max(MIN_UPLOAD_CHUNK_SIZE_BYTES, mib * 1024 * 1024);
+};
+const MAX_UPLOAD_CHUNK_SIZE_BYTES = resolveMaxChunkSizeBytes();
+
+const clampNumber = (value, min, max) => Math.max(min, Math.min(max, value));
+
+const defaultUploadSettings = () => {
+  const configuredChunkSize = parseByteSize(env.UPLOAD_CHUNK_SIZE);
+  const chunkSizeBytes =
+    Number.isFinite(configuredChunkSize) && configuredChunkSize > 0
+      ? configuredChunkSize
+      : DEFAULT_UPLOAD_CHUNK_SIZE_BYTES;
 
-const generateId = () => {
-  const crypto = require('crypto');
-  return typeof crypto.randomUUID === 'function'
-    ? crypto.randomUUID()
-    : `${Date.now().toString(36)}-${crypto.randomBytes(8).toString('hex')}`;
+  const chunkedAutoFallback = env.UPLOAD_CHUNKED_AUTO_FALLBACK ?? false;
+  return {
+    // Auto-fallback and forced chunked uploads are mutually exclusive — auto is a
+    // direct-with-fallback mode, so it turns forced chunking off.
+    chunkedEnabled: chunkedAutoFallback ? false : (env.UPLOAD_CHUNKED_ENABLED ?? false),
+    chunkedAutoFallback,
+    chunkSizeBytes: clampNumber(
+      Math.floor(chunkSizeBytes),
+      MIN_UPLOAD_CHUNK_SIZE_BYTES,
+      MAX_UPLOAD_CHUNK_SIZE_BYTES
+    ),
+  };
+};
+
+const isValidFolderPath = (folderPath) =>
+  typeof folderPath === 'string' &&
+  folderPath.length > 0 &&
+  folderPath.length <= MAX_FOLDER_PATH_LENGTH;
+
+const sanitizeFolderSort = (sort) => {
+  if (
+    !sort ||
+    typeof sort !== 'object' ||
+    typeof sort.by !== 'string' ||
+    sort.by.trim().length === 0 ||
+    sort.by.length > MAX_SORT_FIELD_LENGTH ||
+    (sort.order !== 'asc' && sort.order !== 'desc')
+  ) {
+    return null;
+  }
+
+  return {
+    by: sort.by.trim(),
+    order: sort.order,
+    updatedAt: Number.isFinite(sort.updatedAt) ? Math.floor(sort.updatedAt) : 0,
+  };
+};
+
+const VIEW_MODES = ['grid', 'list', 'tab', 'photos'];
+
+/** A remembered view mode for one folder, or null when it is not one we have. */
+const sanitizeFolderView = (view) => {
+  const mode = typeof view === 'string' ? view : view?.mode;
+  if (!VIEW_MODES.includes(mode)) return null;
+
+  return {
+    mode,
+    updatedAt: Number.isFinite(view?.updatedAt) ? Math.floor(view.updatedAt) : 0,
+  };
+};
+
+/**
+ * A map of folder path to preference, keeping only what is valid and only the
+ * most recently used — one entry per folder ever visited would grow forever.
+ */
+const sanitizeFolderPreferences = (preferences, sanitizeEntry) => {
+  if (!preferences || typeof preferences !== 'object' || Array.isArray(preferences)) {
+    return {};
+  }
+
+  return Object.fromEntries(
+    Object.entries(preferences)
+      .map(([folderPath, entry]) => {
+        const sanitized = sanitizeEntry(entry);
+        return isValidFolderPath(folderPath) && sanitized ? [folderPath, sanitized] : null;
+      })
+      .filter(Boolean)
+      .sort(([, a], [, b]) => b.updatedAt - a.updatedAt)
+      .slice(0, MAX_FOLDER_PREFERENCES)
+  );
+};
+
+const sanitizeFolderSorts = (folderSorts) =>
+  sanitizeFolderPreferences(folderSorts, sanitizeFolderSort);
+
+const sanitizeFolderViews = (folderViews) =>
+  sanitizeFolderPreferences(folderViews, sanitizeFolderView);
+
+/**
+ * The bounds thumbnail settings are held to, and their defaults. The settings
+ * page refuses a value outside them before sending it, with the same numbers
+ * (`SettingsFilesThumbnails.vue`).
+ */
+const THUMBNAIL_BOUNDS = {
+  size: { min: 64, max: 1024, fallback: 200 },
+  quality: { min: 1, max: 100, fallback: 70 },
+  concurrency: { min: 1, max: 50, fallback: 10 },
 };
 
 /**
  * Sanitize thumbnail settings
  */
 const sanitizeThumbnails = (thumbnails = {}) => {
+  const integer = (key) => {
+    const { min, max, fallback } = THUMBNAIL_BOUNDS[key];
+    return Number.isFinite(thumbnails[key])
+      ? clampNumber(Math.floor(thumbnails[key]), min, max)
+      : fallback;
+  };
   return {
     enabled: typeof thumbnails.enabled === 'boolean' ? thumbnails.enabled : true,
-    size: Number.isFinite(thumbnails.size)
-      ? Math.max(64, Math.min(1024, Math.floor(thumbnails.size)))
-      : 200,
-    quality: Number.isFinite(thumbnails.quality)
-      ? Math.max(1, Math.min(100, Math.floor(thumbnails.quality)))
-      : 70,
-    concurrency: Number.isFinite(thumbnails.concurrency)
-      ? Math.max(1, Math.min(50, Math.floor(thumbnails.concurrency)))
-      : 10,
+    size: integer('size'),
+    quality: integer('quality'),
+    concurrency: integer('concurrency'),
   };
 };
 
+const FOLDER_SIZE_MODES = ['off', 'shallow', 'full'];
+
 /**
- * Sanitize access control rules
+ * What an administrator chose for the two background workers. Only a choice:
+ * when the environment set the same thing, the environment is what runs, and
+ * this is kept for the day the variable is taken away.
  */
-const sanitizeAccessRules = (rules = []) => {
-  if (!Array.isArray(rules)) return [];
+const sanitizeFolderSize = (folderSize = {}) => ({
+  excludedPaths: folderSizeExclusions.sanitizePaths(folderSize.excludedPaths || []),
+  mode: FOLDER_SIZE_MODES.includes(folderSize.mode) ? folderSize.mode : 'off',
+});
+
+const sanitizeSearchIndex = (searchIndex = {}) => ({
+  excludedPaths: searchIndexExclusions.sanitizePaths(searchIndex.excludedPaths || []),
+  enabled: searchIndex.enabled === true,
+});
+
+const ACCESS_PERMISSIONS = ['rw', 'ro', 'hidden'];
+
+/**
+ * Sanitize access control rules.
+ *
+ * Read back (`strict: false`), a rule that cannot stand is dropped. Anything
+ * else would make one bad row — left by an older version, or edited into
+ * app.db by hand — unreadable settings, and unreadable settings are every
+ * hidden folder visible to everybody.
+ *
+ * Saved (`strict: true`), the same rule is refused with its reason and nothing
+ * is written. Dropping it silently answered 200 with a list the page then
+ * adopted: the row for `../Secret` disappeared the moment it was saved, and an
+ * administrator was left believing a folder was hidden that never was. The
+ * permissions were worse — anything not one of the three became `rw`, so a
+ * mistyped `readonly` opened a folder for writing instead of refusing the word.
+ */
+const sanitizeAccessRules = (rules = [], { strict = false } = {}) => {
+  if (!Array.isArray(rules)) {
+    if (strict) throw new ValidationError('The access rules have to be sent as a list.');
+    return [];
+  }
 
   return rules
-    .map((rule) => {
-      if (!rule || typeof rule !== 'object') return null;
+    .map((rule, index) => {
+      // Numbered as the page numbers them, so the reason names the row.
+      const refuse = (reason) => {
+        if (!strict) return null;
+        throw new ValidationError(`Access rule ${index + 1}: ${reason}`);
+      };
+
+      if (!rule || typeof rule !== 'object' || Array.isArray(rule)) {
+        return refuse('this is not a rule.');
+      }
+
+      // A path of nothing but spaces normalises to itself: the rule was stored
+      // as it came and matched no folder — written by an administrator, listed
+      // on the page, and doing nothing. Refused now, and only when it is blank
+      // all through: a folder may legitimately be called "My Documents", or
+      // even " x ", so nothing here trims what somebody wrote.
+      if (!String(rule.path ?? '').trim()) return refuse('a rule needs the path of a folder.');
 
       // Validate path
       let normalizedPath;
       try {
         normalizedPath = normalizeRelativePath(rule.path || '');
-      } catch {
-        return null; // Invalid path
+      } catch (error) {
+        return refuse(`"${rule.path}" is not a folder path. ${error.message}`);
       }
 
-      if (!normalizedPath) return null;
+      if (!normalizedPath) return refuse('a rule needs the path of a folder.');
 
       // Validate permissions
-      const permissions = ['rw', 'ro', 'hidden'].includes(rule.permissions)
-        ? rule.permissions
-        : 'rw';
+      if (rule.permissions !== undefined && !ACCESS_PERMISSIONS.includes(rule.permissions)) {
+        return refuse(
+          `"${rule.permissions}" is not one of the permissions a rule gives: rw, ro or hidden.`
+        );
+      }
+      const permissions = ACCESS_PERMISSIONS.includes(rule.permissions) ? rule.permissions : 'rw';
+
+      if (rule.recursive !== undefined && typeof rule.recursive !== 'boolean') {
+        return refuse(`"${rule.recursive}" does not say whether the rule covers what is inside.`);
+      }
+
+      if (rule.appliesToAdmins !== undefined && typeof rule.appliesToAdmins !== 'boolean') {
+        return refuse(
+          `"${rule.appliesToAdmins}" does not say whether the rule holds administrators too.`
+        );
+      }
 
       return {
         id: rule.id || `${Date.now()}-${Math.random().toString(36).slice(2)}`,
@@ -63,8 +240,8 @@ const sanitizeAccessRules = (rules = []) => {
         recursive: Boolean(rule.recursive),
         permissions,
         // Stored as a plain yes or no, so the page shows a definite box and
-        // nothing downstream has to guess again. What a rule written before
-        // this switch existed means is decided in one place, utils/accessRules.
+        // nothing has to guess again. What a rule written before this switch
+        // existed means is decided in one place, utils/accessRules.
         appliesToAdmins: ruleAppliesToAdmins({ ...rule, permissions }),
       };
     })
@@ -72,15 +249,19 @@ const sanitizeAccessRules = (rules = []) => {
 };
 
 /**
- * The access section: the rules, and whether they hold administrators.
- *
- * Kept together because the two are read together — a rule says whether it
- * holds administrators, and this setting holds them to all of them at once.
+ * The access section: the rules, and whether every one of them also holds
+ * administrators. The setting is the blunt one — on, no rule lets an
+ * administrator through; off, each rule says for itself.
  */
-const sanitizeAccess = (access = {}) => {
+const sanitizeAccess = (access = {}, { strict = false } = {}) => {
   const source = access && typeof access === 'object' && !Array.isArray(access) ? access : {};
+  if (source.applyToAdmins !== undefined && typeof source.applyToAdmins !== 'boolean' && strict) {
+    throw new ValidationError(
+      'Whether the rules hold administrators too has to be sent as true or false.'
+    );
+  }
   return {
-    rules: sanitizeAccessRules(source.rules || []),
+    rules: sanitizeAccessRules(source.rules || [], { strict }),
     applyToAdmins: source.applyToAdmins === true,
   };
 };
@@ -89,9 +270,12 @@ const sanitizeAccess = (access = {}) => {
  * Sanitize branding settings
  */
 const sanitizeBranding = (branding = {}) => {
+  // A name of nothing but spaces was stored as it came, and the header and the
+  // sign-in page showed no name at all. One stored that way reads as the
+  // default, so an installation that saved one needs nothing done.
+  const appName = typeof branding.appName === 'string' ? branding.appName.trim().slice(0, 100) : '';
   return {
-    appName:
-      typeof branding.appName === 'string' ? branding.appName.trim().slice(0, 100) : 'Explorer',
+    appName: appName || 'Explorer',
     appLogoUrl:
       typeof branding.appLogoUrl === 'string'
         ? branding.appLogoUrl.trim().slice(0, 500)
@@ -100,6 +284,39 @@ const sanitizeBranding = (branding = {}) => {
   };
 };
 
+/**
+ * Sanitize upload settings
+ */
+const sanitizeUploads = (uploads = {}) => {
+  const defaults = defaultUploadSettings();
+  const rawChunkSize =
+    typeof uploads.chunkSizeBytes === 'string'
+      ? parseByteSize(uploads.chunkSizeBytes)
+      : uploads.chunkSizeBytes;
+
+  const chunkedAutoFallback =
+    typeof uploads.chunkedAutoFallback === 'boolean'
+      ? uploads.chunkedAutoFallback
+      : defaults.chunkedAutoFallback;
+  const chunkedEnabled = chunkedAutoFallback
+    ? false // mutually exclusive with auto-fallback (auto wins)
+    : typeof uploads.chunkedEnabled === 'boolean'
+      ? uploads.chunkedEnabled
+      : defaults.chunkedEnabled;
+
+  return {
+    chunkedEnabled,
+    chunkedAutoFallback,
+    chunkSizeBytes: Number.isFinite(rawChunkSize)
+      ? clampNumber(
+          Math.floor(rawChunkSize),
+          MIN_UPLOAD_CHUNK_SIZE_BYTES,
+          MAX_UPLOAD_CHUNK_SIZE_BYTES
+        )
+      : defaults.chunkSizeBytes,
+  };
+};
+
 /**
  * The trash settings in force: on or off, how many days an item is kept, and
  * how much of a volume the trash may hold — a share of it, capped by a size
@@ -107,14 +324,10 @@ const sanitizeBranding = (branding = {}) => {
  * out keeps the default the environment gave.
  */
 const sanitizeTrash = (trash = {}) => {
-  // eslint-disable-next-line global-require
   const { trash: defaults } = require('../config/index');
-  // eslint-disable-next-line global-require
-  const { parseByteSize } = require('../utils/env');
   const source = trash && typeof trash === 'object' ? trash : {};
-  const clamp = (value, min, max) => Math.min(max, Math.max(min, value));
   const integerIn = (value, min, max, fallback) =>
-    Number.isFinite(value) ? clamp(Math.round(value), min, max) : fallback;
+    Number.isFinite(value) ? clampNumber(Math.round(value), min, max) : fallback;
   const rawMaxBytes =
     typeof source.maxBytes === 'string' ? parseByteSize(source.maxBytes) : source.maxBytes;
 
@@ -131,20 +344,40 @@ const sanitizeTrash = (trash = {}) => {
 };
 
 /**
- * The file-version settings in force: whether a save keeps what it replaces,
- * and the retention thinning (everything for a while, then hourly, then daily),
- * a per-file cap and a session-checkpoint gap. Out-of-range values are clamped,
- * and the windows are kept consistent (hourly covers keep-all, daily covers
- * hourly), so the policy never contradicts itself.
+ * The activity log settings in force: on or off, and how long a line is kept.
+ *
+ * Off is the default and stays the default: a log nobody asked for is a record
+ * of somebody's day that nobody reads.
+ */
+const sanitizeActivity = (activity = {}) => {
+  const { activity: defaults } = require('../config/index');
+  const source = activity && typeof activity === 'object' ? activity : {};
+  const retentionDays = Number(source.retentionDays);
+  return {
+    enabled: typeof source.enabled === 'boolean' ? source.enabled : defaults.enabled,
+    retentionDays: Number.isFinite(retentionDays)
+      ? clampNumber(Math.round(retentionDays), 1, 3650)
+      : defaults.retentionDays,
+  };
+};
+
+/**
+ * The file version settings in force: on or off, how long everything is kept
+ * before thinning starts, how long one an hour and one a day are kept, how many
+ * versions a file keeps at most, and how often an editing session leaves a
+ * checkpoint. The space they may take is the trash's: one budget per volume.
+ *
+ * The tiers are kept in order — a week of hourly versions cannot end before the
+ * day of keeping everything does.
  */
 const sanitizeVersions = (versions = {}) => {
-  // eslint-disable-next-line global-require
   const { versions: defaults, VERSION_BOUNDS } = require('../config/index');
   const source = versions && typeof versions === 'object' ? versions : {};
-  const clamp = (value, min, max) => Math.min(max, Math.max(min, value));
   const integer = (key) => {
     const [min, max] = VERSION_BOUNDS[key];
-    return Number.isFinite(source[key]) ? clamp(Math.round(source[key]), min, max) : defaults[key];
+    return Number.isFinite(source[key])
+      ? clampNumber(Math.round(source[key]), min, max)
+      : defaults[key];
   };
   const keepAllHours = integer('keepAllHours');
   const hourlyDays = Math.max(integer('hourlyDays'), Math.ceil(keepAllHours / 24));
@@ -159,248 +392,146 @@ const sanitizeVersions = (versions = {}) => {
   };
 };
 
-const FOLDER_SIZE_MODES = ['off', 'shallow', 'full'];
-
-/**
- * What an administrator chose for the two background workers. Only a choice:
- * when the environment set the same thing, the environment is what runs, and
- * this is kept for the day the variable is taken away.
- */
-const sanitizeFolderSize = (folderSize = {}) => ({
-  excludedPaths: folderSizeExclusions.sanitizePaths(folderSize.excludedPaths || []),
-  mode: FOLDER_SIZE_MODES.includes(folderSize.mode) ? folderSize.mode : 'off',
-});
-
-const sanitizeSearchIndex = (searchIndex = {}) => ({
-  excludedPaths: searchIndexExclusions.sanitizePaths(searchIndex.excludedPaths || []),
-  enabled: searchIndex.enabled === true,
-});
-
-/**
- * The activity log settings in force: on or off, and how long a line is kept.
- *
- * Off is the default and stays the default: a log nobody asked for is a record
- * of somebody's day that nobody reads.
- */
-const sanitizeActivity = (activity = {}) => {
-  // eslint-disable-next-line global-require
-  const { activity: defaults } = require('../config/index');
-  const source = activity && typeof activity === 'object' ? activity : {};
-  const retentionDays = Number(source.retentionDays);
-  return {
-    enabled: typeof source.enabled === 'boolean' ? source.enabled : defaults.enabled,
-    retentionDays: Number.isFinite(retentionDays)
-      ? Math.max(1, Math.min(3650, Math.round(retentionDays)))
-      : defaults.retentionDays,
-  };
-};
-
 /**
  * Get public settings (branding only, no auth required)
  */
 const getPublicSettings = async () => {
-  try {
-    const db = await getDb();
-    const brandingRow = db
-      .prepare('SELECT value FROM system_settings WHERE category = ? AND key = ?')
-      .get('branding', 'branding');
+  const db = await getDb();
+  const brandingRow = db
+    .prepare('SELECT value FROM system_settings WHERE category = ? AND key = ?')
+    .get('branding', 'branding');
 
-    if (brandingRow) {
-      const branding = JSON.parse(brandingRow.value);
-      return {
-        branding: sanitizeBranding(branding),
-      };
+  let branding = {};
+  if (brandingRow) {
+    try {
+      branding = JSON.parse(brandingRow.value);
+    } catch {
+      // An unreadable value is the default branding, not a failure to sign in.
     }
-  } catch (err) {
-    // Fallback to JSON if DB read fails
-  }
-
-  // Fallback to JSON storage
-  try {
-    const data = await storage.get();
-    const branding = data.settings?.branding || {};
-    return {
-      branding: sanitizeBranding(branding),
-    };
-  } catch (err) {
-    // Return defaults if all else fails
-    return {
-      branding: sanitizeBranding({}),
-    };
   }
+  return { branding: sanitizeBranding(branding) };
 };
 
 /**
  * Get user-specific settings
  */
-const MIN_UPLOAD_CHUNK_SIZE_BYTES = 1024 * 1024;
-const HARD_MAX_UPLOAD_CHUNK_SIZE_MIB = 512;
-const DEFAULT_UPLOAD_CHUNK_SIZE_BYTES = 8 * 1024 * 1024;
-
-// The administrator's ceiling (MAX_CHUNK_SIZE_MIB), itself capped: a chunk is
-// held whole in memory at each end, so an unbounded one is a way to run a
-// server out of it.
-const resolveMaxChunkSizeBytes = () => {
-  const raw = Number(env.MAX_CHUNK_SIZE_MIB);
-  const mib =
-    Number.isFinite(raw) && raw > 0
-      ? Math.min(Math.floor(raw), HARD_MAX_UPLOAD_CHUNK_SIZE_MIB)
-      : HARD_MAX_UPLOAD_CHUNK_SIZE_MIB;
-  return Math.max(MIN_UPLOAD_CHUNK_SIZE_BYTES, mib * 1024 * 1024);
-};
-const MAX_UPLOAD_CHUNK_SIZE_BYTES = resolveMaxChunkSizeBytes();
-
-const clampNumber = (value, min, max) => Math.max(min, Math.min(max, value));
-
-const defaultUploadSettings = () => {
-  const configuredChunkSize = parseByteSize(env.UPLOAD_CHUNK_SIZE);
-  const chunkSizeBytes =
-    Number.isFinite(configuredChunkSize) && configuredChunkSize > 0
-      ? configuredChunkSize
-      : DEFAULT_UPLOAD_CHUNK_SIZE_BYTES;
-
-  return {
-    chunkedEnabled: env.UPLOAD_CHUNKED_ENABLED ?? false,
-    chunkSizeBytes: clampNumber(
-      Math.floor(chunkSizeBytes),
-      MIN_UPLOAD_CHUNK_SIZE_BYTES,
-      MAX_UPLOAD_CHUNK_SIZE_BYTES
-    ),
-  };
-};
-
-const sanitizeUploads = (uploads = {}) => {
-  const defaults = defaultUploadSettings();
-  const rawChunkSize =
-    typeof uploads.chunkSizeBytes === 'string'
-      ? parseByteSize(uploads.chunkSizeBytes)
-      : uploads.chunkSizeBytes;
-
-  return {
-    chunkedEnabled:
-      typeof uploads.chunkedEnabled === 'boolean'
-        ? uploads.chunkedEnabled
-        : defaults.chunkedEnabled,
-    chunkSizeBytes: Number.isFinite(rawChunkSize)
-      ? clampNumber(
-          Math.floor(rawChunkSize),
-          MIN_UPLOAD_CHUNK_SIZE_BYTES,
-          MAX_UPLOAD_CHUNK_SIZE_BYTES
-        )
-      : defaults.chunkSizeBytes,
-  };
-};
-
 const getUserSettings = async (userId) => {
   if (!userId) return {};
 
   try {
     const db = await getDb();
-    const rows = db.prepare('SELECT key, value FROM user_settings WHERE user_id = ?').all(userId);
+    const rows = prepared(db, 'SELECT key, value FROM user_settings WHERE user_id = ?').all(userId);
 
     const settings = {};
     for (const row of rows) {
       try {
         settings[row.key] = JSON.parse(row.value);
-      } catch (err) {
+      } catch (_) {
         // Skip invalid JSON
       }
     }
 
+    // Per-folder preferences are rows of their own now, but the client still
+    // receives them among the user's settings.
+    Object.assign(settings, await getUserFolderPreferences(userId));
+
     return settings;
-  } catch (err) {
+  } catch (_) {
     return {};
   }
 };
 
+// Through `prepared` rather than db.prepare: these run on every preference
+// change, and recompiling the same three statements each time is waste the
+// rest of this file already avoids.
+const upsertUserSetting = (db, userId, key, value) => {
+  const now = new Date().toISOString();
+  const valueJson = JSON.stringify(value);
+  const existing = prepared(db, 'SELECT id FROM user_settings WHERE user_id = ? AND key = ?').get(
+    userId,
+    key
+  );
+
+  if (existing) {
+    prepared(
+      db,
+      'UPDATE user_settings SET value = ?, updated_at = ? WHERE user_id = ? AND key = ?'
+    ).run(valueJson, now, userId, key);
+  } else {
+    prepared(
+      db,
+      'INSERT INTO user_settings (id, user_id, key, value, updated_at) VALUES (?, ?, ?, ?, ?)'
+    ).run(generateId(), userId, key, valueJson, now);
+  }
+};
+
 /**
  * Get system settings (admin only)
  */
+/**
+ * System settings, read from app.db and nowhere else.
+ *
+ * They used to fall back to app-config.json whenever the read failed. That file
+ * stopped following the settings long ago — the screens save to app.db alone —
+ * so a read that failed ran with whatever the file last held, often no access
+ * rules at all: a folder hidden by a rule opened for everyone for as long as the
+ * database could not be read. A read that fails now fails the request.
+ */
 const getSystemSettings = async () => {
-  try {
-    const db = await getDb();
-    const rows = db
-      .prepare('SELECT key, value FROM system_settings WHERE category = ?')
-      .all('system');
-
-    const thumbnails = { enabled: true, size: 200, quality: 70, concurrency: 10 };
-    const access = { rules: [] };
-    let trash = {};
-    let versions = {};
-    let uploads = {};
-    let activity = {};
-    let folderSize = {};
-    let searchIndex = {};
-
-    for (const row of rows) {
-      try {
-        if (row.key === 'thumbnails') {
-          Object.assign(thumbnails, JSON.parse(row.value));
-        } else if (row.key === 'access') {
-          Object.assign(access, JSON.parse(row.value));
-        } else if (row.key === 'trash') {
-          trash = JSON.parse(row.value);
-        } else if (row.key === 'versions') {
-          versions = JSON.parse(row.value);
-        } else if (row.key === 'uploads') {
-          uploads = JSON.parse(row.value);
-        } else if (row.key === 'activity') {
-          activity = JSON.parse(row.value);
-        } else if (row.key === 'folderSize') {
-          folderSize = JSON.parse(row.value);
-        } else if (row.key === 'searchIndex') {
-          searchIndex = JSON.parse(row.value);
-        }
-      } catch (err) {
-        // Skip invalid JSON
-      }
-    }
-
-    return {
-      thumbnails: sanitizeThumbnails(thumbnails),
-      access: sanitizeAccess(access),
-      trash: sanitizeTrash(trash),
-      versions: sanitizeVersions(versions),
-      uploads: sanitizeUploads(uploads),
-      activity: sanitizeActivity(activity),
-      folderSize: {
-        ...sanitizeFolderSize(folderSize),
-        environmentExcludedPaths: folderSizeExclusions.snapshot().environmentExcludedPaths,
-      },
-      searchIndex: {
-        ...sanitizeSearchIndex(searchIndex),
-        environmentExcludedPaths: searchIndexExclusions.snapshot().environmentExcludedPaths,
-      },
-    };
-  } catch (err) {
-    // Fallback to JSON storage
+  const db = await getDb();
+  const rows = db
+    .prepare('SELECT key, value FROM system_settings WHERE category = ?')
+    .all('system');
+
+  const thumbnails = { enabled: true, size: 200, quality: 70, concurrency: 10 };
+  const access = { rules: [] };
+  let uploads = defaultUploadSettings();
+  const folderSize = { excludedPaths: [] };
+  const searchIndex = { excludedPaths: [] };
+  const trash = {};
+  const versions = {};
+  const activity = {};
+
+  for (const row of rows) {
     try {
-      const data = await storage.get();
-      const settings = data.settings || {};
-      return {
-        thumbnails: sanitizeThumbnails(settings.thumbnails),
-        access: sanitizeAccess(settings.access),
-        trash: sanitizeTrash(settings.trash),
-        versions: sanitizeVersions(settings.versions),
-        uploads: sanitizeUploads(settings.uploads),
-        activity: sanitizeActivity(settings.activity),
-        folderSize: sanitizeFolderSize(settings.folderSize),
-        searchIndex: sanitizeSearchIndex(settings.searchIndex),
-      };
-    } catch (err2) {
-      // Return defaults
-      return {
-        thumbnails: sanitizeThumbnails({}),
-        access: sanitizeAccess({}),
-        trash: sanitizeTrash({}),
-        versions: sanitizeVersions({}),
-        uploads: sanitizeUploads({}),
-        activity: sanitizeActivity({}),
-        folderSize: sanitizeFolderSize({}),
-        searchIndex: sanitizeSearchIndex({}),
-      };
+      if (row.key === 'thumbnails') {
+        Object.assign(thumbnails, JSON.parse(row.value));
+      } else if (row.key === 'access') {
+        Object.assign(access, JSON.parse(row.value));
+      } else if (row.key === 'uploads') {
+        uploads = { ...uploads, ...JSON.parse(row.value) };
+      } else if (row.key === 'folderSize') {
+        Object.assign(folderSize, JSON.parse(row.value));
+      } else if (row.key === 'searchIndex') {
+        Object.assign(searchIndex, JSON.parse(row.value));
+      } else if (row.key === 'trash') {
+        Object.assign(trash, JSON.parse(row.value));
+      } else if (row.key === 'versions') {
+        Object.assign(versions, JSON.parse(row.value));
+      } else if (row.key === 'activity') {
+        Object.assign(activity, JSON.parse(row.value));
+      }
+    } catch (_) {
+      // Skip invalid JSON
     }
   }
+
+  return {
+    thumbnails: sanitizeThumbnails(thumbnails),
+    access: sanitizeAccess(access),
+    uploads: sanitizeUploads(uploads),
+    trash: sanitizeTrash(trash),
+    versions: sanitizeVersions(versions),
+    activity: sanitizeActivity(activity),
+    folderSize: {
+      ...sanitizeFolderSize(folderSize),
+      environmentExcludedPaths: folderSizeExclusions.snapshot().environmentExcludedPaths,
+    },
+    searchIndex: {
+      ...sanitizeSearchIndex(searchIndex),
+      environmentExcludedPaths: searchIndexExclusions.snapshot().environmentExcludedPaths,
+    },
+  };
 };
 
 /**
@@ -418,18 +549,18 @@ const getSettingsForUser = async (user) => {
   if (user && user.id) {
     const userSettings = await getUserSettings(user.id);
     result.user = userSettings;
+    const systemSettings = await getSystemSettings();
+    result.uploads = systemSettings.uploads;
 
     const isAdmin = Array.isArray(user.roles) && user.roles.includes('admin');
     if (isAdmin) {
-      const systemSettings = await getSystemSettings();
       result.thumbnails = systemSettings.thumbnails;
       result.access = systemSettings.access;
+      result.folderSize = systemSettings.folderSize;
+      result.searchIndex = systemSettings.searchIndex;
       result.trash = systemSettings.trash;
       result.versions = systemSettings.versions;
-      result.uploads = systemSettings.uploads;
       result.activity = systemSettings.activity;
-      result.folderSize = systemSettings.folderSize;
-      result.searchIndex = systemSettings.searchIndex;
     }
   }
 
@@ -437,30 +568,64 @@ const getSettingsForUser = async (user) => {
 };
 
 /**
- * The preferences an account may set, in one place.
+ * Anything that is not a boolean is not an answer, and answers undefined, so
+ * the stored value stays.
+ *
+ * It used to be `Boolean(value)`, which has an opinion about everything:
+ * `'false'` — what a form field, a query string or a shell client sends — was
+ * true, and `0` was false. Either way the switch was set to something nobody
+ * had chosen, and the answer said it had been saved.
+ */
+const asBoolean = (value) => (typeof value === 'boolean' ? value : undefined);
+
+// null means "no answer of my own": for skipHome, defer to the environment.
+const asNullableBoolean = (value) => {
+  if (value === null || value === undefined) return null;
+  return typeof value === 'boolean' ? value : undefined;
+};
+
+/**
+ * A default share expiry: null for none, or a whole number of at least one
+ * with its unit.
+ *
+ * Anything else is not an expiry, and answers undefined, so the stored one
+ * stays. It used to answer null, which is a value here: a default of minus
+ * three weeks, or of three years, silently removed the default the person had.
+ */
+const asShareExpiration = (value) => {
+  if (value === null || value === undefined) return null;
+  if (typeof value !== 'object') return undefined;
+  const validUnits = ['days', 'weeks', 'months'];
+  const amount = Number.isFinite(value.value) ? Math.floor(value.value) : 0;
+  if (amount < 1 || !validUnits.includes(value.unit)) return undefined;
+  return { value: amount, unit: value.unit };
+};
+
+/**
+ * The view a folder gets when it has none of its own (#360).
+ *
+ * null is a value here, and means "use the built-in default". A mode we do not
+ * have is not: it used to become null too, so one unknown word put every
+ * folder back to the built-in view instead of being refused.
+ */
+const asViewMode = (value) => {
+  if (value === null || value === undefined) return null;
+  return VIEW_MODES.includes(value) ? value : undefined;
+};
+
+/**
+ * A language tag, or null to follow the browser.
  *
- * There used to be two lists: this one, which decides how a value is
- * sanitised, and another inside the settings route, which decides whether the
- * key is written at all. Adding a preference to one and not the other produced
- * a toggle that moved on screen, answered success, and stored nothing — so the
- * two are the same list now, and the route asks here.
- */
-const USER_BOOLEAN_SETTINGS = new Set([
-  'showHiddenFiles',
-  'showThumbnails',
-  'showVersionMarks',
-  'documentsOpenInNewTab',
-  'showSidebarFavorites',
-  'showSidebarShares',
-  'showSidebarTools',
-]);
-
-/**
- * A language tag, or null for "follow the browser".
+ * Checked for its shape and not against a list of the languages that exist:
+ * the translations are the interface's, and a second list here would be a
+ * second truth to keep — one locale added there and forgotten here would be
+ * refused for no reason anybody could see. A tag naming a translation nobody
+ * ships is stored and then falls back to the browser, which is what a reader
+ * whose language is gone should get anyway.
  *
- * Checked for shape rather than against the list of translations: the list
- * changes with a release, and a stored tag we no longer ship should fall back
- * on screen, not be refused on the way in.
+ * Anything that is not a tag at all is refused rather than turned into null,
+ * as a view mode is: a typo would otherwise read as "follow the browser" and
+ * the choice would put itself back where it was.
  */
 const LANGUAGE_TAG = /^[A-Za-z]{2,3}(-[A-Za-z0-9]{2,8})*$/;
 const asLocale = (value) => {
@@ -470,12 +635,46 @@ const asLocale = (value) => {
   return LANGUAGE_TAG.test(tag) ? tag : undefined;
 };
 
-const USER_SETTING_KEYS = new Set([
-  ...USER_BOOLEAN_SETTINGS,
-  'defaultShareExpiration',
-  'skipHome',
-  'locale',
-]);
+/**
+ * Every preference a user may set, each with the coercion that belongs to it.
+ *
+ * One line per preference, in one place, because this used to be spread over
+ * three: a list of allowed keys in the settings route, a chain of if/else
+ * sanitising here, and the defaults in the client store. A key present in one
+ * and missing from another was accepted by the API, silently dropped, and
+ * answered with its previous value — which the client then applied, so the
+ * switch flicked itself back off. `markdownOpensInEditor` did exactly that.
+ *
+ * Adding a preference is now adding a line here. Its name and its validation
+ * cannot come apart, because they are the same line.
+ */
+const USER_SETTINGS = {
+  showHiddenFiles: asBoolean,
+  showThumbnails: asBoolean,
+  showSidebarFavorites: asBoolean,
+  showSidebarShares: asBoolean,
+  showSidebarTools: asBoolean,
+  markdownOpensInEditor: asBoolean,
+  documentsOpenInNewTab: asBoolean,
+  showVersionMarks: asBoolean,
+  defaultShareExpiration: asShareExpiration,
+  skipHome: asNullableBoolean,
+  defaultView: asViewMode,
+  locale: asLocale,
+};
+
+/**
+ * Written by the application, never straight from a request: a folder
+ * preference is saved one folder at a time, so that two tabs on different
+ * folders do not overwrite each other with whole maps.
+ */
+const INTERNAL_USER_SETTINGS = {
+  folderSorts: sanitizeFolderSorts,
+  folderViews: sanitizeFolderViews,
+};
+
+/** What PATCH /api/settings accepts under `user`. */
+const WRITABLE_USER_SETTINGS = new Set(Object.keys(USER_SETTINGS));
 
 /**
  * Set a user setting
@@ -484,146 +683,213 @@ const setUserSetting = async (userId, key, value) => {
   if (!userId) {
     throw new Error('User ID is required');
   }
-
   const db = await getDb();
-  const now = new Date().toISOString();
 
-  // Validate and sanitize value based on key
-  let sanitizedValue = value;
-  if (USER_BOOLEAN_SETTINGS.has(key)) {
-    sanitizedValue = Boolean(value);
-  } else if (key === 'locale') {
-    const tag = asLocale(value);
-    // `undefined` means "not a language tag": the stored value is left alone
-    // rather than replaced by something the interface cannot read.
-    if (tag === undefined) return (await getUserSettings(userId))[key];
-    sanitizedValue = tag;
-  } else if (key === 'defaultShareExpiration') {
-    // Validate expiration object: { value: number, unit: 'days'|'weeks'|'months' } or null
-    if (value === null || value === undefined) {
-      sanitizedValue = null;
-    } else if (typeof value === 'object' && value !== null) {
-      const validUnits = ['days', 'weeks', 'months'];
-      const unit = validUnits.includes(value.unit) ? value.unit : 'weeks';
-      const numValue =
-        Number.isFinite(value.value) && value.value > 0 ? Math.floor(value.value) : null;
-      sanitizedValue = numValue ? { value: numValue, unit } : null;
-    } else {
-      sanitizedValue = null;
-    }
-  } else if (key === 'skipHome') {
-    // Can be null (use env), true, or false
-    if (value === null || value === undefined) {
-      sanitizedValue = null;
-    } else {
-      sanitizedValue = Boolean(value);
-    }
-  }
+  // An unknown key is stored as it came: callers are the application itself,
+  // and the route only ever passes what WRITABLE_USER_SETTINGS allows.
+  const sanitize = USER_SETTINGS[key] || INTERNAL_USER_SETTINGS[key];
+  const sanitizedValue = sanitize ? sanitize(value) : value;
 
-  const valueJson = JSON.stringify(sanitizedValue);
-
-  // Check if setting exists
-  const existing = db
-    .prepare('SELECT id FROM user_settings WHERE user_id = ? AND key = ?')
-    .get(userId, key);
+  // What a preference cannot take is left out rather than stored as its
+  // default, as a section field of the wrong shape is: the stored value stays.
+  if (sanitizedValue === undefined) return undefined;
 
-  if (existing) {
-    db.prepare(
-      'UPDATE user_settings SET value = ?, updated_at = ? WHERE user_id = ? AND key = ?'
-    ).run(valueJson, now, userId, key);
-  } else {
-    db.prepare(
-      'INSERT INTO user_settings (id, user_id, key, value, updated_at) VALUES (?, ?, ?, ?, ?)'
-    ).run(generateId(), userId, key, valueJson, now);
-  }
+  upsertUserSetting(db, userId, key, sanitizedValue);
 
   return sanitizedValue;
 };
 
 /**
- * Set a system setting (admin only)
- */
-/**
- * Change the branding, and answer what it was and what it is now.
+ * Remember one folder's preference, and return the whole map back.
  *
- * Read and written without yielding in between — the database answers
- * synchronously — so two saves at once cannot both start from the same branding:
- * the logo a save replaced is the one it was the last to see, and removing it
- * cannot take away the logo another save has just put in place.
- *
- * @returns {Promise<{previous: object, current: object}>}
+ * Written one folder at a time rather than by sending the map: two tabs open
+ * on different folders would otherwise overwrite each other with whichever
+ * copy was saved last. The stored map is re-read here so the entry joins what
+ * is already there.
  */
-const replaceBranding = async (update) => {
-  const db = await getDb();
-  const row = db
-    .prepare('SELECT value FROM system_settings WHERE category = ? AND key = ?')
-    .get('branding', 'branding');
+/** Every folder preference this user has, as the client expects them. */
+const getUserFolderPreferences = async (userId) => {
+  if (!userId) return { folderSorts: {}, folderViews: {} };
 
-  let stored = {};
-  if (row) {
-    try {
-      stored = JSON.parse(row.value);
-    } catch {
-      // An unreadable value is the default branding.
+  const db = await getDb();
+  const rows = prepared(
+    db,
+    'SELECT path, sort_by, sort_order, view_mode, updated_at FROM folder_preferences WHERE user_id = ?'
+  ).all(userId);
+
+  const folderSorts = {};
+  const folderViews = {};
+  for (const row of rows) {
+    const updatedAt = Date.parse(row.updated_at) || 0;
+    if (row.sort_by) {
+      folderSorts[row.path] = {
+        by: row.sort_by,
+        order: row.sort_order === 'desc' ? 'desc' : 'asc',
+        updatedAt,
+      };
+    }
+    if (row.view_mode) {
+      folderViews[row.path] = { mode: row.view_mode, updatedAt };
     }
   }
 
-  const previous = sanitizeBranding(stored);
-  const current = sanitizeBranding({ ...previous, ...update });
+  return { folderSorts, folderViews };
+};
 
-  const now = new Date().toISOString();
-  const valueJson = JSON.stringify(current);
-  const existing = db
-    .prepare('SELECT id FROM system_settings WHERE category = ? AND key = ?')
-    .get('branding', 'branding');
-  if (existing) {
-    db.prepare(
-      'UPDATE system_settings SET value = ?, updated_at = ? WHERE category = ? AND key = ?'
-    ).run(valueJson, now, 'branding', 'branding');
-  } else {
-    db.prepare(
-      'INSERT INTO system_settings (id, category, key, value, updated_at) VALUES (?, ?, ?, ?, ?)'
-    ).run(generateId(), 'branding', 'branding', valueJson, now);
+/**
+ * Remember one folder's sort or view.
+ *
+ * One row per folder, so a change touches only that folder: two tabs on
+ * different folders no longer overwrite each other, and there is no ceiling on
+ * how many folders can be remembered. The row carries both preferences, so
+ * setting one must not erase the other.
+ */
+const setUserFolderPreference = async (userId, folderPath, { sort, view }) => {
+  if (!userId) {
+    throw new Error('User ID is required');
   }
 
-  return { previous, current };
+  const normalizedPath = normalizeRelativePath(folderPath);
+  const sanitizedSort = sort === undefined ? undefined : sanitizeFolderSort(sort);
+  const sanitizedView = view === undefined ? undefined : sanitizeFolderView(view);
+
+  if (!isValidFolderPath(normalizedPath) || (!sanitizedSort && !sanitizedView)) {
+    return null;
+  }
+
+  const db = await getDb();
+  const now = new Date().toISOString();
+
+  prepared(
+    db,
+    `INSERT INTO folder_preferences (user_id, path, sort_by, sort_order, view_mode, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?)
+     ON CONFLICT(user_id, path) DO UPDATE SET
+       sort_by    = COALESCE(excluded.sort_by, folder_preferences.sort_by),
+       sort_order = COALESCE(excluded.sort_order, folder_preferences.sort_order),
+       view_mode  = COALESCE(excluded.view_mode, folder_preferences.view_mode),
+       updated_at = excluded.updated_at`
+  ).run(
+    userId,
+    normalizedPath,
+    sanitizedSort?.by ?? null,
+    sanitizedSort?.order ?? null,
+    sanitizedView?.mode ?? null,
+    now
+  );
+
+  return getUserFolderPreferences(userId);
 };
 
-const setSystemSetting = async (category, key, value) => {
+const setUserFolderSort = async (userId, folderPath, sort) => {
+  const preferences = await setUserFolderPreference(userId, folderPath, { sort });
+  return preferences?.folderSorts ?? null;
+};
+
+const setUserFolderView = async (userId, folderPath, view) => {
+  const preferences = await setUserFolderPreference(userId, folderPath, { view });
+  return preferences?.folderViews ?? null;
+};
+
+const assertSystemCategory = (category) => {
   if (category !== 'branding' && category !== 'system') {
     throw new Error('Invalid category. Must be "branding" or "system"');
   }
+};
+
+/**
+ * What a section is held to before it is stored, by key.
+ *
+ * The same shaping a read applies, so a section merged over the row itself
+ * comes out as it would have come out of the settings: a field nobody sent
+ * takes the sanitiser's default, which is the one a read would have given it.
+ */
+const sanitizeSystemSetting = (key, value) => {
+  if (key === 'thumbnails') return sanitizeThumbnails(value);
+  // Strict: what is being stored was just written by somebody, and a rule that
+  // cannot be stored as they wrote it is answered rather than dropped.
+  if (key === 'access') return sanitizeAccess(value, { strict: true });
+  if (key === 'uploads') return sanitizeUploads(value);
+  if (key === 'branding') return sanitizeBranding(value);
+  if (key === 'folderSize') return sanitizeFolderSize(value);
+  // The search index had no case here, so what was stored for it was the
+  // merge as it came: paths with spaces around them, empty entries, the same
+  // folder twice. The worker was handed a sanitised copy and behaved, so only
+  // the stored value was wrong — and it is the one the next merge starts from.
+  if (key === 'searchIndex') return sanitizeSearchIndex(value);
+  if (key === 'trash') return sanitizeTrash(value);
+  if (key === 'activity') return sanitizeActivity(value);
+  if (key === 'versions') return sanitizeVersions(value);
+  return value;
+};
+
+/**
+ * What a section would be stored as, without storing it.
+ *
+ * The route checks every section of a save before writing any of them, so a
+ * section that refuses what it was sent refuses before another has been
+ * stored.
+ */
+const checkSystemSection = (key, value) => sanitizeSystemSetting(key, value);
+
+/**
+ * Set a system setting (admin only)
+ */
+const setSystemSetting = async (category, key, value) => {
+  assertSystemCategory(category);
 
   const db = await getDb();
-  const now = new Date().toISOString();
+  const sanitizedValue = sanitizeSystemSetting(key, value);
+
+  writeSystemSetting(db, category, key, sanitizedValue);
+
+  return sanitizedValue;
+};
+
+/** One section as it is stored, before any default is put around it. */
+const readStoredSection = (db, category, key) => {
+  const row = db
+    .prepare('SELECT value FROM system_settings WHERE category = ? AND key = ?')
+    .get(category, key);
+  if (!row) return {};
 
-  // Sanitize based on key
-  let sanitizedValue = value;
-  if (key === 'thumbnails') {
-    sanitizedValue = sanitizeThumbnails(value);
-  } else if (key === 'access') {
-    sanitizedValue = sanitizeAccess(value);
-  } else if (key === 'branding') {
-    sanitizedValue = sanitizeBranding(value);
-  } else if (key === 'trash') {
-    sanitizedValue = sanitizeTrash(value);
-  } else if (key === 'versions') {
-    sanitizedValue = sanitizeVersions(value);
-  } else if (key === 'uploads') {
-    sanitizedValue = sanitizeUploads(value);
-  } else if (key === 'activity') {
-    sanitizedValue = sanitizeActivity(value);
-  } else if (key === 'folderSize') {
-    sanitizedValue = sanitizeFolderSize(value);
-  } else if (key === 'searchIndex') {
-    // The search index had no case here, so what was stored for it was the
-    // merge as it came: paths with spaces around them, empty entries, the same
-    // folder twice. The worker was handed a sanitised copy and behaved, so only
-    // the stored value was wrong — and it is the one the next merge starts from.
-    sanitizedValue = sanitizeSearchIndex(value);
+  try {
+    const stored = JSON.parse(row.value);
+    return stored && typeof stored === 'object' && !Array.isArray(stored) ? stored : {};
+  } catch {
+    // An unreadable value is the section's defaults, exactly as a read treats it.
+    return {};
   }
+};
+
+/**
+ * Merge an update over one stored section and write it back, and answer the
+ * whole section as it now stands.
+ *
+ * Read and written without yielding in between — the database answers
+ * synchronously — so two saves of one section at once cannot both start from
+ * the same stored value. The route used to merge over the settings read at the
+ * start of the request, with two awaits between that read and the write: a
+ * retention of ninety days saved in one tab disappeared when the other tab
+ * saved a size cap a moment later, and the person who set it was told it was
+ * saved. Branding was taken out of this path for the same reason, where losing
+ * a save also left a logo file behind with nothing to serve or remove it.
+ */
+const mergeSystemSection = async (category, key, update) => {
+  assertSystemCategory(category);
+
+  const db = await getDb();
+  const merged = sanitizeSystemSetting(key, {
+    ...readStoredSection(db, category, key),
+    ...update,
+  });
+  writeSystemSetting(db, category, key, merged);
+  return merged;
+};
 
-  const valueJson = JSON.stringify(sanitizedValue);
+/** Store one system setting as it is, in a single synchronous step. */
+const writeSystemSetting = (db, category, key, value, now = new Date().toISOString()) => {
+  const valueJson = JSON.stringify(value);
 
   // Check if setting exists
   const existing = db
@@ -631,31 +897,71 @@ const setSystemSetting = async (category, key, value) => {
     .get(category, key);
 
   if (existing) {
-    db.prepare(
+    prepared(
+      db,
       'UPDATE system_settings SET value = ?, updated_at = ? WHERE category = ? AND key = ?'
     ).run(valueJson, now, category, key);
   } else {
-    db.prepare(
+    prepared(
+      db,
       'INSERT INTO system_settings (id, category, key, value, updated_at) VALUES (?, ?, ?, ?, ?)'
     ).run(generateId(), category, key, valueJson, now);
   }
+};
 
-  return sanitizedValue;
+/**
+ * Change the branding, and answer what it was and what it is now.
+ *
+ * Read and written without yielding in between — the database answers
+ * synchronously — so two saves at once cannot both start from the same
+ * branding: the logo a save replaced is the one it was the last to see, and
+ * removing it cannot take away the logo another save has just put in place.
+ *
+ * @returns {Promise<{previous: object, current: object}>}
+ */
+const replaceBranding = async (update) => {
+  const db = await getDb();
+  const row = db
+    .prepare('SELECT value FROM system_settings WHERE category = ? AND key = ?')
+    .get('branding', 'branding');
+
+  let stored = {};
+  if (row) {
+    try {
+      stored = JSON.parse(row.value);
+    } catch {
+      // An unreadable value is the default branding.
+    }
+  }
+
+  const previous = sanitizeBranding(stored);
+  const current = sanitizeBranding({ ...previous, ...update });
+  writeSystemSetting(db, 'branding', 'branding', current);
+  return { previous, current };
 };
 
 /**
  * Legacy method: Get all settings (for backward compatibility)
  * Returns system settings + branding
  */
-const getSettings = async () => {
-  const systemSettings = await getSystemSettings();
-  const publicSettings = await getPublicSettings();
+/**
+ * Settings, read once per request.
+ *
+ * The access rules are consulted for every path, so a bulk operation asked for
+ * these thousands of times over — each one several queries and a JSON parse,
+ * to re-read values that cannot change while a single request is running. The
+ * promise is memoized, not the value, so concurrent callers share one read.
+ */
+const getSettings = async () =>
+  cachedForRequest('settings', 'all', async () => {
+    const systemSettings = await getSystemSettings();
+    const publicSettings = await getPublicSettings();
 
-  return {
-    ...systemSettings,
-    branding: publicSettings.branding,
-  };
-};
+    return {
+      ...systemSettings,
+      branding: publicSettings.branding,
+    };
+  });
 
 /**
  * Legacy method: Set settings (for backward compatibility)
@@ -667,15 +973,25 @@ const setSettings = async (partial) => {
   // Deep merge
   const merged = {
     thumbnails: { ...current.thumbnails, ...(partial.thumbnails || {}) },
+    // Each half of the section stands on its own: saving the rules alone must
+    // not quietly switch off whether they hold administrators, and vice versa.
     access: {
       rules: partial.access?.rules !== undefined ? partial.access.rules : current.access.rules,
-      // Saved apart from the rules on the settings page, so each has to survive
-      // the other being saved on its own.
       applyToAdmins:
         partial.access?.applyToAdmins !== undefined
           ? partial.access.applyToAdmins
           : current.access.applyToAdmins,
     },
+    uploads: { ...current.uploads, ...(partial.uploads || {}) },
+    trash: { ...current.trash, ...(partial.trash || {}) },
+    versions: { ...current.versions, ...(partial.versions || {}) },
+    activity: { ...current.activity, ...(partial.activity || {}) },
+    folderSize: {
+      excludedPaths:
+        partial.folderSize?.excludedPaths !== undefined
+          ? partial.folderSize.excludedPaths
+          : current.folderSize.excludedPaths,
+    },
     branding: { ...current.branding, ...(partial.branding || {}) },
   };
 
@@ -686,54 +1002,46 @@ const setSettings = async (partial) => {
   if (partial.access) {
     merged.access = await setSystemSetting('system', 'access', merged.access);
   }
+  if (partial.folderSize) {
+    merged.folderSize = await setSystemSetting('system', 'folderSize', merged.folderSize);
+  }
   if (partial.branding) {
     merged.branding = await setSystemSetting('branding', 'branding', merged.branding);
   }
-
-  // Also update JSON for backward compatibility during transition
-  try {
-    await storage.update((data) => ({
-      ...data,
-      settings: {
-        thumbnails: merged.thumbnails,
-        access: merged.access,
-        branding: merged.branding,
-      },
-    }));
-  } catch (err) {
-    // Non-fatal, continue
+  if (partial.uploads) {
+    merged.uploads = await setSystemSetting('system', 'uploads', merged.uploads);
+  }
+  if (partial.trash) {
+    merged.trash = await setSystemSetting('system', 'trash', merged.trash);
+  }
+  if (partial.versions) {
+    merged.versions = await setSystemSetting('system', 'versions', merged.versions);
+  }
+  if (partial.activity) {
+    merged.activity = await setSystemSetting('system', 'activity', merged.activity);
   }
 
   return merged;
 };
 
-/**
- * Update settings with an updater function
- */
-const updateSettings = async (updater) => {
-  const current = await getSettings();
-  const next = typeof updater === 'function' ? updater(current) : current;
-  return setSettings(next);
-};
-
 module.exports = {
-  replaceBranding,
-  USER_SETTING_KEYS,
-  MAX_UPLOAD_CHUNK_SIZE_BYTES,
+  checkSystemSection,
   getPublicSettings,
-  sanitizeAccess,
+  getUserSettings,
+  getSystemSettings,
   sanitizeTrash,
   sanitizeVersions,
   sanitizeActivity,
-  sanitizeFolderSize,
-  sanitizeSearchIndex,
-  getUserSettings,
-  getSystemSettings,
   getSettingsForUser,
   setUserSetting,
+  WRITABLE_USER_SETTINGS,
+  setUserFolderSort,
+  setUserFolderView,
   setSystemSetting,
+  mergeSystemSection,
+  replaceBranding,
+  MAX_UPLOAD_CHUNK_SIZE_BYTES,
   // Legacy methods for backward compatibility
   getSettings,
   setSettings,
-  updateSettings,
 };
diff --git a/backend/src/services/sharesService.js b/backend/src/services/sharesService.js
index f9d785f39..9bcf28cf4 100644
--- a/backend/src/services/sharesService.js
+++ b/backend/src/services/sharesService.js
@@ -1,15 +1,9 @@
 const crypto = require('crypto');
 const bcrypt = require('bcryptjs');
-const { getDb } = require('./db');
+const { getDb, prepared } = require('./db');
+const { generateId, nowIso } = require('../utils/ids');
 const logger = require('../utils/logger');
 
-const nowIso = () => new Date().toISOString();
-
-const generateId = () =>
-  typeof crypto.randomUUID === 'function'
-    ? crypto.randomUUID()
-    : `${Date.now().toString(36)}-${crypto.randomBytes(8).toString('hex')}`;
-
 /**
  * Generate a URL-safe share token
  * Uses base62 encoding for readability (no special characters)
@@ -37,6 +31,13 @@ const toClientShare = (row) => {
     sourcePath: row.source_path,
     isDirectory: Boolean(row.is_directory),
     accessMode: row.access_mode,
+    allowDelete: row.allow_delete !== 0,
+    allowCreateFolder: row.allow_create_folder !== 0,
+    allowCreateFile: row.allow_create_file !== 0,
+    allowUpload: row.allow_upload !== 0,
+    allowDownload: row.allow_download !== 0,
+    versionsVisible: row.versions_visible === 1,
+    versionsDownload: row.versions_download === 1,
     sharingType: row.sharing_type,
     hasPassword: Boolean(row.password_hash),
     expiresAt: row.expires_at || null,
@@ -44,6 +45,9 @@ const toClientShare = (row) => {
     accessCount: row.access_count || 0,
     downloadCount: row.download_count || 0,
     lastAccessedAt: row.last_accessed_at || null,
+    lastAccessIp: row.last_access_ip || null,
+    lastDownloadedAt: row.last_downloaded_at || null,
+    lastDownloadIp: row.last_download_ip || null,
     createdAt: row.created_at,
     updatedAt: row.updated_at,
   };
@@ -58,6 +62,13 @@ const createShare = async ({
   sourcePath,
   isDirectory = false,
   accessMode = 'readonly',
+  allowDelete = true,
+  allowCreateFolder = true,
+  allowCreateFile = true,
+  allowUpload = true,
+  allowDownload = true,
+  versionsVisible,
+  versionsDownload,
   sharingType = 'anyone',
   password = null,
   userIds = [],
@@ -88,6 +99,20 @@ const createShare = async ({
     throw e;
   }
 
+  const operationPermissions = {
+    allowDelete,
+    allowCreateFolder,
+    allowCreateFile,
+    allowUpload,
+  };
+  for (const [key, value] of Object.entries(operationPermissions)) {
+    if (typeof value !== 'boolean') {
+      const e = new Error(`${key} must be a boolean`);
+      e.status = 400;
+      throw e;
+    }
+  }
+
   if (!['anyone', 'users'].includes(sharingType)) {
     const e = new Error('Invalid sharing type');
     e.status = 400;
@@ -100,6 +125,21 @@ const createShare = async ({
     throw e;
   }
 
+  // A share with named accounts shows the history they would see anyway; a link
+  // for anyone shows none until its owner decides otherwise.
+  const historyByDefault = sharingType === 'users';
+  const history = {
+    versionsVisible: versionsVisible === undefined ? historyByDefault : versionsVisible,
+    versionsDownload: versionsDownload === undefined ? historyByDefault : versionsDownload,
+  };
+  for (const [key, value] of Object.entries(history)) {
+    if (typeof value !== 'boolean') {
+      const e = new Error(`${key} must be a boolean`);
+      e.status = 400;
+      throw e;
+    }
+  }
+
   const db = await getDb();
   const shareId = generateId();
   const shareToken = generateShareToken(10);
@@ -107,13 +147,15 @@ const createShare = async ({
   const passwordHash = password ? await bcrypt.hash(password, 10) : null;
 
   // Create share
-  db.prepare(
+  prepared(
+    db,
     `
     INSERT INTO shares (
       id, share_token, owner_id, source_space, source_path, is_directory,
-      access_mode, sharing_type, password_hash, expires_at, label,
-      download_count, created_at, updated_at
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?)
+      access_mode, allow_delete, allow_create_folder, allow_create_file, allow_upload,
+      allow_download, sharing_type, password_hash, expires_at, label, download_count,
+      created_at, updated_at, versions_visible, versions_download
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)
   `
   ).run(
     shareId,
@@ -123,20 +165,30 @@ const createShare = async ({
     sourcePath,
     isDirectory ? 1 : 0,
     accessMode,
+    allowDelete ? 1 : 0,
+    allowCreateFolder ? 1 : 0,
+    allowCreateFile ? 1 : 0,
+    allowUpload ? 1 : 0,
+    allowDownload ? 1 : 0,
     sharingType,
     passwordHash,
     expiresAt,
     label,
     now,
-    now
+    now,
+    history.versionsVisible ? 1 : 0,
+    history.versionsDownload ? 1 : 0
   );
 
   // Add user permissions if user-specific share
   if (sharingType === 'users' && Array.isArray(userIds) && userIds.length > 0) {
-    const insertPerm = db.prepare(`
+    const insertPerm = prepared(
+      db,
+      `
       INSERT INTO share_permissions (id, share_id, user_id, created_at)
       VALUES (?, ?, ?, ?)
-    `);
+    `
+    );
 
     for (const userId of userIds) {
       try {
@@ -158,7 +210,7 @@ const createShare = async ({
  */
 const getShareById = async (shareId) => {
   const db = await getDb();
-  const row = db.prepare('SELECT * FROM shares WHERE id = ?').get(shareId);
+  const row = prepared(db, 'SELECT * FROM shares WHERE id = ?').get(shareId);
   if (!row) return null;
 
   const share = toClientShare(row);
@@ -183,7 +235,7 @@ const getShareById = async (shareId) => {
  */
 const getShareByToken = async (token) => {
   const db = await getDb();
-  const row = db.prepare('SELECT * FROM shares WHERE share_token = ?').get(token);
+  const row = prepared(db, 'SELECT * FROM shares WHERE share_token = ?').get(token);
   if (!row) return null;
 
   const share = toClientShare(row);
@@ -274,13 +326,28 @@ const getSharesForUser = async (userId) => {
  */
 const updateShare = async (shareId, updates = {}) => {
   const db = await getDb();
-  const existing = db.prepare('SELECT * FROM shares WHERE id = ?').get(shareId);
+  const existing = prepared(db, 'SELECT * FROM shares WHERE id = ?').get(shareId);
   if (!existing) {
     const e = new Error('Share not found');
     e.status = 404;
     throw e;
   }
 
+  const effectiveSharingType = updates.sharingType || existing.sharing_type;
+  const hasUserIdsUpdate = 'userIds' in updates;
+  if (effectiveSharingType === 'users' && hasUserIdsUpdate) {
+    if (!Array.isArray(updates.userIds) || updates.userIds.length === 0) {
+      const e = new Error('At least one user is required for user-specific shares');
+      e.status = 400;
+      throw e;
+    }
+  }
+  if (effectiveSharingType === 'users' && existing.sharing_type !== 'users' && !hasUserIdsUpdate) {
+    const e = new Error('At least one user is required for user-specific shares');
+    e.status = 400;
+    throw e;
+  }
+
   const fields = [];
   const values = [];
 
@@ -292,6 +359,26 @@ const updateShare = async (shareId, updates = {}) => {
     values.push(updates.accessMode);
   }
 
+  const operationPermissionFields = [
+    ['allowDelete', 'allow_delete'],
+    ['allowCreateFolder', 'allow_create_folder'],
+    ['allowCreateFile', 'allow_create_file'],
+    ['allowUpload', 'allow_upload'],
+    ['allowDownload', 'allow_download'],
+    ['versionsVisible', 'versions_visible'],
+    ['versionsDownload', 'versions_download'],
+  ];
+  for (const [key, column] of operationPermissionFields) {
+    if (!(key in updates)) continue;
+    if (typeof updates[key] !== 'boolean') {
+      const e = new Error(`${key} must be a boolean`);
+      e.status = 400;
+      throw e;
+    }
+    fields.push(`${column} = ?`);
+    values.push(updates[key] ? 1 : 0);
+  }
+
   if (
     typeof updates.sharingType === 'string' &&
     ['anyone', 'users'].includes(updates.sharingType)
@@ -326,29 +413,30 @@ const updateShare = async (shareId, updates = {}) => {
     values.push(updates.label);
   }
 
-  if (fields.length === 0) {
-    return getShareById(shareId);
-  }
-
-  fields.push('updated_at = ?');
-  values.push(nowIso());
-  values.push(shareId);
+  const permissionsWillChange =
+    hasUserIdsUpdate || (effectiveSharingType === 'anyone' && existing.sharing_type === 'users');
+  if (fields.length > 0 || permissionsWillChange) {
+    fields.push('updated_at = ?');
+    values.push(nowIso());
+    values.push(shareId);
 
-  db.prepare(`UPDATE shares SET ${fields.join(', ')} WHERE id = ?`).run(...values);
-
-  // Update user permissions if provided and sharing type is 'users'
-  if ('userIds' in updates && Array.isArray(updates.userIds)) {
-    const sharingType = updates.sharingType || existing.sharing_type;
+    prepared(db, `UPDATE shares SET ${fields.join(', ')} WHERE id = ?`).run(...values);
+  }
 
-    if (sharingType === 'users') {
-      // Remove all existing permissions
-      db.prepare('DELETE FROM share_permissions WHERE share_id = ?').run(shareId);
+  // A permission list is meaningful only for user-specific shares. Always clear
+  // it when switching back to an anyone link so revoked recipients have no stale
+  // database entries left behind.
+  if (hasUserIdsUpdate || effectiveSharingType === 'anyone') {
+    prepared(db, 'DELETE FROM share_permissions WHERE share_id = ?').run(shareId);
 
-      // Add new permissions
-      const insertPerm = db.prepare(`
+    if (effectiveSharingType === 'users') {
+      const insertPerm = prepared(
+        db,
+        `
         INSERT INTO share_permissions (id, share_id, user_id, created_at)
         VALUES (?, ?, ?, ?)
-      `);
+      `
+      );
 
       const now = nowIso();
       for (const userId of updates.userIds) {
@@ -381,7 +469,7 @@ const updateShare = async (shareId, updates = {}) => {
  */
 const deleteShare = async (shareId) => {
   const db = await getDb();
-  const result = db.prepare('DELETE FROM shares WHERE id = ?').run(shareId);
+  const result = prepared(db, 'DELETE FROM shares WHERE id = ?').run(shareId);
   return result.changes > 0;
 };
 
@@ -391,7 +479,63 @@ const normalizeShareSourcePath = (sourcePath = '') =>
     .replace(/^\/+/, '')
     .replace(/\/+$/, '');
 
-const escapeLikePattern = (value = '') => String(value).replace(/[\\%_]/g, '\\$&');
+/**
+ * The shares inside a folder, found by bounds on the path: every path that
+ * begins with `prefix/` sorts at or after it and before `prefix0`, `0` being
+ * the character right after `/`.
+ *
+ * `LIKE 'prefix/%'` ignored case, as SQLite's LIKE always does for ASCII:
+ * deleting `Docs` counted, and then deleted, the share links of `docs/…` —
+ * another folder on a Linux volume, and somebody else's links as often as not.
+ */
+const CHILD_SHARES_SQL =
+  'SELECT * FROM shares WHERE source_space = ? AND source_path >= ? AND source_path < ?';
+const childRange = (prefix) => [`${prefix}/`, `${prefix}0`];
+
+/**
+ * Shares affected by each target, in one pass.
+ *
+ * A bulk delete asked this per file — three thousand round trips through the
+ * database to answer a question the whole selection could ask once. Returned
+ * as a map so each entry still knows which shares are its own.
+ */
+const getSharesBySourceTarget = async (targets = []) => {
+  const byTarget = new Map();
+  const normalized = (Array.isArray(targets) ? targets : [])
+    .map((target) => ({
+      key: `${target?.sourceSpace}:${normalizeShareSourcePath(target?.sourcePath)}`,
+      sourceSpace: target?.sourceSpace,
+      sourcePath: normalizeShareSourcePath(target?.sourcePath),
+      includeChildren: Boolean(target?.includeChildren),
+    }))
+    .filter((target) => target.sourceSpace && target.sourcePath);
+
+  if (normalized.length === 0) return byTarget;
+
+  const db = await getDb();
+  const exactQuery = prepared(
+    db,
+    'SELECT * FROM shares WHERE source_space = ? AND source_path = ?'
+  );
+  const childQuery = prepared(db, CHILD_SHARES_SQL);
+
+  for (const target of normalized) {
+    if (byTarget.has(target.key)) continue;
+    const rows = new Map();
+    exactQuery.all(target.sourceSpace, target.sourcePath).forEach((row) => rows.set(row.id, row));
+    if (target.includeChildren) {
+      childQuery
+        .all(target.sourceSpace, ...childRange(target.sourcePath))
+        .forEach((row) => rows.set(row.id, row));
+    }
+    byTarget.set(target.key, Array.from(rows.values()).map(toClientShare));
+  }
+
+  return byTarget;
+};
+
+const shareTargetKey = (target) =>
+  `${target?.sourceSpace}:${normalizeShareSourcePath(target?.sourcePath)}`;
 
 const getSharesForSourceTargets = async (targets = []) => {
   const normalizedTargets = (Array.isArray(targets) ? targets : [])
@@ -409,20 +553,18 @@ const getSharesForSourceTargets = async (targets = []) => {
   const db = await getDb();
   const sharesById = new Map();
 
-  const exactQuery = db.prepare('SELECT * FROM shares WHERE source_space = ? AND source_path = ?');
-  const childQuery = db.prepare(
-    "SELECT * FROM shares WHERE source_space = ? AND source_path LIKE ? ESCAPE '\\'"
+  const exactQuery = prepared(
+    db,
+    'SELECT * FROM shares WHERE source_space = ? AND source_path = ?'
   );
+  const childQuery = prepared(db, CHILD_SHARES_SQL);
 
   for (const target of normalizedTargets) {
     const exactRows = exactQuery.all(target.sourceSpace, target.sourcePath);
     exactRows.forEach((row) => sharesById.set(row.id, row));
 
     if (target.includeChildren) {
-      const childRows = childQuery.all(
-        target.sourceSpace,
-        `${escapeLikePattern(target.sourcePath)}/%`
-      );
+      const childRows = childQuery.all(target.sourceSpace, ...childRange(target.sourcePath));
       childRows.forEach((row) => sharesById.set(row.id, row));
     }
   }
@@ -437,7 +579,7 @@ const deleteSharesByIds = async (shareIds = []) => {
   }
 
   const db = await getDb();
-  const deleteOne = db.prepare('DELETE FROM shares WHERE id = ?');
+  const deleteOne = prepared(db, 'DELETE FROM shares WHERE id = ?');
   const transaction = db.transaction((ids) => {
     let changes = 0;
     ids.forEach((id) => {
@@ -454,7 +596,7 @@ const deleteSharesByIds = async (shareIds = []) => {
  */
 const verifySharePassword = async (shareId, password) => {
   const db = await getDb();
-  const row = db.prepare('SELECT password_hash FROM shares WHERE id = ?').get(shareId);
+  const row = prepared(db, 'SELECT password_hash FROM shares WHERE id = ?').get(shareId);
 
   if (!row) {
     return false;
@@ -469,9 +611,6 @@ const verifySharePassword = async (shareId, password) => {
     return false;
   }
 
-  // The asynchronous form: this is reachable without an account, and the
-  // synchronous one stops the server doing anything else for the length of
-  // the hash.
   return bcrypt.compare(password, row.password_hash);
 };
 
@@ -480,7 +619,7 @@ const verifySharePassword = async (shareId, password) => {
  */
 const hasUserPermission = async (shareId, userId) => {
   const db = await getDb();
-  const share = db.prepare('SELECT sharing_type, owner_id FROM shares WHERE id = ?').get(shareId);
+  const share = prepared(db, 'SELECT sharing_type, owner_id FROM shares WHERE id = ?').get(shareId);
 
   if (!share) {
     return false;
@@ -525,19 +664,15 @@ const isShareExpired = (share) => {
 };
 
 /**
- * Somebody opened the share.
- *
- * Opening it is not downloading from it: this used to raise the download
- * counter, so the number an owner was shown counted page loads, reloads and
- * every folder they browsed inside the share. A link opened twenty times and
- * never downloaded from read as twenty downloads.
+ * Update share access tracking
  */
 const trackShareAccess = async (shareId, { ipAddress = null } = {}) => {
   const db = await getDb();
-  db.prepare(
+  prepared(
+    db,
     `
     UPDATE shares
-    SET access_count = COALESCE(access_count, 0) + 1,
+    SET access_count = access_count + 1,
         last_accessed_at = ?,
         last_access_ip = ?
     WHERE id = ?
@@ -545,15 +680,18 @@ const trackShareAccess = async (shareId, { ipAddress = null } = {}) => {
   ).run(nowIso(), ipAddress, shareId);
 };
 
-/** Something was actually sent: a file left through the link. */
+/**
+ * Update share download tracking
+ */
 const trackShareDownload = async (shareId, { ipAddress = null } = {}) => {
   const db = await getDb();
-  db.prepare(
+  prepared(
+    db,
     `
     UPDATE shares
-    SET download_count = COALESCE(download_count, 0) + 1,
-        last_accessed_at = ?,
-        last_access_ip = ?
+    SET download_count = download_count + 1,
+        last_downloaded_at = ?,
+        last_download_ip = ?
     WHERE id = ?
   `
   ).run(nowIso(), ipAddress, shareId);
@@ -564,7 +702,7 @@ const trackShareDownload = async (shareId, { ipAddress = null } = {}) => {
  */
 const getShareStats = async (shareId) => {
   const db = await getDb();
-  const share = db.prepare('SELECT * FROM shares WHERE id = ?').get(shareId);
+  const share = prepared(db, 'SELECT * FROM shares WHERE id = ?').get(shareId);
   if (!share) return null;
 
   // Count guest sessions
@@ -580,6 +718,9 @@ const getShareStats = async (shareId) => {
     accessCount: share.access_count || 0,
     downloadCount: share.download_count || 0,
     lastAccessedAt: share.last_accessed_at || null,
+    lastAccessIp: share.last_access_ip || null,
+    lastDownloadedAt: share.last_downloaded_at || null,
+    lastDownloadIp: share.last_download_ip || null,
     guestSessionCount: guestSessions?.count || 0,
   };
 };
@@ -606,6 +747,8 @@ module.exports = {
   getShareByToken,
   getSharesByOwnerId,
   getSharesForSourceTargets,
+  getSharesBySourceTarget,
+  shareTargetKey,
   getSharesForUser,
   updateShare,
   deleteShare,
diff --git a/backend/src/services/userSearchService.js b/backend/src/services/userSearchService.js
index 7351d540a..158b80561 100644
--- a/backend/src/services/userSearchService.js
+++ b/backend/src/services/userSearchService.js
@@ -81,21 +81,25 @@ const searchUsersForMentions = async (query, limit = 10) => {
 };
 
 /**
- * Who can be mentioned in a comment.
+ * Everyone who can be mentioned, without a search term.
  *
- * ONLYOFFICE asks for the whole list and filters it in the editor as the
- * comment is typed, so this answers with names and addresses rather than to a
- * query.
+ * ONLYOFFICE asks for the list once and filters it in the editor as the comment
+ * is typed, so there is nothing to search on here — which is why this cannot go
+ * through `searchLocalUsers`, whose pattern match is what makes it safe to run
+ * on user input in the first place. Bounded by `limit` for the same reason a
+ * search is: an unbounded list is a mistake waiting for a large deployment.
  */
 const listUsersForMentions = async (limit = 100) => {
   try {
     const db = await getDb();
     const rows = db
       .prepare(
-        `SELECT id, email, username, display_name
-           FROM users
-          ORDER BY display_name ASC, email ASC
-          LIMIT ?`
+        `
+      SELECT id, email, username, display_name
+      FROM users
+      ORDER BY display_name ASC, email ASC
+      LIMIT ?
+    `
       )
       .all(limit);
 
@@ -111,7 +115,7 @@ const listUsersForMentions = async (limit = 100) => {
 };
 
 module.exports = {
-  listUsersForMentions,
   searchUsersForMentions,
   searchLocalUsers,
+  listUsersForMentions,
 };
diff --git a/backend/src/services/userVolumesService.js b/backend/src/services/userVolumesService.js
index 82ab52ed5..b82fc6f84 100644
--- a/backend/src/services/userVolumesService.js
+++ b/backend/src/services/userVolumesService.js
@@ -4,8 +4,6 @@ const fs = require('fs/promises');
 const { getDb } = require('./db');
 const { generateId, nowIso } = require('../utils/ids');
 
-
-
 const RESERVED_VOLUME_LABELS = new Set(['personal', 'share', 'volumes']);
 
 const assertValidVolumeLabel = (labelRaw) => {
diff --git a/backend/src/services/users/index.js b/backend/src/services/users/index.js
index 4e9a262da..e52fe267e 100644
--- a/backend/src/services/users/index.js
+++ b/backend/src/services/users/index.js
@@ -35,8 +35,8 @@ module.exports = {
 
   // OIDC authentication
   getOrCreateOidcUser: oidcAuth.getOrCreateOidcUser,
-  deriveRolesFromClaims: oidcAuth.deriveRolesFromClaims,
   rolesFromClaimsAreAuthoritative: oidcAuth.rolesFromClaimsAreAuthoritative,
+  deriveRolesFromClaims: oidcAuth.deriveRolesFromClaims,
 
   // Request user handling
   getRequestUser: requestUser.getRequestUser,
diff --git a/backend/src/services/users/management.js b/backend/src/services/users/management.js
index d6d0e6699..eea8cabe2 100644
--- a/backend/src/services/users/management.js
+++ b/backend/src/services/users/management.js
@@ -1,5 +1,5 @@
 const { getDb } = require('../db');
-const { toClientUser, toShareableUser, normalizeEmail, nowIso } = require('./utils');
+const { toClientUser, toShareableUser, normalizeEmail, nowIso, usernameTaken } = require('./utils');
 const { countAdmins } = require('./queries');
 
 const listUsers = async () => {
@@ -75,6 +75,12 @@ const updateUserProfile = async ({ userId, email, username, displayName }) => {
 
   if (typeof username === 'string') {
     const trimmed = username.trim();
+    // A username is something to sign in with, so it has to name one account.
+    if (trimmed && usernameTaken(db, trimmed, userId)) {
+      const err = new Error('Username already in use.');
+      err.status = 409;
+      throw err;
+    }
     updates.push('username = ?');
     values.push(trimmed || null);
   }
@@ -132,8 +138,24 @@ const deleteUser = async ({ userId }) => {
     /* ignore parse errors */
   }
 
-  // Delete user (cascade will delete auth_methods)
-  db.prepare('DELETE FROM users WHERE id = ?').run(userId);
+  // One transaction. The account goes (its auth_methods cascade with it); its
+  // folder name stays reserved while its folder is on disk (personalFolders.js);
+  // and the rows that only ever described this account go too — none of these
+  // tables points at users through a foreign key, so nothing else removes them.
+  db.transaction(() => {
+    if (row.personal_folder_name) {
+      db.prepare(
+        'INSERT OR REPLACE INTO personal_folder_reservations (name, user_id, reserved_at) VALUES (?, ?, ?)'
+      ).run(row.personal_folder_name, userId, new Date().toISOString());
+    }
+    db.prepare('DELETE FROM folder_preferences WHERE user_id = ?').run(userId);
+    db.prepare('DELETE FROM recent_destinations WHERE user_id = ?').run(userId);
+    db.prepare('DELETE FROM auth_locks WHERE key = ?').run(userId);
+    // Its API tokens do cascade, and are removed here all the same: a way into
+    // an account is the one leftover worth writing twice.
+    db.prepare('DELETE FROM api_tokens WHERE user_id = ?').run(userId);
+    db.prepare('DELETE FROM users WHERE id = ?').run(userId);
+  })();
   return true;
 };
 
diff --git a/backend/src/services/users/requestUser.js b/backend/src/services/users/requestUser.js
index 5693e9154..379486708 100644
--- a/backend/src/services/users/requestUser.js
+++ b/backend/src/services/users/requestUser.js
@@ -2,6 +2,22 @@ const { getDb } = require('../db');
 const { auth: envAuthConfig } = require('../../config/index');
 const { toClientUser, normalizeEmail } = require('./utils');
 const { deriveRolesFromClaims } = require('./oidcAuth');
+const { claimPersonalFolderName } = require('../personalFolders');
+
+/**
+ * An account that has no folder name yet gets one here.
+ *
+ * The migration gave every account that existed a name; this covers the ones
+ * created since, wherever they were created from, without every creation path
+ * having to remember. It writes once in an account's life and reads a column
+ * that was already loaded, so the cost after that is a null check.
+ */
+const withPersonalFolder = (db, row) => {
+  if (row && !row.personal_folder_name) {
+    row.personal_folder_name = claimPersonalFolderName(db, row);
+  }
+  return row;
+};
 
 const getRequestUser = async (req) => {
   // Synthetic or pre-populated user (e.g., AUTH_ENABLED=false)
@@ -22,10 +38,10 @@ const getRequestUser = async (req) => {
     const db = await getDb();
     const row = db.prepare('SELECT * FROM users WHERE id = ?').get(req.apiToken.userId);
     if (!row) return null;
-    const user = toClientUser(row);
+    const user = toClientUser(withPersonalFolder(db, row));
     if (user) {
       // Which kind of account this is lives in `auth_methods` rather than on
-      // the row.
+      // the row — the column that used to say so was carried there years ago.
       const local = db
         .prepare(
           `SELECT 1 FROM auth_methods
@@ -42,7 +58,7 @@ const getRequestUser = async (req) => {
   if (req?.session?.localUserId) {
     const db = await getDb();
     const row = db.prepare('SELECT * FROM users WHERE id = ?').get(req.session.localUserId);
-    const user = toClientUser(row);
+    const user = toClientUser(withPersonalFolder(db, row));
     if (user) {
       user.provider = 'local';
     }
@@ -73,7 +89,7 @@ const getRequestUser = async (req) => {
 
     if (authMethod) {
       const row = db.prepare('SELECT * FROM users WHERE id = ?').get(authMethod.user_id);
-      const user = toClientUser(row);
+      const user = toClientUser(withPersonalFolder(db, row));
       if (user) {
         user.provider = 'oidc';
         user.oidcIssuer = issuer;
@@ -111,6 +127,21 @@ const getRequestUser = async (req) => {
         roles,
         createdAt: null,
         updatedAt: null,
+        // The subject, not the username.
+        //
+        // This account has no row yet, so there is no claimed folder name to
+        // carry and nothing to claim one against. Left null, the folder would be
+        // derived from `USER_FOLDER_NAME_ORDER` — and the order the reference
+        // recommends for reusing /home puts `username` first, which two
+        // identities from two providers can share. The claim mechanism exists to
+        // stop exactly that, and it cannot run here.
+        //
+        // The subject is unique to the provider that issued it, so it is a
+        // folder of this account's own. It is deliberately not the folder the
+        // account will get once its row exists: that one is claimed, recorded
+        // and permanent, and guessing at it here would be handing out a name
+        // nothing had reserved.
+        personalFolderName: `oidc-${claims.sub}`,
       };
     } catch (_) {
       return null;
diff --git a/backend/src/utils/env.js b/backend/src/utils/env.js
index dca4b8b92..299ccea8b 100644
--- a/backend/src/utils/env.js
+++ b/backend/src/utils/env.js
@@ -22,7 +22,11 @@ const parseByteSize = (value) => {
 
   const s = value.trim();
   if (!s) return null;
-  const m = s.match(/^([0-9]+)\s*([kKmMgGtT]?)b?$/);
+  // `5MB` is how everyone writes it, the README included, and it used to be
+  // rejected outright for the capital B — leaving the setting silently at its
+  // default. Spaces and either case are accepted; the unit is what carries the
+  // meaning, and `5 mb`, `5MB` and `5m` all mean the same thing to a reader.
+  const m = s.match(/^([0-9]+)\s*([kKmMgGtT]?)[bB]?$/);
   if (!m) return null;
   const num = Number(m[1]);
   if (!Number.isFinite(num)) return null;
diff --git a/backend/src/utils/ownedTree.js b/backend/src/utils/ownedTree.js
index d6bf5222c..eb824fd71 100644
--- a/backend/src/utils/ownedTree.js
+++ b/backend/src/utils/ownedTree.js
@@ -40,7 +40,6 @@ const takeInventory = async (root) => {
     owned.add(identityOf(stats));
     if (!stats.isDirectory()) return;
     for (const name of await fs.readdir(entryPath)) {
-      // eslint-disable-next-line no-await-in-loop
       await walk(path.join(entryPath, name));
     }
   };
@@ -73,7 +72,6 @@ const removeInventoried = async (root, inventory) => {
     }
 
     for (const name of await fs.readdir(entryPath)) {
-      // eslint-disable-next-line no-await-in-loop
       await visit(path.join(entryPath, name));
     }
     if (!ours) {
diff --git a/backend/tests/config/archive-bounds.test.js b/backend/tests/config/archive-bounds.test.js
new file mode 100644
index 000000000..bbc37163a
--- /dev/null
+++ b/backend/tests/config/archive-bounds.test.js
@@ -0,0 +1,133 @@
+import { describe, it, expect, afterEach } from 'vitest';
+
+import { modulePath } from '../helpers/env-test-utils.js';
+
+/**
+ * The two bounds on browsing inside an archive.
+ *
+ * `archiveCacheService` reads both of them, and nothing defined either. In
+ * JavaScript that is not an error, it is `undefined`, and every comparison
+ * against `undefined` is false — so the guards were the wrong way round in two
+ * different directions at once:
+ *
+ *   - `innerSize > browseMaxBytes` was never true, so no archive was ever too
+ *     large to look inside. A .tar.gz of any size was decompressed whole into
+ *     the cache so its listing could be shown, which is the one thing that
+ *     guard exists to prevent.
+ *   - `total <= cacheMaxBytes` was never true either, so the sweep never
+ *     returned early and never stopped: it removed every cached copy it found,
+ *     on every pass, and each archive was decompressed again from scratch the
+ *     next time somebody opened it.
+ *
+ * Asserted against the configuration rather than the service, because that is
+ * where the numbers were missing, and a service test would have passed just as
+ * happily against `undefined`.
+ */
+
+const load = () => {
+  delete require.cache[require.resolve(modulePath('src/config/index.js'))];
+  delete require.cache[require.resolve(modulePath('src/config/env.js'))];
+  return require(modulePath('src/config/index.js'));
+};
+
+const withEnv = (values, run) => {
+  const previous = {};
+  for (const [key, value] of Object.entries(values)) {
+    previous[key] = process.env[key];
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+  try {
+    return run();
+  } finally {
+    for (const [key, value] of Object.entries(previous)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  }
+};
+
+afterEach(() => load());
+
+describe('the bounds on browsing inside an archive', () => {
+  it('gives both of them a number, so every comparison against them means something', () => {
+    const { archives } = withEnv(
+      { MAX_BROWSABLE_ARCHIVE_SIZE: undefined, ARCHIVE_CACHE_MAX_SIZE: undefined },
+      load
+    );
+
+    expect(Number.isFinite(archives.browseMaxBytes)).toBe(true);
+    expect(Number.isFinite(archives.cacheMaxBytes)).toBe(true);
+    expect(archives.browseMaxBytes).toBeGreaterThan(0);
+    expect(archives.cacheMaxBytes).toBeGreaterThan(0);
+  });
+
+  /**
+   * The comparisons as `archiveCacheService` writes them. Undefined passes the
+   * first assertion above in no version of this — but it also has to be said
+   * the way the code says it, because that is where it went wrong.
+   */
+  it('refuses an archive larger than the bound, and admits one under it', () => {
+    const { archives } = load();
+
+    expect(archives.browseMaxBytes + 1 > archives.browseMaxBytes).toBe(true);
+    expect(1 > archives.browseMaxBytes).toBe(false);
+  });
+
+  it('lets a cache under the bound alone, and sweeps one over it', () => {
+    const { archives } = load();
+
+    expect(1 <= archives.cacheMaxBytes).toBe(true);
+    expect(archives.cacheMaxBytes + 1 <= archives.cacheMaxBytes).toBe(false);
+  });
+
+  it('takes the size an administrator sets', () => {
+    const { archives } = withEnv(
+      { MAX_BROWSABLE_ARCHIVE_SIZE: '512MB', ARCHIVE_CACHE_MAX_SIZE: '1GB' },
+      load
+    );
+
+    expect(archives.browseMaxBytes).toBe(512 * 1024 * 1024);
+    expect(archives.cacheMaxBytes).toBe(1024 * 1024 * 1024);
+  });
+
+  it('falls back rather than failing the start when the value is not a size', () => {
+    const { archives } = withEnv(
+      { MAX_BROWSABLE_ARCHIVE_SIZE: 'as much as it takes', ARCHIVE_CACHE_MAX_SIZE: '-1' },
+      load
+    );
+
+    expect(archives.browseMaxBytes).toBe(2 * 1024 * 1024 * 1024);
+    expect(archives.cacheMaxBytes).toBe(8 * 1024 * 1024 * 1024);
+  });
+});
+
+/**
+ * Every size an administrator can set, and the capital B.
+ *
+ * `5MB` is how the README writes it and how everyone writes it, and the parser
+ * rejected it for the capital B alone — returning null, which every setting
+ * reads as "not set" and answers with its default. Ten settings took their
+ * default from a value that had been given: the upload chunk size, the search
+ * and editor ceilings, the JSON body limit, the direct-upload limit, the
+ * storage reserve, both archive bounds, the trash quota and the preview ceiling.
+ */
+describe('a size, however it is written', () => {
+  const sizes = () => require(modulePath('src/utils/env.js')).parseByteSize;
+
+  it.each([
+    ['512M', 512 * 1024 * 1024],
+    ['512MB', 512 * 1024 * 1024],
+    ['512mb', 512 * 1024 * 1024],
+    ['512 MB', 512 * 1024 * 1024],
+    ['2GB', 2 * 1024 * 1024 * 1024],
+    ['1k', 1024],
+    ['4096', 4096],
+  ])('reads %s', (written, bytes) => {
+    expect(sizes()(written)).toBe(bytes);
+  });
+
+  it.each(['512Mo', 'as much as it takes', '', '5 5MB'])('refuses %s', (written) => {
+    expect(sizes()(written)).toBe(null);
+  });
+});
diff --git a/backend/tests/helpers/substitute-module.js b/backend/tests/helpers/substitute-module.js
new file mode 100644
index 000000000..38c6b659f
--- /dev/null
+++ b/backend/tests/helpers/substitute-module.js
@@ -0,0 +1,36 @@
+const { createRequire } = require('node:module');
+
+/**
+ * Stand `exports` in for what `fromFile` receives when it requires `request`,
+ * until the returned function is called.
+ *
+ * For the rare collaborator a test cannot otherwise bring into the state it
+ * needs — a write that has begun and not yet finished. The request is resolved
+ * from `fromFile`, exactly as the code under test resolves it, so the stand-in
+ * is the module that code actually gets. Require the code under test after
+ * this, and restore once whatever it started has been stopped.
+ */
+const substituteModule = (fromFile, request, exports) => {
+  const localRequire = createRequire(fromFile);
+  const resolved = localRequire.resolve(request);
+  const previous = localRequire.cache[resolved];
+
+  localRequire.cache[resolved] = {
+    id: resolved,
+    filename: resolved,
+    loaded: true,
+    exports,
+    children: [],
+    paths: [],
+  };
+
+  return () => {
+    if (previous) {
+      localRequire.cache[resolved] = previous;
+    } else {
+      delete localRequire.cache[resolved];
+    }
+  };
+};
+
+module.exports = { substituteModule };
diff --git a/backend/tests/openapi/tour.js b/backend/tests/openapi/tour.js
index 4fc6a46bc..c63ab2b0c 100644
--- a/backend/tests/openapi/tour.js
+++ b/backend/tests/openapi/tour.js
@@ -353,6 +353,7 @@ const tour = async (app, { volume, requireFresh }) => {
       destination: 'Documents/Projets',
     })
   );
+  await call('GET /api/files/recent-destinations', admin.get('/api/files/recent-destinations'));
   await call(
     'POST /api/files/delete-impact',
     admin
diff --git a/backend/tests/routes/account-language.test.js b/backend/tests/routes/account-language.test.js
index 3a589e037..5c833192c 100644
--- a/backend/tests/routes/account-language.test.js
+++ b/backend/tests/routes/account-language.test.js
@@ -74,8 +74,8 @@ describe('a language on the account', () => {
   });
 
   it('is a preference the settings route accepts', async () => {
-    const { USER_SETTING_KEYS } = settings();
+    const { WRITABLE_USER_SETTINGS } = settings();
 
-    expect(USER_SETTING_KEYS.has('locale')).toBe(true);
+    expect(WRITABLE_USER_SETTINGS.has('locale')).toBe(true);
   });
 });
diff --git a/backend/tests/routes/auth.test.js b/backend/tests/routes/auth.test.js
index c6a69780b..8df7732c0 100644
--- a/backend/tests/routes/auth.test.js
+++ b/backend/tests/routes/auth.test.js
@@ -5,7 +5,7 @@ import express from 'express';
 import session from 'express-session';
 import bodyParser from 'body-parser';
 import request from 'supertest';
-import { setupTestEnv, clearModuleCache } from '../helpers/env-test-utils.js';
+import { setupTestEnv, clearModuleCache, modulePath } from '../helpers/env-test-utils.js';
 
 let envContext;
 
@@ -20,12 +20,26 @@ afterAll(async () => {
   await envContext.cleanup();
 });
 
-const buildApp = ({ authEnabled } = {}) => {
+const buildApp = async ({ authEnabled } = {}) => {
   if (!envContext) {
     throw new Error('Test environment not initialized');
   }
 
   // Ensure each test app starts with a clean database.
+  //
+  // Closed before it is removed, not only dropped from the module cache. SQLite
+  // keeps an unlinked file alive for whoever still holds it open, so the second
+  // app in a file went on reading the first one's accounts through the old
+  // handle: `/auth/setup` answered "already configured" and the test that
+  // needed a fresh install failed on its very first call, for a reason that had
+  // nothing to do with what it was testing.
+  try {
+    // The instance that has it open, not a fresh one: `requireFresh` would hand
+    // back a module that has never opened anything, and close nothing.
+    await require(modulePath('src/services/db')).closeDb();
+  } catch (_) {
+    // Nothing had opened it yet.
+  }
   try {
     fs.rmSync(path.join(envContext.configDir, 'app.db'), { force: true });
   } catch (_) {
@@ -72,7 +86,7 @@ const buildApp = ({ authEnabled } = {}) => {
 describe('Auth Routes', () => {
   describe('Authentication Flow', () => {
     it('should complete setup -> login -> me -> password -> logout flow', async () => {
-      const app = buildApp({ authEnabled: true });
+      const app = await buildApp({ authEnabled: true });
 
       // status before setup
       const s1 = await request(app).get('/api/auth/status');
@@ -81,13 +95,11 @@ describe('Auth Routes', () => {
       expect(s1.body.authEnabled).toBe(true);
 
       // setup admin
-      const setup = await request(app)
-        .post('/api/auth/setup')
-        .send({
-          email: 'admin@example.com',
-          username: 'admin',
-          password: 'secret123',
-        });
+      const setup = await request(app).post('/api/auth/setup').send({
+        email: 'admin@example.com',
+        username: 'admin',
+        password: 'secret123',
+      });
       expect(setup.status).toBe(201);
       expect(setup.body.user).toBeDefined();
       expect(setup.body.user.roles).toContain('admin');
@@ -116,16 +128,14 @@ describe('Auth Routes', () => {
     });
 
     it('should return JSON 401 when current password is incorrect', async () => {
-      const app = buildApp({ authEnabled: true });
+      const app = await buildApp({ authEnabled: true });
 
       // setup admin
-      const setup = await request(app)
-        .post('/api/auth/setup')
-        .send({
-          email: 'admin@example.com',
-          username: 'admin',
-          password: 'secret123',
-        });
+      const setup = await request(app).post('/api/auth/setup').send({
+        email: 'admin@example.com',
+        username: 'admin',
+        password: 'secret123',
+      });
       expect(setup.status).toBe(201);
 
       // login
@@ -149,7 +159,7 @@ describe('Auth Routes', () => {
 
   describe('Auth Status', () => {
     it('should reflect disabled auth via AUTH_ENABLED', async () => {
-      const app = buildApp({ authEnabled: false });
+      const app = await buildApp({ authEnabled: false });
 
       const status = await request(app).get('/api/auth/status');
       expect(status.status).toBe(200);
diff --git a/backend/tests/routes/browse-caching.test.js b/backend/tests/routes/browse-caching.test.js
new file mode 100644
index 000000000..56d2c75bb
--- /dev/null
+++ b/backend/tests/routes/browse-caching.test.js
@@ -0,0 +1,49 @@
+import express from 'express';
+import request from 'supertest';
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * A listing is not a document, and must not be cached as one.
+ *
+ * `GET /api/browse` carries what is true at that moment: which documents somebody has
+ * open in an editor, what a folder weighs, whether a write would be refused. None of
+ * that is worth remembering, and a proxy or a browser that remembers it serves a view
+ * of a folder as it was — a file that was deleted still listed, a document shown as
+ * open by somebody who closed it an hour ago.
+ *
+ * No header said so, and the answer to a GET with none is cacheable by default.
+ */
+
+let env;
+
+afterEach(async () => {
+  if (env) await env.cleanup();
+  env = null;
+});
+
+const app = () => {
+  const server = express();
+  server.use((req, _res, next) => {
+    req.user = { id: 'admin-1', roles: ['admin'] };
+    next();
+  });
+  server.use('/api', env.requireFresh('src/routes/browse'));
+  server.use(env.requireFresh('src/middleware/errorHandler').errorHandler);
+  return server;
+};
+
+describe('the answer to a listing', () => {
+  it('is not to be kept by a browser or a proxy', async () => {
+    env = await setupTestEnv({ tag: 'browse-caching-' });
+
+    const response = await request(app()).get('/api/browse/');
+
+    expect(response.status).toBe(200);
+    // `private` keeps a shared proxy out of it; `no-store` keeps the browser from
+    // answering the next navigation from what it already has.
+    expect(response.headers['cache-control']).toContain('no-store');
+    expect(response.headers['cache-control']).toContain('private');
+  });
+});
diff --git a/backend/tests/routes/browse-hidden-files.test.js b/backend/tests/routes/browse-hidden-files.test.js
index 6ef8c7dee..d46d0df41 100644
--- a/backend/tests/routes/browse-hidden-files.test.js
+++ b/backend/tests/routes/browse-hidden-files.test.js
@@ -20,6 +20,17 @@ const createBrowseContext = async () => {
     ],
   });
 
+  // The account the requests below are made as. A preference belongs to an
+  // account — `user_settings` says so with a foreign key — so writing one for
+  // an id nothing created fails on the constraint rather than on anything this
+  // test is about.
+  const db = await envContext.requireFresh('src/services/db').getDb();
+  const now = new Date().toISOString();
+  db.prepare(
+    `INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
+     VALUES ('admin', 'admin@example.com', 1, 'admin', 'Admin', '["admin"]', ?, ?)`
+  ).run(now, now);
+
   const browseRoutes = envContext.requireFresh('src/routes/browse');
   const { errorHandler } = envContext.requireFresh('src/middleware/errorHandler');
   const app = createTestApp({
diff --git a/backend/tests/routes/no-shell.test.js b/backend/tests/routes/no-shell.test.js
new file mode 100644
index 000000000..cc8092240
--- /dev/null
+++ b/backend/tests/routes/no-shell.test.js
@@ -0,0 +1,117 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import request from 'supertest';
+import { setupTestEnv, createTestApp } from '../helpers/env-test-utils.js';
+
+/**
+ * A name from a request is not a shell string.
+ *
+ * Two routes built command lines with values from the request pasted into them and
+ * handed the line to `/bin/sh`. A folder name, an owner, a group: anything that
+ * closed the quoting left the rest for the shell to run, as the user this server
+ * runs as. The folder one needs no privilege at all — any account that can make a
+ * folder can name one, and with AUTH_ENABLED=false that is anybody who can reach
+ * the server.
+ *
+ * The payloads below only create a file inside the test's own temporary directory,
+ * and what each case asserts is that the file is not there.
+ */
+
+let env;
+
+// Where a payload would land: a folder name cannot hold a slash, so it writes into
+// the working directory of the process running this.
+const PROOF = path.join(process.cwd(), 'a-shell-ran-here');
+const shellRan = async () =>
+  fs
+    .access(PROOF)
+    .then(() => true)
+    .catch(() => false);
+
+afterEach(async () => {
+  // Whatever an assertion did, this happens: a run that does execute must not leave
+  // the file behind for the next one to find.
+  await fs.rm(PROOF, { force: true });
+  if (env) {
+    await env.cleanup();
+    env = null;
+  }
+});
+
+describe('asking how full a volume is', () => {
+  it('does not run what a folder is called', async () => {
+    env = await setupTestEnv({
+      tag: 'usage-no-shell-',
+      modules: ['src/routes/usage', 'src/services/accessManager', 'src/utils/pathUtils'],
+    });
+
+    // A name that closes the quoting the route used to open around it.
+    const folder = 'Vol";touch a-shell-ran-here;echo "';
+    await fs.mkdir(path.join(env.volumeDir, folder));
+
+    const app = createTestApp({
+      router: env.requireFresh('src/routes/usage'),
+      mountPath: '/api',
+      user: { id: 'admin-user', roles: ['admin'] },
+    });
+
+    const response = await request(app).get(`/api/usage/${encodeURIComponent(folder)}`);
+
+    expect(response.status).toBe(200);
+    expect(await shellRan()).toBe(false);
+  });
+});
+
+describe('changing an owner', () => {
+  // With the error handler, so a refusal arrives as the sentence it is meant to be
+  // rather than an empty body with a status on it.
+  const appFor = () =>
+    createTestApp({
+      router: env.requireFresh('src/routes/permissions'),
+      mountPath: '/api',
+      user: { id: 'admin-user', roles: ['admin'] },
+      errorHandler: env.requireFresh('src/middleware/errorHandler').errorHandler,
+    });
+
+  const setup = async (tag) => {
+    env = await setupTestEnv({
+      tag,
+      modules: [
+        'src/routes/permissions',
+        'src/middleware/errorHandler',
+        'src/services/accessManager',
+        'src/utils/pathUtils',
+      ],
+    });
+    await fs.mkdir(path.join(env.volumeDir, 'Vol'), { recursive: true });
+    await fs.writeFile(path.join(env.volumeDir, 'Vol', 'file.txt'), 'x');
+  };
+
+  it('does not run what an owner is called', async () => {
+    await setup('chown-no-shell-');
+    const response = await request(appFor())
+      .post('/api/permissions/chown')
+      .send({ path: 'Vol/file.txt', owner: 'root";touch a-shell-ran-here;echo "' });
+
+    // Refused as a name, or attempted as one argument and failed — either way the
+    // command inside it is not a command.
+    expect(await shellRan()).toBe(false);
+    expect(response.status).toBeGreaterThanOrEqual(400);
+  });
+
+  it('refuses a name that would be read as an option', async () => {
+    await setup('chown-option-');
+
+    const response = await request(appFor())
+      .post('/api/permissions/chown')
+      .send({ path: 'Vol/file.txt', owner: '--reference=/etc/shadow' });
+
+    // Refused as a name rather than attempted as one: a 400 from the route, and a
+    // sentence that says which field and that it is a name. Not the exact wording —
+    // a test that pins a sentence breaks when somebody improves it.
+    expect(response.status).toBe(400);
+    expect(JSON.stringify(response.body)).toMatch(/owner/i);
+    expect(JSON.stringify(response.body)).toMatch(/(invalid|not a valid).{0,20}name/i);
+  });
+});
diff --git a/backend/tests/routes/permissions.test.js b/backend/tests/routes/permissions.test.js
new file mode 100644
index 000000000..20454d5ae
--- /dev/null
+++ b/backend/tests/routes/permissions.test.js
@@ -0,0 +1,265 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import express from 'express';
+import request from 'supertest';
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * The two routes that hand a path to `chmod` and `chown`.
+ *
+ * They are the pair that once shipped with no admin check at all, and they are
+ * the only place in the application where a value from a request reaches a
+ * system tool. Both facts are pinned here: that a regular account is refused,
+ * and that nothing shaped like an option can reach the argument list.
+ */
+
+let currentEnv;
+
+afterEach(async () => {
+  if (currentEnv) {
+    await currentEnv.cleanup();
+    currentEnv = null;
+  }
+});
+
+const REGULAR_USER = { id: 'user-1', username: 'regular', roles: ['user'] };
+const ADMIN_USER = { id: 'admin-1', username: 'admin', roles: ['admin'] };
+
+const seed = async () => {
+  currentEnv = await setupTestEnv({ tag: 'permissions-' });
+  const dbService = currentEnv.requireFresh('src/services/db');
+  const db = await dbService.getDb();
+  const now = new Date().toISOString();
+  for (const user of [REGULAR_USER, ADMIN_USER]) {
+    db.prepare(
+      `INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
+       VALUES (?, ?, 1, ?, ?, ?, ?, ?)`
+    ).run(
+      user.id,
+      `${user.username}@example.com`,
+      user.username,
+      user.username,
+      JSON.stringify(user.roles),
+      now,
+      now
+    );
+  }
+  const dir = path.join(currentEnv.volumeDir, 'Docs');
+  await fs.mkdir(dir, { recursive: true });
+  await fs.writeFile(path.join(dir, 'note.txt'), 'hello\n');
+  return dir;
+};
+
+const buildApp = (user) => {
+  const routes = currentEnv.requireFresh('src/routes/permissions');
+  const { errorHandler } = currentEnv.requireFresh('src/middleware/errorHandler');
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    if (user) req.user = user;
+    next();
+  });
+  app.use('/api', routes);
+  app.use(errorHandler);
+  return app;
+};
+
+describe('who may change permissions', () => {
+  it('refuses a regular account on chmod', async () => {
+    await seed();
+
+    const response = await request(buildApp(REGULAR_USER))
+      .post('/api/permissions/chmod')
+      .send({ path: 'Docs/note.txt', mode: '777' });
+
+    expect(response.status).toBe(403);
+  });
+
+  it('refuses a regular account on chown', async () => {
+    await seed();
+
+    const response = await request(buildApp(REGULAR_USER))
+      .post('/api/permissions/chown')
+      .send({ path: 'Docs/note.txt', owner: 'root' });
+
+    expect(response.status).toBe(403);
+  });
+
+  /**
+   * A write permission on a path is not consent to re-permission its tree —
+   * the refusal has to come from the role, not from the path being unreachable.
+   */
+  it('refuses before it has looked at the path at all', async () => {
+    await seed();
+
+    const response = await request(buildApp(REGULAR_USER))
+      .post('/api/permissions/chmod')
+      .send({ path: 'Docs/does-not-exist.txt', mode: '777' });
+
+    expect(response.status).toBe(403);
+  });
+});
+
+describe('what may reach chmod', () => {
+  it('changes the mode of a real file', async () => {
+    const dir = await seed();
+
+    const response = await request(buildApp(ADMIN_USER))
+      .post('/api/permissions/chmod')
+      .send({ path: 'Docs/note.txt', mode: '640' });
+
+    expect(response.status).toBe(200);
+    const stats = await fs.stat(path.join(dir, 'note.txt'));
+    expect(stats.mode & 0o777).toBe(0o640);
+  });
+
+  // Three digits say nothing about the setuid, setgid and sticky bits, and
+  // chmod writes the whole mode: unticking one box on a sticky or setgid folder
+  // used to take those bits away with it.
+  it('keeps the special bits the folder already had', async () => {
+    const dir = await seed();
+    const shared = path.join(dir, 'drop-box');
+    await fs.mkdir(shared);
+    await fs.chmod(shared, 0o1777);
+
+    const response = await request(buildApp(ADMIN_USER))
+      .post('/api/permissions/chmod')
+      .send({ path: 'Docs/drop-box', mode: '775' });
+
+    expect(response.status).toBe(200);
+    const stats = await fs.stat(shared);
+    expect(stats.mode & 0o777).toBe(0o775);
+    expect(stats.mode & 0o7000).toBe(0o1000);
+    expect(response.body.mode & 0o7777).toBe(0o1775);
+  });
+
+  // The mode is interpolated into a `chmod -R` argument list on the recursive
+  // path. Only three octal digits can get that far.
+  it.each([['755 --reference=/etc/shadow'], ['7555'], ['75\n5'], ['a+x'], ['']])(
+    'refuses the mode %j',
+    async (mode) => {
+      await seed();
+
+      const response = await request(buildApp(ADMIN_USER))
+        .post('/api/permissions/chmod')
+        .send({ path: 'Docs/note.txt', mode });
+
+      expect(response.status).toBe(400);
+    }
+  );
+
+  // The status alone proves nothing here: a share path is unreachable anyway,
+  // so it is refused either way. Only the reason says which check fired.
+  it('refuses a path reached through a share, and says so', async () => {
+    await seed();
+
+    const response = await request(buildApp(ADMIN_USER))
+      .post('/api/permissions/chmod')
+      .send({ path: 'share/abc/note.txt', mode: '640' });
+
+    expect(response.status).toBe(403);
+    expect(response.body.error.message).toBe('Permissions cannot be changed through a share.');
+  });
+
+  it('requires a path', async () => {
+    await seed();
+
+    const response = await request(buildApp(ADMIN_USER))
+      .post('/api/permissions/chmod')
+      .send({ mode: '640' });
+
+    expect(response.status).toBe(400);
+  });
+});
+
+describe('what may reach chown', () => {
+  /**
+   * `chown` takes its arguments as an array and never through a shell, so a
+   * semicolon is harmless — an argument that reads as an *option* is not.
+   * `--reference=FILE` makes chown copy another file's ownership, and a
+   * leading dash is what the pattern exists to refuse.
+   */
+  it.each([['--reference=/etc/shadow'], ['-R'], ['root nobody'], ['root;id'], ['.hidden'], ['-']])(
+    'refuses the owner %j',
+    async (owner) => {
+      await seed();
+
+      const response = await request(buildApp(ADMIN_USER))
+        .post('/api/permissions/chown')
+        .send({ path: 'Docs/note.txt', owner });
+
+      expect(response.status).toBe(400);
+    }
+  );
+
+  it('refuses a group of the same shape', async () => {
+    await seed();
+
+    const response = await request(buildApp(ADMIN_USER))
+      .post('/api/permissions/chown')
+      .send({ path: 'Docs/note.txt', group: '--reference=/etc/shadow' });
+
+    expect(response.status).toBe(400);
+  });
+
+  it('accepts an ordinary account name', async () => {
+    await seed();
+
+    const response = await request(buildApp(ADMIN_USER))
+      .post('/api/permissions/chown')
+      .send({ path: 'Docs/note.txt', owner: 'nobody' });
+
+    // Changing ownership needs root, which the test process is not; what
+    // matters is that the name passed validation and the call was attempted.
+    expect(response.status).not.toBe(400);
+  });
+
+  it('requires an owner or a group', async () => {
+    await seed();
+
+    const response = await request(buildApp(ADMIN_USER))
+      .post('/api/permissions/chown')
+      .send({ path: 'Docs/note.txt' });
+
+    expect(response.status).toBe(400);
+  });
+
+  it('refuses a path reached through a share, and says so', async () => {
+    await seed();
+
+    const response = await request(buildApp(ADMIN_USER))
+      .post('/api/permissions/chown')
+      .send({ path: 'share/abc/note.txt', owner: 'nobody' });
+
+    expect(response.status).toBe(403);
+    expect(response.body.error.message).toBe('Ownership cannot be changed through a share.');
+  });
+});
+
+describe('reading permissions', () => {
+  it('reports the mode, owner and group of a file', async () => {
+    await seed();
+
+    const response = await request(buildApp(ADMIN_USER)).get('/api/permissions/Docs/note.txt');
+
+    expect(response.status).toBe(200);
+    expect(response.body).toMatchObject({ path: 'Docs/note.txt' });
+  });
+
+  it('requires a path', async () => {
+    await seed();
+
+    const response = await request(buildApp(ADMIN_USER)).get('/api/permissions/');
+
+    expect(response.status).toBe(400);
+  });
+
+  it('says not found rather than failing, for a path that is not there', async () => {
+    await seed();
+
+    const response = await request(buildApp(ADMIN_USER)).get('/api/permissions/Docs/absent.txt');
+
+    expect(response.status).toBe(404);
+  });
+});
diff --git a/backend/tests/routes/personal-folder-isolation.test.js b/backend/tests/routes/personal-folder-isolation.test.js
index 97b6d238b..e58140c76 100644
--- a/backend/tests/routes/personal-folder-isolation.test.js
+++ b/backend/tests/routes/personal-folder-isolation.test.js
@@ -61,8 +61,7 @@ const setup = async ({ userRootEnv = {} } = {}) => {
   await fs.writeFile(path.join(aliceRoot, 'salary.txt'), 'alice private');
 
   const bob = { id: 'bob', username: 'bob', roles: ['user'] };
-  const asBob = (router) =>
-    createTestApp({ router, mountPath: '/api', user: bob, errorHandler });
+  const asBob = (router) => createTestApp({ router, mountPath: '/api', user: bob, errorHandler });
 
   return {
     env,
@@ -176,7 +175,7 @@ describe('a volume that does not hold the personal folders', () => {
 
     const browseRoutes = env.requireFresh('src/routes/browse');
     const { errorHandler } = env.requireFresh('src/middleware/errorHandler');
-    const db = await (env.requireFresh('src/services/db').getDb());
+    const db = await env.requireFresh('src/services/db').getDb();
     const now = new Date().toISOString();
     db.prepare(
       `INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
diff --git a/backend/tests/routes/public-endpoints-hardening.test.js b/backend/tests/routes/public-endpoints-hardening.test.js
index dcb6ed5b9..0539eed4b 100644
--- a/backend/tests/routes/public-endpoints-hardening.test.js
+++ b/backend/tests/routes/public-endpoints-hardening.test.js
@@ -88,8 +88,14 @@ describe('checking a share password', () => {
       .post(`/api/share/${token}/verify`)
       .send({ password: 'open-sesame' });
 
+    // The one being handed out, not the one being cleared. The cookie moved
+    // from /api to the root — an <img> asking /static for a thumbnail cannot
+    // carry a header, and a cookie scoped to /api never reaches it — so the
+    // old one is cleared in the same answer, and a browser keeps both headers.
     const cookieOf = (response) =>
-      [].concat(response.headers['set-cookie'] || []).find((c) => c.startsWith('guestSession='));
+      []
+        .concat(response.headers['set-cookie'] || [])
+        .find((c) => /^guestSession=.+/.test(c) && !/Expires=Thu, 01 Jan 1970/.test(c));
     expect(overHttps.status).toBe(200);
     expect(cookieOf(overHttps)).toMatch(/;\s*Secure/i);
     // The control: plain HTTP cannot carry a Secure cookie back at all.
diff --git a/backend/tests/routes/recent-destinations.test.js b/backend/tests/routes/recent-destinations.test.js
new file mode 100644
index 000000000..8e44c7c8c
--- /dev/null
+++ b/backend/tests/routes/recent-destinations.test.js
@@ -0,0 +1,146 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import request from 'supertest';
+import { createTestApp, setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * The folders a user actually files things into.
+ *
+ * The destination picker opens on this list rather than at the root, so what it
+ * contains has to be true without anyone maintaining it: written by the
+ * transfers themselves, ordered by use, and holding nothing the person cannot
+ * still reach. A destination offered and then refused at the end of the flow
+ * would be worse than no list at all.
+ */
+
+describe('recent destinations', () => {
+  let env;
+  const asUser = (id) => ({ id, roles: ['admin'] });
+
+  const setup = async () => {
+    env = await setupTestEnv({
+      tag: 'recent-destinations-',
+      modules: [
+        'src/services/db',
+        'src/services/recentDestinationsService',
+        'src/services/accessManager',
+        'src/routes/files',
+        'src/middleware/errorHandler',
+      ],
+    });
+
+    for (const folder of ['Archive', 'Invoices', 'Photos']) {
+      await fs.mkdir(path.join(env.volumeDir, folder), { recursive: true });
+    }
+    await fs.writeFile(path.join(env.volumeDir, 'report.txt'), 'contents');
+  };
+
+  const appFor = (user) => {
+    const routes = env.requireFresh('src/routes/files');
+    const { errorHandler } = env.requireFresh('src/middleware/errorHandler');
+    return createTestApp({ router: routes, mountPath: '/api', user, errorHandler });
+  };
+
+  /** Move a file into a folder, the way the client does. */
+  const moveInto = async (app, name, destination) =>
+    request(app)
+      .post('/api/files/move')
+      .send({
+        items: [{ name, path: '' }],
+        destination,
+      });
+
+  const listFor = async (app) => {
+    const response = await request(app).get('/api/files/recent-destinations');
+    expect(response.status).toBe(200);
+    return response.body.items;
+  };
+
+  afterEach(async () => {
+    if (env) {
+      await env.cleanup();
+      env = null;
+    }
+  });
+
+  it('remembers where a transfer landed, without being asked to', async () => {
+    // Nothing in the client reports this: recording it from the transfer means
+    // a drag onto a favorite and a paste count exactly like a pick.
+    await setup();
+    const app = appFor(asUser('alice'));
+
+    expect(await listFor(app)).toEqual([]);
+
+    expect((await moveInto(app, 'report.txt', 'Archive')).status).toBe(200);
+
+    expect(await listFor(app)).toEqual(['Archive']);
+  });
+
+  it('puts the destination used most recently first', async () => {
+    await setup();
+    const app = appFor(asUser('alice'));
+
+    await moveInto(app, 'report.txt', 'Archive');
+    await fs.writeFile(path.join(env.volumeDir, 'report.txt'), 'again');
+    await moveInto(app, 'report.txt', 'Invoices');
+
+    expect(await listFor(app)).toEqual(['Invoices', 'Archive']);
+  });
+
+  it('moves a destination up rather than listing it twice', async () => {
+    await setup();
+    const app = appFor(asUser('alice'));
+
+    await moveInto(app, 'report.txt', 'Archive');
+    await fs.writeFile(path.join(env.volumeDir, 'report.txt'), 'again');
+    await moveInto(app, 'report.txt', 'Invoices');
+    await fs.writeFile(path.join(env.volumeDir, 'report.txt'), 'once more');
+    await moveInto(app, 'report.txt', 'Archive');
+
+    expect(await listFor(app)).toEqual(['Archive', 'Invoices']);
+  });
+
+  it('keeps one user habits out of another list', async () => {
+    // Where someone files their work says something about it; a favorite is
+    // shared deliberately, this is not.
+    await setup();
+    const alice = appFor(asUser('alice'));
+    const bob = appFor(asUser('bob'));
+
+    await moveInto(alice, 'report.txt', 'Archive');
+
+    expect(await listFor(alice)).toEqual(['Archive']);
+    expect(await listFor(bob)).toEqual([]);
+  });
+
+  it('drops a destination that has since been deleted', async () => {
+    // Offering it would only produce a failure at the end of the flow.
+    await setup();
+    const app = appFor(asUser('alice'));
+
+    await moveInto(app, 'report.txt', 'Archive');
+    await fs.rm(path.join(env.volumeDir, 'Archive'), { recursive: true, force: true });
+
+    expect(await listFor(app)).toEqual([]);
+
+    // And forgotten for good, rather than re-tested on every open.
+    await fs.mkdir(path.join(env.volumeDir, 'Archive'), { recursive: true });
+    expect(await listFor(app)).toEqual([]);
+  });
+
+  it('swallows a write it cannot perform, rather than failing the transfer', async () => {
+    // The list is a convenience; the file arriving is not. A /config directory
+    // shared with an older image is the real way this happens — the schema is
+    // behind and the table simply isn't there, which must not turn a successful
+    // move into a 500.
+    await setup();
+
+    const { getDb } = env.requireFresh('src/services/db');
+    const service = env.requireFresh('src/services/recentDestinationsService');
+    const db = await getDb();
+    db.exec('DROP TABLE recent_destinations');
+
+    await expect(service.record('alice', 'Archive')).resolves.toBeUndefined();
+  });
+});
diff --git a/backend/tests/routes/search-ordinary-folder-names.test.js b/backend/tests/routes/search-ordinary-folder-names.test.js
new file mode 100644
index 000000000..f6ca2c2d0
--- /dev/null
+++ b/backend/tests/routes/search-ordinary-folder-names.test.js
@@ -0,0 +1,168 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import express from 'express';
+import request from 'supertest';
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * Folder names an editor skips and a file server must not.
+ *
+ * Search carried `.git`, `node_modules`, `dist` and `build` as names to walk
+ * past — a habit that belongs in a code editor. Here they are folder names
+ * somebody may have put a year of work in, and a file under one of them could
+ * not be found by name or by content, with nothing in the answer to say why
+ * (#11).
+ *
+ * Both engines are exercised, because the names were hard-coded twice: once as
+ * ripgrep globs and once in the walker that runs when ripgrep is absent.
+ */
+
+let envContext;
+
+const buildApp = () => {
+  const searchRoutes = envContext.requireFresh('src/routes/search');
+  const { errorHandler } = envContext.requireFresh('src/middleware/errorHandler');
+  const app = express();
+  app.use((req, _res, next) => {
+    req.user = { id: 'u1', email: 'u@example.com', roles: ['admin'] };
+    next();
+  });
+  app.use('/api', searchRoutes);
+  app.use(errorHandler);
+  return app;
+};
+
+const seed = async (env = {}) => {
+  envContext = await setupTestEnv({
+    tag: 'search-folder-names-',
+    env: { SEARCH_RIPGREP: 'true', SEARCH_DEEP: 'true', ...env },
+  });
+  const dbService = envContext.requireFresh('src/services/db');
+  const db = await dbService.getDb();
+  const now = new Date().toISOString();
+  db.prepare(
+    `INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
+     VALUES ('u1', 'u@example.com', 1, 'u', 'U', '["admin"]', ?, ?)`
+  ).run(now, now);
+  return path.join(envContext.volumeDir, 'Docs');
+};
+
+const search = async (term) => {
+  const response = await request(buildApp()).get('/api/search').query({ q: term });
+  expect(response.status).toBe(200);
+  return (response.body.items || []).map((item) => `${item.path}/${item.name}`);
+};
+
+/** One file at `relDir/name`, and what searching for `term` returns. */
+const withFile = async ({ relDir, name, contents = 'nothing in particular', term, env }) => {
+  const docs = await seed(env);
+  const dir = path.join(docs, relDir);
+  await fs.mkdir(dir, { recursive: true });
+  await fs.writeFile(path.join(dir, name), contents);
+  return search(term);
+};
+
+afterEach(async () => {
+  if (envContext) await envContext.cleanup();
+  envContext = null;
+});
+
+describe('a folder named like a build directory', () => {
+  for (const folder of ['build', 'dist', 'node_modules']) {
+    it(`finds a file by name under ${folder}`, async () => {
+      const found = await withFile({
+        relDir: `projects/${folder}/reports`,
+        name: 'quarterly.txt',
+        term: 'quarterly',
+      });
+      expect(found).toContain(`Docs/projects/${folder}/reports/quarterly.txt`);
+    });
+  }
+
+  it('finds what such a folder holds, by its contents', async () => {
+    const found = await withFile({
+      relDir: 'projects/build',
+      name: 'notes.txt',
+      contents: 'the measurement was taken at dawn',
+      term: 'dawn',
+    });
+    expect(found).toContain('Docs/projects/build/notes.txt');
+  });
+
+  it('finds the folder itself', async () => {
+    const found = await withFile({
+      relDir: 'projects/build/reports',
+      name: 'quarterly.txt',
+      term: 'build',
+    });
+    expect(found).toContain('Docs/projects/build');
+  });
+
+  it('finds it with the walker too, when ripgrep is not there', async () => {
+    const found = await withFile({
+      relDir: 'projects/build/reports',
+      name: 'quarterly.txt',
+      term: 'quarterly',
+      env: { SEARCH_RIPGREP: 'false' },
+    });
+    expect(found).toContain('Docs/projects/build/reports/quarterly.txt');
+  });
+});
+
+describe('what may still be left out', () => {
+  // The mechanism that decides is the administrator's, not a name in the
+  // source: removing the four must not remove this one.
+  it('honours the exclusion list', async () => {
+    const found = await withFile({
+      relDir: 'private',
+      name: 'quarterly.txt',
+      term: 'quarterly',
+      env: { SEARCH_INDEX_EXCLUDE: 'Docs/private' },
+    });
+    expect(found).toEqual([]);
+  });
+
+  it('leaves hidden folders hidden while the reader has not asked', async () => {
+    const found = await withFile({
+      relDir: '.private',
+      name: 'quarterly.txt',
+      term: 'quarterly',
+    });
+    expect(found).toEqual([]);
+  });
+});
+
+/**
+ * And the third place the same four names were written down.
+ *
+ * The index is a fourth engine, not a variant of the other two: it walks the
+ * volume itself, on its own schedule, and the search answers from what it
+ * catalogued. A name it never walked into is a name no amount of asking will
+ * return — and unlike the other two, being absent from the index shows up as
+ * an empty answer with nothing to explain it, however the search is run.
+ */
+describe('a folder named like a build directory, catalogued', () => {
+  const indexAndSearch = async (relDir, name, term) => {
+    const docs = await seed({ SEARCH_INDEX_ENABLED: 'true' });
+    const dir = path.join(docs, relDir);
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(path.join(dir, name), 'le mot pangolin');
+
+    const indexDb = envContext.requireFresh('src/services/indexDb');
+    const db = await indexDb.getIndexDb();
+    const indexer = envContext.requireFresh('src/services/searchIndexer');
+    await indexer.indexTree({ db, rootAbs: envContext.volumeDir, cpuPercent: 100 });
+
+    const store = envContext.requireFresh('src/services/searchIndexStore');
+    return { catalogued: store.search(db, term) };
+  };
+
+  for (const folder of ['build', 'dist', 'node_modules']) {
+    it(`catalogues what is under ${folder}`, async () => {
+      const { catalogued } = await indexAndSearch(`projets/${folder}`, 'rapport.txt', 'pangolin');
+
+      expect(catalogued).toContain(`Docs/projets/${folder}/rapport.txt`);
+    });
+  }
+});
diff --git a/backend/tests/routes/settings-concurrent-saves.test.js b/backend/tests/routes/settings-concurrent-saves.test.js
new file mode 100644
index 000000000..f1c38f344
--- /dev/null
+++ b/backend/tests/routes/settings-concurrent-saves.test.js
@@ -0,0 +1,137 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { fileURLToPath } from 'node:url';
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+import { substituteModule } from '../helpers/substitute-module.js';
+
+/**
+ * Two saves of one settings section, in flight at the same moment.
+ *
+ * The page sends what changed rather than the whole document, so the server
+ * merges each section over what is stored. That merge used to read the
+ * settings at the start of the request and write the result two awaits later:
+ * two administrators saving at once, or one with the settings open in two
+ * tabs, both started from the same stored value and the second wrote over the
+ * first's field — while telling the person who set it that it was saved.
+ * Branding was taken out of that path already, where a lost save also left a
+ * logo file behind; every other section had the same hole.
+ *
+ * The database answers synchronously, so a read and a write with nothing
+ * awaited between them cannot be interleaved. That is what is pinned here: the
+ * moment where the second request could slip in is the `await` on the database
+ * handle, and both requests are held at it until both have arrived. With the
+ * read and the write on either side of it, the second overwrites the first;
+ * with both after it, the second reads what the first has just written.
+ */
+
+const SERVICE_FILE = fileURLToPath(
+  new URL('../../src/services/settingsService.js', import.meta.url)
+);
+
+let currentEnv;
+let restore = null;
+
+afterEach(async () => {
+  restore?.();
+  restore = null;
+  if (currentEnv) {
+    await currentEnv.cleanup();
+    currentEnv = null;
+  }
+});
+
+/**
+ * Hold the first two callers until both have arrived, and let everything after
+ * them straight through.
+ */
+const holdFirstTwo = () => {
+  let arrived = 0;
+  let release;
+  const both = new Promise((resolve) => {
+    release = resolve;
+  });
+  return async () => {
+    arrived += 1;
+    if (arrived > 2) return;
+    if (arrived === 2) release();
+    await both;
+  };
+};
+
+const buildApp = () => {
+  const routes = currentEnv.requireFresh('src/routes/settings');
+  const { errorHandler } = currentEnv.requireFresh('src/middleware/errorHandler');
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    req.user = { id: 'u1', email: 'u@example.com', roles: ['admin'] };
+    next();
+  });
+  app.use('/api', routes);
+  app.use(errorHandler);
+  return app;
+};
+
+/**
+ * An application whose settings service waits on the gate every time it asks
+ * for the database handle.
+ */
+const seed = async () => {
+  currentEnv = await setupTestEnv({ tag: 'settings-concurrent-' });
+  const db = currentEnv.requireFresh('src/services/db');
+  await db.getDb();
+
+  const gate = holdFirstTwo();
+  // Substituted after the environment cleared the module registry, so the
+  // settings service required next is the one that receives this.
+  restore = substituteModule(SERVICE_FILE, './db', {
+    ...db,
+    getDb: async () => {
+      await gate();
+      return db.getDb();
+    },
+  });
+
+  return buildApp();
+};
+
+const patch = (app, payload) => request(app).patch('/api/settings').send(payload);
+const readAsAdmin = async (app) => (await request(app).get('/api/settings')).body;
+
+describe('two saves of one settings section at once', () => {
+  it.each([
+    ['the trash', 'trash', { retentionDays: 90 }, { maxPercent: 40 }],
+    ['file versions', 'versions', { maxPerFile: 7 }, { dailyDays: 60 }],
+    ['thumbnails', 'thumbnails', { size: 320 }, { quality: 55 }],
+    ['uploads', 'uploads', { chunkSizeBytes: 16 * 1024 * 1024 }, { chunkedEnabled: true }],
+  ])('keep both fields: %s', async (_label, section, first, second) => {
+    const app = await seed();
+
+    const answers = await Promise.all([
+      patch(app, { [section]: first }),
+      patch(app, { [section]: second }),
+    ]);
+
+    expect(answers.map((answer) => answer.status)).toEqual([200, 200]);
+    expect((await readAsAdmin(app))[section]).toMatchObject({ ...first, ...second });
+  });
+
+  /**
+   * The exclusions are a list rather than a set of fields, so the two saves
+   * cannot both survive — the second replaces the list. What must hold is that
+   * the one the person is told about is the one that is stored.
+   */
+  it('leaves the folder size exclusions as the last answer says they are', async () => {
+    const app = await seed();
+
+    const answers = await Promise.all([
+      patch(app, { folderSize: { excludedPaths: ['Archive'] } }),
+      patch(app, { folderSize: { excludedPaths: ['Archive', 'Backups'] } }),
+    ]);
+
+    expect(answers.map((answer) => answer.status)).toEqual([200, 200]);
+    const stored = (await readAsAdmin(app)).folderSize.excludedPaths;
+    expect(stored).toEqual(answers.at(-1).body.folderSize.excludedPaths);
+  });
+});
diff --git a/backend/tests/routes/settings-exclusions.test.js b/backend/tests/routes/settings-exclusions.test.js
new file mode 100644
index 000000000..485d62480
--- /dev/null
+++ b/backend/tests/routes/settings-exclusions.test.js
@@ -0,0 +1,124 @@
+import { describe, it, expect } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * Written at the layer the browser actually talks to.
+ *
+ * `SEARCH_INDEX_EXCLUDE` was set, the service that reads settings reported it,
+ * a test asserted exactly that — and the page still said "no path configured",
+ * because the route does not call that function. It calls one that assembles
+ * the admin payload field by field, and the new field was not in the list. A
+ * test one layer below the defect cannot see the defect.
+ */
+let envContext;
+
+const buildApp = (roles) => {
+  const settingsRoutes = envContext.requireFresh('src/routes/settings');
+  const { errorHandler } = envContext.requireFresh('src/middleware/errorHandler');
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    req.user = { id: 'u1', email: 'u@example.com', roles };
+    next();
+  });
+  app.use('/api', settingsRoutes);
+  app.use(errorHandler);
+  return app;
+};
+
+const seed = async (env) => {
+  envContext = await setupTestEnv({ tag: 'settings-exclusions-', env });
+  const dbService = envContext.requireFresh('src/services/db');
+  await dbService.getDb();
+};
+
+describe('what GET /api/settings tells an administrator', () => {
+  it('carries the search index exclusions the environment set', async () => {
+    await seed({ SEARCH_INDEX: 'true', SEARCH_INDEX_EXCLUDE: 'Stacks/docker' });
+    try {
+      const response = await request(buildApp(['admin'])).get('/api/settings');
+
+      expect(response.status).toBe(200);
+      expect(response.body.searchIndex).toBeTruthy();
+      expect(response.body.searchIndex.environmentExcludedPaths).toEqual(['Stacks/docker']);
+      // Beside the folder-size ones, which have always been there.
+      expect(response.body.folderSize).toBeTruthy();
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+
+  it('does not carry them to someone who is not an administrator', async () => {
+    await seed({ SEARCH_INDEX: 'true', SEARCH_INDEX_EXCLUDE: 'Stacks/docker' });
+    try {
+      const response = await request(buildApp(['user'])).get('/api/settings');
+
+      expect(response.status).toBe(200);
+      expect(response.body.searchIndex).toBeUndefined();
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+
+  it('takes a path an administrator adds and gives it back', async () => {
+    await seed({ SEARCH_INDEX: 'true' });
+    try {
+      const app = buildApp(['admin']);
+      const saved = await request(app)
+        .patch('/api/settings')
+        .send({ searchIndex: { excludedPaths: ['Sauvegardes/2024'] } });
+      expect(saved.status).toBe(200);
+
+      const response = await request(app).get('/api/settings');
+      expect(response.body.searchIndex.excludedPaths).toEqual(['Sauvegardes/2024']);
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+});
+
+/**
+ * Written down is not the same as in effect.
+ *
+ * Saving the list and telling the worker about it are two separate steps, and
+ * a test that reads the setting back sees only the first. Skipping the second
+ * leaves the running indexer walking a folder an administrator has just
+ * excluded, with the settings page showing it excluded — which is the worst
+ * shape a setting can take.
+ */
+describe('an exclusion an administrator adds while the index is running', () => {
+  it('reaches the worker, not only the stored settings', async () => {
+    await seed({ SEARCH_INDEX: 'true' });
+    try {
+      const exclusions = envContext.requireFresh('src/services/searchIndexExclusions');
+      expect(exclusions.effectivePaths()).not.toContain('Sauvegardes/2024');
+
+      const response = await request(buildApp(['admin']))
+        .patch('/api/settings')
+        .send({ searchIndex: { excludedPaths: ['Sauvegardes/2024'] } });
+      expect(response.status).toBe(200);
+
+      // The worker decides what it walks from this list, not from the database.
+      expect(exclusions.effectivePaths()).toContain('Sauvegardes/2024');
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+
+  it('does the same for folder sizes', async () => {
+    await seed({ FOLDER_SIZE_MODE: 'full' });
+    try {
+      const exclusions = envContext.requireFresh('src/services/folderSizeExclusions');
+
+      await request(buildApp(['admin']))
+        .patch('/api/settings')
+        .send({ folderSize: { excludedPaths: ['Media/raw'] } });
+
+      expect(exclusions.effectivePaths()).toContain('Media/raw');
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+});
diff --git a/backend/tests/routes/settings-partial-updates.test.js b/backend/tests/routes/settings-partial-updates.test.js
new file mode 100644
index 000000000..e21cd3a97
--- /dev/null
+++ b/backend/tests/routes/settings-partial-updates.test.js
@@ -0,0 +1,587 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * A settings write that sends part of a section, or sends a field in the wrong
+ * shape.
+ *
+ * The settings page sends what changed, not the whole document, so the route
+ * merges each section over what is stored. And it drops a field that is not in
+ * the shape the field takes before anything is stored — which matters more than
+ * it looks, because the service underneath repairs a bad value by putting the
+ * *default* in its place. Without the route's check, a trash retention of
+ * ninety days sent back as "forever" becomes thirty, and an access rule list
+ * sent as anything other than a list becomes no rules at all: every folder an
+ * administrator had hidden, visible again.
+ *
+ * So every case here first stores a value that differs from the default, then
+ * sends the bad one, then reads back — a test that started from the default
+ * could not tell the route's refusal from the service's repair.
+ *
+ * Who may write which section is pinned in `settings-write-boundary.test.js`.
+ */
+
+const MiB = 1024 * 1024;
+
+let currentEnv;
+
+afterEach(async () => {
+  if (currentEnv) {
+    await currentEnv.cleanup();
+    currentEnv = null;
+  }
+});
+
+const seed = async () => {
+  currentEnv = await setupTestEnv({ tag: 'settings-partial-' });
+  const db = await currentEnv.requireFresh('src/services/db').getDb();
+  const now = new Date().toISOString();
+  db.prepare(
+    `INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
+     VALUES ('u1','u@example.com',1,'u','U','["user"]', ?, ?)`
+  ).run(now, now);
+  return db;
+};
+
+const buildApp = (roles) => {
+  const routes = currentEnv.requireFresh('src/routes/settings');
+  const { errorHandler } = currentEnv.requireFresh('src/middleware/errorHandler');
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    req.user = { id: 'u1', email: 'u@example.com', roles };
+    next();
+  });
+  app.use('/api', routes);
+  app.use(errorHandler);
+  return app;
+};
+
+const patch = (roles, payload) => request(buildApp(roles)).patch('/api/settings').send(payload);
+const readAsAdmin = async () => (await request(buildApp(['admin'])).get('/api/settings')).body;
+
+describe('a field sent in a shape it does not take', () => {
+  it.each([
+    [
+      'thumbnails.quality',
+      { thumbnails: { quality: 55 } },
+      { thumbnails: { quality: 'best' } },
+      (s) => s.thumbnails.quality,
+      55,
+    ],
+    [
+      'uploads.chunkSizeBytes',
+      { uploads: { chunkSizeBytes: 16 * MiB } },
+      { uploads: { chunkSizeBytes: 'huge' } },
+      (s) => s.uploads.chunkSizeBytes,
+      16 * MiB,
+    ],
+    [
+      'uploads.chunkedEnabled',
+      { uploads: { chunkedEnabled: true } },
+      { uploads: { chunkedEnabled: 'yes' } },
+      (s) => s.uploads.chunkedEnabled,
+      true,
+    ],
+    [
+      'trash.retentionDays',
+      { trash: { retentionDays: 90 } },
+      { trash: { retentionDays: 'forever' } },
+      (s) => s.trash.retentionDays,
+      90,
+    ],
+    [
+      'trash.maxBytes',
+      { trash: { maxBytes: 5_000_000_000 } },
+      { trash: { maxBytes: 'lots' } },
+      (s) => s.trash.maxBytes,
+      5_000_000_000,
+    ],
+    [
+      'versions.maxPerFile',
+      { versions: { maxPerFile: 7 } },
+      { versions: { maxPerFile: 'many' } },
+      (s) => s.versions.maxPerFile,
+      7,
+    ],
+    [
+      'branding.appName',
+      { branding: { appName: 'Files' } },
+      { branding: { appName: 42 } },
+      (s) => s.branding.appName,
+      'Files',
+    ],
+  ])(
+    'leaves %s as it was, not reset to its default',
+    async (_field, stored, sent, readBack, kept) => {
+      await seed();
+      await patch(['admin'], stored);
+      expect(readBack(await readAsAdmin())).toEqual(kept);
+
+      const response = await patch(['admin'], sent);
+
+      expect(response.status).toBe(200);
+      expect(readBack(await readAsAdmin())).toEqual(kept);
+    }
+  );
+
+  it('leaves thumbnails as they were when "enabled" is not a boolean', async () => {
+    await seed();
+    await patch(['admin'], { thumbnails: { enabled: false } });
+
+    // Anything present used to count, and the service reads what is not a
+    // boolean as on: "false" switched thumbnails on for everybody.
+    const response = await patch(['admin'], { thumbnails: { enabled: 'false' } });
+
+    expect(response.status).toBe(200);
+    expect((await readAsAdmin()).thumbnails.enabled).toBe(false);
+  });
+
+  /** The one field where "nothing" is a value: no cap on the trash. */
+  it('takes null for the trash size cap, which removes the cap', async () => {
+    await seed();
+    await patch(['admin'], { trash: { maxBytes: 5_000_000_000 } });
+
+    await patch(['admin'], { trash: { maxBytes: null } });
+
+    expect((await readAsAdmin()).trash.maxBytes).toBeNull();
+  });
+});
+
+/**
+ * A number, but not one anybody chose: what an emptied or mistyped field sends.
+ *
+ * The shape is right, so the check above let these through, and the service
+ * brought each up to its lowest bound — a chunk size of 0 stored as 1 MiB, a
+ * thumbnail size of 0 as 64 pixels — in place of what the administrator had.
+ * A positive value beyond a bound is still brought within it.
+ */
+describe('a size or a count of nothing', () => {
+  it.each([
+    ['uploads.chunkSizeBytes', 0, 'uploads', 'chunkSizeBytes', 16 * MiB],
+    ['uploads.chunkSizeBytes', -MiB, 'uploads', 'chunkSizeBytes', 16 * MiB],
+    ['thumbnails.size', 0, 'thumbnails', 'size', 320],
+    ['thumbnails.quality', -5, 'thumbnails', 'quality', 55],
+    ['thumbnails.concurrency', 0, 'thumbnails', 'concurrency', 4],
+    // The trash and the file versions, which the settings page already refuses
+    // with these bounds — this is what an API client saw instead.
+    ['trash.retentionDays', 0, 'trash', 'retentionDays', 90],
+    ['trash.retentionDays', -5, 'trash', 'retentionDays', 90],
+    ['trash.maxPercent', 0, 'trash', 'maxPercent', 40],
+    ['trash.maxBytes', 0, 'trash', 'maxBytes', 5_000_000_000],
+    ['versions.keepAllHours', 0, 'versions', 'keepAllHours', 48],
+    ['versions.hourlyDays', -3, 'versions', 'hourlyDays', 14],
+    ['versions.dailyDays', 0, 'versions', 'dailyDays', 60],
+    ['versions.maxPerFile', 0, 'versions', 'maxPerFile', 7],
+    ['versions.sessionCheckpointMinutes', -1, 'versions', 'sessionCheckpointMinutes', 30],
+  ])('leaves %s as it was when sent %j', async (_label, sent, section, field, kept) => {
+    await seed();
+    await patch(['admin'], { [section]: { [field]: kept } });
+
+    const response = await patch(['admin'], { [section]: { [field]: sent } });
+
+    expect(response.status).toBe(200);
+    expect((await readAsAdmin())[section][field]).toBe(kept);
+  });
+
+  it('still brings a positive value beyond its bounds within them', async () => {
+    await seed();
+
+    await patch(['admin'], {
+      thumbnails: { size: 5000 },
+      uploads: { chunkSizeBytes: 1024 },
+      trash: { retentionDays: 9000 },
+      versions: { maxPerFile: 5000 },
+    });
+
+    const settings = await readAsAdmin();
+    expect(settings.thumbnails.size).toBe(1024);
+    expect(settings.uploads.chunkSizeBytes).toBe(MiB);
+    expect(settings.trash.retentionDays).toBe(3650);
+    expect(settings.versions.maxPerFile).toBe(1000);
+  });
+});
+
+describe('the application name', () => {
+  it.each([[''], ['   ']])('is left as it was when sent as %j', async (appName) => {
+    await seed();
+    await patch(['admin'], { branding: { appName: 'Files' } });
+
+    const response = await patch(['admin'], { branding: { appName } });
+
+    expect(response.status).toBe(200);
+    expect(response.body.branding.appName).toBe('Files');
+    expect((await readAsAdmin()).branding.appName).toBe('Files');
+  });
+
+  it('reads as the default where an empty one was stored before', async () => {
+    const db = await seed();
+    db.prepare(
+      `INSERT INTO system_settings (id, category, key, value, updated_at)
+       VALUES ('b1', 'branding', 'branding', ?, ?)`
+    ).run(JSON.stringify({ appName: '  ', appLogoUrl: '/logo.svg' }), new Date().toISOString());
+
+    const response = await request(buildApp([])).get('/api/branding');
+
+    expect(response.body.appName).toBe('Explorer');
+  });
+});
+
+describe('a section sent with only some of its fields', () => {
+  it('changes those fields and leaves the rest of the section as it was', async () => {
+    await seed();
+    await patch(['admin'], {
+      trash: { retentionDays: 90, maxPercent: 40 },
+      versions: { maxPerFile: 7, dailyDays: 60 },
+    });
+
+    await patch(['admin'], { trash: { retentionDays: 7 }, versions: { maxPerFile: 9 } });
+
+    const { trash, versions } = await readAsAdmin();
+    expect(trash).toMatchObject({ retentionDays: 7, maxPercent: 40 });
+    expect(versions).toMatchObject({ maxPerFile: 9, dailyDays: 60 });
+  });
+});
+
+describe('a list sent as something that is not a list', () => {
+  const HIDDEN_RULE = { path: 'Private', permissions: 'hidden', recursive: true };
+  const rulesOf = (settings) => settings.access.rules.map((r) => `${r.path}:${r.permissions}`);
+
+  it.each([
+    [
+      'the access rules',
+      { access: { rules: [HIDDEN_RULE] } },
+      { access: { rules: 'none' } },
+      rulesOf,
+      ['Private:hidden'],
+    ],
+    [
+      'the access rules, when the list is missing',
+      { access: { rules: [HIDDEN_RULE] } },
+      { access: {} },
+      rulesOf,
+      ['Private:hidden'],
+    ],
+    [
+      'the search index exclusions',
+      { searchIndex: { excludedPaths: ['Private'] } },
+      { searchIndex: { excludedPaths: 'Elsewhere' } },
+      (s) => s.searchIndex.excludedPaths,
+      ['Private'],
+    ],
+    [
+      'the folder size exclusions',
+      { folderSize: { excludedPaths: ['Private'] } },
+      { folderSize: { excludedPaths: null } },
+      (s) => s.folderSize.excludedPaths,
+      ['Private'],
+    ],
+  ])('leaves %s in place', async (_label, stored, sent, readBack, kept) => {
+    await seed();
+    await patch(['admin'], stored);
+    expect(readBack(await readAsAdmin())).toEqual(kept);
+
+    const response = await patch(['admin'], sent);
+
+    expect(response.status).toBe(200);
+    expect(readBack(await readAsAdmin())).toEqual(kept);
+  });
+});
+
+/**
+ * A rule the server cannot store as it was written.
+ *
+ * Every one of these used to be sanitised away with a 200: the row for
+ * `../Secret` vanished from the page the moment it was saved, and an
+ * administrator was left believing a folder was hidden that never was. Worse,
+ * permissions that were not one of the three became `rw`, so a mistyped
+ * `readonly` opened a folder for writing instead of refusing the word.
+ *
+ * Each one stores a good rule first, so a refusal can be told from a list that
+ * was replaced by nothing.
+ */
+describe('an access rule the server cannot store', () => {
+  const STORED = { id: 'kept', path: 'Private', permissions: 'hidden', recursive: true };
+
+  it.each([
+    [
+      'a path that climbs out of the volume',
+      { path: '../Secret', permissions: 'hidden' },
+      /Traversal outside the volume root/,
+    ],
+    ['no path at all', { path: '', permissions: 'ro' }, /a rule needs the path of a folder/],
+    [
+      'permissions that are not one of the three',
+      { path: 'Legal', permissions: 'readonly' },
+      /is not one of the permissions/,
+    ],
+    [
+      'a recursive flag that is not one',
+      { path: 'Legal', permissions: 'ro', recursive: 'yes' },
+      /does not say whether the rule covers what is inside/,
+    ],
+    ['something that is not a rule', 'Legal', /this is not a rule/],
+  ])('is refused, with the reason, and changes nothing: %s', async (_label, rule, reason) => {
+    await seed();
+    await patch(['admin'], { access: { rules: [STORED] } });
+
+    const response = await patch(['admin'], { access: { rules: [STORED, rule] } });
+
+    expect(response.status).toBe(400);
+    expect(response.body.error.message).toMatch(reason);
+    // Numbered as the page numbers the rows, so the reason names the one to fix.
+    expect(response.body.error.message).toMatch(/^Access rule 2: /);
+    expect((await readAsAdmin()).access.rules).toEqual([expect.objectContaining(STORED)]);
+  });
+
+  /**
+   * Read back, the same rule is still dropped rather than refused. A value an
+   * older version stored, or one edited into app.db by hand, must not make the
+   * settings unreadable — unreadable settings are every hidden folder visible.
+   */
+  it('is dropped, not refused, when it is already in the database', async () => {
+    const db = await seed();
+    db.prepare(
+      `INSERT INTO system_settings (id, category, key, value, updated_at)
+       VALUES ('a1', 'system', 'access', ?, ?)`
+    ).run(
+      JSON.stringify({ rules: [STORED, { path: '../Secret', permissions: 'hidden' }] }),
+      new Date().toISOString()
+    );
+
+    const settings = await readAsAdmin();
+
+    expect(settings.access.rules).toEqual([expect.objectContaining(STORED)]);
+  });
+});
+
+describe('what a regular account may not change', () => {
+  /**
+   * `settings-write-boundary.test.js` covers one field of five sections. These
+   * are the other three, and the access rules are the ones that decide which
+   * folders anybody may see.
+   */
+  it.each([
+    ['the access rules', { access: { rules: [] } }, (s) => s.access.rules.length, 1],
+    ['the trash', { trash: { retentionDays: 1 } }, (s) => s.trash.retentionDays, 90],
+    ['the file versions', { versions: { maxPerFile: 1 } }, (s) => s.versions.maxPerFile, 7],
+  ])('is refused, and unchanged: %s', async (_label, sent, readBack, kept) => {
+    await seed();
+    await patch(['admin'], {
+      access: { rules: [{ path: 'Private', permissions: 'hidden', recursive: true }] },
+      trash: { retentionDays: 90 },
+      versions: { maxPerFile: 7 },
+    });
+
+    const response = await patch(['user'], sent);
+
+    expect(response.status).toBe(403);
+    expect(response.body.error).toBe('Admin access required for system settings.');
+    expect(readBack(await readAsAdmin())).toBe(kept);
+  });
+});
+
+/**
+ * A save the route refuses halfway.
+ *
+ * One payload carries a section per group, and the sections used to be applied
+ * one after another: a valid one before a refused one was stored, and the
+ * answer was still 400. The person saw their save refused, the page kept the
+ * values it had sent, and the server had taken some of them — the two
+ * disagreed until the next reload, which is the worst state of the three.
+ *
+ * The access rules are the only section that refuses what it was sent, so they
+ * are what makes this reachable. The sections are checked in the order they
+ * are declared, and thumbnails come first: it is written before access is
+ * reached, or it is not written at all.
+ */
+describe('a payload with a valid section and a refused one', () => {
+  const REFUSED = { access: { rules: [{ path: 'Private', permissions: 'sideways' }] } };
+
+  it('stores none of it, and says which rule it refused', async () => {
+    await seed();
+    await patch(['admin'], { thumbnails: { size: 321 } });
+
+    const response = await patch(['admin'], { ...REFUSED, thumbnails: { size: 654 } });
+
+    expect(response.status).toBe(400);
+    expect(response.body.error.message).toMatch(/Access rule 1/);
+    expect((await readAsAdmin()).thumbnails.size).toBe(321);
+  });
+
+  /**
+   * The other direction, so this cannot pass on the order of the sections
+   * alone: branding is written after access, and must be no more stored than
+   * thumbnails was.
+   */
+  it('stores nothing that comes after the refusal either', async () => {
+    await seed();
+    await patch(['admin'], { branding: { appName: 'Before' } });
+
+    const response = await patch(['admin'], { ...REFUSED, branding: { appName: 'After' } });
+
+    expect(response.status).toBe(400);
+    expect((await readAsAdmin()).branding.appName).toBe('Before');
+  });
+
+  /** A preference of one's own is not stored by a save the server refuses. */
+  it('leaves the sender’s own preferences alone', async () => {
+    await seed();
+    await patch(['admin'], { user: { showHiddenFiles: true } });
+
+    const response = await patch(['admin'], { ...REFUSED, user: { showHiddenFiles: false } });
+
+    expect(response.status).toBe(400);
+    expect((await readAsAdmin()).user.showHiddenFiles).toBe(true);
+  });
+
+  /** And a save with nothing wrong in it still writes every section it carries. */
+  it('still writes every section when none of them is refused', async () => {
+    await seed();
+
+    const response = await patch(['admin'], {
+      thumbnails: { size: 654 },
+      branding: { appName: 'After' },
+      access: { rules: [{ path: 'Private', permissions: 'hidden', recursive: true }] },
+    });
+
+    expect(response.status).toBe(200);
+    const settings = await readAsAdmin();
+    expect(settings.thumbnails.size).toBe(654);
+    expect(settings.branding.appName).toBe('After');
+    expect(settings.access.rules.map((rule) => rule.path)).toEqual(['Private']);
+  });
+});
+
+/**
+ * A rule that names no folder, and an exclusion list stored as it came.
+ *
+ * Both are the same kind of defect: something an administrator saved, that the
+ * page then showed back to them, doing nothing. A path of nothing but spaces
+ * normalises to itself, so it was stored and matched no folder. The search
+ * index had no sanitiser on its way into storage, so its list kept whatever
+ * spacing and repetition it arrived with — the worker was handed a clean copy
+ * and behaved, which is exactly why nobody noticed the stored one.
+ */
+describe('what a rule and an exclusion list are held to', () => {
+  it.each([['   '], ['\t'], [''], ['  \n ']])(
+    'refuses an access rule whose path is %j',
+    async (blank) => {
+      await seed();
+
+      const response = await patch(['admin'], {
+        access: { rules: [{ path: blank, permissions: 'hidden' }] },
+      });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error.message).toMatch(/Access rule 1.*folder/);
+      expect((await readAsAdmin()).access.rules).toEqual([]);
+    }
+  );
+
+  it('keeps a folder whose name has spaces in it', async () => {
+    await seed();
+
+    const response = await patch(['admin'], {
+      access: { rules: [{ path: 'My Documents/Q1 2026', permissions: 'ro' }] },
+    });
+
+    expect(response.status).toBe(200);
+    expect((await readAsAdmin()).access.rules.map((rule) => rule.path)).toEqual([
+      'My Documents/Q1 2026',
+    ]);
+  });
+
+  it('stores the search index exclusions as the worker is given them', async () => {
+    const db = await seed();
+
+    const response = await patch(['admin'], {
+      searchIndex: { excludedPaths: ['  Private  ', 'Private', '', '/Cache/'] },
+    });
+
+    expect(response.status).toBe(200);
+    const stored = JSON.parse(
+      db
+        .prepare(
+          "SELECT value FROM system_settings WHERE category = 'system' AND key = 'searchIndex'"
+        )
+        .get().value
+    );
+
+    // Trimmed, emptied of nothing, and each folder once — the list the worker
+    // is handed, rather than what the request happened to carry.
+    expect(stored.excludedPaths).not.toContain('  Private  ');
+    expect(stored.excludedPaths).not.toContain('');
+    expect(stored.excludedPaths.filter((entry) => entry === 'Private')).toHaveLength(1);
+    expect(stored.excludedPaths).toEqual((await readAsAdmin()).searchIndex.excludedPaths);
+  });
+});
+
+/**
+ * The access section is saved from two controls: the list of rules, and the one
+ * switch above them that holds administrators to every rule.
+ *
+ * The route used to forward the rules alone. Saving them switched the setting
+ * back off — silently widening what administrators could reach — and a request
+ * that carried only the switch stored nothing at all, so turning it on did
+ * nothing whatever the page showed. The service was right either way, which is
+ * why only a test that goes through the route catches it.
+ */
+describe('the access section, saved half at a time', () => {
+  const RULE = { path: 'Team', recursive: true, permissions: 'ro', appliesToAdmins: true };
+
+  const storeBoth = () =>
+    patch(['admin'], { access: { rules: [RULE], applyToAdmins: true } }).expect(200);
+
+  it('keeps the switch when only the rules are sent', async () => {
+    await seed();
+    await storeBoth();
+
+    await patch(['admin'], {
+      access: { rules: [{ ...RULE, path: 'Finance' }] },
+    }).expect(200);
+
+    const { access } = await readAsAdmin();
+    expect(access.applyToAdmins).toBe(true);
+    expect(access.rules.map((rule) => rule.path)).toEqual(['Finance']);
+  });
+
+  it('keeps the rules when only the switch is sent', async () => {
+    await seed();
+    await storeBoth();
+
+    await patch(['admin'], { access: { applyToAdmins: false } }).expect(200);
+
+    const { access } = await readAsAdmin();
+    expect(access.applyToAdmins).toBe(false);
+    expect(access.rules.map((rule) => rule.path)).toEqual(['Team']);
+  });
+
+  it('stores what each rule says about administrators', async () => {
+    await seed();
+
+    await patch(['admin'], {
+      access: {
+        rules: [
+          { path: 'Team', recursive: true, permissions: 'ro', appliesToAdmins: true },
+          { path: 'Vault', recursive: true, permissions: 'hidden', appliesToAdmins: false },
+        ],
+      },
+    }).expect(200);
+
+    const { access } = await readAsAdmin();
+    expect(access.rules.map((rule) => rule.appliesToAdmins)).toEqual([true, false]);
+  });
+
+  it('refuses a switch that is not a yes or a no, and stores nothing', async () => {
+    await seed();
+    await storeBoth();
+
+    await patch(['admin'], { access: { applyToAdmins: 'yes' } }).expect(400);
+
+    const { access } = await readAsAdmin();
+    expect(access.applyToAdmins).toBe(true);
+  });
+});
diff --git a/backend/tests/routes/settings-preferences.test.js b/backend/tests/routes/settings-preferences.test.js
index 26c503722..ac95cee92 100644
--- a/backend/tests/routes/settings-preferences.test.js
+++ b/backend/tests/routes/settings-preferences.test.js
@@ -66,26 +66,34 @@ describe('a preference the screen offers', () => {
   /**
    * Every key the service knows how to sanitise is a key this route accepts:
    * one list, so neither can gain a preference the other drops.
+   *
+   * A value each preference actually takes, and the value is what is asserted
+   * rather than the key being present: the answer carries the settings as they
+   * now stand, so a key stored by an earlier turn of this loop would still be
+   * there after the one that dropped it.
    */
+  const A_VALUE_IT_TAKES = {
+    defaultShareExpiration: null,
+    skipHome: null,
+    locale: 'fr',
+    defaultView: 'list',
+  };
+
   it('accepts exactly what the settings service calls a preference', async () => {
-    const { USER_SETTING_KEYS } = load('src/services/settingsService');
-
-    for (const key of USER_SETTING_KEYS) {
-      const value =
-        key === 'defaultShareExpiration' || key === 'skipHome'
-          ? null
-          : key === 'locale'
-            ? 'fr'
-            : true;
+    const { WRITABLE_USER_SETTINGS } = load('src/services/settingsService');
+
+    for (const key of WRITABLE_USER_SETTINGS) {
+      const value = key in A_VALUE_IT_TAKES ? A_VALUE_IT_TAKES[key] : true;
       const response = await save({ [key]: value });
-      expect(response.body.user, `${key} was dropped`).toHaveProperty(key);
+      expect(response.body.user?.[key], `${key} was dropped`).toEqual(value);
+      expect((await stored())[key], `${key} was not stored`).toEqual(value);
     }
   });
 
   it('ignores a key that is not a preference', async () => {
     const response = await save({ isAdmin: true });
 
-    expect(response.body.user ?? {}).toEqual({});
+    expect(response.body.user).not.toHaveProperty('isAdmin');
     expect((await stored()).isAdmin).toBeUndefined();
   });
 });
diff --git a/backend/tests/routes/settings-user-preferences.test.js b/backend/tests/routes/settings-user-preferences.test.js
new file mode 100644
index 000000000..2c196b9d3
--- /dev/null
+++ b/backend/tests/routes/settings-user-preferences.test.js
@@ -0,0 +1,323 @@
+import { describe, it, expect } from 'vitest';
+import request from 'supertest';
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+const MODULES = [
+  'src/services/settingsService',
+  'src/services/db',
+  'src/routes/settings',
+  'src/middleware/errorHandler',
+];
+
+/**
+ * The route, not the service underneath it.
+ *
+ * A preference used to have to be listed in two places — sanitised in the
+ * service and allowed in the route — and a key present in one but not the other
+ * was accepted by the API, silently dropped, and answered with its previous
+ * value. The client applied that answer, so the switch flicked itself back off.
+ * Testing setUserSetting directly could not see it: the route was the half that
+ * was missing.
+ */
+const buildContext = async () => {
+  const envContext = await setupTestEnv({ tag: 'settings-route-test-', modules: MODULES });
+  const settingsService = envContext.requireFresh('src/services/settingsService');
+  const settingsRoutes = envContext.requireFresh('src/routes/settings');
+  const { errorHandler } = envContext.requireFresh('src/middleware/errorHandler');
+
+  const dbService = envContext.requireFresh('src/services/db');
+  const db = await dbService.getDb();
+  const now = new Date().toISOString();
+  db.prepare(
+    `INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run('user-1', 'user-1@example.com', 1, 'user-1', 'User 1', '["user"]', now, now);
+
+  const express = require('express');
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    req.user = { id: 'user-1', email: 'user-1@example.com', roles: ['user'] };
+    next();
+  });
+  app.use('/api', settingsRoutes);
+  app.use(errorHandler);
+
+  return { envContext, app, settingsService };
+};
+
+// A value that is different from every default, so "it came back" cannot be
+// confused with "it was already like that".
+const NON_DEFAULT = {
+  showHiddenFiles: true,
+  showThumbnails: false,
+  showSidebarFavorites: false,
+  showSidebarShares: false,
+  showSidebarTools: false,
+  markdownOpensInEditor: true,
+  documentsOpenInNewTab: true,
+  // On by default, so off is the value that has to survive a round trip.
+  showVersionMarks: false,
+  defaultShareExpiration: { value: 3, unit: 'days' },
+  skipHome: true,
+  defaultView: 'list',
+  // Null by default, which means "follow the browser".
+  locale: 'nl',
+};
+
+describe('PATCH /api/settings — user preferences', () => {
+  it('saves the markdown preference and reads it back', async () => {
+    const { envContext, app } = await buildContext();
+    try {
+      const saved = await request(app)
+        .patch('/api/settings')
+        .send({ user: { markdownOpensInEditor: true } })
+        .expect(200);
+
+      // The response is what the client applies to its own state, so the value
+      // has to be in it — not merely stored somewhere.
+      expect(saved.body.user?.markdownOpensInEditor).toBe(true);
+
+      const reread = await request(app).get('/api/settings').expect(200);
+      expect(reread.body.user.markdownOpensInEditor).toBe(true);
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+
+  // Every writable preference, so the next one added is covered without anyone
+  // having to remember to write a test for it.
+  it('saves and reads back every writable preference', async () => {
+    const { envContext, app, settingsService } = await buildContext();
+    try {
+      const writable = [...settingsService.WRITABLE_USER_SETTINGS];
+
+      // Guard against the list and this test drifting apart.
+      for (const key of writable) {
+        expect(NON_DEFAULT, `add ${key} to NON_DEFAULT`).toHaveProperty(key);
+      }
+
+      const payload = Object.fromEntries(writable.map((key) => [key, NON_DEFAULT[key]]));
+      const saved = await request(app).patch('/api/settings').send({ user: payload }).expect(200);
+
+      for (const key of writable) {
+        expect(saved.body.user?.[key], `${key} missing from the response`).toEqual(
+          NON_DEFAULT[key]
+        );
+      }
+
+      const reread = await request(app).get('/api/settings').expect(200);
+      for (const key of writable) {
+        expect(reread.body.user[key], `${key} was not persisted`).toEqual(NON_DEFAULT[key]);
+      }
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+
+  /**
+   * A default expiry that is not one used to be stored as no default: minus
+   * three weeks sent from the page removed the default the person had, and the
+   * page then showed an empty field.
+   */
+  it.each([
+    [{ value: -3, unit: 'weeks' }],
+    [{ value: 0, unit: 'days' }],
+    [{ value: 3, unit: 'years' }],
+    [5],
+    ['soon'],
+  ])('leaves the default share expiry as it was when sent %j', async (sent) => {
+    const { envContext, app } = await buildContext();
+    try {
+      await request(app)
+        .patch('/api/settings')
+        .send({ user: { defaultShareExpiration: { value: 3, unit: 'days' } } })
+        .expect(200);
+
+      const saved = await request(app)
+        .patch('/api/settings')
+        .send({ user: { defaultShareExpiration: sent } })
+        .expect(200);
+
+      expect(saved.body.user.defaultShareExpiration).toEqual({ value: 3, unit: 'days' });
+      const reread = await request(app).get('/api/settings').expect(200);
+      expect(reread.body.user.defaultShareExpiration).toEqual({ value: 3, unit: 'days' });
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+
+  it('removes the default share expiry when sent null', async () => {
+    const { envContext, app } = await buildContext();
+    try {
+      await request(app)
+        .patch('/api/settings')
+        .send({ user: { defaultShareExpiration: { value: 3, unit: 'days' } } })
+        .expect(200);
+
+      await request(app)
+        .patch('/api/settings')
+        .send({ user: { defaultShareExpiration: null } })
+        .expect(200);
+
+      const reread = await request(app).get('/api/settings').expect(200);
+      expect(reread.body.user.defaultShareExpiration).toBeNull();
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+
+  /**
+   * A switch used to be `Boolean(whatever came)`, which has an opinion about
+   * everything: `'false'` — what a form field, a query string or a shell
+   * client sends — was true, and `0` was false. Either way the preference was
+   * set to something nobody had chosen, and answered as though they had.
+   *
+   * Each case stores the opposite of what the coercion would have made of the
+   * value, so "it stayed" cannot be confused with "it was already like that".
+   */
+  it.each([
+    ['showHiddenFiles', 'false', false],
+    ['showThumbnails', 0, true],
+    ['showSidebarFavorites', 'no', false],
+    ['markdownOpensInEditor', '', true],
+    ['skipHome', 0, true],
+  ])('leaves %s as it was when sent %j', async (key, sent, stored) => {
+    const { envContext, app } = await buildContext();
+    try {
+      await request(app)
+        .patch('/api/settings')
+        .send({ user: { [key]: stored } })
+        .expect(200);
+
+      const saved = await request(app)
+        .patch('/api/settings')
+        .send({ user: { [key]: sent } })
+        .expect(200);
+
+      expect(saved.body.user[key]).toBe(stored);
+      const reread = await request(app).get('/api/settings').expect(200);
+      expect(reread.body.user[key]).toBe(stored);
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+
+  /**
+   * A view mode we do not have used to become null, and null is a value here:
+   * the built-in default. One unknown word therefore put every folder back to
+   * the built-in view rather than being refused.
+   */
+  it('leaves the default view as it was when sent a mode there is no such thing as', async () => {
+    const { envContext, app } = await buildContext();
+    try {
+      await request(app)
+        .patch('/api/settings')
+        .send({ user: { defaultView: 'list' } })
+        .expect(200);
+
+      const saved = await request(app)
+        .patch('/api/settings')
+        .send({ user: { defaultView: 'mosaic' } })
+        .expect(200);
+
+      expect(saved.body.user.defaultView).toBe('list');
+      const reread = await request(app).get('/api/settings').expect(200);
+      expect(reread.body.user.defaultView).toBe('list');
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+
+  it('still takes null for the default view, which is the built-in one', async () => {
+    const { envContext, app } = await buildContext();
+    try {
+      await request(app)
+        .patch('/api/settings')
+        .send({ user: { defaultView: 'list' } })
+        .expect(200);
+
+      await request(app)
+        .patch('/api/settings')
+        .send({ user: { defaultView: null } })
+        .expect(200);
+
+      const reread = await request(app).get('/api/settings').expect(200);
+      expect(reread.body.user.defaultView).toBeNull();
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+
+  /**
+   * The language an account reads in, which is the account's and not the
+   * browser's: the only other way to choose one is the picker on the sign-in
+   * page, which writes into the browser and is never seen again once somebody
+   * is signed in (nxzai/NextExplorer discussion #408).
+   */
+  describe('the language', () => {
+    it('follows the browser until an account says otherwise', async () => {
+      const { envContext, app } = await buildContext();
+      try {
+        const fresh = await request(app).get('/api/settings').expect(200);
+        expect(fresh.body.user.locale ?? null).toBeNull();
+
+        const saved = await request(app)
+          .patch('/api/settings')
+          .send({ user: { locale: 'pt-BR' } })
+          .expect(200);
+        expect(saved.body.user.locale).toBe('pt-BR');
+
+        const back = await request(app)
+          .patch('/api/settings')
+          .send({ user: { locale: null } })
+          .expect(200);
+        expect(back.body.user.locale).toBeNull();
+      } finally {
+        await envContext.cleanup();
+      }
+    });
+
+    /**
+     * Refused rather than read as "follow the browser": a value that is not a
+     * language tag is a mistake, and turning it into the default would put the
+     * choice back where it was with nothing to show for it.
+     */
+    it.each([['not a language'], ['en_US!'], [42], [{ code: 'fr' }], [['fr']]])(
+      'leaves the language as it was when sent %j',
+      async (sent) => {
+        const { envContext, app } = await buildContext();
+        try {
+          await request(app)
+            .patch('/api/settings')
+            .send({ user: { locale: 'nl' } })
+            .expect(200);
+
+          const saved = await request(app)
+            .patch('/api/settings')
+            .send({ user: { locale: sent } })
+            .expect(200);
+
+          expect(saved.body.user.locale).toBe('nl');
+        } finally {
+          await envContext.cleanup();
+        }
+      }
+    );
+  });
+
+  it('ignores a key that is not a user preference', async () => {
+    const { envContext, app } = await buildContext();
+    try {
+      await request(app)
+        .patch('/api/settings')
+        .send({ user: { notASetting: 'x' } })
+        .expect(200);
+
+      const reread = await request(app).get('/api/settings').expect(200);
+      expect(reread.body.user.notASetting).toBeUndefined();
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+});
diff --git a/backend/tests/routes/settings-write-boundary.test.js b/backend/tests/routes/settings-write-boundary.test.js
new file mode 100644
index 000000000..7fb754c41
--- /dev/null
+++ b/backend/tests/routes/settings-write-boundary.test.js
@@ -0,0 +1,189 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * Who may change what, on the one endpoint that writes every setting.
+ *
+ * `PATCH /api/settings` takes a single payload with a section per group and
+ * decides section by section: anyone signed in may change their own
+ * preferences, only an administrator may change the ones that affect everybody.
+ * Fifty-five paths through one function, and only the read side of that
+ * boundary had a test — a regular account being refused the *write* did not.
+ *
+ * The response is the whole settings document rather than a list of changes,
+ * so what is asserted is the value before and after, not the shape of a reply.
+ */
+
+let currentEnv;
+
+afterEach(async () => {
+  if (currentEnv) {
+    await currentEnv.cleanup();
+    currentEnv = null;
+  }
+});
+
+const seed = async (env = {}) => {
+  currentEnv = await setupTestEnv({ tag: 'settings-write-', env });
+  const dbService = currentEnv.requireFresh('src/services/db');
+  const db = await dbService.getDb();
+  // A preference is stored against an account that has to exist; without the
+  // row the write fails on a foreign key and the route answers 500.
+  const now = new Date().toISOString();
+  db.prepare(
+    `INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
+     VALUES ('u1','u@example.com',1,'u','U','["user"]', ?, ?)`
+  ).run(now, now);
+};
+
+const buildApp = (roles) => {
+  const routes = currentEnv.requireFresh('src/routes/settings');
+  const { errorHandler } = currentEnv.requireFresh('src/middleware/errorHandler');
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    req.user = { id: 'u1', email: 'u@example.com', roles };
+    next();
+  });
+  app.use('/api', routes);
+  app.use(errorHandler);
+  return app;
+};
+
+const patch = (roles, payload) => request(buildApp(roles)).patch('/api/settings').send(payload);
+const read = (roles) => request(buildApp(roles)).get('/api/settings');
+
+/**
+ * One writable field per section that only an administrator may touch, with a
+ * value that differs from the default, so a change is visible either way.
+ */
+const SYSTEM_CHANGES = [
+  ['thumbnails', { size: 321 }, (settings) => settings.thumbnails?.size],
+  ['uploads', { chunkedEnabled: true }, (settings) => settings.uploads?.chunkedEnabled],
+  ['branding', { appName: 'Renamed' }, (settings) => settings.branding?.appName],
+  [
+    'folderSize',
+    { excludedPaths: ['Sneaked/in'] },
+    (settings) => settings.folderSize?.excludedPaths?.join(),
+  ],
+  [
+    'searchIndex',
+    { excludedPaths: ['Sneaked/in'] },
+    (settings) => settings.searchIndex?.excludedPaths?.join(),
+  ],
+];
+
+describe('what only an administrator may change', () => {
+  /**
+   * Refused outright rather than quietly dropped. Answering 200 to a change
+   * that was not made is worse than saying no: the page that asked has no way
+   * to tell, and shows the value the person typed.
+   */
+  it.each(SYSTEM_CHANGES)(
+    'is refused, and unchanged, when a regular account asks: %s',
+    async (section, value, readBack) => {
+      await seed();
+      const before = readBack((await read(['admin'])).body);
+
+      const response = await patch(['user'], { [section]: value });
+
+      expect(response.status).toBe(403);
+      expect(readBack((await read(['admin'])).body)).toEqual(before);
+    }
+  );
+
+  it.each(SYSTEM_CHANGES)(
+    'is applied when an administrator asks: %s',
+    async (section, value, readBack) => {
+      await seed();
+      const before = readBack((await read(['admin'])).body);
+
+      await patch(['admin'], { [section]: value });
+
+      const after = readBack((await read(['admin'])).body);
+      expect(after).not.toEqual(before);
+    }
+  );
+
+  /**
+   * A payload that mixes the two is refused whole, and the preference in it is
+   * not kept either.
+   *
+   * It used to be: the user section was applied first and the refusal raised
+   * afterwards, so this answered 403 with the preference already saved. A
+   * request reported as refused that changed something is the one answer a
+   * caller cannot act on.
+   */
+  it('refuses a payload that mixes its own preference with a system one', async () => {
+    await seed();
+
+    const response = await patch(['user'], {
+      branding: { appName: 'Taken over' },
+      user: { markdownOpensInEditor: true },
+    });
+
+    expect(response.status).toBe(403);
+    expect((await read(['user'])).body.user?.markdownOpensInEditor).not.toBe(true);
+    expect((await read(['admin'])).body.branding?.appName).not.toBe('Taken over');
+  });
+
+  it('takes a preference on its own from a regular account', async () => {
+    await seed();
+
+    const response = await patch(['user'], { user: { markdownOpensInEditor: true } });
+
+    expect(response.status).toBe(200);
+    expect(response.body.user?.markdownOpensInEditor).toBe(true);
+  });
+});
+
+describe('what a value has to look like to be stored', () => {
+  it('takes a boolean from anything truthy, since a checkbox may send either', async () => {
+    await seed();
+
+    const response = await patch(['admin'], { thumbnails: { enabled: 'yes' } });
+
+    expect(response.body.thumbnails.enabled).toBe(true);
+  });
+
+  /**
+   * A size that is not a number is a size nobody chose. Storing it would put
+   * something that is not a pixel count where one belongs, and every thumbnail
+   * generated afterwards would carry it.
+   *
+   * Refused twice — once by the route and once by the service that stores it —
+   * so neither mutation alone fails this. Removing both does. Said out loud
+   * because a single surviving mutation reads like a gap and is not one.
+   */
+  it.each([['not-a-number'], [null], [Infinity]])(
+    'keeps the size it had when given %s',
+    async (size) => {
+      await seed();
+      const before = (await read(['admin'])).body.thumbnails.size;
+
+      await patch(['admin'], { thumbnails: { size } });
+
+      expect((await read(['admin'])).body.thumbnails.size).toBe(before);
+    }
+  );
+
+  it('takes a size that is a number', async () => {
+    await seed();
+
+    await patch(['admin'], { thumbnails: { size: 256 } });
+
+    expect((await read(['admin'])).body.thumbnails.size).toBe(256);
+  });
+
+  it('ignores a section that is not an object', async () => {
+    await seed();
+    const before = (await read(['admin'])).body.thumbnails;
+
+    const response = await patch(['admin'], { thumbnails: 'enabled please' });
+
+    expect(response.status).toBe(200);
+    expect((await read(['admin'])).body.thumbnails).toEqual(before);
+  });
+});
diff --git a/backend/tests/routes/share-counters.test.js b/backend/tests/routes/share-counters.test.js
index ddfc9ac7b..78cc9e1fd 100644
--- a/backend/tests/routes/share-counters.test.js
+++ b/backend/tests/routes/share-counters.test.js
@@ -98,7 +98,15 @@ describe('a share link', () => {
     expect(await numbers(id)).toEqual({ opened: 2, downloaded: 0 });
   });
 
-  it('counts a file leaving as a download', async () => {
+  /**
+   * Counted the way the file is delivered, not by which route asked for it.
+   *
+   * Every fetch of `/file/...` used to be a download, so reading a text file in
+   * the browser — which never leaves the page — was written down as a copy
+   * taken away. An owner reading "downloaded 40 times" was reading the number
+   * of times somebody had looked at it.
+   */
+  it('counts a file shown in the page as an opening', async () => {
     const { token, id } = await seedShare();
     const app = buildApp();
 
@@ -106,6 +114,19 @@ describe('a share link', () => {
     const file = await request(app).get(`/api/share/${token}/file/file.txt`);
 
     expect(file.status).toBe(200);
+    expect(file.headers['content-disposition'] || '').not.toMatch(/attachment/);
+    expect(await numbers(id)).toEqual({ opened: 2, downloaded: 0 });
+  });
+
+  it('counts a file handed over as a download', async () => {
+    const { token, id } = await seedShare();
+    const app = buildApp();
+
+    await request(app).get(`/api/share/${token}/access`);
+    const file = await request(app).get(`/api/share/${token}/file/file.txt?mode=download`);
+
+    expect(file.status).toBe(200);
+    expect(file.headers['content-disposition'] || '').toMatch(/attachment/);
     expect(await numbers(id)).toEqual({ opened: 1, downloaded: 1 });
   });
 
diff --git a/backend/tests/routes/share-door.test.js b/backend/tests/routes/share-door.test.js
new file mode 100644
index 000000000..ca1b6ea96
--- /dev/null
+++ b/backend/tests/routes/share-door.test.js
@@ -0,0 +1,615 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import express from 'express';
+import cookieParser from 'cookie-parser';
+import request from 'supertest';
+
+import { setupTestEnv, clearModuleCache } from '../helpers/env-test-utils.js';
+
+/**
+ * The three routes a shared link is opened through.
+ *
+ * `/info` is answered to anyone holding a token, before any password has been
+ * typed — so what it does *not* say matters as much as what it does: where the
+ * file lives on the server, and who the share was named to, are not a visitor's
+ * to learn from a link they may not even be able to open.
+ *
+ * `/verify` and `/access` are the door itself. Between them they decide who
+ * gets a guest session, who is sent to sign in, and who is turned away — and
+ * the rules are not symmetrical: a password protects a link from everyone but
+ * its owner, being signed in is not the same as knowing it, and a share named
+ * to people is not opened by a password at all.
+ */
+
+let envContext;
+
+beforeAll(async () => {
+  envContext = await setupTestEnv({
+    tag: 'share-door-test-',
+    env: { USER_VOLUMES: 'true' },
+    modules: [
+      'src/services/db',
+      'src/services/users',
+      'src/services/userVolumesService',
+      'src/services/sharesService',
+      'src/services/guestSessionService',
+      'src/utils/pathUtils',
+      'src/middleware/authMiddleware',
+      'src/middleware/errorHandler',
+      'src/routes/shares',
+    ],
+  });
+});
+
+afterAll(async () => {
+  await envContext.cleanup();
+});
+
+const buildApp = ({ user } = {}) => {
+  clearModuleCache('src/config/env');
+  clearModuleCache('src/config/index');
+
+  const sharesRoutes = envContext.requireFresh('src/routes/shares');
+  const { errorHandler } = envContext.requireFresh('src/middleware/errorHandler');
+  const authMiddleware = envContext.requireFresh('src/middleware/authMiddleware');
+
+  const app = express();
+  app.use(express.json());
+  app.use(cookieParser());
+  app.use((req, _res, next) => {
+    req.session = user ? { localUserId: user.id } : {};
+    next();
+  });
+  app.use(authMiddleware);
+  app.use('/api/shares', sharesRoutes);
+  app.use('/api/share', sharesRoutes);
+  app.use(errorHandler);
+  return app;
+};
+
+let seq = 0;
+
+/** An owner with a volume of their own, and something in it. */
+const makeOwner = async (files = { 'hello.txt': 'bonjour' }) => {
+  seq += 1;
+  const usersService = envContext.requireFresh('src/services/users');
+  const userVolumesService = envContext.requireFresh('src/services/userVolumesService');
+
+  const root = path.join(envContext.tmpRoot, `door-volume-${seq}`);
+  await fs.mkdir(root, { recursive: true });
+  for (const [name, contents] of Object.entries(files)) {
+    await fs.mkdir(path.dirname(path.join(root, name)), { recursive: true });
+    await fs.writeFile(path.join(root, name), contents);
+  }
+
+  const user = await usersService.createLocalUser({
+    email: `door-${seq}@example.com`,
+    username: `door-${seq}`,
+    displayName: `Door ${seq}`,
+    password: 'secret123',
+    roles: ['user'],
+  });
+  const label = `DoorVol${seq}`;
+  await userVolumesService.addVolumeToUser({
+    userId: user.id,
+    label,
+    volumePath: root,
+    accessMode: 'readwrite',
+  });
+
+  return { user, label, root };
+};
+
+const createShare = async (user, body) => {
+  const response = await request(buildApp({ user })).post('/api/shares').send(body);
+  expect(response.status).toBe(201);
+  return response.body;
+};
+
+const visitor = () => buildApp();
+
+describe('what a link tells someone holding it', () => {
+  it('names the share and says what it is', async () => {
+    const { user, label } = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      label: 'Le mot de passe du wifi',
+    });
+
+    const info = await request(visitor()).get(`/api/share/${share.shareToken}/info`);
+
+    expect(info.status).toBe(200);
+    expect(info.body).toMatchObject({
+      shareToken: share.shareToken,
+      label: 'Le mot de passe du wifi',
+      isDirectory: false,
+      hasPassword: false,
+      sharingType: 'anyone',
+      isExpired: false,
+    });
+  });
+
+  /**
+   * A token is not a permission. Anyone who has one — from a forwarded message,
+   * a browser history, a proxy log — can call this before typing a password, so
+   * it must not describe the server's filesystem or name the people the share
+   * was made for.
+   */
+  it('says nothing about where the file lives or who it was made for', async () => {
+    const { user, label } = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+    });
+
+    const info = await request(visitor()).get(`/api/share/${share.shareToken}/info`);
+
+    expect(Object.keys(info.body).sort()).toEqual(
+      [
+        'expiresAt',
+        'hasPassword',
+        'isDirectory',
+        'isExpired',
+        'label',
+        'requiresPassword',
+        'sharingType',
+        'shareToken',
+      ].sort()
+    );
+    expect(JSON.stringify(info.body)).not.toContain(label);
+  });
+
+  it('says a protected link wants a password', async () => {
+    const { user, label } = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      password: 'ouvre-toi',
+    });
+
+    const info = await request(visitor()).get(`/api/share/${share.shareToken}/info`);
+
+    expect(info.body).toMatchObject({ hasPassword: true, requiresPassword: true });
+  });
+
+  /**
+   * The owner of a protected link is not sent to a prompt the API would let
+   * them skip — the router reads this field, so the two have to agree.
+   */
+  it('does not ask its own owner for the password', async () => {
+    const { user, label } = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      password: 'ouvre-toi',
+    });
+
+    const info = await request(buildApp({ user })).get(`/api/share/${share.shareToken}/info`);
+
+    expect(info.body).toMatchObject({ hasPassword: true, requiresPassword: false });
+  });
+
+  it('says an expired link has expired', async () => {
+    const { user, label } = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      expiresAt: new Date(Date.now() + 60_000).toISOString(),
+    });
+    const sharesService = envContext.requireFresh('src/services/sharesService');
+    const dbService = envContext.requireFresh('src/services/db');
+    const db = await dbService.getDb();
+    db.prepare('UPDATE shares SET expires_at = ? WHERE share_token = ?').run(
+      new Date(Date.now() - 60_000).toISOString(),
+      share.shareToken
+    );
+    expect(sharesService).toBeTruthy();
+
+    const info = await request(visitor()).get(`/api/share/${share.shareToken}/info`);
+
+    expect(info.body.isExpired).toBe(true);
+  });
+
+  it('answers a token that was never a share with a plain not-found', async () => {
+    const info = await request(visitor()).get('/api/share/pas-un-jeton/info');
+
+    expect(info.status).toBe(404);
+  });
+});
+
+describe('typing the password on a link', () => {
+  const lockedShare = async () => {
+    const { user, label } = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      password: 'ouvre-toi',
+    });
+    return { user, share };
+  };
+
+  it('opens it, and hands back a session for this share', async () => {
+    const { share } = await lockedShare();
+
+    const verified = await request(visitor())
+      .post(`/api/share/${share.shareToken}/verify`)
+      .send({ password: 'ouvre-toi' });
+
+    expect(verified.status).toBe(200);
+    expect(verified.body.success).toBe(true);
+    expect(verified.body.guestSessionId).toBeTruthy();
+  });
+
+  it('sets the session as a cookie, so a reload keeps it', async () => {
+    const { share } = await lockedShare();
+
+    const verified = await request(visitor())
+      .post(`/api/share/${share.shareToken}/verify`)
+      .send({ password: 'ouvre-toi' });
+
+    expect(String(verified.headers['set-cookie'])).toContain('guest');
+  });
+
+  it('refuses the wrong one, and hands back nothing', async () => {
+    const { share } = await lockedShare();
+
+    const refused = await request(visitor())
+      .post(`/api/share/${share.shareToken}/verify`)
+      .send({ password: 'au-hasard' });
+
+    expect(refused.status).toBe(401);
+    expect(refused.body.guestSessionId).toBeUndefined();
+  });
+
+  it('refuses an empty one', async () => {
+    const { share } = await lockedShare();
+
+    const refused = await request(visitor()).post(`/api/share/${share.shareToken}/verify`).send({});
+
+    expect(refused.status).toBe(401);
+  });
+
+  /** A link that has run out is not opened by the right password either. */
+  it('refuses an expired link whatever is typed', async () => {
+    const { share } = await lockedShare();
+    const db = await envContext.requireFresh('src/services/db').getDb();
+    db.prepare('UPDATE shares SET expires_at = ? WHERE share_token = ?').run(
+      new Date(Date.now() - 60_000).toISOString(),
+      share.shareToken
+    );
+
+    const refused = await request(visitor())
+      .post(`/api/share/${share.shareToken}/verify`)
+      .send({ password: 'ouvre-toi' });
+
+    expect(refused.status).toBe(403);
+  });
+
+  /**
+   * A share named to people is not opened by knowing something. The visitor is
+   * told to sign in rather than handed a session.
+   */
+  it('sends a named share to sign in rather than opening it', async () => {
+    const { user, label } = await makeOwner();
+    const other = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'users',
+      userIds: [other.user.id],
+      password: 'ouvre-toi',
+    });
+
+    const verified = await request(visitor())
+      .post(`/api/share/${share.shareToken}/verify`)
+      .send({ password: 'ouvre-toi' });
+
+    expect(verified.status).toBe(200);
+    expect(verified.body).toEqual({ success: true, requiresAuth: true });
+    expect(verified.body.guestSessionId).toBeUndefined();
+  });
+
+  it('opens a link with no password at all, for anyone', async () => {
+    const { user, label } = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+    });
+
+    const verified = await request(visitor())
+      .post(`/api/share/${share.shareToken}/verify`)
+      .send({});
+
+    expect(verified.status).toBe(200);
+    expect(verified.body.guestSessionId).toBeTruthy();
+  });
+
+  it('still requires signing in for a named share with no password', async () => {
+    const { user, label } = await makeOwner();
+    const other = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'users',
+      userIds: [other.user.id],
+    });
+
+    const refused = await request(visitor()).post(`/api/share/${share.shareToken}/verify`).send({});
+
+    expect(refused.status).toBe(401);
+  });
+
+  it('answers a token that was never a share with a plain not-found', async () => {
+    const refused = await request(visitor())
+      .post('/api/share/pas-un-jeton/verify')
+      .send({ password: 'x' });
+
+    expect(refused.status).toBe(404);
+  });
+});
+
+describe('opening a link', () => {
+  it('gives a visitor a session and describes what they may do', async () => {
+    const { user, label } = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+    });
+
+    const opened = await request(visitor()).get(`/api/share/${share.shareToken}/access`);
+
+    expect(opened.status).toBe(200);
+    expect(opened.body.guestSessionId).toBeTruthy();
+    expect(opened.body.share).toMatchObject({
+      shareToken: share.shareToken,
+      sourcePath: `share/${share.shareToken}`,
+      accessMode: 'readonly',
+      allowDownload: true,
+      isDirectory: false,
+    });
+  });
+
+  /** Being signed in is not knowing the password. */
+  it('refuses a protected link to a visitor who has not typed the password', async () => {
+    const { user, label } = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      password: 'ouvre-toi',
+    });
+
+    const refused = await request(visitor()).get(`/api/share/${share.shareToken}/access`);
+
+    expect(refused.status).toBe(401);
+  });
+
+  it('refuses it to a signed-in stranger too', async () => {
+    const { user, label } = await makeOwner();
+    const stranger = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      password: 'ouvre-toi',
+    });
+
+    const refused = await request(buildApp({ user: stranger.user })).get(
+      `/api/share/${share.shareToken}/access`
+    );
+
+    expect(refused.status).toBe(401);
+  });
+
+  it('opens it for its owner without a password', async () => {
+    const { user, label } = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      password: 'ouvre-toi',
+    });
+
+    const opened = await request(buildApp({ user })).get(`/api/share/${share.shareToken}/access`);
+
+    expect(opened.status).toBe(200);
+  });
+
+  /**
+   * Reloading the page calls here again. A visitor who has just typed the
+   * password holds a session that says so, and asking for it a second time —
+   * for a share they were just given — is how this went wrong before.
+   */
+  it('accepts the session a visitor was just handed', async () => {
+    const { user, label } = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      password: 'ouvre-toi',
+    });
+    const app = visitor();
+    const agent = request.agent(app);
+    const verified = await agent
+      .post(`/api/share/${share.shareToken}/verify`)
+      .send({ password: 'ouvre-toi' });
+    expect(verified.status).toBe(200);
+
+    const opened = await agent.get(`/api/share/${share.shareToken}/access`);
+
+    expect(opened.status).toBe(200);
+    expect(opened.body.guestSessionId).toBe(verified.body.guestSessionId);
+  });
+
+  it('refuses a named share to somebody not on it', async () => {
+    const { user, label } = await makeOwner();
+    const invited = await makeOwner();
+    const stranger = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'users',
+      userIds: [invited.user.id],
+    });
+
+    const refused = await request(buildApp({ user: stranger.user })).get(
+      `/api/share/${share.shareToken}/access`
+    );
+
+    expect(refused.status).toBe(403);
+  });
+
+  it('opens it for somebody who is on it', async () => {
+    const { user, label } = await makeOwner();
+    const invited = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'users',
+      userIds: [invited.user.id],
+    });
+
+    const opened = await request(buildApp({ user: invited.user })).get(
+      `/api/share/${share.shareToken}/access`
+    );
+
+    expect(opened.status).toBe(200);
+  });
+
+  it('asks a signed-out visitor of a named share to sign in', async () => {
+    const { user, label } = await makeOwner();
+    const invited = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'users',
+      userIds: [invited.user.id],
+    });
+
+    const refused = await request(visitor()).get(`/api/share/${share.shareToken}/access`);
+
+    expect(refused.status).toBe(401);
+  });
+
+  it('refuses an expired link to everyone, its owner included', async () => {
+    const { user, label } = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+    });
+    const db = await envContext.requireFresh('src/services/db').getDb();
+    db.prepare('UPDATE shares SET expires_at = ? WHERE share_token = ?').run(
+      new Date(Date.now() - 60_000).toISOString(),
+      share.shareToken
+    );
+
+    expect((await request(visitor()).get(`/api/share/${share.shareToken}/access`)).status).toBe(
+      403
+    );
+    expect(
+      (await request(buildApp({ user })).get(`/api/share/${share.shareToken}/access`)).status
+    ).toBe(403);
+  });
+
+  it('answers a token that was never a share with a plain not-found', async () => {
+    const refused = await request(visitor()).get('/api/share/pas-un-jeton/access');
+
+    expect(refused.status).toBe(404);
+  });
+});
+
+describe('browsing a share that is one file', () => {
+  const openFileShare = async (body = {}) => {
+    const { user, label } = await makeOwner({ 'photo.png': 'pas vraiment une image' });
+    const share = await createShare(user, {
+      sourcePath: `${label}/photo.png`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      ...body,
+    });
+    const agent = request.agent(visitor());
+    await agent.get(`/api/share/${share.shareToken}/access`);
+    return { agent, share, user };
+  };
+
+  it('answers with the one file, and says it is not a folder', async () => {
+    const { agent, share } = await openFileShare();
+
+    const listing = await agent.get(`/api/share/${share.shareToken}/browse/`);
+
+    expect(listing.status).toBe(200);
+    expect(listing.body.items).toHaveLength(1);
+    expect(listing.body.items[0].name).toBe('photo.png');
+    expect(listing.body.current.isDirectory).toBe(false);
+  });
+
+  /**
+   * A file share is a file, so the things a folder allows are refused whatever
+   * the share's own access mode says: there is nowhere to upload to, nothing to
+   * create, and a link is not a right to hand out more links.
+   */
+  it('offers none of the things a folder would', async () => {
+    const { agent, share } = await openFileShare({ accessMode: 'readwrite' });
+
+    const listing = await agent.get(`/api/share/${share.shareToken}/browse/`);
+
+    expect(listing.body.access).toMatchObject({
+      canUpload: false,
+      canCreateFolder: false,
+      canCreateFile: false,
+      canShare: false,
+    });
+  });
+
+  it('follows the share on whether the file may be downloaded', async () => {
+    const { agent, share } = await openFileShare({ allowDownload: false });
+
+    const listing = await agent.get(`/api/share/${share.shareToken}/browse/`);
+
+    expect(listing.body.access.canDownload).toBe(false);
+  });
+
+  it('names the folder the file came from, for the breadcrumb', async () => {
+    const { user, label } = await makeOwner({ 'Rapports/mars.txt': 'bonjour' });
+    const share = await createShare(user, {
+      sourcePath: `${label}/Rapports/mars.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      label: 'Le rapport de mars',
+    });
+    const agent = request.agent(visitor());
+    await agent.get(`/api/share/${share.shareToken}/access`);
+
+    const listing = await agent.get(`/api/share/${share.shareToken}/browse/`);
+
+    expect(listing.body.shareInfo).toEqual({
+      label: 'Le rapport de mars',
+      sourceFolderName: 'mars.txt',
+    });
+  });
+
+  it('is refused to a visitor who has not opened the link', async () => {
+    const { user, label } = await makeOwner();
+    const share = await createShare(user, {
+      sourcePath: `${label}/hello.txt`,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      password: 'ouvre-toi',
+    });
+
+    const refused = await request(visitor()).get(`/api/share/${share.shareToken}/browse/`);
+
+    expect(refused.status).toBe(401);
+  });
+});
diff --git a/backend/tests/routes/share-download-permission.test.js b/backend/tests/routes/share-download-permission.test.js
new file mode 100644
index 000000000..4530a1e9e
--- /dev/null
+++ b/backend/tests/routes/share-download-permission.test.js
@@ -0,0 +1,309 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import express from 'express';
+import request from 'supertest';
+
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * A share that may be read but not taken away.
+ *
+ * `canDownload` existed across four call sites and was set to `true` at every
+ * place that set it — the only `false` was in the denied-access object, where
+ * `canAccess` had already answered. Removing the check from the download route
+ * broke no test, because nothing could ever withhold it. It was a promise the
+ * code did not keep, and the frontend gated a button on it.
+ *
+ * `allowDownload` on a share is what makes it mean something: "read this"
+ * rather than "take a copy of this". It is deliberately not tied to read-write
+ * like the other granular permissions — a read-only share is exactly where
+ * withholding a download is the point.
+ *
+ * The default is allowed, everywhere, so every share made before this existed
+ * behaves as it always did. That is the property most worth pinning: a
+ * permission added to a live system must not silently take something away.
+ */
+
+let ctx;
+
+const setup = async () => {
+  ctx = await setupTestEnv({
+    tag: 'share-download-',
+    modules: [
+      'src/config/env',
+      'src/config/index',
+      'src/services/db',
+      'src/services/sharesService',
+      'src/services/accessManager',
+      'src/routes/shares',
+      'src/routes/files/download',
+      'src/middleware/errorHandler',
+    ],
+  });
+
+  await fs.mkdir(path.join(ctx.volumeDir, 'Docs'), { recursive: true });
+  await fs.writeFile(path.join(ctx.volumeDir, 'Docs', 'report.txt'), 'the contents');
+
+  const { getDb } = ctx.requireFresh('src/services/db');
+  const db = await getDb();
+  const now = new Date().toISOString();
+  db.prepare(
+    `INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
+     VALUES ('owner', 'owner@example.com', 1, 'owner', 'Owner', '["admin"]', ?, ?)`
+  ).run(now, now);
+
+  const shares = ctx.requireFresh('src/services/sharesService');
+  const routes = ctx.requireFresh('src/routes/shares');
+  const { errorHandler } = ctx.requireFresh('src/middleware/errorHandler');
+
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    req.user = { id: 'owner', roles: ['admin'] };
+    next();
+  });
+  // Mounted at both paths, as the application mounts it: `/api/shares` is the
+  // owner's view of their shares, `/api/share` is what a link resolves to.
+  app.use('/api/shares', routes);
+  app.use('/api/share', routes);
+  app.use(errorHandler);
+
+  // The ordinary download endpoint, which resolves a `share/<token>/...` path
+  // through the same access manager as everything else.
+  const downloadRoutes = ctx.requireFresh('src/routes/files/download');
+  const downloadApp = express();
+  downloadApp.use(express.json());
+  downloadApp.use((req, _res, next) => {
+    req.user = { id: 'owner', roles: ['admin'] };
+    next();
+  });
+  downloadApp.use('/api', downloadRoutes);
+  downloadApp.use(errorHandler);
+
+  return { shares, app, db, downloadApp };
+};
+
+afterEach(async () => {
+  if (ctx) {
+    await ctx.cleanup();
+    ctx = null;
+  }
+});
+
+const makeShare = (shares, overrides = {}) =>
+  shares.createShare({
+    ownerId: 'owner',
+    sourceSpace: 'volume',
+    sourcePath: 'Docs/report.txt',
+    isDirectory: false,
+    accessMode: 'readonly',
+    sharingType: 'anyone',
+    ...overrides,
+  });
+
+describe('a share that allows downloads', () => {
+  it('is the default, so nothing that already exists changes', async () => {
+    const { shares } = await setup();
+
+    const share = await makeShare(shares);
+
+    expect(share.allowDownload).toBe(true);
+  });
+
+  it('serves the file', async () => {
+    const { shares, app } = await setup();
+    const share = await makeShare(shares);
+
+    const response = await request(app).get(`/api/share/${share.shareToken}/file`);
+
+    expect(response.status).toBe(200);
+  });
+
+  /**
+   * A row written before the column existed has it filled in by the migration
+   * default. Anything else would take downloads away from live share links on
+   * an upgrade.
+   */
+  it('is what a row from before the column reads as', async () => {
+    const { shares, db } = await setup();
+    const share = await makeShare(shares);
+    db.prepare('UPDATE shares SET allow_download = 1 WHERE id = ?').run(share.id);
+
+    const reloaded = await shares.getShareById(share.id);
+
+    expect(reloaded.allowDownload).toBe(true);
+  });
+});
+
+describe('a share that withholds them', () => {
+  it('records the choice', async () => {
+    const { shares } = await setup();
+
+    const share = await makeShare(shares, { allowDownload: false });
+
+    expect(share.allowDownload).toBe(false);
+  });
+
+  it('refuses the file', async () => {
+    const { shares, app } = await setup();
+    const share = await makeShare(shares, { allowDownload: false });
+
+    const response = await request(app).get(`/api/share/${share.shareToken}/file`);
+
+    expect(response.status).toBe(403);
+  });
+
+  /**
+   * The whole point: reading still works. A share nobody can open is not a
+   * read-only share, it is a broken one.
+   */
+  it('still lets the share be opened', async () => {
+    const { shares, app } = await setup();
+    const share = await makeShare(shares, { allowDownload: false });
+
+    const response = await request(app).get(`/api/share/${share.shareToken}/access`);
+
+    expect(response.status).toBe(200);
+  });
+
+  /**
+   * Told to the client before it browses anything, so a share view can hide the
+   * button instead of offering a click whose only outcome is a 403.
+   */
+  it('says so in the payload that opens the share', async () => {
+    const { shares, app } = await setup();
+    const share = await makeShare(shares, { allowDownload: false });
+
+    const response = await request(app).get(`/api/share/${share.shareToken}/access`);
+
+    expect(response.body?.share?.allowDownload).toBe(false);
+  });
+
+  it('says the opposite for one that allows them', async () => {
+    const { shares, app } = await setup();
+    const share = await makeShare(shares);
+
+    const response = await request(app).get(`/api/share/${share.shareToken}/access`);
+
+    expect(response.body?.share?.allowDownload).toBe(true);
+  });
+
+  /**
+   * And per row in the listing, which used to be hard-coded true: every file in
+   * a share with downloads withheld still showed the button.
+   */
+  it('says so for each file in the listing too', async () => {
+    const { shares, app } = await setup();
+    const folderShare = await shares.createShare({
+      ownerId: 'owner',
+      sourceSpace: 'volume',
+      sourcePath: 'Docs',
+      isDirectory: true,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      allowDownload: false,
+    });
+
+    const response = await request(app).get(`/api/share/${folderShare.shareToken}/browse/`);
+
+    expect(response.status).toBe(200);
+    const items = response.body?.items || [];
+    expect(items.length).toBeGreaterThan(0);
+    expect(items.every((item) => item.access?.canDownload === false)).toBe(true);
+  });
+
+  /**
+   * Not tied to read-write, unlike delete, upload and the create permissions.
+   * A read-write share where downloads are withheld is coherent — collaborate
+   * on it, do not take it home — and gating it the way the others are gated
+   * would make that impossible to express.
+   */
+  it('withholds them on a read-write share too', async () => {
+    const { shares, app } = await setup();
+    const share = await makeShare(shares, { accessMode: 'readwrite', allowDownload: false });
+
+    const response = await request(app).get(`/api/share/${share.shareToken}/file`);
+
+    expect(response.status).toBe(403);
+  });
+});
+
+describe('the ordinary download route, on a share path', () => {
+  /**
+   * A signed-in person can reach a share through the normal explorer, and the
+   * normal download endpoint resolves `share/<token>/...` through the same
+   * access manager. That endpoint's own `canDownload` check was the one nothing
+   * could reach — it is reachable now, and this is what reaches it.
+   */
+  it('refuses a file inside a share that withholds downloads', async () => {
+    const { shares, app, downloadApp } = await setup();
+    const share = await shares.createShare({
+      ownerId: 'owner',
+      sourceSpace: 'volume',
+      sourcePath: 'Docs',
+      isDirectory: true,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+      allowDownload: false,
+    });
+    expect(app).toBeTruthy();
+
+    const response = await request(downloadApp)
+      .post('/api/download')
+      .send({ paths: [`share/${share.shareToken}/report.txt`] });
+
+    expect(response.status).toBe(403);
+  });
+
+  it('serves it from a share that allows them', async () => {
+    const { shares, downloadApp } = await setup();
+    const share = await shares.createShare({
+      ownerId: 'owner',
+      sourceSpace: 'volume',
+      sourcePath: 'Docs',
+      isDirectory: true,
+      accessMode: 'readonly',
+      sharingType: 'anyone',
+    });
+
+    const response = await request(downloadApp)
+      .post('/api/download')
+      .send({ paths: [`share/${share.shareToken}/report.txt`] });
+
+    expect(response.status).toBe(200);
+  });
+});
+
+describe('changing it afterwards', () => {
+  it('can be switched off on an existing share', async () => {
+    const { shares, app } = await setup();
+    const share = await makeShare(shares);
+
+    await request(app).put(`/api/shares/${share.id}`).send({ allowDownload: false });
+    const response = await request(app).get(`/api/share/${share.shareToken}/file`);
+
+    expect(response.status).toBe(403);
+  });
+
+  it('can be switched back on', async () => {
+    const { shares, app } = await setup();
+    const share = await makeShare(shares, { allowDownload: false });
+
+    await request(app).put(`/api/shares/${share.id}`).send({ allowDownload: true });
+    const response = await request(app).get(`/api/share/${share.shareToken}/file`);
+
+    expect(response.status).toBe(200);
+  });
+
+  /** An update that says nothing about it must not reset it. */
+  it('is left alone by an update that does not mention it', async () => {
+    const { shares, app } = await setup();
+    const share = await makeShare(shares, { allowDownload: false });
+
+    await request(app).put(`/api/shares/${share.id}`).send({ label: 'Renamed' });
+    const reloaded = await shares.getShareById(share.id);
+
+    expect(reloaded.allowDownload).toBe(false);
+  });
+});
diff --git a/backend/tests/routes/share-editor-save.test.js b/backend/tests/routes/share-editor-save.test.js
index bba4fd87b..f0fc15573 100644
--- a/backend/tests/routes/share-editor-save.test.js
+++ b/backend/tests/routes/share-editor-save.test.js
@@ -62,8 +62,8 @@ const buildApp = ({ user } = {}) => {
   return application;
 };
 
-/** An "anyone" share of `sourceName` inside the owner's assigned volume. */
-const shareOf = async (sourceName, { accessMode = 'readwrite' } = {}) => {
+/** A writable "anyone" share of `sourceName` inside the owner's assigned volume. */
+const shareOf = async (sourceName) => {
   const owner = await load('src/services/users').createLocalUser({
     email: `owner-${sourceName.replace(/\W/g, '-')}@example.com`,
     username: `owner-${sourceName.replace(/\W/g, '-')}`,
@@ -81,7 +81,7 @@ const shareOf = async (sourceName, { accessMode = 'readwrite' } = {}) => {
     .post('/api/shares')
     .send({
       sourcePath: `Assigned/${sourceName}`,
-      accessMode,
+      accessMode: 'readwrite',
       sharingType: 'anyone',
     });
   expect(create.status).toBe(201);
@@ -149,24 +149,4 @@ describe('saving a text file through a share link', () => {
     expect(response.status).toBe(400);
     expect((await fsp.stat(path.join(assignedRoot, 'minutes'))).isDirectory()).toBe(true);
   });
-
-  /**
-   * A link that only reads is the case this route exists to keep apart from
-   * the one that writes: the editor opens on both, and offers to save on one.
-   */
-  it('refuses a link that was not made writable', async () => {
-    const target = path.join(assignedRoot, 'lecture.txt');
-    await fsp.writeFile(target, 'à lire seulement');
-    const token = await shareOf('lecture.txt', { accessMode: 'readonly' });
-
-    // It still opens: reading is what the link is for.
-    const opened = await request(buildApp()).get(`/api/share/${token}/editor`);
-    expect(opened.status).toBe(200);
-    expect(opened.body).toMatchObject({ canWrite: false });
-
-    const response = await save(token, 'réécrit quand même');
-
-    expect(response.status).toBe(403);
-    expect(await fsp.readFile(target, 'utf8')).toBe('à lire seulement');
-  });
 });
diff --git a/backend/tests/routes/shareLinksUsers.test.js b/backend/tests/routes/shareLinksUsers.test.js
index 430edc4b3..a2c6c21d8 100644
--- a/backend/tests/routes/shareLinksUsers.test.js
+++ b/backend/tests/routes/shareLinksUsers.test.js
@@ -18,6 +18,7 @@ beforeAll(async () => {
       'src/middleware/errorHandler',
       'src/routes/auth',
       'src/routes/shares',
+      'src/services/textEditorService',
     ],
   });
 });
@@ -66,7 +67,12 @@ const buildApp = () => {
 
 describe('Share Links for Specific Users', () => {
   describe('User-Specific Share Access', () => {
-    it('should allow /api/share/:token/access when logged in as recipient', async () => {
+    /**
+     * Slow for the same reason as the local-auth walk-through: bcryptjs is pure
+     * JavaScript, the share password is hashed, and v8 coverage instrumentation
+     * multiplies that cost past the five-second default.
+     */
+    it('should restrict the shared editor to the intended recipient', async () => {
       const usersService = envContext.requireFresh('src/services/users');
       const app = buildApp();
 
@@ -86,6 +92,13 @@ describe('Share Links for Specific Users', () => {
         password: 'secret123',
         roles: ['user'],
       });
+      const outsider = await usersService.createLocalUser({
+        email: 'outsider@example.com',
+        username: 'outsider',
+        displayName: 'Outsider',
+        password: 'secret123',
+        roles: ['user'],
+      });
 
       // Create a folder to share under the volume root.
       const sharedFolder = path.join(envContext.volumeDir, 'docs');
@@ -122,6 +135,19 @@ describe('Share Links for Specific Users', () => {
       expect(access.status).toBe(200);
       expect(access.body?.share?.shareToken).toBe(token);
       expect(access.body?.share?.sourcePath).toBe(`share/${token}`);
-    });
+
+      const editor = await recipientAgent.get(`/api/share/${token}/editor/hello.txt`);
+      expect(editor.status).toBe(200);
+      expect(editor.body).toMatchObject({ name: 'hello.txt', content: 'hello' });
+
+      const outsiderAgent = request.agent(app);
+      const outsiderLogin = await outsiderAgent
+        .post('/api/auth/login')
+        .send({ email: outsider.email, password: 'secret123' });
+      expect(outsiderLogin.status).toBe(200);
+
+      const forbidden = await outsiderAgent.get(`/api/share/${token}/editor/hello.txt`);
+      expect(forbidden.status).toBe(403);
+    }, 30_000);
   });
 });
diff --git a/backend/tests/routes/shares.test.js b/backend/tests/routes/shares.test.js
index 027a81a55..8ca901cc3 100644
--- a/backend/tests/routes/shares.test.js
+++ b/backend/tests/routes/shares.test.js
@@ -2,6 +2,7 @@ import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 import path from 'node:path';
 import fs from 'node:fs/promises';
 import express from 'express';
+import cookieParser from 'cookie-parser';
 import request from 'supertest';
 import { setupTestEnv, clearModuleCache } from '../helpers/env-test-utils.js';
 
@@ -20,9 +21,13 @@ beforeAll(async () => {
       'src/services/sharesService',
       'src/services/guestSessionService',
       'src/utils/pathUtils',
+      'src/middleware/authMiddleware',
       'src/middleware/errorHandler',
       'src/routes/shares',
       'src/routes/files/delete',
+      'src/routes/files/folder',
+      'src/routes/files/file',
+      'src/routes/permissions',
       'src/services/fileTransferService',
     ],
   });
@@ -40,29 +45,253 @@ const buildApp = ({ user } = {}) => {
 
   const sharesRoutes = envContext.requireFresh('src/routes/shares');
   const deleteRoutes = envContext.requireFresh('src/routes/files/delete');
+  const folderRoutes = envContext.requireFresh('src/routes/files/folder');
+  const fileRoutes = envContext.requireFresh('src/routes/files/file');
+  const permissionsRoutes = envContext.requireFresh('src/routes/permissions');
   const { errorHandler } = envContext.requireFresh('src/middleware/errorHandler');
 
   const app = express();
   app.use(express.json());
-
-  app.use(async (req, _res, next) => {
-    if (user) req.user = user;
-    const guestSessionId = req.headers['x-guest-session'];
-    if (guestSessionId) {
-      const { getGuestSession } = envContext.requireFresh('src/services/guestSessionService');
-      req.guestSession = await getGuestSession(guestSessionId);
-    }
+  app.use(cookieParser());
+
+  // The real middleware, not a stand-in for it. An earlier version of this
+  // harness attached req.guestSession unconditionally, which the middleware
+  // does not do — and a bug that lived in exactly that gap shipped green.
+  const authMiddleware = envContext.requireFresh('src/middleware/authMiddleware');
+  app.use((req, _res, next) => {
+    // express-session normally provides this; the middleware loads the user
+    // from the database, exactly as it does in production.
+    req.session = user ? { localUserId: user.id } : {};
     next();
   });
+  app.use(authMiddleware);
 
   app.use('/api/shares', sharesRoutes);
   app.use('/api/share', sharesRoutes);
   app.use('/api', deleteRoutes);
+  app.use('/api', folderRoutes);
+  app.use('/api', fileRoutes);
+  app.use('/api', permissionsRoutes);
   app.use(errorHandler);
   return app;
 };
 
 describe('Shares Routes', () => {
+  describe('Share updates', () => {
+    it('should replace recipient permissions and clear them when changing to an anyone link', async () => {
+      const usersService = envContext.requireFresh('src/services/users');
+      const userVolumesService = envContext.requireFresh('src/services/userVolumesService');
+      const assignedRoot = path.join(envContext.tmpRoot, 'assigned-volume-share-updates');
+      await fs.mkdir(assignedRoot, { recursive: true });
+      await fs.writeFile(path.join(assignedRoot, 'shared.txt'), 'shared');
+
+      const owner = await usersService.createLocalUser({
+        email: 'share-owner@example.com',
+        username: 'share-owner',
+        displayName: 'Share Owner',
+        password: 'secret123',
+        roles: ['user'],
+      });
+      const recipient = await usersService.createLocalUser({
+        email: 'share-recipient@example.com',
+        username: 'share-recipient',
+        displayName: 'Share Recipient',
+        password: 'secret123',
+        roles: ['user'],
+      });
+      await userVolumesService.addVolumeToUser({
+        userId: owner.id,
+        label: 'ShareUpdateVol',
+        volumePath: assignedRoot,
+        accessMode: 'readwrite',
+      });
+
+      const app = buildApp({ user: owner });
+      const created = await request(app)
+        .post('/api/shares')
+        .send({
+          sourcePath: 'ShareUpdateVol/shared.txt',
+          accessMode: 'readonly',
+          sharingType: 'users',
+          userIds: [recipient.id],
+        });
+      expect(created.status).toBe(201);
+      expect(created.body.permittedUserIds).toEqual([recipient.id]);
+
+      const updated = await request(app).put(`/api/shares/${created.body.id}`).send({
+        accessMode: 'readwrite',
+        sharingType: 'anyone',
+        userIds: [],
+        allowDelete: false,
+        allowCreateFolder: false,
+        allowCreateFile: false,
+        allowUpload: false,
+        label: 'Updated share',
+      });
+      expect(updated.status).toBe(200);
+      expect(updated.body).toMatchObject({
+        accessMode: 'readwrite',
+        sharingType: 'anyone',
+        allowDelete: false,
+        allowCreateFolder: false,
+        allowCreateFile: false,
+        allowUpload: false,
+        label: 'Updated share',
+      });
+
+      const recipientApp = buildApp({ user: recipient });
+      const received = await request(recipientApp).get('/api/shares/shared-with-me');
+      expect(received.status).toBe(200);
+      expect(received.body.shares).toEqual([]);
+    });
+  });
+
+  describe('Shared item permissions', () => {
+    it('should allow viewing permissions through a share but reject permission changes', async () => {
+      const usersService = envContext.requireFresh('src/services/users');
+      const userVolumesService = envContext.requireFresh('src/services/userVolumesService');
+      const assignedRoot = path.join(envContext.tmpRoot, 'assigned-volume-share-permissions');
+      await fs.mkdir(assignedRoot, { recursive: true });
+      await fs.writeFile(path.join(assignedRoot, 'shared.txt'), 'shared');
+
+      const user = await usersService.createLocalUser({
+        email: 'share-permissions@example.com',
+        username: 'share-permissions',
+        displayName: 'Share Permissions',
+        password: 'secret123',
+        roles: ['user'],
+      });
+      await userVolumesService.addVolumeToUser({
+        userId: user.id,
+        label: 'SharePermissionsVol',
+        volumePath: assignedRoot,
+        accessMode: 'readwrite',
+      });
+
+      const app = buildApp({ user });
+      const created = await request(app).post('/api/shares').send({
+        sourcePath: 'SharePermissionsVol/shared.txt',
+        accessMode: 'readwrite',
+        sharingType: 'anyone',
+      });
+      expect(created.status).toBe(201);
+
+      const sharedPath = `share/${created.body.shareToken}/shared.txt`;
+      const view = await request(app).get(`/api/permissions/${sharedPath}`);
+      expect(view.status).toBe(200);
+
+      const chmod = await request(app)
+        .post('/api/permissions/chmod')
+        .send({ path: sharedPath, mode: '644' });
+      expect(chmod.status).toBe(403);
+
+      const chown = await request(app)
+        .post('/api/permissions/chown')
+        .send({ path: sharedPath, owner: 'root', group: 'root' });
+      expect(chown.status).toBe(403);
+    });
+  });
+
+  describe('Granular write permissions', () => {
+    it('should apply directory write permissions to share access and mutation routes', async () => {
+      const usersService = envContext.requireFresh('src/services/users');
+      const userVolumesService = envContext.requireFresh('src/services/userVolumesService');
+
+      const assignedRoot = path.join(envContext.tmpRoot, 'assigned-volume-granular-permissions');
+      const sharedFolder = path.join(assignedRoot, 'shared');
+      await fs.mkdir(sharedFolder, { recursive: true });
+      await fs.writeFile(path.join(sharedFolder, 'existing.txt'), 'existing');
+
+      const user = await usersService.createLocalUser({
+        email: 'permissions@example.com',
+        username: 'permissions',
+        displayName: 'Permissions',
+        password: 'secret123',
+        roles: ['user'],
+      });
+
+      await userVolumesService.addVolumeToUser({
+        userId: user.id,
+        label: 'PermissionsVol',
+        volumePath: assignedRoot,
+        accessMode: 'readwrite',
+      });
+
+      const ownerApp = buildApp({ user });
+      const create = await request(ownerApp).post('/api/shares').send({
+        sourcePath: 'PermissionsVol/shared',
+        accessMode: 'readwrite',
+        allowDelete: false,
+        allowCreateFolder: false,
+        allowCreateFile: false,
+        allowUpload: false,
+        sharingType: 'anyone',
+      });
+
+      expect(create.status).toBe(201);
+      expect(create.body.allowDelete).toBe(false);
+      expect(create.body.allowCreateFolder).toBe(false);
+      expect(create.body.allowCreateFile).toBe(false);
+      expect(create.body.allowUpload).toBe(false);
+
+      const guestApp = buildApp();
+      const access = await request(guestApp).get(`/api/share/${create.body.shareToken}/access`);
+      expect(access.status).toBe(200);
+      expect(access.body.guestSessionId).toBeTruthy();
+
+      const sessionHeader = { 'X-Guest-Session': access.body.guestSessionId };
+      const browse = await request(guestApp)
+        .get(`/api/share/${create.body.shareToken}/browse/`)
+        .set(sessionHeader);
+      expect(browse.status).toBe(200);
+      expect(browse.body.access).toMatchObject({
+        canWrite: true,
+        canDelete: false,
+        canUpload: false,
+        canCreateFolder: false,
+        canCreateFile: false,
+      });
+
+      const createFolder = await request(guestApp)
+        .post('/api/files/folder')
+        .set(sessionHeader)
+        .send({ path: `share/${create.body.shareToken}`, name: 'blocked-folder' });
+      expect(createFolder.status).toBe(403);
+
+      const createFile = await request(guestApp)
+        .post('/api/files/file')
+        .set(sessionHeader)
+        .send({ path: `share/${create.body.shareToken}`, name: 'blocked.txt' });
+      expect(createFile.status).toBe(403);
+    });
+
+    it('should default granular permissions to the current full read-write behavior', async () => {
+      const sharesService = envContext.requireFresh('src/services/sharesService');
+      const usersService = envContext.requireFresh('src/services/users');
+      const owner = await usersService.createLocalUser({
+        email: 'default-permissions@example.com',
+        username: 'default-permissions',
+        displayName: 'Default Permissions',
+        password: 'secret123',
+        roles: ['user'],
+      });
+      const share = await sharesService.createShare({
+        ownerId: owner.id,
+        sourceSpace: 'volume',
+        sourcePath: 'Volume/default-permissions',
+        isDirectory: true,
+        accessMode: 'readwrite',
+      });
+
+      expect(share).toMatchObject({
+        allowDelete: true,
+        allowCreateFolder: true,
+        allowCreateFile: true,
+        allowUpload: true,
+      });
+    });
+  });
+
   describe('User Volumes', () => {
     it('should create and browse share from assigned volume path', async () => {
       const usersService = envContext.requireFresh('src/services/users');
@@ -339,10 +568,11 @@ describe('Shares Routes', () => {
       });
 
       expect(create.status).toBe(201);
-      expect(create.body.directFileUrl).toContain(`/api/share/${create.body.shareToken}/file`);
+      expect(create.body.directFileUrl).toContain(`/api/share/${create.body.shareToken}`);
+      expect(create.body.directFileUrl).not.toContain('/file');
 
       const publicApp = buildApp();
-      const direct = await request(publicApp).get(`/api/share/${create.body.shareToken}/file`);
+      const direct = await request(publicApp).get(`/api/share/${create.body.shareToken}`);
 
       expect(direct.status).toBe(200);
       expect(direct.headers['content-disposition']).toContain('inline');
@@ -350,12 +580,164 @@ describe('Shares Routes', () => {
       expect(direct.text).toBe('hello direct link');
 
       const download = await request(publicApp).get(
-        `/api/share/${create.body.shareToken}/file?mode=download`
+        `/api/share/${create.body.shareToken}?mode=download`
       );
 
       expect(download.status).toBe(200);
       expect(download.headers['content-disposition']).toContain('attachment');
       expect(download.headers['content-disposition']).toContain('hello.txt');
+
+      const raw = await request(publicApp).get(`/api/share/${create.body.shareToken}?mode=raw`);
+      expect(raw.status).toBe(200);
+      expect(raw.text).toBe('hello direct link');
+
+      const legacyDirect = await request(publicApp).get(
+        `/api/share/${create.body.shareToken}/file`
+      );
+      expect(legacyDirect.status).toBe(200);
+      expect(legacyDirect.text).toBe('hello direct link');
+    });
+
+    it('records the client IP when a shared file is accessed directly', async () => {
+      const usersService = envContext.requireFresh('src/services/users');
+      const userVolumesService = envContext.requireFresh('src/services/userVolumesService');
+
+      const assignedRoot = path.join(envContext.tmpRoot, 'assigned-volume-direct-ip');
+      await fs.mkdir(assignedRoot, { recursive: true });
+      await fs.writeFile(path.join(assignedRoot, 'ip.txt'), 'track my ip');
+
+      const user = await usersService.createLocalUser({
+        email: 'direct-ip@example.com',
+        username: 'direct-ip',
+        displayName: 'Direct Ip',
+        password: 'secret123',
+        roles: ['user'],
+      });
+
+      await userVolumesService.addVolumeToUser({
+        userId: user.id,
+        label: 'DirectIpVol',
+        volumePath: assignedRoot,
+        accessMode: 'readwrite',
+      });
+
+      const ownerApp = buildApp({ user });
+      const create = await request(ownerApp).post('/api/shares').send({
+        sourcePath: 'DirectIpVol/ip.txt',
+        accessMode: 'readonly',
+        sharingType: 'anyone',
+      });
+      expect(create.status).toBe(201);
+
+      // Accessing the file directly is the common path for viewing a share; it
+      // must record the access IP (regression: it previously tracked with none).
+      const direct = await request(buildApp()).get(`/api/share/${create.body.shareToken}/file`);
+      expect(direct.status).toBe(200);
+
+      const details = await request(ownerApp).get(`/api/shares/${create.body.id}`);
+      expect(details.status).toBe(200);
+      expect(details.body.stats.accessCount).toBeGreaterThan(0);
+      expect(typeof details.body.stats.lastAccessIp).toBe('string');
+      expect(details.body.stats.lastAccessIp.length).toBeGreaterThan(0);
+    });
+
+    it('counts direct attachment deliveries as downloads, inline views as accesses', async () => {
+      const usersService = envContext.requireFresh('src/services/users');
+      const userVolumesService = envContext.requireFresh('src/services/userVolumesService');
+
+      const assignedRoot = path.join(envContext.tmpRoot, 'assigned-volume-direct-download');
+      await fs.mkdir(assignedRoot, { recursive: true });
+      await fs.writeFile(path.join(assignedRoot, 'notes.txt'), 'count my download');
+
+      const user = await usersService.createLocalUser({
+        email: 'direct-download@example.com',
+        username: 'direct-download',
+        displayName: 'Direct Download',
+        password: 'secret123',
+        roles: ['user'],
+      });
+
+      await userVolumesService.addVolumeToUser({
+        userId: user.id,
+        label: 'DirectDownloadVol',
+        volumePath: assignedRoot,
+        accessMode: 'readwrite',
+      });
+
+      const ownerApp = buildApp({ user });
+      const create = await request(ownerApp).post('/api/shares').send({
+        sourcePath: 'DirectDownloadVol/notes.txt',
+        accessMode: 'readonly',
+        sharingType: 'anyone',
+      });
+      expect(create.status).toBe(201);
+
+      // Explicit download mode serves an attachment: it must increment the
+      // download counter (regression: it only ever counted an access).
+      const download = await request(buildApp()).get(
+        `/api/share/${create.body.shareToken}/file?mode=download`
+      );
+      expect(download.status).toBe(200);
+      expect(download.headers['content-disposition']).toContain('attachment');
+
+      const afterDownload = await request(ownerApp).get(`/api/shares/${create.body.id}`);
+      expect(afterDownload.status).toBe(200);
+      expect(afterDownload.body.stats.downloadCount).toBe(1);
+      expect(afterDownload.body.stats.accessCount).toBe(0);
+      expect(afterDownload.body.stats.lastDownloadedAt).toBeTruthy();
+      expect(typeof afterDownload.body.stats.lastDownloadIp).toBe('string');
+      expect(afterDownload.body.stats.lastDownloadIp.length).toBeGreaterThan(0);
+
+      // An inline view of the same link still counts as an access.
+      const view = await request(buildApp()).get(`/api/share/${create.body.shareToken}/file`);
+      expect(view.status).toBe(200);
+      expect(view.headers['content-disposition']).toContain('inline');
+
+      const afterView = await request(ownerApp).get(`/api/shares/${create.body.id}`);
+      expect(afterView.status).toBe(200);
+      expect(afterView.body.stats.accessCount).toBe(1);
+      expect(afterView.body.stats.downloadCount).toBe(1);
+    });
+
+    it('counts a direct directory ZIP delivery as a download', async () => {
+      const usersService = envContext.requireFresh('src/services/users');
+      const userVolumesService = envContext.requireFresh('src/services/userVolumesService');
+
+      const assignedRoot = path.join(envContext.tmpRoot, 'assigned-volume-direct-zip-count');
+      await fs.mkdir(path.join(assignedRoot, 'folder'), { recursive: true });
+      await fs.writeFile(path.join(assignedRoot, 'folder', 'nested.txt'), 'nested file');
+
+      const user = await usersService.createLocalUser({
+        email: 'direct-zip-count@example.com',
+        username: 'direct-zip-count',
+        displayName: 'Direct Zip Count',
+        password: 'secret123',
+        roles: ['user'],
+      });
+
+      await userVolumesService.addVolumeToUser({
+        userId: user.id,
+        label: 'DirectZipCountVol',
+        volumePath: assignedRoot,
+        accessMode: 'readwrite',
+      });
+
+      const ownerApp = buildApp({ user });
+      const create = await request(ownerApp).post('/api/shares').send({
+        sourcePath: 'DirectZipCountVol/folder',
+        accessMode: 'readonly',
+        sharingType: 'anyone',
+      });
+      expect(create.status).toBe(201);
+
+      const direct = await request(buildApp()).get(`/api/share/${create.body.shareToken}/file`);
+      expect(direct.status).toBe(200);
+      expect(direct.headers['content-disposition']).toContain('attachment');
+
+      const details = await request(ownerApp).get(`/api/shares/${create.body.id}`);
+      expect(details.status).toBe(200);
+      expect(details.body.stats.downloadCount).toBe(1);
+      expect(details.body.stats.accessCount).toBe(0);
     });
 
     it('should redirect a password-protected direct file until the password is verified', async () => {
@@ -393,7 +775,7 @@ describe('Shares Routes', () => {
 
       const publicApp = buildApp();
       const directBeforePassword = await request(publicApp).get(
-        `/api/share/${create.body.shareToken}/file`
+        `/api/share/${create.body.shareToken}`
       );
       expect(directBeforePassword.status).toBe(302);
       expect(directBeforePassword.headers.location).toContain(`/share/${create.body.shareToken}`);
@@ -407,7 +789,7 @@ describe('Shares Routes', () => {
       expect(verify.body.guestSessionId).toBeDefined();
 
       const directAfterPassword = await request(publicApp)
-        .get(`/api/share/${create.body.shareToken}/file`)
+        .get(`/api/share/${create.body.shareToken}`)
         .set('X-Guest-Session', verify.body.guestSessionId);
 
       expect(directAfterPassword.status).toBe(200);
@@ -445,10 +827,11 @@ describe('Shares Routes', () => {
       });
 
       expect(create.status).toBe(201);
-      expect(create.body.directFileUrl).toContain(`/api/share/${create.body.shareToken}/file`);
+      expect(create.body.directFileUrl).toContain(`/api/share/${create.body.shareToken}`);
+      expect(create.body.directFileUrl).not.toContain('/file');
 
       const publicApp = buildApp();
-      const direct = await request(publicApp).get(`/api/share/${create.body.shareToken}/file`);
+      const direct = await request(publicApp).get(`/api/share/${create.body.shareToken}`);
 
       expect(direct.status).toBe(200);
       expect(direct.headers['content-type']).toContain('application/zip');
@@ -542,4 +925,271 @@ describe('Shares Routes', () => {
       expect(direct.status).toBe(403);
     });
   });
+
+  describe('Shared Pastebin Editor', () => {
+    it('should keep a read-only public text share read-only', async () => {
+      const usersService = envContext.requireFresh('src/services/users');
+      const userVolumesService = envContext.requireFresh('src/services/userVolumesService');
+
+      const assignedRoot = path.join(envContext.tmpRoot, 'assigned-volume-shared-editor');
+      await fs.mkdir(assignedRoot, { recursive: true });
+      await fs.writeFile(
+        path.join(assignedRoot, 'Analyze-FileServerData.ps1'),
+        'Write-Output hello'
+      );
+
+      const user = await usersService.createLocalUser({
+        email: 'shared-editor@example.com',
+        username: 'shared-editor',
+        displayName: 'Shared Editor',
+        password: 'secret123',
+        roles: ['user'],
+      });
+
+      await userVolumesService.addVolumeToUser({
+        userId: user.id,
+        label: 'SharedEditorVol',
+        volumePath: assignedRoot,
+        accessMode: 'readwrite',
+      });
+
+      const ownerApp = buildApp({ user });
+      const create = await request(ownerApp).post('/api/shares').send({
+        sourcePath: 'SharedEditorVol/Analyze-FileServerData.ps1',
+        accessMode: 'readonly',
+        sharingType: 'anyone',
+      });
+      expect(create.status).toBe(201);
+
+      const publicApp = buildApp();
+      const editor = await request(publicApp).get(`/api/share/${create.body.shareToken}/editor`);
+      expect(editor.status).toBe(200);
+      expect(editor.headers['cache-control']).toBe('private, no-cache');
+      expect(editor.body).toMatchObject({
+        name: 'Analyze-FileServerData.ps1',
+        content: 'Write-Output hello',
+        canDownload: true,
+        canWrite: false,
+      });
+
+      // Friendly links may include the source filename, but no arbitrary child path.
+      const friendly = await request(publicApp).get(
+        `/api/share/${create.body.shareToken}/editor/Analyze-FileServerData.ps1`
+      );
+      expect(friendly.status).toBe(200);
+      expect(friendly.body.path).toBe('');
+
+      const write = await request(publicApp)
+        .put(`/api/share/${create.body.shareToken}/editor`)
+        .send({ content: 'should never be written' });
+      expect(write.status).toBe(403);
+      expect(
+        await fs.readFile(path.join(assignedRoot, 'Analyze-FileServerData.ps1'), 'utf-8')
+      ).toBe('Write-Output hello');
+    });
+
+    it('should send a large shared text file compressed', async () => {
+      const usersService = envContext.requireFresh('src/services/users');
+      const userVolumesService = envContext.requireFresh('src/services/userVolumesService');
+
+      const assignedRoot = path.join(envContext.tmpRoot, 'assigned-volume-shared-editor-large');
+      await fs.mkdir(assignedRoot, { recursive: true });
+      const content = '# Journal\n\nUne ligne de texte, encore une.\n'.repeat(2000);
+      await fs.writeFile(path.join(assignedRoot, 'journal.md'), content);
+
+      const user = await usersService.createLocalUser({
+        email: 'shared-editor-large@example.com',
+        username: 'shared-editor-large',
+        displayName: 'Shared Editor Large',
+        password: 'secret123',
+        roles: ['user'],
+      });
+      await userVolumesService.addVolumeToUser({
+        userId: user.id,
+        label: 'SharedEditorLargeVol',
+        volumePath: assignedRoot,
+        accessMode: 'readwrite',
+      });
+
+      const create = await request(buildApp({ user })).post('/api/shares').send({
+        sourcePath: 'SharedEditorLargeVol/journal.md',
+        accessMode: 'readonly',
+        sharingType: 'anyone',
+      });
+      expect(create.status).toBe(201);
+
+      const editor = await request(buildApp())
+        .get(`/api/share/${create.body.shareToken}/editor`)
+        .set('Accept-Encoding', 'gzip, deflate');
+      expect(editor.status).toBe(200);
+      expect(editor.headers['content-encoding']).toBe('gzip');
+      expect(editor.headers.vary).toMatch(/accept-encoding/i);
+      expect(editor.body).toMatchObject({ name: 'journal.md', content, canWrite: false });
+    });
+
+    /**
+     * The shared editor's answer says whether the visitor may save. Kept by the
+     * browser and revalidated, it must be read again when that changes, even
+     * though the file did not.
+     */
+    it('should never hide a change of permission behind a 304', async () => {
+      const usersService = envContext.requireFresh('src/services/users');
+      const userVolumesService = envContext.requireFresh('src/services/userVolumesService');
+
+      const assignedRoot = path.join(envContext.tmpRoot, 'assigned-volume-shared-editor-etag');
+      await fs.mkdir(assignedRoot, { recursive: true });
+      await fs.writeFile(path.join(assignedRoot, 'notes.txt'), 'Shared notes');
+
+      const user = await usersService.createLocalUser({
+        email: 'shared-editor-etag@example.com',
+        username: 'shared-editor-etag',
+        displayName: 'Shared Editor Etag',
+        password: 'secret123',
+        roles: ['user'],
+      });
+      await userVolumesService.addVolumeToUser({
+        userId: user.id,
+        label: 'SharedEditorEtagVol',
+        volumePath: assignedRoot,
+        accessMode: 'readwrite',
+      });
+
+      const ownerApp = buildApp({ user });
+      const create = await request(ownerApp).post('/api/shares').send({
+        sourcePath: 'SharedEditorEtagVol/notes.txt',
+        accessMode: 'readonly',
+        sharingType: 'anyone',
+      });
+      expect(create.status).toBe(201);
+
+      const publicApp = buildApp();
+      const editorUrl = `/api/share/${create.body.shareToken}/editor`;
+      const first = await request(publicApp).get(editorUrl);
+      expect(first.body).toMatchObject({ content: 'Shared notes', canWrite: false });
+      expect(first.headers.etag).toMatch(/^W\/".+"$/);
+
+      const unchanged = await request(publicApp)
+        .get(editorUrl)
+        .set('If-None-Match', first.headers.etag);
+      expect(unchanged.status).toBe(304);
+
+      const updated = await request(ownerApp)
+        .put(`/api/shares/${create.body.id}`)
+        .send({ accessMode: 'readwrite' });
+      expect(updated.status).toBe(200);
+
+      const after = await request(publicApp)
+        .get(editorUrl)
+        .set('If-None-Match', first.headers.etag);
+      expect(after.status).toBe(200);
+      expect(after.body).toMatchObject({ content: 'Shared notes', canWrite: true });
+      expect(after.headers.etag).not.toBe(first.headers.etag);
+    });
+
+    it('should save a text file only through a read-write share', async () => {
+      const usersService = envContext.requireFresh('src/services/users');
+      const userVolumesService = envContext.requireFresh('src/services/userVolumesService');
+
+      const assignedRoot = path.join(envContext.tmpRoot, 'assigned-volume-shared-editor-write');
+      await fs.mkdir(assignedRoot, { recursive: true });
+      const filePath = path.join(assignedRoot, 'editable.txt');
+      await fs.writeFile(filePath, 'initial content');
+
+      const user = await usersService.createLocalUser({
+        email: 'shared-editor-write@example.com',
+        username: 'shared-editor-write',
+        displayName: 'Shared Editor Write',
+        password: 'secret123',
+        roles: ['user'],
+      });
+
+      await userVolumesService.addVolumeToUser({
+        userId: user.id,
+        label: 'SharedEditorWriteVol',
+        volumePath: assignedRoot,
+        accessMode: 'readwrite',
+      });
+
+      const ownerApp = buildApp({ user });
+      const create = await request(ownerApp).post('/api/shares').send({
+        sourcePath: 'SharedEditorWriteVol/editable.txt',
+        accessMode: 'readwrite',
+        sharingType: 'anyone',
+      });
+      expect(create.status).toBe(201);
+
+      const publicApp = buildApp();
+      const editor = await request(publicApp).get(`/api/share/${create.body.shareToken}/editor`);
+      expect(editor.status).toBe(200);
+      expect(editor.body.canWrite).toBe(true);
+
+      const save = await request(publicApp)
+        .put(`/api/share/${create.body.shareToken}/editor`)
+        .send({ content: 'updated through the share' });
+      expect(save.status).toBe(200);
+      expect(await fs.readFile(filePath, 'utf-8')).toBe('updated through the share');
+    });
+
+    it('should require a verified guest session and reject binary shared files', async () => {
+      const usersService = envContext.requireFresh('src/services/users');
+      const userVolumesService = envContext.requireFresh('src/services/userVolumesService');
+
+      const assignedRoot = path.join(envContext.tmpRoot, 'assigned-volume-shared-editor-protected');
+      await fs.mkdir(assignedRoot, { recursive: true });
+      await fs.writeFile(path.join(assignedRoot, 'protected.txt'), 'protected text');
+      await fs.writeFile(path.join(assignedRoot, 'binary.dat'), Buffer.from([0, 1, 2, 3]));
+
+      const user = await usersService.createLocalUser({
+        email: 'shared-editor-protected@example.com',
+        username: 'shared-editor-protected',
+        displayName: 'Shared Editor Protected',
+        password: 'secret123',
+        roles: ['user'],
+      });
+
+      await userVolumesService.addVolumeToUser({
+        userId: user.id,
+        label: 'SharedEditorProtectedVol',
+        volumePath: assignedRoot,
+        accessMode: 'readwrite',
+      });
+
+      const ownerApp = buildApp({ user });
+      const protectedShare = await request(ownerApp).post('/api/shares').send({
+        sourcePath: 'SharedEditorProtectedVol/protected.txt',
+        accessMode: 'readonly',
+        sharingType: 'anyone',
+        password: 'open-sesame',
+      });
+      const binaryShare = await request(ownerApp).post('/api/shares').send({
+        sourcePath: 'SharedEditorProtectedVol/binary.dat',
+        accessMode: 'readonly',
+        sharingType: 'anyone',
+      });
+      expect(protectedShare.status).toBe(201);
+      expect(binaryShare.status).toBe(201);
+
+      const publicApp = buildApp();
+      const beforeVerification = await request(publicApp).get(
+        `/api/share/${protectedShare.body.shareToken}/editor`
+      );
+      expect(beforeVerification.status).toBe(302);
+
+      const verify = await request(publicApp)
+        .post(`/api/share/${protectedShare.body.shareToken}/verify`)
+        .send({ password: 'open-sesame' });
+      expect(verify.status).toBe(200);
+
+      const afterVerification = await request(publicApp)
+        .get(`/api/share/${protectedShare.body.shareToken}/editor`)
+        .set('X-Guest-Session', verify.body.guestSessionId);
+      expect(afterVerification.status).toBe(200);
+      expect(afterVerification.body.content).toBe('protected text');
+
+      const binary = await request(publicApp).get(
+        `/api/share/${binaryShare.body.shareToken}/editor`
+      );
+      expect(binary.status).toBe(415);
+    });
+  });
 });
diff --git a/backend/tests/routes/sign-in-identifier.test.js b/backend/tests/routes/sign-in-identifier.test.js
new file mode 100644
index 000000000..4e4dd44b7
--- /dev/null
+++ b/backend/tests/routes/sign-in-identifier.test.js
@@ -0,0 +1,119 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+import request from 'supertest';
+
+import { createTestApp, modulePath, setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * One box on the sign-in screen, and the same name for it all the way down.
+ *
+ * The box takes an email address or a username, so it is neither: it is
+ * whatever was typed. That name has to hold from the screen to the route, and
+ * when it did not, nothing said so. The screen sent `identifier`, the store
+ * passed on `email`, and `JSON.stringify` drops a key whose value is undefined
+ * — so the request went out carrying a password and nobody to sign in, and the
+ * answer was "invalid credentials", which is what a wrong password looks like.
+ *
+ * Both halves are asserted here: the route takes the name the screen sends, and
+ * the screen, the client and the store all use that one name. The second half
+ * is read off the frontend sources, because the chain is four files long and
+ * three of them have no runner here — and a chain that breaks silently in the
+ * middle is exactly what this is for.
+ */
+
+const FRONTEND = path.join(__dirname, '..', '..', '..', 'frontend', 'src');
+const read = (relative) => fs.readFileSync(path.join(FRONTEND, relative), 'utf8');
+
+describe('the name for what was typed into the sign-in box', () => {
+  let env;
+  let app;
+
+  beforeEach(async () => {
+    env = await setupTestEnv({
+      tag: 'sign-in-identifier-',
+      modules: ['src/services/db', 'src/routes/auth', 'src/middleware/errorHandler'],
+      envOverrides: { AUTH_ENABLED: 'true' },
+    });
+    await env.requireFresh('src/services/users').createLocalUser({
+      email: 'alice@example.com',
+      username: 'alice',
+      displayName: 'Alice',
+      password: 'correct horse battery',
+      roles: ['admin'],
+    });
+    app = createTestApp({
+      router: env.requireFresh('src/routes/auth'),
+      mountPath: '/api/auth',
+      errorHandler: env.requireFresh('src/middleware/errorHandler').errorHandler,
+    });
+  });
+
+  afterEach(async () => {
+    await env.cleanup();
+  });
+
+  const signIn = (body) => request(app).post('/api/auth/login').send(body);
+
+  it('signs in with the name the screen sends', async () => {
+    const response = await signIn({
+      identifier: 'alice@example.com',
+      password: 'correct horse battery',
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.body.user?.email).toBe('alice@example.com');
+  });
+
+  it('takes a username in the same box', async () => {
+    const response = await signIn({ identifier: 'alice', password: 'correct horse battery' });
+
+    expect(response.status).toBe(200);
+    expect(response.body.user?.username).toBe('alice');
+  });
+
+  it.each(['email', 'username'])('still takes the older name %s', async (name) => {
+    const response = await signIn({
+      [name]: name === 'email' ? 'alice@example.com' : 'alice',
+      password: 'correct horse battery',
+    });
+
+    expect(response.status).toBe(200);
+  });
+
+  it('refuses a password that is wrong, and says nothing about which half', async () => {
+    const response = await signIn({ identifier: 'alice', password: 'not it' });
+
+    expect(response.status).toBe(401);
+    expect(response.body.error?.code).toBe('AUTH_INVALID_CREDENTIALS');
+  });
+
+  /**
+   * The screen, the client and the store. A rename that stops at one of them
+   * leaves the next passing undefined, which is not an error anywhere — the key
+   * simply vanishes from the request body.
+   */
+  it('is the name the screen, the client and the store all use', () => {
+    expect(read('views/AuthLoginView.vue')).toMatch(/auth\.login\(\{\s*identifier:/);
+    expect(read('api/auth.api.js')).toMatch(/const login = \(\{ identifier, password \}\)/);
+    expect(read('stores/auth.js')).toMatch(/const login = async \(\{ identifier, password \}\)/);
+    expect(read('stores/auth.js')).toMatch(/loginApi\(\{ identifier, password \}\)/);
+  });
+
+  /**
+   * Everything else the sign-in screen reads off the store.
+   *
+   * The same rename went through this screen and stopped before the store, and
+   * the identifier was only the half that failed loudly. `totpPending` reads
+   * undefined, so the box for the code from the authenticator never appears:
+   * a correct password on an account with a second factor lands on a screen
+   * that looks like it did nothing. Undefined is not an error in a template —
+   * it is a `v-if` that is false — so there is nothing to see but the absence.
+   */
+  it.each(['totpPending', 'oidcStatus', 'cancelTotp', 'ensureStatus', 'forgetSession'])(
+    'is on the store, because the screen reads it: %s',
+    (member) => {
+      expect(read('stores/auth.js')).toContain(member);
+    }
+  );
+});
diff --git a/backend/tests/routes/usage-no-shell.test.js b/backend/tests/routes/usage-no-shell.test.js
new file mode 100644
index 000000000..fc2628289
--- /dev/null
+++ b/backend/tests/routes/usage-no-shell.test.js
@@ -0,0 +1,83 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import request from 'supertest';
+
+import { createTestApp, setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * How full a volume is, asked of the kernel rather than of a shell.
+ *
+ * It used to be two commands with the path pasted into them — `du -sb "<path>"`
+ * and `df -Pk "<path>"` — and a folder name is not a shell string. A folder
+ * called `x";<anything>;echo "` closed the quote and left whatever followed for
+ * the shell to run, as the server's user, the moment somebody opened it. Any
+ * account that can make a folder could do it, and with sign-in switched off
+ * that is anybody at all.
+ *
+ * `fs.statfs` answers the same question with no shell and no subprocess, which
+ * is also why it is instant: `du` walked the whole tree to report a number the
+ * filesystem already had.
+ *
+ * The test makes such a folder, asks for its usage, and checks that what the
+ * name said to run did not run. It is written against the route because the
+ * route is where the path arrived.
+ */
+
+describe('the usage of a folder whose name is shell syntax', () => {
+  let env;
+  let app;
+  let witness;
+
+  const NAME = 'wedge";touch $WITNESS;echo "';
+
+  beforeEach(async () => {
+    env = await setupTestEnv({ tag: 'usage-no-shell-', modules: ['src/routes/usage'] });
+    witness = path.join(env.cacheDir, 'ran');
+    process.env.WITNESS = witness;
+    await fs.mkdir(path.join(env.volumeDir, NAME), { recursive: true });
+    app = createTestApp({
+      router: env.requireFresh('src/routes/usage'),
+      mountPath: '/api',
+      user: { id: 'u-1', roles: ['admin'] },
+    });
+  });
+
+  afterEach(async () => {
+    delete process.env.WITNESS;
+    await env.cleanup();
+  });
+
+  const exists = async (file) =>
+    fs
+      .access(file)
+      .then(() => true)
+      .catch(() => false);
+
+  it('does not run what the name says to run', async () => {
+    expect(await exists(witness)).toBe(false);
+
+    const response = await request(app).get(`/api/usage/${encodeURIComponent(NAME)}`);
+
+    expect(response.status).toBe(200);
+    expect(await exists(witness)).toBe(false);
+  });
+
+  it('answers with the numbers the filesystem holds', async () => {
+    const response = await request(app).get('/api/usage/');
+
+    expect(response.status).toBe(200);
+    expect(response.body.total).toBeGreaterThan(0);
+    expect(response.body.free).toBeGreaterThan(0);
+    expect(response.body.used).toBe(response.body.total - response.body.free);
+    expect(response.body.percentUsed).toBeGreaterThanOrEqual(0);
+    expect(response.body.percentUsed).toBeLessThanOrEqual(100);
+  });
+
+  it('answers zeroes rather than failing when the path cannot be read', async () => {
+    const response = await request(app).get('/api/usage/nothing-here');
+
+    expect(response.status).toBe(200);
+    expect(response.body).toMatchObject({ size: 0, free: 0, total: 0, percentUsed: 0 });
+  });
+});
diff --git a/backend/tests/routes/user-volumes-ownership.test.js b/backend/tests/routes/user-volumes-ownership.test.js
new file mode 100644
index 000000000..9a5e815e6
--- /dev/null
+++ b/backend/tests/routes/user-volumes-ownership.test.js
@@ -0,0 +1,123 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import express from 'express';
+import request from 'supertest';
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * Which account a volume belongs to, on the routes that change one.
+ *
+ * A volume is addressed twice in these URLs: by the account in the path and by
+ * its own id. Only the id is needed to find it, so a route that looked it up by
+ * id alone would let `/users/alice/volumes/<bob's volume>` rename, re-mode or
+ * remove Bob's folder while the screen said it was editing Alice. The routes
+ * refuse that pairing as "not found", and these pin it — with the same calls
+ * made through the right account as the control, so a 404 cannot come from a
+ * wrong id instead.
+ *
+ * The admin and feature gates in front of all of this are pinned in
+ * `user-volumes.test.js`.
+ */
+
+let currentEnv;
+
+afterEach(async () => {
+  if (currentEnv) {
+    await currentEnv.cleanup();
+    currentEnv = null;
+  }
+});
+
+const ADMIN = { id: 'admin-1', roles: ['admin'] };
+
+const seed = async () => {
+  currentEnv = await setupTestEnv({ tag: 'user-volumes-owner-', env: { USER_VOLUMES: 'true' } });
+  const db = await currentEnv.requireFresh('src/services/db').getDb();
+  const now = new Date().toISOString();
+  for (const id of ['alice', 'bob']) {
+    db.prepare(
+      `INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
+       VALUES (?, ?, 1, ?, ?, '["user"]', ?, ?)`
+    ).run(id, `${id}@example.com`, id, id, now, now);
+  }
+  const media = path.join(currentEnv.volumeDir, 'Media');
+  await fs.mkdir(media, { recursive: true });
+
+  const routes = currentEnv.requireFresh('src/routes/userVolumes');
+  const { errorHandler } = currentEnv.requireFresh('src/middleware/errorHandler');
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    req.user = ADMIN;
+    next();
+  });
+  app.use('/api', routes);
+  app.use(errorHandler);
+
+  const created = await request(app)
+    .post('/api/users/bob/volumes')
+    .send({ label: 'Media', path: media, accessMode: 'readonly' });
+  expect(created.status).toBe(201);
+
+  return { app, db, media, bobVolume: created.body.volume };
+};
+
+const volumesOf = async (app, userId) =>
+  (await request(app).get(`/api/users/${userId}/volumes`)).body.volumes;
+
+describe('a volume reached through an account it does not belong to', () => {
+  it('is not changed', async () => {
+    const { app, bobVolume } = await seed();
+
+    const response = await request(app)
+      .patch(`/api/users/alice/volumes/${bobVolume.id}`)
+      .send({ label: 'Taken', accessMode: 'readwrite' });
+
+    expect(response.status).toBe(404);
+    expect(response.body.error.message).toBe('Volume not found.');
+    expect(await volumesOf(app, 'bob')).toMatchObject([{ label: 'Media', accessMode: 'readonly' }]);
+  });
+
+  it('is not removed', async () => {
+    const { app, bobVolume } = await seed();
+
+    const response = await request(app).delete(`/api/users/alice/volumes/${bobVolume.id}`);
+
+    expect(response.status).toBe(404);
+    expect(response.body.error.message).toBe('Volume not found.');
+    expect((await volumesOf(app, 'bob')).map((v) => v.id)).toEqual([bobVolume.id]);
+  });
+});
+
+describe('a volume reached through the account it belongs to', () => {
+  it('is changed, and then removed', async () => {
+    const { app, bobVolume } = await seed();
+
+    const patched = await request(app)
+      .patch(`/api/users/bob/volumes/${bobVolume.id}`)
+      .send({ label: 'Films', accessMode: 'readwrite' });
+    expect(patched.status).toBe(200);
+    expect(patched.body.volume).toMatchObject({ label: 'Films', accessMode: 'readwrite' });
+
+    const removed = await request(app).delete(`/api/users/bob/volumes/${bobVolume.id}`);
+    expect(removed.status).toBe(204);
+    expect(await volumesOf(app, 'bob')).toEqual([]);
+  });
+});
+
+describe('assigning a volume to an account that does not exist', () => {
+  it('is refused, and stores nothing', async () => {
+    const { app, db, media } = await seed();
+
+    const response = await request(app)
+      .post('/api/users/nobody/volumes')
+      .send({ label: 'Elsewhere', path: media });
+
+    expect(response.status).toBe(404);
+    expect(response.body.error.message).toBe('User not found.');
+    expect(
+      db.prepare("SELECT COUNT(*) AS n FROM user_volumes WHERE user_id = 'nobody'").get().n
+    ).toBe(0);
+  });
+});
diff --git a/backend/tests/routes/user-volumes.test.js b/backend/tests/routes/user-volumes.test.js
new file mode 100644
index 000000000..ac198a272
--- /dev/null
+++ b/backend/tests/routes/user-volumes.test.js
@@ -0,0 +1,174 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import express from 'express';
+import request from 'supertest';
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * Assigning volumes to accounts. Every endpoint sits behind two gates — an
+ * administrator, and the feature actually being switched on — and the order
+ * matters: a regular account must be told no before it learns whether the
+ * feature exists.
+ *
+ * `/admin/browse-directories` reads the container's filesystem outside the
+ * volume root on purpose, because a volume may point anywhere the container can
+ * see. That is exactly why both gates are pinned here.
+ */
+
+let currentEnv;
+
+afterEach(async () => {
+  if (currentEnv) {
+    await currentEnv.cleanup();
+    currentEnv = null;
+  }
+});
+
+const seed = async (env = { USER_VOLUMES: 'true' }) => {
+  currentEnv = await setupTestEnv({ tag: 'user-volumes-', env });
+  const dbService = currentEnv.requireFresh('src/services/db');
+  const db = await dbService.getDb();
+  const now = new Date().toISOString();
+  db.prepare(
+    `INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
+     VALUES ('user-1','regular@example.com',1,'regular','Regular','["user"]', ?, ?)`
+  ).run(now, now);
+  await fs.mkdir(path.join(currentEnv.volumeDir, 'Media'), { recursive: true });
+  return db;
+};
+
+const buildApp = (user) => {
+  const routes = currentEnv.requireFresh('src/routes/userVolumes');
+  const { errorHandler } = currentEnv.requireFresh('src/middleware/errorHandler');
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    if (user) req.user = user;
+    next();
+  });
+  app.use('/api', routes);
+  app.use(errorHandler);
+  return app;
+};
+
+const ADMIN = { id: 'admin-1', roles: ['admin'] };
+const REGULAR = { id: 'user-1', roles: ['user'] };
+
+const ENDPOINTS = [
+  ['get', '/api/users/user-1/volumes', undefined],
+  ['post', '/api/users/user-1/volumes', { label: 'Media', path: '/tmp' }],
+  ['patch', '/api/users/user-1/volumes/anything', { accessMode: 'readonly' }],
+  ['delete', '/api/users/user-1/volumes/anything', undefined],
+  ['get', '/api/admin/browse-directories', undefined],
+];
+
+const call = (app, method, url, body) => {
+  const pending = request(app)[method](url);
+  return body ? pending.send(body) : pending;
+};
+
+describe('the two gates on assigning volumes', () => {
+  it.each(ENDPOINTS)('refuses a regular account on %s %s', async (method, url, body) => {
+    await seed();
+
+    const response = await call(buildApp(REGULAR), method, url, body);
+
+    expect(response.status).toBe(403);
+    expect(response.body.error.message).toBe('Admin access required.');
+  });
+
+  it.each(ENDPOINTS)(
+    'refuses even an administrator when the feature is off, on %s %s',
+    async (method, url, body) => {
+      await seed({ USER_VOLUMES: 'false' });
+
+      const response = await call(buildApp(ADMIN), method, url, body);
+
+      expect(response.status).toBe(403);
+      expect(response.body.error.message).toBe('User volumes feature is not enabled.');
+    }
+  );
+
+  /**
+   * The role is checked first, so someone who is not an administrator cannot
+   * learn from the answer whether the feature is configured.
+   */
+  it('tells a regular account about the role, never about the feature', async () => {
+    await seed({ USER_VOLUMES: 'false' });
+
+    const response = await request(buildApp(REGULAR)).get('/api/users/user-1/volumes');
+
+    expect(response.body.error.message).toBe('Admin access required.');
+  });
+});
+
+describe('assigning a volume', () => {
+  it('says not found for an account that does not exist', async () => {
+    await seed();
+
+    const response = await request(buildApp(ADMIN)).get('/api/users/nobody/volumes');
+
+    expect(response.status).toBe(404);
+  });
+
+  it('lists nothing for an account with no assignment', async () => {
+    await seed();
+
+    const response = await request(buildApp(ADMIN)).get('/api/users/user-1/volumes');
+
+    expect(response.status).toBe(200);
+    expect(response.body.volumes).toEqual([]);
+  });
+
+  it('gives back what it assigned', async () => {
+    await seed();
+    const target = path.join(currentEnv.volumeDir, 'Media');
+
+    const created = await request(buildApp(ADMIN))
+      .post('/api/users/user-1/volumes')
+      .send({ label: 'Media', path: target, accessMode: 'readonly' });
+
+    expect([200, 201]).toContain(created.status);
+
+    const listed = await request(buildApp(ADMIN)).get('/api/users/user-1/volumes');
+    expect(listed.body.volumes.map((v) => v.label)).toEqual(['Media']);
+  });
+});
+
+describe('browsing for a folder to assign', () => {
+  it('lists only the directories it finds', async () => {
+    await seed();
+    await fs.mkdir(path.join(currentEnv.volumeDir, 'Media', 'inner'), { recursive: true });
+    await fs.writeFile(path.join(currentEnv.volumeDir, 'Media', 'file.txt'), 'x');
+
+    const response = await request(buildApp(ADMIN))
+      .get('/api/admin/browse-directories')
+      .query({ path: path.join(currentEnv.volumeDir, 'Media') });
+
+    expect(response.status).toBe(200);
+    expect(response.body.directories.map((d) => d.name)).toEqual(['inner']);
+  });
+
+  it('says not found for a path that is not there', async () => {
+    await seed();
+
+    const response = await request(buildApp(ADMIN))
+      .get('/api/admin/browse-directories')
+      .query({ path: '/definitely/not/here' });
+
+    expect(response.status).toBe(404);
+  });
+
+  it('refuses a file', async () => {
+    await seed();
+    const file = path.join(currentEnv.volumeDir, 'Media', 'file.txt');
+    await fs.writeFile(file, 'x');
+
+    const response = await request(buildApp(ADMIN))
+      .get('/api/admin/browse-directories')
+      .query({ path: file });
+
+    expect(response.status).toBe(400);
+  });
+});
diff --git a/backend/tests/routes/versions-browse-access.test.js b/backend/tests/routes/versions-browse-access.test.js
new file mode 100644
index 000000000..bfea0f593
--- /dev/null
+++ b/backend/tests/routes/versions-browse-access.test.js
@@ -0,0 +1,91 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import express from 'express';
+import request from 'supertest';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { modulePath, setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * Whether a listing says its files show their history, which is what decides
+ * whether the Versions entry appears in the menu: always for a place someone
+ * may read, and through a share only when its owner turned it on.
+ */
+
+let envContext;
+let users;
+let app;
+
+const load = (relative) => require(modulePath(relative));
+
+beforeEach(async () => {
+  envContext = await setupTestEnv({ tag: 'versions-browse-', env: { SHARES_ENABLED: 'true' } });
+  users = {
+    alice: await load('src/services/users').createLocalUser({
+      email: 'alice@example.com',
+      username: 'alice',
+      displayName: 'Alice',
+      password: 'secret123',
+      roles: ['user'],
+    }),
+  };
+  await fs.mkdir(path.join(envContext.volumeDir, 'Projects'), { recursive: true });
+  await fs.writeFile(path.join(envContext.volumeDir, 'Projects', 'notes.md'), '# notes\n');
+
+  app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    const who = req.get('x-test-user');
+    if (who?.startsWith('guest:')) {
+      req.guestSession = { id: 'guest-session', shareId: who.slice('guest:'.length) };
+    } else if (who) {
+      req.user = users[who];
+    }
+    next();
+  });
+  app.use('/api', load('src/routes/browse'));
+  app.use('/api/shares', load('src/routes/shares'));
+  app.use('/api/share', load('src/routes/shares'));
+  app.use(load('src/middleware/errorHandler').errorHandler);
+});
+
+afterEach(async () => {
+  await envContext.cleanup();
+});
+
+describe('what a listing says about file histories', () => {
+  it('shows them in a place someone may read', async () => {
+    const response = await request(app).get('/api/browse/Projects').set('x-test-user', 'alice');
+
+    expect(response.status).toBe(200);
+    expect(response.body.access.canSeeVersions).toBe(true);
+  });
+
+  it('shows them through a share only once its owner turns them on', async () => {
+    const folder = await request(app)
+      .post('/api/shares')
+      .set('x-test-user', 'alice')
+      .send({ sourcePath: 'Projects', sharingType: 'anyone' });
+    const file = await request(app)
+      .post('/api/shares')
+      .set('x-test-user', 'alice')
+      .send({ sourcePath: 'Projects/notes.md', sharingType: 'anyone' });
+    const browseAs = (share) =>
+      request(app)
+        .get(`/api/share/${share.shareToken}/browse/`)
+        .set('x-test-user', `guest:${share.id}`);
+
+    expect((await browseAs(folder.body)).body.access.canSeeVersions).toBe(false);
+    expect((await browseAs(file.body)).body.access.canSeeVersions).toBe(false);
+
+    for (const share of [folder.body, file.body]) {
+      await request(app)
+        .put(`/api/shares/${share.id}`)
+        .set('x-test-user', 'alice')
+        .send({ versionsVisible: true });
+    }
+
+    expect((await browseAs(folder.body)).body.access.canSeeVersions).toBe(true);
+    expect((await browseAs(file.body)).body.access.canSeeVersions).toBe(true);
+  });
+});
diff --git a/backend/tests/routes/volumes.test.js b/backend/tests/routes/volumes.test.js
new file mode 100644
index 000000000..fdd093286
--- /dev/null
+++ b/backend/tests/routes/volumes.test.js
@@ -0,0 +1,112 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import express from 'express';
+import request from 'supertest';
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * Which volumes a caller is told about. Four different answers depending on who
+ * is asking and whether `USER_VOLUMES` is on — and one of them, the empty list
+ * for a share visitor, is the difference between a link to one folder and a map
+ * of the whole server.
+ */
+
+let currentEnv;
+
+afterEach(async () => {
+  if (currentEnv) {
+    await currentEnv.cleanup();
+    currentEnv = null;
+  }
+});
+
+const seed = async (env = {}) => {
+  currentEnv = await setupTestEnv({ tag: 'volumes-route-', env });
+  const dbService = currentEnv.requireFresh('src/services/db');
+  const db = await dbService.getDb();
+  const now = new Date().toISOString();
+  for (const [id, username, roles] of [
+    ['admin-1', 'admin', '["admin"]'],
+    ['user-1', 'regular', '["user"]'],
+  ]) {
+    db.prepare(
+      `INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
+       VALUES (?, ?, 1, ?, ?, ?, ?, ?)`
+    ).run(id, `${username}@example.com`, username, username, roles, now, now);
+  }
+  await fs.mkdir(path.join(currentEnv.volumeDir, 'Media'), { recursive: true });
+  await fs.mkdir(path.join(currentEnv.volumeDir, 'Documents'), { recursive: true });
+  return db;
+};
+
+const buildApp = (user) => {
+  const routes = currentEnv.requireFresh('src/routes/volumes');
+  const { errorHandler } = currentEnv.requireFresh('src/middleware/errorHandler');
+  const app = express();
+  app.use((req, _res, next) => {
+    if (user) req.user = user;
+    next();
+  });
+  app.use('/api', routes);
+  app.use(errorHandler);
+  return app;
+};
+
+const ADMIN = { id: 'admin-1', roles: ['admin'] };
+const REGULAR = { id: 'user-1', roles: ['user'] };
+
+describe('who is told which volumes exist', () => {
+  /**
+   * A share visitor carries a guest session and no account. Listing volumes for
+   * them turns a link to one folder into a map of the server.
+   */
+  it('tells a visitor with no account nothing', async () => {
+    await seed();
+
+    const response = await request(buildApp(null)).get('/api/volumes');
+
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual([]);
+  });
+
+  it('shows every volume when the feature is off', async () => {
+    await seed();
+
+    const response = await request(buildApp(REGULAR)).get('/api/volumes');
+
+    expect(response.status).toBe(200);
+    expect(response.body.map((v) => v.name).sort()).toEqual(['Documents', 'Media']);
+  });
+
+  it('shows every volume to an administrator even when the feature is on', async () => {
+    await seed({ USER_VOLUMES: 'true' });
+
+    const response = await request(buildApp(ADMIN)).get('/api/volumes');
+
+    expect(response.body.map((v) => v.name).sort()).toEqual(['Documents', 'Media']);
+  });
+
+  it('shows a regular account only what it was assigned', async () => {
+    const db = await seed({ USER_VOLUMES: 'true' });
+    const now = new Date().toISOString();
+    db.prepare(
+      `INSERT INTO user_volumes (id, user_id, label, path, access_mode, created_at, updated_at)
+       VALUES ('uv1','user-1','Media', ?, 'readwrite', ?, ?)`
+    ).run(path.join(currentEnv.volumeDir, 'Media'), now, now);
+
+    const response = await request(buildApp(REGULAR)).get('/api/volumes');
+
+    expect(response.status).toBe(200);
+    expect(response.body.map((v) => v.name)).toEqual(['Media']);
+    expect(response.body[0]).toMatchObject({ kind: 'volume', accessMode: 'readwrite' });
+  });
+
+  it('gives a regular account with no assignment an empty list', async () => {
+    await seed({ USER_VOLUMES: 'true' });
+
+    const response = await request(buildApp(REGULAR)).get('/api/volumes');
+
+    expect(response.body).toEqual([]);
+  });
+});
diff --git a/backend/tests/services/access-control.test.js b/backend/tests/services/access-control.test.js
index 1c5689d86..b751ef096 100644
--- a/backend/tests/services/access-control.test.js
+++ b/backend/tests/services/access-control.test.js
@@ -1,11 +1,7 @@
 import { describe, it, expect } from 'vitest';
 import { setupTestEnv } from '../helpers/env-test-utils.js';
 
-const ACCESS_MODULES = [
-  'src/services/storage/jsonStorage',
-  'src/services/settingsService',
-  'src/services/accessControlService',
-];
+const ACCESS_MODULES = ['src/services/settingsService', 'src/services/accessControlService'];
 
 const createAccessContext = async () => {
   const envContext = await setupTestEnv({
diff --git a/backend/tests/services/access-manager.test.js b/backend/tests/services/access-manager.test.js
index 3ff61b169..c8fc10f77 100644
--- a/backend/tests/services/access-manager.test.js
+++ b/backend/tests/services/access-manager.test.js
@@ -569,6 +569,7 @@ describe('accessManager — what a share grants', () => {
       canDelete: false,
       canUpload: false,
       canCreateFolder: false,
+      canCreateFile: false,
       effectivePermission: 'ro',
     });
   });
@@ -585,10 +586,28 @@ describe('accessManager — what a share grants', () => {
       canDelete: true,
       canUpload: true,
       canCreateFolder: true,
+      canCreateFile: true,
       effectivePermission: 'rw',
     });
   });
 
+  it.each([
+    ['allowDelete', 'canDelete'],
+    ['allowUpload', 'canUpload'],
+    ['allowCreateFolder', 'canCreateFolder'],
+    ['allowCreateFile', 'canCreateFile'],
+  ])('withholds %s on its own, leaving the rest of the write grant', async (flag, granted) => {
+    const { share, guestSession } = await openShare(`grant-without-${flag}`, {
+      accessMode: 'readwrite',
+      [flag]: false,
+    });
+
+    const access = await accessTo(share, { guestSession });
+
+    expect(access[granted]).toBe(false);
+    expect(access.canWrite).toBe(true);
+  });
+
   it('never lets a share be shared again', async () => {
     const { share, guestSession } = await openShare('grant-no-resharing', {
       accessMode: 'readwrite',
diff --git a/backend/tests/services/db-single-open.test.js b/backend/tests/services/db-single-open.test.js
new file mode 100644
index 000000000..4cf226b4f
--- /dev/null
+++ b/backend/tests/services/db-single-open.test.js
@@ -0,0 +1,98 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * How many times `app.db` is opened, and how many times a statement is compiled.
+ *
+ * Everything that starts with the server asks for the database at once: the session
+ * store, the settings, the trash sweep, the search index, the favourites. `getDb`
+ * checked whether a connection was already open and opened one when it was not — and
+ * every caller that arrived before the first one had finished saw "not open" and opened
+ * another. Four connections at every start, four runs of the migrations over the same
+ * file in parallel, and whichever finished last became the one everybody used.
+ *
+ * The number that matters is therefore 1, and it is the constructor that is counted
+ * rather than anything the code says about itself.
+ */
+
+let env;
+
+afterEach(async () => {
+  vi.restoreAllMocks();
+  if (env) {
+    env.requireFresh('src/services/db').closeDb?.();
+    await env.cleanup();
+  }
+  env = null;
+});
+
+describe('opening the application database', () => {
+  it('happens once, however many callers ask at the same moment', async () => {
+    env = await setupTestEnv({ tag: 'db-single-open-' });
+    const db = env.requireFresh('src/services/db');
+
+    // Five callers in the same turn, as the start does.
+    const handles = await Promise.all([db.getDb(), db.getDb(), db.getDb(), db.getDb(), db.getDb()]);
+
+    // The same connection, not five that happen to point at the same file.
+    expect(new Set(handles).size).toBe(1);
+  });
+
+  it('gives every later caller the connection it already has', async () => {
+    env = await setupTestEnv({ tag: 'db-single-open-' });
+    const db = env.requireFresh('src/services/db');
+
+    const first = await db.getDb();
+    const second = await db.getDb();
+
+    expect(second).toBe(first);
+  });
+
+  it('opens again after it has been closed', async () => {
+    env = await setupTestEnv({ tag: 'db-single-open-' });
+    const db = env.requireFresh('src/services/db');
+
+    const first = await db.getDb();
+    db.closeDb();
+    const second = await db.getDb();
+
+    expect(second).not.toBe(first);
+    // And the new one works, which a closed handle would not.
+    expect(second.prepare('SELECT 1 AS one').get().one).toBe(1);
+  });
+});
+
+describe('a statement asked for twice', () => {
+  it('is compiled once', async () => {
+    env = await setupTestEnv({ tag: 'db-prepared-' });
+    const db = await env.requireFresh('src/services/db').getDb();
+    const { prepared } = env.requireFresh('src/services/db');
+    const compile = vi.spyOn(db, 'prepare');
+
+    const sql = 'SELECT COUNT(*) AS total FROM users WHERE id = ?';
+    const a = prepared(db, sql);
+    const b = prepared(db, sql);
+
+    expect(b).toBe(a);
+    expect(compile).toHaveBeenCalledTimes(1);
+    // And it is a working statement, not a cached object that only looks like one.
+    expect(a.get('nobody').total).toBe(0);
+  });
+
+  it('is compiled again for a different connection', async () => {
+    env = await setupTestEnv({ tag: 'db-prepared-' });
+    const service = env.requireFresh('src/services/db');
+    const sql = 'SELECT COUNT(*) AS total FROM users';
+
+    const first = await service.getDb();
+    const one = service.prepared(first, sql);
+    service.closeDb();
+    const second = await service.getDb();
+    const two = service.prepared(second, sql);
+
+    // A statement belongs to the connection that compiled it; handing the old one to a
+    // new connection is how a cache keyed on the SQL alone breaks.
+    expect(two).not.toBe(one);
+  });
+});
diff --git a/backend/tests/services/folder-preferences-as-rows.test.js b/backend/tests/services/folder-preferences-as-rows.test.js
new file mode 100644
index 000000000..b447d1ae1
--- /dev/null
+++ b/backend/tests/services/folder-preferences-as-rows.test.js
@@ -0,0 +1,189 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * What a user chose for one folder, held as a row of its own.
+ *
+ * It used to be two JSON values per account under `user_settings` — one map of
+ * sorts, one of views — read and rewritten whole on every change. Three things
+ * followed from that, and all three are asserted here:
+ *
+ *   - Two tabs open on different folders overwrote each other. Each sent the
+ *     whole map, so whichever saved last won and the other folder's choice was
+ *     gone.
+ *   - The map had to be capped, because it shipped entire on every load and was
+ *     rewritten entire on every change. The hundred-and-first folder silently
+ *     forgot the oldest.
+ *   - Nothing could clean it up: a deleted folder's preferences stayed behind on
+ *     every account that had ever opened it.
+ *
+ * The carry-over is asserted too. An installation that has the old values keeps
+ * them: they are moved into rows, and the values they came from are removed so
+ * a later version cannot read them back.
+ */
+
+const MODULES = ['src/services/db', 'src/services/settingsService'];
+
+let envContext;
+let settingsService;
+let dbService;
+
+beforeEach(async () => {
+  envContext = await setupTestEnv({ tag: 'folder-preferences-', modules: MODULES });
+  dbService = envContext.requireFresh('src/services/db');
+  settingsService = envContext.requireFresh('src/services/settingsService');
+
+  const db = await dbService.getDb();
+  const now = new Date().toISOString();
+  for (const id of ['u-1', 'u-2']) {
+    db.prepare('INSERT INTO users (id, email, created_at, updated_at) VALUES (?, ?, ?, ?)').run(
+      id,
+      `${id}@example.com`,
+      now,
+      now
+    );
+  }
+});
+
+afterEach(async () => {
+  await envContext.cleanup();
+});
+
+const stored = (userId = 'u-1') => settingsService.getUserSettings(userId);
+
+describe('a folder’s remembered sort and view', () => {
+  it('is saved one folder at a time, so another folder’s choice survives it', async () => {
+    await settingsService.setUserFolderSort('u-1', 'Projects', { by: 'name', order: 'desc' });
+    await settingsService.setUserFolderSort('u-1', 'Music', { by: 'size', order: 'asc' });
+
+    expect((await stored()).folderSorts).toMatchObject({
+      Projects: { by: 'name', order: 'desc' },
+      Music: { by: 'size', order: 'asc' },
+    });
+  });
+
+  it('keeps the sort when the view of the same folder is set, and the other way round', async () => {
+    await settingsService.setUserFolderSort('u-1', 'Projects', { by: 'name', order: 'desc' });
+    await settingsService.setUserFolderView('u-1', 'Projects', { mode: 'photos' });
+
+    const settings = await stored();
+    expect(settings.folderSorts.Projects).toMatchObject({ by: 'name', order: 'desc' });
+    expect(settings.folderViews.Projects).toMatchObject({ mode: 'photos' });
+  });
+
+  it('is one account’s alone', async () => {
+    await settingsService.setUserFolderView('u-1', 'Projects', { mode: 'list' });
+    await settingsService.setUserFolderView('u-2', 'Projects', { mode: 'grid' });
+
+    expect((await stored('u-1')).folderViews.Projects).toMatchObject({ mode: 'list' });
+    expect((await stored('u-2')).folderViews.Projects).toMatchObject({ mode: 'grid' });
+  });
+
+  /**
+   * The hundred-and-first folder. As one value per account this was a ceiling,
+   * and the oldest entry was dropped to stay under it; as rows there is nothing
+   * to stay under.
+   */
+  it('is remembered past the hundred the single value could hold', async () => {
+    for (let n = 0; n < 120; n += 1) {
+      await settingsService.setUserFolderSort('u-1', `Folder-${n}`, { by: 'name', order: 'asc' });
+    }
+
+    const { folderSorts } = await stored();
+    expect(Object.keys(folderSorts)).toHaveLength(120);
+    expect(folderSorts['Folder-0']).toMatchObject({ by: 'name', order: 'asc' });
+  });
+
+  it('refuses a view mode there is no such thing as, rather than storing it', async () => {
+    await settingsService.setUserFolderView('u-1', 'Projects', { mode: 'grid' });
+    await settingsService.setUserFolderView('u-1', 'Projects', { mode: 'sideways' });
+
+    expect((await stored()).folderViews.Projects).toMatchObject({ mode: 'grid' });
+  });
+});
+
+/**
+ * The installation that already had them.
+ *
+ * Built by putting the database back the way schema 19 left it — the two values
+ * under `user_settings`, no table of rows, the version stamped back — and then
+ * opening it again, which is the migration this batch adds.
+ */
+describe('preferences carried over from the single value per account', () => {
+  const T = 1756300000000;
+
+  const asSchema19 = async () => {
+    const db = await dbService.getDb();
+    const setting = (id, userId, key, value) =>
+      db
+        .prepare(
+          'INSERT INTO user_settings (id, user_id, key, value, updated_at) VALUES (?, ?, ?, ?, ?)'
+        )
+        .run(id, userId, key, value, new Date(T).toISOString());
+
+    setting(
+      'us-1',
+      'u-1',
+      'folderSorts',
+      JSON.stringify({
+        Projects: { by: 'name', order: 'desc', updatedAt: T },
+        Docs: { by: 'size', order: 'asc', updatedAt: T + 100 },
+      })
+    );
+    setting(
+      'us-2',
+      'u-1',
+      'folderViews',
+      JSON.stringify({ Projects: { mode: 'grid', updatedAt: T + 200 } })
+    );
+    setting('us-3', 'u-2', 'folderSorts', '{ not json');
+    setting('us-4', 'u-1', 'theme', '"dark"');
+
+    db.exec('DROP TABLE folder_preferences');
+    db.prepare('INSERT OR REPLACE INTO meta(key, value) VALUES (?, ?)').run('schema_version', '19');
+    await dbService.closeDb();
+
+    envContext.requireFresh('src/services/db');
+    dbService = envContext.requireFresh('src/services/db');
+    settingsService = envContext.requireFresh('src/services/settingsService');
+    return dbService.getDb();
+  };
+
+  it('makes one row per folder, merging the sort and the view under the later time', async () => {
+    const db = await asSchema19();
+
+    expect(
+      db
+        .prepare(
+          `SELECT user_id, path, sort_by, sort_order, view_mode
+             FROM folder_preferences ORDER BY user_id, path`
+        )
+        .all()
+    ).toEqual([
+      { user_id: 'u-1', path: 'Docs', sort_by: 'size', sort_order: 'asc', view_mode: null },
+      { user_id: 'u-1', path: 'Projects', sort_by: 'name', sort_order: 'desc', view_mode: 'grid' },
+    ]);
+  });
+
+  it('removes the values it read, including one it could not, and keeps the rest', async () => {
+    const db = await asSchema19();
+
+    expect(db.prepare('SELECT user_id, key FROM user_settings ORDER BY key').all()).toEqual([
+      { user_id: 'u-1', key: 'theme' },
+    ]);
+  });
+
+  it('serves them through what the application reads', async () => {
+    await asSchema19();
+
+    expect(await settingsService.getUserSettings('u-1')).toMatchObject({
+      folderSorts: {
+        Docs: { by: 'size', order: 'asc' },
+        Projects: { by: 'name', order: 'desc' },
+      },
+      folderViews: { Projects: { mode: 'grid' } },
+      theme: 'dark',
+    });
+  });
+});
diff --git a/backend/tests/services/legacy-cache-check.test.js b/backend/tests/services/legacy-cache-check.test.js
new file mode 100644
index 000000000..5dcfa6ecc
--- /dev/null
+++ b/backend/tests/services/legacy-cache-check.test.js
@@ -0,0 +1,86 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * What early releases left in the cache directory.
+ *
+ * An installation that started on 1.1.7 or earlier kept its database in /cache;
+ * the move to /config that 1.1.8 made was removed in 2.0.3, so one that skipped
+ * the releases in between comes up on an empty app.db with its accounts unread
+ * in /cache. Nothing said so. Now the start does — and moves nothing, since
+ * which file holds what matters cannot be told from here.
+ */
+
+let envContext;
+
+afterEach(async () => {
+  if (envContext) await envContext.cleanup();
+  envContext = null;
+});
+
+const setup = async () => {
+  envContext = await setupTestEnv({ tag: 'legacy-cache-' });
+  const check = envContext.requireFresh('src/services/legacyCacheCheck');
+  const log = { warn: vi.fn(), info: vi.fn() };
+  const report = () =>
+    check.reportLegacyCache({
+      cacheDir: envContext.cacheDir,
+      configDir: envContext.configDir,
+      log,
+    });
+  return { check, log, report, cache: envContext.cacheDir, config: envContext.configDir };
+};
+
+describe('an app.db left in the cache directory', () => {
+  it('is reported as a warning naming both files, and left where it is', async () => {
+    const { log, report, cache, config } = await setup();
+    fs.writeFileSync(path.join(cache, 'app.db'), 'SQLite format 3\0 with the old accounts');
+
+    const findings = report();
+
+    expect(findings).toEqual([expect.objectContaining({ name: 'app.db', kind: 'database' })]);
+    expect(log.warn).toHaveBeenCalledTimes(1);
+    expect(log.warn.mock.calls[0][0]).toMatchObject({
+      legacyDatabase: path.join(cache, 'app.db'),
+      databaseInUse: path.join(config, 'app.db'),
+    });
+    expect(fs.existsSync(path.join(cache, 'app.db'))).toBe(true);
+  });
+});
+
+describe('links left in the cache directory', () => {
+  it('are mentioned as unused, not warned about, and not followed', async () => {
+    const { log, report, cache, config } = await setup();
+    fs.writeFileSync(path.join(config, 'app-config.json'), '{}');
+    fs.symlinkSync(path.join(config, 'app.db'), path.join(cache, 'app.db'));
+    fs.symlinkSync(path.join(config, 'app-config.json'), path.join(cache, 'app-config.json'));
+    fs.symlinkSync(path.join(config, 'extensions'), path.join(cache, 'extensions'));
+
+    const findings = report();
+
+    expect(findings.map((finding) => [finding.name, finding.kind])).toEqual([
+      ['app.db', 'link'],
+      ['app-config.json', 'link'],
+      ['extensions', 'link'],
+    ]);
+    expect(log.warn).not.toHaveBeenCalled();
+    expect(log.info).toHaveBeenCalledTimes(1);
+    expect(log.info.mock.calls[0][0].links).toHaveLength(3);
+  });
+});
+
+describe('a cache directory with nothing from early releases', () => {
+  it('says nothing', async () => {
+    const { log, report, cache } = await setup();
+    fs.mkdirSync(path.join(cache, 'thumbnails'), { recursive: true });
+    fs.writeFileSync(path.join(cache, 'index.db'), 'SQLite format 3\0');
+
+    expect(report()).toEqual([]);
+    expect(log.warn).not.toHaveBeenCalled();
+    expect(log.info).not.toHaveBeenCalled();
+  });
+});
diff --git a/backend/tests/services/performance-diagnostics.test.js b/backend/tests/services/performance-diagnostics.test.js
new file mode 100644
index 000000000..2e3b7c010
--- /dev/null
+++ b/backend/tests/services/performance-diagnostics.test.js
@@ -0,0 +1,153 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * The periodic record of what the process is costing.
+ *
+ * It exists for the case nobody can reproduce: an installation that goes slow after
+ * hours, on storage nobody here has, with a load nobody here makes. The only useful
+ * answer is what the process was costing at the time, so the sampler reports CPU,
+ * resident memory as the cgroup sees it, event-loop delay, and the queues that grow.
+ *
+ * What is worth testing is not the numbers — they are the machine's — but the three
+ * decisions around them: that it says nothing at all unless it was asked for, that it
+ * then reports only the intervals that look wrong, and that it can be told to report
+ * every one. A diagnostic that logs on every interval by accident is a diagnostic that
+ * fills a disk.
+ */
+
+let env;
+
+afterEach(async () => {
+  vi.restoreAllMocks();
+  if (env) {
+    env.requireFresh('src/services/performanceDiagnostics').stop();
+    await env.cleanup();
+  }
+  env = null;
+});
+
+const load = async (extraEnv = {}) => {
+  env = await setupTestEnv({ tag: 'perf-diagnostics-', env: extraEnv });
+  // The logger first, and spied on before the service is loaded: the service keeps
+  // whichever logger it was given at require time, so spying on a fresh one afterwards
+  // watches an object nothing writes to.
+  const logger = env.requireFresh('src/utils/logger');
+  const said = vi.spyOn(logger, 'info');
+  const diagnostics = env.requireFresh('src/services/performanceDiagnostics');
+  return { diagnostics, said };
+};
+
+/** Every message a logger spy was given, as one string. */
+const messages = (spy) => spy.mock.calls.map((call) => String(call[1] ?? call[0])).join('\n');
+
+describe('the performance record', () => {
+  it('is silent unless somebody asked for it', async () => {
+    const { diagnostics, said } = await load();
+
+    diagnostics.start();
+
+    expect(messages(said)).not.toContain('Performance diagnostics');
+  });
+
+  it('says what it will watch, and by which thresholds, when it is on', async () => {
+    const { diagnostics, said } = await load({
+      PERFORMANCE_DIAGNOSTICS_ENABLED: 'true',
+      PERFORMANCE_DIAGNOSTICS_INTERVAL_MS: '60000',
+      PERFORMANCE_DIAGNOSTICS_CPU_THRESHOLD: '90',
+    });
+
+    diagnostics.start();
+
+    expect(messages(said)).toContain('Performance diagnostics enabled');
+    const announced = said.mock.calls.find(([, message]) => /enabled/.test(String(message)))[0];
+    expect(announced.intervalMs).toBe(60000);
+    expect(announced.cpuThreshold).toBe(90);
+  });
+
+  it('holds an interval below its floor to the default, rather than sampling constantly', async () => {
+    // What an emptied or mistyped field sends. A sampler on a 1 ms interval costs more
+    // than whatever it was meant to diagnose.
+    const { diagnostics, said } = await load({
+      PERFORMANCE_DIAGNOSTICS_ENABLED: 'true',
+      PERFORMANCE_DIAGNOSTICS_INTERVAL_MS: '1',
+    });
+
+    diagnostics.start();
+
+    const announced = said.mock.calls.find(([, message]) => /enabled/.test(String(message)))[0];
+    expect(announced.intervalMs).toBe(15000);
+  });
+
+  it('reports nothing of an interval that looks ordinary', async () => {
+    const { diagnostics, said } = await load({
+      PERFORMANCE_DIAGNOSTICS_ENABLED: 'true',
+      // Thresholds nothing here will reach.
+      PERFORMANCE_DIAGNOSTICS_CPU_THRESHOLD: '100000',
+      PERFORMANCE_DIAGNOSTICS_RSS_THRESHOLD_MB: '100000',
+      PERFORMANCE_DIAGNOSTICS_EVENT_LOOP_DELAY_MS: '100000',
+    });
+
+    diagnostics.start();
+    await vi.waitFor(() => expect(messages(said)).toContain('enabled'));
+    await new Promise((resolve) => setTimeout(resolve, 50));
+
+    const records = said.mock.calls.filter(([, message]) => message === 'Performance diagnostics');
+    expect(records).toEqual([]);
+  });
+
+  it('reports one that passes a threshold, and says which kind of interval it was', async () => {
+    const { diagnostics, said } = await load({
+      PERFORMANCE_DIAGNOSTICS_ENABLED: 'true',
+      // A memory threshold of nothing: every interval is past it.
+      PERFORMANCE_DIAGNOSTICS_RSS_THRESHOLD_MB: '1',
+    });
+
+    diagnostics.start();
+
+    await vi.waitFor(() => {
+      const records = said.mock.calls.filter(
+        ([, message]) => message === 'Performance diagnostics'
+      );
+      expect(records.length).toBeGreaterThan(0);
+      expect(records[0][0].reason).toBe('resource-pressure');
+    });
+  });
+
+  it('reports every interval when it is told to', async () => {
+    const { diagnostics, said } = await load({
+      PERFORMANCE_DIAGNOSTICS_ENABLED: 'true',
+      PERFORMANCE_DIAGNOSTICS_LOG_EVERY_INTERVAL: 'true',
+      PERFORMANCE_DIAGNOSTICS_CPU_THRESHOLD: '100000',
+      PERFORMANCE_DIAGNOSTICS_RSS_THRESHOLD_MB: '100000',
+      PERFORMANCE_DIAGNOSTICS_EVENT_LOOP_DELAY_MS: '100000',
+    });
+
+    diagnostics.start();
+
+    await vi.waitFor(() => {
+      const records = said.mock.calls.filter(
+        ([, message]) => message === 'Performance diagnostics'
+      );
+      expect(records.length).toBeGreaterThan(0);
+      // Nothing was under pressure: it is reporting because it was asked to.
+      expect(records[0][0].reason).toBe('interval');
+    });
+  });
+
+  it('samples the machine rather than guessing at it', async () => {
+    const { diagnostics } = await load({ PERFORMANCE_DIAGNOSTICS_ENABLED: 'true' });
+
+    const snapshot = await diagnostics.sample();
+
+    // `toMb` rounds, and this process is small enough to round to zero on some
+    // machines, so what is asserted is that the numbers came from somewhere rather
+    // than what they are.
+    expect(typeof snapshot.memoryMb.rss).toBe('number');
+    expect(snapshot.memoryMb.heapTotal).toBeGreaterThan(0);
+    // And the queues each answered, or said they had nothing to answer with.
+    expect(snapshot).toHaveProperty('resources');
+    expect(snapshot).toHaveProperty('cpuPercent');
+  });
+});
diff --git a/backend/tests/services/personal-folder-reservation.test.js b/backend/tests/services/personal-folder-reservation.test.js
new file mode 100644
index 000000000..173f19304
--- /dev/null
+++ b/backend/tests/services/personal-folder-reservation.test.js
@@ -0,0 +1,153 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * A deleted account's personal folder is not handed to the next account.
+ *
+ * Deleting an account removed its row and nothing else: `_users/<name>` stayed
+ * on disk with what it held, its trash and its versions, and the name was free
+ * again. With `USER_FOLDER_NAME_ORDER=username,id` — what the environment
+ * reference recommends — the next account called bob claimed `bob`, and with it
+ * the previous bob's files. Reproduced before this change.
+ *
+ * The name now stays reserved while the folder is on disk; removing or renaming
+ * that folder on the server frees it. The rows that only described the account
+ * go with it.
+ */
+
+let envContext;
+
+afterEach(async () => {
+  if (envContext) await envContext.cleanup();
+  envContext = null;
+});
+
+const build = async () => {
+  envContext = await setupTestEnv({
+    tag: 'personal-folder-reservation-',
+    env: { USER_FOLDER_NAME_ORDER: 'username,id', USER_DIR_ENABLED: 'true' },
+  });
+  const dbModule = envContext.requireFresh('src/services/db');
+  const db = await dbModule.getDb();
+  const { claimPersonalFolderName } = envContext.requireFresh('src/services/personalFolders');
+  const { deleteUser } = envContext.requireFresh('src/services/users/management');
+  const userRoot = path.join(envContext.volumeDir, '_users');
+  return { db, dbModule, claimPersonalFolderName, deleteUser, userRoot };
+};
+
+const addUser = (db, { id, username, createdAt = new Date().toISOString() }) => {
+  db.prepare(
+    `INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
+     VALUES (?, ?, 1, ?, ?, '["user"]', ?, ?)`
+  ).run(id, `${id}@example.com`, username, username, createdAt, createdAt);
+  return db.prepare('SELECT * FROM users WHERE id = ?').get(id);
+};
+
+const count = (db, sql, ...args) =>
+  db
+    .prepare(sql)
+    .pluck()
+    .get(...args);
+
+describe('the folder name of a deleted account', () => {
+  it('is not given to the next account that derives it while its folder is on disk', async () => {
+    const { db, claimPersonalFolderName, deleteUser, userRoot } = await build();
+    expect(claimPersonalFolderName(db, addUser(db, { id: 'bob-1', username: 'bob' }))).toBe('bob');
+    fs.mkdirSync(path.join(userRoot, 'bob'), { recursive: true });
+    fs.writeFileSync(path.join(userRoot, 'bob', 'payslip.pdf'), 'private');
+
+    await deleteUser({ userId: 'bob-1' });
+    const claimed = claimPersonalFolderName(db, addUser(db, { id: 'bob-2', username: 'bob' }));
+
+    expect(claimed).not.toBe('bob');
+    expect(claimed).toBe('bob-2');
+    expect(fs.readFileSync(path.join(userRoot, 'bob', 'payslip.pdf'), 'utf8')).toBe('private');
+  });
+
+  it('is given out again once its folder has been removed from the disk', async () => {
+    const { db, claimPersonalFolderName, deleteUser, userRoot } = await build();
+    claimPersonalFolderName(db, addUser(db, { id: 'bob-1', username: 'bob' }));
+    fs.mkdirSync(path.join(userRoot, 'bob'), { recursive: true });
+    await deleteUser({ userId: 'bob-1' });
+
+    fs.rmSync(path.join(userRoot, 'bob'), { recursive: true });
+    const claimed = claimPersonalFolderName(db, addUser(db, { id: 'bob-2', username: 'bob' }));
+
+    expect(claimed).toBe('bob');
+    expect(count(db, 'SELECT COUNT(*) FROM personal_folder_reservations')).toBe(0);
+  });
+
+  it('reserves nothing for an account that never had a folder name', async () => {
+    const { db, deleteUser } = await build();
+    addUser(db, { id: 'ann-1', username: 'ann' });
+
+    await deleteUser({ userId: 'ann-1' });
+
+    expect(count(db, 'SELECT COUNT(*) FROM personal_folder_reservations')).toBe(0);
+  });
+});
+
+describe('deleting an account', () => {
+  const seedRows = (db, userId) => {
+    const now = new Date().toISOString();
+    db.prepare(
+      "INSERT INTO folder_preferences (user_id, path, sort_by, sort_order, view_mode, updated_at) VALUES (?, 'Docs', 'name', 'asc', 'list', ?)"
+    ).run(userId, now);
+    db.prepare(
+      "INSERT INTO recent_destinations (user_id, path, used_at) VALUES (?, 'Docs', ?)"
+    ).run(userId, now);
+    db.prepare('INSERT INTO auth_locks (key, failed_count, locked_until) VALUES (?, 3, NULL)').run(
+      userId
+    );
+  };
+
+  it('removes the rows that only described it, and leaves everyone else their own', async () => {
+    const { db, deleteUser } = await build();
+    addUser(db, { id: 'gone', username: 'gone' });
+    addUser(db, { id: 'stays', username: 'stays' });
+    seedRows(db, 'gone');
+    seedRows(db, 'stays');
+
+    await deleteUser({ userId: 'gone' });
+
+    for (const table of ['folder_preferences', 'recent_destinations']) {
+      expect(count(db, `SELECT COUNT(*) FROM ${table} WHERE user_id = 'gone'`), table).toBe(0);
+      expect(count(db, `SELECT COUNT(*) FROM ${table} WHERE user_id = 'stays'`), table).toBe(1);
+    }
+    expect(count(db, "SELECT COUNT(*) FROM auth_locks WHERE key = 'gone'")).toBe(0);
+    expect(count(db, "SELECT COUNT(*) FROM auth_locks WHERE key = 'stays'")).toBe(1);
+  });
+
+  it('removes, at the upgrade, the rows accounts deleted before it left behind', async () => {
+    const { db, dbModule, deleteUser } = await build();
+    addUser(db, { id: 'stays', username: 'stays' });
+    addUser(db, { id: 'deleted-long-ago', username: 'old' });
+    seedRows(db, 'stays');
+    seedRows(db, 'deleted-long-ago');
+    // Deleted the way every release before this one did: the row alone.
+    db.prepare("DELETE FROM users WHERE id = 'deleted-long-ago'").run();
+    // Back to before the reservations table existed here, which is 22: the
+    // numbering is this repository's, not the fork's.
+    db.prepare("UPDATE meta SET value = '22' WHERE key = 'schema_version'").run();
+    dbModule.closeDb();
+    void deleteUser;
+
+    const reopened = await envContext.requireFresh('src/services/db').getDb();
+
+    expect(count(reopened, "SELECT value FROM meta WHERE key = 'schema_version'")).toBe('23');
+    for (const table of ['folder_preferences', 'recent_destinations']) {
+      expect(
+        count(reopened, `SELECT COUNT(*) FROM ${table} WHERE user_id = 'deleted-long-ago'`)
+      ).toBe(0);
+      expect(count(reopened, `SELECT COUNT(*) FROM ${table} WHERE user_id = 'stays'`)).toBe(1);
+    }
+    // Sign-in locks are left alone: those older releases wrote are keyed by the name
+    // that was typed, not by an account id, so which account one belonged to
+    // cannot be told, and an upgrade must not lift a lock it cannot place.
+    expect(count(reopened, 'SELECT COUNT(*) FROM auth_locks')).toBe(2);
+  });
+});
diff --git a/backend/tests/services/search-index.test.js b/backend/tests/services/search-index.test.js
index e85a7420d..2e7b1f26e 100644
--- a/backend/tests/services/search-index.test.js
+++ b/backend/tests/services/search-index.test.js
@@ -561,12 +561,14 @@ describe('forgetting what is gone', () => {
   });
 
   // Nothing walks a folder that is not there, so nothing asks what it held.
+  // Three rows go, not two: a folder has a row of its own now, so that somebody
+  // can find it by its name without knowing what is inside it.
   it('forgets a folder that was removed outright', async () => {
     await fs.rm(volumePath('Docs', 'Notes'), { recursive: true });
 
     const result = await indexAll();
 
-    expect(result.removed).toBe(2);
+    expect(result.removed).toBe(3);
     expect(store.search(db, 'pangolin')).toEqual(['Docs/kept.txt']);
   });
 
diff --git a/backend/tests/services/settings-without-json.test.js b/backend/tests/services/settings-without-json.test.js
new file mode 100644
index 000000000..d9416513d
--- /dev/null
+++ b/backend/tests/services/settings-without-json.test.js
@@ -0,0 +1,130 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import Database from 'better-sqlite3';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { setupTestEnv } from '../helpers/env-test-utils.js';
+
+/**
+ * Settings live in app.db, and only there.
+ *
+ * They used to be mirrored into app-config.json by one save path and read back
+ * from it whenever app.db could not be read. The screens save through another
+ * path, so the file stopped following the settings — and a read that failed ran
+ * with whatever the file held, usually no access rules at all: reproduced, a
+ * folder hidden by a rule answered `rw` for as long as the read kept failing.
+ * The file is still read once by the migrations that carry very old settings
+ * into app.db; nothing at runtime reads or writes it.
+ */
+
+let envContext;
+
+afterEach(async () => {
+  vi.restoreAllMocks();
+  if (envContext) await envContext.cleanup();
+  envContext = null;
+});
+
+const setup = async () => {
+  envContext = await setupTestEnv({ tag: 'settings-without-json-' });
+  const db = await envContext.requireFresh('src/services/db').getDb();
+  const accessControl = envContext.requireFresh('src/services/accessControlService');
+  const settings = envContext.requireFresh('src/services/settingsService');
+  return { db, accessControl, settings, file: path.join(envContext.configDir, 'app-config.json') };
+};
+
+/**
+ * Make the read of the system settings fail, the way a damaged database does.
+ *
+ * Only that read: the branding is read from the same table, and failing both
+ * would let a fallback in the system settings hide behind the branding's own
+ * failure.
+ */
+const breakSettingsReads = (db) => {
+  const proto = Object.getPrototypeOf(db.prepare('SELECT 1'));
+  for (const method of ['get', 'all']) {
+    const original = proto[method];
+    vi.spyOn(proto, method).mockImplementation(function (...args) {
+      if (/FROM system_settings WHERE category = \?\s*$/.test(this.source)) {
+        throw Object.assign(new Error('database disk image is malformed'), {
+          code: 'SQLITE_CORRUPT',
+        });
+      }
+      return original.apply(this, args);
+    });
+  }
+};
+
+describe('access rules when the settings cannot be read', () => {
+  it('refuse to answer rather than let a hidden folder open', async () => {
+    const { db, accessControl } = await setup();
+    await accessControl.setRules([{ path: 'Secret', recursive: true, permissions: 'hidden' }]);
+    expect(await accessControl.getPermissionForPath('Secret/plan.pdf')).toBe('hidden');
+
+    breakSettingsReads(db);
+
+    await expect(accessControl.getPermissionForPath('Secret/plan.pdf')).rejects.toThrow(
+      /malformed/
+    );
+  });
+
+  it('do not fall back to an app-config.json left on disk, whatever it says', async () => {
+    const { db, accessControl, file } = await setup();
+    await accessControl.setRules([{ path: 'Secret', recursive: true, permissions: 'hidden' }]);
+    fs.writeFileSync(
+      file,
+      JSON.stringify({ version: 4, settings: { access: { rules: [] } }, favorites: [] })
+    );
+
+    breakSettingsReads(db);
+
+    await expect(accessControl.getPermissionForPath('Secret/plan.pdf')).rejects.toThrow();
+  });
+});
+
+describe('app-config.json at runtime', () => {
+  it('is not created by reading the settings of a new installation', async () => {
+    const { settings, accessControl, file } = await setup();
+
+    await settings.getPublicSettings();
+    await settings.getSettings();
+    await accessControl.getRules();
+
+    expect(fs.existsSync(file)).toBe(false);
+  });
+
+  it('is not written by saving settings, and one already there is left as it was', async () => {
+    const { accessControl, settings, file } = await setup();
+    const before = JSON.stringify({ version: 4, settings: {}, favorites: [] });
+    fs.writeFileSync(file, before);
+
+    await accessControl.setRules([{ path: 'Secret', recursive: true, permissions: 'ro' }]);
+    await settings.setSettings({ thumbnails: { quality: 60 } });
+
+    expect(fs.readFileSync(file, 'utf8')).toBe(before);
+    expect(await accessControl.getPermissionForPath('Secret/a.txt')).toBe('ro');
+  });
+
+  it('gives the sign-in page the default branding when none was saved', async () => {
+    const { settings } = await setup();
+
+    const { branding } = await settings.getPublicSettings();
+
+    expect(branding).toEqual(expect.objectContaining({ appName: expect.any(String) }));
+  });
+
+  it('keeps the default branding when the saved one cannot be parsed', async () => {
+    const { db, settings } = await setup();
+    db.prepare(
+      "INSERT INTO system_settings (id, category, key, value, updated_at) VALUES ('b', 'branding', 'branding', '{not json', ?)"
+    ).run(new Date().toISOString());
+
+    const { branding } = await settings.getPublicSettings();
+
+    expect(branding).toEqual(expect.objectContaining({ appName: expect.any(String) }));
+  });
+});
+
+// Database is imported for its prototype only through the connection above.
+void Database;
diff --git a/backend/tests/services/settings.test.js b/backend/tests/services/settings.test.js
index cce8f1696..ebbf26e37 100644
--- a/backend/tests/services/settings.test.js
+++ b/backend/tests/services/settings.test.js
@@ -1,11 +1,7 @@
 import { describe, it, expect } from 'vitest';
 import { setupTestEnv } from '../helpers/env-test-utils.js';
 
-const SETTINGS_MODULES = [
-  'src/services/storage/jsonStorage',
-  'src/services/settingsService',
-  'src/services/db',
-];
+const SETTINGS_MODULES = ['src/services/settingsService', 'src/services/db'];
 
 const createSettingsContext = async () => {
   const envContext = await setupTestEnv({
@@ -29,6 +25,8 @@ describe('Settings Service', () => {
         expect(settings.thumbnails.size).toBe(200);
         expect(settings.thumbnails.quality).toBe(70);
         expect(settings.thumbnails.concurrency).toBe(10);
+        expect(settings.uploads.chunkedEnabled).toBe(false);
+        expect(settings.uploads.chunkSizeBytes).toBe(8 * 1024 * 1024);
       } finally {
         await envContext.cleanup();
       }
@@ -36,18 +34,15 @@ describe('Settings Service', () => {
   });
 
   describe('setSettings', () => {
-    it('should sanitize thumbnails and filter access rules', async () => {
+    it('should sanitize thumbnails and uploads, and tidy a rule path', async () => {
       const { envContext, settingsService } = await createSettingsContext();
       try {
         const payload = {
           thumbnails: { size: 5000, quality: 150, concurrency: -2 },
           access: {
-            rules: [
-              { path: '/Projects', permissions: 'ro', recursive: true },
-              { path: 'uploads', permissions: 'invalid', recursive: false },
-              { path: '../bad', permissions: 'hidden' },
-            ],
+            rules: [{ path: '/Projects', permissions: 'ro', recursive: true }],
           },
+          uploads: { chunkedEnabled: true, chunkSizeBytes: 512 },
         };
 
         const updated = await settingsService.setSettings(payload);
@@ -56,9 +51,42 @@ describe('Settings Service', () => {
         expect(updated.thumbnails.quality).toBe(100);
         expect(updated.thumbnails.concurrency).toBe(1);
         expect(updated.thumbnails.enabled).toBe(true);
-        expect(updated.access.rules.length).toBe(2);
+        expect(updated.access.rules.length).toBe(1);
         expect(updated.access.rules[0].path).toBe('Projects');
-        expect(updated.access.rules[1].permissions).toBe('rw');
+        expect(updated.uploads.chunkedEnabled).toBe(true);
+        expect(updated.uploads.chunkSizeBytes).toBe(1024 * 1024);
+      } finally {
+        await envContext.cleanup();
+      }
+    });
+
+    /**
+     * A number out of its bounds is brought within them, because every value in
+     * the range means the same kind of thing. A rule is not like that: there is
+     * no nearest valid folder for `../bad`, and the nearest valid permissions
+     * for a misspelt `readonly` used to be `rw` — the opposite of what was
+     * meant. Both are answered instead, and nothing is stored.
+     */
+    it('should refuse an access rule it cannot store rather than repair it', async () => {
+      const { envContext, settingsService } = await createSettingsContext();
+      try {
+        await settingsService.setSettings({
+          access: { rules: [{ path: 'Projects', permissions: 'ro', recursive: true }] },
+        });
+
+        await expect(
+          settingsService.setSettings({
+            access: { rules: [{ path: 'uploads', permissions: 'invalid', recursive: false }] },
+          })
+        ).rejects.toThrow(/is not one of the permissions/);
+        await expect(
+          settingsService.setSettings({
+            access: { rules: [{ path: '../bad', permissions: 'hidden' }] },
+          })
+        ).rejects.toThrow(/Traversal outside the volume root/);
+
+        const { access } = await settingsService.getSystemSettings();
+        expect(access.rules).toEqual([expect.objectContaining({ path: 'Projects' })]);
       } finally {
         await envContext.cleanup();
       }
@@ -79,17 +107,143 @@ describe('Settings Service', () => {
         ).run('user-1', 'user-1@example.com', 1, 'user-1', 'User 1', '["user"]', now, now);
 
         await settingsService.setUserSetting('user-1', 'showSidebarFavorites', false);
-        await settingsService.setUserSetting('user-1', 'showSidebarShares', 0);
-        await settingsService.setUserSetting('user-1', 'showSidebarTools', 'yes');
+        await settingsService.setUserSetting('user-1', 'showSidebarShares', true);
+        // Whether a .md file opens in the editor rather than the preview (#347)
+        // is a per-user choice, and a boolean like the others.
+        await settingsService.setUserSetting('user-1', 'markdownOpensInEditor', true);
+
+        // Anything that is not a boolean is not an answer, and is not stored:
+        // `Boolean('yes')` used to store true and `Boolean(0)` false, in place
+        // of what the person had chosen.
+        expect(
+          await settingsService.setUserSetting('user-1', 'showSidebarShares', 0)
+        ).toBeUndefined();
+        expect(
+          await settingsService.setUserSetting('user-1', 'showSidebarTools', 'yes')
+        ).toBeUndefined();
 
         const settings = await settingsService.getUserSettings('user-1');
 
         expect(settings.showSidebarFavorites).toBe(false);
-        expect(settings.showSidebarShares).toBe(false);
-        expect(settings.showSidebarTools).toBe(true);
+        expect(settings.showSidebarShares).toBe(true);
+        // Never stored, so the client's own default is what applies.
+        expect(settings.showSidebarTools).toBeUndefined();
+        expect(settings.markdownOpensInEditor).toBe(true);
+      } finally {
+        await envContext.cleanup();
+      }
+    });
+  });
+
+  describe('folder sorts', () => {
+    it('keeps every folder a user has set a preference on', async () => {
+      // The cap existed because these lived in one JSON blob, rewritten whole
+      // on every change: past a hundred folders the oldest was silently
+      // forgotten. As rows there is nothing to cap, and nothing to forget.
+      const { envContext, settingsService, dbService } = await createSettingsContext();
+      try {
+        const db = await dbService.getDb();
+        const now = new Date().toISOString();
+        db.prepare(
+          `
+          INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+        `
+        ).run('user-1', 'user-1@example.com', 1, 'user-1', 'User 1', '["user"]', now, now);
+
+        for (let index = 0; index < 150; index += 1) {
+          await settingsService.setUserFolderSort('user-1', `Projects/folder-${index}`, {
+            by: 'customColumn',
+            order: 'desc',
+          });
+        }
+
+        const settings = await settingsService.getUserSettings('user-1');
+
+        expect(Object.keys(settings.folderSorts)).toHaveLength(150);
+        expect(settings.folderSorts['Projects/folder-0']).toMatchObject({
+          by: 'customColumn',
+          order: 'desc',
+        });
       } finally {
         await envContext.cleanup();
       }
     });
+
+    it('keeps a folder sort and its view side by side', async () => {
+      // One row carries both, so setting one must not wipe the other.
+      const { envContext, settingsService, dbService } = await createSettingsContext();
+      try {
+        const db = await dbService.getDb();
+        const now = new Date().toISOString();
+        db.prepare(
+          `
+          INSERT INTO users (id, email, email_verified, username, display_name, roles, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+        `
+        ).run('user-1', 'user-1@example.com', 1, 'user-1', 'User 1', '["user"]', now, now);
+
+        await settingsService.setUserFolderSort('user-1', 'Photos', { by: 'name', order: 'asc' });
+        await settingsService.setUserFolderView('user-1', 'Photos', { mode: 'photos' });
+
+        const settings = await settingsService.getUserSettings('user-1');
+
+        expect(settings.folderSorts.Photos).toMatchObject({ by: 'name', order: 'asc' });
+        expect(settings.folderViews.Photos).toMatchObject({ mode: 'photos' });
+      } finally {
+        await envContext.cleanup();
+      }
+    });
+  });
+});
+
+/**
+ * A path written into the compose file has to reach the page that shows it.
+ *
+ * It did not: the server sent it and the browser dropped it, because the
+ * settings store copies system settings field by field and nobody added the
+ * new one. Both halves are covered now — this end, and the store's own test.
+ */
+describe('exclusions that come from the environment', () => {
+  it('reports the search index exclusions the environment set', async () => {
+    const envContext = await setupTestEnv({
+      tag: 'settings-search-index-',
+      modules: [...SETTINGS_MODULES, 'src/services/searchIndexExclusions'],
+      env: { SEARCH_INDEX: 'true', SEARCH_INDEX_EXCLUDE: 'Stacks/docker, Sauvegardes/2024' },
+    });
+    try {
+      const settingsService = envContext.requireFresh('src/services/settingsService');
+      const settings = await settingsService.getSettings();
+
+      expect(settings.searchIndex.environmentExcludedPaths).toEqual([
+        'Sauvegardes/2024',
+        'Stacks/docker',
+      ]);
+      // The environment's list is not the administrator's, and neither is
+      // shown in place of the other.
+      expect(settings.searchIndex.excludedPaths).toEqual([]);
+    } finally {
+      await envContext.cleanup();
+    }
+  });
+
+  it('keeps the two lists apart when an administrator adds one', async () => {
+    const envContext = await setupTestEnv({
+      tag: 'settings-search-index-',
+      modules: [...SETTINGS_MODULES, 'src/services/searchIndexExclusions'],
+      env: { SEARCH_INDEX: 'true', SEARCH_INDEX_EXCLUDE: 'Stacks/docker' },
+    });
+    try {
+      const settingsService = envContext.requireFresh('src/services/settingsService');
+      await settingsService.setSystemSetting('system', 'searchIndex', {
+        excludedPaths: ['Photos/RAW'],
+      });
+
+      const settings = await settingsService.getSettings();
+      expect(settings.searchIndex.excludedPaths).toEqual(['Photos/RAW']);
+      expect(settings.searchIndex.environmentExcludedPaths).toEqual(['Stacks/docker']);
+    } finally {
+      await envContext.cleanup();
+    }
   });
 });
diff --git a/backend/tests/services/trash-settings.test.js b/backend/tests/services/trash-settings.test.js
index 0e08adbe9..20210a38a 100644
--- a/backend/tests/services/trash-settings.test.js
+++ b/backend/tests/services/trash-settings.test.js
@@ -126,16 +126,14 @@ describe('changing them', () => {
     expect(response.body.trash).toMatchObject({ retentionDays: 60, maxPercent: 20 });
   });
 
-  it('is not changed by anyone but an administrator', async () => {
-    // The settings route ignores every system section a non-admin sends, trash
-    // included: the request is accepted but nothing system-wide is written.
+  it('is refused to everyone else, with nothing written', async () => {
     const app = await buildApp({ id: 'user', roles: ['user'] });
 
     const response = await request(app)
       .patch('/api/settings')
       .send({ trash: { enabled: false } });
 
-    expect(response.body.trash).toBeUndefined();
+    expect(response.status).toBe(403);
     const settingsService = envContext.requireFresh('src/services/settingsService');
     expect((await settingsService.getSystemSettings()).trash.enabled).toBe(true);
   });
diff --git a/docs/admin/user-volumes.md b/docs/admin/user-volumes.md
index 64f4d70b4..6238221b3 100644
--- a/docs/admin/user-volumes.md
+++ b/docs/admin/user-volumes.md
@@ -29,12 +29,14 @@ Each assignment creates a top-level entry in the user’s sidebar using the assi
 Make sure the directories you want to expose exist inside the container and are readable/writable by the container user as appropriate.
 
 Typical pattern:
+
 - `VOLUME_ROOT=/mnt`
 - Mount team folders as subdirectories under `/mnt` (e.g., `/mnt/Projects`, `/mnt/Media`, `/mnt/Finance`)
 
 ### 2) Create or pick a user profile
 
 Go to **Settings → Admin → Users**, then:
+
 - Select an existing user profile, or
 - Create a new local user profile (so you can pre-assign volumes before their first login)
 
diff --git a/docs/public/openapi.json b/docs/public/openapi.json
index e6aa903a2..fee406cea 100644
--- a/docs/public/openapi.json
+++ b/docs/public/openapi.json
@@ -3221,6 +3221,47 @@
         }
       }
     },
+    "/api/files/recent-destinations": {
+      "get": {
+        "operationId": "listRecentDestinations",
+        "summary": "Folders this account recently copied or moved into",
+        "description": "Only those it can still reach.",
+        "tags": ["Files"],
+        "security": [
+          {
+            "session": []
+          },
+          {
+            "apiToken": []
+          }
+        ],
+        "x-access": "account",
+        "responses": {
+          "200": {
+            "description": "Done.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "items": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  },
+                  "required": ["items"]
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/E401"
+          }
+        }
+      }
+    },
     "/api/files/delete-impact": {
       "post": {
         "operationId": "describeDeletion",
diff --git a/frontend/src/api/errorHandler.js b/frontend/src/api/errorHandler.js
index 9a333b3fb..9b10bf203 100644
--- a/frontend/src/api/errorHandler.js
+++ b/frontend/src/api/errorHandler.js
@@ -1,32 +1,61 @@
+/**
+ * Codes that say what kind of refusal it was, not which one. The catalogue
+ * gives the kind in the reader's language; the server's own sentence, which
+ * says which refusal, goes underneath rather than being lost.
+ */
+const GENERIC_CODES = new Set(['FORBIDDEN', 'NOT_FOUND', 'CONFLICT', 'RATE_LIMIT_EXCEEDED']);
+
 export function createErrorHandler(notificationsStore, i18n) {
-  return (errorInfo) => {
+  // Asked before translating: vue-i18n warns in the console for every key it
+  // is asked for and does not have, twice with a fallback locale, and most
+  // codes the server sends have no entry.
+  const knows = (key) => i18n.global.te(key) || i18n.global.te(key, 'en');
+
+  /**
+   * @param {object} errorInfo what the server refused with
+   * @param {object} [options]
+   * @param {boolean} [options.quiet] translate it, but raise no notification:
+   *   the screen that asked is about to say it itself, under the field it
+   *   belongs to, which is a better place for it than a toast in the corner.
+   */
+  return (errorInfo, { quiet = false } = {}) => {
     const { code, message, requestId, statusCode, details } = errorInfo;
 
     let heading = message || 'An error occurred';
+    let explanation = null;
 
     // Translate if we have a code
     if (code) {
       const key = `serverErrors.${code}`;
-      const translated = i18n.global.t(key);
 
-      if (translated !== key) {
+      if (knows(key)) {
         // Handle rate limit pluralization
         if (code.startsWith('RATE_LIMIT_') && details?.retryAfter) {
           const minutes = Math.ceil(details.retryAfter / 60);
           heading = i18n.global.t(key, { minutes }, minutes);
+        } else if (code === 'AUTH_ACCOUNT_LOCKED' && details?.retryAfter) {
+          // A sentence of its own rather than a placeholder in the plain one:
+          // a lock that arrives without a duration must never read "{minutes}".
+          const minutes = Math.ceil(details.retryAfter / 60);
+          heading = i18n.global.t('serverErrors.AUTH_ACCOUNT_LOCKED_RETRY', { minutes }, minutes);
         } else {
-          heading = translated;
+          heading = i18n.global.t(key);
         }
+        if (GENERIC_CODES.has(code) && message) explanation = message;
       }
     }
 
-    notificationsStore.addNotification({
-      type: 'error',
-      heading,
-      body: details ? JSON.stringify(details) : '',
-      requestId,
-      statusCode,
-    });
+    const body = [explanation, details ? JSON.stringify(details) : null].filter(Boolean).join('\n');
+
+    if (!quiet) {
+      notificationsStore.addNotification({
+        type: 'error',
+        heading,
+        body,
+        requestId,
+        statusCode,
+      });
+    }
 
     // Return translated message for error thrown by http.js
     return heading;
diff --git a/frontend/src/api/files.api.js b/frontend/src/api/files.api.js
index 686b0d7f0..f5dc1412f 100644
--- a/frontend/src/api/files.api.js
+++ b/frontend/src/api/files.api.js
@@ -60,6 +60,16 @@ async function moveItems(items, destination) {
   });
 }
 
+/**
+ * Folders this user has recently moved or copied things into, most recent
+ * first. The server only returns the ones still reachable, so the picker can
+ * offer them without checking each in turn.
+ */
+async function fetchRecentDestinations() {
+  const payload = await requestJson('/api/files/recent-destinations');
+  return Array.isArray(payload?.items) ? payload.items : [];
+}
+
 async function deleteItems(items) {
   const normalizedItems = Array.isArray(items) ? items : [];
   if (normalizedItems.length <= DELETE_BATCH_SIZE) {
@@ -386,6 +396,7 @@ export {
   refreshFolderSize,
   copyItems,
   moveItems,
+  fetchRecentDestinations,
   deleteItems,
   getDeleteImpact,
   createFile,
diff --git a/frontend/src/api/settings.api.js b/frontend/src/api/settings.api.js
index 86bf80d2f..a209def88 100644
--- a/frontend/src/api/settings.api.js
+++ b/frontend/src/api/settings.api.js
@@ -17,6 +17,17 @@ export async function patchSettings(partial) {
   });
 }
 
+/**
+ * Make an image the logo, with the rest of the branding in the same request:
+ * the server stores both, or neither. Answers the settings, as a patch does.
+ */
+export async function uploadLogo(file, branding) {
+  const form = new FormData();
+  if (branding) form.append('branding', JSON.stringify(branding));
+  form.append('logo', file);
+  return requestJson('/api/settings/upload-logo', { method: 'POST', body: form });
+}
+
 /**
  * What each path of an access rule names on the disk, so the rule editor can
  * warn about one that names nothing and offer the folder probably meant.
diff --git a/frontend/src/api/shares.api.js b/frontend/src/api/shares.api.js
index ce42cdaa0..deaeae049 100644
--- a/frontend/src/api/shares.api.js
+++ b/frontend/src/api/shares.api.js
@@ -6,11 +6,20 @@ import { requestJson, normalizePath, encodePath } from './http';
 async function createShare({
   sourcePath,
   accessMode = 'readonly',
+  allowDelete = true,
+  allowCreateFolder = true,
+  allowCreateFile = true,
+  allowUpload = true,
+  allowDownload = true,
   sharingType = 'anyone',
   password = null,
   userIds = [],
   expiresAt = null,
   label = null,
+  // Left out of the body when not given, so the server's default for the kind
+  // of share applies: shown for named people, hidden for a link for anyone.
+  versionsVisible,
+  versionsDownload,
 }) {
   const normalizedPath = normalizePath(sourcePath);
 
@@ -19,11 +28,18 @@ async function createShare({
     body: JSON.stringify({
       sourcePath: normalizedPath,
       accessMode,
+      allowDelete,
+      allowCreateFolder,
+      allowCreateFile,
+      allowUpload,
+      allowDownload,
       sharingType,
       password,
       userIds,
       expiresAt,
       label,
+      versionsVisible,
+      versionsDownload,
     }),
   });
 }
@@ -42,13 +58,6 @@ async function getSharedWithMe() {
   return requestJson('/api/shares/shared-with-me', { method: 'GET' });
 }
 
-/**
- * Get share details by ID
- */
-async function getShareById(shareId) {
-  return requestJson(`/api/shares/${shareId}`, { method: 'GET' });
-}
-
 /**
  * Update an existing share
  */
@@ -95,39 +104,33 @@ async function accessShare(shareToken) {
 /**
  * Browse share contents
  */
-async function browseShare(shareToken, innerPath = '') {
+async function browseShare(shareToken, innerPath = '', options = {}) {
   const normalizedInnerPath = normalizePath(innerPath);
   const encodedPath = encodePath(normalizedInnerPath);
   const endpoint = encodedPath
     ? `/api/share/${shareToken}/browse/${encodedPath}`
     : `/api/share/${shareToken}/browse/`;
 
-  return requestJson(endpoint, { method: 'GET' });
+  return requestJson(endpoint, { method: 'GET', signal: options.signal });
 }
 
 /**
  * Store guest session ID in sessionStorage
  */
-function setGuestSession(sessionId) {
+function setGuestSession(sessionId, shareToken = '') {
   if (sessionId) {
     sessionStorage.setItem('guestSessionId', sessionId);
+    if (shareToken) {
+      sessionStorage.setItem('guestSessionShareToken', shareToken);
+    }
   } else {
     sessionStorage.removeItem('guestSessionId');
+    sessionStorage.removeItem('guestSessionShareToken');
   }
 }
 
-/**
- * Get guest session ID from sessionStorage
- */
-function getGuestSession() {
-  return sessionStorage.getItem('guestSessionId');
-}
-
-/**
- * Clear guest session
- */
-function clearGuestSession() {
-  sessionStorage.removeItem('guestSessionId');
+function getGuestSessionShareToken() {
+  return sessionStorage.getItem('guestSessionShareToken');
 }
 
 /**
@@ -142,6 +145,7 @@ const DIRECT_SHARE_FILE_MODES = [
   { value: 'auto', labelKey: 'share.directLinkModes.auto', fallback: 'Auto' },
   { value: 'inline', labelKey: 'share.directLinkModes.inline', fallback: 'View' },
   { value: 'raw', labelKey: 'share.directLinkModes.raw', fallback: 'Raw' },
+  { value: 'editor', labelKey: 'share.directLinkModes.editor', fallback: 'Editor' },
   { value: 'download', labelKey: 'share.directLinkModes.download', fallback: 'Download' },
 ];
 
@@ -160,11 +164,23 @@ function getDirectShareFileUrl(shareToken, innerPath = '', mode = 'auto') {
   const encodedInnerPath = encodePath(normalizedInnerPath);
   const url = encodedInnerPath
     ? `${baseUrl}/api/share/${encodedToken}/file/${encodedInnerPath}`
-    : `${baseUrl}/api/share/${encodedToken}/file`;
+    : `${baseUrl}/api/share/${encodedToken}`;
   const normalizedMode = normalizeDirectShareFileMode(mode);
+  if (normalizedMode === 'editor') {
+    return getDirectShareEditorUrl(shareToken, normalizedInnerPath);
+  }
   return normalizedMode === 'auto' ? url : `${url}?mode=${encodeURIComponent(normalizedMode)}`;
 }
 
+function getDirectShareEditorUrl(shareToken, innerPath = '') {
+  const baseUrl = window.location.origin;
+  const encodedToken = encodeURIComponent(shareToken);
+  const encodedInnerPath = encodePath(normalizePath(innerPath));
+  return encodedInnerPath
+    ? `${baseUrl}/editor/share/${encodedToken}/${encodedInnerPath}`
+    : `${baseUrl}/editor/share/${encodedToken}`;
+}
+
 const writeToClipboard = async (value) => {
   if (navigator.clipboard && navigator.clipboard.writeText) {
     await navigator.clipboard.writeText(value);
@@ -203,7 +219,6 @@ export {
   createShare,
   getMyShares,
   getSharedWithMe,
-  getShareById,
   updateShare,
   deleteShare,
   getShareInfo,
@@ -211,9 +226,7 @@ export {
   accessShare,
   browseShare,
   setGuestSession,
-  getGuestSession,
-  clearGuestSession,
-  getShareUrl,
+  getGuestSessionShareToken,
   DIRECT_SHARE_FILE_MODES,
   getDirectShareFileUrl,
   copyShareUrl,
diff --git a/frontend/src/api/users.api.js b/frontend/src/api/users.api.js
index f98055e80..e83fede4d 100644
--- a/frontend/src/api/users.api.js
+++ b/frontend/src/api/users.api.js
@@ -44,6 +44,13 @@ export async function adminSetUserPassword(userId, newPassword) {
   });
 }
 
+/** Release an account locked by failed sign-ins, before its lock runs out. */
+export async function unlockUser(userId) {
+  return requestJson(`/api/users/${encodeURIComponent(userId)}/lock`, {
+    method: 'DELETE',
+  });
+}
+
 export async function deleteUser(userId) {
   return requestJson(`/api/users/${encodeURIComponent(userId)}`, {
     method: 'DELETE',
diff --git a/frontend/src/components/ConfigWarningNotice.vue b/frontend/src/components/ConfigWarningNotice.vue
index 9e02e2e2e..8ff67f180 100644
--- a/frontend/src/components/ConfigWarningNotice.vue
+++ b/frontend/src/components/ConfigWarningNotice.vue
@@ -47,7 +47,12 @@ onKeyStroke('Escape', dismiss);
 <template>
   <Teleport to="body">
     <TransitionRoot appear :show="true" as="template">
-      <div class="relative z-[90]" role="dialog" aria-modal="true" aria-labelledby="config-warning-title">
+      <div
+        class="relative z-[90]"
+        role="dialog"
+        aria-modal="true"
+        aria-labelledby="config-warning-title"
+      >
         <TransitionChild
           as="template"
           enter="ease-out duration-200"
@@ -57,7 +62,10 @@ onKeyStroke('Escape', dismiss);
           leave-from="opacity-100"
           leave-to="opacity-0"
         >
-          <div class="fixed inset-0 bg-black/30 backdrop-blur-xs dark:bg-black/50" @click="dismiss" />
+          <div
+            class="fixed inset-0 bg-black/30 backdrop-blur-xs dark:bg-black/50"
+            @click="dismiss"
+          />
         </TransitionChild>
 
         <div class="fixed inset-0 overflow-y-auto px-4 py-6 sm:px-6 sm:py-10">
@@ -94,16 +102,19 @@ onKeyStroke('Escape', dismiss);
                       >
                         `PUBLIC_URL` does not match this domain
                       </h2>
-                      <p class="mt-2 max-w-xl text-sm leading-6 text-neutral-600 dark:text-neutral-300">
-                        You can keep using the app, but sign-in, cookies, sharing links, and callback-based
-                        flows may be unreliable until the public URL matches the domain you opened.
+                      <p
+                        class="mt-2 max-w-xl text-sm leading-6 text-neutral-600 dark:text-neutral-300"
+                      >
+                        You can keep using the app, but sign-in, cookies, sharing links, and
+                        callback-based flows may be unreliable until the public URL matches the
+                        domain you opened.
                       </p>
                     </div>
 
                     <button
                       type="button"
                       class="inline-flex rounded-lg p-1.5 text-neutral-400 transition hover:bg-neutral-100 hover:text-neutral-700 dark:hover:bg-white/10 dark:hover:text-neutral-200"
-                      aria-label="Dismiss warning"
+                      :aria-label="$t('common.dismissWarning')"
                       @click="dismiss"
                     >
                       <XMarkIcon class="h-5 w-5" />
@@ -116,10 +127,14 @@ onKeyStroke('Escape', dismiss);
                     <div
                       class="rounded-xl border border-neutral-200 bg-neutral-50/80 p-4 dark:border-white/10 dark:bg-white/[0.03]"
                     >
-                      <div class="text-xs font-semibold uppercase tracking-[0.14em] text-neutral-500 dark:text-neutral-400">
+                      <div
+                        class="text-xs font-semibold uppercase tracking-[0.14em] text-neutral-500 dark:text-neutral-400"
+                      >
                         Opened from
                       </div>
-                      <div class="mt-2 font-mono text-[13px] break-all text-neutral-900 dark:text-neutral-100">
+                      <div
+                        class="mt-2 font-mono text-[13px] break-all text-neutral-900 dark:text-neutral-100"
+                      >
                         {{ props.requestOrigin }}
                       </div>
                     </div>
@@ -127,10 +142,14 @@ onKeyStroke('Escape', dismiss);
                     <div
                       class="rounded-xl border border-amber-200 bg-amber-50/80 p-4 dark:border-amber-400/20 dark:bg-amber-500/10"
                     >
-                      <div class="text-xs font-semibold uppercase tracking-[0.14em] text-amber-700 dark:text-amber-300">
+                      <div
+                        class="text-xs font-semibold uppercase tracking-[0.14em] text-amber-700 dark:text-amber-300"
+                      >
                         Server expects
                       </div>
-                      <div class="mt-2 font-mono text-[13px] break-all text-amber-950 dark:text-amber-100">
+                      <div
+                        class="mt-2 font-mono text-[13px] break-all text-amber-950 dark:text-amber-100"
+                      >
                         {{ props.expectedOrigin }}
                       </div>
                     </div>
@@ -142,7 +161,9 @@ onKeyStroke('Escape', dismiss);
                     <div class="font-medium text-neutral-900 dark:text-neutral-100">Admin fix</div>
                     <p class="mt-1 leading-6">
                       If this domain is intended, update
-                      <span class="font-mono text-[13px]">PUBLIC_URL={{ props.requestOrigin }}</span>
+                      <span class="font-mono text-[13px]"
+                        >PUBLIC_URL={{ props.requestOrigin }}</span
+                      >
                       on the server and restart the app.
                     </p>
                   </div>
diff --git a/frontend/src/components/DestinationPickerDialog.vue b/frontend/src/components/DestinationPickerDialog.vue
new file mode 100644
index 000000000..1d610288a
--- /dev/null
+++ b/frontend/src/components/DestinationPickerDialog.vue
@@ -0,0 +1,317 @@
+<script setup>
+import { computed, ref, watch } from 'vue';
+import { useI18n } from 'vue-i18n';
+import { FolderIcon, ClockIcon, DocumentIcon, StarIcon } from '@heroicons/vue/24/outline';
+import ModalDialog from '@/components/ModalDialog.vue';
+import { useStorageBrowser } from '@/composables/useStorageBrowser';
+import { useFavoritesStore } from '@/stores/favorites';
+import { useDestinationPicker } from '@/composables/useDestinationPicker';
+import { fetchRecentDestinations, normalizePath } from '@/api';
+import logger from '@/utils/logger';
+
+/**
+ * Choose where to move or copy something.
+ *
+ * Dragging onto a folder is the fast way to file something, but it is turned
+ * off on touch devices — which leaves anyone on a tablet with no way to move a
+ * file at all. This is that way, and it is built for the case that forced it:
+ * large targets, no dragging, and the folders you actually use offered before
+ * any browsing is needed.
+ *
+ * The three sections are ordered by how likely they are to hold the answer:
+ * where you last put things, what you bookmarked, then the storage itself.
+ */
+
+const { t } = useI18n();
+const favoritesStore = useFavoritesStore();
+const picker = useDestinationPicker();
+const { currentPath, items: entries, isLoading, error, crumbs, navigate } = useStorageBrowser();
+
+// Closing without choosing has to settle the caller's promise, whichever way it
+// happens — the Cancel button, the dialog's own dismiss, or the Escape key.
+const isOpen = computed({
+  get: () => picker.isOpen.value,
+  set: (value) => {
+    if (!value) {
+      picker.isOpen.value = false;
+      picker.dismiss();
+    }
+  },
+});
+
+const props = computed(() => ({
+  mode: picker.mode.value,
+  items: picker.items.value,
+  initialPath: picker.initialPath.value,
+}));
+
+const recents = ref([]);
+
+const folders = computed(() => entries.value.filter((entry) => entry.kind === 'directory'));
+
+/**
+ * In file mode the answer is a file — the one an earlier version is put over —
+ * so files are listed beside the folders, and choosing one selects it.
+ */
+const isFileMode = computed(() => props.value.mode === 'file');
+const selectedFile = ref('');
+const entryPath = (entry) =>
+  normalizePath(entry?.path ? `${entry.path}/${entry.name}` : entry?.name || '');
+const listed = computed(() =>
+  isFileMode.value ? entries.value.filter((entry) => entry.kind !== 'volume') : folders.value
+);
+const sourceFile = computed(() => (props.value.items[0] ? entryPath(props.value.items[0]) : ''));
+watch(currentPath, () => {
+  selectedFile.value = '';
+});
+
+/** Paths of the folders being transferred, for the checks below. */
+const movingPaths = computed(() =>
+  props.value.items
+    .filter((item) => item?.kind === 'directory')
+    .map((item) => normalizePath(item.path ? `${item.path}/${item.name}` : item.name))
+    .filter(Boolean)
+);
+
+/** Where everything currently sits — moving there again would do nothing. */
+const sourcePath = computed(() => {
+  const paths = new Set(props.value.items.map((item) => normalizePath(item?.path || '')));
+  return paths.size === 1 ? [...paths][0] : null;
+});
+
+/**
+ * Why a folder cannot be the destination, or '' when it can.
+ *
+ * The server refuses all of these too, but only once the transfer has been
+ * asked for — by then the person has picked, confirmed, and watched it fail.
+ */
+const rejection = (path) => {
+  const target = normalizePath(path);
+  if (!target) return t('destinationPicker.rootRejected');
+
+  for (const source of movingPaths.value) {
+    if (target === source) return t('destinationPicker.itselfRejected');
+    if (target.startsWith(`${source}/`)) return t('destinationPicker.descendantRejected');
+  }
+
+  if (props.value.mode === 'move' && sourcePath.value !== null && target === sourcePath.value) {
+    return t('destinationPicker.alreadyThereRejected');
+  }
+
+  return '';
+};
+
+const fileRejection = () => {
+  if (!selectedFile.value) return t('destinationPicker.fileRequired');
+  if (selectedFile.value === sourceFile.value) return t('destinationPicker.sameFileRejected');
+  return '';
+};
+
+const currentRejection = computed(() =>
+  isFileMode.value ? fileRejection() : rejection(currentPath.value)
+);
+const canConfirm = computed(() => !isLoading.value && currentRejection.value === '');
+
+const LABELS = {
+  copy: { title: 'destinationPicker.copyTitle', confirm: 'destinationPicker.copyHere' },
+  move: { title: 'destinationPicker.moveTitle', confirm: 'destinationPicker.moveHere' },
+  // Out of the trash: nothing is being taken from a folder, so nothing is
+  // "already there" either.
+  restore: { title: 'destinationPicker.restoreTitle', confirm: 'destinationPicker.restoreHere' },
+  // An earlier version of a file taken out as a copy, or put over another file.
+  'version-copy': {
+    title: 'destinationPicker.versionCopyTitle',
+    confirm: 'destinationPicker.versionCopyHere',
+  },
+  file: { title: 'destinationPicker.replaceTitle', confirm: 'destinationPicker.replaceHere' },
+  // Out of an archive and onto the volume: nothing is leaving a folder here
+  // either, so the same reading as a restore.
+  extract: { title: 'destinationPicker.extractTitle', confirm: 'destinationPicker.extractHere' },
+};
+const labels = computed(() => LABELS[props.value.mode] || LABELS.move);
+const title = computed(() => t(labels.value.title));
+const confirmLabel = computed(() => t(labels.value.confirm));
+
+const shortcuts = computed(() => {
+  const seen = new Set();
+  const rows = [];
+
+  const add = (path, kind) => {
+    const normalized = normalizePath(path);
+    if (!normalized || seen.has(normalized) || rejection(normalized)) return;
+    seen.add(normalized);
+    rows.push({ path: normalized, kind, name: normalized.split('/').pop() || normalized });
+  };
+
+  recents.value.forEach((path) => add(path, 'recent'));
+  favoritesStore.favorites.forEach((favorite) => add(favorite?.path, 'favorite'));
+  return rows;
+});
+
+const confirm = () => {
+  if (!canConfirm.value) return;
+  picker.choose(isFileMode.value ? selectedFile.value : normalizePath(currentPath.value));
+};
+
+const loadRecents = async () => {
+  try {
+    recents.value = await fetchRecentDestinations();
+  } catch (recentsError) {
+    // Browsing still works without them; there is nothing to tell the user.
+    logger.debug('Could not load recent destinations', recentsError);
+    recents.value = [];
+  }
+};
+
+watch(
+  () => picker.isOpen.value,
+  (opened) => {
+    if (!opened) return;
+    void navigate(props.value.initialPath || '');
+    void loadRecents();
+    void favoritesStore.ensureLoaded?.();
+  },
+  { immediate: true }
+);
+</script>
+
+<template>
+  <!-- Above the Versions panel, which asks for these two over an open editor too. -->
+  <!--
+    Raised above what asked for it whenever that is itself a window: the
+    versions panel, the editor, and the archive panel all sit above the page,
+    and a dialog at the page's own level would open behind them.
+  -->
+  <ModalDialog
+    v-model="isOpen"
+    :elevated="['version-copy', 'file', 'extract'].includes(props.mode)"
+  >
+    <template #title>{{ title }}</template>
+
+    <div class="flex max-h-full min-h-0 flex-col gap-3">
+      <!--
+        Favourites and recent destinations, capped. Ten of them pushed the
+        folder list and the buttons off the bottom of the screen, on a dialog
+        that had nowhere to scroll: what is above the list has to give way to
+        it, not the other way round.
+      -->
+      <div v-if="shortcuts.length" class="flex max-h-44 shrink-0 flex-col gap-1 overflow-y-auto">
+        <ul class="flex flex-col gap-1">
+          <li v-for="shortcut in shortcuts" :key="`${shortcut.kind}:${shortcut.path}`">
+            <button
+              type="button"
+              class="flex w-full items-center gap-2 rounded-lg px-3 py-2.5 text-left hover:bg-neutral-100 dark:hover:bg-zinc-800"
+              @click="navigate(shortcut.path)"
+            >
+              <ClockIcon
+                v-if="shortcut.kind === 'recent'"
+                class="h-4 w-4 shrink-0 text-neutral-400"
+                aria-hidden="true"
+              />
+              <StarIcon v-else class="h-4 w-4 shrink-0 text-amber-500" aria-hidden="true" />
+              <span class="truncate">{{ shortcut.name }}</span>
+              <span class="truncate text-xs text-neutral-500 dark:text-neutral-400">
+                {{ shortcut.path }}
+              </span>
+            </button>
+          </li>
+        </ul>
+      </div>
+
+      <nav
+        class="flex flex-wrap items-center gap-1 text-xs text-neutral-500 dark:text-neutral-400"
+        :aria-label="t('storagePicker.breadcrumb')"
+      >
+        <button
+          type="button"
+          class="rounded px-1 py-0.5 hover:bg-neutral-100 hover:text-neutral-800 dark:hover:bg-zinc-800 dark:hover:text-neutral-200"
+          @click="navigate('')"
+        >
+          {{ t('storagePicker.root') }}
+        </button>
+        <template v-for="crumb in crumbs" :key="crumb.path">
+          <span aria-hidden="true">/</span>
+          <button
+            type="button"
+            class="rounded px-1 py-0.5 hover:bg-neutral-100 hover:text-neutral-800 dark:hover:bg-zinc-800 dark:hover:text-neutral-200"
+            @click="navigate(crumb.path)"
+          >
+            {{ crumb.name }}
+          </button>
+        </template>
+      </nav>
+
+      <!--
+        The folder list takes what is left rather than a fixed height: on a
+        short screen it shrinks instead of pushing the buttons out of reach,
+        and on a tall one it fills.
+      -->
+      <div
+        class="min-h-40 flex-1 overflow-y-auto rounded-lg border border-neutral-200 dark:border-zinc-700"
+        role="listbox"
+      >
+        <p v-if="isLoading" class="p-4 text-neutral-500 dark:text-neutral-400">
+          {{ t('common.loadingEllipsis') }}
+        </p>
+        <p v-else-if="error" class="p-4 text-red-600 dark:text-red-400">{{ error }}</p>
+        <p v-else-if="listed.length === 0" class="p-4 text-neutral-500 dark:text-neutral-400">
+          {{ isFileMode ? t('destinationPicker.nothingHere') : t('destinationPicker.noFolders') }}
+        </p>
+        <ul v-else class="divide-y divide-neutral-100 dark:divide-zinc-800">
+          <li v-for="entry in listed" :key="`${entry.path}/${entry.name}`">
+            <button
+              v-if="entry.kind === 'directory'"
+              type="button"
+              role="option"
+              :aria-selected="false"
+              class="flex w-full items-center gap-2 px-3 py-3 text-left hover:bg-neutral-100 dark:hover:bg-zinc-800"
+              @click="navigate(entry.path ? `${entry.path}/${entry.name}` : entry.name)"
+            >
+              <FolderIcon class="h-4 w-4 shrink-0 text-blue-500" aria-hidden="true" />
+              <span class="truncate">{{ entry.name }}</span>
+            </button>
+            <button
+              v-else
+              type="button"
+              role="option"
+              :aria-selected="selectedFile === entryPath(entry)"
+              data-test="destination-picker-file"
+              class="flex w-full items-center gap-2 px-3 py-3 text-left hover:bg-neutral-100 dark:hover:bg-zinc-800"
+              :class="selectedFile === entryPath(entry) ? 'bg-blue-50 dark:bg-blue-500/15' : ''"
+              @click="selectedFile = entryPath(entry)"
+            >
+              <DocumentIcon class="h-4 w-4 shrink-0 text-neutral-400" aria-hidden="true" />
+              <span class="truncate">{{ entry.name }}</span>
+            </button>
+          </li>
+        </ul>
+      </div>
+    </div>
+
+    <template #footer>
+      <div class="flex items-center justify-between gap-3">
+        <p v-if="currentRejection" class="min-w-0 text-xs text-amber-600 dark:text-amber-400">
+          {{ currentRejection }}
+        </p>
+        <span v-else></span>
+        <div class="flex shrink-0 justify-end gap-2">
+          <button
+            type="button"
+            class="rounded-md border border-neutral-300 px-3 py-1.5 text-sm hover:bg-neutral-100 dark:border-neutral-600 dark:hover:bg-zinc-800"
+            @click="isOpen = false"
+          >
+            {{ t('common.cancel') }}
+          </button>
+          <button
+            type="button"
+            class="rounded-md bg-blue-600 px-3 py-1.5 text-sm font-medium text-white hover:bg-blue-500 disabled:cursor-not-allowed disabled:opacity-50"
+            :disabled="!canConfirm"
+            @click="confirm"
+          >
+            {{ confirmLabel }}
+          </button>
+        </div>
+      </div>
+    </template>
+  </ModalDialog>
+</template>
diff --git a/frontend/src/components/FavMenu.vue b/frontend/src/components/FavMenu.vue
index 841bb3555..3794b8e4c 100644
--- a/frontend/src/components/FavMenu.vue
+++ b/frontend/src/components/FavMenu.vue
@@ -2,7 +2,7 @@
 import { computed, onBeforeUnmount, onMounted, ref } from 'vue';
 import { useRoute } from 'vue-router';
 import * as OutlineIcons from '@heroicons/vue/24/outline';
-import * as SolidIcons from '@heroicons/vue/24/solid';
+import { ExclamationTriangleIcon } from '@heroicons/vue/24/outline';
 import { storeToRefs } from 'pinia';
 import draggable from 'vuedraggable';
 import { useFavoritesStore } from '@/stores/favorites';
@@ -10,6 +10,8 @@ import { useNavigation } from '@/composables/navigation';
 import { normalizePath } from '@/api';
 import { useI18n } from 'vue-i18n';
 import { useFavoriteEditor } from '@/composables/useFavoriteEditor';
+import { resolveFavoriteIcon } from '@/utils/favoriteIcons';
+import { useFileDragDrop } from '@/composables/useFileDragDrop';
 
 const {
   ChevronDownIcon,
@@ -27,35 +29,10 @@ const { favorites } = storeToRefs(favoritesStore);
 const route = useRoute();
 const { openBreadcrumb } = useNavigation();
 const { openEditorForFavorite } = useFavoriteEditor();
+const { handleDragOver, handleDragLeave, handleDrop, isDragTarget, isCopyDragTarget } =
+  useFileDragDrop();
 
-const ICON_VARIANTS = {
-  outline: OutlineIcons,
-  solid: SolidIcons,
-};
-
-const resolveIconComponent = (iconName) => {
-  if (typeof iconName !== 'string') {
-    return StarIconOutline;
-  }
-
-  const trimmed = iconName.trim();
-  if (!trimmed) {
-    return StarIconOutline;
-  }
-
-  if (trimmed.includes(':')) {
-    const [variantRaw, iconRaw] = trimmed.split(':', 2);
-    const variantKey = variantRaw.toLowerCase();
-    const iconKey = iconRaw.trim();
-    const registry = ICON_VARIANTS[variantKey];
-    if (registry && registry[iconKey]) {
-      return registry[iconKey];
-    }
-  }
-
-  return OutlineIcons[trimmed] || SolidIcons[trimmed] || StarIconOutline;
-};
-
+const resolveIconComponent = resolveFavoriteIcon;
 const getFavoriteLabel = (favorite = {}) => {
   const path = favorite.path || '';
   const autoLabel = path.split('/').pop() || path;
@@ -87,6 +64,19 @@ const handleOpenFavorite = (favorite) => {
   openBreadcrumb(favorite.path);
 };
 
+const favoriteDropTarget = (favorite = {}) => {
+  const destinationPath = normalizePath(favorite.path || '');
+  const segments = destinationPath.split('/').filter(Boolean);
+  return {
+    name: segments.at(-1) || '',
+    path: segments.slice(0, -1).join('/'),
+    destinationPath,
+  };
+};
+
+const isFavoriteDragTarget = (favorite) => isDragTarget(favoriteDropTarget(favorite));
+const isFavoriteCopyTarget = (favorite) => isCopyDragTarget(favoriteDropTarget(favorite));
+
 const toggleEditMode = () => {
   if (!favorites.value.length) return;
   isEditMode.value = !isEditMode.value;
@@ -156,6 +146,7 @@ onBeforeUnmount(() => {
           {{ t('common.edit') }}
         </button>
         <button
+          :aria-label="t('common.toggleSection')"
           @click="open = !open"
           class="hidden group-hover:block active:text-black dark:active:text-white text-neutral-500"
           type="button"
@@ -184,7 +175,7 @@ onBeforeUnmount(() => {
               handle=".favorite-drag-handle"
               :disabled="!isEditMode || favorites.length < 2"
               :animation="250"
-              :easing="'cubic-bezier(0.25, 0.46, 0.45, 0.94)'"
+              easing="cubic-bezier(0.25, 0.46, 0.45, 0.94)"
               ghost-class="favorite-ghost"
               chosen-class="favorite-chosen"
               drag-class="favorite-drag"
@@ -192,7 +183,7 @@ onBeforeUnmount(() => {
               @end="handleReorderEnd"
             >
               <template #item="{ element: favorite }">
-                <div class="group/item mb-3 flex items-center gap-2 favorite-drag-handle">
+                <div class="group/item relative mb-3 flex items-center gap-2 favorite-drag-handle">
                   <Bars3Icon
                     v-if="isEditMode"
                     class="h-4 w-4 shrink-0 cursor-grab text-neutral-400 group-hover/item:text-white dark:text-neutral-500 dark:group-hover/item:text-neutral-100 transition-colors duration-150"
@@ -200,12 +191,24 @@ onBeforeUnmount(() => {
                   <button
                     type="button"
                     @click="handleOpenFavorite(favorite)"
+                    @dragover="handleDragOver($event, favoriteDropTarget(favorite))"
+                    @dragleave="handleDragLeave($event, favoriteDropTarget(favorite))"
+                    @drop="handleDrop($event, favoriteDropTarget(favorite))"
                     class="truncate"
+                    :title="
+                      favorite.available === false ? t('favorites.volumeUnavailable') : undefined
+                    "
                     :class="[
-                      'cursor-pointer flex w-full items-center gap-3 rounded-lg text-sm',
+                      'cursor-pointer flex w-full items-center gap-3 rounded-lg text-sm transition-colors',
+                      favorite.available === false ? 'opacity-50' : '',
                       isActiveFav(favorite.path)
                         ? 'text-neutral-950 dark:text-white'
                         : 'text-neutral-950 dark:text-neutral-300/90',
+                      isFavoriteCopyTarget(favorite)
+                        ? 'bg-emerald-50 dark:bg-emerald-950/40 ring-2 ring-inset ring-emerald-500 dark:ring-emerald-400'
+                        : isFavoriteDragTarget(favorite)
+                          ? 'bg-blue-50 dark:bg-blue-950/40 ring-2 ring-inset ring-blue-500 dark:ring-blue-400'
+                          : '',
                     ]"
                   >
                     <component
@@ -214,9 +217,15 @@ onBeforeUnmount(() => {
                       :style="{ color: favorite.color || 'currentColor' }"
                     />
                     <span class="truncate">{{ getFavoriteLabel(favorite) }}</span>
+                    <ExclamationTriangleIcon
+                      v-if="favorite.available === false"
+                      class="h-4 w-4 shrink-0 text-amber-500"
+                      :aria-label="t('favorites.volumeUnavailable')"
+                    />
                   </button>
                   <template v-if="isEditMode">
                     <button
+                      :aria-label="t('common.edit')"
                       type="button"
                       class="shrink-0 rounded-md text-neutral-500 hover:bg-neutral-100 dark:text-neutral-400 dark:hover:bg-neutral-700 transition-colors duration-150"
                       @click.stop="handleEditFavorite(favorite)"
@@ -224,6 +233,7 @@ onBeforeUnmount(() => {
                       <PencilSquareIcon class="h-4 w-4" />
                     </button>
                     <button
+                      :aria-label="t('common.remove')"
                       type="button"
                       class="shrink-0 rounded-md text-red-600 hover:bg-red-50 dark:text-red-400 dark:hover:bg-red-900/40 transition-colors duration-150"
                       @click.stop="handleRemoveFavorite(favorite)"
diff --git a/frontend/src/components/FileObject.vue b/frontend/src/components/FileObject.vue
index 346eb46da..eeb44aa9e 100644
--- a/frontend/src/components/FileObject.vue
+++ b/frontend/src/components/FileObject.vue
@@ -16,27 +16,52 @@ import { isPreviewableImage, isPreviewableVideo } from '@/config/media';
 import { useSettingsStore } from '@/stores/settings';
 import { DragSelectOption } from '@coleqiu/vue-drag-select';
 import MiddleEllipsis from '@/components/MiddleEllipsis.vue';
+import ReadOnlyMark from '@/components/ReadOnlyMark.vue';
 import { ellipses } from '@/utils/ellipses';
 import { useInputMode } from '@/composables/useInputMode';
 import { CheckIcon } from '@heroicons/vue/20/solid';
 import { ClockIcon, PencilSquareIcon } from '@heroicons/vue/24/outline';
-import { useI18n } from 'vue-i18n';
 import { useVersionsPanelStore } from '@/stores/versionsPanel';
 import { useFileDragDrop } from '@/composables/useFileDragDrop';
+import { useI18n } from 'vue-i18n';
+import { useNotificationsStore } from '@/stores/notifications';
 
-const props = defineProps(['item', 'view']);
+const props = defineProps({
+  item: { type: Object, required: true },
+  view: { type: String, required: true },
+});
 const settings = useSettingsStore();
 
-const { openItem } = useNavigation();
+const { openItem: navigateTo } = useNavigation();
+const { t } = useI18n();
+const notificationsStore = useNotificationsStore();
+
+// A link out of the volume is listed so it can be seen, but the server refuses
+// to follow it, so opening it says why instead of failing.
+const isOutsideLink = computed(() => props.item?.link === 'outside');
+const openItem = (item) => {
+  if (item?.link === 'outside') {
+    notificationsStore.addNotification({
+      type: 'info',
+      heading: t('links.outside'),
+      body: t('links.outsideExplained', { name: item.name }),
+    });
+    return;
+  }
+  navigateTo(item);
+};
 const { handleSelection, isSelected, toggleSelection } = useSelection();
 const fileStore = useFileStore();
+const { renameState, selectionMode } = storeToRefs(fileStore);
+const { canDragDrop, handleDragStart, handleDragEnd } = useFileDragDrop();
+const contextMenu = useExplorerContextMenu();
+const { isTouchDevice } = useInputMode();
 const folderSizeStore = useFolderSizeStore();
 const featuresStore = useFeaturesStore();
 
 const isDirectory = computed(() => props.item?.kind === 'directory');
 // item.path is the parent's logical path and item.name the entry name, so the
-// folder's own logical path — which is how the index knows it — is the two
-// joined.
+// folder's own logical path (used to look up its indexed size) combines them.
 const folderFullPath = computed(() => {
   const parent = props.item?.path || '';
   const name = props.item?.name || '';
@@ -46,10 +71,6 @@ const showFolderSize = computed(() => isDirectory.value && featuresStore.folderS
 const folderSizeEntry = computed(() =>
   showFolderSize.value ? folderSizeStore.sizeFor(folderFullPath.value) : null
 );
-const { renameState, selectionMode } = storeToRefs(fileStore);
-const { canDragDrop, handleDragStart } = useFileDragDrop();
-const contextMenu = useExplorerContextMenu();
-const { isTouchDevice } = useInputMode();
 
 const renameInputRef = ref(null);
 const rootRef = ref(null);
@@ -80,22 +101,14 @@ const isCut = computed(() =>
 );
 
 const selected = computed(() => isSelected(props.item));
-
-/**
- * Somebody has this document open in an editor.
- *
- * Advisory, never a lock: the file can still be copied, moved, renamed or
- * deleted. The mark is there so nobody does any of those by accident while an
- * editor is about to write a newer version of it.
- */
 const onlyofficeActivity = computed(() => props.item?.onlyofficeActivity || null);
 const onlyofficeActivityLabel = computed(() => {
   const activity = onlyofficeActivity.value;
   if (!activity?.active) return '';
   const users = Array.isArray(activity.users) ? activity.users.filter(Boolean) : [];
   return users.length > 0
-    ? t('onlyoffice.editingBy', { names: users.join(', ') })
-    : t('onlyoffice.editingNow');
+    ? `Édition en cours dans OnlyOffice : ${users.join(', ')}`
+    : 'Édition en cours dans OnlyOffice';
 });
 
 /**
@@ -106,21 +119,18 @@ const onlyofficeActivityLabel = computed(() => {
  * that there is one unless its owner said so. Nothing is decided here: the
  * mark is there when the count is.
  */
-const { t } = useI18n();
 const versionsPanel = useVersionsPanelStore();
 const versionCount = computed(() => {
   const count = Number(props.item?.versions?.count);
   return Number.isFinite(count) && count > 0 ? count : 0;
 });
-// `(key, named, plural)`, as the Versions panel calls it: the third argument of
-// the other overload is a bag of options, not a bag of values.
+// `(key, named, plural)`, as the Versions panel calls it: the third argument
+// of the other overload is a bag of options, not a bag of values.
 const versionsLabel = computed(() =>
   versionCount.value ? t('versions.mark', { count: versionCount.value }, versionCount.value) : ''
 );
-/**
- * Straight to the history, rather than the row's own click: it is the one thing
- * the mark could mean, and the right-click route stays as it was.
- */
+/** Straight to the history, rather than the row's own click: it is the one
+ *  thing the mark could mean, and the right-click route stays as it was. */
 const openVersions = () => {
   if (!versionCount.value) return;
   versionsPanel.open(props.item);
@@ -286,6 +296,7 @@ if (isTouchDevice.value) {
       @dblclick="handleDblClick"
       @contextmenu.prevent.stop="handleContextMenu"
       @dragstart="(e) => handleDragStart(e, item)"
+      @dragend="handleDragEnd"
       :draggable="canDragDrop() && !isRenaming"
       class="photo-cell relative w-full rounded-md overflow-hidden cursor-pointer select-none bg-neutral-100 dark:bg-zinc-800/60 hover:brightness-105"
       :class="{
@@ -312,8 +323,6 @@ if (isTouchDevice.value) {
       <span
         v-if="onlyofficeActivity?.active"
         :title="onlyofficeActivityLabel"
-        :aria-label="onlyofficeActivityLabel"
-        data-test="onlyoffice-mark"
         class="absolute left-2 top-2 z-10 inline-flex h-5 w-5 items-center justify-center rounded-full bg-amber-100/95 text-amber-700 shadow-sm dark:bg-amber-400/20 dark:text-amber-300"
       >
         <PencilSquareIcon class="h-3.5 w-3.5" />
@@ -342,6 +351,7 @@ if (isTouchDevice.value) {
       @dblclick="handleDblClick"
       @contextmenu.prevent.stop="handleContextMenu"
       @dragstart="(e) => handleDragStart(e, item)"
+      @dragend="handleDragEnd"
       :draggable="canDragDrop() && !isRenaming"
       class="relative flex flex-col items-center gap-2 p-2 rounded-xl cursor-pointer select-none"
       :class="[
@@ -365,6 +375,13 @@ if (isTouchDevice.value) {
       >
         <CheckIcon class="h-4 w-4" />
       </button>
+      <span
+        v-if="onlyofficeActivity?.active"
+        :title="onlyofficeActivityLabel"
+        class="absolute left-2 top-2 z-10 inline-flex h-5 w-5 items-center justify-center rounded-full bg-amber-100/95 text-amber-700 shadow-sm dark:bg-amber-400/20 dark:text-amber-300"
+      >
+        <PencilSquareIcon class="h-3.5 w-3.5" />
+      </span>
       <FileIcon :item="item" class="h-16 shrink-0" />
       <div
         class="text-sm text-center break-all line-clamp-2 rounded-md"
@@ -387,15 +404,11 @@ if (isTouchDevice.value) {
         </template>
         <template v-else>
           {{ ellipses(item.name, (maxl = 15))
-          }}<span
-            v-if="onlyofficeActivity?.active"
-            :title="onlyofficeActivityLabel"
-            :aria-label="onlyofficeActivityLabel"
-            data-test="onlyoffice-mark"
-            class="ml-1 inline-flex shrink-0 items-center align-middle text-amber-600 dark:text-amber-400"
-          >
-            <PencilSquareIcon class="h-3.5 w-3.5" /> </span
-          ><button
+          }}<ReadOnlyMark
+            v-if="item.readOnly"
+            :reason="item.readOnly"
+            class="ml-1 align-middle"
+          /><button
             v-if="versionCount"
             type="button"
             :title="versionsLabel"
@@ -420,6 +433,7 @@ if (isTouchDevice.value) {
       @dblclick="handleDblClick"
       @contextmenu.prevent.stop="handleContextMenu"
       @dragstart="(e) => handleDragStart(e, item)"
+      @dragend="handleDragEnd"
       :draggable="canDragDrop() && !isRenaming"
       class="relative flex items-center gap-2 p-4 rounded-md cursor-pointer select-none"
       :class="[
@@ -450,7 +464,7 @@ if (isTouchDevice.value) {
           'bg-blue-500 text-white dark:bg-blue-600': selected && !isRenaming,
         }"
       >
-        <div class="break-all line-clamp-2">
+        <div class="flex items-center gap-1.5 break-all line-clamp-2">
           <template v-if="isRenaming">
             <input
               ref="renameInputRef"
@@ -465,22 +479,22 @@ if (isTouchDevice.value) {
             />
           </template>
           <template v-else>
-            {{ ellipses(item.name, (maxl = 50))
-            }}<span
+            {{ ellipses(item.name, (maxl = 50)) }}
+            <ReadOnlyMark v-if="item.readOnly" :reason="item.readOnly" />
+            <span
               v-if="onlyofficeActivity?.active"
               :title="onlyofficeActivityLabel"
-              :aria-label="onlyofficeActivityLabel"
-              data-test="onlyoffice-mark"
-              class="ml-1 inline-flex shrink-0 items-center align-middle text-amber-600 dark:text-amber-400"
+              class="inline-flex h-4 w-4 shrink-0 items-center justify-center text-amber-600 dark:text-amber-400"
             >
-              <PencilSquareIcon class="h-3.5 w-3.5" /> </span
-            ><button
+              <PencilSquareIcon class="h-3.5 w-3.5" />
+            </span>
+            <button
               v-if="versionCount"
               type="button"
               :title="versionsLabel"
               :aria-label="versionsLabel"
               data-test="version-mark"
-              class="ml-1 inline-flex shrink-0 items-center gap-0.5 rounded-full px-1 align-middle text-[0.65rem] font-medium leading-4 text-current opacity-55 transition-opacity hover:opacity-100 focus-visible:opacity-100 focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-blue-500"
+              class="inline-flex shrink-0 items-center gap-0.5 rounded-full px-1 align-middle text-[0.65rem] font-medium leading-4 text-current opacity-55 transition-opacity hover:opacity-100 focus-visible:opacity-100 focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-blue-500"
               @click.stop.prevent="openVersions"
               @dblclick.stop.prevent
             >
@@ -491,7 +505,9 @@ if (isTouchDevice.value) {
         </div>
         <p class="text-xs text-stone-400">
           <FolderSizeLabel v-if="showFolderSize" :entry="folderSizeEntry" />
-          <template v-else>{{ formatBytes(item.size) }}</template>
+          <template v-else>{{
+            isOutsideLink ? t('links.outside') : formatBytes(item.size)
+          }}</template>
         </p>
       </div>
     </div>
@@ -503,6 +519,7 @@ if (isTouchDevice.value) {
       @dblclick="handleDblClick"
       @contextmenu.prevent.stop="handleContextMenu"
       @dragstart="(e) => handleDragStart(e, item)"
+      @dragend="handleDragEnd"
       :draggable="canDragDrop() && !isRenaming"
       :class="[
         'grid select-none items-center',
@@ -560,37 +577,45 @@ if (isTouchDevice.value) {
           />
         </template>
         <template v-else>
-          <MiddleEllipsis :text="item.name" :end-chars="10" /><span
-            v-if="onlyofficeActivity?.active"
-            :title="onlyofficeActivityLabel"
-            :aria-label="onlyofficeActivityLabel"
-            data-test="onlyoffice-mark"
-            class="ml-1 inline-flex shrink-0 items-center align-middle text-amber-600 dark:text-amber-400"
-          >
-            <PencilSquareIcon class="h-3.5 w-3.5" /> </span
-          ><button
-            v-if="versionCount"
-            type="button"
-            :title="versionsLabel"
-            :aria-label="versionsLabel"
-            data-test="version-mark"
-            class="ml-1 inline-flex shrink-0 items-center gap-0.5 rounded-full px-1 align-middle text-[0.65rem] font-medium leading-4 text-current opacity-55 transition-opacity hover:opacity-100 focus-visible:opacity-100 focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-blue-500"
-            @click.stop.prevent="openVersions"
-            @dblclick.stop.prevent
-          >
-            <ClockIcon class="h-3.5 w-3.5" />
-            <span>{{ versionCount }}</span>
-          </button>
+          <!-- Name stays anchored on the left; the hover icons sit to its right in
+               the free space, and wrap onto the line below when the name is too
+               long to leave room. The name never shifts, so browsing isn't jumpy. -->
+          <div class="flex flex-wrap items-center gap-x-1.5 gap-y-0.5 min-w-0">
+            <MiddleEllipsis :text="item.name" :end-chars="10" />
+            <!-- A rule holds this entry to reading: the same lock a volume held
+                 to reading carries, drawn where the restriction begins. -->
+            <ReadOnlyMark v-if="item.readOnly" :reason="item.readOnly" />
+            <span
+              v-if="onlyofficeActivity?.active"
+              :title="onlyofficeActivityLabel"
+              class="inline-flex h-4 w-4 shrink-0 items-center justify-center text-amber-600 dark:text-amber-400"
+            >
+              <PencilSquareIcon class="h-3.5 w-3.5" />
+            </span>
+            <button
+              v-if="versionCount"
+              type="button"
+              :title="versionsLabel"
+              :aria-label="versionsLabel"
+              data-test="version-mark"
+              class="inline-flex shrink-0 items-center gap-0.5 rounded-full px-1 align-middle text-[0.65rem] font-medium leading-4 text-current opacity-55 transition-opacity hover:opacity-100 focus-visible:opacity-100 focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-blue-500"
+              @click.stop.prevent="openVersions"
+              @dblclick.stop.prevent
+            >
+              <ClockIcon class="h-3.5 w-3.5" />
+              <span>{{ versionCount }}</span>
+            </button>
+          </div>
         </template>
       </div>
       <div class="text-sm">
         <FolderSizeLabel v-if="showFolderSize" :entry="folderSizeEntry" />
         <template v-else>{{
-          item.kind === 'directory' ? '&mdash;' : formatBytes(item.size)
+          item.kind === 'directory' || isOutsideLink ? '&mdash;' : formatBytes(item.size)
         }}</template>
       </div>
       <div class="text-sm">
-        {{ getKindLabel(item) }}
+        {{ isOutsideLink ? t('links.outside') : getKindLabel(item) }}
       </div>
       <div class="text-sm">
         {{ formatDate(item.dateModified) }}
diff --git a/frontend/src/components/InfoPanel.vue b/frontend/src/components/InfoPanel.vue
index ebc0fffbf..c9800127c 100644
--- a/frontend/src/components/InfoPanel.vue
+++ b/frontend/src/components/InfoPanel.vue
@@ -1,9 +1,10 @@
 <script setup>
 import { computed, onMounted, onBeforeUnmount, watch, ref } from 'vue';
-import { XMarkIcon } from '@heroicons/vue/24/outline';
+import { ArrowPathIcon, XMarkIcon } from '@heroicons/vue/24/outline';
 import { useInfoPanelStore } from '@/stores/infoPanel';
-import { useVersionsPanelStore } from '@/stores/versionsPanel';
+import { useFolderSizeStore } from '@/stores/folderSize';
 import { useFeaturesStore } from '@/stores/features';
+import { useVersionsPanelStore } from '@/stores/versionsPanel';
 import { useFileStore } from '@/stores/fileStore';
 import { formatBytes, formatDate } from '@/utils';
 import { getKindLabel } from '@/utils/fileKinds';
@@ -14,37 +15,35 @@ import { fetchMetadata, fetchPermissions, changePermissions, changeOwnership } f
 import { useI18n } from 'vue-i18n';
 
 const store = useInfoPanelStore();
+const folderSizeStore = useFolderSizeStore();
+const featuresStore = useFeaturesStore();
 
 const isOpen = computed(() => store.isOpen);
 const item = computed(() => store.item);
 const relativePath = computed(() => store.relativePath);
+const isSharedPath = computed(() => String(relativePath.value || '').startsWith('share/'));
 
 const { t } = useI18n();
-const featuresStore = useFeaturesStore();
-const versionsPanel = useVersionsPanelStore();
-const fileStore = useFileStore();
-// Through a share whose owner keeps the history hidden, the listing says so.
-const canShowVersions = computed(
-  () =>
-    featuresStore.versionsEnabled &&
-    Boolean(item.value) &&
-    !['directory', 'volume'].includes(item.value.kind) &&
-    fileStore.currentPathData?.canSeeVersions !== false
-);
-const openVersions = () => {
-  const target = item.value;
-  if (!target) return;
-  store.close();
-  versionsPanel.open(target);
-};
-
 const title = computed(() => item.value?.name || t('common.details'));
 const kindLabel = computed(() => (item.value ? getKindLabel(item.value) : ''));
+const indexedFolderSize = computed(() => folderSizeStore.sizeFor(relativePath.value));
+
+const directorySizeLabel = computed(() => {
+  if (indexedFolderSize.value?.excluded) return t('info.folderSizeExcluded');
+  const indexedSize = indexedFolderSize.value?.sizeBytes;
+  if (Number.isFinite(indexedSize)) return formatBytes(indexedSize);
+  const metadataSize = details.value?.directory?.totalSize;
+  return Number.isFinite(metadataSize) ? formatBytes(metadataSize) : '—';
+});
 
 const sizeLabel = computed(() => {
   const it = item.value;
   if (!it) return '';
-  if (it.kind === 'directory') return '—';
+  if (it.kind === 'directory') {
+    if (indexedFolderSize.value?.excluded) return t('info.folderSizeExcluded');
+    const size = indexedFolderSize.value?.sizeBytes;
+    return Number.isFinite(size) ? formatBytes(size) : '—';
+  }
   if (typeof it.size === 'number') return formatBytes(it.size);
   return '';
 });
@@ -57,6 +56,23 @@ const modifiedLabel = computed(() => {
 
 const locationLabel = computed(() => item.value?.path || '');
 
+const versionsPanel = useVersionsPanelStore();
+const fileStore = useFileStore();
+// Through a share whose owner keeps the history hidden, the listing says so.
+const canShowVersions = computed(
+  () =>
+    featuresStore.versionsEnabled &&
+    Boolean(item.value) &&
+    !['directory', 'volume'].includes(item.value.kind) &&
+    fileStore.currentPathData?.canSeeVersions !== false
+);
+const openVersions = () => {
+  const target = item.value;
+  if (!target) return;
+  store.close();
+  versionsPanel.open(target);
+};
+
 const loading = ref(false);
 const details = ref(null);
 const errorMsg = ref('');
@@ -64,6 +80,26 @@ const errorMsg = ref('');
 const permissionsLoading = ref(false);
 const permissions = ref(null);
 const permissionsError = ref('');
+const refreshingFolderSize = ref(false);
+const folderSizeRefreshError = ref('');
+
+const canRefreshDirectorySize = computed(
+  () => item.value?.kind === 'directory' && featuresStore.folderSizeEnabled
+);
+
+const refreshDirectorySize = async () => {
+  if (!canRefreshDirectorySize.value || !relativePath.value || refreshingFolderSize.value) return;
+
+  refreshingFolderSize.value = true;
+  folderSizeRefreshError.value = '';
+  try {
+    await folderSizeStore.refreshFolder(relativePath.value);
+  } catch (error) {
+    folderSizeRefreshError.value = error?.message || t('errors.loadMetadata');
+  } finally {
+    refreshingFolderSize.value = false;
+  }
+};
 
 const loadDetails = async () => {
   if (!isOpen.value || !relativePath.value) {
@@ -98,7 +134,7 @@ const loadPermissions = async () => {
 };
 
 const handleChangePermissions = async ({ mode, recursive }) => {
-  if (!relativePath.value) return;
+  if (!relativePath.value || isSharedPath.value) return;
 
   permissionsLoading.value = true;
   permissionsError.value = '';
@@ -115,7 +151,7 @@ const handleChangePermissions = async ({ mode, recursive }) => {
 };
 
 const handleChangeOwner = async ({ owner, group }) => {
-  if (!relativePath.value) return;
+  if (!relativePath.value || isSharedPath.value) return;
 
   permissionsLoading.value = true;
   permissionsError.value = '';
@@ -210,6 +246,17 @@ onBeforeUnmount(() => {
               {{ title }}
             </h2>
           </div>
+          <button
+            v-if="canRefreshDirectorySize"
+            type="button"
+            class="rounded-md p-2 text-neutral-600 transition hover:bg-neutral-100 hover:text-neutral-800 disabled:cursor-wait disabled:opacity-60 dark:text-neutral-400 dark:hover:bg-zinc-800 dark:hover:text-neutral-200"
+            :disabled="refreshingFolderSize"
+            :title="$t('common.refresh')"
+            :aria-label="$t('common.refresh')"
+            @click="refreshDirectorySize"
+          >
+            <ArrowPathIcon :class="['h-5 w-5', refreshingFolderSize ? 'animate-spin' : '']" />
+          </button>
           <button
             type="button"
             class="ml-auto rounded-md p-2 text-neutral-600 transition hover:bg-neutral-100 hover:text-neutral-800 dark:text-neutral-400 dark:hover:bg-zinc-800 dark:hover:text-neutral-200"
@@ -311,7 +358,7 @@ onBeforeUnmount(() => {
               <p class="text-neutral-900 dark:text-neutral-100">
                 {{
                   t('info.folderSize', {
-                    size: formatBytes(details.directory.totalSize || 0),
+                    size: directorySizeLabel,
                   })
                 }}
               </p>
@@ -323,6 +370,9 @@ onBeforeUnmount(() => {
                   })
                 }}
               </p>
+              <p v-if="folderSizeRefreshError" class="mt-2 text-sm text-red-600 dark:text-red-400">
+                {{ folderSizeRefreshError }}
+              </p>
             </div>
 
             <!-- Image specific metadata -->
@@ -428,6 +478,7 @@ onBeforeUnmount(() => {
               :permissions="permissions"
               :is-directory="item?.kind === 'directory'"
               :loading="permissionsLoading"
+              :read-only="isSharedPath"
               @change-permissions="handleChangePermissions"
               @change-owner="handleChangeOwner"
             />
diff --git a/frontend/src/components/ModalDialog.vue b/frontend/src/components/ModalDialog.vue
index 893573506..fdd14a62c 100644
--- a/frontend/src/components/ModalDialog.vue
+++ b/frontend/src/components/ModalDialog.vue
@@ -53,6 +53,19 @@ function onBackgroundClick() {
         <div class="p-6 py-6 text-sm">
           <slot> </slot>
         </div>
+
+        <!--
+          What a dialog asks for stays where it can be reached. Inside the
+          scrolling part, a long list pushed the buttons below the fold, on a
+          window that could not grow: the answer to a question was off the
+          screen, and the only way back was Escape.
+        -->
+        <div
+          v-if="$slots.footer"
+          class="shrink-0 border-t border-zinc-300 px-6 py-4 text-sm dark:border-zinc-800"
+        >
+          <slot name="footer" />
+        </div>
       </div>
     </div>
   </Teleport>
diff --git a/frontend/src/components/PermissionsPanel.vue b/frontend/src/components/PermissionsPanel.vue
index 359d7b54b..26d1ea7e9 100644
--- a/frontend/src/components/PermissionsPanel.vue
+++ b/frontend/src/components/PermissionsPanel.vue
@@ -14,6 +14,10 @@ const props = defineProps({
     type: Boolean,
     default: false,
   },
+  readOnly: {
+    type: Boolean,
+    default: false,
+  },
 });
 
 const emit = defineEmits(['change-permissions', 'change-owner']);
@@ -94,6 +98,7 @@ const hasChanges = computed(() => {
 });
 
 const applyChanges = () => {
+  if (props.readOnly) return;
   emit('change-permissions', {
     mode: currentOctal.value,
     recursive: applyToItems.value,
@@ -107,11 +112,13 @@ const newOwner = ref('');
 const newGroup = ref('');
 
 const startEditOwner = () => {
+  if (props.readOnly) return;
   newOwner.value = props.permissions?.owner || '';
   editingOwner.value = true;
 };
 
 const startEditGroup = () => {
+  if (props.readOnly) return;
   newGroup.value = props.permissions?.group || '';
   editingGroup.value = true;
 };
@@ -139,6 +146,16 @@ const cancelEditGroup = () => {
   editingGroup.value = false;
   newGroup.value = '';
 };
+
+// The details panel stays mounted from one item to the next. A name typed for
+// the owner of one file, left open, would otherwise be saved onto the next.
+watch(
+  () => props.permissions,
+  () => {
+    cancelEditOwner();
+    cancelEditGroup();
+  }
+);
 </script>
 
 <template>
@@ -188,12 +205,15 @@ const cancelEditGroup = () => {
             </button>
           </div>
           <button
-            v-else
+            v-else-if="!readOnly"
             @click="startEditOwner"
             class="text-sm text-blue-600 dark:text-blue-400 hover:underline"
           >
             {{ permissions.owner || 'Unknown' }}
           </button>
+          <span v-else class="text-sm text-neutral-900 dark:text-neutral-100">
+            {{ permissions.owner || 'Unknown' }}
+          </span>
         </div>
 
         <!-- Group -->
@@ -221,12 +241,15 @@ const cancelEditGroup = () => {
             </button>
           </div>
           <button
-            v-else
+            v-else-if="!readOnly"
             @click="startEditGroup"
             class="text-sm text-blue-600 dark:text-blue-400 hover:underline"
           >
             {{ permissions.group || 'Unknown' }}
           </button>
+          <span v-else class="text-sm text-neutral-900 dark:text-neutral-100">
+            {{ permissions.group || 'Unknown' }}
+          </span>
         </div>
       </div>
 
@@ -249,6 +272,7 @@ const cancelEditGroup = () => {
             <input
               v-model="ownerRead"
               type="checkbox"
+              :disabled="readOnly"
               class="h-4 w-4 rounded border-neutral-300 dark:border-white/10 text-blue-600 focus:ring-blue-500"
             />
           </div>
@@ -256,6 +280,7 @@ const cancelEditGroup = () => {
             <input
               v-model="ownerWrite"
               type="checkbox"
+              :disabled="readOnly"
               class="h-4 w-4 rounded border-neutral-300 dark:border-white/10 text-blue-600 focus:ring-blue-500"
             />
           </div>
@@ -263,6 +288,7 @@ const cancelEditGroup = () => {
             <input
               v-model="ownerExecute"
               type="checkbox"
+              :disabled="readOnly"
               class="h-4 w-4 rounded border-neutral-300 dark:border-white/10 text-blue-600 focus:ring-blue-500"
             />
           </div>
@@ -275,6 +301,7 @@ const cancelEditGroup = () => {
             <input
               v-model="groupRead"
               type="checkbox"
+              :disabled="readOnly"
               class="h-4 w-4 rounded border-neutral-300 dark:border-white/10 text-blue-600 focus:ring-blue-500"
             />
           </div>
@@ -282,6 +309,7 @@ const cancelEditGroup = () => {
             <input
               v-model="groupWrite"
               type="checkbox"
+              :disabled="readOnly"
               class="h-4 w-4 rounded border-neutral-300 dark:border-white/10 text-blue-600 focus:ring-blue-500"
             />
           </div>
@@ -289,6 +317,7 @@ const cancelEditGroup = () => {
             <input
               v-model="groupExecute"
               type="checkbox"
+              :disabled="readOnly"
               class="h-4 w-4 rounded border-neutral-300 dark:border-white/10 text-blue-600 focus:ring-blue-500"
             />
           </div>
@@ -301,6 +330,7 @@ const cancelEditGroup = () => {
             <input
               v-model="othersRead"
               type="checkbox"
+              :disabled="readOnly"
               class="h-4 w-4 rounded border-neutral-300 dark:border-white/10 text-blue-600 focus:ring-blue-500"
             />
           </div>
@@ -308,6 +338,7 @@ const cancelEditGroup = () => {
             <input
               v-model="othersWrite"
               type="checkbox"
+              :disabled="readOnly"
               class="h-4 w-4 rounded border-neutral-300 dark:border-white/10 text-blue-600 focus:ring-blue-500"
             />
           </div>
@@ -315,6 +346,7 @@ const cancelEditGroup = () => {
             <input
               v-model="othersExecute"
               type="checkbox"
+              :disabled="readOnly"
               class="h-4 w-4 rounded border-neutral-300 dark:border-white/10 text-blue-600 focus:ring-blue-500"
             />
           </div>
@@ -323,7 +355,7 @@ const cancelEditGroup = () => {
 
       <!-- Apply to items checkbox for directories -->
       <div
-        v-if="isDirectory"
+        v-if="isDirectory && !readOnly"
         class="flex items-center gap-2 pt-3 border-t border-neutral-200 dark:border-white/5"
       >
         <input
@@ -339,7 +371,7 @@ const cancelEditGroup = () => {
 
       <!-- Apply button (only shows when changes detected) -->
       <button
-        v-if="hasChanges"
+        v-if="hasChanges && !readOnly"
         @click="applyChanges"
         class="w-full mt-2 px-3 py-1.5 text-sm font-medium text-white bg-blue-600 rounded-md hover:bg-blue-700 transition-colors"
       >
diff --git a/frontend/src/components/ShareDialog.vue b/frontend/src/components/ShareDialog.vue
index cb8727b21..e1664c038 100644
--- a/frontend/src/components/ShareDialog.vue
+++ b/frontend/src/components/ShareDialog.vue
@@ -2,10 +2,12 @@
 import { ref, computed, watch, nextTick, onBeforeUnmount } from 'vue';
 import { useI18n } from 'vue-i18n';
 import { useAppSettings } from '@/stores/appSettings';
+import { isEditableExtension } from '@/config/editor';
 import { calculateExpirationDate } from '@/utils/datetime';
 import ModalDialog from '@/components/ModalDialog.vue';
 import {
   createShare,
+  updateShare,
   copyDirectShareFileUrl,
   copyShareUrl,
   DIRECT_SHARE_FILE_MODES,
@@ -22,6 +24,7 @@ import {
   GlobeAltIcon,
   UsersIcon,
   CalendarIcon,
+  ChevronDownIcon,
 } from '@heroicons/vue/24/outline';
 
 const { t } = useI18n();
@@ -30,9 +33,12 @@ const appSettings = useAppSettings();
 const props = defineProps({
   modelValue: Boolean,
   item: Object, // {name, path, kind}
+  share: Object,
+  // Passed through when opened from above a full-screen overlay.
+  elevated: Boolean,
 });
 
-const emit = defineEmits(['update:modelValue', 'shareCreated']);
+const emit = defineEmits(['update:modelValue', 'shareCreated', 'shareUpdated']);
 
 const isOpen = computed({
   get: () => props.modelValue,
@@ -44,10 +50,23 @@ const accessMode = ref('readonly');
 const sharingType = ref('anyone');
 const password = ref('');
 const enablePassword = ref(false);
+const passwordDirty = ref(false);
 const selectedUserIds = ref([]);
 const expiresAtDate = ref(null);
 const enableExpiry = ref(false);
 const label = ref('');
+const showAdvancedPermissions = ref(false);
+const allowDelete = ref(true);
+// Not part of the advanced block below: it applies to a single-file share as
+// much as to a folder, and to a read-only share as much as a read-write one.
+const allowDownload = ref(true);
+const allowCreateFolder = ref(true);
+const allowCreateFile = ref(true);
+const allowUpload = ref(true);
+// What the share shows of a file's history: the list of its versions, and the
+// versions themselves.
+const versionsVisible = ref(false);
+const versionsDownload = ref(false);
 
 // UI state
 const isCreating = ref(false);
@@ -62,14 +81,26 @@ const expiresAtInputRef = ref(null);
 let expiresPicker = null;
 
 // Computed
-const isDirectory = computed(() => props.item?.kind === 'directory');
+const isEditing = computed(() => Boolean(props.share?.id));
+const isDirectory = computed(() => {
+  if (props.share?.isDirectory != null) return Boolean(props.share.isDirectory);
+  return props.item?.kind === 'directory';
+});
+const supportsSharedEditor = computed(() => {
+  const name = props.share?.sourcePath || props.item?.name || '';
+  const extension = name.includes('.') ? name.split('.').pop() : '';
+  return !isDirectory.value && isEditableExtension(extension);
+});
 const sourcePath = computed(() => {
+  if (props.share?.sourcePath) return props.share.sourcePath;
   if (!props.item) return '';
   const parentPath = props.item.path || '';
   return parentPath ? `${parentPath}/${props.item.name}` : props.item.name;
 });
 const directLinkModeOptions = computed(() =>
-  DIRECT_SHARE_FILE_MODES.map((mode) => ({
+  DIRECT_SHARE_FILE_MODES.filter(
+    (mode) => mode.value !== 'editor' || supportsSharedEditor.value
+  ).map((mode) => ({
     ...mode,
     label: t(mode.labelKey, mode.fallback),
   }))
@@ -83,17 +114,25 @@ const directShareUrl = computed(() => {
 watch(isOpen, async (opened) => {
   if (opened) {
     resetForm();
-    if (props.item?.name) {
+    if (isEditing.value) {
+      populateShareForm(props.share);
+    } else if (props.item?.name) {
       label.value = props.item.name;
     }
 
-    // Apply default share expiration if user has one set
-    const defaultExpiration = appSettings.userSettings?.defaultShareExpiration;
-    const expirationDate = calculateExpirationDate(defaultExpiration);
+    if (!isEditing.value) {
+      // Apply the default only to new shares; an existing share must keep its
+      // own expiration unchanged until the owner edits it.
+      const defaultExpiration = appSettings.userSettings?.defaultShareExpiration;
+      const expirationDate = calculateExpirationDate(defaultExpiration);
 
-    if (expirationDate) {
-      enableExpiry.value = true;
-      expiresAtDate.value = expirationDate;
+      if (expirationDate) {
+        enableExpiry.value = true;
+        expiresAtDate.value = expirationDate;
+      }
+    }
+
+    if (enableExpiry.value) {
       await nextTick();
       await initExpiresPicker();
     }
@@ -112,15 +151,33 @@ watch(sharingType, async (newType) => {
   }
 });
 
+// A share with named accounts shows the history they would see anyway; a link
+// for anyone shows none until its owner turns it on. Only for a new share: an
+// existing one keeps what its owner chose.
+watch(sharingType, (type) => {
+  if (isEditing.value) return;
+  versionsVisible.value = type === 'users';
+  versionsDownload.value = type === 'users';
+});
+
 function resetForm() {
   accessMode.value = 'readonly';
   sharingType.value = 'anyone';
   password.value = '';
   enablePassword.value = false;
+  passwordDirty.value = false;
   selectedUserIds.value = [];
   expiresAtDate.value = null;
   enableExpiry.value = false;
   label.value = '';
+  showAdvancedPermissions.value = false;
+  allowDelete.value = true;
+  allowDownload.value = true;
+  allowCreateFolder.value = true;
+  allowCreateFile.value = true;
+  allowUpload.value = true;
+  versionsVisible.value = false;
+  versionsDownload.value = false;
   error.value = '';
   shareResult.value = null;
   linkCopied.value = false;
@@ -128,6 +185,35 @@ function resetForm() {
   directLinkMode.value = 'auto';
 }
 
+function populateShareForm(share) {
+  accessMode.value = share.accessMode || 'readonly';
+  sharingType.value = share.sharingType || 'anyone';
+  enablePassword.value = Boolean(share.hasPassword);
+  selectedUserIds.value = Array.isArray(share.permittedUserIds) ? [...share.permittedUserIds] : [];
+  label.value = share.label || '';
+  allowDelete.value = share.allowDelete !== false;
+  allowDownload.value = share.allowDownload !== false;
+  allowCreateFolder.value = share.allowCreateFolder !== false;
+  allowCreateFile.value = share.allowCreateFile !== false;
+  allowUpload.value = share.allowUpload !== false;
+  versionsVisible.value = share.versionsVisible === true;
+  versionsDownload.value = share.versionsDownload === true;
+  showAdvancedPermissions.value =
+    isDirectory.value &&
+    (allowDelete.value === false ||
+      allowCreateFolder.value === false ||
+      allowCreateFile.value === false ||
+      allowUpload.value === false);
+
+  if (share.expiresAt) {
+    const date = new Date(share.expiresAt);
+    if (!Number.isNaN(date.getTime())) {
+      enableExpiry.value = true;
+      expiresAtDate.value = date;
+    }
+  }
+}
+
 function destroyExpiresPicker() {
   if (!expiresPicker) return;
   try {
@@ -199,8 +285,8 @@ function toggleUserSelection(userId) {
   }
 }
 
-async function createShareLink() {
-  if (!sourcePath.value) {
+async function submitShare() {
+  if (!isEditing.value && !sourcePath.value) {
     error.value = t(
       'share.errors.invalidSourcePath',
       'Unable to determine the item path to share.'
@@ -230,16 +316,39 @@ async function createShareLink() {
     error.value = '';
 
     const shareData = {
-      sourcePath: sourcePath.value,
       accessMode: accessMode.value,
+      allowDelete: allowDelete.value,
+      allowDownload: allowDownload.value,
+      allowCreateFolder: allowCreateFolder.value,
+      allowCreateFile: allowCreateFile.value,
+      allowUpload: allowUpload.value,
+      versionsVisible: versionsVisible.value,
+      versionsDownload: versionsVisible.value && versionsDownload.value,
       sharingType: sharingType.value,
-      password: enablePassword.value ? password.value : null,
       userIds: sharingType.value === 'users' ? selectedUserIds.value : [],
       expiresAt:
         enableExpiry.value && expiresAtDate.value ? expiresAtDate.value.toISOString() : null,
       label: label.value || null,
     };
 
+    if (isEditing.value) {
+      // Passwords apply only to anyone-with-link shares. Clear an old password
+      // when switching to named users so it cannot unexpectedly apply again if
+      // the link is later made public.
+      if (sharingType.value === 'users') {
+        shareData.password = null;
+      } else if (passwordDirty.value) {
+        shareData.password = enablePassword.value ? password.value : null;
+      }
+      const result = await updateShare(props.share.id, shareData);
+      emit('shareUpdated', result);
+      closeDialog();
+      return;
+    }
+
+    shareData.sourcePath = sourcePath.value;
+    shareData.password = enablePassword.value ? password.value : null;
+
     const result = await createShare(shareData);
     shareResult.value = result;
 
@@ -285,14 +394,20 @@ function closeDialog() {
 </script>
 
 <template>
-  <ModalDialog v-model="isOpen">
+  <ModalDialog v-model="isOpen" :elevated="props.elevated">
     <template #title>
       <ShareIcon class="w-5 h-5" />
-      {{ shareResult ? t('share.shareCreated') : t('share.createShareLink') }}
+      {{
+        shareResult
+          ? t('share.shareCreated')
+          : isEditing
+            ? t('share.editShareLink', 'Edit share link')
+            : t('share.createShareLink')
+      }}
     </template>
 
     <!-- Share created success view -->
-    <div v-if="shareResult" class="space-y-4">
+    <div v-if="shareResult && !isEditing" class="space-y-4">
       <div class="p-4 rounded-lg bg-green-50 dark:bg-green-900/20">
         <div class="flex items-center gap-2 text-green-800 dark:text-green-200">
           <CheckIcon class="w-5 h-5" />
@@ -396,7 +511,7 @@ function closeDialog() {
       </div>
     </div>
 
-    <!-- Share creation form -->
+    <!-- Share creation and editing form -->
     <div v-else class="space-y-4">
       <div
         v-if="error"
@@ -410,7 +525,9 @@ function closeDialog() {
         <div class="text-sm text-gray-500 dark:text-gray-400">
           {{ t('share.sharing') }}
         </div>
-        <div class="font-medium">{{ item?.name }}</div>
+        <div class="font-medium">
+          {{ share?.label || share?.sourcePath?.split('/').filter(Boolean).pop() || item?.name }}
+        </div>
         <div class="text-xs text-gray-500">{{ sourcePath }}</div>
       </div>
 
@@ -454,6 +571,112 @@ function closeDialog() {
         </div>
       </div>
 
+      <!-- Downloading is its own question: a share can be readable without
+           being copyable, and that holds for a single file as much as a
+           folder. So it sits here rather than inside the advanced block, which
+           only appears for a read-write folder. -->
+      <label class="flex cursor-pointer items-center justify-between gap-3 text-sm">
+        <span>
+          {{ t('share.allowDownload', 'Allow downloading') }}
+          <span class="block text-xs text-zinc-500 dark:text-zinc-400">
+            {{
+              t(
+                'share.allowDownloadHelp',
+                'Turn this off to let people read the files without taking a copy.'
+              )
+            }}
+          </span>
+        </span>
+        <input
+          v-model="allowDownload"
+          type="checkbox"
+          class="h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500"
+        />
+      </label>
+
+      <label class="flex cursor-pointer items-center justify-between gap-3 text-sm">
+        <span>
+          {{ t('share.versionsVisible') }}
+          <span class="block text-xs text-zinc-500 dark:text-zinc-400">
+            {{ t('share.versionsVisibleHelp') }}
+          </span>
+        </span>
+        <input
+          v-model="versionsVisible"
+          type="checkbox"
+          data-test="share-versions-visible"
+          class="h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500"
+        />
+      </label>
+      <label
+        class="flex items-center justify-between gap-3 text-sm"
+        :class="versionsVisible ? 'cursor-pointer' : 'cursor-not-allowed opacity-50'"
+      >
+        <span>{{ t('share.versionsDownload') }}</span>
+        <input
+          v-model="versionsDownload"
+          type="checkbox"
+          :disabled="!versionsVisible"
+          data-test="share-versions-download"
+          class="h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500"
+        />
+      </label>
+
+      <div
+        v-if="isDirectory && accessMode === 'readwrite'"
+        class="rounded-lg border border-zinc-200 dark:border-zinc-700"
+      >
+        <button
+          type="button"
+          class="flex w-full items-center justify-between gap-3 px-3 py-2.5 text-left text-sm font-medium hover:bg-zinc-50 dark:hover:bg-zinc-800"
+          :aria-expanded="showAdvancedPermissions"
+          @click="showAdvancedPermissions = !showAdvancedPermissions"
+        >
+          {{ t('share.advancedPermissions', 'Advanced') }}
+          <ChevronDownIcon
+            class="h-4 w-4 transition-transform"
+            :class="showAdvancedPermissions ? 'rotate-180' : ''"
+          />
+        </button>
+        <div
+          v-if="showAdvancedPermissions"
+          class="space-y-2 border-t border-zinc-200 p-3 dark:border-zinc-700"
+        >
+          <label class="flex cursor-pointer items-center justify-between gap-3 text-sm">
+            <span>{{ t('share.allowDelete', 'Allow deleting files') }}</span>
+            <input
+              v-model="allowDelete"
+              type="checkbox"
+              class="h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500"
+            />
+          </label>
+          <label class="flex cursor-pointer items-center justify-between gap-3 text-sm">
+            <span>{{ t('share.allowCreateFolder', 'Allow creating folders') }}</span>
+            <input
+              v-model="allowCreateFolder"
+              type="checkbox"
+              class="h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500"
+            />
+          </label>
+          <label class="flex cursor-pointer items-center justify-between gap-3 text-sm">
+            <span>{{ t('share.allowCreateFile', 'Allow creating files') }}</span>
+            <input
+              v-model="allowCreateFile"
+              type="checkbox"
+              class="h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500"
+            />
+          </label>
+          <label class="flex cursor-pointer items-center justify-between gap-3 text-sm">
+            <span>{{ t('share.allowUpload', 'Allow uploading files and folders') }}</span>
+            <input
+              v-model="allowUpload"
+              type="checkbox"
+              class="h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500"
+            />
+          </label>
+        </div>
+      </div>
+
       <!-- Sharing Type -->
       <div>
         <label class="block mb-2 text-sm font-medium">{{ t('share.whoCanAccess') }}</label>
@@ -521,6 +744,7 @@ function closeDialog() {
           <input
             v-model="enablePassword"
             type="checkbox"
+            @change="passwordDirty = true"
             class="w-4 h-4 text-blue-600 border-gray-300 rounded focus:ring-blue-500"
           />
           <LockClosedIcon class="w-4 h-4" />
@@ -530,6 +754,7 @@ function closeDialog() {
           v-if="enablePassword"
           v-model="password"
           type="password"
+          @input="passwordDirty = true"
           :placeholder="t('share.enterPassword')"
           class="w-full px-3 py-2 text-sm border rounded-lg border-zinc-300 dark:border-zinc-700 dark:bg-zinc-800 focus:outline-none focus:ring-2 focus:ring-blue-500"
         />
@@ -566,11 +791,17 @@ function closeDialog() {
           {{ t('common.cancel') }}
         </button>
         <button
-          @click="createShareLink"
+          @click="submitShare"
           :disabled="isCreating"
           class="px-4 py-2 text-sm font-medium text-white transition bg-blue-600 rounded-lg hover:bg-blue-700 disabled:opacity-50"
         >
-          {{ isCreating ? t('share.creating') : t('share.createShareLink') }}
+          {{
+            isCreating
+              ? t('share.creating')
+              : isEditing
+                ? t('share.saveShare', 'Save changes')
+                : t('share.createShareLink')
+          }}
         </button>
       </div>
     </div>
diff --git a/frontend/src/components/SharesMenu.vue b/frontend/src/components/SharesMenu.vue
index 680d2a1b4..1f55c874e 100644
--- a/frontend/src/components/SharesMenu.vue
+++ b/frontend/src/components/SharesMenu.vue
@@ -28,6 +28,7 @@ const handleOpenSharedByMe = () => {
     >
       {{ t('common.shares') }}
       <button
+        :aria-label="t('common.toggleSection')"
         @click="open = !open"
         class="hidden group-hover:block active:text-black dark:active:text-white text-neutral-500"
         type="button"
diff --git a/frontend/src/components/SpotlightSearch.vue b/frontend/src/components/SpotlightSearch.vue
index fae3a759d..76b7035ed 100644
--- a/frontend/src/components/SpotlightSearch.vue
+++ b/frontend/src/components/SpotlightSearch.vue
@@ -1,4 +1,5 @@
 <script setup>
+import { matchLabelKey } from '@/utils/searchMatch';
 import { ref, computed, watch, nextTick, shallowRef } from 'vue';
 import { useRoute, useRouter } from 'vue-router';
 import { useDebounceFn, onKeyStroke } from '@vueuse/core';
@@ -7,6 +8,7 @@ import { search as searchApi, normalizePath } from '@/api';
 import { useSpotlightStore } from '@/stores/spotlight';
 import FileIcon from '@/icons/FileIcon.vue';
 import { useI18n } from 'vue-i18n';
+import { folderRoute } from '@/utils/folderRoute';
 
 const router = useRouter();
 const route = useRoute();
@@ -31,30 +33,121 @@ const basePath = computed(() => {
   return normalizePath(fromBrowse || fromQuery || '');
 });
 
-const performSearch = useDebounceFn(async () => {
+/**
+ * A search is coming, before it has started.
+ *
+ * Typing sets this immediately; the request itself only begins a second later,
+ * once the debounce lets it. Without it there is a second where nothing is
+ * loading and nothing has been found, which the panel showed as "no matches" —
+ * a search that had not run yet, reported as one that had answered.
+ */
+const pending = ref(false);
+
+/**
+ * Only the newest search may write to the panel.
+ *
+ * The debounce delays the start of a request; it does nothing about one
+ * already in flight. Typing `*.doc*`, then `*.docx`, then `*.doc*` sent
+ * three searches, and a deep one takes seconds — so the panel showed
+ * whichever came back last, which is not the one being asked for. Superseding
+ * a search also aborts it, so the server stops looking for an answer nobody
+ * will read.
+ */
+let currentRequest = 0;
+let inFlight = null;
+
+/** Why the answer is short of everything, or null when it is not. */
+const shortfall = ref(null);
+/** Whether what was typed is too short to be worth sending. */
+const tooShort = ref(false);
+let lastAsked = null;
+const MIN_TERM_LENGTH = 3;
+/**
+ * How many results this search has asked for.
+ *
+ * A page is a hundred, and somebody who wants the rest asks again for more
+ * rather than being handed a cursor: holding a search open between requests
+ * would mean keeping its generator, its subprocesses and its database cursor
+ * alive per person and per term, which is a great deal of machinery to avoid
+ * repeating a query the index answers in milliseconds.
+ */
+const LIMIT_STEPS = [100, 300, 500];
+const askedLimit = ref(LIMIT_STEPS[0]);
+const canShowMore = computed(
+  () => shortfall.value?.kind === 'first' && askedLimit.value < LIMIT_STEPS[LIMIT_STEPS.length - 1]
+);
+const showMore = () => {
+  askedLimit.value = LIMIT_STEPS.find((step) => step > askedLimit.value) ?? askedLimit.value;
+  runSearch();
+};
+
+const runSearch = async () => {
   const term = query.value.trim();
+  const request = (currentRequest += 1);
+
+  inFlight?.abort();
+  inFlight = null;
 
   errorMsg.value = '';
   activeIndex.value = -1;
+  if (term !== lastAsked) {
+    lastAsked = term;
+    askedLimit.value = LIMIT_STEPS[0];
+  }
 
-  if (!term) {
+  // Below this the server refuses, and rightly: one or two characters describe
+  // most of a volume. Said here rather than sent and bounced back.
+  if (term.length < MIN_TERM_LENGTH) {
     results.value = [];
+    shortfall.value = null;
+    pending.value = false;
+    tooShort.value = term.length > 0;
     return;
   }
+  tooShort.value = false;
 
+  const controller = new AbortController();
+  inFlight = controller;
   loading.value = true;
   try {
-    const { items = [] } = await searchApi(basePath.value, term);
+    const {
+      items = [],
+      truncated = false,
+      complete = true,
+      limit,
+    } = await searchApi(basePath.value, term, askedLimit.value, { signal: controller.signal });
+    if (request !== currentRequest) return;
     // Limit results to prevent performance issues with massive lists
     const limitedItems = Array.isArray(items) ? items : [];
     results.value = Object.freeze(limitedItems);
+    // Why the list may be shorter than the truth, said rather than left to
+    // look like the whole answer.
+    shortfall.value = truncated
+      ? { kind: 'stopped' }
+      : complete
+        ? null
+        : { kind: 'first', count: Number.isFinite(limit) ? limit : limitedItems.length };
   } catch (e) {
+    // A search this one replaced has nothing to say, and an abort is not a
+    // failure to report: it is this function having moved on.
+    if (request !== currentRequest) return;
     errorMsg.value = e?.message || t('errors.searchFailed');
     results.value = [];
+    shortfall.value = null;
   } finally {
-    loading.value = false;
+    if (request === currentRequest) {
+      inFlight = null;
+      loading.value = false;
+      pending.value = false;
+    }
   }
-}, 1000);
+  // A second was long enough that the panel felt slower than the search: the
+  // wait before asking was most of what people were waiting for. Short enough
+  // now to feel immediate, long enough that typing a word is still one query.
+};
+
+// Typing waits; asking for more does not — the decision was just made.
+const performSearch = useDebounceFn(runSearch, 350);
 
 function scrollToActiveItem() {
   if (activeIndex.value < 0 || activeIndex.value >= results.value.length) return;
@@ -104,15 +197,9 @@ function openResult(item) {
 
   const normalizedPath = normalizePath(targetPath);
 
-  if (!isDirectory && item.name) {
-    router.push({
-      name: 'FolderView',
-      params: { path: normalizedPath },
-      query: { select: item.name },
-    });
-  } else {
-    router.push({ name: 'FolderView', params: { path: normalizedPath } });
-  }
+  router.push(
+    folderRoute(normalizedPath, !isDirectory && item.name ? { select: item.name } : undefined)
+  );
   spotlight.close();
 }
 
@@ -123,6 +210,8 @@ function resetSpotlight() {
   errorMsg.value = '';
   activeIndex.value = -1;
   loading.value = false;
+  // Closing the panel cancels the search that was about to run with it.
+  pending.value = false;
 }
 
 // Create a stable item object that won't trigger FileIcon watchers
@@ -143,7 +232,12 @@ function toIconItem(item) {
 }
 
 // Only watch query changes, not spotlight state
-watch(query, performSearch);
+watch(query, () => {
+  // Set here rather than inside the debounced call: the whole point is to
+  // cover the wait before it runs.
+  pending.value = query.value.trim().length > 0;
+  performSearch();
+});
 
 // Separate watcher for spotlight open/close
 watch(
@@ -229,7 +323,10 @@ onKeyStroke(
 
         <!-- Results -->
         <div ref="resultsContainerRef" class="max-h-[60vh] overflow-y-auto">
-          <div v-if="loading" class="px-4 py-3 text-sm text-neutral-500 dark:text-neutral-400">
+          <div
+            v-if="loading || pending"
+            class="px-4 py-3 text-sm text-neutral-500 dark:text-neutral-400"
+          >
             {{ t('search.searching') }}
           </div>
           <div v-else-if="errorMsg" class="px-4 py-3 text-sm text-red-600">
@@ -241,6 +338,16 @@ onKeyStroke(
           >
             {{ t('spotlight.hintWithin') }}
             <span class="font-mono">/{{ basePath }}</span>
+            <p class="mt-2 text-xs text-neutral-400 dark:text-neutral-500">
+              {{ t('spotlight.hintPattern') }}
+            </p>
+          </div>
+          <div
+            v-else-if="tooShort"
+            data-test="search-too-short"
+            class="px-4 py-6 text-sm text-neutral-500 dark:text-neutral-400"
+          >
+            {{ t('search.tooShort', { count: MIN_TERM_LENGTH }) }}
           </div>
           <div
             v-else-if="results.length === 0"
@@ -270,8 +377,17 @@ onKeyStroke(
                   class="w-8 h-8 shrink-0"
                 />
                 <div class="min-w-0">
-                  <div class="text-[15px] text-neutral-900 dark:text-neutral-100 truncate">
-                    {{ item.name }}
+                  <div class="flex items-baseline gap-2 min-w-0">
+                    <div class="text-[15px] text-neutral-900 dark:text-neutral-100 truncate">
+                      {{ item.name }}
+                    </div>
+                    <span
+                      v-if="matchLabelKey(item)"
+                      data-test="match-kind"
+                      class="shrink-0 rounded-full px-1.5 text-[0.65rem] font-medium leading-4 text-neutral-500 ring-1 ring-neutral-300 dark:text-neutral-400 dark:ring-neutral-600"
+                    >
+                      {{ t(matchLabelKey(item)) }}
+                    </span>
                   </div>
                   <div
                     class="text-[12px] text-neutral-500 dark:text-neutral-400 font-mono truncate"
@@ -292,6 +408,27 @@ onKeyStroke(
                 </div>
               </div>
             </button>
+
+            <p
+              v-if="shortfall"
+              data-test="search-shortfall"
+              class="px-3 py-2 text-xs text-amber-700 dark:text-amber-400/90"
+            >
+              {{
+                shortfall.kind === 'stopped'
+                  ? t('search.stoppedEarly')
+                  : t('search.firstOnly', { count: shortfall.count })
+              }}
+              <button
+                v-if="canShowMore"
+                data-test="search-show-more"
+                type="button"
+                class="ml-2 underline underline-offset-2 hover:no-underline"
+                @click="showMore"
+              >
+                {{ t('search.showMore') }}
+              </button>
+            </p>
           </div>
         </div>
       </div>
diff --git a/frontend/src/components/UserMenu.vue b/frontend/src/components/UserMenu.vue
index 346bd432a..bde5cb5f5 100644
--- a/frontend/src/components/UserMenu.vue
+++ b/frontend/src/components/UserMenu.vue
@@ -76,20 +76,16 @@ const handleThemeToggle = () => {
 };
 
 const handleLogout = async () => {
-  // Capture whether the session is OIDC-backed before clearing state
-  const wasOidcUser = auth.currentUser?.provider === 'oidc';
-
-  // Always clear local session on the backend
-  try {
-    await auth.logout();
-  } catch (_) {}
+  // Preserve the OIDC session until the provider-aware logout endpoint has
+  // consumed its ID token. Clearing it first prevents a federated logout.
+  const isOidcUser = auth.currentUser?.provider === 'oidc';
 
   isExpanded.value = false;
 
-  // If the current user was an OIDC user (or OIDC is enabled),
-  // bounce through the provider-aware /logout endpoint to clear IdP session.
-  const isOidcUser = wasOidcUser || auth.strategies?.oidc === true;
   if (isOidcUser) {
+    // The login view uses this same-tab marker to avoid immediately starting a
+    // new OIDC flow when the IdP redirects the browser back after logout.
+    window.sessionStorage.setItem('oidcSignedOut', '1');
     const base = apiBase || '';
     const returnTo = '/auth/login';
     const logoutUrl = `${base}/logout?returnTo=${encodeURIComponent(returnTo)}`;
@@ -97,6 +93,12 @@ const handleLogout = async () => {
     return;
   }
 
+  try {
+    await auth.logout();
+  } catch (_) {
+    // Nothing to recover from here.
+  }
+
   router.push({ name: 'auth-login' });
 };
 </script>
@@ -153,17 +155,22 @@ const handleLogout = async () => {
         </transition>
       </div>
 
-      <div
+      <button
         type="button"
         class="group flex w-full items-center gap-3 text-left transition"
         @click="toggleMenu"
         :aria-expanded="isExpanded"
       >
+        <!-- Named "Account" followed by the name and address it shows, so voice
+             control answers to what is on screen. The avatar only repeats the
+             name beside it. -->
+        <span class="sr-only">{{ $t('user.account') }}</span>
         <span
+          aria-hidden="true"
           class="flex h-9 w-9 items-center justify-center rounded-full bg-accent/15 text-base font-semibold uppercase text-accent transition group-hover:bg-accent/25 dark:bg-white/10 dark:text-white dark:group-hover:bg-white/20"
         >
           <template v-if="avatarUrl">
-            <img :src="avatarUrl" alt="User avatar" class="h-9 w-9 rounded-full object-cover" />
+            <img :src="avatarUrl" alt="" class="h-9 w-9 rounded-full object-cover" />
           </template>
           <template v-else-if="avatarLetter">{{ avatarLetter }}</template>
           <UserCircleIcon v-else class="h-6 w-6" />
@@ -182,7 +189,7 @@ const handleLogout = async () => {
           class="h-3 w-3 text-neutral-400 transition group-hover:text-neutral-700 dark:text-white/60 dark:group-hover:text-white/80"
           :class="{ 'rotate-180': isExpanded }"
         />
-      </div>
+      </button>
     </div>
   </div>
 </template>
diff --git a/frontend/src/components/VolMenu.vue b/frontend/src/components/VolMenu.vue
index 2602b1324..e49077b4e 100644
--- a/frontend/src/components/VolMenu.vue
+++ b/frontend/src/components/VolMenu.vue
@@ -1,22 +1,28 @@
 <script setup>
 import { ServerIcon, ChevronDownIcon } from '@heroicons/vue/24/outline';
-import ReadOnlyMark from '@/components/ReadOnlyMark.vue';
-import { getVolumes } from '@/api';
 import { ref, onMounted, computed } from 'vue';
 import { useRoute } from 'vue-router';
+import { useI18n } from 'vue-i18n';
 import { useNavigation } from '@/composables/navigation';
 import { useFeaturesStore } from '@/stores/features';
+import { useVolumeUsageStore } from '@/stores/volumeUsage';
 import { FolderIcon } from '@heroicons/vue/24/outline';
+import VolumeUsageBar from '@/components/VolumeUsageBar.vue';
+import ReadOnlyMark from '@/components/ReadOnlyMark.vue';
 
+const { t } = useI18n();
 const { openItem, openBreadcrumb } = useNavigation();
 const route = useRoute();
 const featuresStore = useFeaturesStore();
-
-const volumes = ref([]);
+const volumeUsageStore = useVolumeUsageStore();
+const volumes = computed(() => volumeUsageStore.volumes);
+const usage = computed(() => volumeUsageStore.usage);
+const showVolumeUsage = computed(() => featuresStore.volumeUsageEnabled);
 
 onMounted(async () => {
   try {
-    volumes.value = await getVolumes();
+    await featuresStore.ensureLoaded();
+    await volumeUsageStore.loadVolumes();
   } catch (error) {
     console.error('Failed to load volumes', error);
   }
@@ -74,6 +80,7 @@ const openPersonal = () => {
     >
       {{ $t('titles.locations') }}
       <button
+        :aria-label="t('common.toggleSection')"
         @click="open = !open"
         class="hidden group-hover:block active:text-black dark:active:text-white text-neutral-500"
       >
@@ -85,12 +92,12 @@ const openPersonal = () => {
     </h4>
     <div class="overflow-hidden">
       <transition
-        enter-active-class="transition-all duration-500"
-        leave-active-class="transition-all duration-500"
-        enter-from-class="-mt-[100%]"
-        enter-to-class="mt-0"
-        leave-from-class="mt-0"
-        leave-to-class="-mt-[100%]"
+        enter-active-class="transition-[max-height,opacity] duration-300 ease-out"
+        leave-active-class="transition-[max-height,opacity] duration-200 ease-in"
+        enter-from-class="max-h-0 opacity-0"
+        enter-to-class="max-h-96 opacity-100"
+        leave-from-class="max-h-96 opacity-100"
+        leave-to-class="max-h-0 opacity-0"
       >
         <div v-if="open" class="overflow-hidden">
           <button
@@ -98,13 +105,38 @@ const openPersonal = () => {
             :key="volume.name"
             @click="openItem(volume)"
             :class="[
-              'cursor-pointer flex w-full items-center gap-3 my-3 rounded-lg transition-colors duration-200 text-sm',
+              'cursor-pointer flex w-full gap-3 my-3 rounded-lg text-left transition-colors duration-200 text-sm',
+              showVolumeUsage ? 'items-start' : 'items-center',
               isActiveVolume(volume.name) ? 'dark:text-white' : 'dark:text-neutral-300/90',
             ]"
           >
-            <ServerIcon class="h-[1.38rem]" />
-            <span class="truncate">{{ volume.name }}</span>
-            <ReadOnlyMark :reason="volume.readOnly" />
+            <ServerIcon :class="showVolumeUsage ? 'mt-px h-7 shrink-0' : 'h-[1.38rem] shrink-0'" />
+            <div
+              :class="
+                showVolumeUsage
+                  ? 'flex h-7 min-w-0 flex-1 flex-col justify-between gap-1'
+                  : 'min-w-0 flex-1'
+              "
+            >
+              <span
+                :class="
+                  showVolumeUsage
+                    ? 'flex w-full min-w-0 items-center gap-1.5 !text-left leading-none'
+                    : 'flex min-w-0 items-center gap-1.5'
+                "
+                style="text-align: left"
+              >
+                <span class="min-w-0 truncate">{{ volume.name }}</span>
+                <ReadOnlyMark :reason="volume.readOnly" />
+              </span>
+              <VolumeUsageBar
+                v-if="showVolumeUsage"
+                :usage="usage[volume.path]"
+                :loading="volumeUsageStore.isLoadingUsage"
+                compact
+                class="w-full"
+              />
+            </div>
           </button>
         </div>
       </transition>
diff --git a/frontend/src/components/VolumeUsageBar.vue b/frontend/src/components/VolumeUsageBar.vue
new file mode 100644
index 000000000..9486b7018
--- /dev/null
+++ b/frontend/src/components/VolumeUsageBar.vue
@@ -0,0 +1,115 @@
+<script setup>
+import { computed } from 'vue';
+import { formatBytes } from '@/utils';
+
+const props = defineProps({
+  usage: { type: Object, default: null },
+  compact: { type: Boolean, default: false },
+  loading: { type: Boolean, default: false },
+  percentInside: { type: Boolean, default: false },
+});
+
+const used = computed(() => Number(props.usage?.used ?? props.usage?.size) || 0);
+const total = computed(() => Number(props.usage?.total) || 0);
+const free = computed(() => Number(props.usage?.free) || 0);
+
+const percentUsed = computed(() => {
+  if (total.value <= 0) return 0;
+  return Math.max(
+    0,
+    Math.min(100, Number(props.usage?.percentUsed) || (used.value / total.value) * 100)
+  );
+});
+
+const percentLabel = computed(() => `${Math.round(percentUsed.value)}%`);
+const title = computed(() => {
+  if (total.value <= 0) return '';
+  return `${formatBytes(used.value)} / ${formatBytes(total.value)} (${percentLabel.value}) · ${formatBytes(free.value)}`;
+});
+
+const progressColors = computed(() => {
+  const pct = percentUsed.value;
+  if (pct >= 92) {
+    return ['#ef4444', '#e11d48'];
+  }
+  if (pct >= 84) {
+    return ['#fb923c', '#ef4444'];
+  }
+  if (pct >= 72) {
+    return ['#fde047', '#fb923c'];
+  }
+  return ['#22d3ee', '#3b82f6'];
+});
+
+const barGradient = computed(() => {
+  const [start, end] = progressColors.value;
+  return `linear-gradient(90deg, ${start} 0%, ${end} 100%)`;
+});
+
+const fillStyle = computed(() => {
+  return {
+    width: `${percentUsed.value}%`,
+    background: barGradient.value,
+  };
+});
+
+const showUsage = computed(() => total.value > 0);
+
+// The label is centered in the track. Below 50%, it sits on the unfilled part;
+// otherwise it sits on the colored fill.
+const percentLabelClass = computed(() => {
+  if (percentUsed.value < 50) {
+    return 'text-neutral-950 dark:text-white';
+  }
+  return 'text-white';
+});
+</script>
+
+<template>
+  <div class="min-w-0 select-none" :title="title">
+    <div
+      v-if="loading && !showUsage"
+      class="h-2.5 overflow-hidden rounded-md bg-neutral-200 dark:bg-neutral-700"
+    >
+      <div class="h-full w-1/2 animate-pulse bg-neutral-300 dark:bg-neutral-600"></div>
+    </div>
+
+    <template v-else-if="showUsage">
+      <div class="flex items-center gap-2" :class="compact ? 'mb-0' : 'mb-1.5'">
+        <div
+          class="relative min-w-0 flex-1 overflow-hidden rounded-md bg-neutral-200/90 shadow-inner ring-1 ring-black/5 dark:bg-neutral-700/80 dark:ring-white/10"
+          :class="compact ? 'h-2.5' : 'h-3'"
+        >
+          <div
+            class="h-full rounded-md shadow-[inset_0_1px_0_rgba(255,255,255,0.35)] transition-[width] duration-500 ease-out"
+            :style="fillStyle"
+          ></div>
+          <span
+            v-if="percentInside || compact"
+            :class="[
+              'absolute inset-0 flex items-center justify-center font-semibold leading-none tabular-nums',
+              compact ? 'text-[0.58rem]' : 'text-[0.65rem]',
+              percentLabelClass,
+            ]"
+          >
+            {{ percentLabel }}
+          </span>
+        </div>
+        <span
+          v-if="!percentInside && !compact"
+          class="shrink-0 text-xs font-medium tabular-nums text-neutral-600 dark:text-neutral-300"
+        >
+          {{ percentLabel }}
+        </span>
+      </div>
+
+      <div
+        v-if="!compact"
+        class="flex items-center justify-between gap-3 text-[0.68rem] leading-none text-neutral-500 dark:text-neutral-400"
+      >
+        <span class="truncate tabular-nums">{{ formatBytes(used) }}</span>
+        <span class="truncate tabular-nums">{{ formatBytes(total) }}</span>
+      </div>
+    </template>
+  </div>
+</template>
diff --git a/frontend/src/components/shares/ShareListState.vue b/frontend/src/components/shares/ShareListState.vue
new file mode 100644
index 000000000..96f4274a9
--- /dev/null
+++ b/frontend/src/components/shares/ShareListState.vue
@@ -0,0 +1,45 @@
+<script setup>
+import { useI18n } from 'vue-i18n';
+import { ShareIcon } from '@heroicons/vue/24/outline';
+
+/**
+ * What a list of share links shows when it is not showing links: still
+ * loading, failed to load, or genuinely empty.
+ *
+ * The third is the one worth having a component for. An empty list rendered as
+ * an empty page reads as a broken screen, and both lists said so in their own
+ * copy of the same twenty-six lines.
+ */
+defineProps({
+  loading: { type: Boolean, default: false },
+  /** The message to show, or empty when nothing went wrong. */
+  error: { type: String, default: '' },
+  empty: { type: Boolean, default: false },
+  /** Already translated: each list says what it has none of. */
+  emptyText: { type: String, required: true },
+});
+
+const emit = defineEmits(['retry']);
+
+const { t } = useI18n();
+</script>
+
+<template>
+  <div v-if="loading" class="flex h-full items-center justify-center">
+    <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-blue-500"></div>
+  </div>
+
+  <div v-else-if="error" class="flex h-full flex-col items-center justify-center text-red-500">
+    <p>{{ error }}</p>
+    <button @click="emit('retry')" class="mt-2 text-blue-500 hover:underline">
+      {{ t('common.tryAgain') }}
+    </button>
+  </div>
+
+  <div v-else-if="empty" class="flex h-full flex-col items-center justify-center text-neutral-400">
+    <ShareIcon class="w-16 h-16 mb-4 opacity-20" />
+    <p>{{ emptyText }}</p>
+  </div>
+
+  <slot v-else />
+</template>
diff --git a/frontend/src/components/shares/ShareListToolbar.vue b/frontend/src/components/shares/ShareListToolbar.vue
new file mode 100644
index 000000000..0c09f63c7
--- /dev/null
+++ b/frontend/src/components/shares/ShareListToolbar.vue
@@ -0,0 +1,84 @@
+<script setup>
+import { useI18n } from 'vue-i18n';
+import { MagnifyingGlassIcon, ArrowsUpDownIcon } from '@heroicons/vue/24/outline';
+
+/**
+ * The bar above both lists of share links: a title, three filters, a sort
+ * toggle and a search box.
+ *
+ * It was written twice, seventy-seven lines each, and the copies had already
+ * begun to drift — one list is a hundred and sixty pixels wider than the other
+ * for no reason anybody wrote down. Whatever a screen wants to put after the
+ * search box goes in the slot; everything before it is the same on both.
+ */
+defineProps({
+  /** Already translated: the two screens name themselves differently. */
+  title: { type: String, required: true },
+});
+
+const filterMode = defineModel('filterMode', { type: String, required: true });
+const sortMode = defineModel('sortMode', { type: String, required: true });
+const searchQuery = defineModel('searchQuery', { type: String, required: true });
+
+const { t } = useI18n();
+
+const FILTER_MODES = ['active', 'expired', 'all'];
+</script>
+
+<template>
+  <div
+    class="z-10 p-3 pl-12 lg:pl-3 border-b border-neutral-200 dark:border-neutral-800 bg-white dark:bg-default"
+  >
+    <div class="flex items-center gap-3">
+      <div class="flex items-center gap-2 mr-4">
+        <h1 class="font-medium text-neutral-800 dark:text-neutral-200 hidden sm:block text-lg ml-2">
+          {{ title }}
+        </h1>
+      </div>
+
+      <div class="flex items-center bg-neutral-100 dark:bg-neutral-800 rounded-md p-0.5">
+        <button
+          v-for="mode in FILTER_MODES"
+          :key="mode"
+          @click="filterMode = mode"
+          class="px-3 py-1 text-xs font-medium rounded-sm transition-colors"
+          :class="
+            filterMode === mode
+              ? 'bg-white dark:bg-neutral-700 text-neutral-900 dark:text-neutral-100 shadow-sm'
+              : 'text-neutral-500 dark:text-neutral-400 hover:text-neutral-700 dark:hover:text-neutral-300'
+          "
+        >
+          {{ t(`common.${mode}`) }}
+        </button>
+      </div>
+
+      <div class="h-6 w-px bg-neutral-200 dark:bg-neutral-700 mx-1"></div>
+
+      <div class="flex items-center gap-2">
+        <button
+          @click="sortMode = sortMode === 'recent' ? 'label' : 'recent'"
+          class="p-1.5 rounded-md hover:bg-neutral-100 dark:hover:bg-neutral-800 text-neutral-500 dark:text-neutral-400"
+          :title="t('actions.sortBy')"
+        >
+          <ArrowsUpDownIcon class="w-5 h-5" />
+        </button>
+      </div>
+
+      <div class="flex-1"></div>
+
+      <div class="relative">
+        <MagnifyingGlassIcon
+          class="absolute left-2.5 top-1/2 -translate-y-1/2 w-4 h-4 text-neutral-400"
+        />
+        <input
+          v-model="searchQuery"
+          type="text"
+          :placeholder="t('share.filterByNameOrPath')"
+          class="pl-9 pr-3 py-1.5 text-sm bg-neutral-100 dark:bg-neutral-800 rounded-md border-none focus:ring-2 focus:ring-blue-500 w-48 transition-all focus:w-64"
+        />
+      </div>
+
+      <slot name="after-search" />
+    </div>
+  </div>
+</template>
diff --git a/frontend/src/composables/navigation.js b/frontend/src/composables/navigation.js
index 3274d6ba2..ea01069a9 100644
--- a/frontend/src/composables/navigation.js
+++ b/frontend/src/composables/navigation.js
@@ -5,6 +5,10 @@ import { usePreviewManager } from '@/plugins/preview/manager';
 import { useAppSettings } from '@/stores/appSettings';
 import { documentRoute } from '@/utils/documentRoute';
 
+// Kept beside the markdown preview plugin's own list, which matches the same
+// two extensions.
+const MARKDOWN_EXTENSIONS = ['md', 'markdown'];
+
 export function useNavigation() {
   const router = useRouter();
   const route = useRoute();
@@ -46,6 +50,16 @@ export function useNavigation() {
     const extensionFromName = name.includes('.') ? name.split('.').pop().toLowerCase() : '';
     const editable =
       isEditableExtension(extensionFromKind) || isEditableExtension(extensionFromName);
+
+    // Markdown is the one kind of file that has both a preview and an editor,
+    // so it is the only one where opening it is a choice. Whoever mostly writes
+    // markdown was going through the preview and clicking Edit every time; this
+    // sends them straight where they were heading. Everything else keeps
+    // preview-first: an image or a video has no editor to go to.
+    const opensInEditor =
+      appSettings.userSettings?.markdownOpensInEditor &&
+      (MARKDOWN_EXTENSIONS.includes(extensionFromKind) ||
+        MARKDOWN_EXTENSIONS.includes(extensionFromName));
     const basePath = item.path ? `${item.path}/${name}` : name;
     const fullPath = basePath.replace(/^\/+/, '');
     const encodedPath = fullPath.split('/').map(encodeURIComponent).join('/');
@@ -60,10 +74,10 @@ export function useNavigation() {
     // being handed one of them instead of this page filling itself.
     if (appSettings.userSettings?.documentsOpenInNewTab) {
       // Asked once: matching a plugin builds a context and walks the list.
-      const previewable = Boolean(previewManager.findPlugin(item));
+      const previewable = !opensInEditor && Boolean(previewManager.findPlugin(item));
       const target = previewable
         ? documentRoute(fullPath)
-        : editable
+        : opensInEditor || editable
           ? { path: `/editor/${encodedPath}` }
           : null;
 
@@ -76,7 +90,7 @@ export function useNavigation() {
     }
 
     // Files: try preview first (no view transition – avoids double animations)
-    if (previewManager.open(item)) {
+    if (!opensInEditor && previewManager.open(item)) {
       return;
     }
 
diff --git a/frontend/src/composables/shareList.js b/frontend/src/composables/shareList.js
new file mode 100644
index 000000000..926448022
--- /dev/null
+++ b/frontend/src/composables/shareList.js
@@ -0,0 +1,69 @@
+import { computed, ref } from 'vue';
+
+/**
+ * Filtering, searching and ordering a list of share links.
+ *
+ * Both share screens want exactly this, and both had their own copy. They are
+ * not identical copies, which is the reason for the parameters: one list is
+ * searched by the name of the file a link points at and the other by its path,
+ * and "most recent" counts a download on the links you handed out but has
+ * nothing to count on the ones you received.
+ *
+ * An extraction that assumed the duplication was exact would have quietly
+ * flattened both of those.
+ *
+ * @param {import('vue').Ref<Array>} shares
+ * @param {object} options
+ * @param {(share: object) => string} options.labelOf what a link is called —
+ *   searched, and what sorting by name sorts by
+ * @param {(share: object) => string} options.searchAlso the other thing worth
+ *   typing to find a link: where it points
+ * @param {string[]} options.recentFields the fields that can hold "when
+ *   something last happened to this link", most meaningful first
+ */
+export const useShareList = (shares, { labelOf, searchAlso, recentFields }) => {
+  const filterMode = ref('active'); // 'active' | 'expired' | 'all'
+  const sortMode = ref('recent'); // 'recent' | 'label'
+  const searchQuery = ref('');
+
+  const isExpired = (share) => {
+    if (!share?.expiresAt) return false;
+    return new Date(share.expiresAt) <= new Date();
+  };
+
+  const recentTimestamp = (share) => {
+    if (!share) return 0;
+    for (const field of recentFields) {
+      const raw = share[field];
+      if (!raw) continue;
+      const time = new Date(raw).getTime();
+      if (!Number.isNaN(time)) return time;
+    }
+    return 0;
+  };
+
+  const visibleShares = computed(() => {
+    let list = shares.value.slice();
+
+    if (filterMode.value === 'active') list = list.filter((share) => !isExpired(share));
+    else if (filterMode.value === 'expired') list = list.filter((share) => isExpired(share));
+
+    const term = searchQuery.value.trim().toLowerCase();
+    if (term) {
+      list = list.filter((share) => {
+        const label = (labelOf(share) || '').toLowerCase();
+        const other = (searchAlso(share) || '').toLowerCase();
+        return label.includes(term) || other.includes(term);
+      });
+    }
+
+    list.sort((a, b) => {
+      if (sortMode.value === 'label') return labelOf(a).localeCompare(labelOf(b));
+      return recentTimestamp(b) - recentTimestamp(a);
+    });
+
+    return list;
+  });
+
+  return { filterMode, sortMode, searchQuery, isExpired, visibleShares };
+};
diff --git a/frontend/src/composables/useDestinationPicker.js b/frontend/src/composables/useDestinationPicker.js
new file mode 100644
index 000000000..b3bcd159f
--- /dev/null
+++ b/frontend/src/composables/useDestinationPicker.js
@@ -0,0 +1,65 @@
+import { ref } from 'vue';
+
+/**
+ * Shared state for the "Move to" / "Copy to" dialog.
+ *
+ * The dialog outlives the menu that asks for it — a context menu closes the
+ * moment something is clicked — so it is mounted once with the layout and
+ * opened from anywhere through this. Singleton for the same reason the favorite
+ * editor is one: two of these on screen would be two answers to one question.
+ */
+
+let instance = null;
+
+export function useDestinationPicker() {
+  if (instance) return instance;
+
+  const isOpen = ref(false);
+  const mode = ref('move');
+  const items = ref([]);
+  const initialPath = ref('');
+  let resolveChoice = null;
+
+  /**
+   * Ask where to put things.
+   *
+   * @returns {Promise<string|null>} The chosen folder, or null if the person
+   *   closed the dialog — which callers must treat as "do nothing", not as an
+   *   error and not as the root folder.
+   */
+  const pick = ({ mode: requestedMode = 'move', items: requestedItems = [], from = '' } = {}) => {
+    // A second request replaces the first rather than queueing behind it; the
+    // earlier caller is told nothing was chosen.
+    resolveChoice?.(null);
+
+    // `version-copy` puts an earlier version of a file into a folder; `file`
+    // asks for an existing file rather than a folder, to put a version over it.
+    mode.value = ['copy', 'restore', 'version-copy', 'file', 'extract'].includes(requestedMode)
+      ? requestedMode
+      : 'move';
+    items.value = Array.isArray(requestedItems) ? requestedItems : [];
+    initialPath.value = from || '';
+    isOpen.value = true;
+
+    return new Promise((resolve) => {
+      resolveChoice = resolve;
+    });
+  };
+
+  const choose = (path) => {
+    const resolver = resolveChoice;
+    resolveChoice = null;
+    isOpen.value = false;
+    resolver?.(path || null);
+  };
+
+  /** Closing without choosing has to settle the promise too. */
+  const dismiss = () => {
+    const resolver = resolveChoice;
+    resolveChoice = null;
+    resolver?.(null);
+  };
+
+  instance = { isOpen, mode, items, initialPath, pick, choose, dismiss };
+  return instance;
+}
diff --git a/frontend/src/composables/useFavoriteEditor.js b/frontend/src/composables/useFavoriteEditor.js
index 5be6368be..436352c4e 100644
--- a/frontend/src/composables/useFavoriteEditor.js
+++ b/frontend/src/composables/useFavoriteEditor.js
@@ -1,5 +1,6 @@
 import { ref } from 'vue';
 import { useFavoritesStore } from '@/stores/favorites';
+import { normalizeIconVariant } from '@/utils/favoriteIcons';
 
 // Singleton instance so multiple callers share the same modal state
 let instance = null;
@@ -14,7 +15,7 @@ export function useFavoriteEditor() {
   const editorName = ref('');
   const editorPath = ref('');
   const editorIcon = ref('');
-  const editorIconVariant = ref('outline-solid');
+  const editorIconVariant = ref('outline');
   const editorColor = ref(null);
   const isSaving = ref(false);
 
@@ -29,10 +30,10 @@ export function useFavoriteEditor() {
     const iconStr = favorite.icon || 'outline:StarIcon';
     if (iconStr.includes(':')) {
       const [variant, iconName] = iconStr.split(':', 2);
-      editorIconVariant.value = variant.toLowerCase();
+      editorIconVariant.value = normalizeIconVariant(variant);
       editorIcon.value = iconName.trim();
     } else {
-      editorIconVariant.value = 'outline-solid';
+      editorIconVariant.value = 'outline';
       editorIcon.value = iconStr;
     }
 
diff --git a/frontend/src/i18n/locales/de.json b/frontend/src/i18n/locales/de.json
index 871c957ed..e9d296255 100644
--- a/frontend/src/i18n/locales/de.json
+++ b/frontend/src/i18n/locales/de.json
@@ -72,7 +72,9 @@
     "readwrite": "Lesen/Schreiben",
     "add": "Hinzufügen",
     "back": "Zurück",
-    "logoAlt": "Logo von {name}"
+    "logoAlt": "Logo von {name}",
+    "toggleSection": "Abschnitt ein-/ausklappen",
+    "dismissWarning": "Warnung ausblenden"
   },
   "editor": {
     "editing": "Editing",
@@ -169,12 +171,14 @@
     "saveVolume": "Failed to save volume",
     "removeVolume": "Failed to remove volume",
     "totpCodeRequired": "Geben Sie den Code ein.",
-    "identifierRequired": "E-Mail-Adresse oder Benutzername ist erforderlich"
+    "identifierRequired": "E-Mail-Adresse oder Benutzername ist erforderlich",
+    "unlockUser": "Das Konto konnte nicht entsperrt werden"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "Authentifizierung erforderlich",
     "AUTH_INVALID_CREDENTIALS": "Ungültige E-Mail oder Passwort",
     "AUTH_ACCOUNT_LOCKED": "Das Konto ist aufgrund fehlgeschlagener Anmeldeversuche vorübergehend gesperrt",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "Konto nach zu vielen fehlgeschlagenen Anmeldeversuchen gesperrt. Versuchen Sie es in {minutes} Minute erneut | Konto nach zu vielen fehlgeschlagenen Anmeldeversuchen gesperrt. Versuchen Sie es in {minutes} Minuten erneut",
     "AUTH_PASSWORD_INCORRECT": "Das aktuelle Passwort ist falsch",
     "VALIDATION_EMAIL_REQUIRED": "E-Mail ist erforderlich",
     "VALIDATION_PASSWORD_REQUIRED": "Passwort ist erforderlich",
@@ -215,7 +219,14 @@
     "searching": "Suche läuft…",
     "noMatches": "Keine Treffer gefunden",
     "openFolder": "Ordner öffnen",
-    "line": "Zeile"
+    "line": "Zeile",
+    "matchedByName": "Name",
+    "matchedByContent": "Inhalt",
+    "matchedByBoth": "Name und Inhalt",
+    "stoppedEarly": "Beim Zeitlimit abgebrochen — das ist, was bisher gefunden wurde.",
+    "firstOnly": "Die ersten {count} Ergebnisse. Grenzen Sie die Suche ein, um mehr zu sehen.",
+    "tooShort": "Geben Sie mindestens {count} Zeichen ein.",
+    "showMore": "Mehr anzeigen"
   },
   "user": {
     "account": "Konto",
@@ -308,7 +319,8 @@
     "emptyTitle": "Noch keine Favoriten",
     "emptyDescription": "Wählen Sie ein Verzeichnis aus und klicken Sie im Haupttoolbereich auf den Stern, um es hier anzupinnen.",
     "editTitle": "Favorit bearbeiten",
-    "icon": "Symbol"
+    "icon": "Symbol",
+    "volumeUnavailable": "Volume nicht verfügbar — es ist nicht eingebunden oder nicht mehr konfiguriert."
   },
   "notifications": {
     "open": "Benachrichtigungen öffnen",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "Tippen, um innerhalb zu suchen"
+    "hintWithin": "Tippen, um innerhalb zu suchen",
+    "hintPattern": "Mit * und ? nach Dateinamen filtern, zum Beispiel *.ps1"
   },
   "download": {
     "preparing": "Download wird vorbereitet..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "Zeigt Dateien und Ordner an, die den konfigurierten versteckten Mustern ({patterns}) entsprechen.",
       "showThumbnails": "Vorschaubilder anzeigen",
       "showThumbnailsHelp": "Zeigt Vorschaubilder für Bilder und Videos im Explorer an.",
+      "markdownOpensInEditor": "Markdown im Editor öffnen",
+      "markdownOpensInEditorHelp": "Ein Doppelklick auf eine .md-Datei öffnet direkt den Editor statt der Vorschau.",
       "showSidebarFavorites": "Favoritenbereich anzeigen",
       "showSidebarFavoritesHelp": "Zeigt Favoriten in der linken Seitenleiste an.",
       "showSidebarShares": "Freigabenbereich anzeigen",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "Zeigt Werkzeuge in der linken Seitenleiste an.",
       "defaultShareExpiration": "Standard-Ablaufdatum für Freigaben",
       "defaultShareExpirationHelp": "Legen Sie einen Standardzeitraum für neue Freigaben fest. Das Ablaufdatum wird beim Erstellen automatisch entsprechend vorbelegt.",
+      "defaultShareExpirationInvalid": "Geben Sie eine ganze Zahl ab 1 ein, oder leeren Sie das Feld, um keinen Standard festzulegen.",
       "expirationValue": "Wert",
       "days": "Tage",
       "weeks": "Wochen",
@@ -517,10 +533,16 @@
       "skipHome": "Startseite überspringen",
       "skipHomeHelp": "Leitet beim Besuch der Startseite automatisch zur ersten Volume weiter. Wenn nicht gesetzt, wird die Serverkonfiguration verwendet.",
       "useEnvSetting": "Servereinstellung verwenden",
-      "showVersionMarks": "Dateien mit Versionen kennzeichnen",
-      "showVersionMarksHelp": "Ein kleines Zeichen in der Liste bei Dateien mit früheren Versionen, mit deren Anzahl. Ein Klick öffnet den Verlauf.",
+      "defaultView": "Standardansicht",
+      "defaultViewHelp": "Die Ansicht für Ordner ohne eigene gespeicherte Ansicht.",
+      "viewGrid": "Raster",
+      "viewList": "Liste",
+      "viewColumns": "Spalten",
+      "viewPhotos": "Fotos",
       "documentsOpenInNewTab": "Dokumente in einem neuen Tab öffnen",
       "documentsOpenInNewTabHelp": "Eine Datei bekommt beim Öffnen einen eigenen Browser-Tab, sodass mehrere offen bleiben, während Sie weiter stöbern. Aus öffnet sie sich wie bisher über dem Ordner.",
+      "showVersionMarks": "Dateien mit Versionen kennzeichnen",
+      "showVersionMarksHelp": "Ein kleines Zeichen in der Liste bei Dateien mit früheren Versionen, mit deren Anzahl. Ein Klick öffnet den Verlauf.",
       "languageHelp": "Wird bei Ihrem Konto gespeichert, in jedem Browser, in dem Sie sich anmelden."
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "Maximale Abmessung",
       "maxDimHelp": "Längste Seite in Pixeln. Standard ist 200.",
       "concurrency": "Parallele Generierung",
-      "concurrencyHelp": "Anzahl der gleichzeitig zu generierenden Miniaturen (1–50). Standard ist 10."
+      "concurrencyHelp": "Anzahl der gleichzeitig zu generierenden Miniaturen (1–50). Standard ist 10.",
+      "invalid": "Prüfen Sie die Werte: Qualität 1 bis 100, maximale Abmessung 64 bis 1024 px, parallele Generierung 1 bis 50."
     },
     "security": {
       "subtitle": "Steuern Sie den Zugriff auf die App.",
@@ -556,7 +579,9 @@
       "pathInvalid": "Dieser Pfad liegt in keinem Volume, daher greift die Regel nie.",
       "pathMissing": "Unter diesem Pfad gibt es keinen Ordner. Eine Regel verwendet den Pfad so, wie NextExplorer ihn anzeigt, beginnend mit dem Namen des Volumes.",
       "useSuggestion": "{path} verwenden",
-      "title": "Zugriff"
+      "title": "Zugriff",
+      "pickFolderTitle": "Ordner für diese Regel",
+      "appliesToAdminsHint": "Auch Administratoren an diese Regel binden."
     },
     "comingSoon": {
       "subtitle": "Dieser Einstellungsbereich wird derzeit entwickelt. Bleiben Sie dran!"
@@ -604,7 +629,9 @@
       "volumePath": "Volumenpfad",
       "pathCannotChange": "Der Pfad kann nach der Erstellung nicht mehr geändert werden. Entfernen Sie dieses Volume und erstellen Sie bei Bedarf ein neues.",
       "accessMode": "Zugriffsmodus",
-      "noUsers": "Keine Benutzer verfügbar"
+      "noUsers": "Keine Benutzer verfügbar",
+      "lockedBadge": "Gesperrt",
+      "lockedUntil": "Gesperrt bis {time}"
     },
     "userDetails": {
       "profileTab": "Profile",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC Provider",
       "oidcLinkedProfile": "Linked Profile",
-      "noOidcProfileMessage": "No OIDC profiles linked to this account."
+      "noOidcProfileMessage": "No OIDC profiles linked to this account.",
+      "signInLock": "Anmeldesperre",
+      "lockedHint": "Nach zu vielen fehlgeschlagenen Anmeldeversuchen gesperrt. Die Sperre endet von selbst um {time}.",
+      "notLockedHint": "Nicht gesperrt. Zu viele fehlgeschlagene Anmeldeversuche sperren ein Konto für eine Weile.",
+      "unlock": "Jetzt entsperren"
     },
     "trash": {
       "title": "Papierkorb und Versionen",
@@ -1023,7 +1054,8 @@
       "auto": "Automatisch",
       "inline": "Anzeigen",
       "raw": "Roh",
-      "download": "Herunterladen"
+      "download": "Herunterladen",
+      "editor": "Editor"
     },
     "deleteShareTitle": "Freigabe entfernen?",
     "deleteShareMessage": "Personen mit diesem Link können nicht mehr auf das freigegebene Element zugreifen.",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "Benutzer werden geladen...",
     "password": "Passwort",
     "protected": "Geschützt",
-    "sharedWith": "Geteilt mit"
+    "sharedWith": "Geteilt mit",
+    "editShareLink": "Freigabelink bearbeiten",
+    "saveShare": "Änderungen speichern",
+    "advancedPermissions": "Erweitert",
+    "allowDelete": "Löschen von Dateien erlauben",
+    "allowCreateFolder": "Erstellen von Ordnern erlauben",
+    "allowCreateFile": "Erstellen von Dateien erlauben",
+    "allowUpload": "Hochladen von Dateien und Ordnern erlauben",
+    "activity": "Aktivität",
+    "activityDetails": "Aktivitätsdetails",
+    "accesses": "Zugriffe",
+    "downloads": "Downloads",
+    "accessCount": "Anzahl der Zugriffe",
+    "downloadCount": "Anzahl der Downloads",
+    "lastAccessIp": "Letzte Zugriffs-IP",
+    "lastDownloaded": "Zuletzt heruntergeladen",
+    "lastDownloadIp": "Letzte Download-IP",
+    "noActivity": "Nie",
+    "noIpRecorded": "Keine IP erfasst",
+    "allowDownload": "Herunterladen erlauben",
+    "allowDownloadHelp": "Ausschalten, damit die Dateien gelesen, aber nicht kopiert werden können.",
+    "versionsVisible": "Dateiversionen anzeigen",
+    "versionsVisibleHelp": "Wer diese Freigabe nutzt, sieht die früheren Versionen ihrer Dateien und kann sie wiederherstellen, wenn Bearbeiten erlaubt ist.",
+    "versionsDownload": "Herunterladen von Versionen erlauben"
   },
   "trash": {
     "title": "Papierkorb",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "Hier kann nichts {name} öffnen.",
-    "backToFolder": "Zurück zum Ordner"
+    "backToFolder": "Zurück zum Ordner",
+    "tooLargeToRenderSized": "Dieses Dokument ist {size} groß. Die Vorschau endet bei {limit}, weil sie jedes Element im Browser darstellt. Öffnen Sie es im Editor oder laden Sie es herunter.",
+    "tooLargeToRenderWithEditor": "Dieses Dokument ist {size} groß. Die Vorschau endet bei {limit}, weil sie jedes Element im Browser darstellt; der Editor öffnet bis zu {editorLimit}. Öffnen Sie es im Editor oder laden Sie es herunter.",
+    "stillRendering": "Wird dargestellt… {percent} %"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "Dieser Dateityp kann hier nicht angezeigt werden.",
     "tooBigToRead": "Zu groß für die Anzeige hier: {size}, das Limit liegt bei {ceiling}. Laden Sie die Datei herunter oder entpacken Sie sie.",
     "extract": "Hier entpacken",
+    "extractTo": "Entpacken nach…",
     "extractNamed": "{name} hier entpacken",
     "selectAll": "Alles hier auswählen",
     "selectNamed": "{name} auswählen",
@@ -1244,5 +1303,31 @@
     "empty": "Hier gibt es nichts auszuwählen",
     "breadcrumb": "Ordnerpfad",
     "chooseFolder": "Diesen Ordner wählen"
+  },
+  "destinationPicker": {
+    "moveTitle": "Verschieben nach",
+    "copyTitle": "Kopieren nach",
+    "moveHere": "Hierher verschieben",
+    "copyHere": "Hierher kopieren",
+    "noFolders": "Keine Ordner hier",
+    "rootRejected": "Wählen Sie zuerst ein Volume oder einen Ordner",
+    "itselfRejected": "Ein Ordner kann nicht in sich selbst verschoben werden",
+    "descendantRejected": "Ein Ordner kann nicht in einen seiner eigenen Ordner verschoben werden",
+    "alreadyThereRejected": "Bereits hier",
+    "restoreTitle": "Wiederherstellen nach",
+    "restoreHere": "Hier wiederherstellen",
+    "versionCopyTitle": "Kopie wiederherstellen nach",
+    "versionCopyHere": "Kopie hier wiederherstellen",
+    "replaceTitle": "Zu ersetzende Datei wählen",
+    "replaceHere": "Diese Datei ersetzen",
+    "fileRequired": "Wählen Sie eine Datei",
+    "sameFileRejected": "Wählen Sie eine andere Datei als diese",
+    "nothingHere": "Hier ist nichts",
+    "extractTitle": "Entpacken nach",
+    "extractHere": "Hierher entpacken"
+  },
+  "links": {
+    "outside": "Verknüpfung außerhalb dieses Volumes",
+    "outsideExplained": "{name} ist eine Verknüpfung zu einem Ort außerhalb dieses Volumes. Sie kann hier weder geöffnet, umbenannt noch gelöscht werden; entfernen Sie sie auf dem Server, wenn sie nicht mehr gebraucht wird."
   }
 }
diff --git a/frontend/src/i18n/locales/en.json b/frontend/src/i18n/locales/en.json
index 916db9e90..620a77f39 100644
--- a/frontend/src/i18n/locales/en.json
+++ b/frontend/src/i18n/locales/en.json
@@ -72,7 +72,9 @@
     "readwrite": "Read/Write",
     "add": "Add",
     "back": "Back",
-    "logoAlt": "{name} logo"
+    "logoAlt": "{name} logo",
+    "toggleSection": "Toggle section",
+    "dismissWarning": "Dismiss warning"
   },
   "editor": {
     "editing": "Editing",
@@ -169,12 +171,14 @@
     "saveVolume": "Failed to save volume",
     "removeVolume": "Failed to remove volume",
     "totpCodeRequired": "Enter the code.",
-    "identifierRequired": "An email address or username is required"
+    "identifierRequired": "An email address or username is required",
+    "unlockUser": "Could not unlock the account"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "Authentication required",
     "AUTH_INVALID_CREDENTIALS": "Invalid email or password",
     "AUTH_ACCOUNT_LOCKED": "Account is temporarily locked due to failed login attempts",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "Account locked after too many failed sign-in attempts. Try again in {minutes} minute | Account locked after too many failed sign-in attempts. Try again in {minutes} minutes",
     "AUTH_PASSWORD_INCORRECT": "Current password is incorrect",
     "VALIDATION_EMAIL_REQUIRED": "Email is required",
     "VALIDATION_PASSWORD_REQUIRED": "Password is required",
@@ -215,7 +219,14 @@
     "searching": "Searching…",
     "noMatches": "No matches found",
     "openFolder": "Open folder",
-    "line": "line"
+    "line": "line",
+    "matchedByName": "name",
+    "matchedByContent": "contents",
+    "matchedByBoth": "name and contents",
+    "stoppedEarly": "Stopped at its time limit — this is what was found so far.",
+    "firstOnly": "First {count} results. Narrow the search to see more.",
+    "tooShort": "Type at least {count} characters.",
+    "showMore": "Show more"
   },
   "user": {
     "account": "Account",
@@ -308,7 +319,8 @@
     "emptyTitle": "No favorites yet",
     "emptyDescription": "Select a directory and tap the star in the main toolbar to pin it here.",
     "editTitle": "Edit favorite",
-    "icon": "Icon"
+    "icon": "Icon",
+    "volumeUnavailable": "Volume unavailable — it is not mounted, or no longer configured."
   },
   "notifications": {
     "open": "Open notifications",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "Type to search within"
+    "hintWithin": "Type to search within",
+    "hintPattern": "Use * and ? to match filenames, for example *.ps1"
   },
   "download": {
     "preparing": "Preparing download..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "Display files and folders matching the configured hidden patterns ({patterns}) in the file browser.",
       "showThumbnails": "Show thumbnails",
       "showThumbnailsHelp": "Display thumbnail previews for images and videos in the file browser.",
+      "markdownOpensInEditor": "Open Markdown in the editor",
+      "markdownOpensInEditorHelp": "Double-clicking a .md file goes straight to the editor instead of the preview.",
       "showSidebarFavorites": "Show Favorites section",
       "showSidebarFavoritesHelp": "Display Favorites in the left sidebar.",
       "showSidebarShares": "Show Shares section",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "Display Tools in the left sidebar.",
       "defaultShareExpiration": "Default share expiration",
       "defaultShareExpirationHelp": "Set a default expiration period for new shares. When creating a share, the expiration date will be pre-filled based on this setting.",
+      "defaultShareExpirationInvalid": "Enter a whole number of at least 1, or clear the field for no default.",
       "expirationValue": "Value",
       "days": "Days",
       "weeks": "Weeks",
@@ -517,10 +533,16 @@
       "skipHome": "Skip home page",
       "skipHomeHelp": "Automatically redirect to the first volume when visiting the home page. If not set, follows the server configuration.",
       "useEnvSetting": "Use server setting",
-      "showVersionMarks": "Mark files that have versions",
-      "showVersionMarksHelp": "A small mark in the listing on any file with earlier versions, with how many. Click it to open the history.",
+      "defaultView": "Default view",
+      "defaultViewHelp": "The view a folder opens in when it has no remembered view of its own.",
+      "viewGrid": "Grid",
+      "viewList": "List",
+      "viewColumns": "Columns",
+      "viewPhotos": "Photos",
       "documentsOpenInNewTab": "Open documents in a new tab",
       "documentsOpenInNewTabHelp": "Opening a file gives it a browser tab of its own, so several stay open while you keep browsing. Off, it opens over the folder as it does today.",
+      "showVersionMarks": "Mark files that have versions",
+      "showVersionMarksHelp": "A small mark in the listing on any file with earlier versions, with how many. Click it to open the history.",
       "languageHelp": "Kept with your account, on every browser you sign in from."
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "Max dimension",
       "maxDimHelp": "Longest side in pixels. Default is 200.",
       "concurrency": "Parallel generation",
-      "concurrencyHelp": "Number of thumbnails to generate simultaneously (1–50). Default is 10."
+      "concurrencyHelp": "Number of thumbnails to generate simultaneously (1–50). Default is 10.",
+      "invalid": "Check the values: quality from 1 to 100, max dimension from 64 to 1024 px, parallel generation from 1 to 50."
     },
     "security": {
       "subtitle": "Control access to the app.",
@@ -556,7 +579,9 @@
       "pathInvalid": "This path is not inside a volume, so the rule will never apply.",
       "pathMissing": "No folder at this path. A rule uses the path as NextExplorer shows it, starting with the volume name.",
       "useSuggestion": "Use {path}",
-      "title": "Access"
+      "title": "Access",
+      "pickFolderTitle": "Folder for this rule",
+      "appliesToAdminsHint": "Hold administrators to this rule as well."
     },
     "comingSoon": {
       "subtitle": "This settings section is being built. Stay tuned!"
@@ -604,7 +629,9 @@
       "volumePath": "Volume Path",
       "pathCannotChange": "The path cannot be changed after creation. Remove this volume and create a new one if needed.",
       "accessMode": "Access Mode",
-      "noUsers": "No users available"
+      "noUsers": "No users available",
+      "lockedBadge": "Locked",
+      "lockedUntil": "Locked until {time}"
     },
     "userDetails": {
       "profileTab": "Profile",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC Provider",
       "oidcLinkedProfile": "Linked Profile",
-      "noOidcProfileMessage": "No OIDC profiles linked to this account."
+      "noOidcProfileMessage": "No OIDC profiles linked to this account.",
+      "signInLock": "Sign-in lock",
+      "lockedHint": "Locked after too many failed sign-in attempts. It frees itself at {time}.",
+      "notLockedHint": "Not locked. Too many failed sign-in attempts lock an account for a while.",
+      "unlock": "Unlock now"
     },
     "trash": {
       "title": "Trash and versions",
@@ -972,7 +1003,8 @@
       "auto": "Auto",
       "inline": "View",
       "raw": "Raw",
-      "download": "Download"
+      "download": "Download",
+      "editor": "Editor"
     },
     "shareLinkCreatedSuccess": "Share link created successfully!",
     "access": "Access Mode",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "Loading users...",
     "password": "Password",
     "protected": "Protected",
-    "sharedWith": "Shared with"
+    "sharedWith": "Shared with",
+    "editShareLink": "Edit share link",
+    "saveShare": "Save changes",
+    "advancedPermissions": "Advanced",
+    "allowDelete": "Allow deleting files",
+    "allowCreateFolder": "Allow creating folders",
+    "allowCreateFile": "Allow creating files",
+    "allowUpload": "Allow uploading files and folders",
+    "activity": "Activity",
+    "activityDetails": "Activity details",
+    "accesses": "accesses",
+    "downloads": "downloads",
+    "accessCount": "Access count",
+    "downloadCount": "Download count",
+    "lastAccessIp": "Last access IP",
+    "lastDownloaded": "Last downloaded",
+    "lastDownloadIp": "Last download IP",
+    "noActivity": "Never",
+    "noIpRecorded": "No IP recorded",
+    "allowDownload": "Allow downloading",
+    "allowDownloadHelp": "Turn this off to let people read the files without taking a copy.",
+    "versionsVisible": "Show file versions",
+    "versionsVisibleHelp": "People using this share see the earlier versions of its files, and can restore them if they may edit.",
+    "versionsDownload": "Allow downloading versions"
   },
   "trash": {
     "title": "Trash",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "Nothing here can open {name}.",
-    "backToFolder": "Back to the folder"
+    "backToFolder": "Back to the folder",
+    "tooLargeToRenderSized": "This document is {size}. The preview stops at {limit}, because it lays out every element in the browser. Open it in the editor or download it.",
+    "tooLargeToRenderWithEditor": "This document is {size}. The preview stops at {limit}, because it lays out every element in the browser; the editor opens up to {editorLimit}. Open it in the editor or download it.",
+    "stillRendering": "Rendering… {percent}%"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "This kind of file cannot be shown here.",
     "tooBigToRead": "Too large to show here: {size}, and up to {ceiling} can be shown. Download it or extract it to open it.",
     "extract": "Extract here",
+    "extractTo": "Extract to…",
     "extractNamed": "Extract {name} here",
     "selectAll": "Select everything here",
     "selectNamed": "Select {name}",
@@ -1244,5 +1303,31 @@
     "empty": "Nothing here to pick",
     "breadcrumb": "Folder path",
     "chooseFolder": "Choose this folder"
+  },
+  "destinationPicker": {
+    "moveTitle": "Move to",
+    "copyTitle": "Copy to",
+    "moveHere": "Move here",
+    "copyHere": "Copy here",
+    "noFolders": "No folders here",
+    "rootRejected": "Pick a volume or folder first",
+    "itselfRejected": "A folder cannot be moved into itself",
+    "descendantRejected": "A folder cannot be moved into one of its own folders",
+    "alreadyThereRejected": "Already here",
+    "restoreTitle": "Restore to",
+    "restoreHere": "Restore here",
+    "versionCopyTitle": "Restore a copy to",
+    "versionCopyHere": "Restore a copy here",
+    "replaceTitle": "Choose the file to replace",
+    "replaceHere": "Replace this file",
+    "fileRequired": "Pick a file",
+    "sameFileRejected": "Pick a file other than this one",
+    "nothingHere": "Nothing here",
+    "extractTitle": "Extract to",
+    "extractHere": "Extract here"
+  },
+  "links": {
+    "outside": "Link out of this volume",
+    "outsideExplained": "{name} is a link to a place outside this volume. It cannot be opened, renamed or deleted from here; remove it on the server if it is no longer needed."
   }
 }
diff --git a/frontend/src/i18n/locales/es.json b/frontend/src/i18n/locales/es.json
index 16aab9ac8..8f99cc12f 100644
--- a/frontend/src/i18n/locales/es.json
+++ b/frontend/src/i18n/locales/es.json
@@ -72,7 +72,9 @@
     "readwrite": "Lectura/Escritura",
     "add": "Añadir",
     "back": "Atrás",
-    "logoAlt": "Logotipo de {name}"
+    "logoAlt": "Logotipo de {name}",
+    "toggleSection": "Mostrar u ocultar la sección",
+    "dismissWarning": "Descartar el aviso"
   },
   "editor": {
     "editing": "Editing",
@@ -169,12 +171,14 @@
     "saveVolume": "",
     "removeVolume": "",
     "totpCodeRequired": "Introduzca el código.",
-    "identifierRequired": "Se requiere un correo electrónico o un nombre de usuario"
+    "identifierRequired": "Se requiere un correo electrónico o un nombre de usuario",
+    "unlockUser": "No se pudo desbloquear la cuenta"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "Se requiere autenticación",
     "AUTH_INVALID_CREDENTIALS": "Correo electrónico o contraseña no válidos",
     "AUTH_ACCOUNT_LOCKED": "La cuenta está bloqueada temporalmente debido a intentos fallidos de inicio de sesión",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "Cuenta bloqueada tras demasiados intentos fallidos de inicio de sesión. Inténtalo de nuevo en {minutes} minuto | Cuenta bloqueada tras demasiados intentos fallidos de inicio de sesión. Inténtalo de nuevo en {minutes} minutos",
     "AUTH_PASSWORD_INCORRECT": "La contraseña actual es incorrecta",
     "VALIDATION_EMAIL_REQUIRED": "El correo electrónico es obligatorio",
     "VALIDATION_PASSWORD_REQUIRED": "La contraseña es obligatoria",
@@ -215,7 +219,14 @@
     "searching": "Buscando…",
     "noMatches": "No se encontraron coincidencias",
     "openFolder": "Abrir carpeta",
-    "line": "línea"
+    "line": "línea",
+    "matchedByName": "nombre",
+    "matchedByContent": "contenido",
+    "matchedByBoth": "nombre y contenido",
+    "stoppedEarly": "Detenida al alcanzar el límite de tiempo: esto es lo encontrado hasta ahora.",
+    "firstOnly": "Los primeros {count} resultados. Acota la búsqueda para ver más.",
+    "tooShort": "Escribe al menos {count} caracteres.",
+    "showMore": "Ver más"
   },
   "user": {
     "account": "Cuenta",
@@ -308,7 +319,8 @@
     "emptyTitle": "Aún no hay favoritos",
     "emptyDescription": "Selecciona un directorio y toca la estrella en la barra de herramientas principal para fijarlo aquí.",
     "editTitle": "Editar favorito",
-    "icon": "Icono"
+    "icon": "Icono",
+    "volumeUnavailable": "Volumen no disponible: no está montado o ya no está configurado."
   },
   "notifications": {
     "open": "Abrir notificaciones",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "Escribe para buscar dentro"
+    "hintWithin": "Escribe para buscar dentro",
+    "hintPattern": "Use * y ? para filtrar nombres de archivo, por ejemplo *.ps1"
   },
   "download": {
     "preparing": "Preparando descarga..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "Muestra archivos y carpetas que coinciden con los patrones ocultos configurados ({patterns}) en el explorador.",
       "showThumbnails": "Mostrar miniaturas",
       "showThumbnailsHelp": "Muestra previsualizaciones en miniatura para imágenes y vídeos.",
+      "markdownOpensInEditor": "Abrir Markdown en el editor",
+      "markdownOpensInEditorHelp": "Al hacer doble clic en un archivo .md se abre directamente el editor en lugar de la vista previa.",
       "showSidebarFavorites": "Mostrar sección Favoritos",
       "showSidebarFavoritesHelp": "Muestra Favoritos en la barra lateral izquierda.",
       "showSidebarShares": "Mostrar sección Compartidos",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "Muestra Herramientas en la barra lateral izquierda.",
       "defaultShareExpiration": "Caducidad predeterminada para compartir",
       "defaultShareExpirationHelp": "Establece un período por defecto para nuevas comparticiones. La fecha de caducidad se rellena automáticamente basándose en este valor.",
+      "defaultShareExpirationInvalid": "Introduce un número entero de al menos 1, o vacía el campo para no tener caducidad predeterminada.",
       "expirationValue": "Valor",
       "days": "Días",
       "weeks": "Semanas",
@@ -517,10 +533,16 @@
       "skipHome": "Saltar inicio",
       "skipHomeHelp": "Redirige automáticamente a la primera unidad al visitar la pantalla de inicio. Si no se establece, usa la configuración del servidor.",
       "useEnvSetting": "Usar configuración del servidor",
-      "showVersionMarks": "Marcar los archivos con versiones",
-      "showVersionMarksHelp": "Una pequeña marca en la lista sobre los archivos con versiones anteriores, con su número. Haga clic para abrir el historial.",
+      "defaultView": "Vista predeterminada",
+      "defaultViewHelp": "La vista con la que se abre una carpeta que no tiene vista guardada.",
+      "viewGrid": "Cuadrícula",
+      "viewList": "Lista",
+      "viewColumns": "Columnas",
+      "viewPhotos": "Fotos",
       "documentsOpenInNewTab": "Abrir los documentos en una pestaña nueva",
       "documentsOpenInNewTabHelp": "Al abrir un archivo se le da su propia pestaña del navegador, así varios siguen abiertos mientras usted sigue navegando. Desactivado, se abre sobre la carpeta como hasta ahora.",
+      "showVersionMarks": "Marcar los archivos con versiones",
+      "showVersionMarksHelp": "Una pequeña marca en la lista sobre los archivos con versiones anteriores, con su número. Haga clic para abrir el historial.",
       "languageHelp": "Se guarda con su cuenta, en cualquier navegador desde el que inicie sesión."
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "Dimensión máxima",
       "maxDimHelp": "Lado más largo en píxeles. El valor predeterminado es 200.",
       "concurrency": "Generación en paralelo",
-      "concurrencyHelp": "Número de miniaturas que se generan simultáneamente (1–50). El valor predeterminado es 10."
+      "concurrencyHelp": "Número de miniaturas que se generan simultáneamente (1–50). El valor predeterminado es 10.",
+      "invalid": "Revisa los valores: calidad de 1 a 100, dimensión máxima de 64 a 1024 px, generación en paralelo de 1 a 50."
     },
     "security": {
       "subtitle": "Controla el acceso a la aplicación.",
@@ -556,7 +579,9 @@
       "pathInvalid": "Esta ruta no está dentro de ningún volumen, así que la regla nunca se aplicará.",
       "pathMissing": "No hay ninguna carpeta en esta ruta. Una regla usa la ruta tal como la muestra NextExplorer, empezando por el nombre del volumen.",
       "useSuggestion": "Usar {path}",
-      "title": "Acceso"
+      "title": "Acceso",
+      "pickFolderTitle": "Carpeta de esta regla",
+      "appliesToAdminsHint": "Someter también a los administradores a esta regla."
     },
     "comingSoon": {
       "subtitle": "Esta sección de configuración está en desarrollo. ¡Permanece atento!"
@@ -604,7 +629,9 @@
       "volumePath": "Ruta del volumen",
       "pathCannotChange": "La ruta no se puede cambiar después de la creación. Elimine este volumen y cree uno nuevo si es necesario.",
       "accessMode": "Modo de acceso",
-      "noUsers": "No hay usuarios disponibles"
+      "noUsers": "No hay usuarios disponibles",
+      "lockedBadge": "Bloqueado",
+      "lockedUntil": "Bloqueado hasta las {time}"
     },
     "userDetails": {
       "profileTab": "Profile",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC Provider",
       "oidcLinkedProfile": "Linked Profile",
-      "noOidcProfileMessage": "No OIDC profiles linked to this account."
+      "noOidcProfileMessage": "No OIDC profiles linked to this account.",
+      "signInLock": "Bloqueo de inicio de sesión",
+      "lockedHint": "Bloqueado tras demasiados intentos fallidos de inicio de sesión. Se desbloquea solo a las {time}.",
+      "notLockedHint": "No bloqueado. Demasiados intentos fallidos de inicio de sesión bloquean una cuenta durante un tiempo.",
+      "unlock": "Desbloquear ahora"
     },
     "trash": {
       "title": "Papelera y versiones",
@@ -1023,7 +1054,8 @@
       "auto": "Automático",
       "inline": "Ver",
       "raw": "Sin procesar",
-      "download": "Descargar"
+      "download": "Descargar",
+      "editor": "Editor"
     },
     "deleteShareTitle": "¿Eliminar enlace compartido?",
     "deleteShareMessage": "Las personas con este enlace ya no podrán acceder al elemento compartido.",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "Cargando usuarios...",
     "password": "Contraseña",
     "protected": "Protegido",
-    "sharedWith": "Compartido con"
+    "sharedWith": "Compartido con",
+    "editShareLink": "Editar enlace para compartir",
+    "saveShare": "Guardar cambios",
+    "advancedPermissions": "Avanzado",
+    "allowDelete": "Permitir eliminar archivos",
+    "allowCreateFolder": "Permitir crear carpetas",
+    "allowCreateFile": "Permitir crear archivos",
+    "allowUpload": "Permitir subir archivos y carpetas",
+    "activity": "Actividad",
+    "activityDetails": "Detalles de actividad",
+    "accesses": "accesos",
+    "downloads": "descargas",
+    "accessCount": "Número de accesos",
+    "downloadCount": "Número de descargas",
+    "lastAccessIp": "IP del último acceso",
+    "lastDownloaded": "Última descarga",
+    "lastDownloadIp": "IP de la última descarga",
+    "noActivity": "Nunca",
+    "noIpRecorded": "Ninguna IP registrada",
+    "allowDownload": "Permitir la descarga",
+    "allowDownloadHelp": "Desactívelo para que se puedan leer los archivos sin llevarse una copia.",
+    "versionsVisible": "Mostrar las versiones de los archivos",
+    "versionsVisibleHelp": "Quienes usan este enlace compartido ven las versiones anteriores de sus archivos y pueden restaurarlas si tienen permiso para editar.",
+    "versionsDownload": "Permitir descargar versiones"
   },
   "trash": {
     "title": "Papelera",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "Aquí nada puede abrir {name}.",
-    "backToFolder": "Volver a la carpeta"
+    "backToFolder": "Volver a la carpeta",
+    "tooLargeToRenderSized": "Este documento ocupa {size}. La vista previa se detiene en {limit}, porque compone cada elemento en el navegador. Ábralo en el editor o descárguelo.",
+    "tooLargeToRenderWithEditor": "Este documento ocupa {size}. La vista previa se detiene en {limit}, porque compone cada elemento en el navegador; el editor abre hasta {editorLimit}. Ábralo en el editor o descárguelo.",
+    "stillRendering": "Representando… {percent} %"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "Este tipo de archivo no se puede mostrar aquí.",
     "tooBigToRead": "Demasiado grande para mostrarlo aquí: {size}, el límite es {ceiling}. Descárguelo o extráigalo para abrirlo.",
     "extract": "Extraer aquí",
+    "extractTo": "Extraer en…",
     "extractNamed": "Extraer {name} aquí",
     "selectAll": "Seleccionar todo aquí",
     "selectNamed": "Seleccionar {name}",
@@ -1244,5 +1303,31 @@
     "empty": "No hay nada que elegir aquí",
     "breadcrumb": "Ruta de la carpeta",
     "chooseFolder": "Elegir esta carpeta"
+  },
+  "destinationPicker": {
+    "moveTitle": "Mover a",
+    "copyTitle": "Copiar a",
+    "moveHere": "Mover aquí",
+    "copyHere": "Copiar aquí",
+    "noFolders": "No hay carpetas aquí",
+    "rootRejected": "Elija primero un volumen o una carpeta",
+    "itselfRejected": "Una carpeta no puede moverse dentro de sí misma",
+    "descendantRejected": "Una carpeta no puede moverse a una de sus propias carpetas",
+    "alreadyThereRejected": "Ya está aquí",
+    "restoreTitle": "Restaurar en",
+    "restoreHere": "Restaurar aquí",
+    "versionCopyTitle": "Restaurar una copia en",
+    "versionCopyHere": "Restaurar una copia aquí",
+    "replaceTitle": "Elegir el archivo que se reemplazará",
+    "replaceHere": "Reemplazar este archivo",
+    "fileRequired": "Elige un archivo",
+    "sameFileRejected": "Elige un archivo distinto de este",
+    "nothingHere": "No hay nada aquí",
+    "extractTitle": "Extraer en",
+    "extractHere": "Extraer aquí"
+  },
+  "links": {
+    "outside": "Enlace fuera de este volumen",
+    "outsideExplained": "{name} es un enlace a un lugar fuera de este volumen. No se puede abrir, renombrar ni eliminar desde aquí; elimínelo en el servidor si ya no lo necesita."
   }
 }
diff --git a/frontend/src/i18n/locales/fr.json b/frontend/src/i18n/locales/fr.json
index bec144287..5a5779f8a 100644
--- a/frontend/src/i18n/locales/fr.json
+++ b/frontend/src/i18n/locales/fr.json
@@ -72,7 +72,9 @@
     "readwrite": "Lecture/Écriture",
     "add": "Ajouter",
     "back": "Retour",
-    "logoAlt": "Logo de {name}"
+    "logoAlt": "Logo de {name}",
+    "toggleSection": "Afficher ou masquer la section",
+    "dismissWarning": "Ignorer l'avertissement"
   },
   "editor": {
     "editing": "Editing",
@@ -169,12 +171,14 @@
     "saveVolume": "Failed to save volume",
     "removeVolume": "Failed to remove volume",
     "totpCodeRequired": "Saisissez le code.",
-    "identifierRequired": "Une adresse e-mail ou un nom d'utilisateur est requis"
+    "identifierRequired": "Une adresse e-mail ou un nom d'utilisateur est requis",
+    "unlockUser": "Impossible de déverrouiller le compte"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "Authentification requise",
     "AUTH_INVALID_CREDENTIALS": "E-mail ou mot de passe invalide",
     "AUTH_ACCOUNT_LOCKED": "Le compte est temporairement verrouillé en raison de tentatives de connexion échouées",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "Compte verrouillé après trop de tentatives de connexion échouées. Réessayez dans {minutes} minute | Compte verrouillé après trop de tentatives de connexion échouées. Réessayez dans {minutes} minutes",
     "AUTH_PASSWORD_INCORRECT": "Le mot de passe actuel est incorrect",
     "VALIDATION_EMAIL_REQUIRED": "L'e-mail est obligatoire",
     "VALIDATION_PASSWORD_REQUIRED": "Le mot de passe est obligatoire",
@@ -215,7 +219,14 @@
     "searching": "Recherche…",
     "noMatches": "Aucune correspondance trouvée",
     "openFolder": "Ouvrir le dossier",
-    "line": "ligne"
+    "line": "ligne",
+    "matchedByName": "nom",
+    "matchedByContent": "contenu",
+    "matchedByBoth": "nom et contenu",
+    "stoppedEarly": "Interrompue au bout du délai — voici ce qui a été trouvé.",
+    "firstOnly": "Les {count} premiers résultats. Affinez la recherche pour en voir plus.",
+    "tooShort": "Tapez au moins {count} caractères.",
+    "showMore": "Voir plus"
   },
   "user": {
     "account": "Compte",
@@ -308,7 +319,8 @@
     "emptyTitle": "Aucun favori pour le moment",
     "emptyDescription": "Sélectionnez un répertoire et appuyez sur l'étoile dans la barre d'outils principale pour l'épingler ici.",
     "editTitle": "Modifier le favori",
-    "icon": "Icône"
+    "icon": "Icône",
+    "volumeUnavailable": "Volume indisponible — il n'est pas monté, ou n'est plus configuré."
   },
   "notifications": {
     "open": "Ouvrir les notifications",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "Tapez pour rechercher à l'intérieur"
+    "hintWithin": "Tapez pour rechercher à l'intérieur",
+    "hintPattern": "Utilisez * et ? pour filtrer les noms de fichiers, par exemple *.ps1"
   },
   "download": {
     "preparing": "Préparation du téléchargement..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "Affiche les fichiers et dossiers correspondant aux patterns cachés configurés ({patterns}) dans l’explorateur.",
       "showThumbnails": "Afficher les miniatures",
       "showThumbnailsHelp": "Affiche des aperçus miniatures pour les images et vidéos.",
+      "markdownOpensInEditor": "Ouvrir le Markdown dans l'éditeur",
+      "markdownOpensInEditorHelp": "Un double-clic sur un fichier .md ouvre directement l'éditeur au lieu de l'aperçu.",
       "showSidebarFavorites": "Afficher la section Favoris",
       "showSidebarFavoritesHelp": "Affiche les Favoris dans la barre latérale gauche.",
       "showSidebarShares": "Afficher la section Partages",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "Affiche les Outils dans la barre latérale gauche.",
       "defaultShareExpiration": "Expiration par défaut des partages",
       "defaultShareExpirationHelp": "Définissez un délai par défaut pour les nouveaux partages. La date d’expiration est pré-remplie selon ce délai.",
+      "defaultShareExpirationInvalid": "Indiquez un nombre entier d’au moins 1, ou videz le champ pour ne pas fixer d’expiration par défaut.",
       "expirationValue": "Valeur",
       "days": "Jours",
       "weeks": "Semaines",
@@ -517,10 +533,16 @@
       "skipHome": "Passer l’accueil",
       "skipHomeHelp": "Redirige automatiquement vers le premier volume depuis l’accueil. Si non défini, utilise la configuration serveur.",
       "useEnvSetting": "Utiliser la configuration serveur",
-      "showVersionMarks": "Signaler les fichiers qui ont des versions",
-      "showVersionMarksHelp": "Une petite marque dans la liste sur les fichiers qui ont des versions antérieures, avec leur nombre. Cliquez dessus pour ouvrir l’historique.",
+      "defaultView": "Vue par défaut",
+      "defaultViewHelp": "La vue utilisée à l'ouverture d'un dossier qui n'a pas de vue mémorisée.",
+      "viewGrid": "Grille",
+      "viewList": "Liste",
+      "viewColumns": "Colonnes",
+      "viewPhotos": "Photos",
       "documentsOpenInNewTab": "Ouvrir les documents dans un nouvel onglet",
       "documentsOpenInNewTabHelp": "Ouvrir un fichier lui donne son propre onglet de navigateur : plusieurs restent ouverts pendant que vous continuez à naviguer. Désactivé, il s’ouvre par-dessus le dossier comme aujourd’hui.",
+      "showVersionMarks": "Signaler les fichiers qui ont des versions",
+      "showVersionMarksHelp": "Une petite marque dans la liste sur les fichiers qui ont des versions antérieures, avec leur nombre. Cliquez dessus pour ouvrir l’historique.",
       "languageHelp": "Conservée avec votre compte, sur chaque navigateur où vous vous connectez."
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "Dimension maximale",
       "maxDimHelp": "Côté le plus long en pixels. La valeur par défaut est 200.",
       "concurrency": "Génération parallèle",
-      "concurrencyHelp": "Nombre de vignettes générées simultanément (1–50). La valeur par défaut est 10."
+      "concurrencyHelp": "Nombre de vignettes générées simultanément (1–50). La valeur par défaut est 10.",
+      "invalid": "Vérifiez les valeurs : qualité de 1 à 100, dimension maximale de 64 à 1024 px, génération parallèle de 1 à 50."
     },
     "security": {
       "subtitle": "Contrôlez l'accès à l'application.",
@@ -556,7 +579,9 @@
       "pathInvalid": "Ce chemin n'est dans aucun volume : la règle ne s'appliquera jamais.",
       "pathMissing": "Aucun dossier à ce chemin. Une règle utilise le chemin tel que NextExplorer l'affiche, en commençant par le nom du volume.",
       "useSuggestion": "Utiliser {path}",
-      "title": "Accès"
+      "title": "Accès",
+      "pickFolderTitle": "Dossier de cette règle",
+      "appliesToAdminsHint": "Soumettre aussi les administrateurs à cette règle."
     },
     "comingSoon": {
       "subtitle": "Cette section de paramètres est en cours de développement. Restez à l'écoute !"
@@ -604,7 +629,9 @@
       "volumePath": "Chemin du volume",
       "pathCannotChange": "Le chemin ne peut pas être modifié après la création. Supprimez ce volume et créez-en un nouveau si nécessaire.",
       "accessMode": "Mode d'accès",
-      "noUsers": "Aucun utilisateur disponible"
+      "noUsers": "Aucun utilisateur disponible",
+      "lockedBadge": "Verrouillé",
+      "lockedUntil": "Verrouillé jusqu'à {time}"
     },
     "userDetails": {
       "profileTab": "Profile",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC Provider",
       "oidcLinkedProfile": "Linked Profile",
-      "noOidcProfileMessage": "No OIDC profiles linked to this account."
+      "noOidcProfileMessage": "No OIDC profiles linked to this account.",
+      "signInLock": "Verrouillage de connexion",
+      "lockedHint": "Verrouillé après trop de tentatives de connexion échouées. Il se libère de lui-même à {time}.",
+      "notLockedHint": "Non verrouillé. Trop de tentatives de connexion échouées verrouillent un compte pour un temps.",
+      "unlock": "Déverrouiller maintenant"
     },
     "trash": {
       "title": "Corbeille et versions",
@@ -972,7 +1003,8 @@
       "auto": "Auto",
       "inline": "Visualiser",
       "raw": "Raw",
-      "download": "Télécharger"
+      "download": "Télécharger",
+      "editor": "Éditeur"
     },
     "shareLinkCreatedSuccess": "Lien de partage créé avec succès !",
     "access": "Access Mode",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "Chargement des utilisateurs...",
     "password": "Mot de passe",
     "protected": "Protégé",
-    "sharedWith": "Partagé avec"
+    "sharedWith": "Partagé avec",
+    "editShareLink": "Modifier le lien de partage",
+    "saveShare": "Enregistrer les modifications",
+    "advancedPermissions": "Avancé",
+    "allowDelete": "Autoriser la suppression de fichiers",
+    "allowCreateFolder": "Autoriser la création de dossiers",
+    "allowCreateFile": "Autoriser la création de fichiers",
+    "allowUpload": "Autoriser l'envoi de fichiers et dossiers",
+    "activity": "Activité",
+    "activityDetails": "Détails d'activité",
+    "accesses": "accès",
+    "downloads": "téléchargements",
+    "accessCount": "Nombre d'accès",
+    "downloadCount": "Nombre de téléchargements",
+    "lastAccessIp": "Dernière IP d'accès",
+    "lastDownloaded": "Dernier téléchargement",
+    "lastDownloadIp": "Dernière IP de téléchargement",
+    "noActivity": "Jamais",
+    "noIpRecorded": "Aucune IP enregistrée",
+    "allowDownload": "Autoriser le téléchargement",
+    "allowDownloadHelp": "Désactivez pour laisser consulter les fichiers sans pouvoir en prendre une copie.",
+    "versionsVisible": "Afficher les versions des fichiers",
+    "versionsVisibleHelp": "Les personnes qui utilisent ce partage voient les versions antérieures de ses fichiers, et peuvent les restaurer si elles ont le droit de modifier.",
+    "versionsDownload": "Autoriser le téléchargement des versions"
   },
   "trash": {
     "title": "Corbeille",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "Rien ici ne sait ouvrir {name}.",
-    "backToFolder": "Retour au dossier"
+    "backToFolder": "Retour au dossier",
+    "tooLargeToRenderSized": "Ce document fait {size}. L'aperçu s'arrête à {limit}, parce qu'il met en page chaque élément dans le navigateur. Ouvrez-le dans l'éditeur ou téléchargez-le.",
+    "tooLargeToRenderWithEditor": "Ce document fait {size}. L'aperçu s'arrête à {limit}, parce qu'il met en page chaque élément dans le navigateur ; l'éditeur, lui, ouvre jusqu'à {editorLimit}. Ouvrez-le dans l'éditeur ou téléchargez-le.",
+    "stillRendering": "Rendu en cours… {percent} %"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "Ce type de fichier ne peut pas être affiché ici.",
     "tooBigToRead": "Trop volumineux pour être affiché ici : {size}, la limite est de {ceiling}. Téléchargez-le ou extrayez-le pour l'ouvrir.",
     "extract": "Extraire ici",
+    "extractTo": "Extraire vers…",
     "extractNamed": "Extraire {name} ici",
     "selectAll": "Tout sélectionner ici",
     "selectNamed": "Sélectionner {name}",
@@ -1244,5 +1303,31 @@
     "empty": "Rien à choisir ici",
     "breadcrumb": "Chemin du dossier",
     "chooseFolder": "Choisir ce dossier"
+  },
+  "destinationPicker": {
+    "moveTitle": "Déplacer vers",
+    "copyTitle": "Copier vers",
+    "moveHere": "Déplacer ici",
+    "copyHere": "Copier ici",
+    "noFolders": "Aucun dossier ici",
+    "rootRejected": "Choisissez d'abord un volume ou un dossier",
+    "itselfRejected": "Un dossier ne peut pas être déplacé dans lui-même",
+    "descendantRejected": "Un dossier ne peut pas être déplacé dans un de ses propres dossiers",
+    "alreadyThereRejected": "Déjà ici",
+    "restoreTitle": "Restaurer vers",
+    "restoreHere": "Restaurer ici",
+    "versionCopyTitle": "Restaurer une copie dans",
+    "versionCopyHere": "Restaurer une copie ici",
+    "replaceTitle": "Choisir le fichier à remplacer",
+    "replaceHere": "Remplacer ce fichier",
+    "fileRequired": "Choisissez un fichier",
+    "sameFileRejected": "Choisissez un autre fichier que celui-ci",
+    "nothingHere": "Rien ici",
+    "extractTitle": "Extraire vers",
+    "extractHere": "Extraire ici"
+  },
+  "links": {
+    "outside": "Lien hors de ce volume",
+    "outsideExplained": "{name} est un lien vers un emplacement hors de ce volume. Il ne peut être ni ouvert, ni renommé, ni supprimé d’ici ; supprimez-le sur le serveur s’il ne sert plus."
   }
 }
diff --git a/frontend/src/i18n/locales/hi.json b/frontend/src/i18n/locales/hi.json
index 952c440f9..2d90c338c 100644
--- a/frontend/src/i18n/locales/hi.json
+++ b/frontend/src/i18n/locales/hi.json
@@ -72,7 +72,9 @@
     "readwrite": "पढ़ना/लिखना",
     "add": "जोड़ें",
     "back": "पीछे",
-    "logoAlt": "{name} का लोगो"
+    "logoAlt": "{name} का लोगो",
+    "toggleSection": "अनुभाग दिखाएँ या छिपाएँ",
+    "dismissWarning": "चेतावनी हटाएँ"
   },
   "editor": {
     "editing": "Editing",
@@ -169,12 +171,14 @@
     "saveVolume": "Failed to save volume",
     "removeVolume": "Failed to remove volume",
     "totpCodeRequired": "कोड डालें।",
-    "identifierRequired": "ईमेल पता या उपयोगकर्ता नाम आवश्यक है"
+    "identifierRequired": "ईमेल पता या उपयोगकर्ता नाम आवश्यक है",
+    "unlockUser": "खाता अनलॉक नहीं हो सका"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "प्रमाणीकरण आवश्यक है",
     "AUTH_INVALID_CREDENTIALS": "अमान्य ईमेल या पासवर्ड",
     "AUTH_ACCOUNT_LOCKED": "असफल लॉगिन प्रयासों के कारण खाता अस्थायी रूप से लॉक है",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "बहुत अधिक असफल साइन-इन प्रयासों के बाद खाता लॉक है। {minutes} मिनट बाद फिर से प्रयास करें",
     "AUTH_PASSWORD_INCORRECT": "वर्तमान पासवर्ड गलत है",
     "VALIDATION_EMAIL_REQUIRED": "ईमेल आवश्यक है",
     "VALIDATION_PASSWORD_REQUIRED": "पासवर्ड आवश्यक है",
@@ -215,7 +219,14 @@
     "searching": "खोज हो रही है…",
     "noMatches": "कोई परिणाम नहीं मिला",
     "openFolder": "फ़ोल्डर खोलें",
-    "line": "पंक्ति"
+    "line": "पंक्ति",
+    "matchedByName": "नाम",
+    "matchedByContent": "सामग्री",
+    "matchedByBoth": "नाम और सामग्री",
+    "stoppedEarly": "समय सीमा पर रुक गई — अब तक यही मिला है।",
+    "firstOnly": "पहले {count} परिणाम। और देखने के लिए खोज सीमित करें।",
+    "tooShort": "कम से कम {count} अक्षर लिखें।",
+    "showMore": "और दिखाएँ"
   },
   "user": {
     "account": "खाता",
@@ -308,7 +319,8 @@
     "emptyTitle": "अभी तक कोई पसंदीदा नहीं",
     "emptyDescription": "किसी डायरेक्टरी का चयन करें और उसे यहाँ पिन करने के लिए मुख्य टूलबार में सितारे पर टैप करें।",
     "editTitle": "पसंदीदा संपादित करें",
-    "icon": "आइकन"
+    "icon": "आइकन",
+    "volumeUnavailable": "वॉल्यूम उपलब्ध नहीं है — यह माउंट नहीं है, या अब कॉन्फ़िगर नहीं है।"
   },
   "notifications": {
     "open": "सूचनाएँ खोलें",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "अंदर खोजने के लिए टाइप करें"
+    "hintWithin": "अंदर खोजने के लिए टाइप करें",
+    "hintPattern": "फ़ाइल नामों को छानने के लिए * और ? का उपयोग करें, उदाहरण के लिए *.ps1"
   },
   "download": {
     "preparing": "डाउनलोड तैयार किया जा रहा है..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "एक्सप्लोरर में कॉन्फ़िगर किए गए छिपे पैटर्न ({patterns}) से मेल खाने वाली फ़ाइलें और फ़ोल्डर दिखाएँ।",
       "showThumbnails": "थंबनेल दिखाएँ",
       "showThumbnailsHelp": "इमेज और वीडियो के लिए थंबनेल पूर्वावलोकन दिखाएँ।",
+      "markdownOpensInEditor": "Markdown को संपादक में खोलें",
+      "markdownOpensInEditorHelp": "किसी .md फ़ाइल पर डबल-क्लिक करने पर पूर्वावलोकन के बजाय सीधे संपादक खुलता है।",
       "showSidebarFavorites": "पसंदीदा सेक्शन दिखाएँ",
       "showSidebarFavoritesHelp": "बाएँ साइडबार में पसंदीदा दिखाएँ।",
       "showSidebarShares": "शेयर सेक्शन दिखाएँ",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "बाएँ साइडबार में टूल्स दिखाएँ।",
       "defaultShareExpiration": "शेयर के लिए डिफ़ॉल्ट समाप्ति",
       "defaultShareExpirationHelp": "नई शेयरों के लिए एक डिफ़ॉल्ट अवधि सेट करें। यह सेटिंग शेयर बनाने पर समाप्ति तिथि को पूर्व-भरा रखेगी।",
+      "defaultShareExpirationInvalid": "कम से कम 1 की पूर्ण संख्या दर्ज करें, या कोई डिफ़ॉल्ट न रखने के लिए फ़ील्ड खाली करें।",
       "expirationValue": "मान",
       "days": "दिन",
       "weeks": "सप्ताह",
@@ -517,10 +533,16 @@
       "skipHome": "होम पेज छोड़ें",
       "skipHomeHelp": "होम पेज पर आने पर पहले वॉल्यूम पर स्वचालित रूप से रीडायरेक्ट करें। यदि सेट नहीं है, तो सर्वर कॉन्फ़िगरेशन का पालन करें।",
       "useEnvSetting": "सर्वर सेटिंग का उपयोग करें",
-      "showVersionMarks": "संस्करण वाली फ़ाइलों पर निशान लगाएँ",
-      "showVersionMarksHelp": "सूची में उन फ़ाइलों पर एक छोटा निशान जिनके पुराने संस्करण हैं, उनकी संख्या के साथ। इतिहास खोलने के लिए उस पर क्लिक करें।",
+      "defaultView": "डिफ़ॉल्ट दृश्य",
+      "defaultViewHelp": "ऐसे फ़ोल्डर के लिए दृश्य जिसका अपना सहेजा गया दृश्य नहीं है।",
+      "viewGrid": "ग्रिड",
+      "viewList": "सूची",
+      "viewColumns": "कॉलम",
+      "viewPhotos": "तस्वीरें",
       "documentsOpenInNewTab": "दस्तावेज़ नए टैब में खोलें",
       "documentsOpenInNewTabHelp": "कोई फ़ाइल खोलने पर उसे अपना ब्राउज़र टैब मिलता है, इसलिए ब्राउज़ करते हुए कई खुले रह सकते हैं। बंद होने पर वह आज की तरह फ़ोल्डर के ऊपर खुलती है।",
+      "showVersionMarks": "संस्करण वाली फ़ाइलों पर निशान लगाएँ",
+      "showVersionMarksHelp": "सूची में उन फ़ाइलों पर एक छोटा निशान जिनके पुराने संस्करण हैं, उनकी संख्या के साथ। इतिहास खोलने के लिए उस पर क्लिक करें।",
       "languageHelp": "आपके खाते के साथ सहेजा जाता है, हर उस ब्राउज़र में जहाँ आप साइन इन करते हैं।"
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "अधिकतम आयाम",
       "maxDimHelp": "सबसे लंबा पक्ष पिक्सेल में। डिफ़ॉल्ट 200 है।",
       "concurrency": "समानांतर जेनरेशन",
-      "concurrencyHelp": "एक साथ उत्पन्न होने वाले थंबनेल की संख्या (1–50)। डिफ़ॉल्ट 10 है।"
+      "concurrencyHelp": "एक साथ उत्पन्न होने वाले थंबनेल की संख्या (1–50)। डिफ़ॉल्ट 10 है।",
+      "invalid": "मान जाँचें: गुणवत्ता 1 से 100, अधिकतम आयाम 64 से 1024 px, समानांतर जेनरेशन 1 से 50।"
     },
     "security": {
       "subtitle": "ऐप तक पहुँच नियंत्रित करें।",
@@ -556,7 +579,9 @@
       "pathInvalid": "यह पथ किसी वॉल्यूम के भीतर नहीं है, इसलिए यह नियम कभी लागू नहीं होगा।",
       "pathMissing": "इस पथ पर कोई फ़ोल्डर नहीं है। नियम उसी पथ का उपयोग करता है जैसा NextExplorer दिखाता है, वॉल्यूम के नाम से शुरू करके।",
       "useSuggestion": "{path} उपयोग करें",
-      "title": "एक्सेस"
+      "title": "एक्सेस",
+      "pickFolderTitle": "इस नियम का फ़ोल्डर",
+      "appliesToAdminsHint": "इस नियम से व्यवस्थापकों को भी बाँधें।"
     },
     "comingSoon": {
       "subtitle": "यह सेटिंग सेक्शन बनाया जा रहा है। जुड़े रहें!"
@@ -604,7 +629,9 @@
       "volumePath": "वॉल्यूम पथ",
       "pathCannotChange": "निर्माण के बाद पथ बदला नहीं जा सकता। यदि आवश्यक हो तो इसे हटा दें और नया बनाएँ।",
       "accessMode": "पहुँच मोड",
-      "noUsers": "कोई उपयोगकर्ता उपलब्ध नहीं"
+      "noUsers": "कोई उपयोगकर्ता उपलब्ध नहीं",
+      "lockedBadge": "लॉक",
+      "lockedUntil": "{time} तक लॉक"
     },
     "userDetails": {
       "profileTab": "Profile",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC Provider",
       "oidcLinkedProfile": "Linked Profile",
-      "noOidcProfileMessage": "No OIDC profiles linked to this account."
+      "noOidcProfileMessage": "No OIDC profiles linked to this account.",
+      "signInLock": "साइन-इन लॉक",
+      "lockedHint": "बहुत अधिक असफल साइन-इन प्रयासों के बाद लॉक किया गया। यह {time} पर अपने आप खुल जाएगा।",
+      "notLockedHint": "लॉक नहीं है। बहुत अधिक असफल साइन-इन प्रयास किसी खाते को कुछ समय के लिए लॉक कर देते हैं।",
+      "unlock": "अभी अनलॉक करें"
     },
     "trash": {
       "title": "रीसायकल बिन और संस्करण",
@@ -1023,7 +1054,8 @@
       "auto": "स्वचालित",
       "inline": "देखें",
       "raw": "रॉ",
-      "download": "डाउनलोड करें"
+      "download": "डाउनलोड करें",
+      "editor": "संपादक"
     },
     "deleteShareTitle": "शेयर हटाएँ?",
     "deleteShareMessage": "इस लिंक वाले लोग अब साझा किए गए आइटम तक पहुँच नहीं कर पाएँगे।",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "उपयोगकर्ता लोड हो रहे हैं...",
     "password": "पासवर्ड",
     "protected": "सुरक्षित",
-    "sharedWith": "इनके साथ साझा"
+    "sharedWith": "इनके साथ साझा",
+    "editShareLink": "शेयर लिंक संपादित करें",
+    "saveShare": "परिवर्तन सहेजें",
+    "advancedPermissions": "उन्नत",
+    "allowDelete": "फ़ाइलें हटाने की अनुमति दें",
+    "allowCreateFolder": "फ़ोल्डर बनाने की अनुमति दें",
+    "allowCreateFile": "फ़ाइलें बनाने की अनुमति दें",
+    "allowUpload": "फ़ाइलें और फ़ोल्डर अपलोड करने की अनुमति दें",
+    "activity": "गतिविधि",
+    "activityDetails": "गतिविधि विवरण",
+    "accesses": "एक्सेस",
+    "downloads": "डाउनलोड",
+    "accessCount": "एक्सेस संख्या",
+    "downloadCount": "डाउनलोड संख्या",
+    "lastAccessIp": "अंतिम एक्सेस IP",
+    "lastDownloaded": "अंतिम डाउनलोड",
+    "lastDownloadIp": "अंतिम डाउनलोड IP",
+    "noActivity": "कभी नहीं",
+    "noIpRecorded": "कोई IP दर्ज नहीं",
+    "allowDownload": "डाउनलोड की अनुमति दें",
+    "allowDownloadHelp": "इसे बंद करें ताकि फ़ाइलें पढ़ी जा सकें पर उनकी प्रति न ली जा सके।",
+    "versionsVisible": "फ़ाइल संस्करण दिखाएँ",
+    "versionsVisibleHelp": "इस साझाकरण का उपयोग करने वाले इसकी फ़ाइलों के पिछले संस्करण देखते हैं, और संपादन की अनुमति होने पर उन्हें पुनर्स्थापित कर सकते हैं।",
+    "versionsDownload": "संस्करण डाउनलोड करने दें"
   },
   "trash": {
     "title": "रीसायकल बिन",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "यहाँ कुछ भी {name} को नहीं खोल सकता।",
-    "backToFolder": "फ़ोल्डर पर वापस"
+    "backToFolder": "फ़ोल्डर पर वापस",
+    "tooLargeToRenderSized": "यह दस्तावेज़ {size} का है। पूर्वावलोकन {limit} पर रुक जाता है, क्योंकि यह हर तत्व को ब्राउज़र में सजाता है। इसे संपादक में खोलें या डाउनलोड करें।",
+    "tooLargeToRenderWithEditor": "यह दस्तावेज़ {size} का है। पूर्वावलोकन {limit} पर रुक जाता है, क्योंकि यह हर तत्व को ब्राउज़र में सजाता है; संपादक {editorLimit} तक खोलता है। इसे संपादक में खोलें या डाउनलोड करें।",
+    "stillRendering": "प्रस्तुत किया जा रहा है… {percent}%"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "इस तरह की फ़ाइल यहाँ नहीं दिखाई जा सकती।",
     "tooBigToRead": "यहाँ दिखाने के लिए बहुत बड़ी: {size}, सीमा {ceiling} है। इसे डाउनलोड करें या निकालकर खोलें।",
     "extract": "यहाँ निकालें",
+    "extractTo": "यहाँ निकालें…",
     "extractNamed": "{name} यहाँ निकालें",
     "selectAll": "यहाँ सब चुनें",
     "selectNamed": "{name} चुनें",
@@ -1244,5 +1303,31 @@
     "empty": "यहाँ चुनने के लिए कुछ नहीं है",
     "breadcrumb": "फ़ोल्डर पथ",
     "chooseFolder": "यह फ़ोल्डर चुनें"
+  },
+  "destinationPicker": {
+    "moveTitle": "यहाँ ले जाएँ",
+    "copyTitle": "यहाँ कॉपी करें",
+    "moveHere": "यहाँ ले जाएँ",
+    "copyHere": "यहाँ कॉपी करें",
+    "noFolders": "यहाँ कोई फ़ोल्डर नहीं",
+    "rootRejected": "पहले कोई वॉल्यूम या फ़ोल्डर चुनें",
+    "itselfRejected": "फ़ोल्डर को उसी में नहीं ले जाया जा सकता",
+    "descendantRejected": "फ़ोल्डर को उसके अपने फ़ोल्डर में नहीं ले जाया जा सकता",
+    "alreadyThereRejected": "पहले से यहाँ है",
+    "restoreTitle": "यहाँ पुनर्स्थापित करें",
+    "restoreHere": "यहाँ पुनर्स्थापित करें",
+    "versionCopyTitle": "प्रतिलिपि यहाँ पुनर्स्थापित करें:",
+    "versionCopyHere": "प्रतिलिपि यहाँ पुनर्स्थापित करें",
+    "replaceTitle": "बदलने के लिए फ़ाइल चुनें",
+    "replaceHere": "यह फ़ाइल बदलें",
+    "fileRequired": "एक फ़ाइल चुनें",
+    "sameFileRejected": "इसके अलावा कोई दूसरी फ़ाइल चुनें",
+    "nothingHere": "यहाँ कुछ नहीं है",
+    "extractTitle": "यहाँ निकालें",
+    "extractHere": "यहीं निकालें"
+  },
+  "links": {
+    "outside": "इस वॉल्यूम से बाहर का लिंक",
+    "outsideExplained": "{name} इस वॉल्यूम के बाहर किसी स्थान का लिंक है। इसे यहाँ से खोला, नाम बदला या हटाया नहीं जा सकता; अगर अब इसकी ज़रूरत नहीं है तो इसे सर्वर पर हटाएँ।"
   }
 }
diff --git a/frontend/src/i18n/locales/it.json b/frontend/src/i18n/locales/it.json
index 09d08f192..c67cf56e5 100644
--- a/frontend/src/i18n/locales/it.json
+++ b/frontend/src/i18n/locales/it.json
@@ -72,7 +72,9 @@
     "readwrite": "Lettura/Scrittura",
     "add": "Aggiungi",
     "back": "Indietro",
-    "logoAlt": "Logo di {name}"
+    "logoAlt": "Logo di {name}",
+    "toggleSection": "Mostra o nascondi la sezione",
+    "dismissWarning": "Ignora l'avviso"
   },
   "editor": {
     "editing": "Editing",
@@ -169,12 +171,14 @@
     "saveVolume": "Impossibile salvare il volume",
     "removeVolume": "Impossibile rimuovere il volume",
     "totpCodeRequired": "Inserisci il codice.",
-    "identifierRequired": "È richiesto un indirizzo email o un nome utente"
+    "identifierRequired": "È richiesto un indirizzo email o un nome utente",
+    "unlockUser": "Impossibile sbloccare l'account"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "Autenticazione richiesta",
     "AUTH_INVALID_CREDENTIALS": "Email o password non validi",
     "AUTH_ACCOUNT_LOCKED": "L'account è temporaneamente bloccato a causa di tentativi di accesso falliti",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "Account bloccato dopo troppi tentativi di accesso falliti. Riprova tra {minutes} minuto | Account bloccato dopo troppi tentativi di accesso falliti. Riprova tra {minutes} minuti",
     "AUTH_PASSWORD_INCORRECT": "La password corrente è errata",
     "VALIDATION_EMAIL_REQUIRED": "L'email è obbligatoria",
     "VALIDATION_PASSWORD_REQUIRED": "La password è obbligatoria",
@@ -215,7 +219,14 @@
     "searching": "Ricerca in corso…",
     "noMatches": "Nessun risultato trovato",
     "openFolder": "Apri cartella",
-    "line": "riga"
+    "line": "riga",
+    "matchedByName": "nome",
+    "matchedByContent": "contenuto",
+    "matchedByBoth": "nome e contenuto",
+    "stoppedEarly": "Interrotta al limite di tempo: ecco ciò che è stato trovato finora.",
+    "firstOnly": "I primi {count} risultati. Restringi la ricerca per vederne altri.",
+    "tooShort": "Digita almeno {count} caratteri.",
+    "showMore": "Mostra altri"
   },
   "user": {
     "account": "Account",
@@ -308,7 +319,8 @@
     "emptyTitle": "Nessun preferito",
     "emptyDescription": "Seleziona una directory e tocca la stella nella barra principale per fissarla qui.",
     "editTitle": "Modifica preferito",
-    "icon": "Icona"
+    "icon": "Icona",
+    "volumeUnavailable": "Volume non disponibile: non è montato o non è più configurato."
   },
   "notifications": {
     "open": "Apri notifiche",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "Digita per cercare all'interno"
+    "hintWithin": "Digita per cercare all'interno",
+    "hintPattern": "Usa * e ? per filtrare i nomi dei file, ad esempio *.ps1"
   },
   "download": {
     "preparing": "Preparazione download..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "Mostra file e cartelle che corrispondono ai pattern nascosti configurati ({patterns}) nell'esploratore.",
       "showThumbnails": "Mostra miniature",
       "showThumbnailsHelp": "Mostra anteprime miniatura per immagini e video.",
+      "markdownOpensInEditor": "Apri Markdown nell'editor",
+      "markdownOpensInEditorHelp": "Un doppio clic su un file .md apre direttamente l'editor invece dell'anteprima.",
       "showSidebarFavorites": "Mostra sezione Preferiti",
       "showSidebarFavoritesHelp": "Mostra i Preferiti nella barra laterale sinistra.",
       "showSidebarShares": "Mostra sezione Condivisioni",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "Mostra gli Strumenti nella barra laterale sinistra.",
       "defaultShareExpiration": "Scadenza predefinita per la condivisione",
       "defaultShareExpirationHelp": "Imposta un intervallo predefinito per le nuove condivisioni. La data di scadenza viene precompilata secondo questo valore.",
+      "defaultShareExpirationInvalid": "Inserisci un numero intero di almeno 1, oppure svuota il campo per non avere una scadenza predefinita.",
       "expirationValue": "Valore",
       "days": "Giorni",
       "weeks": "Settimane",
@@ -517,10 +533,16 @@
       "skipHome": "Salta la home",
       "skipHomeHelp": "Reindirizza automaticamente al primo volume quando si visita la home. Se non impostato, usa la configurazione del server.",
       "useEnvSetting": "Usa impostazione del server",
-      "showVersionMarks": "Segnalare i file con versioni",
-      "showVersionMarksHelp": "Un piccolo segno nell’elenco sui file con versioni precedenti, con il loro numero. Un clic apre la cronologia.",
+      "defaultView": "Vista predefinita",
+      "defaultViewHelp": "La vista con cui si apre una cartella senza vista memorizzata.",
+      "viewGrid": "Griglia",
+      "viewList": "Elenco",
+      "viewColumns": "Colonne",
+      "viewPhotos": "Foto",
       "documentsOpenInNewTab": "Aprire i documenti in una nuova scheda",
       "documentsOpenInNewTabHelp": "Aprire un file gli dà una scheda del browser tutta sua, così più documenti restano aperti mentre continuate a navigare. Spento, si apre sopra la cartella come oggi.",
+      "showVersionMarks": "Segnalare i file con versioni",
+      "showVersionMarksHelp": "Un piccolo segno nell’elenco sui file con versioni precedenti, con il loro numero. Un clic apre la cronologia.",
       "languageHelp": "Salvata con il tuo account, su ogni browser da cui accedi."
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "Dimensione massima",
       "maxDimHelp": "Lato più lungo in pixel. Il valore predefinito è 200.",
       "concurrency": "Generazione parallela",
-      "concurrencyHelp": "Numero di miniature da generare contemporaneamente (1–50). Il valore predefinito è 10."
+      "concurrencyHelp": "Numero di miniature da generare contemporaneamente (1–50). Il valore predefinito è 10.",
+      "invalid": "Controlla i valori: qualità da 1 a 100, dimensione massima da 64 a 1024 px, generazione parallela da 1 a 50."
     },
     "security": {
       "subtitle": "Controlla l'accesso all'app.",
@@ -556,7 +579,9 @@
       "pathInvalid": "Questo percorso non è in nessun volume, quindi la regola non si applicherà mai.",
       "pathMissing": "Nessuna cartella a questo percorso. Una regola usa il percorso come lo mostra NextExplorer, a partire dal nome del volume.",
       "useSuggestion": "Usa {path}",
-      "title": "Accesso"
+      "title": "Accesso",
+      "pickFolderTitle": "Cartella per questa regola",
+      "appliesToAdminsHint": "Vincolare a questa regola anche gli amministratori."
     },
     "comingSoon": {
       "subtitle": "Questa sezione delle impostazioni è in costruzione. Resta sintonizzato!"
@@ -604,7 +629,9 @@
       "volumePath": "Percorso volume",
       "pathCannotChange": "Il percorso non può essere cambiato dopo la creazione. Rimuovi questo volume e creane uno nuovo se necessario.",
       "accessMode": "Modalità di accesso",
-      "noUsers": "Nessun utente disponibile"
+      "noUsers": "Nessun utente disponibile",
+      "lockedBadge": "Bloccato",
+      "lockedUntil": "Bloccato fino alle {time}"
     },
     "userDetails": {
       "profileTab": "Profile",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC Provider",
       "oidcLinkedProfile": "Linked Profile",
-      "noOidcProfileMessage": "No OIDC profiles linked to this account."
+      "noOidcProfileMessage": "No OIDC profiles linked to this account.",
+      "signInLock": "Blocco dell'accesso",
+      "lockedHint": "Bloccato dopo troppi tentativi di accesso falliti. Si sblocca da solo alle {time}.",
+      "notLockedHint": "Non bloccato. Troppi tentativi di accesso falliti bloccano un account per un po'.",
+      "unlock": "Sblocca ora"
     },
     "trash": {
       "title": "Cestino e versioni",
@@ -1023,7 +1054,8 @@
       "auto": "Automatico",
       "inline": "Visualizza",
       "raw": "Grezzo",
-      "download": "Scarica"
+      "download": "Scarica",
+      "editor": "Editor"
     },
     "deleteShareTitle": "Rimuovere la condivisione?",
     "deleteShareMessage": "Le persone con questo link non potranno più accedere all’elemento condiviso.",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "Caricamento utenti...",
     "password": "Password",
     "protected": "Protetto",
-    "sharedWith": "Condiviso con"
+    "sharedWith": "Condiviso con",
+    "editShareLink": "Modifica link di condivisione",
+    "saveShare": "Salva modifiche",
+    "advancedPermissions": "Avanzate",
+    "allowDelete": "Consenti l'eliminazione dei file",
+    "allowCreateFolder": "Consenti la creazione di cartelle",
+    "allowCreateFile": "Consenti la creazione di file",
+    "allowUpload": "Consenti il caricamento di file e cartelle",
+    "activity": "Attività",
+    "activityDetails": "Dettagli attività",
+    "accesses": "accessi",
+    "downloads": "download",
+    "accessCount": "Numero di accessi",
+    "downloadCount": "Numero di download",
+    "lastAccessIp": "IP ultimo accesso",
+    "lastDownloaded": "Ultimo download",
+    "lastDownloadIp": "IP ultimo download",
+    "noActivity": "Mai",
+    "noIpRecorded": "Nessun IP registrato",
+    "allowDownload": "Consenti il download",
+    "allowDownloadHelp": "Disattiva per far leggere i file senza permetterne una copia.",
+    "versionsVisible": "Mostra le versioni dei file",
+    "versionsVisibleHelp": "Chi usa questa condivisione vede le versioni precedenti dei suoi file e può ripristinarle se ha il permesso di modifica.",
+    "versionsDownload": "Consenti il download delle versioni"
   },
   "trash": {
     "title": "Cestino",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "Qui niente sa aprire {name}.",
-    "backToFolder": "Torna alla cartella"
+    "backToFolder": "Torna alla cartella",
+    "tooLargeToRenderSized": "Questo documento occupa {size}. L'anteprima si ferma a {limit}, perché dispone ogni elemento nel browser. Aprilo nell'editor o scaricalo.",
+    "tooLargeToRenderWithEditor": "Questo documento occupa {size}. L'anteprima si ferma a {limit}, perché dispone ogni elemento nel browser; l'editor apre fino a {editorLimit}. Aprilo nell'editor o scaricalo.",
+    "stillRendering": "Rendering in corso… {percent} %"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "Questo tipo di file non può essere mostrato qui.",
     "tooBigToRead": "Troppo grande per essere mostrato qui: {size}, il limite è {ceiling}. Scaricalo o estrailo per aprirlo.",
     "extract": "Estrai qui",
+    "extractTo": "Estrai in…",
     "extractNamed": "Estrai {name} qui",
     "selectAll": "Seleziona tutto qui",
     "selectNamed": "Seleziona {name}",
@@ -1244,5 +1303,31 @@
     "empty": "Non c'è nulla da scegliere qui",
     "breadcrumb": "Percorso della cartella",
     "chooseFolder": "Scegli questa cartella"
+  },
+  "destinationPicker": {
+    "moveTitle": "Sposta in",
+    "copyTitle": "Copia in",
+    "moveHere": "Sposta qui",
+    "copyHere": "Copia qui",
+    "noFolders": "Nessuna cartella qui",
+    "rootRejected": "Scegli prima un volume o una cartella",
+    "itselfRejected": "Una cartella non può essere spostata in se stessa",
+    "descendantRejected": "Una cartella non può essere spostata in una delle proprie cartelle",
+    "alreadyThereRejected": "Già qui",
+    "restoreTitle": "Ripristina in",
+    "restoreHere": "Ripristina qui",
+    "versionCopyTitle": "Ripristina una copia in",
+    "versionCopyHere": "Ripristina una copia qui",
+    "replaceTitle": "Scegli il file da sostituire",
+    "replaceHere": "Sostituisci questo file",
+    "fileRequired": "Scegli un file",
+    "sameFileRejected": "Scegli un file diverso da questo",
+    "nothingHere": "Qui non c'è niente",
+    "extractTitle": "Estrai in",
+    "extractHere": "Estrai qui"
+  },
+  "links": {
+    "outside": "Collegamento esterno a questo volume",
+    "outsideExplained": "{name} è un collegamento a una posizione esterna a questo volume. Non può essere aperto, rinominato o eliminato da qui; rimuovilo sul server se non serve più."
   }
 }
diff --git a/frontend/src/i18n/locales/ko.json b/frontend/src/i18n/locales/ko.json
index 4a2975c5f..6fe30fec2 100644
--- a/frontend/src/i18n/locales/ko.json
+++ b/frontend/src/i18n/locales/ko.json
@@ -72,7 +72,9 @@
     "readwrite": "읽기/쓰기",
     "add": "추가",
     "back": "뒤로 가기",
-    "logoAlt": "{name} 로고"
+    "logoAlt": "{name} 로고",
+    "toggleSection": "섹션 펼치기/접기",
+    "dismissWarning": "경고 닫기"
   },
   "editor": {
     "editing": "편집 중",
@@ -169,12 +171,14 @@
     "saveVolume": "볼륨 저장 실패",
     "removeVolume": "볼륨 제거 실패",
     "totpCodeRequired": "코드를 입력하세요.",
-    "identifierRequired": "이메일 주소 또는 사용자 이름이 필요합니다"
+    "identifierRequired": "이메일 주소 또는 사용자 이름이 필요합니다",
+    "unlockUser": "계정 잠금을 해제할 수 없습니다"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "인증이 필요합니다",
     "AUTH_INVALID_CREDENTIALS": "이메일 혹은 비밀번호가 일치하지 않습니다",
     "AUTH_ACCOUNT_LOCKED": "로그인 실패로 인해 계정이 일시 잠금 처리되었습니다",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "로그인 실패가 너무 많아 계정이 잠겼습니다. {minutes}분 후 다시 시도해주세요 | 로그인 실패가 너무 많아 계정이 잠겼습니다. {minutes}분 후 다시 시도해주세요",
     "AUTH_PASSWORD_INCORRECT": "현재 비밀번호가 일치하지 않습니다",
     "VALIDATION_EMAIL_REQUIRED": "이메일 주소가 필요합니다",
     "VALIDATION_PASSWORD_REQUIRED": "비밀번호가 필요합니다",
@@ -215,7 +219,14 @@
     "searching": "검색 중…",
     "noMatches": "검색 결과 없음",
     "openFolder": "폴더 열기",
-    "line": "라인"
+    "line": "라인",
+    "matchedByName": "이름",
+    "matchedByContent": "내용",
+    "matchedByBoth": "이름과 내용",
+    "stoppedEarly": "제한 시간에 도달해 중단되었습니다 — 지금까지 찾은 결과입니다.",
+    "firstOnly": "처음 {count}개의 결과입니다. 더 보려면 검색을 좁히세요.",
+    "tooShort": "{count}자 이상 입력하세요.",
+    "showMore": "더 보기"
   },
   "user": {
     "account": "계정",
@@ -308,7 +319,8 @@
     "emptyTitle": "즐겨찾기 없음",
     "emptyDescription": "폴더 컨텍스트 메뉴에서 별표를 눌러 이곳에 고정하세요.",
     "editTitle": "즐겨찾기 편집",
-    "icon": "아이콘"
+    "icon": "아이콘",
+    "volumeUnavailable": "볼륨을 사용할 수 없습니다 — 마운트되지 않았거나 더 이상 구성되어 있지 않습니다."
   },
   "notifications": {
     "open": "알림 열기",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "검색어를 입력하세요"
+    "hintWithin": "검색어를 입력하세요",
+    "hintPattern": "파일 이름을 찾으려면 * 와 ? 를 사용하세요. 예: *.ps1"
   },
   "download": {
     "preparing": "다운로드 준비 중..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "파일 탐색기에서 구성된 숨김 패턴({patterns})과 일치하는 파일과 폴더를 표시합니다.",
       "showThumbnails": "썸네일 표시",
       "showThumbnailsHelp": "파일 탐색기에서 사진과 영상 파일의 미리보기 썸네일을 표시합니다.",
+      "markdownOpensInEditor": "Markdown을 편집기에서 열기",
+      "markdownOpensInEditorHelp": ".md 파일을 두 번 클릭하면 미리 보기 대신 편집기가 바로 열립니다.",
       "showSidebarFavorites": "즐겨찾기 섹션 표시",
       "showSidebarFavoritesHelp": "왼쪽 사이드바에 즐겨찾기를 표시합니다.",
       "showSidebarShares": "공유 섹션 표시",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "왼쪽 사이드바에 도구를 표시합니다.",
       "defaultShareExpiration": "기본 공유 기한",
       "defaultShareExpirationHelp": "새 공유를 만들 때 사용할 기본 공유 기한을 지정하세요. 공유를 생성할 때 이 설정 값을 바탕으로 기본값이 채워집니다.",
+      "defaultShareExpirationInvalid": "1 이상의 정수를 입력하거나, 기본 기한을 두지 않으려면 입력란을 비우세요.",
       "expirationValue": "기간",
       "days": "일",
       "weeks": "주",
@@ -517,10 +533,16 @@
       "skipHome": "홈페이지 건너뛰기",
       "skipHomeHelp": "접속했을 때, 자동으로 첫 번째 볼륨으로 이동합니다. 설정하지 않을 경우 서버 설정을 따릅니다.",
       "useEnvSetting": "서버 설정 사용",
-      "showVersionMarks": "버전이 있는 파일 표시",
-      "showVersionMarksHelp": "이전 버전이 있는 파일에 개수와 함께 목록에서 작은 표시를 붙입니다. 누르면 기록이 열립니다.",
+      "defaultView": "기본 보기",
+      "defaultViewHelp": "저장된 보기가 없는 폴더에 사용할 보기입니다.",
+      "viewGrid": "그리드",
+      "viewList": "목록",
+      "viewColumns": "열",
+      "viewPhotos": "사진",
       "documentsOpenInNewTab": "문서를 새 탭에서 열기",
       "documentsOpenInNewTabHelp": "파일을 열면 브라우저 탭이 따로 생기므로, 계속 탐색하는 동안 여러 개를 열어 둘 수 있습니다. 끄면 지금처럼 폴더 위에서 열립니다.",
+      "showVersionMarks": "버전이 있는 파일 표시",
+      "showVersionMarksHelp": "이전 버전이 있는 파일에 개수와 함께 목록에서 작은 표시를 붙입니다. 누르면 기록이 열립니다.",
       "languageHelp": "계정에 저장되어 로그인하는 모든 브라우저에 적용됩니다."
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "최대 해상도",
       "maxDimHelp": "가로와 세로 중 긴 면의 최대 픽셀 수를 지정하세요. 기본값은 200입니다.",
       "concurrency": "병렬 생성",
-      "concurrencyHelp": "동시에 생성 가능한 썸네일 개수를 지정하세요 (1–50). 기본값은 10입니다."
+      "concurrencyHelp": "동시에 생성 가능한 썸네일 개수를 지정하세요 (1–50). 기본값은 10입니다.",
+      "invalid": "값을 확인하세요: 품질 1~100, 최대 해상도 64~1024px, 병렬 생성 1~50."
     },
     "security": {
       "subtitle": "애플리케이션에 대한 접근 방식을 설정합니다.",
@@ -556,7 +579,9 @@
       "pathInvalid": "이 경로는 어떤 볼륨에도 속하지 않으므로 규칙이 적용되지 않습니다.",
       "pathMissing": "이 경로에 폴더가 없습니다. 규칙은 볼륨 이름부터 시작하여 NextExplorer에 표시되는 경로를 사용합니다.",
       "useSuggestion": "{path} 사용",
-      "title": "접근"
+      "title": "접근",
+      "pickFolderTitle": "이 규칙의 폴더",
+      "appliesToAdminsHint": "이 규칙을 관리자에게도 적용합니다."
     },
     "comingSoon": {
       "subtitle": "이 설정 항목은 현재 개발 중입니다. 기대해주세요!"
@@ -604,7 +629,9 @@
       "volumePath": "볼륨 경로",
       "pathCannotChange": "생성된 이후에는 경로를 변경할 수 없습니다. 필요 시에는 이 볼륨을 제거하고 새로운 볼륨을 생성해야 합니다.",
       "accessMode": "접근 모드",
-      "noUsers": "유저가 없습니다"
+      "noUsers": "유저가 없습니다",
+      "lockedBadge": "잠김",
+      "lockedUntil": "{time}까지 잠김"
     },
     "userDetails": {
       "profileTab": "프로필",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC 제공자",
       "oidcLinkedProfile": "연결된 프로필",
-      "noOidcProfileMessage": "이 계정과 연결된 OIDC 프로필이 없습니다."
+      "noOidcProfileMessage": "이 계정과 연결된 OIDC 프로필이 없습니다.",
+      "signInLock": "로그인 잠금",
+      "lockedHint": "로그인 실패가 너무 많아 잠겼습니다. {time}에 자동으로 해제됩니다.",
+      "notLockedHint": "잠겨 있지 않습니다. 로그인 실패가 너무 많으면 계정이 잠시 잠깁니다.",
+      "unlock": "지금 잠금 해제"
     },
     "trash": {
       "title": "휴지통 및 버전",
@@ -1023,7 +1054,8 @@
       "auto": "자동",
       "inline": "보기",
       "raw": "원본",
-      "download": "다운로드"
+      "download": "다운로드",
+      "editor": "에디터"
     },
     "deleteShareTitle": "공유를 제거할까요?",
     "deleteShareMessage": "이 링크가 있는 사용자는 더 이상 공유 항목에 접근할 수 없습니다.",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "유저 정보 로딩 중...",
     "password": "비밀번호",
     "protected": "보호됨",
-    "sharedWith": "공유 대상"
+    "sharedWith": "공유 대상",
+    "editShareLink": "공유 링크 편집",
+    "saveShare": "변경 사항 저장",
+    "advancedPermissions": "고급",
+    "allowDelete": "파일 삭제 허용",
+    "allowCreateFolder": "폴더 생성 허용",
+    "allowCreateFile": "파일 생성 허용",
+    "allowUpload": "파일 및 폴더 업로드 허용",
+    "activity": "활동",
+    "activityDetails": "활동 상세",
+    "accesses": "접근",
+    "downloads": "다운로드",
+    "accessCount": "접근 횟수",
+    "downloadCount": "다운로드 횟수",
+    "lastAccessIp": "마지막 접근 IP",
+    "lastDownloaded": "마지막 다운로드",
+    "lastDownloadIp": "마지막 다운로드 IP",
+    "noActivity": "없음",
+    "noIpRecorded": "기록된 IP 없음",
+    "allowDownload": "다운로드 허용",
+    "allowDownloadHelp": "끄면 파일을 읽을 수는 있지만 복사본을 가져갈 수는 없습니다.",
+    "versionsVisible": "파일 버전 표시",
+    "versionsVisibleHelp": "이 공유를 사용하는 사람은 파일의 이전 버전을 볼 수 있고, 편집 권한이 있으면 복원할 수 있습니다.",
+    "versionsDownload": "버전 다운로드 허용"
   },
   "trash": {
     "title": "휴지통",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "여기에서 {name}을(를) 열 수 있는 것이 없습니다.",
-    "backToFolder": "폴더로 돌아가기"
+    "backToFolder": "폴더로 돌아가기",
+    "tooLargeToRenderSized": "이 문서는 {size}입니다. 미리 보기는 브라우저에서 모든 요소를 배치하므로 {limit}에서 멈춥니다. 편집기에서 열거나 내려받으세요.",
+    "tooLargeToRenderWithEditor": "이 문서는 {size}입니다. 미리 보기는 브라우저에서 모든 요소를 배치하므로 {limit}에서 멈춥니다. 편집기는 {editorLimit}까지 엽니다. 편집기에서 열거나 내려받으세요.",
+    "stillRendering": "그리는 중… {percent}%"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "이런 종류의 파일은 여기에서 표시할 수 없습니다.",
     "tooBigToRead": "여기에 표시하기에는 너무 큽니다: {size}, 한도는 {ceiling}입니다. 내려받거나 압축을 풀어서 여세요.",
     "extract": "여기에 압축 풀기",
+    "extractTo": "다음 위치에 풀기…",
     "extractNamed": "{name}을(를) 여기에 압축 풀기",
     "selectAll": "여기 있는 항목 모두 선택",
     "selectNamed": "{name} 선택",
@@ -1244,5 +1303,31 @@
     "empty": "선택할 항목이 없습니다",
     "breadcrumb": "폴더 경로",
     "chooseFolder": "이 폴더 선택"
+  },
+  "destinationPicker": {
+    "moveTitle": "이동 위치",
+    "copyTitle": "복사 위치",
+    "moveHere": "여기로 이동",
+    "copyHere": "여기에 복사",
+    "noFolders": "폴더가 없습니다",
+    "rootRejected": "먼저 볼륨이나 폴더를 선택하세요",
+    "itselfRejected": "폴더를 자기 자신으로 이동할 수 없습니다",
+    "descendantRejected": "폴더를 자신의 하위 폴더로 이동할 수 없습니다",
+    "alreadyThereRejected": "이미 여기에 있습니다",
+    "restoreTitle": "복원할 위치",
+    "restoreHere": "여기에 복원",
+    "versionCopyTitle": "사본 복원 위치",
+    "versionCopyHere": "여기에 사본 복원",
+    "replaceTitle": "바꿀 파일 선택",
+    "replaceHere": "이 파일 바꾸기",
+    "fileRequired": "파일을 선택하세요",
+    "sameFileRejected": "이 파일이 아닌 다른 파일을 선택하세요",
+    "nothingHere": "여기에는 아무것도 없습니다",
+    "extractTitle": "다음 위치에 풀기",
+    "extractHere": "여기에 풀기"
+  },
+  "links": {
+    "outside": "이 볼륨 밖을 가리키는 링크",
+    "outsideExplained": "{name}은(는) 이 볼륨 밖의 위치를 가리키는 링크입니다. 여기서는 열거나 이름을 바꾸거나 삭제할 수 없습니다. 더 이상 필요하지 않으면 서버에서 제거하세요."
   }
 }
diff --git a/frontend/src/i18n/locales/nl.json b/frontend/src/i18n/locales/nl.json
index 482029f16..bbf5067ad 100644
--- a/frontend/src/i18n/locales/nl.json
+++ b/frontend/src/i18n/locales/nl.json
@@ -72,7 +72,9 @@
     "readwrite": "Lezen/schrijven",
     "add": "Toevoegen",
     "back": "Terug",
-    "logoAlt": "Logo van {name}"
+    "logoAlt": "Logo van {name}",
+    "toggleSection": "Sectie in- of uitklappen",
+    "dismissWarning": "Waarschuwing sluiten"
   },
   "editor": {
     "editing": "Bewerken",
@@ -169,12 +171,14 @@
     "saveVolume": "Volume opslaan is mislukt",
     "removeVolume": "Volume verwijderen is mislukt",
     "totpCodeRequired": "Voer de code in.",
-    "identifierRequired": "Een e-mailadres of gebruikersnaam is verplicht"
+    "identifierRequired": "Een e-mailadres of gebruikersnaam is verplicht",
+    "unlockUser": "Het account kon niet worden ontgrendeld"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "Authenticatie vereist",
     "AUTH_INVALID_CREDENTIALS": "Ongeldige aanmeldgegevens",
     "AUTH_ACCOUNT_LOCKED": "Account is tijdelijk geblokkeerd vanwege mislukte inlogpogingen",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "Account vergrendeld na te veel mislukte aanmeldpogingen. Probeer het over {minutes} minuut opnieuw | Account vergrendeld na te veel mislukte aanmeldpogingen. Probeer het over {minutes} minuten opnieuw",
     "AUTH_PASSWORD_INCORRECT": "Huidig wachtwoord is onjuist",
     "VALIDATION_EMAIL_REQUIRED": "E-mailadres is vereist",
     "VALIDATION_PASSWORD_REQUIRED": "Wachtwoord is vereist",
@@ -215,7 +219,14 @@
     "searching": "Zoeken…",
     "noMatches": "Geen overeenkomst gevonden",
     "openFolder": "Map openen",
-    "line": "regel"
+    "line": "regel",
+    "matchedByName": "naam",
+    "matchedByContent": "inhoud",
+    "matchedByBoth": "naam en inhoud",
+    "stoppedEarly": "Gestopt bij de tijdslimiet — dit is wat tot nu toe is gevonden.",
+    "firstOnly": "De eerste {count} resultaten. Verfijn de zoekopdracht voor meer.",
+    "tooShort": "Typ minstens {count} tekens.",
+    "showMore": "Meer tonen"
   },
   "user": {
     "account": "Account",
@@ -308,7 +319,8 @@
     "emptyTitle": "Nog geen favorieten",
     "emptyDescription": "Selecteer een map en tik op de ster in de hoofdwerkbalk om deze hier vast te zetten.",
     "editTitle": "Favoriet bewerken",
-    "icon": "Pictogram"
+    "icon": "Pictogram",
+    "volumeUnavailable": "Volume niet beschikbaar — het is niet gekoppeld of niet meer geconfigureerd."
   },
   "notifications": {
     "open": "Meldingen openen",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "Typ om te zeken in"
+    "hintWithin": "Typ om te zeken in",
+    "hintPattern": "Gebruik * en ? om bestandsnamen te zoeken, bijvoorbeeld *.ps1"
   },
   "download": {
     "preparing": "Download voorbereiden…"
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "Toon bestanden en mappen die overeenkomen met de geconfigureerde verborgen patronen ({patterns}) in de bestandsbrowser.",
       "showThumbnails": "Miniaturen weergeven",
       "showThumbnailsHelp": "Miniatuurvoorbeelden van afbeeldingen en video's weergeven in de bestandsbrowser.",
+      "markdownOpensInEditor": "Markdown openen in de editor",
+      "markdownOpensInEditorHelp": "Dubbelklikken op een .md-bestand opent direct de editor in plaats van het voorbeeld.",
       "showSidebarFavorites": "Sectie Favorieten weergeven",
       "showSidebarFavoritesHelp": "Toon Favorieten in de linker zijbalk.",
       "showSidebarShares": "Sectie Shares weergeven",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "Toon Hulpmiddelen in de linker zijbalk.",
       "defaultShareExpiration": "Standaard verlooptijd bij Delen",
       "defaultShareExpirationHelp": "Stel een standaard vervaldatum in voor nieuwe shares. Bij het aanmaken van een share wordt de vervaldatum automatisch ingevuld op basis van deze instelling.",
+      "defaultShareExpirationInvalid": "Vul een geheel getal van minstens 1 in, of maak het veld leeg voor geen standaard verlooptijd.",
       "expirationValue": "Waarde",
       "days": "Dagen",
       "weeks": "Weken",
@@ -517,10 +533,16 @@
       "skipHome": "Startpagina overslaan",
       "skipHomeHelp": "Automatisch doorsturen naar het eerste volume bij het bezoeken van de startpagina. Als dit niet is ingesteld, wordt de serverconfiguratie gevolgd.",
       "useEnvSetting": "Serverconfiguratie gebruiken",
-      "showVersionMarks": "Bestanden met versies markeren",
-      "showVersionMarksHelp": "Een klein teken in de lijst bij bestanden met eerdere versies, met het aantal. Klik erop om de geschiedenis te openen.",
+      "defaultView": "Standaardweergave",
+      "defaultViewHelp": "De weergave waarin een map opent als er voor die map geen weergave is onthouden.",
+      "viewGrid": "Raster",
+      "viewList": "Lijst",
+      "viewColumns": "Kolommen",
+      "viewPhotos": "Foto's",
       "documentsOpenInNewTab": "Documenten in een nieuw tabblad openen",
       "documentsOpenInNewTabHelp": "Een bestand openen geeft het een eigen browsertabblad, zodat er meerdere open blijven terwijl u verder bladert. Uit opent het over de map heen, zoals nu.",
+      "showVersionMarks": "Bestanden met versies markeren",
+      "showVersionMarksHelp": "Een klein teken in de lijst bij bestanden met eerdere versies, met het aantal. Klik erop om de geschiedenis te openen.",
       "languageHelp": "Wordt bij uw account bewaard, in elke browser waarmee u zich aanmeldt."
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "Max. afmetingen",
       "maxDimHelp": "Langste zijde in pixels. Standaard is 200.",
       "concurrency": "Parallel aanmaken",
-      "concurrencyHelp": "Het aantal miniaturen dat tegelijk wordt aangemaakt (1–50). Standaard is 10."
+      "concurrencyHelp": "Het aantal miniaturen dat tegelijk wordt aangemaakt (1–50). Standaard is 10.",
+      "invalid": "Controleer de waarden: kwaliteit van 1 tot 100, max. afmetingen van 64 tot 1024 px, parallel aanmaken van 1 tot 50."
     },
     "security": {
       "subtitle": "Toegangscontrole tot de app.",
@@ -556,7 +579,9 @@
       "pathInvalid": "Dit pad ligt niet in een volume, dus de regel wordt nooit toegepast.",
       "pathMissing": "Er is geen map op dit pad. Een regel gebruikt het pad zoals NextExplorer het toont, beginnend met de naam van het volume.",
       "useSuggestion": "{path} gebruiken",
-      "title": "Toegang"
+      "title": "Toegang",
+      "pickFolderTitle": "Map voor deze regel",
+      "appliesToAdminsHint": "Ook beheerders aan deze regel houden."
     },
     "comingSoon": {
       "subtitle": "Deze sectie Instellingen wordt momenteel gebouwd. Blijf op de hoogte!"
@@ -604,7 +629,9 @@
       "accessMode": "Toegangsmodus",
       "makeAdmin": "Beheerder maken",
       "editUser": "Gebruiker bewerken",
-      "noUsers": "Geen gebruikers beschikbaar"
+      "noUsers": "Geen gebruikers beschikbaar",
+      "lockedBadge": "Vergrendeld",
+      "lockedUntil": "Vergrendeld tot {time}"
     },
     "userDetails": {
       "profileTab": "Profiel",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC Provider",
       "oidcLinkedProfile": "Gekoppeld profiel",
-      "noOidcProfileMessage": "Geen OIDC-profielen gekoppeld aan dit account."
+      "noOidcProfileMessage": "Geen OIDC-profielen gekoppeld aan dit account.",
+      "signInLock": "Aanmeldvergrendeling",
+      "lockedHint": "Vergrendeld na te veel mislukte aanmeldpogingen. De vergrendeling vervalt om {time}.",
+      "notLockedHint": "Niet vergrendeld. Te veel mislukte aanmeldpogingen vergrendelen een account een tijdje.",
+      "unlock": "Nu ontgrendelen"
     },
     "trash": {
       "title": "Prullenbak en versies",
@@ -953,7 +984,8 @@
       "auto": "Autom.",
       "inline": "Weergeven",
       "raw": "Ruw",
-      "download": "Downloaden"
+      "download": "Downloaden",
+      "editor": "Editor"
     },
     "shareLinkCreatedSuccess": "Share-link met succes aangemaakt!",
     "access": "Toegangsmodus",
@@ -1015,7 +1047,30 @@
     "loadingUsers": "Gebruikers laden...",
     "password": "Wachtwoord",
     "protected": "Beveiligd",
-    "sharedWith": "Gedeeld met"
+    "sharedWith": "Gedeeld met",
+    "editShareLink": "Deellink bewerken",
+    "saveShare": "Wijzigingen opslaan",
+    "advancedPermissions": "Geavanceerd",
+    "allowDelete": "Verwijderen van bestanden toestaan",
+    "allowCreateFolder": "Aanmaken van mappen toestaan",
+    "allowCreateFile": "Aanmaken van bestanden toestaan",
+    "allowUpload": "Uploaden van bestanden en mappen toestaan",
+    "activity": "Activiteit",
+    "activityDetails": "Details van de activiteit",
+    "accesses": "keer geopend",
+    "downloads": "downloads",
+    "accessCount": "Aantal keer geopend",
+    "downloadCount": "Aantal downloads",
+    "lastAccessIp": "IP van laatste toegang",
+    "lastDownloaded": "Laatst gedownload",
+    "lastDownloadIp": "IP van laatste download",
+    "noActivity": "Nooit",
+    "noIpRecorded": "Geen IP vastgelegd",
+    "allowDownload": "Downloaden toestaan",
+    "allowDownloadHelp": "Schakel dit uit om mensen de bestanden te laten lezen zonder er een kopie van te nemen.",
+    "versionsVisible": "Bestandsversies tonen",
+    "versionsVisibleHelp": "Wie deze deellink gebruikt, ziet de eerdere versies van de bestanden en kan ze terugzetten als bewerken is toegestaan.",
+    "versionsDownload": "Downloaden van versies toestaan"
   },
   "mediaPreview": {
     "download": "Media downloaden",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "Hier kan niets {name} openen.",
-    "backToFolder": "Terug naar de map"
+    "backToFolder": "Terug naar de map",
+    "tooLargeToRenderSized": "Dit document is {size}. Het voorbeeld stopt bij {limit}, omdat het elk element in de browser opmaakt. Open het in de editor of download het.",
+    "tooLargeToRenderWithEditor": "Dit document is {size}. Het voorbeeld stopt bij {limit}, omdat het elk element in de browser opmaakt; de editor opent tot {editorLimit}. Open het in de editor of download het.",
+    "stillRendering": "Weergeven… {percent}%"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "Dit soort bestand kan hier niet worden getoond.",
     "tooBigToRead": "Te groot om hier te tonen: {size}, de limiet is {ceiling}. Download het of pak het uit om het te openen.",
     "extract": "Hier uitpakken",
+    "extractTo": "Uitpakken naar…",
     "extractNamed": "{name} hier uitpakken",
     "selectAll": "Alles hier selecteren",
     "selectNamed": "{name} selecteren",
@@ -1244,5 +1303,31 @@
     "empty": "Hier is niets om te kiezen",
     "breadcrumb": "Pad van de map",
     "chooseFolder": "Deze map kiezen"
+  },
+  "destinationPicker": {
+    "moveTitle": "Verplaatsen naar",
+    "copyTitle": "Kopiëren naar",
+    "moveHere": "Hierheen verplaatsen",
+    "copyHere": "Hierheen kopiëren",
+    "noFolders": "Geen mappen hier",
+    "rootRejected": "Kies eerst een volume of map",
+    "itselfRejected": "Een map kan niet in zichzelf worden verplaatst",
+    "descendantRejected": "Een map kan niet in een van zijn eigen submappen worden verplaatst",
+    "alreadyThereRejected": "Staat hier al",
+    "restoreTitle": "Terugzetten naar",
+    "restoreHere": "Hier terugzetten",
+    "versionCopyTitle": "Kopie terugzetten naar",
+    "versionCopyHere": "Kopie hier terugzetten",
+    "replaceTitle": "Kies het bestand dat vervangen wordt",
+    "replaceHere": "Dit bestand vervangen",
+    "fileRequired": "Kies een bestand",
+    "sameFileRejected": "Kies een ander bestand dan dit",
+    "nothingHere": "Hier staat niets",
+    "extractTitle": "Uitpakken naar",
+    "extractHere": "Hier uitpakken"
+  },
+  "links": {
+    "outside": "Link buiten dit volume",
+    "outsideExplained": "{name} is een link naar een plek buiten dit volume. Hij kan hier niet worden geopend, hernoemd of verwijderd; verwijder hem op de server als hij niet meer nodig is."
   }
 }
diff --git a/frontend/src/i18n/locales/pl.json b/frontend/src/i18n/locales/pl.json
index 6fe0405e0..17eabf3dc 100644
--- a/frontend/src/i18n/locales/pl.json
+++ b/frontend/src/i18n/locales/pl.json
@@ -72,7 +72,9 @@
     "readwrite": "Odczyt/Zapis",
     "add": "Dodaj",
     "back": "Wstecz",
-    "logoAlt": "Logo {name}"
+    "logoAlt": "Logo {name}",
+    "toggleSection": "Pokaż lub ukryj sekcję",
+    "dismissWarning": "Odrzuć ostrzeżenie"
   },
   "editor": {
     "editing": "Editing",
@@ -169,12 +171,14 @@
     "saveVolume": "Failed to save volume",
     "removeVolume": "Failed to remove volume",
     "totpCodeRequired": "Wpisz kod.",
-    "identifierRequired": "Wymagany jest adres e-mail lub nazwa użytkownika"
+    "identifierRequired": "Wymagany jest adres e-mail lub nazwa użytkownika",
+    "unlockUser": "Nie udało się odblokować konta"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "Wymagana autentykacja",
     "AUTH_INVALID_CREDENTIALS": "Nieprawidłowy adres e-mail lub hasło",
     "AUTH_ACCOUNT_LOCKED": "Konto jest tymczasowo zablokowane z powodu nieudanych prób logowania",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "Konto zablokowane po zbyt wielu nieudanych próbach logowania. Spróbuj ponownie za {minutes} minutę | Konto zablokowane po zbyt wielu nieudanych próbach logowania. Spróbuj ponownie za {minutes} minuty | Konto zablokowane po zbyt wielu nieudanych próbach logowania. Spróbuj ponownie za {minutes} minut",
     "AUTH_PASSWORD_INCORRECT": "Obecne hasło jest nieprawidłowe",
     "VALIDATION_EMAIL_REQUIRED": "Adres e-mail jest wymagany",
     "VALIDATION_PASSWORD_REQUIRED": "Hasło jest wymagane",
@@ -215,7 +219,14 @@
     "searching": "Wyszukiwanie…",
     "noMatches": "Nie znaleziono wyników",
     "openFolder": "Otwórz folder",
-    "line": "wiersz"
+    "line": "wiersz",
+    "matchedByName": "nazwa",
+    "matchedByContent": "treść",
+    "matchedByBoth": "nazwa i treść",
+    "stoppedEarly": "Przerwano po upływie limitu czasu — oto, co udało się znaleźć.",
+    "firstOnly": "Pierwsze {count} wyników. Zawęź wyszukiwanie, aby zobaczyć więcej.",
+    "tooShort": "Wpisz co najmniej {count} znaki.",
+    "showMore": "Pokaż więcej"
   },
   "user": {
     "account": "Konto",
@@ -308,7 +319,8 @@
     "emptyTitle": "Brak ulubionych",
     "emptyDescription": "Wybierz katalog i kliknij gwiazdkę na głównym pasku narzędzi, aby przypiąć go tutaj.",
     "editTitle": "Edytuj ulubiony",
-    "icon": "Ikona"
+    "icon": "Ikona",
+    "volumeUnavailable": "Wolumin niedostępny — nie jest zamontowany lub nie jest już skonfigurowany."
   },
   "notifications": {
     "open": "Otwórz powiadomienia",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "Wpisz, aby wyszukać wewnątrz"
+    "hintWithin": "Wpisz, aby wyszukać wewnątrz",
+    "hintPattern": "Użyj * i ? aby filtrować nazwy plików, na przykład *.ps1"
   },
   "download": {
     "preparing": "Przygotowywanie pobierania..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "Pokazuje pliki i foldery pasujące do skonfigurowanych ukrytych wzorców ({patterns}) w eksploratorze.",
       "showThumbnails": "Pokaż miniatury",
       "showThumbnailsHelp": "Wyświetla miniatury obrazów i filmów w przeglądarce.",
+      "markdownOpensInEditor": "Otwieraj Markdown w edytorze",
+      "markdownOpensInEditorHelp": "Dwukrotne kliknięcie pliku .md otwiera od razu edytor zamiast podglądu.",
       "showSidebarFavorites": "Pokaż sekcję Ulubione",
       "showSidebarFavoritesHelp": "Wyświetla Ulubione na lewym pasku bocznym.",
       "showSidebarShares": "Pokaż sekcję Udostępnienia",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "Wyświetla Narzędzia na lewym pasku bocznym.",
       "defaultShareExpiration": "Domyślny czas wygaśnięcia udostępnień",
       "defaultShareExpirationHelp": "Ustaw domyślny okres dla nowych udostępnień. Data wygaśnięcia zostanie wstępnie ustawiona zgodnie z tym okresem.",
+      "defaultShareExpirationInvalid": "Podaj liczbę całkowitą nie mniejszą niż 1 albo wyczyść pole, aby nie ustawiać domyślnego czasu.",
       "expirationValue": "Wartość",
       "days": "Dni",
       "weeks": "Tygodnie",
@@ -517,10 +533,16 @@
       "skipHome": "Pomiń stronę główną",
       "skipHomeHelp": "Automatycznie przekierowuje do pierwszego wolumenu przy otwieraniu strony głównej. Jeśli nie ustawiono, stosuje konfigurację serwera.",
       "useEnvSetting": "Użyj ustawień serwera",
-      "showVersionMarks": "Oznaczaj pliki, które mają wersje",
-      "showVersionMarksHelp": "Mały znak na liście przy plikach z wcześniejszymi wersjami, wraz z ich liczbą. Kliknięcie otwiera historię.",
+      "defaultView": "Widok domyślny",
+      "defaultViewHelp": "Widok folderu, który nie ma własnego zapamiętanego widoku.",
+      "viewGrid": "Siatka",
+      "viewList": "Lista",
+      "viewColumns": "Kolumny",
+      "viewPhotos": "Zdjęcia",
       "documentsOpenInNewTab": "Otwieraj dokumenty w nowej karcie",
       "documentsOpenInNewTabHelp": "Otwarcie pliku daje mu własną kartę przeglądarki, więc kilka pozostaje otwartych, gdy przeglądasz dalej. Wyłączone — otwiera się nad folderem, tak jak dziś.",
+      "showVersionMarks": "Oznaczaj pliki, które mają wersje",
+      "showVersionMarksHelp": "Mały znak na liście przy plikach z wcześniejszymi wersjami, wraz z ich liczbą. Kliknięcie otwiera historię.",
       "languageHelp": "Zapisywany przy koncie, w każdej przeglądarce, w której się logujesz."
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "Maksymalny wymiar",
       "maxDimHelp": "Najdłuższy bok w pikselach. Domyślnie 200.",
       "concurrency": "Generowanie równoległe",
-      "concurrencyHelp": "Liczba miniatur generowanych jednocześnie (1–50). Domyślnie 10."
+      "concurrencyHelp": "Liczba miniatur generowanych jednocześnie (1–50). Domyślnie 10.",
+      "invalid": "Sprawdź wartości: jakość od 1 do 100, maksymalny wymiar od 64 do 1024 px, generowanie równoległe od 1 do 50."
     },
     "security": {
       "subtitle": "Kontroluj dostęp do aplikacji.",
@@ -556,7 +579,9 @@
       "pathInvalid": "Ta ścieżka nie leży w żadnym woluminie, więc reguła nigdy nie zadziała.",
       "pathMissing": "Pod tą ścieżką nie ma folderu. Reguła używa ścieżki tak, jak pokazuje ją NextExplorer, zaczynając od nazwy woluminu.",
       "useSuggestion": "Użyj {path}",
-      "title": "Dostęp"
+      "title": "Dostęp",
+      "pickFolderTitle": "Folder dla tej reguły",
+      "appliesToAdminsHint": "Objąć tą regułą także administratorów."
     },
     "comingSoon": {
       "subtitle": "Ta sekcja ustawień jest w przygotowaniu. Bądź na bieżąco!"
@@ -604,7 +629,9 @@
       "volumePath": "Ścieżka woluminu",
       "pathCannotChange": "Ścieżki nie można zmienić po utworzeniu. Usuń ten wolumin i utwórz nowy w razie potrzeby.",
       "accessMode": "Tryb dostępu",
-      "noUsers": "Brak dostępnych użytkowników"
+      "noUsers": "Brak dostępnych użytkowników",
+      "lockedBadge": "Zablokowane",
+      "lockedUntil": "Zablokowane do {time}"
     },
     "userDetails": {
       "profileTab": "Profile",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC Provider",
       "oidcLinkedProfile": "Linked Profile",
-      "noOidcProfileMessage": "No OIDC profiles linked to this account."
+      "noOidcProfileMessage": "No OIDC profiles linked to this account.",
+      "signInLock": "Blokada logowania",
+      "lockedHint": "Zablokowane po zbyt wielu nieudanych próbach logowania. Blokada zniknie sama o {time}.",
+      "notLockedHint": "Niezablokowane. Zbyt wiele nieudanych prób logowania blokuje konto na pewien czas.",
+      "unlock": "Odblokuj teraz"
     },
     "trash": {
       "title": "Kosz i wersje",
@@ -1023,7 +1054,8 @@
       "auto": "Automatycznie",
       "inline": "Wyświetl",
       "raw": "Surowy",
-      "download": "Pobierz"
+      "download": "Pobierz",
+      "editor": "Edytor"
     },
     "deleteShareTitle": "Usunąć udostępnienie?",
     "deleteShareMessage": "Osoby z tym linkiem nie będą już mogły uzyskać dostępu do udostępnionego elementu.",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "Ładowanie użytkowników...",
     "password": "Hasło",
     "protected": "Chronione",
-    "sharedWith": "Udostępnione dla"
+    "sharedWith": "Udostępnione dla",
+    "editShareLink": "Edytuj link udostępniania",
+    "saveShare": "Zapisz zmiany",
+    "advancedPermissions": "Zaawansowane",
+    "allowDelete": "Zezwól na usuwanie plików",
+    "allowCreateFolder": "Zezwól na tworzenie folderów",
+    "allowCreateFile": "Zezwól na tworzenie plików",
+    "allowUpload": "Zezwól na przesyłanie plików i folderów",
+    "activity": "Aktywność",
+    "activityDetails": "Szczegóły aktywności",
+    "accesses": "dostępy",
+    "downloads": "pobrania",
+    "accessCount": "Liczba dostępów",
+    "downloadCount": "Liczba pobrań",
+    "lastAccessIp": "IP ostatniego dostępu",
+    "lastDownloaded": "Ostatnie pobranie",
+    "lastDownloadIp": "IP ostatniego pobrania",
+    "noActivity": "Nigdy",
+    "noIpRecorded": "Brak zarejestrowanego IP",
+    "allowDownload": "Zezwalaj na pobieranie",
+    "allowDownloadHelp": "Wyłącz, aby pliki można było czytać bez pobierania kopii.",
+    "versionsVisible": "Pokaż wersje plików",
+    "versionsVisibleHelp": "Osoby korzystające z tego udostępnienia widzą wcześniejsze wersje jego plików i mogą je przywrócić, jeśli mają prawo edycji.",
+    "versionsDownload": "Zezwól na pobieranie wersji"
   },
   "trash": {
     "title": "Kosz",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "Nic tutaj nie otworzy {name}.",
-    "backToFolder": "Powrót do folderu"
+    "backToFolder": "Powrót do folderu",
+    "tooLargeToRenderSized": "Ten dokument ma {size}. Podgląd kończy się na {limit}, ponieważ rozmieszcza każdy element w przeglądarce. Otwórz go w edytorze lub pobierz.",
+    "tooLargeToRenderWithEditor": "Ten dokument ma {size}. Podgląd kończy się na {limit}, ponieważ rozmieszcza każdy element w przeglądarce; edytor otwiera do {editorLimit}. Otwórz go w edytorze lub pobierz.",
+    "stillRendering": "Renderowanie… {percent}%"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "Tego rodzaju pliku nie można tutaj wyświetlić.",
     "tooBigToRead": "Zbyt duży, aby go tutaj wyświetlić: {size}, limit to {ceiling}. Pobierz go lub wypakuj, aby otworzyć.",
     "extract": "Wypakuj tutaj",
+    "extractTo": "Wypakuj do…",
     "extractNamed": "Wypakuj {name} tutaj",
     "selectAll": "Zaznacz wszystko tutaj",
     "selectNamed": "Zaznacz {name}",
@@ -1244,5 +1303,31 @@
     "empty": "Nie ma tu nic do wyboru",
     "breadcrumb": "Ścieżka folderu",
     "chooseFolder": "Wybierz ten folder"
+  },
+  "destinationPicker": {
+    "moveTitle": "Przenieś do",
+    "copyTitle": "Kopiuj do",
+    "moveHere": "Przenieś tutaj",
+    "copyHere": "Kopiuj tutaj",
+    "noFolders": "Brak folderów",
+    "rootRejected": "Najpierw wybierz wolumin lub folder",
+    "itselfRejected": "Folderu nie można przenieść do niego samego",
+    "descendantRejected": "Folderu nie można przenieść do jednego z jego własnych folderów",
+    "alreadyThereRejected": "Już tutaj",
+    "restoreTitle": "Przywróć do",
+    "restoreHere": "Przywróć tutaj",
+    "versionCopyTitle": "Przywróć kopię do",
+    "versionCopyHere": "Przywróć kopię tutaj",
+    "replaceTitle": "Wybierz plik do zastąpienia",
+    "replaceHere": "Zastąp ten plik",
+    "fileRequired": "Wybierz plik",
+    "sameFileRejected": "Wybierz inny plik niż ten",
+    "nothingHere": "Nic tu nie ma",
+    "extractTitle": "Wypakuj do",
+    "extractHere": "Wypakuj tutaj"
+  },
+  "links": {
+    "outside": "Łącze poza ten wolumin",
+    "outsideExplained": "{name} to łącze do miejsca poza tym woluminem. Nie można go stąd otworzyć, zmienić jego nazwy ani usunąć; usuń je na serwerze, jeśli nie jest już potrzebne."
   }
 }
diff --git a/frontend/src/i18n/locales/pt-BR.json b/frontend/src/i18n/locales/pt-BR.json
index 6c5eea037..4613e367d 100644
--- a/frontend/src/i18n/locales/pt-BR.json
+++ b/frontend/src/i18n/locales/pt-BR.json
@@ -72,7 +72,9 @@
     "readwrite": "Leitura/Escrita",
     "add": "Adicionar",
     "back": "Voltar",
-    "logoAlt": "Logotipo de {name}"
+    "logoAlt": "Logotipo de {name}",
+    "toggleSection": "Mostrar ou ocultar a seção",
+    "dismissWarning": "Dispensar o aviso"
   },
   "editor": {
     "editing": "Editando",
@@ -169,12 +171,14 @@
     "saveVolume": "Falha ao salvar volume",
     "removeVolume": "Falha ao remover volume",
     "totpCodeRequired": "Digite o código.",
-    "identifierRequired": "É necessário um e-mail ou nome de usuário"
+    "identifierRequired": "É necessário um e-mail ou nome de usuário",
+    "unlockUser": "Não foi possível desbloquear a conta"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "Autenticação necessária",
     "AUTH_INVALID_CREDENTIALS": "E-mail ou senha inválidos",
     "AUTH_ACCOUNT_LOCKED": "A conta está temporariamente bloqueada devido a tentativas de login com falha",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "Conta bloqueada após muitas tentativas de login com falha. Tente novamente em {minutes} minuto | Conta bloqueada após muitas tentativas de login com falha. Tente novamente em {minutes} minutos",
     "AUTH_PASSWORD_INCORRECT": "A senha atual está incorreta",
     "VALIDATION_EMAIL_REQUIRED": "O e-mail é obrigatório",
     "VALIDATION_PASSWORD_REQUIRED": "A senha é obrigatória",
@@ -215,7 +219,14 @@
     "searching": "Pesquisando…",
     "noMatches": "Nenhum resultado encontrado",
     "openFolder": "Abrir pasta",
-    "line": "linha"
+    "line": "linha",
+    "matchedByName": "nome",
+    "matchedByContent": "conteúdo",
+    "matchedByBoth": "nome e conteúdo",
+    "stoppedEarly": "Interrompida ao atingir o limite de tempo — isto é o que foi encontrado.",
+    "firstOnly": "Os primeiros {count} resultados. Refine a busca para ver mais.",
+    "tooShort": "Digite ao menos {count} caracteres.",
+    "showMore": "Ver mais"
   },
   "user": {
     "account": "Conta",
@@ -308,7 +319,8 @@
     "emptyTitle": "Nenhum favorito ainda",
     "emptyDescription": "Selecione um diretório e toque na estrela na barra de ferramentas principal para fixá-lo aqui.",
     "editTitle": "Editar favorito",
-    "icon": "Ícone"
+    "icon": "Ícone",
+    "volumeUnavailable": "Volume indisponível — não está montado ou não está mais configurado."
   },
   "notifications": {
     "open": "Abrir notificações",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "Digite para pesquisar dentro de"
+    "hintWithin": "Digite para pesquisar dentro de",
+    "hintPattern": "Use * e ? para filtrar nomes de arquivos, por exemplo *.ps1"
   },
   "download": {
     "preparing": "Preparando download..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "Exibir arquivos e pastas que correspondem aos padrões ocultos configurados ({patterns}) no navegador de arquivos.",
       "showThumbnails": "Mostrar miniaturas",
       "showThumbnailsHelp": "Exibir pré-visualizações em miniatura de imagens e vídeos no navegador de arquivos.",
+      "markdownOpensInEditor": "Abrir Markdown no editor",
+      "markdownOpensInEditorHelp": "Um duplo clique em um arquivo .md abre direto o editor, em vez da visualização.",
       "showSidebarFavorites": "Mostrar seção Favoritos",
       "showSidebarFavoritesHelp": "Exibir Favoritos na barra lateral esquerda.",
       "showSidebarShares": "Mostrar seção Compartilhamentos",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "Exibir Ferramentas na barra lateral esquerda.",
       "defaultShareExpiration": "Expiração padrão de compartilhamentos",
       "defaultShareExpirationHelp": "Defina um período de expiração padrão para novos compartilhamentos. Ao criar um compartilhamento, a data de expiração será pré-preenchida com base nesta configuração.",
+      "defaultShareExpirationInvalid": "Informe um número inteiro de pelo menos 1, ou limpe o campo para não ter expiração padrão.",
       "expirationValue": "Valor",
       "days": "Dias",
       "weeks": "Semanas",
@@ -517,10 +533,16 @@
       "skipHome": "Pular página inicial",
       "skipHomeHelp": "Redirecionar automaticamente para o primeiro volume ao visitar a página inicial. Se não definido, segue a configuração do servidor.",
       "useEnvSetting": "Usar configuração do servidor",
-      "showVersionMarks": "Marcar arquivos que têm versões",
-      "showVersionMarksHelp": "Uma pequena marca na lista nos arquivos com versões anteriores, com a quantidade. Clique nela para abrir o histórico.",
+      "defaultView": "Visualização padrão",
+      "defaultViewHelp": "A visualização usada ao abrir uma pasta que ainda não tem uma memorizada.",
+      "viewGrid": "Grade",
+      "viewList": "Lista",
+      "viewColumns": "Colunas",
+      "viewPhotos": "Fotos",
       "documentsOpenInNewTab": "Abrir documentos em uma nova aba",
       "documentsOpenInNewTabHelp": "Abrir um arquivo lhe dá uma aba do navegador só dele, então vários continuam abertos enquanto você navega. Desligado, ele abre sobre a pasta como hoje.",
+      "showVersionMarks": "Marcar arquivos que têm versões",
+      "showVersionMarksHelp": "Uma pequena marca na lista nos arquivos com versões anteriores, com a quantidade. Clique nela para abrir o histórico.",
       "languageHelp": "Salvo na sua conta, em todos os navegadores onde você entrar."
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "Dimensão máxima",
       "maxDimHelp": "Maior lado em pixels. Padrão: 200.",
       "concurrency": "Geração paralela",
-      "concurrencyHelp": "Número de miniaturas geradas simultaneamente (1–50). Padrão: 10."
+      "concurrencyHelp": "Número de miniaturas geradas simultaneamente (1–50). Padrão: 10.",
+      "invalid": "Verifique os valores: qualidade de 1 a 100, dimensão máxima de 64 a 1024 px, geração paralela de 1 a 50."
     },
     "security": {
       "subtitle": "Controle o acesso ao aplicativo.",
@@ -556,7 +579,9 @@
       "pathInvalid": "Este caminho não está dentro de nenhum volume, então a regra nunca será aplicada.",
       "pathMissing": "Não há pasta neste caminho. Uma regra usa o caminho como o NextExplorer o mostra, começando pelo nome do volume.",
       "useSuggestion": "Usar {path}",
-      "title": "Acesso"
+      "title": "Acesso",
+      "pickFolderTitle": "Pasta desta regra",
+      "appliesToAdminsHint": "Sujeitar também os administradores a esta regra."
     },
     "comingSoon": {
       "subtitle": "Esta seção de configurações está em construção. Aguarde!"
@@ -604,7 +629,9 @@
       "volumePath": "Caminho do Volume",
       "pathCannotChange": "O caminho não pode ser alterado após a criação. Remova este volume e crie um novo se necessário.",
       "accessMode": "Modo de Acesso",
-      "noUsers": "Nenhum usuário disponível"
+      "noUsers": "Nenhum usuário disponível",
+      "lockedBadge": "Bloqueado",
+      "lockedUntil": "Bloqueado até {time}"
     },
     "userDetails": {
       "profileTab": "Perfil",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "Provedor OIDC",
       "oidcLinkedProfile": "Perfil Vinculado",
-      "noOidcProfileMessage": "Nenhum perfil OIDC vinculado a esta conta."
+      "noOidcProfileMessage": "Nenhum perfil OIDC vinculado a esta conta.",
+      "signInLock": "Bloqueio de login",
+      "lockedHint": "Bloqueado após muitas tentativas de login com falha. Será liberado automaticamente às {time}.",
+      "notLockedHint": "Não bloqueado. Muitas tentativas de login com falha bloqueiam uma conta por um tempo.",
+      "unlock": "Desbloquear agora"
     },
     "trash": {
       "title": "Lixeira e versões",
@@ -972,7 +1003,8 @@
       "auto": "Automático",
       "inline": "Visualizar",
       "raw": "Bruto",
-      "download": "Baixar"
+      "download": "Baixar",
+      "editor": "Editor"
     },
     "shareLinkCreatedSuccess": "Link de compartilhamento criado com sucesso!",
     "access": "Modo de Acesso",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "Carregando usuários...",
     "password": "Senha",
     "protected": "Protegido",
-    "sharedWith": "Compartilhado com"
+    "sharedWith": "Compartilhado com",
+    "editShareLink": "Editar o link de compartilhamento",
+    "saveShare": "Salvar as alterações",
+    "advancedPermissions": "Avançado",
+    "allowDelete": "Permitir excluir arquivos",
+    "allowCreateFolder": "Permitir criar pastas",
+    "allowCreateFile": "Permitir criar arquivos",
+    "allowUpload": "Permitir enviar arquivos e pastas",
+    "activity": "Atividade",
+    "activityDetails": "Detalhes da atividade",
+    "accesses": "acessos",
+    "downloads": "downloads",
+    "accessCount": "Número de acessos",
+    "downloadCount": "Número de downloads",
+    "lastAccessIp": "IP do último acesso",
+    "lastDownloaded": "Último download",
+    "lastDownloadIp": "IP do último download",
+    "noActivity": "Nunca",
+    "noIpRecorded": "Nenhum IP registrado",
+    "allowDownload": "Permitir download",
+    "allowDownloadHelp": "Desative para que os arquivos possam ser lidos sem que se leve uma cópia.",
+    "versionsVisible": "Mostrar versões dos arquivos",
+    "versionsVisibleHelp": "Quem usa este compartilhamento vê as versões anteriores dos arquivos e pode restaurá-las se tiver permissão para editar.",
+    "versionsDownload": "Permitir baixar versões"
   },
   "trash": {
     "title": "Lixeira",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "Nada aqui consegue abrir {name}.",
-    "backToFolder": "Voltar para a pasta"
+    "backToFolder": "Voltar para a pasta",
+    "tooLargeToRenderSized": "Este documento tem {size}. A visualização para em {limit}, porque monta cada elemento no navegador. Abra-o no editor ou baixe-o.",
+    "tooLargeToRenderWithEditor": "Este documento tem {size}. A visualização para em {limit}, porque monta cada elemento no navegador; o editor abre até {editorLimit}. Abra-o no editor ou baixe-o.",
+    "stillRendering": "Renderizando… {percent}%"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "Este tipo de arquivo não pode ser exibido aqui.",
     "tooBigToRead": "Grande demais para exibir aqui: {size}, o limite é {ceiling}. Baixe ou extraia o arquivo para abri-lo.",
     "extract": "Extrair aqui",
+    "extractTo": "Extrair para…",
     "extractNamed": "Extrair {name} aqui",
     "selectAll": "Selecionar tudo aqui",
     "selectNamed": "Selecionar {name}",
@@ -1244,5 +1303,31 @@
     "empty": "Nada para escolher aqui",
     "breadcrumb": "Caminho da pasta",
     "chooseFolder": "Escolher esta pasta"
+  },
+  "destinationPicker": {
+    "moveTitle": "Mover para",
+    "copyTitle": "Copiar para",
+    "moveHere": "Mover para cá",
+    "copyHere": "Copiar para cá",
+    "noFolders": "Nenhuma pasta aqui",
+    "rootRejected": "Escolha primeiro um volume ou uma pasta",
+    "itselfRejected": "Uma pasta não pode ser movida para dentro de si mesma",
+    "descendantRejected": "Uma pasta não pode ser movida para dentro de uma de suas próprias pastas",
+    "alreadyThereRejected": "Já está aqui",
+    "restoreTitle": "Restaurar em",
+    "restoreHere": "Restaurar aqui",
+    "versionCopyTitle": "Restaurar uma cópia em",
+    "versionCopyHere": "Restaurar uma cópia aqui",
+    "replaceTitle": "Escolher o arquivo a substituir",
+    "replaceHere": "Substituir este arquivo",
+    "fileRequired": "Escolha um arquivo",
+    "sameFileRejected": "Escolha um arquivo diferente deste",
+    "nothingHere": "Nada aqui",
+    "extractTitle": "Extrair para",
+    "extractHere": "Extrair aqui"
+  },
+  "links": {
+    "outside": "Link para fora deste volume",
+    "outsideExplained": "{name} é um link para um local fora deste volume. Não pode ser aberto, renomeado nem excluído daqui; remova-o no servidor se não for mais necessário."
   }
 }
diff --git a/frontend/src/i18n/locales/ro.json b/frontend/src/i18n/locales/ro.json
index 6460935b2..3c6e08c2b 100644
--- a/frontend/src/i18n/locales/ro.json
+++ b/frontend/src/i18n/locales/ro.json
@@ -72,7 +72,9 @@
     "readwrite": "Citire/Scriere",
     "add": "Adaugă",
     "back": "Înapoi",
-    "logoAlt": "Sigla {name}"
+    "logoAlt": "Sigla {name}",
+    "toggleSection": "Afișează sau ascunde secțiunea",
+    "dismissWarning": "Închideți avertismentul"
   },
   "editor": {
     "editing": "Editing",
@@ -169,12 +171,14 @@
     "saveVolume": "Nu s-a putut salva volumul",
     "removeVolume": "Nu s-a putut elimina volumul",
     "totpCodeRequired": "Introduceți codul.",
-    "identifierRequired": "Este necesară o adresă de e-mail sau un nume de utilizator"
+    "identifierRequired": "Este necesară o adresă de e-mail sau un nume de utilizator",
+    "unlockUser": "Contul nu a putut fi deblocat"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "Autentificare necesară",
     "AUTH_INVALID_CREDENTIALS": "Email sau parolă invalidă",
     "AUTH_ACCOUNT_LOCKED": "Contul este blocat temporar din cauza încercărilor eșuate de autentificare",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "Cont blocat după prea multe încercări eșuate de autentificare. Încercați din nou peste {minutes} minut | Cont blocat după prea multe încercări eșuate de autentificare. Încercați din nou peste {minutes} minute",
     "AUTH_PASSWORD_INCORRECT": "Parola curentă este incorectă",
     "VALIDATION_EMAIL_REQUIRED": "Email-ul este obligatoriu",
     "VALIDATION_PASSWORD_REQUIRED": "Parola este obligatorie",
@@ -215,7 +219,14 @@
     "searching": "Se caută…",
     "noMatches": "Nu a fost găsit niciun rezultat",
     "openFolder": "Deschide dosarul",
-    "line": "linie"
+    "line": "linie",
+    "matchedByName": "nume",
+    "matchedByContent": "conținut",
+    "matchedByBoth": "nume și conținut",
+    "stoppedEarly": "Oprită la limita de timp — acestea sunt rezultatele găsite până acum.",
+    "firstOnly": "Primele {count} rezultate. Restrânge căutarea pentru a vedea mai multe.",
+    "tooShort": "Scrie cel puțin {count} caractere.",
+    "showMore": "Arată mai multe"
   },
   "user": {
     "account": "Cont",
@@ -308,7 +319,8 @@
     "emptyTitle": "Niciun favorit încă",
     "emptyDescription": "Selectează un director și apasă pe stea în bara principală pentru a-l fixa aici.",
     "editTitle": "Editează favorit",
-    "icon": "Pictogramă"
+    "icon": "Pictogramă",
+    "volumeUnavailable": "Volum indisponibil — nu este montat sau nu mai este configurat."
   },
   "notifications": {
     "open": "Deschide notificările",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "Tastează pentru a căuta în interior"
+    "hintWithin": "Tastează pentru a căuta în interior",
+    "hintPattern": "Folosiți * și ? pentru a filtra numele fișierelor, de exemplu *.ps1"
   },
   "download": {
     "preparing": "Se pregătește descărcarea..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "Afișează fișierele și folderele care corespund modelelor ascunse configurate ({patterns}) în navigator.",
       "showThumbnails": "Afișează miniaturi",
       "showThumbnailsHelp": "Afișează previzualizări în miniatură pentru imagini și videoclipuri.",
+      "markdownOpensInEditor": "Deschide Markdown în editor",
+      "markdownOpensInEditorHelp": "Dublu clic pe un fișier .md deschide direct editorul în loc de previzualizare.",
       "showSidebarFavorites": "Afișează secțiunea Favorite",
       "showSidebarFavoritesHelp": "Afișează Favorite în bara laterală stângă.",
       "showSidebarShares": "Afișează secțiunea Partajări",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "Afișează Instrumente în bara laterală stângă.",
       "defaultShareExpiration": "Expirare implicită pentru partajare",
       "defaultShareExpirationHelp": "Setează o perioadă implicită pentru noile partajări. Data de expirare este completată în prealabil pe baza acestei valori.",
+      "defaultShareExpirationInvalid": "Introduceți un număr întreg de cel puțin 1 sau goliți câmpul pentru a nu avea o expirare implicită.",
       "expirationValue": "Valoare",
       "days": "Zile",
       "weeks": "Săptămâni",
@@ -517,10 +533,16 @@
       "skipHome": "Sari peste pagina principală",
       "skipHomeHelp": "Redirectează automat către primul volum la deschiderea paginii principale. Dacă nu este setat, se folosește configurația serverului.",
       "useEnvSetting": "Folosește setarea serverului",
-      "showVersionMarks": "Marchează fișierele care au versiuni",
-      "showVersionMarksHelp": "Un semn discret în listă pe fișierele cu versiuni anterioare, cu numărul lor. Un clic deschide istoricul.",
+      "defaultView": "Vizualizare implicită",
+      "defaultViewHelp": "Vizualizarea folosită pentru un folder fără vizualizare memorată.",
+      "viewGrid": "Grilă",
+      "viewList": "Listă",
+      "viewColumns": "Coloane",
+      "viewPhotos": "Fotografii",
       "documentsOpenInNewTab": "Deschide documentele într-o filă nouă",
       "documentsOpenInNewTabHelp": "Deschiderea unui fișier îi dă o filă proprie de browser, așa că mai multe rămân deschise cât timp navigați. Oprit, se deschide peste dosar ca până acum.",
+      "showVersionMarks": "Marchează fișierele care au versiuni",
+      "showVersionMarksHelp": "Un semn discret în listă pe fișierele cu versiuni anterioare, cu numărul lor. Un clic deschide istoricul.",
       "languageHelp": "Se păstrează în contul dumneavoastră, în orice browser din care vă conectați."
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "Dimensiune maximă",
       "maxDimHelp": "Latura cea mai lungă în pixeli. Implicit este 200.",
       "concurrency": "Generare paralelă",
-      "concurrencyHelp": "Numărul de miniaturi generate simultan (1–50). Implicit este 10."
+      "concurrencyHelp": "Numărul de miniaturi generate simultan (1–50). Implicit este 10.",
+      "invalid": "Verificați valorile: calitate între 1 și 100, dimensiune maximă între 64 și 1024 px, generare paralelă între 1 și 50."
     },
     "security": {
       "subtitle": "Controlează accesul la aplicație.",
@@ -556,7 +579,9 @@
       "pathInvalid": "Această cale nu se află în niciun volum, așa că regula nu se va aplica niciodată.",
       "pathMissing": "Nu există niciun dosar la această cale. O regulă folosește calea așa cum o arată NextExplorer, începând cu numele volumului.",
       "useSuggestion": "Folosiți {path}",
-      "title": "Acces"
+      "title": "Acces",
+      "pickFolderTitle": "Dosarul acestei reguli",
+      "appliesToAdminsHint": "Supune acestei reguli și administratorii."
     },
     "comingSoon": {
       "subtitle": "Această secțiune de setări este în lucru. Revino în curând!"
@@ -604,7 +629,9 @@
       "volumePath": "Cale volum",
       "pathCannotChange": "Calea nu poate fi schimbată după creare. Șterge și creează unul nou dacă e necesar.",
       "accessMode": "Mod acces",
-      "noUsers": "Nu există utilizatori disponibili"
+      "noUsers": "Nu există utilizatori disponibili",
+      "lockedBadge": "Blocat",
+      "lockedUntil": "Blocat până la {time}"
     },
     "userDetails": {
       "profileTab": "Profile",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC Provider",
       "oidcLinkedProfile": "Linked Profile",
-      "noOidcProfileMessage": "No OIDC profiles linked to this account."
+      "noOidcProfileMessage": "No OIDC profiles linked to this account.",
+      "signInLock": "Blocarea autentificării",
+      "lockedHint": "Blocat după prea multe încercări eșuate de autentificare. Se deblochează singur la {time}.",
+      "notLockedHint": "Neblocat. Prea multe încercări eșuate de autentificare blochează un cont pentru o vreme.",
+      "unlock": "Deblochează acum"
     },
     "trash": {
       "title": "Coș de gunoi și versiuni",
@@ -1023,7 +1054,8 @@
       "auto": "Automat",
       "inline": "Vizualizează",
       "raw": "Brut",
-      "download": "Descarcă"
+      "download": "Descarcă",
+      "editor": "Editor"
     },
     "deleteShareTitle": "Elimini partajarea?",
     "deleteShareMessage": "Persoanele cu acest link nu vor mai putea accesa elementul partajat.",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "Se încarcă utilizatorii...",
     "password": "Parolă",
     "protected": "Protejat",
-    "sharedWith": "Partajat cu"
+    "sharedWith": "Partajat cu",
+    "editShareLink": "Editează linkul de partajare",
+    "saveShare": "Salvează modificările",
+    "advancedPermissions": "Avansat",
+    "allowDelete": "Permite ștergerea fișierelor",
+    "allowCreateFolder": "Permite crearea de dosare",
+    "allowCreateFile": "Permite crearea de fișiere",
+    "allowUpload": "Permite încărcarea de fișiere și dosare",
+    "activity": "Activitate",
+    "activityDetails": "Detalii activitate",
+    "accesses": "accesări",
+    "downloads": "descărcări",
+    "accessCount": "Număr de accesări",
+    "downloadCount": "Număr de descărcări",
+    "lastAccessIp": "Ultima IP de accesare",
+    "lastDownloaded": "Ultima descărcare",
+    "lastDownloadIp": "Ultima IP de descărcare",
+    "noActivity": "Niciodată",
+    "noIpRecorded": "Nicio IP înregistrată",
+    "allowDownload": "Permite descărcarea",
+    "allowDownloadHelp": "Dezactivați pentru a permite citirea fișierelor fără a lua o copie.",
+    "versionsVisible": "Afișați versiunile fișierelor",
+    "versionsVisibleHelp": "Cei care folosesc această partajare văd versiunile anterioare ale fișierelor și le pot restaura dacă au dreptul de editare.",
+    "versionsDownload": "Permiteți descărcarea versiunilor"
   },
   "trash": {
     "title": "Coș de gunoi",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "Nimic de aici nu poate deschide {name}.",
-    "backToFolder": "Înapoi la dosar"
+    "backToFolder": "Înapoi la dosar",
+    "tooLargeToRenderSized": "Acest document are {size}. Previzualizarea se oprește la {limit}, deoarece aranjează fiecare element în browser. Deschideți-l în editor sau descărcați-l.",
+    "tooLargeToRenderWithEditor": "Acest document are {size}. Previzualizarea se oprește la {limit}, deoarece aranjează fiecare element în browser; editorul deschide până la {editorLimit}. Deschideți-l în editor sau descărcați-l.",
+    "stillRendering": "Se randează… {percent} %"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "Acest tip de fișier nu poate fi afișat aici.",
     "tooBigToRead": "Prea mare pentru a fi afișat aici: {size}, limita este {ceiling}. Descărcați-l sau extrageți-l pentru a-l deschide.",
     "extract": "Extrage aici",
+    "extractTo": "Extrageți în…",
     "extractNamed": "Extrage {name} aici",
     "selectAll": "Selectați tot de aici",
     "selectNamed": "Selectați {name}",
@@ -1244,5 +1303,31 @@
     "empty": "Nu este nimic de ales aici",
     "breadcrumb": "Calea folderului",
     "chooseFolder": "Alegeți acest dosar"
+  },
+  "destinationPicker": {
+    "moveTitle": "Mută în",
+    "copyTitle": "Copiază în",
+    "moveHere": "Mută aici",
+    "copyHere": "Copiază aici",
+    "noFolders": "Niciun folder aici",
+    "rootRejected": "Alegeți mai întâi un volum sau un folder",
+    "itselfRejected": "Un folder nu poate fi mutat în el însuși",
+    "descendantRejected": "Un folder nu poate fi mutat într-unul dintre folderele sale",
+    "alreadyThereRejected": "Deja aici",
+    "restoreTitle": "Restaurează în",
+    "restoreHere": "Restaurează aici",
+    "versionCopyTitle": "Restaurați o copie în",
+    "versionCopyHere": "Restaurați o copie aici",
+    "replaceTitle": "Alegeți fișierul de înlocuit",
+    "replaceHere": "Înlocuiți acest fișier",
+    "fileRequired": "Alegeți un fișier",
+    "sameFileRejected": "Alegeți alt fișier decât acesta",
+    "nothingHere": "Nimic aici",
+    "extractTitle": "Extrageți în",
+    "extractHere": "Extrageți aici"
+  },
+  "links": {
+    "outside": "Legătură în afara acestui volum",
+    "outsideExplained": "{name} este o legătură către o locație din afara acestui volum. Nu poate fi deschisă, redenumită sau ștearsă de aici; eliminați-o pe server dacă nu mai este necesară."
   }
 }
diff --git a/frontend/src/i18n/locales/ru.json b/frontend/src/i18n/locales/ru.json
index 01612b6e2..5c96ffef7 100644
--- a/frontend/src/i18n/locales/ru.json
+++ b/frontend/src/i18n/locales/ru.json
@@ -72,7 +72,9 @@
     "readwrite": "Чтение/Запись",
     "add": "Добавить",
     "back": "Назад",
-    "logoAlt": "Логотип {name}"
+    "logoAlt": "Логотип {name}",
+    "toggleSection": "Показать или скрыть раздел",
+    "dismissWarning": "Скрыть предупреждение"
   },
   "editor": {
     "editing": "Editing",
@@ -169,12 +171,14 @@
     "saveVolume": "Не удалось сохранить том",
     "removeVolume": "Не удалось удалить том",
     "totpCodeRequired": "Введите код.",
-    "identifierRequired": "Требуется адрес электронной почты или имя пользователя"
+    "identifierRequired": "Требуется адрес электронной почты или имя пользователя",
+    "unlockUser": "Не удалось разблокировать учетную запись"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "Требуется аутентификация",
     "AUTH_INVALID_CREDENTIALS": "Неверная электронная почта или пароль",
     "AUTH_ACCOUNT_LOCKED": "Учетная запись временно заблокирована из-за неудачных попыток входа",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "Учетная запись заблокирована после слишком многих неудачных попыток входа. Повторите попытку через {minutes} минуту | Учетная запись заблокирована после слишком многих неудачных попыток входа. Повторите попытку через {minutes} минуты | Учетная запись заблокирована после слишком многих неудачных попыток входа. Повторите попытку через {minutes} минут",
     "AUTH_PASSWORD_INCORRECT": "Текущий пароль неверен",
     "VALIDATION_EMAIL_REQUIRED": "Требуется электронная почта",
     "VALIDATION_PASSWORD_REQUIRED": "Требуется пароль",
@@ -215,7 +219,14 @@
     "searching": "Поиск…",
     "noMatches": "Совпадений не найдено",
     "openFolder": "Открыть папку",
-    "line": "строка"
+    "line": "строка",
+    "matchedByName": "имя",
+    "matchedByContent": "содержимое",
+    "matchedByBoth": "имя и содержимое",
+    "stoppedEarly": "Остановлен по истечении времени — вот что удалось найти.",
+    "firstOnly": "Первые {count} результатов. Уточните запрос, чтобы увидеть больше.",
+    "tooShort": "Введите не менее {count} символов.",
+    "showMore": "Показать ещё"
   },
   "user": {
     "account": "Аккаунт",
@@ -308,7 +319,8 @@
     "emptyTitle": "Избранного пока нет",
     "emptyDescription": "Выберите каталог и нажмите на звездочку на панели инструментов, чтобы закрепить его здесь.",
     "editTitle": "Изменить избранное",
-    "icon": "Иконка"
+    "icon": "Иконка",
+    "volumeUnavailable": "Том недоступен — он не смонтирован или больше не настроен."
   },
   "notifications": {
     "open": "Открыть уведомления",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "Введите для поиска в"
+    "hintWithin": "Введите для поиска в",
+    "hintPattern": "Используйте * и ? для поиска по именам файлов, например *.ps1"
   },
   "download": {
     "preparing": "Подготовка к скачиванию..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "Отображает файлы и папки, соответствующие настроенным скрытым шаблонам ({patterns}), в проводнике.",
       "showThumbnails": "Показывать миниатюры",
       "showThumbnailsHelp": "Показывает миниатюры для изображений и видео.",
+      "markdownOpensInEditor": "Открывать Markdown в редакторе",
+      "markdownOpensInEditorHelp": "Двойной щелчок по файлу .md сразу открывает редактор вместо предпросмотра.",
       "showSidebarFavorites": "Показывать раздел избранного",
       "showSidebarFavoritesHelp": "Показывает избранное в левой боковой панели.",
       "showSidebarShares": "Показывать раздел общего доступа",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "Показывает инструменты в левой боковой панели.",
       "defaultShareExpiration": "Стандартный срок действия ссылки",
       "defaultShareExpirationHelp": "Установите интервал по умолчанию для новых ссылок. Дата истечения будет автоматически заполнена согласно этому значению.",
+      "defaultShareExpirationInvalid": "Укажите целое число не меньше 1 или очистите поле, чтобы не задавать срок по умолчанию.",
       "expirationValue": "Значение",
       "days": "Дней",
       "weeks": "Недель",
@@ -517,10 +533,16 @@
       "skipHome": "Пропустить главную",
       "skipHomeHelp": "Автоматически перенаправляет к первому тому при заходе на главную. Если не указано, используется настройка сервера.",
       "useEnvSetting": "Использовать серверную настройку",
-      "showVersionMarks": "Отмечать файлы, у которых есть версии",
-      "showVersionMarksHelp": "Небольшая отметка в списке у файлов с предыдущими версиями и их числом. Нажмите на неё, чтобы открыть историю.",
+      "defaultView": "Вид по умолчанию",
+      "defaultViewHelp": "Вид для папки, у которой нет сохранённого вида.",
+      "viewGrid": "Сетка",
+      "viewList": "Список",
+      "viewColumns": "Столбцы",
+      "viewPhotos": "Фотографии",
       "documentsOpenInNewTab": "Открывать документы в новой вкладке",
       "documentsOpenInNewTabHelp": "Открытый файл получает собственную вкладку браузера, так что несколько остаются открытыми, пока вы продолжаете просмотр. Выключено — открывается поверх папки, как сейчас.",
+      "showVersionMarks": "Отмечать файлы, у которых есть версии",
+      "showVersionMarksHelp": "Небольшая отметка в списке у файлов с предыдущими версиями и их числом. Нажмите на неё, чтобы открыть историю.",
       "languageHelp": "Сохраняется в вашей учётной записи, в любом браузере, где вы входите."
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "Макс. размер",
       "maxDimHelp": "Самая длинная сторона в пикселях. По умолчанию 200.",
       "concurrency": "Параллельная генерация",
-      "concurrencyHelp": "Количество одновременно генерируемых миниатюр (1–50). По умолчанию 10."
+      "concurrencyHelp": "Количество одновременно генерируемых миниатюр (1–50). По умолчанию 10.",
+      "invalid": "Проверьте значения: качество от 1 до 100, макс. размер от 64 до 1024 px, параллельная генерация от 1 до 50."
     },
     "security": {
       "subtitle": "Контроль доступа к приложению.",
@@ -556,7 +579,9 @@
       "pathInvalid": "Этот путь не находится ни в одном томе, поэтому правило никогда не сработает.",
       "pathMissing": "По этому пути нет папки. Правило использует путь так, как его показывает NextExplorer, начиная с имени тома.",
       "useSuggestion": "Использовать {path}",
-      "title": "Доступ"
+      "title": "Доступ",
+      "pickFolderTitle": "Папка для этого правила",
+      "appliesToAdminsHint": "Распространить это правило и на администраторов."
     },
     "comingSoon": {
       "subtitle": "Этот раздел настроек находится в разработке. Следите за обновлениями!"
@@ -604,7 +629,9 @@
       "volumePath": "Путь к тому",
       "pathCannotChange": "Путь нельзя изменить после создания. При необходимости удалите этот том и создайте новый.",
       "accessMode": "Режим доступа",
-      "noUsers": "Нет доступных пользователей"
+      "noUsers": "Нет доступных пользователей",
+      "lockedBadge": "Заблокирован",
+      "lockedUntil": "Заблокирован до {time}"
     },
     "userDetails": {
       "profileTab": "Profile",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC Provider",
       "oidcLinkedProfile": "Linked Profile",
-      "noOidcProfileMessage": "No OIDC profiles linked to this account."
+      "noOidcProfileMessage": "No OIDC profiles linked to this account.",
+      "signInLock": "Блокировка входа",
+      "lockedHint": "Заблокирован после слишком многих неудачных попыток входа. Блокировка снимется сама в {time}.",
+      "notLockedHint": "Не заблокирован. После слишком многих неудачных попыток входа учетная запись блокируется на время.",
+      "unlock": "Разблокировать сейчас"
     },
     "trash": {
       "title": "Корзина и версии",
@@ -1023,7 +1054,8 @@
       "auto": "Авто",
       "inline": "Просмотр",
       "raw": "Как есть",
-      "download": "Скачать"
+      "download": "Скачать",
+      "editor": "Редактор"
     },
     "deleteShareTitle": "Удалить общий доступ?",
     "deleteShareMessage": "Пользователи с этой ссылкой больше не смогут получить доступ к общему элементу.",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "Загрузка пользователей...",
     "password": "Пароль",
     "protected": "Защищено",
-    "sharedWith": "Кому доступно"
+    "sharedWith": "Кому доступно",
+    "editShareLink": "Изменить ссылку доступа",
+    "saveShare": "Сохранить изменения",
+    "advancedPermissions": "Дополнительно",
+    "allowDelete": "Разрешить удаление файлов",
+    "allowCreateFolder": "Разрешить создание папок",
+    "allowCreateFile": "Разрешить создание файлов",
+    "allowUpload": "Разрешить загрузку файлов и папок",
+    "activity": "Активность",
+    "activityDetails": "Детали активности",
+    "accesses": "обращения",
+    "downloads": "скачивания",
+    "accessCount": "Количество обращений",
+    "downloadCount": "Количество скачиваний",
+    "lastAccessIp": "IP последнего обращения",
+    "lastDownloaded": "Последнее скачивание",
+    "lastDownloadIp": "IP последнего скачивания",
+    "noActivity": "Никогда",
+    "noIpRecorded": "IP не записан",
+    "allowDownload": "Разрешить скачивание",
+    "allowDownloadHelp": "Отключите, чтобы файлы можно было читать, но не сохранять копию.",
+    "versionsVisible": "Показывать версии файлов",
+    "versionsVisibleHelp": "Пользователи этого общего доступа видят предыдущие версии его файлов и могут восстанавливать их, если им разрешено редактирование.",
+    "versionsDownload": "Разрешить скачивание версий"
   },
   "trash": {
     "title": "Корзина",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "Здесь нечем открыть {name}.",
-    "backToFolder": "Назад к папке"
+    "backToFolder": "Назад к папке",
+    "tooLargeToRenderSized": "Размер документа — {size}. Предпросмотр останавливается на {limit}, поскольку размещает каждый элемент в браузере. Откройте его в редакторе или скачайте.",
+    "tooLargeToRenderWithEditor": "Размер документа — {size}. Предпросмотр останавливается на {limit}, поскольку размещает каждый элемент в браузере; редактор открывает до {editorLimit}. Откройте его в редакторе или скачайте.",
+    "stillRendering": "Отрисовка… {percent} %"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "Файл такого типа нельзя показать здесь.",
     "tooBigToRead": "Слишком большой для просмотра здесь: {size}, предел — {ceiling}. Скачайте или извлеките файл, чтобы открыть его.",
     "extract": "Извлечь сюда",
+    "extractTo": "Извлечь в…",
     "extractNamed": "Извлечь {name} сюда",
     "selectAll": "Выбрать всё здесь",
     "selectNamed": "Выбрать {name}",
@@ -1244,5 +1303,31 @@
     "empty": "Здесь нечего выбрать",
     "breadcrumb": "Путь к папке",
     "chooseFolder": "Выбрать эту папку"
+  },
+  "destinationPicker": {
+    "moveTitle": "Переместить в",
+    "copyTitle": "Копировать в",
+    "moveHere": "Переместить сюда",
+    "copyHere": "Копировать сюда",
+    "noFolders": "Здесь нет папок",
+    "rootRejected": "Сначала выберите том или папку",
+    "itselfRejected": "Папку нельзя переместить в саму себя",
+    "descendantRejected": "Папку нельзя переместить в одну из её собственных папок",
+    "alreadyThereRejected": "Уже здесь",
+    "restoreTitle": "Восстановить в",
+    "restoreHere": "Восстановить сюда",
+    "versionCopyTitle": "Восстановить копию в",
+    "versionCopyHere": "Восстановить копию сюда",
+    "replaceTitle": "Выберите файл для замены",
+    "replaceHere": "Заменить этот файл",
+    "fileRequired": "Выберите файл",
+    "sameFileRejected": "Выберите другой файл, не этот",
+    "nothingHere": "Здесь ничего нет",
+    "extractTitle": "Извлечь в",
+    "extractHere": "Извлечь сюда"
+  },
+  "links": {
+    "outside": "Ссылка за пределы этого тома",
+    "outsideExplained": "{name} — ссылка на место за пределами этого тома. Её нельзя открыть, переименовать или удалить отсюда; удалите её на сервере, если она больше не нужна."
   }
 }
diff --git a/frontend/src/i18n/locales/sv.json b/frontend/src/i18n/locales/sv.json
index 4e6d8f496..c8df7cb72 100644
--- a/frontend/src/i18n/locales/sv.json
+++ b/frontend/src/i18n/locales/sv.json
@@ -72,7 +72,9 @@
     "readwrite": "Läs/Skriv",
     "add": "Lägg till",
     "back": "Bakåt",
-    "logoAlt": "Logotyp för {name}"
+    "logoAlt": "Logotyp för {name}",
+    "toggleSection": "Visa eller dölj avsnittet",
+    "dismissWarning": "Avfärda varningen"
   },
   "editor": {
     "editing": "Editing",
@@ -169,12 +171,14 @@
     "saveVolume": "Failed to save volume",
     "removeVolume": "Failed to remove volume",
     "totpCodeRequired": "Ange koden.",
-    "identifierRequired": "En e-postadress eller ett användarnamn krävs"
+    "identifierRequired": "En e-postadress eller ett användarnamn krävs",
+    "unlockUser": "Kontot kunde inte låsas upp"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "Autentisering krävs",
     "AUTH_INVALID_CREDENTIALS": "Ogiltig e-post eller lösenord",
     "AUTH_ACCOUNT_LOCKED": "Kontot är tillfälligt låst på grund av misslyckade inloggningsförsök",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "Kontot är låst efter för många misslyckade inloggningsförsök. Försök igen om {minutes} minut | Kontot är låst efter för många misslyckade inloggningsförsök. Försök igen om {minutes} minuter",
     "AUTH_PASSWORD_INCORRECT": "Det nuvarande lösenordet är felaktigt",
     "VALIDATION_EMAIL_REQUIRED": "E-post krävs",
     "VALIDATION_PASSWORD_REQUIRED": "Lösenord krävs",
@@ -215,7 +219,14 @@
     "searching": "Söker…",
     "noMatches": "Inga träffar hittades",
     "openFolder": "Öppna mapp",
-    "line": "rad"
+    "line": "rad",
+    "matchedByName": "namn",
+    "matchedByContent": "innehåll",
+    "matchedByBoth": "namn och innehåll",
+    "stoppedEarly": "Avbröts vid tidsgränsen — det här hittades.",
+    "firstOnly": "De första {count} träffarna. Avgränsa sökningen för att se fler.",
+    "tooShort": "Skriv minst {count} tecken.",
+    "showMore": "Visa fler"
   },
   "user": {
     "account": "Konto",
@@ -308,7 +319,8 @@
     "emptyTitle": "Inga favoriter ännu",
     "emptyDescription": "Välj en katalog och tryck på stjärnan i huvudverktygsfältet för att fästa den här.",
     "editTitle": "Redigera favorit",
-    "icon": "Ikon"
+    "icon": "Ikon",
+    "volumeUnavailable": "Volymen är inte tillgänglig – den är inte monterad eller inte längre konfigurerad."
   },
   "notifications": {
     "open": "Öppna aviseringar",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "Skriv för att söka inom"
+    "hintWithin": "Skriv för att söka inom",
+    "hintPattern": "Använd * och ? för att filtrera filnamn, till exempel *.ps1"
   },
   "download": {
     "preparing": "Förbereder nerladdning..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "Visar filer och mappar som matchar de konfigurerade dolda mönstren ({patterns}) i Utforskaren.",
       "showThumbnails": "Visa miniatyrbilder",
       "showThumbnailsHelp": "Visar förhandsgranskningar av bilder och videor i miniatyrformat.",
+      "markdownOpensInEditor": "Öppna Markdown i redigeraren",
+      "markdownOpensInEditorHelp": "Dubbelklick på en .md-fil öppnar redigeraren direkt i stället för förhandsvisningen.",
       "showSidebarFavorites": "Visa Favoriter",
       "showSidebarFavoritesHelp": "Visar Favoriter i vänster sidofält.",
       "showSidebarShares": "Visa Delningar",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "Visar Verktyg i vänster sidofält.",
       "defaultShareExpiration": "Standardutgång för delningar",
       "defaultShareExpirationHelp": "Ställ in en standardperiod för nya delningar. Utlösningsdatumet fylls i automatiskt baserat på detta val.",
+      "defaultShareExpirationInvalid": "Ange ett heltal på minst 1, eller töm fältet för att inte ha någon standardutgång.",
       "expirationValue": "Värde",
       "days": "Dagar",
       "weeks": "Veckor",
@@ -517,10 +533,16 @@
       "skipHome": "Hoppa över startsidan",
       "skipHomeHelp": "Omdirigerar automatiskt till den första volymen när startsidan öppnas. Om inget anges används serverinställningen.",
       "useEnvSetting": "Använd serverinställning",
-      "showVersionMarks": "Märk filer som har versioner",
-      "showVersionMarksHelp": "Ett litet märke i listan på filer med tidigare versioner, med antalet. Klicka på det för att öppna historiken.",
+      "defaultView": "Standardvy",
+      "defaultViewHelp": "Vyn för en mapp som saknar egen sparad vy.",
+      "viewGrid": "Rutnät",
+      "viewList": "Lista",
+      "viewColumns": "Kolumner",
+      "viewPhotos": "Foton",
       "documentsOpenInNewTab": "Öppna dokument i en ny flik",
       "documentsOpenInNewTabHelp": "En fil som öppnas får en egen webbläsarflik, så att flera kan stå öppna medan du bläddrar vidare. Av öppnas den ovanpå mappen som i dag.",
+      "showVersionMarks": "Märk filer som har versioner",
+      "showVersionMarksHelp": "Ett litet märke i listan på filer med tidigare versioner, med antalet. Klicka på det för att öppna historiken.",
       "languageHelp": "Sparas med ditt konto, i varje webbläsare du loggar in från."
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "Max mått",
       "maxDimHelp": "Längsta sidan i bildpunkter. Standard är 200.",
       "concurrency": "Samtidig generering",
-      "concurrencyHelp": "Antal miniatyrbilder som ska genereras samtidigt (1–50). Standard är 10."
+      "concurrencyHelp": "Antal miniatyrbilder som ska genereras samtidigt (1–50). Standard är 10.",
+      "invalid": "Kontrollera värdena: kvalitet 1 till 100, max mått 64 till 1024 px, samtidig generering 1 till 50."
     },
     "security": {
       "subtitle": "Kontrollera åtkomst till appen.",
@@ -556,7 +579,9 @@
       "pathInvalid": "Den här sökvägen ligger inte i någon volym, så regeln kommer aldrig att gälla.",
       "pathMissing": "Det finns ingen mapp på den här sökvägen. En regel använder sökvägen så som NextExplorer visar den, med volymens namn först.",
       "useSuggestion": "Använd {path}",
-      "title": "Åtkomst"
+      "title": "Åtkomst",
+      "pickFolderTitle": "Mapp för den här regeln",
+      "appliesToAdminsHint": "Låt regeln gälla även administratörer."
     },
     "comingSoon": {
       "subtitle": "Denna inställningssektion håller på att byggas. Vänta och se!"
@@ -604,7 +629,9 @@
       "volumePath": "Volymsökväg",
       "pathCannotChange": "Sökvägen kan inte ändras i efterhand. Ta bort och skapa ny vid behov.",
       "accessMode": "Åtkomstläge",
-      "noUsers": "Inga användare tillgängliga"
+      "noUsers": "Inga användare tillgängliga",
+      "lockedBadge": "Låst",
+      "lockedUntil": "Låst till {time}"
     },
     "userDetails": {
       "profileTab": "Profile",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC Provider",
       "oidcLinkedProfile": "Linked Profile",
-      "noOidcProfileMessage": "No OIDC profiles linked to this account."
+      "noOidcProfileMessage": "No OIDC profiles linked to this account.",
+      "signInLock": "Inloggningsspärr",
+      "lockedHint": "Låst efter för många misslyckade inloggningsförsök. Spärren släpper av sig själv kl. {time}.",
+      "notLockedHint": "Inte låst. För många misslyckade inloggningsförsök låser ett konto en stund.",
+      "unlock": "Lås upp nu"
     },
     "trash": {
       "title": "Papperskorg och versioner",
@@ -1023,7 +1054,8 @@
       "auto": "Automatiskt",
       "inline": "Visa",
       "raw": "Rå",
-      "download": "Hämta"
+      "download": "Hämta",
+      "editor": "Redigerare"
     },
     "deleteShareTitle": "Ta bort delning?",
     "deleteShareMessage": "Personer med den här länken kommer inte längre åt det delade objektet.",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "Läser in användare...",
     "password": "Lösenord",
     "protected": "Skyddad",
-    "sharedWith": "Delad med"
+    "sharedWith": "Delad med",
+    "editShareLink": "Redigera delningslänk",
+    "saveShare": "Spara ändringar",
+    "advancedPermissions": "Avancerat",
+    "allowDelete": "Tillåt att radera filer",
+    "allowCreateFolder": "Tillåt att skapa mappar",
+    "allowCreateFile": "Tillåt att skapa filer",
+    "allowUpload": "Tillåt uppladdning av filer och mappar",
+    "activity": "Aktivitet",
+    "activityDetails": "Aktivitetsdetaljer",
+    "accesses": "åtkomster",
+    "downloads": "nerladdningar",
+    "accessCount": "Antal åtkomster",
+    "downloadCount": "Antal nerladdningar",
+    "lastAccessIp": "Senaste åtkomst-IP",
+    "lastDownloaded": "Senast nerladdad",
+    "lastDownloadIp": "Senaste nerladdnings-IP",
+    "noActivity": "Aldrig",
+    "noIpRecorded": "Ingen IP registrerad",
+    "allowDownload": "Tillåt nedladdning",
+    "allowDownloadHelp": "Stäng av för att låta filerna läsas utan att en kopia tas.",
+    "versionsVisible": "Visa filversioner",
+    "versionsVisibleHelp": "De som använder den här delningen ser tidigare versioner av dess filer och kan återställa dem om de får redigera.",
+    "versionsDownload": "Tillåt nedladdning av versioner"
   },
   "trash": {
     "title": "Papperskorg",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "Inget här kan öppna {name}.",
-    "backToFolder": "Tillbaka till mappen"
+    "backToFolder": "Tillbaka till mappen",
+    "tooLargeToRenderSized": "Dokumentet är {size}. Förhandsvisningen stannar vid {limit}, eftersom den placerar varje element i webbläsaren. Öppna det i redigeraren eller ladda ner det.",
+    "tooLargeToRenderWithEditor": "Dokumentet är {size}. Förhandsvisningen stannar vid {limit}, eftersom den placerar varje element i webbläsaren; redigeraren öppnar upp till {editorLimit}. Öppna det i redigeraren eller ladda ner det.",
+    "stillRendering": "Renderar… {percent} %"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "Den här filtypen kan inte visas här.",
     "tooBigToRead": "För stor för att visas här: {size}, gränsen är {ceiling}. Ladda ner eller packa upp filen för att öppna den.",
     "extract": "Extrahera hit",
+    "extractTo": "Packa upp till…",
     "extractNamed": "Extrahera {name} hit",
     "selectAll": "Markera allt här",
     "selectNamed": "Markera {name}",
@@ -1244,5 +1303,31 @@
     "empty": "Det finns inget att välja här",
     "breadcrumb": "Mappsökväg",
     "chooseFolder": "Välj den här mappen"
+  },
+  "destinationPicker": {
+    "moveTitle": "Flytta till",
+    "copyTitle": "Kopiera till",
+    "moveHere": "Flytta hit",
+    "copyHere": "Kopiera hit",
+    "noFolders": "Inga mappar här",
+    "rootRejected": "Välj en volym eller mapp först",
+    "itselfRejected": "En mapp kan inte flyttas in i sig själv",
+    "descendantRejected": "En mapp kan inte flyttas till en av sina egna mappar",
+    "alreadyThereRejected": "Redan här",
+    "restoreTitle": "Återställ till",
+    "restoreHere": "Återställ hit",
+    "versionCopyTitle": "Återställ en kopia till",
+    "versionCopyHere": "Återställ en kopia här",
+    "replaceTitle": "Välj filen som ska ersättas",
+    "replaceHere": "Ersätt den här filen",
+    "fileRequired": "Välj en fil",
+    "sameFileRejected": "Välj en annan fil än den här",
+    "nothingHere": "Inget här",
+    "extractTitle": "Packa upp till",
+    "extractHere": "Packa upp här"
+  },
+  "links": {
+    "outside": "Länk utanför den här volymen",
+    "outsideExplained": "{name} är en länk till en plats utanför den här volymen. Den kan inte öppnas, byta namn eller tas bort härifrån; ta bort den på servern om den inte längre behövs."
   }
 }
diff --git a/frontend/src/i18n/locales/zh-CN.json b/frontend/src/i18n/locales/zh-CN.json
index 5ac5665f2..63c22d713 100644
--- a/frontend/src/i18n/locales/zh-CN.json
+++ b/frontend/src/i18n/locales/zh-CN.json
@@ -72,7 +72,9 @@
     "readwrite": "读/写",
     "add": "添加",
     "back": "后退",
-    "logoAlt": "{name} 的徽标"
+    "logoAlt": "{name} 的徽标",
+    "toggleSection": "展开或折叠此部分",
+    "dismissWarning": "忽略此警告"
   },
   "editor": {
     "editing": "Editing",
@@ -169,12 +171,14 @@
     "saveVolume": "Failed to save volume",
     "removeVolume": "Failed to remove volume",
     "totpCodeRequired": "请输入验证码。",
-    "identifierRequired": "需要邮箱地址或用户名"
+    "identifierRequired": "需要邮箱地址或用户名",
+    "unlockUser": "无法解锁账户"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "需要身份验证",
     "AUTH_INVALID_CREDENTIALS": "电子邮件或密码无效",
     "AUTH_ACCOUNT_LOCKED": "由于登录尝试失败，账户已被临时锁定",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "登录失败次数过多，账户已被锁定。请在{minutes}分钟后重试",
     "AUTH_PASSWORD_INCORRECT": "当前密码不正确",
     "VALIDATION_EMAIL_REQUIRED": "电子邮件为必填项",
     "VALIDATION_PASSWORD_REQUIRED": "密码为必填项",
@@ -215,7 +219,14 @@
     "searching": "正在搜索…",
     "noMatches": "未找到匹配结果",
     "openFolder": "打开文件夹",
-    "line": "行"
+    "line": "行",
+    "matchedByName": "文件名",
+    "matchedByContent": "内容",
+    "matchedByBoth": "文件名和内容",
+    "stoppedEarly": "已达时间上限而停止 — 以下是已找到的内容。",
+    "firstOnly": "前 {count} 条结果。缩小搜索范围可查看更多。",
+    "tooShort": "请至少输入 {count} 个字符。",
+    "showMore": "显示更多"
   },
   "user": {
     "account": "账户",
@@ -308,7 +319,8 @@
     "emptyTitle": "尚无收藏",
     "emptyDescription": "选择一个目录并点击主工具栏中的星标，将其固定在此处。",
     "editTitle": "编辑收藏",
-    "icon": "图标"
+    "icon": "图标",
+    "volumeUnavailable": "卷不可用 — 未挂载，或已不再配置。"
   },
   "notifications": {
     "open": "打开通知",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "键入以在其中搜索"
+    "hintWithin": "键入以在其中搜索",
+    "hintPattern": "使用 * 和 ? 匹配文件名，例如 *.ps1"
   },
   "download": {
     "preparing": "正在准备下载..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "在文件浏览器中显示匹配已配置隐藏模式（{patterns}）的文件和文件夹。",
       "showThumbnails": "显示缩略图",
       "showThumbnailsHelp": "在浏览器中显示图像和视频的缩略预览。",
+      "markdownOpensInEditor": "在编辑器中打开 Markdown",
+      "markdownOpensInEditorHelp": "双击 .md 文件将直接打开编辑器，而不是预览。",
       "showSidebarFavorites": "显示收藏夹区域",
       "showSidebarFavoritesHelp": "在左侧边栏显示收藏夹。",
       "showSidebarShares": "显示共享区域",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "在左侧边栏显示工具。",
       "defaultShareExpiration": "分享默认过期时间",
       "defaultShareExpirationHelp": "为新的分享设置默认期限。创建分享时将自动填充到期日期。",
+      "defaultShareExpirationInvalid": "请输入不小于 1 的整数，或清空此字段以不设默认过期时间。",
       "expirationValue": "值",
       "days": "天",
       "weeks": "周",
@@ -517,10 +533,16 @@
       "skipHome": "跳过首页",
       "skipHomeHelp": "访问首页时自动重定向到第一个卷。未设置时遵循服务器配置。",
       "useEnvSetting": "使用服务器设置",
-      "showVersionMarks": "标记有版本的文件",
-      "showVersionMarksHelp": "在列表中为有历史版本的文件加一个小标记，并显示数量。点击即可打开历史记录。",
+      "defaultView": "默认视图",
+      "defaultViewHelp": "没有单独记住视图的文件夹所使用的视图。",
+      "viewGrid": "网格",
+      "viewList": "列表",
+      "viewColumns": "分栏",
+      "viewPhotos": "照片",
       "documentsOpenInNewTab": "在新标签页中打开文档",
       "documentsOpenInNewTabHelp": "打开文件时给它一个独立的浏览器标签页，这样你继续浏览时可以同时开着好几个。关闭后，它像现在一样覆盖在文件夹上打开。",
+      "showVersionMarks": "标记有版本的文件",
+      "showVersionMarksHelp": "在列表中为有历史版本的文件加一个小标记，并显示数量。点击即可打开历史记录。",
       "languageHelp": "保存在您的账户中，在您登录的每个浏览器上生效。"
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "最大尺寸",
       "maxDimHelp": "最长边的像素数。默认值为 200。",
       "concurrency": "并行生成",
-      "concurrencyHelp": "同时生成的缩略图数量 (1–50)。默认值为 10。"
+      "concurrencyHelp": "同时生成的缩略图数量 (1–50)。默认值为 10。",
+      "invalid": "请检查数值：质量 1 至 100，最大尺寸 64 至 1024 px，并行生成 1 至 50。"
     },
     "security": {
       "subtitle": "控制对应用的访问。",
@@ -556,7 +579,9 @@
       "pathInvalid": "此路径不在任何卷内，因此该规则永远不会生效。",
       "pathMissing": "此路径下没有文件夹。规则使用 NextExplorer 显示的路径，以卷名开头。",
       "useSuggestion": "使用 {path}",
-      "title": "访问"
+      "title": "访问",
+      "pickFolderTitle": "此规则的文件夹",
+      "appliesToAdminsHint": "让该规则同样约束管理员。"
     },
     "comingSoon": {
       "subtitle": "此设置部分正在构建中，敬请期待！"
@@ -604,7 +629,9 @@
       "volumePath": "卷路径",
       "pathCannotChange": "创建后无法更改路径。如需更改，请删除此卷并重新创建。",
       "accessMode": "访问模式",
-      "noUsers": "没有可用用户"
+      "noUsers": "没有可用用户",
+      "lockedBadge": "已锁定",
+      "lockedUntil": "锁定至 {time}"
     },
     "userDetails": {
       "profileTab": "Profile",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC Provider",
       "oidcLinkedProfile": "Linked Profile",
-      "noOidcProfileMessage": "No OIDC profiles linked to this account."
+      "noOidcProfileMessage": "No OIDC profiles linked to this account.",
+      "signInLock": "登录锁定",
+      "lockedHint": "登录失败次数过多，已被锁定。将于 {time} 自动解锁。",
+      "notLockedHint": "未锁定。登录失败次数过多会使账户暂时锁定。",
+      "unlock": "立即解锁"
     },
     "trash": {
       "title": "回收站和版本",
@@ -1023,7 +1054,8 @@
       "auto": "自动",
       "inline": "查看",
       "raw": "原始",
-      "download": "下载"
+      "download": "下载",
+      "editor": "编辑器"
     },
     "deleteShareTitle": "移除共享？",
     "deleteShareMessage": "拥有此链接的人员将无法再访问共享项目。",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "正在加载用户...",
     "password": "密码",
     "protected": "已保护",
-    "sharedWith": "共享对象"
+    "sharedWith": "共享对象",
+    "editShareLink": "编辑共享链接",
+    "saveShare": "保存更改",
+    "advancedPermissions": "高级",
+    "allowDelete": "允许删除文件",
+    "allowCreateFolder": "允许创建文件夹",
+    "allowCreateFile": "允许创建文件",
+    "allowUpload": "允许上传文件和文件夹",
+    "activity": "活动",
+    "activityDetails": "活动详情",
+    "accesses": "访问",
+    "downloads": "下载",
+    "accessCount": "访问次数",
+    "downloadCount": "下载次数",
+    "lastAccessIp": "上次访问 IP",
+    "lastDownloaded": "上次下载",
+    "lastDownloadIp": "上次下载 IP",
+    "noActivity": "从不",
+    "noIpRecorded": "未记录 IP",
+    "allowDownload": "允许下载",
+    "allowDownloadHelp": "关闭后，他人可以阅读文件但无法下载副本。",
+    "versionsVisible": "显示文件版本",
+    "versionsVisibleHelp": "使用此共享的人可以看到其文件的历史版本，若有编辑权限还可以恢复。",
+    "versionsDownload": "允许下载版本"
   },
   "trash": {
     "title": "回收站",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "这里没有什么能打开 {name}。",
-    "backToFolder": "返回文件夹"
+    "backToFolder": "返回文件夹",
+    "tooLargeToRenderSized": "该文档大小为 {size}。预览在 {limit} 处停止，因为它需要在浏览器中排布每一个元素。请在编辑器中打开或下载。",
+    "tooLargeToRenderWithEditor": "该文档大小为 {size}。预览在 {limit} 处停止，因为它需要在浏览器中排布每一个元素；编辑器最多可打开 {editorLimit}。请在编辑器中打开或下载。",
+    "stillRendering": "正在渲染… {percent}%"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "此类文件无法在此显示。",
     "tooBigToRead": "太大，无法在此显示：{size}，上限为 {ceiling}。请下载或解压后打开。",
     "extract": "解压到此处",
+    "extractTo": "解压到…",
     "extractNamed": "将 {name} 解压到此处",
     "selectAll": "全选当前层级",
     "selectNamed": "选择 {name}",
@@ -1244,5 +1303,31 @@
     "empty": "这里没有可选项",
     "breadcrumb": "文件夹路径",
     "chooseFolder": "选择此文件夹"
+  },
+  "destinationPicker": {
+    "moveTitle": "移动到",
+    "copyTitle": "复制到",
+    "moveHere": "移动到此处",
+    "copyHere": "复制到此处",
+    "noFolders": "此处没有文件夹",
+    "rootRejected": "请先选择卷或文件夹",
+    "itselfRejected": "文件夹不能移动到自身",
+    "descendantRejected": "文件夹不能移动到其自身的子文件夹",
+    "alreadyThereRejected": "已在此处",
+    "restoreTitle": "还原到",
+    "restoreHere": "还原到此处",
+    "versionCopyTitle": "将副本恢复到",
+    "versionCopyHere": "将副本恢复到此处",
+    "replaceTitle": "选择要替换的文件",
+    "replaceHere": "替换此文件",
+    "fileRequired": "请选择一个文件",
+    "sameFileRejected": "请选择此文件以外的文件",
+    "nothingHere": "这里什么都没有",
+    "extractTitle": "解压到",
+    "extractHere": "解压到此处"
+  },
+  "links": {
+    "outside": "指向此卷外部的链接",
+    "outsideExplained": "{name} 是指向此卷外部位置的链接。无法在此打开、重命名或删除它；如果不再需要，请在服务器上将其移除。"
   }
 }
diff --git a/frontend/src/i18n/locales/zh-TW.json b/frontend/src/i18n/locales/zh-TW.json
index 3dfba8d63..d44bb12c7 100644
--- a/frontend/src/i18n/locales/zh-TW.json
+++ b/frontend/src/i18n/locales/zh-TW.json
@@ -72,7 +72,9 @@
     "readwrite": "讀寫",
     "add": "新增",
     "back": "後退",
-    "logoAlt": "{name} 的標誌"
+    "logoAlt": "{name} 的標誌",
+    "toggleSection": "展開或摺疊此區段",
+    "dismissWarning": "忽略此警告"
   },
   "editor": {
     "editing": "Editing",
@@ -169,12 +171,14 @@
     "saveVolume": "儲存儲存卷失敗",
     "removeVolume": "移除儲存卷失敗",
     "totpCodeRequired": "請輸入驗證碼。",
-    "identifierRequired": "需要電子郵件地址或使用者名稱"
+    "identifierRequired": "需要電子郵件地址或使用者名稱",
+    "unlockUser": "無法解鎖帳戶"
   },
   "serverErrors": {
     "AUTH_REQUIRED": "需要身份驗證",
     "AUTH_INVALID_CREDENTIALS": "電子郵件或密碼無效",
     "AUTH_ACCOUNT_LOCKED": "由於登入嘗試失敗，帳戶已暫時鎖定",
+    "AUTH_ACCOUNT_LOCKED_RETRY": "登入失敗次數過多，帳戶已被鎖定。請在{minutes}分鐘後重試",
     "AUTH_PASSWORD_INCORRECT": "目前密碼不正確",
     "VALIDATION_EMAIL_REQUIRED": "電子郵件為必填",
     "VALIDATION_PASSWORD_REQUIRED": "密碼為必填",
@@ -215,7 +219,14 @@
     "searching": "正在搜尋…",
     "noMatches": "未找到吻合的結果",
     "openFolder": "打開檔案夾",
-    "line": "行"
+    "line": "行",
+    "matchedByName": "檔名",
+    "matchedByContent": "內容",
+    "matchedByBoth": "檔名和內容",
+    "stoppedEarly": "已達時間上限而停止 — 以下是已找到的內容。",
+    "firstOnly": "前 {count} 筆結果。縮小搜尋範圍可查看更多。",
+    "tooShort": "請至少輸入 {count} 個字元。",
+    "showMore": "顯示更多"
   },
   "user": {
     "account": "帳號",
@@ -308,7 +319,8 @@
     "emptyTitle": "尚無最愛",
     "emptyDescription": "選擇一個目錄並點擊主工具欄中的星星，將其固定在此處。",
     "editTitle": "編輯最愛",
-    "icon": "圖標"
+    "icon": "圖標",
+    "volumeUnavailable": "磁碟區無法使用 — 未掛載，或已不再設定。"
   },
   "notifications": {
     "open": "打開通知",
@@ -322,7 +334,8 @@
     }
   },
   "spotlight": {
-    "hintWithin": "輸入關鍵字來搜尋"
+    "hintWithin": "輸入關鍵字來搜尋",
+    "hintPattern": "使用 * 和 ? 比對檔案名稱，例如 *.ps1"
   },
   "download": {
     "preparing": "正在準備下載..."
@@ -502,6 +515,8 @@
       "showHiddenFilesHelp": "在檔案瀏覽器中顯示符合已設定隱藏模式（{patterns}）的檔案和資料夾。",
       "showThumbnails": "顯示縮圖",
       "showThumbnailsHelp": "在瀏覽器中顯示圖片和影片的縮圖預覽。",
+      "markdownOpensInEditor": "在編輯器中開啟 Markdown",
+      "markdownOpensInEditorHelp": "按兩下 .md 檔案會直接開啟編輯器，而不是預覽。",
       "showSidebarFavorites": "顯示我的最愛區段",
       "showSidebarFavoritesHelp": "在左側邊欄顯示我的最愛。",
       "showSidebarShares": "顯示分享區段",
@@ -510,6 +525,7 @@
       "showSidebarToolsHelp": "在左側邊欄顯示工具。",
       "defaultShareExpiration": "分享預設過期時間",
       "defaultShareExpirationHelp": "為新的分享設置預設期限。建立分享時將自動填入到期日期。",
+      "defaultShareExpirationInvalid": "請輸入不小於 1 的整數，或清空此欄位以不設預設過期時間。",
       "expirationValue": "值",
       "days": "天",
       "weeks": "週",
@@ -517,10 +533,16 @@
       "skipHome": "跳過首頁",
       "skipHomeHelp": "進入首頁時自動導向到第一個儲存卷。未設定時會使用伺服器預設。",
       "useEnvSetting": "使用伺服器預設",
-      "showVersionMarks": "標示有版本的檔案",
-      "showVersionMarksHelp": "在清單中為有舊版本的檔案加上一個小標記，並顯示數量。點一下即可開啟歷程記錄。",
+      "defaultView": "預設檢視",
+      "defaultViewHelp": "沒有單獨記住檢視的資料夾所使用的檢視。",
+      "viewGrid": "格狀",
+      "viewList": "清單",
+      "viewColumns": "分欄",
+      "viewPhotos": "相片",
       "documentsOpenInNewTab": "在新分頁中開啟文件",
       "documentsOpenInNewTabHelp": "開啟檔案時給它一個獨立的瀏覽器分頁，這樣你繼續瀏覽時可以同時開著好幾個。關閉後，它像現在一樣覆蓋在資料夾上開啟。",
+      "showVersionMarks": "標示有版本的檔案",
+      "showVersionMarksHelp": "在清單中為有舊版本的檔案加上一個小標記，並顯示數量。點一下即可開啟歷程記錄。",
       "languageHelp": "儲存在您的帳戶中，在您登入的每個瀏覽器上生效。"
     },
     "thumbs": {
@@ -532,7 +554,8 @@
       "maxDim": "最大尺寸",
       "maxDimHelp": "最長邊的畫素。預設值為 200。",
       "concurrency": "平行產生",
-      "concurrencyHelp": "同時產生的縮圖數量 (1–50)。預設值為 10。"
+      "concurrencyHelp": "同時產生的縮圖數量 (1–50)。預設值為 10。",
+      "invalid": "請檢查數值：品質 1 至 100，最大尺寸 64 至 1024 px，平行產生 1 至 50。"
     },
     "security": {
       "subtitle": "控制對應用產生的存取。",
@@ -556,7 +579,9 @@
       "pathInvalid": "此路徑不在任何磁碟區內，因此該規則永遠不會生效。",
       "pathMissing": "此路徑下沒有資料夾。規則使用 NextExplorer 顯示的路徑，以磁碟區名稱開頭。",
       "useSuggestion": "使用 {path}",
-      "title": "存取"
+      "title": "存取",
+      "pickFolderTitle": "此規則的資料夾",
+      "appliesToAdminsHint": "讓該規則同樣約束管理員。"
     },
     "comingSoon": {
       "subtitle": "此設置部分正在建置中，敬請期待！"
@@ -604,7 +629,9 @@
       "volumePath": "儲存卷路徑",
       "pathCannotChange": "建立後無法更改路徑。如需更改，請刪除此卷並重新建立。",
       "accessMode": "存取模式",
-      "noUsers": "沒有可用使用者"
+      "noUsers": "沒有可用使用者",
+      "lockedBadge": "已鎖定",
+      "lockedUntil": "鎖定至 {time}"
     },
     "userDetails": {
       "profileTab": "Profile",
@@ -630,7 +657,11 @@
       "sso": "Single Sign-On (OIDC)",
       "oidcProvider": "OIDC Provider",
       "oidcLinkedProfile": "Linked Profile",
-      "noOidcProfileMessage": "No OIDC profiles linked to this account."
+      "noOidcProfileMessage": "No OIDC profiles linked to this account.",
+      "signInLock": "登入鎖定",
+      "lockedHint": "登入失敗次數過多，已被鎖定。將於 {time} 自動解鎖。",
+      "notLockedHint": "未鎖定。登入失敗次數過多會使帳戶暫時鎖定。",
+      "unlock": "立即解鎖"
     },
     "trash": {
       "title": "資源回收筒和版本",
@@ -1023,7 +1054,8 @@
       "auto": "自動",
       "inline": "檢視",
       "raw": "原始",
-      "download": "下載"
+      "download": "下載",
+      "editor": "編輯器"
     },
     "deleteShareTitle": "移除分享？",
     "deleteShareMessage": "擁有此連結的人將無法再存取分享的項目。",
@@ -1032,7 +1064,30 @@
     "loadingUsers": "正在載入使用者...",
     "password": "密碼",
     "protected": "已保護",
-    "sharedWith": "分享對象"
+    "sharedWith": "分享對象",
+    "editShareLink": "編輯分享連結",
+    "saveShare": "儲存變更",
+    "advancedPermissions": "進階",
+    "allowDelete": "允許刪除檔案",
+    "allowCreateFolder": "允許建立檔案夾",
+    "allowCreateFile": "允許建立檔案",
+    "allowUpload": "允許上傳檔案和檔案夾",
+    "activity": "活動",
+    "activityDetails": "活動詳細資訊",
+    "accesses": "次存取",
+    "downloads": "次下載",
+    "accessCount": "存取次數",
+    "downloadCount": "下載次數",
+    "lastAccessIp": "上次存取 IP",
+    "lastDownloaded": "上次下載",
+    "lastDownloadIp": "上次下載 IP",
+    "noActivity": "從未",
+    "noIpRecorded": "未記錄 IP",
+    "allowDownload": "允許下載",
+    "allowDownloadHelp": "關閉後，他人可以閱讀檔案但無法下載副本。",
+    "versionsVisible": "顯示檔案版本",
+    "versionsVisibleHelp": "使用此共用的人可以看到其檔案的先前版本，若有編輯權限還可以還原。",
+    "versionsDownload": "允許下載版本"
   },
   "trash": {
     "title": "資源回收筒",
@@ -1209,7 +1264,10 @@
   },
   "preview": {
     "nothingOpensIt": "這裡沒有什麼能開啟 {name}。",
-    "backToFolder": "返回資料夾"
+    "backToFolder": "返回資料夾",
+    "tooLargeToRenderSized": "這份文件大小為 {size}。預覽在 {limit} 處停止，因為它需要在瀏覽器中排版每一個元素。請在編輯器中開啟或下載。",
+    "tooLargeToRenderWithEditor": "這份文件大小為 {size}。預覽在 {limit} 處停止，因為它需要在瀏覽器中排版每一個元素；編輯器最多可開啟 {editorLimit}。請在編輯器中開啟或下載。",
+    "stillRendering": "正在算繪… {percent}%"
   },
   "archive": {
     "password": {
@@ -1230,6 +1288,7 @@
     "notReadable": "這類檔案無法在此顯示。",
     "tooBigToRead": "太大，無法在此顯示：{size}，上限為 {ceiling}。請下載或解壓縮後開啟。",
     "extract": "解壓縮到此處",
+    "extractTo": "解壓縮到…",
     "extractNamed": "將 {name} 解壓縮到此處",
     "selectAll": "全選目前層級",
     "selectNamed": "選擇 {name}",
@@ -1244,5 +1303,31 @@
     "empty": "這裡沒有可選項目",
     "breadcrumb": "資料夾路徑",
     "chooseFolder": "選擇此資料夾"
+  },
+  "destinationPicker": {
+    "moveTitle": "移動到",
+    "copyTitle": "複製到",
+    "moveHere": "移動到此處",
+    "copyHere": "複製到此處",
+    "noFolders": "此處沒有資料夾",
+    "rootRejected": "請先選擇磁碟區或資料夾",
+    "itselfRejected": "資料夾不能移動到自身",
+    "descendantRejected": "資料夾不能移動到其自身的子資料夾",
+    "alreadyThereRejected": "已在此處",
+    "restoreTitle": "還原到",
+    "restoreHere": "還原到此處",
+    "versionCopyTitle": "將副本還原到",
+    "versionCopyHere": "將副本還原到此處",
+    "replaceTitle": "選擇要取代的檔案",
+    "replaceHere": "取代此檔案",
+    "fileRequired": "請選擇一個檔案",
+    "sameFileRejected": "請選擇此檔案以外的檔案",
+    "nothingHere": "這裡什麼都沒有",
+    "extractTitle": "解壓縮到",
+    "extractHere": "解壓縮到此處"
+  },
+  "links": {
+    "outside": "指向此磁碟區外部的連結",
+    "outsideExplained": "{name} 是指向此磁碟區外部位置的連結。無法在此開啟、重新命名或刪除；如果不再需要，請在伺服器上將其移除。"
   }
 }
diff --git a/frontend/src/icons/FileIcon.vue b/frontend/src/icons/FileIcon.vue
index 96a343334..12229a022 100644
--- a/frontend/src/icons/FileIcon.vue
+++ b/frontend/src/icons/FileIcon.vue
@@ -1,5 +1,5 @@
 <script setup>
-import { computed, ref, watchEffect } from 'vue';
+import { computed, nextTick, onBeforeUnmount, onMounted, ref, watch } from 'vue';
 
 import { apiBase } from '@/api';
 import { useAppSettings } from '@/stores/appSettings';
@@ -15,6 +15,7 @@ import ImageIcon from './files/image-icon.vue';
 import VideoIcon from './files/video-icon.vue';
 import AudioIcon from './files/audio-icon.vue';
 import ArchiveIcon from './files/archive-icon.vue';
+import { badgeForExtension } from './fileBadges';
 
 const props = defineProps({
   item: {
@@ -80,193 +81,146 @@ const isPreviewable = computed(() => {
 
 // Track if we've already requested the thumbnail in this component instance
 const hasRequestedThumbnail = ref(false);
+const iconRoot = ref(null);
+const isNearViewport = ref(false);
+const thumbnailRetryCount = ref(0);
+let thumbnailObserver = null;
+let thumbnailRetryTimer = null;
+
+const canRequestThumbnail = computed(() => {
+  if (props.disableThumbnails) return false;
+  if (!props.item || props.item.kind === 'directory') return false;
+  if (!isPreviewable.value) return false;
+  if (appSettings.thumbnailsEnabledForSession === false) return false;
+  if (props.item.thumbnail) return false;
+  // A prior request definitively failed (missing source / unsupported): don't
+  // loop on it. A fresh navigation yields a new item object without this flag.
+  if (props.item.thumbnailUnavailable) return false;
+  return Boolean(props.item.supportsThumbnail);
+});
 
-// Automatically request thumbnail when all conditions are met
-// watchEffect automatically tracks all reactive dependencies and re-runs when they change
-watchEffect(() => {
-  // Exit early if already requested
-  if (hasRequestedThumbnail.value) return;
+const thumbnailRequestKey = computed(() => {
+  if (!props.item) return '';
+  return [
+    props.item.path || '',
+    props.item.name || '',
+    props.item.kind || '',
+    props.item.size || '',
+    props.item.modified || '',
+  ].join('::');
+});
 
-  // Check all conditions
-  if (props.disableThumbnails) return;
-  if (!props.item || props.item.kind === 'directory') return;
-  if (!isPreviewable.value) return;
-  if (appSettings.thumbnailsEnabledForSession === false) return;
-  if (props.item.thumbnail) return;
-  if (!props.item.supportsThumbnail) return;
+const clearThumbnailRetry = () => {
+  if (thumbnailRetryTimer) {
+    clearTimeout(thumbnailRetryTimer);
+    thumbnailRetryTimer = null;
+  }
+};
+
+const scheduleThumbnailRetry = () => {
+  clearThumbnailRetry();
+  if (!canRequestThumbnail.value || !isNearViewport.value) return;
+  if (thumbnailRetryCount.value >= 20) return;
+
+  thumbnailRetryCount.value += 1;
+  const delayMs = Math.min(5000, 700 + thumbnailRetryCount.value * 400);
+  thumbnailRetryTimer = setTimeout(() => {
+    thumbnailRetryTimer = null;
+    hasRequestedThumbnail.value = false;
+    requestThumbnailIfNeeded();
+  }, delayMs);
+};
+
+const requestThumbnailIfNeeded = () => {
+  if (hasRequestedThumbnail.value) return;
+  if (!isNearViewport.value) return;
+  if (!canRequestThumbnail.value) return;
 
   // All conditions met - request thumbnail once
   hasRequestedThumbnail.value = true;
-  fileStore.ensureItemThumbnail(props.item);
+  fileStore.ensureItemThumbnail(props.item).then((thumbnail) => {
+    if (thumbnail) {
+      clearThumbnailRetry();
+      return;
+    }
+    scheduleThumbnailRetry();
+  });
+};
+
+const disconnectThumbnailObserver = () => {
+  if (thumbnailObserver) {
+    thumbnailObserver.disconnect();
+    thumbnailObserver = null;
+  }
+};
+
+const observeThumbnailVisibility = async () => {
+  await nextTick();
+  if (!iconRoot.value) {
+    isNearViewport.value = true;
+    return;
+  }
+
+  if (typeof IntersectionObserver === 'undefined') {
+    isNearViewport.value = true;
+    return;
+  }
+
+  disconnectThumbnailObserver();
+  thumbnailObserver = new IntersectionObserver(
+    (entries) => {
+      isNearViewport.value = entries.some((entry) => entry.isIntersecting);
+      if (isNearViewport.value) {
+        requestThumbnailIfNeeded();
+      } else {
+        clearThumbnailRetry();
+        hasRequestedThumbnail.value = false;
+      }
+    },
+    { root: null, rootMargin: '300px 0px', threshold: 0.01 }
+  );
+  thumbnailObserver.observe(iconRoot.value);
+};
+
+watch([canRequestThumbnail, isNearViewport], requestThumbnailIfNeeded);
+
+watch(thumbnailRequestKey, () => {
+  clearThumbnailRetry();
+  hasRequestedThumbnail.value = false;
+  isNearViewport.value = false;
+  thumbnailRetryCount.value = 0;
+  observeThumbnailVisibility();
+});
+
+onMounted(observeThumbnailVisibility);
+onBeforeUnmount(() => {
+  clearThumbnailRetry();
+  disconnectThumbnailObserver();
 });
 
 // Additional type groupings
 const audioExts = new Set(['mp3', 'wav', 'flac', 'aac', 'm4a', 'ogg', 'opus', 'wma']);
 const archiveExts = new Set(['zip', 'rar', '7z', 'tar', 'gz', 'bz2', 'xz', 'tgz']);
 
-// Badge mapping for many common types
-const badge = computed(() => {
-  const e = ext.value;
-  switch (e) {
-    // Documents
-    case 'doc':
-    case 'docx':
-    case 'rtf':
-      return { label: 'DOC', bg: '#2563EB', fg: '#FFFFFF' };
-    case 'xls':
-    case 'xlsx':
-      return { label: 'XLS', bg: '#16A34A', fg: '#FFFFFF' };
-    case 'ppt':
-    case 'pptx':
-      return { label: 'PPT', bg: '#F97316', fg: '#FFFFFF' };
-    case 'csv':
-      return { label: 'CSV', bg: '#22C55E', fg: '#FFFFFF' };
-    case 'txt':
-      return { label: 'TXT', bg: '#6B7280', fg: '#FFFFFF' };
-    case 'md':
-    case 'markdown':
-      return { label: 'MD', bg: '#0EA5E9', fg: '#FFFFFF' };
-
-    // Web & styles
-    case 'html':
-    case 'htm':
-      return { label: 'HTML', bg: '#E44D26', fg: '#FFFFFF' };
-    case 'css':
-      return { label: 'CSS', bg: '#2965F1', fg: '#FFFFFF' };
-    case 'scss':
-      return { label: 'SCSS', bg: '#C6538C', fg: '#FFFFFF' };
-    case 'less':
-      return { label: 'LESS', bg: '#1D365D', fg: '#FFFFFF' };
-
-    // Scripts & code
-    case 'js':
-      return { label: 'JS', bg: '#F7DF1E', fg: '#000000' };
-    case 'ts':
-      return { label: 'TS', bg: '#3178C6', fg: '#FFFFFF' };
-    case 'jsx':
-      return { label: 'JSX', bg: '#61DAFB', fg: '#000000' };
-    case 'tsx':
-      return { label: 'TSX', bg: '#3178C6', fg: '#FFFFFF' };
-    case 'vue':
-      return { label: 'VUE', bg: '#41B883', fg: '#0B1921' };
-    case 'json':
-      return { label: 'JSON', bg: '#8B5CF6', fg: '#FFFFFF' };
-    case 'yml':
-    case 'yaml':
-      return { label: 'YAML', bg: '#14B8A6', fg: '#073B3A' };
-    case 'xml':
-      return { label: 'XML', bg: '#EC4899', fg: '#FFFFFF' };
-    case 'sh':
-    case 'bash':
-    case 'zsh':
-      return { label: 'SH', bg: '#374151', fg: '#FFFFFF' };
-    case 'py':
-      return { label: 'PY', bg: '#3776AB', fg: '#FFFFFF' };
-    case 'rb':
-      return { label: 'RB', bg: '#CC342D', fg: '#FFFFFF' };
-    case 'php':
-      return { label: 'PHP', bg: '#777BB4', fg: '#FFFFFF' };
-    case 'go':
-      return { label: 'GO', bg: '#00ADD8', fg: '#073B4C' };
-    case 'rs':
-      return { label: 'RS', bg: '#DEA584', fg: '#000000' };
-    case 'java':
-      return { label: 'JAVA', bg: '#E11D48', fg: '#FFFFFF' };
-    case 'kt':
-    case 'kts':
-      return { label: 'KT', bg: '#7F52FF', fg: '#FFFFFF' };
-    case 'swift':
-      return { label: 'SWIFT', bg: '#FA7343', fg: '#FFFFFF' };
-    case 'c':
-      return { label: 'C', bg: '#5C6BC0', fg: '#FFFFFF' };
-    case 'cpp':
-    case 'cc':
-    case 'cxx':
-      return { label: 'CPP', bg: '#00599C', fg: '#FFFFFF' };
-    case 'cs':
-      return { label: 'CS', bg: '#239120', fg: '#FFFFFF' };
-
-    // Data & config
-    case 'sql':
-      return { label: 'SQL', bg: '#0EA5E9', fg: '#FFFFFF' };
-    case 'db':
-    case 'sqlite':
-    case 'sqlite3':
-      return { label: 'DB', bg: '#0EA5E9', fg: '#FFFFFF' };
-    case 'ini':
-    case 'conf':
-    case 'cfg':
-      return { label: 'CFG', bg: '#6B7280', fg: '#FFFFFF' };
-    case 'toml':
-      return { label: 'TOML', bg: '#0F766E', fg: '#FFFFFF' };
-    case 'env':
-      return { label: 'ENV', bg: '#059669', fg: '#FFFFFF' };
-
-    // Fonts & vector
-    case 'svg':
-      return { label: 'SVG', bg: '#8B5CF6', fg: '#FFFFFF' };
-    case 'ttf':
-    case 'otf':
-    case 'woff':
-    case 'woff2':
-      return { label: 'FONT', bg: '#9CA3AF', fg: '#111827' };
-
-    // Locks
-    case 'lock':
-      return { label: 'LOCK', bg: '#6B7280', fg: '#FFFFFF' };
-
-    // Creative & design
-    case 'psd':
-      return { label: 'PSD', bg: '#001E36', fg: '#00C8FF' };
-    case 'ai':
-      return { label: 'AI', bg: '#300000', fg: '#FF9A00' };
-    case 'fig':
-      return { label: 'FIG', bg: '#A259FF', fg: '#FFFFFF' };
-    case 'sketch':
-      return { label: 'SKETCH', bg: '#FDB300', fg: '#111827' };
-
-    // Packages / installers
-    case 'exe':
-      return { label: 'EXE', bg: '#111827', fg: '#FFFFFF' };
-    case 'msi':
-      return { label: 'MSI', bg: '#0EA5E9', fg: '#FFFFFF' };
-    case 'apk':
-      return { label: 'APK', bg: '#34D399', fg: '#073B3A' };
-    case 'dmg':
-      return { label: 'DMG', bg: '#6B7280', fg: '#FFFFFF' };
-    case 'pkg':
-      return { label: 'PKG', bg: '#F59E0B', fg: '#111827' };
-    case 'deb':
-      return { label: 'DEB', bg: '#CC0000', fg: '#FFFFFF' };
-    case 'rpm':
-      return { label: 'RPM', bg: '#EE0000', fg: '#FFFFFF' };
-
-    // Misc
-    case 'log':
-      return { label: 'LOG', bg: '#9CA3AF', fg: '#111827' };
-    case 'tmp':
-    case 'bak':
-      return { label: e.toUpperCase(), bg: '#D1D5DB', fg: '#111827' };
-
-    default:
-      return null;
-  }
-});
+// Which badge a file gets is a table, and lives as one in ./fileBadges.
+const badge = computed(() => badgeForExtension(ext.value));
 </script>
 
 <template>
-  <DirectoryIcon v-if="props.item.kind === 'directory'" />
-  <PdfIcon v-else-if="props.item.kind === 'pdf'" />
-  <div
-    v-else-if="thumbnailUrl"
-    class="aspect-square bg-contain bg-center bg-no-repeat"
-    :style="{ backgroundImage: `url('${thumbnailUrl}')` }"
-  />
-  <ImageIcon v-else-if="isPreviewableImage(ext)" />
-  <VideoIcon v-else-if="isPreviewableVideo(ext)" />
-  <AudioIcon v-else-if="audioExts.has(ext)" />
-  <ArchiveIcon v-else-if="archiveExts.has(ext)" />
-  <FileBadgeIcon v-else-if="badge" v-bind="badge" />
-  <CodeIcon v-else-if="['json', 'vue'].includes(props.item.kind)" />
-  <TxtIcon v-else />
+  <span ref="iconRoot" class="block aspect-square">
+    <DirectoryIcon v-if="props.item.kind === 'directory'" />
+    <PdfIcon v-else-if="props.item.kind === 'pdf'" />
+    <div
+      v-else-if="thumbnailUrl"
+      class="h-full w-full bg-contain bg-center bg-no-repeat"
+      :style="{ backgroundImage: `url('${thumbnailUrl}')` }"
+    />
+    <ImageIcon v-else-if="isPreviewableImage(ext)" />
+    <VideoIcon v-else-if="isPreviewableVideo(ext)" />
+    <AudioIcon v-else-if="audioExts.has(ext)" />
+    <ArchiveIcon v-else-if="archiveExts.has(ext)" />
+    <FileBadgeIcon v-else-if="badge" v-bind="badge" />
+    <CodeIcon v-else-if="['json', 'vue'].includes(props.item.kind)" />
+    <TxtIcon v-else />
+  </span>
 </template>
diff --git a/frontend/src/icons/fileBadges.js b/frontend/src/icons/fileBadges.js
new file mode 100644
index 000000000..2b9d52111
--- /dev/null
+++ b/frontend/src/icons/fileBadges.js
@@ -0,0 +1,96 @@
+/**
+ * The little coloured square on a file with no thumbnail.
+ *
+ * This was seventy-two branches of a switch — the single most complex function
+ * in the frontend — for what it plainly is: a table. Written as data it can be
+ * read at a glance, added to without touching any logic, and checked as a
+ * whole rather than one branch at a time.
+ *
+ * Grouped by what the extensions are, because that is the order someone
+ * looking for a missing one will read.
+ */
+
+const BADGES = [
+  // Documents
+  [['doc', 'docx', 'rtf'], { label: 'DOC', bg: '#2563EB', fg: '#FFFFFF' }],
+  [['xls', 'xlsx'], { label: 'XLS', bg: '#16A34A', fg: '#FFFFFF' }],
+  [['ppt', 'pptx'], { label: 'PPT', bg: '#F97316', fg: '#FFFFFF' }],
+  [['csv'], { label: 'CSV', bg: '#22C55E', fg: '#FFFFFF' }],
+  [['txt'], { label: 'TXT', bg: '#6B7280', fg: '#FFFFFF' }],
+  [['md', 'markdown'], { label: 'MD', bg: '#0EA5E9', fg: '#FFFFFF' }],
+
+  // Web & styles
+  [['html', 'htm'], { label: 'HTML', bg: '#E44D26', fg: '#FFFFFF' }],
+  [['css'], { label: 'CSS', bg: '#2965F1', fg: '#FFFFFF' }],
+  [['scss'], { label: 'SCSS', bg: '#C6538C', fg: '#FFFFFF' }],
+  [['less'], { label: 'LESS', bg: '#1D365D', fg: '#FFFFFF' }],
+
+  // Scripts & code
+  [['js'], { label: 'JS', bg: '#F7DF1E', fg: '#000000' }],
+  [['ts'], { label: 'TS', bg: '#3178C6', fg: '#FFFFFF' }],
+  [['jsx'], { label: 'JSX', bg: '#61DAFB', fg: '#000000' }],
+  [['tsx'], { label: 'TSX', bg: '#3178C6', fg: '#FFFFFF' }],
+  [['vue'], { label: 'VUE', bg: '#41B883', fg: '#0B1921' }],
+  [['json'], { label: 'JSON', bg: '#8B5CF6', fg: '#FFFFFF' }],
+  [['yml', 'yaml'], { label: 'YAML', bg: '#14B8A6', fg: '#073B3A' }],
+  [['xml'], { label: 'XML', bg: '#EC4899', fg: '#FFFFFF' }],
+  [['sh', 'bash', 'zsh'], { label: 'SH', bg: '#374151', fg: '#FFFFFF' }],
+  [['py'], { label: 'PY', bg: '#3776AB', fg: '#FFFFFF' }],
+  [['rb'], { label: 'RB', bg: '#CC342D', fg: '#FFFFFF' }],
+  [['php'], { label: 'PHP', bg: '#777BB4', fg: '#FFFFFF' }],
+  [['go'], { label: 'GO', bg: '#00ADD8', fg: '#073B4C' }],
+  [['rs'], { label: 'RS', bg: '#DEA584', fg: '#000000' }],
+  [['java'], { label: 'JAVA', bg: '#E11D48', fg: '#FFFFFF' }],
+  [['kt', 'kts'], { label: 'KT', bg: '#7F52FF', fg: '#FFFFFF' }],
+  [['swift'], { label: 'SWIFT', bg: '#FA7343', fg: '#FFFFFF' }],
+  [['c'], { label: 'C', bg: '#5C6BC0', fg: '#FFFFFF' }],
+  [['cpp', 'cc', 'cxx'], { label: 'CPP', bg: '#00599C', fg: '#FFFFFF' }],
+  [['cs'], { label: 'CS', bg: '#239120', fg: '#FFFFFF' }],
+
+  // Data & config
+  [['sql'], { label: 'SQL', bg: '#0EA5E9', fg: '#FFFFFF' }],
+  [['db', 'sqlite', 'sqlite3'], { label: 'DB', bg: '#0EA5E9', fg: '#FFFFFF' }],
+  [['ini', 'conf', 'cfg'], { label: 'CFG', bg: '#6B7280', fg: '#FFFFFF' }],
+  [['toml'], { label: 'TOML', bg: '#0F766E', fg: '#FFFFFF' }],
+  [['env'], { label: 'ENV', bg: '#059669', fg: '#FFFFFF' }],
+
+  // Fonts & vector
+  [['svg'], { label: 'SVG', bg: '#8B5CF6', fg: '#FFFFFF' }],
+  [['ttf', 'otf', 'woff', 'woff2'], { label: 'FONT', bg: '#9CA3AF', fg: '#111827' }],
+
+  // Locks
+  [['lock'], { label: 'LOCK', bg: '#6B7280', fg: '#FFFFFF' }],
+
+  // Creative & design
+  [['psd'], { label: 'PSD', bg: '#001E36', fg: '#00C8FF' }],
+  [['ai'], { label: 'AI', bg: '#300000', fg: '#FF9A00' }],
+  [['fig'], { label: 'FIG', bg: '#A259FF', fg: '#FFFFFF' }],
+  [['sketch'], { label: 'SKETCH', bg: '#FDB300', fg: '#111827' }],
+
+  // Packages / installers
+  [['exe'], { label: 'EXE', bg: '#111827', fg: '#FFFFFF' }],
+  [['msi'], { label: 'MSI', bg: '#0EA5E9', fg: '#FFFFFF' }],
+  [['apk'], { label: 'APK', bg: '#34D399', fg: '#073B3A' }],
+  [['dmg'], { label: 'DMG', bg: '#6B7280', fg: '#FFFFFF' }],
+  [['pkg'], { label: 'PKG', bg: '#F59E0B', fg: '#111827' }],
+  [['deb'], { label: 'DEB', bg: '#CC0000', fg: '#FFFFFF' }],
+  [['rpm'], { label: 'RPM', bg: '#EE0000', fg: '#FFFFFF' }],
+
+  // Misc
+  [['log'], { label: 'LOG', bg: '#9CA3AF', fg: '#111827' }],
+  [['tmp'], { label: 'TMP', bg: '#D1D5DB', fg: '#111827' }],
+  [['bak'], { label: 'BAK', bg: '#D1D5DB', fg: '#111827' }],
+];
+
+const byExtension = new Map(
+  BADGES.flatMap(([extensions, badge]) => extensions.map((extension) => [extension, badge]))
+);
+
+/**
+ * @param {string} extension lower-case, without the dot
+ * @returns {{label: string, bg: string, fg: string}|null} null when this kind
+ *   of file has no badge of its own and falls back to a plain file icon
+ */
+export const badgeForExtension = (extension) => byExtension.get(extension) || null;
+
+export { BADGES };
diff --git a/frontend/src/layouts/BrowserLayout.vue b/frontend/src/layouts/BrowserLayout.vue
index 77797329c..cfff840e7 100644
--- a/frontend/src/layouts/BrowserLayout.vue
+++ b/frontend/src/layouts/BrowserLayout.vue
@@ -31,6 +31,7 @@ import { useFileUploader } from '@/composables/fileUploader';
 import { useKeyboardShortcuts } from '@/composables/keyboardShortcuts';
 import SpotlightSearch from '@/components/SpotlightSearch.vue';
 import FavoriteEditDialog from '@/components/FavoriteEditDialog.vue';
+import DestinationPickerDialog from '@/components/DestinationPickerDialog.vue';
 import {
   Bars3Icon,
   ArrowRightOnRectangleIcon,
@@ -238,6 +239,7 @@ const handleGuestLogin = () => {
     <OnlyOfficeTransferConfirm />
     <SpotlightSearch />
     <FavoriteEditDialog />
+    <DestinationPickerDialog />
     <NotificationToastContainer />
     <NotificationPanel />
     <TerminalPanel v-if="featuresStore.terminalEnabled" />
diff --git a/frontend/src/plugins/archive/ArchivePreview.vue b/frontend/src/plugins/archive/ArchivePreview.vue
index f9a8904ad..a51be57e1 100644
--- a/frontend/src/plugins/archive/ArchivePreview.vue
+++ b/frontend/src/plugins/archive/ArchivePreview.vue
@@ -201,6 +201,15 @@
             >
               {{ $t('archive.extract') }}
             </button>
+            <button
+              type="button"
+              class="rounded border border-neutral-300 px-2 py-1 hover:bg-neutral-100 disabled:opacity-40 dark:border-neutral-700 dark:hover:bg-neutral-800"
+              :disabled="Boolean(extracting)"
+              data-testid="archive-extract-elsewhere"
+              @click="extractElsewhere"
+            >
+              {{ $t('archive.extractTo') }}
+            </button>
           </template>
         </div>
       </template>
@@ -214,6 +223,7 @@ import { useI18n } from 'vue-i18n';
 import { ArrowDownTrayIcon, ArrowUpTrayIcon, ChevronRightIcon } from '@heroicons/vue/24/outline';
 
 import { browseArchive, archiveEntryUrl, extractFromArchive } from '@/api';
+import { useDestinationPicker } from '@/composables/useDestinationPicker';
 import { formatBytes } from '@/utils';
 import { isEditableExtension } from '@/config/editor';
 import FileIcon from '@/icons/FileIcon.vue';
@@ -249,6 +259,7 @@ const reading = ref(null);
 /** The entries ticked at this level, by their path inside the archive. */
 const selection = ref(new Set());
 
+const picker = useDestinationPicker();
 const extracted = ref('');
 
 /** The archive, then every folder of the position, each one a way back to it. */
@@ -354,6 +365,23 @@ const takeOut = async (paths, destination = '') => {
 
 const extract = (entry) => takeOut([entry.path]);
 
+/**
+ * Somewhere other than the folder the archive is in.
+ *
+ * The dialog the rest of the application uses for "move to", so the folders
+ * offered first are the ones this person actually files things in. Closing it
+ * without choosing means do nothing — not the root, and not the default.
+ */
+const extractElsewhere = async () => {
+  const destination = await picker.pick({
+    mode: 'extract',
+    items: entries.value.filter((entry) => selection.value.has(entry.path)),
+    from: props.item?.path || '',
+  });
+  if (!destination) return;
+  await takeOut([...selection.value], destination);
+};
+
 onMounted(() => open(''));
 watch(
   () => props.filePath,
diff --git a/frontend/src/stores/appSettings.js b/frontend/src/stores/appSettings.js
index a4e859465..b832921b3 100644
--- a/frontend/src/stores/appSettings.js
+++ b/frontend/src/stores/appSettings.js
@@ -1,54 +1,111 @@
 import { defineStore } from 'pinia';
-import { ref, computed } from 'vue';
+import { ref, computed, watch } from 'vue';
 import {
   getBranding as getBrandingApi,
   getSettings as getSettingsApi,
   patchSettings as patchSettingsApi,
+  uploadLogo as uploadLogoApi,
 } from '@/api';
 import { useAuthStore } from '@/stores/auth';
 
 export const useAppSettings = defineStore('appSettings', () => {
   const loaded = ref(false);
   const loading = ref(false);
+  const loadedForUserId = ref(null);
   const lastError = ref(null);
   const authStore = useAuthStore();
 
-  // Three-tier settings structure
-  const publicSettings = ref({
-    branding: { appName: 'Explorer', appLogoUrl: '/logo.svg', showPoweredBy: false },
-  });
-
-  const userSettings = ref({
+  const createDefaultUserSettings = () => ({
     showHiddenFiles: false,
     showThumbnails: true,
     showSidebarFavorites: true,
     showSidebarShares: true,
     showSidebarTools: true,
-    defaultShareExpiration: null, // { value: number, unit: 'days' | 'weeks' | 'months' }
-    skipHome: null, // null = use env var, true/false = override
+    defaultShareExpiration: null,
+    skipHome: null,
+    folderSorts: {},
+    folderViews: {},
+    defaultView: null,
+    // Markdown is the one kind of file with both a preview and an editor, so
+    // it is the only one where opening it is a choice (#347).
+    markdownOpensInEditor: false,
+    // Opening a document in a browser tab of its own, rather than over the
+    // folder it is in. Off, so nothing changes for anybody who does not ask
+    // for it.
+    documentsOpenInNewTab: false,
+    // The small mark on a row whose file has earlier versions. On, unlike the
+    // two above: it says something true about the file that nothing else in
+    // the listing says, and a history nobody knows about is a history nobody
+    // uses. It is read as `!== false` on the server, so this default and that
+    // one cannot drift apart.
+    showVersionMarks: true,
+    // The language this account is read in. null follows the browser, which is
+    // what everybody got before there was anywhere to say otherwise.
+    locale: null,
+  });
+
+  const createDefaultTrashSettings = () => ({
+    enabled: true,
+    retentionDays: 30,
+    maxPercent: 10,
+    maxBytes: null,
+  });
+
+  const createDefaultVersionSettings = () => ({
+    enabled: true,
+    keepAllHours: 24,
+    hourlyDays: 7,
+    dailyDays: 30,
+    maxPerFile: 50,
+    sessionCheckpointMinutes: 10,
   });
 
-  const systemSettings = ref({
-    thumbnails: { enabled: true, size: 200, quality: 70 },
-    access: { rules: [], applyToAdmins: false },
-    // What the server answers for the trash and the versions. Held as it comes:
-    // the screen that shows them sends back what it was given, and the server
-    // is the one that decides what a value may be.
-    trash: null,
-    versions: null,
-    uploads: null,
-    activity: null,
+  const createDefaultSystemSettings = () => ({
+    thumbnails: { enabled: true, size: 200, quality: 70, concurrency: 10 },
+    access: { rules: [] },
+    uploads: { chunkedEnabled: false, chunkSizeBytes: 8 * 1024 * 1024 },
+    folderSize: { excludedPaths: [], environmentExcludedPaths: [] },
+    searchIndex: { excludedPaths: [], environmentExcludedPaths: [] },
+    trash: createDefaultTrashSettings(),
+    versions: createDefaultVersionSettings(),
+    // Off until an administrator asks for it, which is what the server says
+    // too: a page that starts by showing the switch on would be a lie.
+    activity: { enabled: false, retentionDays: 90 },
   });
 
+  // Three-tier settings structure
+  const publicSettings = ref({
+    branding: { appName: 'Explorer', appLogoUrl: '/logo.svg', showPoweredBy: false },
+  });
+
+  const userSettings = ref(createDefaultUserSettings());
+  const systemSettings = ref(createDefaultSystemSettings());
+
+  // Signing in as someone else must not leave the previous account's
+  // preferences on screen, so the store empties itself the moment the user
+  // changes rather than waiting for the next load to overwrite it.
+  watch(
+    () => authStore.currentUser?.id ?? null,
+    (userId, previousUserId) => {
+      if (userId === previousUserId) return;
+
+      loaded.value = false;
+      loadedForUserId.value = null;
+      userSettings.value = createDefaultUserSettings();
+      systemSettings.value = createDefaultSystemSettings();
+    },
+    { flush: 'sync' }
+  );
+
   // Computed state that combines all settings (for backward compatibility)
   const state = computed(() => ({
     branding: publicSettings.value.branding,
     user: userSettings.value,
     thumbnails: systemSettings.value.thumbnails,
     access: systemSettings.value.access,
-    trash: systemSettings.value.trash,
-    versions: systemSettings.value.versions,
     uploads: systemSettings.value.uploads,
+    folderSize: systemSettings.value.folderSize,
+    searchIndex: systemSettings.value.searchIndex,
   }));
 
   // Whether thumbnails should be shown/requested for the current session.
@@ -91,6 +148,7 @@ export const useAppSettings = defineStore('appSettings', () => {
   // - Authenticated user: branding + user settings
   // - Admin: branding + user settings + system settings
   const load = async () => {
+    const userId = authStore.currentUser?.id ?? null;
     loading.value = true;
     lastError.value = null;
     try {
@@ -107,21 +165,15 @@ export const useAppSettings = defineStore('appSettings', () => {
       }
 
       // Update user settings if present (authenticated users)
-      if (s?.user && typeof s.user === 'object') {
+      if (userId === authStore.currentUser?.id && s?.user && typeof s.user === 'object') {
         userSettings.value = {
-          showHiddenFiles: false,
-          showThumbnails: true,
-          showSidebarFavorites: true,
-          showSidebarShares: true,
-          showSidebarTools: true,
-          defaultShareExpiration: null,
-          skipHome: null,
+          ...createDefaultUserSettings(),
           ...s.user,
         };
       }
 
       // Update system settings if present (admin only)
-      if (s?.thumbnails) {
+      if (userId === authStore.currentUser?.id && s?.thumbnails) {
         systemSettings.value.thumbnails = {
           enabled: true,
           size: 200,
@@ -129,18 +181,46 @@ export const useAppSettings = defineStore('appSettings', () => {
           ...s.thumbnails,
         };
       }
-      if (s?.trash) systemSettings.value.trash = { ...s.trash };
-      if (s?.versions) systemSettings.value.versions = { ...s.versions };
-      if (s?.uploads) systemSettings.value.uploads = { ...s.uploads };
-      if (s?.activity) systemSettings.value.activity = { ...s.activity };
-      if (s?.access) {
+      if (userId === authStore.currentUser?.id && s?.access) {
         systemSettings.value.access = {
           rules: Array.isArray(s.access.rules) ? s.access.rules : [],
-          applyToAdmins: s.access.applyToAdmins === true,
         };
       }
+      if (s?.uploads) {
+        systemSettings.value.uploads = {
+          chunkedEnabled: false,
+          chunkSizeBytes: 8 * 1024 * 1024,
+          ...s.uploads,
+        };
+      }
+      if (s?.folderSize) {
+        systemSettings.value.folderSize = {
+          excludedPaths: [],
+          environmentExcludedPaths: [],
+          ...s.folderSize,
+        };
+      }
+      if (s?.searchIndex) {
+        systemSettings.value.searchIndex = {
+          excludedPaths: [],
+          environmentExcludedPaths: [],
+          ...s.searchIndex,
+        };
+      }
+      if (s?.trash) {
+        systemSettings.value.trash = { ...createDefaultTrashSettings(), ...s.trash };
+      }
+      if (s?.versions) {
+        systemSettings.value.versions = { ...createDefaultVersionSettings(), ...s.versions };
+      }
+      if (s?.activity) {
+        systemSettings.value.activity = { enabled: false, retentionDays: 90, ...s.activity };
+      }
 
-      loaded.value = true;
+      if (userId === authStore.currentUser?.id) {
+        loadedForUserId.value = userId;
+        loaded.value = true;
+      }
     } catch (e) {
       // For non-admin users, 403 errors are expected for system settings
       // But we should still have branding loaded
@@ -153,7 +233,10 @@ export const useAppSettings = defineStore('appSettings', () => {
       if (!isAdmin && e?.status === 403) {
         // Non-admin user - this is expected, just ensure branding is loaded
         await loadBranding();
-        loaded.value = true;
+        if (userId === authStore.currentUser?.id) {
+          loadedForUserId.value = userId;
+          loaded.value = true;
+        }
       } else {
         lastError.value = e?.message || 'Failed to load settings';
       }
@@ -163,19 +246,29 @@ export const useAppSettings = defineStore('appSettings', () => {
   };
 
   const ensureLoaded = async () => {
-    if (loaded.value || loading.value) {
+    const userId = authStore.currentUser?.id ?? null;
+    if (loaded.value && loadedForUserId.value === userId) {
       return state.value;
     }
     await load();
     return state.value;
   };
 
-  const save = async (partial) => {
+  /**
+   * Send a change and keep what the server answered, for as long as the
+   * person who sent it is still the one signed in.
+   */
+  const saveWith = async (send) => {
+    const userId = authStore.currentUser?.id ?? null;
     lastError.value = null;
     try {
-      const updated = await patchSettingsApi(partial);
+      const updated = await send();
 
       // Update local state based on what was returned
+      if (userId !== authStore.currentUser?.id) {
+        return state.value;
+      }
+
       if (updated?.branding) {
         publicSettings.value.branding = {
           appName: 'Explorer',
@@ -192,10 +285,6 @@ export const useAppSettings = defineStore('appSettings', () => {
         };
       }
 
-      if (updated?.trash) systemSettings.value.trash = { ...updated.trash };
-      if (updated?.versions) systemSettings.value.versions = { ...updated.versions };
-      if (updated?.uploads) systemSettings.value.uploads = { ...updated.uploads };
-      if (updated?.activity) systemSettings.value.activity = { ...updated.activity };
       if (updated?.thumbnails) {
         systemSettings.value.thumbnails = {
           enabled: true,
@@ -208,11 +297,48 @@ export const useAppSettings = defineStore('appSettings', () => {
       if (updated?.access) {
         systemSettings.value.access = {
           rules: Array.isArray(updated.access.rules) ? updated.access.rules : [],
-          applyToAdmins: updated.access.applyToAdmins === true,
+        };
+      }
+      if (updated?.folderSize) {
+        systemSettings.value.folderSize = {
+          excludedPaths: [],
+          environmentExcludedPaths: [],
+          ...updated.folderSize,
+        };
+      }
+      // Copied here as `load` copies it. It was not, so a saved exclusion list
+      // left the store holding the old one and the page still "unsaved".
+      if (updated?.searchIndex) {
+        systemSettings.value.searchIndex = {
+          excludedPaths: [],
+          environmentExcludedPaths: [],
+          ...updated.searchIndex,
+        };
+      }
+
+      if (updated?.uploads) {
+        systemSettings.value.uploads = {
+          chunkedEnabled: false,
+          chunkSizeBytes: 8 * 1024 * 1024,
+          ...updated.uploads,
         };
       }
 
+      if (updated?.trash) {
+        systemSettings.value.trash = { ...createDefaultTrashSettings(), ...updated.trash };
+      }
+      if (updated?.versions) {
+        systemSettings.value.versions = {
+          ...createDefaultVersionSettings(),
+          ...updated.versions,
+        };
+      }
+      if (updated?.activity) {
+        systemSettings.value.activity = { enabled: false, retentionDays: 90, ...updated.activity };
+      }
+
       loaded.value = true;
+      loadedForUserId.value = userId;
       return state.value;
     } catch (e) {
       lastError.value = e?.message || 'Failed to save settings';
@@ -220,6 +346,12 @@ export const useAppSettings = defineStore('appSettings', () => {
     }
   };
 
+  const save = (partial) => saveWith(() => patchSettingsApi(partial));
+
+  // The logo and the rest of the branding go in one request, so that a logo is
+  // never stored without the name saved alongside it, or the other way round.
+  const saveLogo = (file, branding) => saveWith(() => uploadLogoApi(file, branding));
+
   return {
     state,
     publicSettings,
@@ -233,5 +365,6 @@ export const useAppSettings = defineStore('appSettings', () => {
     ensureLoaded,
     loadBranding,
     save,
+    saveLogo,
   };
 });
diff --git a/frontend/src/stores/auth.js b/frontend/src/stores/auth.js
index 43bf8ee43..d4bd2abc7 100644
--- a/frontend/src/stores/auth.js
+++ b/frontend/src/stores/auth.js
@@ -5,8 +5,8 @@ import {
   fetchAuthStatus,
   setupAccount as setupAccountApi,
   login as loginApi,
-  submitTotpCode as submitTotpCodeApi,
   signInWithPasskey as signInWithPasskeyApi,
+  submitTotpCode as submitTotpCodeApi,
   logout as logoutApi,
   fetchCurrentUser,
 } from '@/api';
@@ -18,16 +18,22 @@ export const useAuthStore = defineStore('auth', () => {
   const strategies = ref({
     local: true,
     oidc: false,
+    passkey: false,
   });
+  // What the server's configuration pass concluded about single sign-on:
+  // 'ready', 'not-configured' or 'unavailable'. The sign-in screen shows the
+  // last two rather than sending somebody to a provider that cannot answer.
+  const oidcStatus = ref('ready');
   const currentUser = ref(null);
-  const isLoading = ref(false);
   /**
-   * Whether a sign-in is waiting for a code from an authenticator.
+   * The password was right, and the account asks for a code as well.
    *
-   * The password was right; nothing about who they are is known here, and the
-   * server is holding that.
+   * Read back from the server on every start, not only set when a sign-in
+   * happens here: a reload in the middle of one lands back on the code rather
+   * than on a password screen that would start the whole thing again.
    */
-  const totpRequired = ref(false);
+  const totpPending = ref(false);
+  const isLoading = ref(false);
   const hasStatus = ref(false);
   const lastError = ref(null);
   let initPromise = null;
@@ -60,11 +66,10 @@ export const useAuthStore = defineStore('auth', () => {
         requiresSetup.value = enabled ? Boolean(status.requiresSetup) : false;
         authEnabled.value = enabled;
         authMode.value = typeof status?.authMode === 'string' ? status.authMode : 'local';
-        strategies.value = status?.strategies || { local: true, oidc: false };
+        strategies.value = status?.strategies || { local: true, oidc: false, passkey: false };
+        oidcStatus.value = status?.oidc?.status || 'ready';
         currentUser.value = status?.user || null;
-        // A reload in the middle of signing in lands back on the code rather
-        // than on a password screen that would start the whole thing again.
-        totpRequired.value = Boolean(status?.totpPending);
+        totpPending.value = Boolean(status?.totpPending);
 
         // Clear guest session if user is now authenticated
         if (currentUser.value) {
@@ -96,15 +101,20 @@ export const useAuthStore = defineStore('auth', () => {
     sessionStorage.removeItem('guestSessionId');
   };
 
-  const login = async ({ email, password }) => {
+  const login = async ({ identifier, password }) => {
     lastError.value = null;
-    const response = await loginApi({ email, password });
+    const response = await loginApi({ identifier, password });
+    hasStatus.value = true;
+
+    // Halfway: the password was right and a code is wanted as well. Nobody is
+    // signed in until it arrives, so nothing here says anybody is.
     if (response?.totpRequired) {
-      totpRequired.value = true;
+      totpPending.value = true;
+      currentUser.value = null;
       return { totpRequired: true };
     }
-    totpRequired.value = false;
-    hasStatus.value = true;
+
+    totpPending.value = false;
     currentUser.value = response?.user || null;
 
     // Clear guest session when user logs in
@@ -113,10 +123,11 @@ export const useAuthStore = defineStore('auth', () => {
   };
 
   /**
-   * Signing in with a passkey.
+   * Sign in with a passkey, which names nobody.
    *
-   * Nobody is named: the authenticator offers what it holds for this site, and
-   * the server works out whose key it is from the key itself.
+   * The same two endings as a password: signed in, or waiting for a code. A
+   * passkey that was unlocked — a fingerprint, a face, a PIN — is already the
+   * second factor, so only one that was not lands here waiting.
    */
   const signInWithPasskey = async () => {
     lastError.value = null;
@@ -124,26 +135,48 @@ export const useAuthStore = defineStore('auth', () => {
     hasStatus.value = true;
 
     if (response?.totpRequired) {
-      totpRequired.value = true;
+      totpPending.value = true;
       currentUser.value = null;
       return { totpRequired: true };
     }
 
-    totpRequired.value = false;
+    totpPending.value = false;
     currentUser.value = response?.user || null;
     sessionStorage.removeItem('guestSessionId');
     return { totpRequired: false };
   };
 
-  /** The second step. Which account this is remains the server's to know. */
+  /**
+   * Finish a sign-in with the code from the phone, or one off the paper.
+   *
+   * @returns {Promise<{usedRecoveryCode: boolean, recoveryCodesLeft: number|null}>}
+   */
   const submitTotpCode = async (code) => {
     lastError.value = null;
     const response = await submitTotpCodeApi(code);
-    totpRequired.value = false;
-    hasStatus.value = true;
+    totpPending.value = false;
     currentUser.value = response?.user || null;
     sessionStorage.removeItem('guestSessionId');
-    return response;
+    return {
+      usedRecoveryCode: Boolean(response?.usedRecoveryCode),
+      recoveryCodesLeft: response?.recoveryCodesLeft ?? null,
+    };
+  };
+
+  /**
+   * Back to the password, when somebody gives up on finding their phone.
+   *
+   * The server is told, rather than only the screen: it is the one holding the
+   * half-open sign-in, and a page reload would otherwise come back to the code
+   * for a step this person has already walked away from.
+   */
+  const cancelTotp = async () => {
+    totpPending.value = false;
+    try {
+      await logoutApi();
+    } catch (_) {
+      // Nothing was signed in; a server that cannot be reached changes that.
+    }
   };
 
   const logout = async () => {
@@ -155,6 +188,26 @@ export const useAuthStore = defineStore('auth', () => {
     }
     hasStatus.value = true;
     currentUser.value = null;
+    totpPending.value = false;
+  };
+
+  /**
+   * Drop the session locally, without telling the server.
+   *
+   * For a session that has already expired: there is nothing left to end, and
+   * asking the server to end it would be one more request answered 401 — or,
+   * where an identity provider is involved, a redirect to it that a fetch
+   * cannot follow. `hasStatus` stays true so the navigation guard sends the
+   * person to the login screen rather than pausing to ask the server who they
+   * are, which is the question that just failed.
+   */
+  const forgetSession = () => {
+    currentUser.value = null;
+    // A session that is over is not one halfway through: whatever was waiting
+    // for a code is gone with it, and the screen starts at the password.
+    totpPending.value = false;
+    hasStatus.value = true;
+    lastError.value = null;
   };
 
   const clearError = () => {
@@ -181,16 +234,19 @@ export const useAuthStore = defineStore('auth', () => {
     authEnabled,
     authMode,
     strategies,
+    oidcStatus,
     currentUser,
+    totpPending,
     lastError,
     initialize,
     ensureStatus: initialize,
     setupAccount,
     login,
-    totpRequired,
-    submitTotpCode,
     signInWithPasskey,
+    submitTotpCode,
+    cancelTotp,
     logout,
+    forgetSession,
     clearError,
     refreshCurrentUser,
   };
diff --git a/frontend/src/stores/fileStore.js b/frontend/src/stores/fileStore.js
index 5a81411dd..c0d29bdfa 100644
--- a/frontend/src/stores/fileStore.js
+++ b/frontend/src/stores/fileStore.js
@@ -467,6 +467,10 @@ export const useFileStore = defineStore('fileStore', () => {
     const previousItems = Array.isArray(currentPathItems.value) ? currentPathItems.value : [];
 
     const normalizedPath = normalizePath(typeof path === 'string' ? path : currentPath.value);
+    // Before the path changes, so the sort and the view this folder was left in
+    // are the ones the first render uses rather than a frame of the previous
+    // folder's.
+    useSettingsStore().restoreFolderPreferences(normalizedPath);
     currentPath.value = normalizedPath;
     clearSelection();
     // When changing folders, exit selection mode (mobile UX).
diff --git a/frontend/src/stores/folderPreference.js b/frontend/src/stores/folderPreference.js
new file mode 100644
index 000000000..71540e45e
--- /dev/null
+++ b/frontend/src/stores/folderPreference.js
@@ -0,0 +1,107 @@
+import { ref, watch } from 'vue';
+
+/**
+ * A preference remembered per folder, per user.
+ *
+ * Sorting and view mode both work this way, and they were about to be written
+ * twice: the same reconciliation between what the server holds and what this
+ * tab has changed, the same guard against a stale response landing after the
+ * user has switched, the same cap on how much is kept. One copy, used twice.
+ *
+ * Saving sends a single folder rather than the whole map — two tabs open on
+ * different folders would otherwise overwrite each other with whichever copy
+ * was written last.
+ */
+
+const MAX_ENTRIES = 100;
+const MAX_PATH_LENGTH = 1024;
+
+export function createFolderPreference({
+  /** Key under `userSettings` holding the stored map. */
+  key,
+  /** Key the save endpoint expects for a single folder. */
+  saveKey,
+  /** Field the endpoint expects the entry under, beside `path`. */
+  entryKey,
+  /** Turn a stored entry into a valid one, or null. Without `updatedAt`. */
+  sanitizeEntry,
+  appSettings,
+  authStore,
+}) {
+  const entries = ref({});
+  let hasLocalChanges = false;
+  let saveChain = Promise.resolve();
+
+  const normalize = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return {};
+
+    return Object.fromEntries(
+      Object.entries(value)
+        .map(([path, entry]) => {
+          const sanitized = sanitizeEntry(entry);
+          if (!sanitized || typeof path !== 'string' || !path || path.length > MAX_PATH_LENGTH) {
+            return null;
+          }
+          return [
+            path,
+            {
+              ...sanitized,
+              updatedAt: Number.isFinite(entry?.updatedAt) ? Math.floor(entry.updatedAt) : 0,
+            },
+          ];
+        })
+        .filter(Boolean)
+        .sort(([, a], [, b]) => b.updatedAt - a.updatedAt)
+        .slice(0, MAX_ENTRIES)
+    );
+  };
+
+  // What the server holds, reconciled with anything changed here since. A
+  // straight overwrite would lose a preference set while the settings were
+  // being fetched.
+  watch(
+    () => appSettings.userSettings?.[key],
+    (value) => {
+      const saved = normalize(value);
+      entries.value = hasLocalChanges ? normalize({ ...saved, ...entries.value }) : saved;
+    },
+    { immediate: true }
+  );
+
+  /** Signing in as someone else must not carry the previous account's choices. */
+  const reset = () => {
+    hasLocalChanges = false;
+    entries.value = normalize(appSettings.userSettings?.[key]);
+  };
+
+  watch(() => authStore.currentUser?.id ?? null, reset, { flush: 'sync' });
+
+  const get = (folderPath) => entries.value?.[folderPath] ?? null;
+
+  const set = (folderPath, entry) => {
+    const userId = authStore.currentUser?.id ?? null;
+    const sanitized = sanitizeEntry(entry);
+    if (!folderPath || !sanitized || !appSettings.loaded || !userId) return undefined;
+
+    entries.value = normalize({
+      ...entries.value,
+      [folderPath]: { ...sanitized, updatedAt: Date.now() },
+    });
+    hasLocalChanges = true;
+
+    // Chained rather than concurrent: two quick changes would otherwise race,
+    // and the server would keep whichever write happened to land second.
+    const save = () => {
+      if (authStore.currentUser?.id !== userId) return undefined;
+      return appSettings.save({
+        user: { [saveKey]: { path: folderPath, [entryKey]: sanitized } },
+      });
+    };
+
+    const result = saveChain.then(save, save);
+    saveChain = result.catch(() => undefined);
+    return result;
+  };
+
+  return { entries, get, set, reset, normalize };
+}
diff --git a/frontend/src/stores/settings.js b/frontend/src/stores/settings.js
index f4e58b46d..53b870553 100644
--- a/frontend/src/stores/settings.js
+++ b/frontend/src/stores/settings.js
@@ -1,22 +1,54 @@
-import { ref, computed, reactive } from 'vue';
+import { ref, computed, reactive, watch } from 'vue';
 import { defineStore } from 'pinia';
 import { useColorMode, useStorage } from '@vueuse/core';
+import { useAuthStore } from '@/stores/auth';
+import { useAppSettings } from '@/stores/appSettings';
+import { createFolderPreference } from '@/stores/folderPreference';
+
+const VIEW_MODES = ['grid', 'list', 'tab', 'photos'];
+
+const DEFAULT_SORT_OPTIONS = [
+  { key: 1, name: 'Name A to Z', by: 'name', order: 'asc' },
+  { key: 2, name: 'Name Z to A', by: 'name', order: 'desc' },
+  { key: 3, name: 'Small to large', by: 'size', order: 'asc' },
+  { key: 4, name: 'Large to small', by: 'size', order: 'desc' },
+  { key: 7, name: 'Kind A to Z', by: 'kind', order: 'asc' },
+  { key: 8, name: 'Kind Z to A', by: 'kind', order: 'desc' },
+  { key: 5, name: 'Old to new', by: 'dateModified', order: 'asc' },
+  { key: 6, name: 'New to old', by: 'dateModified', order: 'desc' },
+];
 
 export const useSettingsStore = defineStore('settings', () => {
-  const view = useStorage('settings:view', 'grid');
-  const gridView = () => {
-    view.value = 'grid';
-  };
-  const listView = () => {
-    view.value = 'list';
-  };
-  const tabView = () => {
-    view.value = 'tab';
-  };
-  const photosView = () => {
-    view.value = 'photos';
+  const appSettings = useAppSettings();
+  const authStore = useAuthStore();
+
+  /**
+   * The view a folder gets when it has no remembered one of its own.
+   *
+   * Requested in #360. It lives with the user rather than in the browser, so it
+   * follows them between machines and does not leak to whoever signs in next on
+   * a shared one.
+   */
+  const defaultView = computed(() => {
+    const preferred = appSettings.userSettings?.defaultView;
+    return VIEW_MODES.includes(preferred) ? preferred : 'grid';
+  });
+
+  const view = ref('grid');
+
+  const setView = (mode) => {
+    if (!VIEW_MODES.includes(mode)) return undefined;
+    view.value = mode;
+    // Remembered against the folder being looked at, so coming back to it looks
+    // the way it was left.
+    return folderViewPreference.set(activeFolderPath.value, { mode });
   };
 
+  const gridView = () => setView('grid');
+  const listView = () => setView('list');
+  const tabView = () => setView('tab');
+  const photosView = () => setView('photos');
+
   // Photos mode item size (in px)
   const photoSize = useStorage('settings:photos:size', 160);
 
@@ -42,42 +74,121 @@ export const useSettingsStore = defineStore('settings', () => {
       themeMode.value === 'auto' ? 'light' : themeMode.value === 'light' ? 'dark' : 'auto';
   };
 
-  const sortOptions = reactive([
-    { key: 1, name: 'Name A to Z', by: 'name', order: 'asc' },
-    { key: 2, name: 'Name Z to A', by: 'name', order: 'desc' },
-    { key: 3, name: 'Small to large', by: 'size', order: 'asc' },
-    { key: 4, name: 'Large to small', by: 'size', order: 'desc' },
-    { key: 7, name: 'Kind A to Z', by: 'kind', order: 'asc' },
-    { key: 8, name: 'Kind Z to A', by: 'kind', order: 'desc' },
-    { key: 5, name: 'Old to new', by: 'dateModified', order: 'asc' },
-    { key: 6, name: 'New to old', by: 'dateModified', order: 'desc' },
-  ]);
-
+  const sortOptions = reactive(DEFAULT_SORT_OPTIONS.map((option) => ({ ...option })));
   const sortBy = ref(sortOptions[0]);
+  const activeFolderPath = ref('');
 
-  const setSortBy = (key) => {
-    sortBy.value = sortOptions.find((o) => o.key === key);
-  };
+  const MAX_SORT_FIELD_LENGTH = 128;
 
-  const setSort = (by, order) => {
-    if (!by || !order) return;
-    const existing = sortOptions.find((o) => o.by === by && o.order === order);
-    if (existing) {
-      sortBy.value = existing;
-      return;
-    }
+  const getSortOption = (by, order) => sortOptions.find((o) => o.by === by && o.order === order);
+
+  const isValidSort = (sort) =>
+    sort &&
+    typeof sort === 'object' &&
+    typeof sort.by === 'string' &&
+    sort.by.trim().length > 0 &&
+    sort.by.length <= MAX_SORT_FIELD_LENGTH &&
+    (sort.order === 'asc' || sort.order === 'desc');
+
+  const folderSortPreference = createFolderPreference({
+    key: 'folderSorts',
+    saveKey: 'folderSort',
+    entryKey: 'sort',
+    sanitizeEntry: (entry) =>
+      isValidSort(entry) ? { by: entry.by.trim(), order: entry.order } : null,
+    appSettings,
+    authStore,
+  });
+
+  const folderViewPreference = createFolderPreference({
+    key: 'folderViews',
+    saveKey: 'folderView',
+    entryKey: 'view',
+    sanitizeEntry: (entry) => {
+      const mode = typeof entry === 'string' ? entry : entry?.mode;
+      return VIEW_MODES.includes(mode) ? { mode } : null;
+    },
+    appSettings,
+    authStore,
+  });
+
+  const folderSorts = folderSortPreference.entries;
+  const folderViews = folderViewPreference.entries;
+
+  // A sort on a column outside the built-in list is still a sort worth
+  // restoring, so the option is rebuilt rather than falling back to the
+  // default.
+  const getOrCreateSortOption = (by, order) => {
+    const existing = getSortOption(by, order);
+    if (existing) return existing;
+    if (!isValidSort({ by, order })) return null;
 
     const nextKey = Math.max(0, ...sortOptions.map((o) => Number(o.key) || 0)) + 1;
     const created = { key: nextKey, name: `${by} ${order}`, by, order };
     sortOptions.push(created);
-    sortBy.value = created;
+    return created;
+  };
+
+  watch(
+    () => authStore.currentUser?.id ?? null,
+    () => {
+      activeFolderPath.value = '';
+      sortOptions.splice(
+        0,
+        sortOptions.length,
+        ...DEFAULT_SORT_OPTIONS.map((option) => ({ ...option }))
+      );
+      sortBy.value = sortOptions[0];
+      view.value = defaultView.value;
+    },
+    { flush: 'sync' }
+  );
+
+  const saveSortForActiveFolder = (sort) =>
+    folderSortPreference.set(activeFolderPath.value, { by: sort.by, order: sort.order });
+
+  const applySort = (sort) => {
+    if (!sort) return;
+    sortBy.value = sort;
+    return saveSortForActiveFolder(sort);
+  };
+
+  const setSortBy = (key) => {
+    applySort(sortOptions.find((o) => o.key === key));
+  };
+
+  const setSort = (by, order) => {
+    const sort = getOrCreateSortOption(by, order);
+    if (!sort) return;
+    return applySort(sort);
+  };
+
+  /**
+   * Put a folder back the way it was left: its sort, and its view.
+   *
+   * A folder with no remembered view falls back to the default rather than
+   * keeping whatever the previous folder was showing — a photo folder set to
+   * the photo grid should not turn a folder of documents into one.
+   */
+  const restoreFolderPreferences = (path) => {
+    activeFolderPath.value = typeof path === 'string' ? path : '';
+    const savedSort = folderSorts.value?.[activeFolderPath.value];
+    sortBy.value = getOrCreateSortOption(savedSort?.by, savedSort?.order) || sortOptions[0];
+
+    const savedView = folderViews.value?.[activeFolderPath.value];
+    view.value = VIEW_MODES.includes(savedView?.mode) ? savedView.mode : defaultView.value;
   };
 
-  const DEFAULT_LIST_VIEW_COLUMN_WIDTHS = [30, 420, 120, 160, 220];
-  const LIST_VIEW_MIN_WIDTHS = [30, 200, 100, 120, 160];
+  // Widths are sized to their content (icon, name, size, kind, modified date) so
+  // the grid doesn't reserve empty space that would trigger a horizontal
+  // scrollbar over nothing. Non-last columns keep a small surplus over their
+  // content as an inter-column margin; the trailing date column hugs its value.
+  // Key is versioned (:v2) so the tighter defaults replace any stored widths.
+  const DEFAULT_LIST_VIEW_COLUMN_WIDTHS = [30, 340, 96, 136, 150];
+  const LIST_VIEW_MIN_WIDTHS = [30, 160, 70, 96, 140];
 
   const listViewColumnWidths = useStorage(
-    'settings:listView:columns',
+    'settings:listView:columns:v2',
     DEFAULT_LIST_VIEW_COLUMN_WIDTHS
   );
 
@@ -124,6 +235,7 @@ export const useSettingsStore = defineStore('settings', () => {
 
   return {
     view,
+    setView,
     gridView,
     listView,
     tabView,
@@ -136,6 +248,9 @@ export const useSettingsStore = defineStore('settings', () => {
     sortBy,
     setSortBy,
     setSort,
+    restoreFolderPreferences,
+    folderViews,
+    defaultView,
     sortOptions,
     terminalHeight,
     listViewColumnWidths,
diff --git a/frontend/src/stores/volumeUsage.js b/frontend/src/stores/volumeUsage.js
new file mode 100644
index 000000000..2bc7b2551
--- /dev/null
+++ b/frontend/src/stores/volumeUsage.js
@@ -0,0 +1,151 @@
+import { defineStore } from 'pinia';
+import { ref } from 'vue';
+import { getUsage, getVolumes, normalizePath } from '@/api';
+import { useFeaturesStore } from '@/stores/features';
+
+const REFRESH_THROTTLE_MS = 2500;
+
+const normalizeUsage = (raw = {}) => {
+  const total = Number(raw.total) || 0;
+  const used = Number(raw.used ?? raw.size) || 0;
+  const free = Number(raw.free) || 0;
+  const percentUsed =
+    total > 0 ? Math.max(0, Math.min(100, Number(raw.percentUsed) || (used / total) * 100)) : 0;
+
+  return {
+    path: normalizePath(raw.path || ''),
+    size: used,
+    used,
+    free,
+    total,
+    percentUsed,
+  };
+};
+
+export const useVolumeUsageStore = defineStore('volumeUsage', () => {
+  const volumes = ref([]);
+  const usage = ref({});
+  const isLoadingVolumes = ref(false);
+  const isLoadingUsage = ref(false);
+  const hasLoadedVolumes = ref(false);
+
+  let loadPromise = null;
+  let refreshPromise = null;
+  let refreshTimer = null;
+  let lastRefreshAt = 0;
+
+  const setUsage = (path, value) => {
+    const key = normalizePath(path || value?.path || '');
+    if (!key) return;
+    usage.value = {
+      ...usage.value,
+      [key]: normalizeUsage({ ...value, path: key }),
+    };
+  };
+
+  const refreshUsage = async ({ force = false, skipLoad = false } = {}) => {
+    const featuresStore = useFeaturesStore();
+    await featuresStore.ensureLoaded();
+
+    if (!featuresStore.volumeUsageEnabled) {
+      usage.value = {};
+      return;
+    }
+
+    if (!volumes.value.length && !skipLoad) {
+      await loadVolumes({ force: false });
+      return;
+    }
+
+    const now = Date.now();
+    if (!force && now - lastRefreshAt < REFRESH_THROTTLE_MS) {
+      return;
+    }
+
+    if (refreshPromise) {
+      return refreshPromise;
+    }
+
+    const targetVolumes = [...volumes.value];
+    isLoadingUsage.value = true;
+    refreshPromise = (async () => {
+      const entries = await Promise.all(
+        targetVolumes.map(async (volume) => {
+          try {
+            const data = await getUsage(volume.path);
+            return [normalizePath(volume.path), normalizeUsage(data)];
+          } catch (_) {
+            return null;
+          }
+        })
+      );
+
+      const nextUsage = { ...usage.value };
+      for (const entry of entries) {
+        if (!entry) continue;
+        const [path, data] = entry;
+        nextUsage[path] = data;
+      }
+      usage.value = nextUsage;
+      lastRefreshAt = Date.now();
+    })();
+
+    try {
+      await refreshPromise;
+    } finally {
+      refreshPromise = null;
+      isLoadingUsage.value = false;
+    }
+  };
+
+  const loadVolumes = async ({ force = false } = {}) => {
+    if (loadPromise) {
+      return loadPromise;
+    }
+    if (!force && volumes.value.length) {
+      return;
+    }
+
+    isLoadingVolumes.value = true;
+    loadPromise = (async () => {
+      const featuresStore = useFeaturesStore();
+      await featuresStore.ensureLoaded();
+
+      volumes.value = await getVolumes();
+      hasLoadedVolumes.value = true;
+
+      if (featuresStore.volumeUsageEnabled) {
+        await refreshUsage({ force: true, skipLoad: true });
+      }
+    })();
+
+    try {
+      await loadPromise;
+    } finally {
+      loadPromise = null;
+      isLoadingVolumes.value = false;
+    }
+  };
+
+  const scheduleRefresh = ({ delayMs = 500, force = true } = {}) => {
+    if (refreshTimer) {
+      globalThis.clearTimeout(refreshTimer);
+    }
+    refreshTimer = globalThis.setTimeout(() => {
+      refreshTimer = null;
+      refreshUsage({ force }).catch(() => {});
+    }, delayMs);
+  };
+
+  return {
+    volumes,
+    usage,
+    isLoadingVolumes,
+    isLoadingUsage,
+    hasLoadedVolumes,
+    loadVolumes,
+    refreshUsage,
+    scheduleRefresh,
+    setUsage,
+  };
+});
diff --git a/frontend/src/utils/favoriteIcons.js b/frontend/src/utils/favoriteIcons.js
new file mode 100644
index 000000000..f8679bfe8
--- /dev/null
+++ b/frontend/src/utils/favoriteIcons.js
@@ -0,0 +1,44 @@
+import * as OutlineIcons from '@heroicons/vue/24/outline';
+import * as SolidIcons from '@heroicons/vue/24/solid';
+
+/**
+ * Favorite icons are stored as "<variant>:<IconName>", e.g. "outline:StarIcon".
+ *
+ * Resolution lives here rather than in each view: the sidebar, the home grid
+ * and the edit dialog all render the same stored value, and a variant one of
+ * them does not know about silently falls back to a star.
+ */
+const FAVORITE_ICON_VARIANTS = {
+  outline: OutlineIcons,
+  solid: SolidIcons,
+};
+
+/**
+ * Map a stored variant onto a real one.
+ *
+ * "outline-solid" was written by an earlier version of the edit dialog; it
+ * never matched a registry, so every icon saved that way renders as the
+ * default star. Treat it as "outline" so those favorites come back.
+ */
+export const normalizeIconVariant = (variant) => {
+  const key = String(variant || '').toLowerCase();
+  if (key === 'outline-solid') return 'outline';
+  return key;
+};
+
+export const resolveFavoriteIcon = (iconName) => {
+  if (typeof iconName !== 'string') return OutlineIcons.StarIcon;
+
+  const trimmed = iconName.trim();
+  if (!trimmed) return OutlineIcons.StarIcon;
+
+  if (trimmed.includes(':')) {
+    const [variantRaw, iconRaw] = trimmed.split(':', 2);
+    const registry = FAVORITE_ICON_VARIANTS[normalizeIconVariant(variantRaw)];
+    const iconKey = iconRaw.trim();
+    if (registry && registry[iconKey]) return registry[iconKey];
+  }
+
+  // Bare names (no variant) are accepted for backwards compatibility.
+  return OutlineIcons[trimmed] || SolidIcons[trimmed] || OutlineIcons.StarIcon;
+};
diff --git a/frontend/src/utils/fileKinds.js b/frontend/src/utils/fileKinds.js
index 293be5585..0fa7d884c 100644
--- a/frontend/src/utils/fileKinds.js
+++ b/frontend/src/utils/fileKinds.js
@@ -147,27 +147,62 @@ const LOOKUP_TABLES = [
   dataMap,
 ];
 
+const lookup = (extension) => {
+  for (const table of LOOKUP_TABLES) {
+    if (Object.prototype.hasOwnProperty.call(table, extension)) {
+      return table[extension];
+    }
+  }
+  return null;
+};
+
+/**
+ * The longest run of characters still plausibly an extension.
+ *
+ * The same rule the listing uses when it decides between an extension and
+ * `unknown`. Without it, a name ending in `.superlongextension` — which the
+ * server refused to call an extension — comes back through this door and is
+ * shown as one anyway.
+ */
+const MAX_PLAUSIBLE_EXTENSION = 10;
+
+/** The extension a filename ends with, or '' — a leading dot is a hidden name. */
+const extensionOfName = (name) => {
+  const nm = String(name || '');
+  const idx = nm.lastIndexOf('.');
+  if (idx <= 0 || idx >= nm.length - 1) return '';
+  const extension = nm.slice(idx + 1).toLowerCase();
+  return extension.length > MAX_PLAUSIBLE_EXTENSION ? '' : extension;
+};
+
+/**
+ * What to call a thing in the Kind column.
+ *
+ * The listing sends `directory`, the file's extension, or the literal string
+ * `unknown` — which it uses for a file with no extension at all, and for one
+ * whose extension is too long to be plausible. `unknown` is a statement about
+ * what the *server* could work out, not something to show anybody: it used to
+ * reach the column as "UNKNOWN file", which is what a LICENSE or a Makefile
+ * read as.
+ *
+ * So an unhelpful kind falls through to the filename, and the filename goes
+ * through the same tables the kind does. Before, it did not: a file arriving
+ * without a kind read as "MD file" where the same file with one read as
+ * "Markdown document" — one file, two labels, depending on which screen asked.
+ */
 function labelFromKind(kind, name) {
   const k = String(kind || '').toLowerCase();
 
   if (k === 'directory') return 'Folder';
   if (k === 'volume') return 'Volume';
 
-  for (const table of LOOKUP_TABLES) {
-    if (Object.prototype.hasOwnProperty.call(table, k)) {
-      return table[k];
-    }
-  }
-
-  if (k) return `${k.toUpperCase()} file`;
+  const known = k && k !== 'unknown' ? lookup(k) : null;
+  if (known) return known;
+  if (k && k !== 'unknown') return `${k.toUpperCase()} file`;
 
-  const nm = String(name || '');
-  const idx = nm.lastIndexOf('.');
-  if (idx > 0 && idx < nm.length - 1) {
-    const ext = nm.slice(idx + 1).toLowerCase();
-    if (ext) return `${ext.toUpperCase()} file`;
-  }
-  return 'File';
+  const extension = extensionOfName(name);
+  if (!extension) return 'File';
+  return lookup(extension) ?? `${extension.toUpperCase()} file`;
 }
 
 function getKindLabel(item) {
@@ -177,15 +212,5 @@ function getKindLabel(item) {
 
 export {
   getKindLabel,
-  labelFromKind,
   // export tables for potential reuse/testing
-  imageMap,
-  videoMap,
-  audioMap,
-  archiveMap,
-  docMap,
-  codeMap,
-  fontMap,
-  pkgMap,
-  dataMap,
 };
diff --git a/frontend/src/utils/folderKeyboard.js b/frontend/src/utils/folderKeyboard.js
new file mode 100644
index 000000000..cdd726975
--- /dev/null
+++ b/frontend/src/utils/folderKeyboard.js
@@ -0,0 +1,82 @@
+/**
+ * Moving through a folder from the keyboard.
+ *
+ * Lifted out of FolderView, which CI measures at under two per cent covered and
+ * which is the screen everybody uses. These are the decisions rather than the
+ * plumbing: which row an arrow key reaches, which rows a held shift covers, and
+ * which file a burst of typing finds. Each of them is wrong in a way somebody
+ * sees immediately — the selection jumps somewhere unexpected — and none of
+ * them needs a DOM to answer.
+ */
+
+/**
+ * The row an arrow key reaches.
+ *
+ * With nothing active yet, down starts at the top and up starts at the bottom,
+ * which is what makes the first keypress in a folder do something sensible
+ * rather than nothing. Otherwise it moves one and stops at the ends: a list
+ * that wrapped around would take somebody from the last file to the first
+ * without their asking.
+ */
+export const nextIndexInDirection = (currentIndex, direction, count) => {
+  if (count <= 0) return -1;
+  if (currentIndex < 0) return direction > 0 ? 0 : count - 1;
+  return Math.min(count - 1, Math.max(0, currentIndex + direction));
+};
+
+/**
+ * The rows a range covers, in list order whichever end it was built from.
+ *
+ * Shift-up from the middle anchors below the active row, and the slice bounds
+ * have to come out the same way round either way.
+ */
+export const rangeBetween = (anchorIndex, activeIndex) =>
+  anchorIndex <= activeIndex ? [anchorIndex, activeIndex] : [activeIndex, anchorIndex];
+
+/**
+ * Typed text, reduced to what a match should ignore.
+ *
+ * Accents are stripped so that typing `e` reaches `Éléonore`, and case is
+ * folded with the locale's own rules rather than ASCII's.
+ */
+export const normalizeTypeaheadText = (value) =>
+  String(value || '')
+    .normalize('NFD')
+    .replace(/\p{Diacritic}/gu, '')
+    .toLocaleLowerCase();
+
+/**
+ * The file a burst of typing finds, and the query it settled on.
+ *
+ * The search starts just after the active row and wraps, so typing the same
+ * letter repeatedly walks through the files that begin with it instead of
+ * sticking on the first one.
+ *
+ * When one more letter matches nothing, the letter starts a new search rather
+ * than leaving the person stuck with a query that can no longer match anything:
+ * somebody typing `re` in a folder with no `re…` almost always meant to jump to
+ * `r`, then to `e`. The query that was settled on comes back with the match so
+ * the caller records the same one the search used.
+ *
+ * @param {object[]} items in the order they are displayed
+ * @param {string} query the accumulated text, already normalised
+ * @param {number} activeIndex where the selection is now, or -1
+ * @param {string} lastKey the key just typed, already normalised
+ */
+export const findTypeaheadMatch = (items, query, activeIndex, lastKey) => {
+  if (!Array.isArray(items) || items.length === 0) return { match: null, query };
+
+  const ordered = [...items.slice(activeIndex + 1), ...items.slice(0, activeIndex + 1)];
+  const startingWith = (text) =>
+    ordered.find((item) => normalizeTypeaheadText(item?.name).startsWith(text));
+
+  const match = startingWith(query);
+  if (match) return { match, query };
+
+  if (query.length > 1 && lastKey) {
+    const restarted = startingWith(lastKey);
+    if (restarted) return { match: restarted, query: lastKey };
+  }
+
+  return { match: null, query };
+};
diff --git a/frontend/src/utils/revealOffset.js b/frontend/src/utils/revealOffset.js
new file mode 100644
index 000000000..52f5cbdbc
--- /dev/null
+++ b/frontend/src/utils/revealOffset.js
@@ -0,0 +1,29 @@
+/**
+ * Where to scroll so that a given row lands on screen.
+ *
+ * A search result opens the folder that holds the file, and the file itself is
+ * usually below the fold — the folder then looks as though nothing was found.
+ * In a virtualised list the row does not exist in the DOM until the scroll
+ * position brings it into the window, so the position has to be computed from
+ * the index rather than read from an element.
+ *
+ * A third of the way down rather than centred: what sits above a file — the
+ * folders it lives among — is context worth seeing, and pinning it to the very
+ * top hides that it has any.
+ */
+const VIEWPORT_FRACTION = 3;
+
+const revealOffset = ({ index, rowHeight, viewportHeight, maxScrollTop }) => {
+  if (!Number.isFinite(index) || index < 0) return 0;
+  if (!Number.isFinite(rowHeight) || rowHeight <= 0) return 0;
+
+  const above = Number.isFinite(viewportHeight) ? viewportHeight / VIEWPORT_FRACTION : 0;
+  const wanted = Math.max(0, index * rowHeight - above);
+
+  // A row near the end cannot be a third of the way down: there is not enough
+  // document below it, and asking for it would scroll past the end.
+  if (!Number.isFinite(maxScrollTop) || maxScrollTop <= 0) return 0;
+  return Math.min(wanted, maxScrollTop);
+};
+
+export { revealOffset, VIEWPORT_FRACTION };
diff --git a/frontend/src/utils/searchMatch.js b/frontend/src/utils/searchMatch.js
new file mode 100644
index 000000000..0f86783d5
--- /dev/null
+++ b/frontend/src/utils/searchMatch.js
@@ -0,0 +1,26 @@
+/**
+ * Which half of the search a result came from.
+ *
+ * A result carrying a matched line was found by its contents and one without
+ * it by its name, and until this was said out loud the only way to tell was to
+ * notice that something was missing — and only by comparing two results with
+ * each other.
+ *
+ * The server now says of every result whether its name matched, asked of the
+ * matcher rather than inferred from which pass produced it, and whether a line
+ * is being shown. This turns the pair into the one word to put on screen.
+ *
+ * @param {{matchedName?: boolean, matchedContent?: boolean}} item
+ * @returns {string|null} a translation key, or null when there is nothing to say
+ */
+export const matchLabelKey = (item) => {
+  const byName = Boolean(item?.matchedName);
+  const byContent = Boolean(item?.matchedContent);
+
+  if (byName && byContent) return 'search.matchedByBoth';
+  if (byContent) return 'search.matchedByContent';
+  if (byName) return 'search.matchedByName';
+  // An answer from a server that predates the question, or a result neither
+  // half claims. Saying nothing is better than guessing which it was.
+  return null;
+};
diff --git a/frontend/src/views/SearchResultsView.vue b/frontend/src/views/SearchResultsView.vue
index de72cec44..07883e3fa 100644
--- a/frontend/src/views/SearchResultsView.vue
+++ b/frontend/src/views/SearchResultsView.vue
@@ -1,17 +1,49 @@
 <script setup>
+import { matchLabelKey } from '@/utils/searchMatch';
 import { ref, onMounted, watch, computed } from 'vue';
 import { useI18n } from 'vue-i18n';
 import { useRoute, useRouter } from 'vue-router';
 import { search as searchApi, normalizePath } from '@/api';
 import FileIcon from '@/icons/FileIcon.vue';
+import { folderRoute } from '@/utils/folderRoute';
 
 const route = useRoute();
 const { t } = useI18n();
 const router = useRouter();
 
 const items = ref([]);
+/** Why the answer is short of everything, or null when it is not. */
+const shortfall = ref(null);
+/** Whether what was asked for is too short to be worth sending. */
+const tooShort = ref(false);
+const MIN_TERM_LENGTH = 3;
+/** A page is a hundred; the rest is asked for rather than held open. */
+const LIMIT_STEPS = [100, 300, 500];
+const askedLimit = ref(LIMIT_STEPS[0]);
+const canShowMore = computed(
+  () => shortfall.value?.kind === 'first' && askedLimit.value < LIMIT_STEPS[LIMIT_STEPS.length - 1]
+);
+const showMore = () => {
+  askedLimit.value = LIMIT_STEPS.find((step) => step > askedLimit.value) ?? askedLimit.value;
+  load();
+};
+let lastAsked = null;
 const loading = ref(false);
 const errorMsg = ref('');
+/**
+ * Whether a search has actually finished for what is being asked now.
+ *
+ * "No matches" is an answer, and it may only be shown once there is one. Before
+ * this existed the empty list said it from the first frame — and again whenever
+ * an earlier request finished while a newer one was still running, since any
+ * completion cleared `loading`. Someone watching read it as a search that had
+ * run and found nothing.
+ */
+const searched = ref(false);
+
+// Only the newest search may write to the view; an older one that comes back
+// late has been superseded and its results are not the ones being asked for.
+let currentRequest = 0;
 
 const q = computed(() => (typeof route.query.q === 'string' ? route.query.q : ''));
 const basePath = computed(() =>
@@ -20,17 +52,52 @@ const basePath = computed(() =>
 
 async function load() {
   const term = q.value.trim();
+  const request = (currentRequest += 1);
+
+  if (term !== lastAsked) {
+    lastAsked = term;
+    askedLimit.value = LIMIT_STEPS[0];
+  }
   items.value = [];
+  shortfall.value = null;
   errorMsg.value = '';
-  if (!term) return;
+  searched.value = false;
+
+  // The server refuses fewer than three characters; said here rather than sent
+  // and bounced back as an error.
+  if (term.length < MIN_TERM_LENGTH) {
+    tooShort.value = term.length > 0;
+    loading.value = false;
+    searched.value = term.length === 0 ? false : true;
+    return;
+  }
+  tooShort.value = false;
+
   loading.value = true;
   try {
-    const { items: list = [] } = await searchApi(basePath.value, term);
+    const {
+      items: list = [],
+      truncated = false,
+      complete = true,
+      limit,
+    } = await searchApi(basePath.value, term, askedLimit.value);
+    if (request !== currentRequest) return;
     items.value = Array.isArray(list) ? list : [];
+    // Why the list may be shorter than the truth, said rather than left to
+    // look like the whole answer.
+    shortfall.value = truncated
+      ? { kind: 'stopped' }
+      : complete
+        ? null
+        : { kind: 'first', count: Number.isFinite(limit) ? limit : items.value.length };
+    searched.value = true;
   } catch (e) {
+    if (request !== currentRequest) return;
     errorMsg.value = e?.message || t('errors.searchFailed');
+    searched.value = true;
   } finally {
-    loading.value = false;
+    // Only the search still being awaited may say the waiting is over.
+    if (request === currentRequest) loading.value = false;
   }
 }
 
@@ -43,7 +110,12 @@ function openResult(it) {
   // Open the matched folder itself for directories; open parent for files
   const target = kind === 'dir' ? [it.path, it.name].filter(Boolean).join('/') : it.path || '';
   const normalized = normalizePath(target || '');
-  router.push({ name: 'FolderView', params: { path: normalized } });
+  // Naming the file is what lets the folder open on it rather than at the
+  // top: landing in the right folder and leaving the reader to find the row
+  // themselves is most of the way to not having searched at all.
+  router.push(
+    folderRoute(normalized, kind === 'file' && it.name ? { select: it.name } : undefined)
+  );
 }
 
 function toIconItem(it) {
@@ -69,7 +141,14 @@ function toIconItem(it) {
 </script>
 
 <template>
-  <div class="flex flex-col gap-3">
+  <!--
+    A column of the height it was given, so the list below can be a viewport
+    over the results rather than the whole of them. The content area this sits
+    in clips, and every other view that lists things does the same thing: the
+    trash, both share lists and the folder listing all scroll their own list.
+    This one did not, and a hundred results showed ten.
+  -->
+  <div class="flex h-full min-h-0 flex-col gap-3">
     <div class="text-sm text-neutral-600 dark:text-neutral-300">
       <span v-if="q">{{ $t('search.resultsFor', { q }) }}</span>
       <span v-if="basePath">
@@ -82,13 +161,19 @@ function toIconItem(it) {
       {{ $t('search.searching') }}
     </div>
     <div v-else-if="errorMsg" class="text-sm text-red-600">{{ errorMsg }}</div>
-    <div v-else-if="items.length === 0" class="text-sm text-neutral-500 dark:text-neutral-400">
+    <div v-else-if="tooShort" data-test="search-too-short" class="p-6 text-sm text-neutral-500">
+      {{ $t('search.tooShort', { count: MIN_TERM_LENGTH }) }}
+    </div>
+    <div
+      v-else-if="searched && items.length === 0"
+      class="text-sm text-neutral-500 dark:text-neutral-400"
+    >
       {{ $t('search.noMatches') }}
     </div>
 
     <div
       v-else
-      class="flex flex-col divide-y divide-neutral-200 dark:divide-neutral-800 rounded-md overflow-hidden"
+      class="min-h-0 flex-1 divide-y divide-neutral-200 overflow-y-auto rounded-md dark:divide-neutral-800"
     >
       <div
         v-for="it in items"
@@ -98,7 +183,16 @@ function toIconItem(it) {
         <div class="flex items-center gap-3 min-w-0">
           <FileIcon :item="toIconItem(it)" class="w-12 h-12 shrink-0" />
           <div class="min-w-0">
-            <div class="font-medium truncate">{{ it.name }}</div>
+            <div class="flex items-baseline gap-2 min-w-0">
+              <div class="font-medium truncate">{{ it.name }}</div>
+              <span
+                v-if="matchLabelKey(it)"
+                data-test="match-kind"
+                class="shrink-0 rounded-full px-1.5 text-[0.65rem] font-medium leading-4 text-neutral-500 ring-1 ring-neutral-300 dark:text-neutral-400 dark:ring-neutral-600"
+              >
+                {{ $t(matchLabelKey(it)) }}
+              </span>
+            </div>
             <div class="text-xs text-neutral-500 font-mono truncate">/{{ it.path }}</div>
             <div
               v-if="it.matchLine"
@@ -119,6 +213,27 @@ function toIconItem(it) {
           </button>
         </div>
       </div>
+
+      <p
+        v-if="shortfall"
+        data-test="search-shortfall"
+        class="p-3 text-xs text-amber-700 dark:text-amber-400/90 bg-white dark:bg-zinc-800/50"
+      >
+        {{
+          shortfall.kind === 'stopped'
+            ? t('search.stoppedEarly')
+            : t('search.firstOnly', { count: shortfall.count })
+        }}
+        <button
+          v-if="canShowMore"
+          data-test="search-show-more"
+          type="button"
+          class="ml-2 underline underline-offset-2 hover:no-underline"
+          @click="showMore"
+        >
+          {{ t('search.showMore') }}
+        </button>
+      </p>
     </div>
   </div>
 </template>
diff --git a/frontend/src/views/SharedByMeView.vue b/frontend/src/views/SharedByMeView.vue
index e7c4ff4f5..9814b59b7 100644
--- a/frontend/src/views/SharedByMeView.vue
+++ b/frontend/src/views/SharedByMeView.vue
@@ -1,6 +1,8 @@
 <script setup>
 import { ref, onMounted, computed } from 'vue';
 import { useI18n } from 'vue-i18n';
+import { formatLocalDateTime } from '@/utils';
+import { isEditableExtension } from '@/config/editor';
 import {
   getMyShares,
   deleteShare,
@@ -11,7 +13,6 @@ import {
 import { fetchShareableUsers } from '@/api/users.api';
 import ModalDialog from '@/components/ModalDialog.vue';
 import {
-  ShareIcon,
   LockClosedIcon,
   LockOpenIcon,
   TrashIcon,
@@ -19,10 +20,16 @@ import {
   ClipboardDocumentIcon,
   CheckIcon,
   LinkIcon,
-  MagnifyingGlassIcon,
-  ArrowsUpDownIcon,
+  EyeIcon,
+  ArrowDownTrayIcon,
+  InformationCircleIcon,
+  XMarkIcon,
+  PencilSquareIcon,
 } from '@heroicons/vue/24/outline';
 import FileIcon from '@/icons/FileIcon.vue';
+import ShareListToolbar from '@/components/shares/ShareListToolbar.vue';
+import ShareListState from '@/components/shares/ShareListState.vue';
+import ShareDialog from '@/components/ShareDialog.vue';
 
 const { t } = useI18n();
 
@@ -38,12 +45,18 @@ const directCopiedId = ref(null);
 const directLinkModes = ref({});
 const sharePendingDelete = ref(null);
 const isDeleteShareDialogOpen = ref(false);
+const selectedActivityShare = ref(null);
+const isEditShareDialogOpen = ref(false);
+const shareBeingEdited = ref(null);
 const searchQuery = ref('');
 const filterMode = ref('active'); // 'active' | 'expired' | 'all'
 const sortMode = ref('recent'); // 'recent' | 'label'
 
 // Grid columns configuration
-const GRID_COLS = 'grid-cols-[30px_minmax(0,3fr)_1.5fr_1fr_1.5fr_170px]';
+// Shared-with / access / expire hold short labels ("Everyone", "Read only",
+// "Never"/a date), so keep them narrow and hand the reclaimed width to the
+// actions column, which carries the info/copy/mode+link/delete controls.
+const GRID_COLS = 'grid-cols-[30px_minmax(0,3fr)_1fr_1fr_1fr_240px]';
 
 // Create a map of userId -> user for quick lookup
 const usersMap = computed(() => {
@@ -91,16 +104,26 @@ const isExpired = (share) => {
   return new Date(share.expiresAt) <= new Date();
 };
 
-const formatDate = (dateString) => {
-  if (!dateString) return t('common.noExpiration');
+const formatDate = (dateString) => formatLocalDateTime(dateString, t('common.noExpiration'));
+
+const formatDetailedDate = (dateString) => {
+  if (!dateString) return t('share.noActivity');
   const date = new Date(dateString);
   if (Number.isNaN(date.getTime())) return dateString;
-  return `${date.toLocaleDateString()} ${date.toLocaleTimeString()}`;
+  return date.toLocaleString(undefined, {
+    dateStyle: 'full',
+    timeStyle: 'medium',
+  });
+};
+
+const formatIp = (ipAddress) => {
+  if (!ipAddress) return t('share.noIpRecorded');
+  return ipAddress;
 };
 
 const getRecentTimestamp = (share) => {
   if (!share) return 0;
-  const fields = ['updatedAt', 'createdAt'];
+  const fields = ['lastDownloadedAt', 'lastAccessedAt', 'updatedAt', 'createdAt'];
   for (const key of fields) {
     const raw = share[key];
     if (!raw) continue;
@@ -151,6 +174,16 @@ const directLinkModeOptions = computed(() =>
   }))
 );
 
+const directLinkModeOptionsForShare = (share) => {
+  const sourceName =
+    String(share?.sourcePath || '')
+      .split('/')
+      .pop() || '';
+  const extension = sourceName.includes('.') ? sourceName.split('.').pop() : '';
+  const supportsEditor = !share?.isDirectory && isEditableExtension(extension);
+  return directLinkModeOptions.value.filter((mode) => mode.value !== 'editor' || supportsEditor);
+};
+
 const getShareLabel = (share) => {
   if (share.label) return share.label;
   if (share.sourcePath) {
@@ -209,6 +242,22 @@ const closeDeleteShareDialog = () => {
   sharePendingDelete.value = null;
 };
 
+const openEditShare = (share) => {
+  if (!share?.id) return;
+  shareBeingEdited.value = share;
+  isEditShareDialogOpen.value = true;
+};
+
+const closeEditShareDialog = () => {
+  isEditShareDialogOpen.value = false;
+  shareBeingEdited.value = null;
+};
+
+const handleShareUpdated = async () => {
+  await loadShares();
+  closeEditShareDialog();
+};
+
 const handleCopyLink = async (share) => {
   if (!share?.id || !share?.shareToken) return;
 
@@ -247,6 +296,14 @@ const handleCopyDirectFileLink = async (share) => {
   }
 };
 
+const openActivityDetails = (share) => {
+  selectedActivityShare.value = share;
+};
+
+const closeActivityDetails = () => {
+  selectedActivityShare.value = null;
+};
+
 onMounted(async () => {
   await loadShares();
 });
@@ -254,256 +311,214 @@ onMounted(async () => {
 
 <template>
   <div class="h-full relative flex flex-col max-h-screen">
-    <!-- Toolbar -->
-    <div
-      class="z-10 p-3 pl-12 lg:pl-3 border-b border-neutral-200 dark:border-neutral-800 bg-white dark:bg-default"
-    >
-      <div class="flex items-center gap-3">
-        <!-- Title/Icon -->
-        <div class="flex items-center gap-2 mr-4">
-          <h1
-            class="font-medium text-neutral-800 dark:text-neutral-200 hidden sm:block text-lg ml-2"
-          >
-            {{ t('share.sharedByMe') }}
-          </h1>
-        </div>
-
-        <!-- Filters -->
-        <div class="flex items-center bg-neutral-100 dark:bg-neutral-800 rounded-md p-0.5">
-          <button
-            v-for="mode in ['active', 'expired', 'all']"
-            :key="mode"
-            @click="filterMode = mode"
-            class="px-3 py-1 text-xs font-medium rounded-sm transition-colors"
-            :class="
-              filterMode === mode
-                ? 'bg-white dark:bg-neutral-700 text-neutral-900 dark:text-neutral-100 shadow-sm'
-                : 'text-neutral-500 dark:text-neutral-400 hover:text-neutral-700 dark:hover:text-neutral-300'
-            "
-          >
-            {{ t(`common.${mode}`) }}
-          </button>
-        </div>
-
-        <div class="h-6 w-px bg-neutral-200 dark:bg-neutral-700 mx-1"></div>
-
-        <!-- Sort -->
-        <div class="flex items-center gap-2">
-          <button
-            @click="sortMode = sortMode === 'recent' ? 'label' : 'recent'"
-            class="p-1.5 rounded-md hover:bg-neutral-100 dark:hover:bg-neutral-800 text-neutral-500 dark:text-neutral-400"
-            :title="t('actions.sortBy')"
-          >
-            <ArrowsUpDownIcon class="w-5 h-5" />
-          </button>
-        </div>
-
-        <div class="flex-1"></div>
-
-        <!-- Search -->
-        <div class="relative">
-          <MagnifyingGlassIcon
-            class="absolute left-2.5 top-1/2 -translate-y-1/2 w-4 h-4 text-neutral-400"
-          />
-          <input
-            v-model="searchQuery"
-            type="text"
-            :placeholder="t('share.filterByNameOrPath')"
-            class="pl-9 pr-3 py-1.5 text-sm bg-neutral-100 dark:bg-neutral-800 rounded-md border-none focus:ring-2 focus:ring-blue-500 w-48 transition-all focus:w-64"
-          />
-        </div>
-      </div>
-    </div>
+    <ShareListToolbar
+      v-model:filter-mode="filterMode"
+      v-model:sort-mode="sortMode"
+      v-model:search-query="searchQuery"
+      :title="t('share.sharedByMe')"
+    />
 
     <!-- Content -->
     <div class="flex-1 overflow-y-auto px-2">
-      <!-- Loading -->
-      <div v-if="loading" class="flex h-full items-center justify-center">
-        <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-blue-500"></div>
-      </div>
-
-      <!-- Error -->
-      <div v-else-if="error" class="flex h-full flex-col items-center justify-center text-red-500">
-        <p>{{ error }}</p>
-        <button @click="loadShares" class="mt-2 text-blue-500 hover:underline">
-          {{ t('common.tryAgain') }}
-        </button>
-      </div>
-
-      <!-- Empty -->
-      <div
-        v-else-if="visibleShares.length === 0"
-        class="flex h-full flex-col items-center justify-center text-neutral-400"
+      <ShareListState
+        :loading="loading"
+        :error="error"
+        :empty="visibleShares.length === 0"
+        :empty-text="t('share.noSharedItemsToShow')"
+        @retry="loadShares"
       >
-        <ShareIcon class="w-16 h-16 mb-4 opacity-20" />
-        <p>{{ t('share.noSharedItemsToShow') }}</p>
-      </div>
-
-      <!-- List -->
-      <div v-else class="min-w-[800px]">
-        <!-- Header Row -->
-        <div
-          :class="[
-            'grid items-center gap-4 px-4 py-2 text-xs font-medium text-neutral-500 dark:text-neutral-400 uppercase tracking-wider border-b border-neutral-100 dark:border-neutral-800 sticky top-0 bg-white dark:bg-default z-10',
-            GRID_COLS,
-          ]"
-        >
-          <div></div>
-          <div>{{ t('common.name') }}</div>
-          <div>{{ t('share.sharedWith') }}</div>
-          <div>{{ t('settings.access.title') }}</div>
-          <div>{{ t('share.expiresAt') }}</div>
-          <div class="text-right">{{ t('common.actions') }}</div>
-        </div>
-
-        <!-- Items -->
-        <div class="flex flex-col gap-0.5 pb-4">
+        <!-- List -->
+        <div class="min-w-[860px]">
+          <!-- Header Row -->
           <div
-            v-for="share in visibleShares"
-            :key="share.id"
             :class="[
-              'grid items-center gap-4 px-4 py-2 text-sm rounded-md hover:bg-neutral-100 dark:hover:bg-neutral-800/50 transition-colors group',
+              'grid items-center gap-4 px-4 py-2 text-xs font-medium text-neutral-500 dark:text-neutral-400 uppercase tracking-wider border-b border-neutral-100 dark:border-neutral-800 sticky top-0 bg-white dark:bg-default z-10',
               GRID_COLS,
             ]"
           >
-            <!-- Icon -->
-            <div class="flex justify-center items-center">
-              <FileIcon
-                :item="getIconItem(share)"
-                class="w-12 h-12 shrink-0"
-                :disable-thumbnails="true"
-              />
-            </div>
+            <div></div>
+            <div>{{ t('common.name') }}</div>
+            <div>{{ t('share.sharedWith') }}</div>
+            <div>{{ t('settings.access.title') }}</div>
+            <div>{{ t('share.expiresAt') }}</div>
+            <div class="text-right">{{ t('common.actions') }}</div>
+          </div>
 
-            <!-- Name & Path -->
-            <div class="min-w-0">
-              <div class="font-medium text-neutral-900 dark:text-neutral-100 truncate">
-                {{ getShareLabel(share) }}
-              </div>
-              <div class="text-xs text-neutral-400 truncate font-mono mt-0.5">
-                {{ share.sourcePath }}
+          <!-- Items -->
+          <div class="flex flex-col gap-0.5 pb-4">
+            <div
+              v-for="share in visibleShares"
+              :key="share.id"
+              data-share-row
+              @dblclick="openEditShare(share)"
+              :class="[
+                'grid cursor-pointer items-center gap-4 px-4 py-2 text-sm rounded-md hover:bg-neutral-100 dark:hover:bg-neutral-800/50 transition-colors group',
+                GRID_COLS,
+              ]"
+            >
+              <!-- Icon -->
+              <div class="flex justify-center items-center">
+                <FileIcon
+                  :item="getIconItem(share)"
+                  class="w-12 h-12 shrink-0"
+                  :disable-thumbnails="true"
+                />
               </div>
-            </div>
 
-            <!-- Shared With -->
-            <div class="min-w-0">
-              <div
-                v-if="share.sharingType === 'anyone'"
-                class="flex items-center gap-1.5 text-neutral-600 dark:text-neutral-300"
-              >
-                <GlobeAltIcon class="w-4 h-4" />
-                <span>{{ t('share.sharedWithAnyone') }}</span>
-              </div>
-              <div v-else class="flex flex-wrap gap-1">
+              <!-- Name & Path -->
+              <div class="min-w-0">
                 <div
-                  v-for="user in getPermittedUsers(share).slice(0, 3)"
-                  :key="user.id"
-                  class="inline-flex items-center px-1.5 py-0.5 rounded text-xs bg-blue-50 text-blue-700 dark:bg-blue-900/30 dark:text-blue-300"
+                  data-share-label
+                  class="font-medium text-neutral-900 dark:text-neutral-100 truncate"
                 >
-                  {{ user.displayName || user.username }}
+                  {{ getShareLabel(share) }}
+                </div>
+                <div class="text-xs text-neutral-400 truncate font-mono mt-0.5">
+                  {{ share.sourcePath }}
                 </div>
-                <span v-if="getPermittedUsers(share).length > 3" class="text-xs text-neutral-400">
-                  +{{ getPermittedUsers(share).length - 3 }}
-                </span>
               </div>
-            </div>
 
-            <!-- Access -->
-            <div class="flex items-center gap-1.5 text-neutral-600 dark:text-neutral-300">
-              <component
-                :is="share.accessMode === 'readonly' ? LockClosedIcon : LockOpenIcon"
-                class="w-4 h-4"
-              />
-              <span>
-                {{
-                  share.accessMode === 'readonly'
-                    ? t('settings.access.readOnly')
-                    : t('settings.access.readWrite')
-                }}
-              </span>
-            </div>
-
-            <!-- Expires -->
-            <div class="text-neutral-600 dark:text-neutral-300">
-              <span :class="{ 'text-red-500': isExpired(share) }">
-                {{ share.expiresAt ? formatDate(share.expiresAt) : t('share.expiresNever') }}
-              </span>
-            </div>
+              <!-- Shared With -->
+              <div class="min-w-0">
+                <div
+                  v-if="share.sharingType === 'anyone'"
+                  class="flex items-center gap-1.5 text-neutral-600 dark:text-neutral-300"
+                >
+                  <GlobeAltIcon class="w-4 h-4" />
+                  <span>{{ t('share.sharedWithAnyone') }}</span>
+                </div>
+                <div v-else class="flex flex-wrap gap-1">
+                  <div
+                    v-for="user in getPermittedUsers(share).slice(0, 3)"
+                    :key="user.id"
+                    class="inline-flex items-center px-1.5 py-0.5 rounded text-xs bg-blue-50 text-blue-700 dark:bg-blue-900/30 dark:text-blue-300"
+                  >
+                    {{ user.displayName || user.username }}
+                  </div>
+                  <span v-if="getPermittedUsers(share).length > 3" class="text-xs text-neutral-400">
+                    +{{ getPermittedUsers(share).length - 3 }}
+                  </span>
+                </div>
+              </div>
 
-            <!-- Actions -->
-            <div class="flex items-center justify-end gap-1.5">
-              <!-- Copy the standard share-page link -->
-              <button
-                @click.stop="handleCopyLink(share)"
-                :disabled="copyingId === share.id"
-                class="p-1.5 rounded hover:bg-neutral-200 dark:hover:bg-neutral-700 text-neutral-500 dark:text-neutral-400"
-                :title="t('share.copyShareLink', 'Copy share link')"
-              >
+              <!-- Access -->
+              <div class="flex items-center gap-1.5 text-neutral-600 dark:text-neutral-300">
                 <component
-                  :is="copiedId === share.id ? CheckIcon : ClipboardDocumentIcon"
+                  :is="share.accessMode === 'readonly' ? LockClosedIcon : LockOpenIcon"
                   class="w-4 h-4"
-                  :class="{ 'text-green-500': copiedId === share.id }"
                 />
-              </button>
-              <!--
+                <span>
+                  {{
+                    share.accessMode === 'readonly'
+                      ? t('settings.access.readOnly')
+                      : t('settings.access.readWrite')
+                  }}
+                </span>
+              </div>
+
+              <!-- Expires -->
+              <div class="text-neutral-600 dark:text-neutral-300">
+                <span :class="{ 'text-red-500': isExpired(share) }">
+                  {{ share.expiresAt ? formatDate(share.expiresAt) : t('share.expiresNever') }}
+                </span>
+              </div>
+
+              <!-- Actions -->
+              <div class="flex items-center justify-end gap-1.5">
+                <!-- Copy the standard share-page link -->
+                <button
+                  @click.stop="openActivityDetails(share)"
+                  class="p-1.5 rounded hover:bg-neutral-200 dark:hover:bg-neutral-700 text-neutral-500 dark:text-neutral-400"
+                  :title="t('share.activityDetails')"
+                >
+                  <InformationCircleIcon class="w-4 h-4" />
+                </button>
+                <button
+                  @click.stop="handleCopyLink(share)"
+                  :disabled="copyingId === share.id"
+                  class="p-1.5 rounded hover:bg-neutral-200 dark:hover:bg-neutral-700 text-neutral-500 dark:text-neutral-400"
+                  :title="t('share.copyShareLink', 'Copy share link')"
+                >
+                  <component
+                    :is="copiedId === share.id ? CheckIcon : ClipboardDocumentIcon"
+                    class="w-4 h-4"
+                    :class="{ 'text-green-500': copiedId === share.id }"
+                  />
+                </button>
+                <!--
                 Direct link control. The mode selector and the copy button are one
                 control (pick a mode, then copy the direct link in that mode), so
                 they live in a single segmented box with a shared border to signal
                 they belong together — instead of reading as two unrelated icons
                 next to the copy/delete buttons (issue #265).
               -->
-              <div
-                class="flex min-w-0 items-center rounded-md border border-neutral-200 dark:border-neutral-700 bg-white dark:bg-neutral-900 focus-within:ring-2 focus-within:ring-blue-500/40"
-              >
-                <select
-                  v-model="directLinkModes[share.id]"
-                  @click.stop
-                  class="min-w-0 rounded-l-md border-0 bg-transparent py-1 pl-1.5 pr-0.5 text-xs text-neutral-600 dark:text-neutral-300 focus:outline-none focus:ring-0 cursor-pointer"
-                  :title="t('share.directLinkMode', 'Direct link mode')"
-                  :aria-label="t('share.directLinkMode', 'Direct link mode')"
+                <div
+                  class="flex min-w-0 items-center rounded-md border border-neutral-200 dark:border-neutral-700 bg-white dark:bg-neutral-900 focus-within:ring-2 focus-within:ring-blue-500/40"
                 >
-                  <option
-                    v-for="mode in directLinkModeOptions"
-                    :key="mode.value"
-                    :value="mode.value"
+                  <select
+                    v-model="directLinkModes[share.id]"
+                    @click.stop
+                    class="min-w-0 rounded-l-md border-0 bg-transparent py-1 pl-1.5 pr-0.5 text-xs text-neutral-600 dark:text-neutral-300 focus:outline-none focus:ring-0 cursor-pointer"
+                    :title="t('share.directLinkMode', 'Direct link mode')"
+                    :aria-label="t('share.directLinkMode', 'Direct link mode')"
+                  >
+                    <option
+                      v-for="mode in directLinkModeOptionsForShare(share)"
+                      :key="mode.value"
+                      :value="mode.value"
+                    >
+                      {{ mode.label }}
+                    </option>
+                  </select>
+                  <span
+                    class="w-px self-stretch bg-neutral-200 dark:bg-neutral-700 shrink-0"
+                    aria-hidden="true"
+                  ></span>
+                  <button
+                    @click.stop="handleCopyDirectFileLink(share)"
+                    :disabled="directCopyingId === share.id"
+                    class="shrink-0 rounded-r-md p-1.5 hover:bg-neutral-200 dark:hover:bg-neutral-700 text-neutral-500 dark:text-neutral-400"
+                    :title="
+                      share.isDirectory
+                        ? t('share.copyDirectFolderLink', 'Copy direct folder ZIP link')
+                        : t('share.copyDirectFileLink', 'Copy direct file link')
+                    "
                   >
-                    {{ mode.label }}
-                  </option>
-                </select>
-                <span
-                  class="w-px self-stretch bg-neutral-200 dark:bg-neutral-700 shrink-0"
-                  aria-hidden="true"
-                ></span>
+                    <component
+                      :is="directCopiedId === share.id ? CheckIcon : LinkIcon"
+                      class="w-4 h-4"
+                      :class="{ 'text-green-500': directCopiedId === share.id }"
+                    />
+                  </button>
+                </div>
                 <button
-                  @click.stop="handleCopyDirectFileLink(share)"
-                  :disabled="directCopyingId === share.id"
-                  class="shrink-0 rounded-r-md p-1.5 hover:bg-neutral-200 dark:hover:bg-neutral-700 text-neutral-500 dark:text-neutral-400"
-                  :title="
-                    share.isDirectory
-                      ? t('share.copyDirectFolderLink', 'Copy direct folder ZIP link')
-                      : t('share.copyDirectFileLink', 'Copy direct file link')
-                  "
+                  @click.stop="openEditShare(share)"
+                  class="p-1.5 rounded hover:bg-neutral-200 dark:hover:bg-neutral-700 text-neutral-500 dark:text-neutral-400"
+                  :title="t('share.editShareLink', 'Edit share link')"
                 >
-                  <component
-                    :is="directCopiedId === share.id ? CheckIcon : LinkIcon"
-                    class="w-4 h-4"
-                    :class="{ 'text-green-500': directCopiedId === share.id }"
-                  />
+                  <PencilSquareIcon class="w-4 h-4" />
+                </button>
+                <button
+                  @click.stop="handleDeleteShare(share)"
+                  class="p-1.5 rounded hover:bg-red-100 dark:hover:bg-red-900/30 text-neutral-500 hover:text-red-600 dark:text-neutral-400 dark:hover:text-red-400"
+                  :title="t('share.removeShare')"
+                >
+                  <TrashIcon class="w-4 h-4" />
                 </button>
               </div>
-              <button
-                @click.stop="handleDeleteShare(share)"
-                class="p-1.5 rounded hover:bg-red-100 dark:hover:bg-red-900/30 text-neutral-500 hover:text-red-600 dark:text-neutral-400 dark:hover:text-red-400"
-                :title="t('share.removeShare')"
-              >
-                <TrashIcon class="w-4 h-4" />
-              </button>
             </div>
           </div>
         </div>
-      </div>
+      </ShareListState>
     </div>
 
+    <ShareDialog
+      v-model="isEditShareDialogOpen"
+      :share="shareBeingEdited"
+      @update:model-value="(value) => !value && closeEditShareDialog()"
+      @share-updated="handleShareUpdated"
+    />
+
     <ModalDialog v-model="isDeleteShareDialogOpen">
       <template #title>
         {{ t('share.deleteShareTitle', 'Remove share?') }}
@@ -536,5 +551,114 @@ onMounted(async () => {
         </button>
       </div>
     </ModalDialog>
+
+    <div
+      v-if="selectedActivityShare"
+      class="fixed inset-0 z-50 flex items-center justify-center bg-black/40 px-4 py-6"
+      @click.self="closeActivityDetails"
+    >
+      <div
+        class="w-full max-w-lg rounded-lg bg-white shadow-xl ring-1 ring-black/10 dark:bg-neutral-900 dark:ring-white/10"
+      >
+        <div
+          class="flex items-start justify-between gap-4 border-b border-neutral-200 px-5 py-4 dark:border-neutral-800"
+        >
+          <div class="min-w-0">
+            <h2 class="text-base font-semibold text-neutral-900 dark:text-neutral-100">
+              {{ t('share.activityDetails') }}
+            </h2>
+            <p class="mt-1 truncate text-sm text-neutral-500 dark:text-neutral-400">
+              {{ getShareLabel(selectedActivityShare) }}
+            </p>
+          </div>
+          <button
+            @click="closeActivityDetails"
+            class="shrink-0 rounded p-1.5 text-neutral-500 hover:bg-neutral-100 hover:text-neutral-800 dark:text-neutral-400 dark:hover:bg-neutral-800 dark:hover:text-neutral-100"
+            :title="t('common.close')"
+          >
+            <XMarkIcon class="h-5 w-5" />
+          </button>
+        </div>
+
+        <div class="space-y-5 px-5 py-5">
+          <div class="rounded-md bg-neutral-50 px-3 py-2 dark:bg-neutral-800/60">
+            <div class="text-xs font-medium uppercase text-neutral-500 dark:text-neutral-400">
+              {{ t('common.path') }}
+            </div>
+            <div class="mt-1 break-all font-mono text-sm text-neutral-800 dark:text-neutral-200">
+              {{ selectedActivityShare.sourcePath }}
+            </div>
+          </div>
+
+          <div class="grid gap-4 sm:grid-cols-2">
+            <section class="rounded-md border border-neutral-200 p-4 dark:border-neutral-800">
+              <div class="mb-3 flex items-center gap-2 text-neutral-800 dark:text-neutral-100">
+                <EyeIcon class="h-5 w-5 text-neutral-500" />
+                <h3 class="font-medium">{{ t('share.accesses') }}</h3>
+              </div>
+              <dl class="space-y-3 text-sm">
+                <div>
+                  <dt class="text-neutral-500 dark:text-neutral-400">
+                    {{ t('share.accessCount') }}
+                  </dt>
+                  <dd class="font-medium tabular-nums text-neutral-900 dark:text-neutral-100">
+                    {{ selectedActivityShare.accessCount || 0 }}
+                  </dd>
+                </div>
+                <div>
+                  <dt class="text-neutral-500 dark:text-neutral-400">
+                    {{ t('share.lastAccessed') }}
+                  </dt>
+                  <dd class="text-neutral-900 dark:text-neutral-100">
+                    {{ formatDetailedDate(selectedActivityShare.lastAccessedAt) }}
+                  </dd>
+                </div>
+                <div>
+                  <dt class="text-neutral-500 dark:text-neutral-400">
+                    {{ t('share.lastAccessIp') }}
+                  </dt>
+                  <dd class="break-all font-mono text-neutral-900 dark:text-neutral-100">
+                    {{ formatIp(selectedActivityShare.lastAccessIp) }}
+                  </dd>
+                </div>
+              </dl>
+            </section>
+
+            <section class="rounded-md border border-neutral-200 p-4 dark:border-neutral-800">
+              <div class="mb-3 flex items-center gap-2 text-neutral-800 dark:text-neutral-100">
+                <ArrowDownTrayIcon class="h-5 w-5 text-neutral-500" />
+                <h3 class="font-medium">{{ t('share.downloads') }}</h3>
+              </div>
+              <dl class="space-y-3 text-sm">
+                <div>
+                  <dt class="text-neutral-500 dark:text-neutral-400">
+                    {{ t('share.downloadCount') }}
+                  </dt>
+                  <dd class="font-medium tabular-nums text-neutral-900 dark:text-neutral-100">
+                    {{ selectedActivityShare.downloadCount || 0 }}
+                  </dd>
+                </div>
+                <div>
+                  <dt class="text-neutral-500 dark:text-neutral-400">
+                    {{ t('share.lastDownloaded') }}
+                  </dt>
+                  <dd class="text-neutral-900 dark:text-neutral-100">
+                    {{ formatDetailedDate(selectedActivityShare.lastDownloadedAt) }}
+                  </dd>
+                </div>
+                <div>
+                  <dt class="text-neutral-500 dark:text-neutral-400">
+                    {{ t('share.lastDownloadIp') }}
+                  </dt>
+                  <dd class="break-all font-mono text-neutral-900 dark:text-neutral-100">
+                    {{ formatIp(selectedActivityShare.lastDownloadIp) }}
+                  </dd>
+                </div>
+              </dl>
+            </section>
+          </div>
+        </div>
+      </div>
+    </div>
   </div>
 </template>
diff --git a/frontend/src/views/SharedWithMeView.vue b/frontend/src/views/SharedWithMeView.vue
index 98e9382c8..b36841b10 100644
--- a/frontend/src/views/SharedWithMeView.vue
+++ b/frontend/src/views/SharedWithMeView.vue
@@ -1,26 +1,21 @@
 <script setup>
-import { ref, onMounted, computed } from 'vue';
+import { ref, onMounted } from 'vue';
+import { useShareList } from '@/composables/shareList';
 import { useRouter } from 'vue-router';
 import { useI18n } from 'vue-i18n';
+import { formatLocalDateTime } from '@/utils';
 import { getSharedWithMe } from '@/api/shares.api';
-import {
-  ShareIcon,
-  LockClosedIcon,
-  LockOpenIcon,
-  UserIcon,
-  MagnifyingGlassIcon,
-  ArrowsUpDownIcon,
-} from '@heroicons/vue/24/outline';
+import { LockClosedIcon, LockOpenIcon, UserIcon } from '@heroicons/vue/24/outline';
 import FileIcon from '@/icons/FileIcon.vue';
+import ShareListToolbar from '@/components/shares/ShareListToolbar.vue';
+import ShareListState from '@/components/shares/ShareListState.vue';
+import { folderRoute } from '@/utils/folderRoute';
 
 const { t } = useI18n();
 const router = useRouter();
 const shares = ref([]);
 const loading = ref(false);
 const error = ref('');
-const searchQuery = ref('');
-const filterMode = ref('active'); // 'active' | 'expired' | 'all'
-const sortMode = ref('recent'); // 'recent' | 'label'
 
 // Grid columns configuration
 const GRID_COLS = 'grid-cols-[30px_minmax(0,3fr)_1.5fr_1fr_1.5fr]';
@@ -70,72 +65,21 @@ const getIconItem = (share) => {
   };
 };
 
-const formatDate = (dateString) => {
-  if (!dateString) return t('common.noExpiration');
-  const date = new Date(dateString);
-  if (Number.isNaN(date.getTime())) return dateString;
-  return `${date.toLocaleDateString()} ${date.toLocaleTimeString()}`;
-};
-
-const isExpired = (share) => {
-  if (!share.expiresAt) return false;
-  return new Date(share.expiresAt) <= new Date();
-};
-
-const getRecentTimestamp = (share) => {
-  if (!share) return 0;
-  const fields = ['lastAccessedAt', 'updatedAt', 'createdAt'];
-  for (const key of fields) {
-    const raw = share[key];
-    if (!raw) continue;
-    const time = new Date(raw).getTime();
-    if (!Number.isNaN(time)) return time;
-  }
-  return 0;
-};
-
-const visibleShares = computed(() => {
-  let list = shares.value.slice();
-
-  // Filter by active / expired
-  if (filterMode.value === 'active') {
-    list = list.filter((s) => !isExpired(s));
-  } else if (filterMode.value === 'expired') {
-    list = list.filter((s) => isExpired(s));
-  }
-
-  // Text search
-  const term = searchQuery.value.trim().toLowerCase();
-  if (term) {
-    list = list.filter((share) => {
-      const label = (getShareLabel(share) || '').toLowerCase();
-      const sourceName = (share.sourceName || '').toLowerCase();
-      return label.includes(term) || sourceName.includes(term);
-    });
-  }
+const formatDate = (dateString) => formatLocalDateTime(dateString, t('common.noExpiration'));
 
-  // Sorting
-  list.sort((a, b) => {
-    if (sortMode.value === 'label') {
-      return getShareLabel(a).localeCompare(getShareLabel(b));
-    }
-
-    const timeA = getRecentTimestamp(a);
-    const timeB = getRecentTimestamp(b);
-    return timeB - timeA;
-  });
-
-  return list;
+// A link you received is found by what it is called or by the file it points
+// at, and nothing here records a download, so the most recent thing that can
+// have happened is an access, a change, or its creation.
+const { filterMode, sortMode, searchQuery, isExpired, visibleShares } = useShareList(shares, {
+  labelOf: getShareLabel,
+  searchAlso: (share) => share.sourceName,
+  recentFields: ['lastAccessedAt', 'updatedAt', 'createdAt'],
 });
 
 const handleOpenShare = (share) => {
   if (isExpired(share)) return;
 
-  // Using named route with params ensures proper URL encoding
-  router.push({
-    name: 'FolderView',
-    params: { path: `share/${share.shareToken}` },
-  });
+  router.push(folderRoute(`share/${share.shareToken}`));
 };
 
 onMounted(async () => {
@@ -145,167 +89,103 @@ onMounted(async () => {
 
 <template>
   <div class="h-full relative flex flex-col max-h-screen">
-    <!-- Toolbar -->
-    <div
-      class="z-10 p-3 pl-12 lg:pl-3 border-b border-neutral-200 dark:border-neutral-800 bg-white dark:bg-default"
-    >
-      <div class="flex items-center gap-3">
-        <!-- Title/Icon -->
-        <div class="flex items-center gap-2 mr-4">
-          <h1
-            class="font-medium text-neutral-800 dark:text-neutral-200 hidden sm:block text-lg ml-2"
-          >
-            {{ t('share.sharedWithMe') }}
-          </h1>
-        </div>
-
-        <!-- Filters -->
-        <div class="flex items-center bg-neutral-100 dark:bg-neutral-800 rounded-md p-0.5">
-          <button
-            v-for="mode in ['active', 'expired', 'all']"
-            :key="mode"
-            @click="filterMode = mode"
-            class="px-3 py-1 text-xs font-medium rounded-sm transition-colors"
-            :class="
-              filterMode === mode
-                ? 'bg-white dark:bg-neutral-700 text-neutral-900 dark:text-neutral-100 shadow-sm'
-                : 'text-neutral-500 dark:text-neutral-400 hover:text-neutral-700 dark:hover:text-neutral-300'
-            "
-          >
-            {{ t(`common.${mode}`) }}
-          </button>
-        </div>
-
-        <div class="h-6 w-px bg-neutral-200 dark:bg-neutral-700 mx-1"></div>
-
-        <!-- Sort -->
-        <div class="flex items-center gap-2">
-          <button
-            @click="sortMode = sortMode === 'recent' ? 'label' : 'recent'"
-            class="p-1.5 rounded-md hover:bg-neutral-100 dark:hover:bg-neutral-800 text-neutral-500 dark:text-neutral-400"
-            :title="t('actions.sortBy')"
-          >
-            <ArrowsUpDownIcon class="w-5 h-5" />
-          </button>
-        </div>
-
-        <div class="flex-1"></div>
-
-        <!-- Search -->
-        <div class="relative">
-          <MagnifyingGlassIcon
-            class="absolute left-2.5 top-1/2 -translate-y-1/2 w-4 h-4 text-neutral-400"
-          />
-          <input
-            v-model="searchQuery"
-            type="text"
-            :placeholder="t('share.filterByNameOrPath')"
-            class="pl-9 pr-3 py-1.5 text-sm bg-neutral-100 dark:bg-neutral-800 rounded-md border-none focus:ring-2 focus:ring-blue-500 w-48 transition-all focus:w-64"
-          />
-        </div>
-      </div>
-    </div>
+    <ShareListToolbar
+      v-model:filter-mode="filterMode"
+      v-model:sort-mode="sortMode"
+      v-model:search-query="searchQuery"
+      :title="t('share.sharedWithMe')"
+    ></ShareListToolbar>
 
     <!-- Content -->
     <div class="flex-1 overflow-y-auto px-2">
-      <!-- Loading -->
-      <div v-if="loading" class="flex h-full items-center justify-center">
-        <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-blue-500"></div>
-      </div>
-
-      <!-- Error -->
-      <div v-else-if="error" class="flex h-full flex-col items-center justify-center text-red-500">
-        <p>{{ error }}</p>
-        <button @click="loadShares" class="mt-2 text-blue-500 hover:underline">
-          {{ t('common.tryAgain') }}
-        </button>
-      </div>
-
-      <!-- Empty -->
-      <div
-        v-else-if="visibleShares.length === 0"
-        class="flex h-full flex-col items-center justify-center text-neutral-400"
+      <ShareListState
+        :loading="loading"
+        :error="error"
+        :empty="visibleShares.length === 0"
+        :empty-text="t('share.noSharedItemsToShow')"
+        @retry="loadShares"
       >
-        <ShareIcon class="w-16 h-16 mb-4 opacity-20" />
-        <p>{{ t('share.noSharedItemsToShow') }}</p>
-      </div>
-
-      <!-- List -->
-      <div v-else class="min-w-[800px]">
-        <!-- Header Row -->
-        <div
-          :class="[
-            'grid items-center gap-4 px-4 py-2 text-xs font-medium text-neutral-500 dark:text-neutral-400 uppercase tracking-wider border-b border-neutral-100 dark:border-neutral-800 sticky top-0 bg-white dark:bg-default z-10',
-            GRID_COLS,
-          ]"
-        >
-          <div></div>
-          <div>{{ t('common.name') }}</div>
-          <div>{{ t('share.sharedBy') }}</div>
-          <div>{{ t('settings.access.title') }}</div>
-          <div>{{ t('share.expiresAt') }}</div>
-        </div>
-
-        <!-- Items -->
-        <div class="flex flex-col gap-0.5 pb-4">
+        <!-- List -->
+        <div class="min-w-[800px]">
+          <!-- Header Row -->
           <div
-            v-for="share in visibleShares"
-            :key="share.id"
-            @click="handleOpenShare(share)"
             :class="[
-              'grid items-center gap-4 px-4 py-2 text-sm rounded-md transition-colors group',
+              'grid items-center gap-4 px-4 py-2 text-xs font-medium text-neutral-500 dark:text-neutral-400 uppercase tracking-wider border-b border-neutral-100 dark:border-neutral-800 sticky top-0 bg-white dark:bg-default z-10',
               GRID_COLS,
-              isExpired(share)
-                ? 'opacity-60 cursor-not-allowed bg-neutral-50 dark:bg-neutral-900/30'
-                : 'cursor-pointer hover:bg-neutral-100 dark:hover:bg-neutral-800/50',
             ]"
           >
-            <!-- Icon -->
-            <div class="flex justify-center items-center">
-              <FileIcon
-                :item="getIconItem(share)"
-                class="h-12 w-12 shrink-0"
-                :disable-thumbnails="true"
-              />
-            </div>
+            <div></div>
+            <div>{{ t('common.name') }}</div>
+            <div>{{ t('share.sharedBy') }}</div>
+            <div>{{ t('settings.access.title') }}</div>
+            <div>{{ t('share.expiresAt') }}</div>
+          </div>
 
-            <!-- Name -->
-            <div class="min-w-0">
-              <div class="font-medium text-neutral-900 dark:text-neutral-100 truncate">
-                {{ getShareLabel(share) }}
+          <!-- Items -->
+          <div class="flex flex-col gap-0.5 pb-4">
+            <div
+              v-for="share in visibleShares"
+              :key="share.id"
+              data-share-row
+              @click="handleOpenShare(share)"
+              :class="[
+                'grid items-center gap-4 px-4 py-2 text-sm rounded-md transition-colors group',
+                GRID_COLS,
+                isExpired(share)
+                  ? 'opacity-60 cursor-not-allowed bg-neutral-50 dark:bg-neutral-900/30'
+                  : 'cursor-pointer hover:bg-neutral-100 dark:hover:bg-neutral-800/50',
+              ]"
+            >
+              <!-- Icon -->
+              <div class="flex justify-center items-center">
+                <FileIcon
+                  :item="getIconItem(share)"
+                  class="h-12 w-12 shrink-0"
+                  :disable-thumbnails="true"
+                />
               </div>
-            </div>
 
-            <!-- Shared By -->
-            <div class="flex items-center gap-1.5 text-neutral-600 dark:text-neutral-300">
-              <UserIcon class="w-4 h-4" />
-              <span>{{ t('share.sharedBy') }}</span>
-            </div>
+              <!-- Name -->
+              <div class="min-w-0">
+                <div
+                  data-share-label
+                  class="font-medium text-neutral-900 dark:text-neutral-100 truncate"
+                >
+                  {{ getShareLabel(share) }}
+                </div>
+              </div>
 
-            <!-- Access -->
-            <div class="flex items-center gap-1.5 text-neutral-600 dark:text-neutral-300">
-              <component
-                :is="share.accessMode === 'readonly' ? LockClosedIcon : LockOpenIcon"
-                class="w-4 h-4"
-              />
-              <span>
-                {{
-                  share.accessMode === 'readonly'
-                    ? t('settings.access.readOnly')
-                    : t('settings.access.readWrite')
-                }}
-              </span>
-            </div>
+              <!-- Shared By -->
+              <div class="flex items-center gap-1.5 text-neutral-600 dark:text-neutral-300">
+                <UserIcon class="w-4 h-4" />
+                <span>{{ t('share.sharedBy') }}</span>
+              </div>
 
-            <!-- Expires -->
-            <div class="text-neutral-600 dark:text-neutral-300">
-              <span :class="{ 'text-red-500': isExpired(share) }">
-                {{ share.expiresAt ? formatDate(share.expiresAt) : t('share.expiresNever') }}
-              </span>
+              <!-- Access -->
+              <div class="flex items-center gap-1.5 text-neutral-600 dark:text-neutral-300">
+                <component
+                  :is="share.accessMode === 'readonly' ? LockClosedIcon : LockOpenIcon"
+                  class="w-4 h-4"
+                />
+                <span>
+                  {{
+                    share.accessMode === 'readonly'
+                      ? t('settings.access.readOnly')
+                      : t('settings.access.readWrite')
+                  }}
+                </span>
+              </div>
+
+              <!-- Expires -->
+              <div class="text-neutral-600 dark:text-neutral-300">
+                <span :class="{ 'text-red-500': isExpired(share) }">
+                  {{ share.expiresAt ? formatDate(share.expiresAt) : t('share.expiresNever') }}
+                </span>
+              </div>
             </div>
           </div>
         </div>
-      </div>
+      </ShareListState>
     </div>
   </div>
 </template>
diff --git a/frontend/src/views/settings/AdminUsers.vue b/frontend/src/views/settings/AdminUsers.vue
index 751a05b15..d262524bc 100644
--- a/frontend/src/views/settings/AdminUsers.vue
+++ b/frontend/src/views/settings/AdminUsers.vue
@@ -7,6 +7,7 @@ import {
   createUser,
   adminSetUserPassword,
   deleteUser,
+  unlockUser,
 } from '@/api';
 import { useAuthStore } from '@/stores/auth';
 import { useI18n } from 'vue-i18n';
@@ -133,6 +134,20 @@ const handleResetPassword = async (u) => {
   }
 };
 
+const handleUnlock = async (u) => {
+  try {
+    await unlockUser(u.id);
+    // Cleared only once the server has agreed: showing a refused release as
+    // done would tell an administrator a person can sign in when they cannot.
+    users.value = users.value.map((it) => (it.id === u.id ? { ...it, lockedUntil: null } : it));
+    if (selectedUser.value?.id === u.id) {
+      selectedUser.value = { ...selectedUser.value, lockedUntil: null };
+    }
+  } catch (e) {
+    alert(e?.message || t('errors.unlockUser'));
+  }
+};
+
 const handleDeleteUser = async (u) => {
   if (u.id === auth.currentUser?.id) {
     alert(t('settings.users.cannotDeleteSelf'));
@@ -216,6 +231,7 @@ onMounted(() => {
       @make-admin="handleMakeAdmin"
       @revoke-admin="handleRevokeAdmin"
       @reset-password="handleResetPassword"
+      @unlock="handleUnlock"
       @delete="handleDeleteUser"
     />
 
@@ -318,9 +334,9 @@ onMounted(() => {
               <label for="is-admin" class="font-medium text-zinc-700 dark:text-zinc-300">{{
                 t('settings.users.grantAdmin')
               }}</label>
-              <p class="text-zinc-500 dark:text-zinc-400">{{
-                t('settings.users.grantAdminHint')
-              }}</p>
+              <p class="text-zinc-500 dark:text-zinc-400">
+                {{ t('settings.users.grantAdminHint') }}
+              </p>
             </div>
           </div>
 
diff --git a/frontend/src/views/settings/SettingsAccessControl.vue b/frontend/src/views/settings/SettingsAccessControl.vue
index a27fb87fb..6c8794533 100644
--- a/frontend/src/views/settings/SettingsAccessControl.vue
+++ b/frontend/src/views/settings/SettingsAccessControl.vue
@@ -54,7 +54,7 @@ const runChecks = async () => {
   const paths = [...new Set(local.rules.map((rule) => String(rule.path || '').trim()))].filter(
     Boolean
   );
-  const round = (checkRound += 1);
+  const round = ++checkRound;
   if (paths.length === 0) {
     checks.value = {};
     return;
@@ -116,15 +116,28 @@ const reset = () => {
   local.rules = original.value.rules.map((r) => ({ ...r }));
   local.applyToAdmins = original.value.applyToAdmins;
 };
+// Why the last save was refused. Without it, a refusal left nothing but the
+// unsaved-changes bar, and an administrator could believe a folder was hidden.
+const saveError = ref('');
+
 const save = async () => {
-  // basic sanitization client-side
-  const cleaned = local.rules
-    .map((r) => ({
-      ...r,
-      path: String(r.path || '').replace(/^\/+|\/+$/g, ''),
-    }))
-    .filter((r) => r.path);
-  await appSettings.save({ access: { rules: cleaned, applyToAdmins: local.applyToAdmins } });
+  // Every row on screen is sent, with the slashes around its path taken off.
+  // A row whose path was empty used to be dropped here, and the server dropped
+  // the rules it could not store: either way the row left the page the moment
+  // it was saved, and an administrator was left believing a folder was hidden
+  // that never was. The server refuses such a rule now and says which one, so
+  // nothing decides on its own that a rule is not worth sending.
+  const cleaned = local.rules.map((r) => ({
+    ...r,
+    path: String(r.path || '').replace(/^\/+|\/+$/g, ''),
+  }));
+  saveError.value = '';
+  try {
+    await appSettings.save({ access: { rules: cleaned, applyToAdmins: local.applyToAdmins } });
+  } catch (error) {
+    saveError.value = error?.message || t('settings.trash.saveFailed');
+    return;
+  }
   local.rules = appSettings.state.access.rules.map((r) => ({ ...r }));
   local.applyToAdmins = appSettings.state.access.applyToAdmins === true;
 };
@@ -153,6 +166,10 @@ const save = async () => {
       </div>
     </div>
 
+    <p v-if="saveError" class="text-sm text-red-600" role="alert" data-test="access-save-error">
+      {{ saveError }}
+    </p>
+
     <!-- Header -->
     <div class="flex items-center justify-between">
       <div>
@@ -182,8 +199,8 @@ const save = async () => {
       class="flex cursor-pointer items-start gap-3 rounded-lg border border-zinc-200 bg-white p-4 dark:border-zinc-800 dark:bg-zinc-900"
     >
       <input
-        v-model="local.applyToAdmins"
         type="checkbox"
+        v-model="local.applyToAdmins"
         data-test="access-apply-to-admins"
         class="mt-0.5 h-4 w-4 rounded-sm border-zinc-300 text-zinc-600 focus:ring-zinc-500 dark:border-zinc-700 dark:bg-zinc-800"
       />
@@ -279,8 +296,8 @@ const save = async () => {
                   </div>
                 </div>
               </td>
-              <td class="px-6 py-4">
-                <label class="inline-flex cursor-pointer items-center">
+              <td class="px-6 py-4 align-top">
+                <label class="inline-flex cursor-pointer items-center pt-2">
                   <input
                     type="checkbox"
                     v-model="rule.recursive"
@@ -288,9 +305,9 @@ const save = async () => {
                   />
                 </label>
               </td>
-              <td class="px-6 py-4">
+              <td class="px-6 py-4 align-top">
                 <label
-                  class="inline-flex items-center"
+                  class="inline-flex items-center pt-2"
                   :class="local.applyToAdmins ? 'cursor-not-allowed' : 'cursor-pointer'"
                   :title="local.applyToAdmins ? t('settings.access.applyToAdminsHint') : ''"
                 >
@@ -304,7 +321,7 @@ const save = async () => {
                   />
                 </label>
               </td>
-              <td class="px-6 py-4">
+              <td class="px-6 py-4 align-top">
                 <select
                   v-model="rule.permissions"
                   class="block w-full rounded-md border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-zinc-900 dark:text-zinc-100 shadow-xs focus:border-zinc-500 focus:ring-zinc-500 sm:text-sm p-2 border"
@@ -320,7 +337,7 @@ const save = async () => {
                   </option>
                 </select>
               </td>
-              <td class="px-6 py-4">
+              <td class="px-6 py-4 align-top">
                 <button
                   class="inline-flex items-center rounded-md border border-transparent bg-red-50 px-3 py-1.5 text-sm font-medium text-red-700 hover:bg-red-100 focus:outline-hidden focus:ring-2 focus:ring-red-500 focus:ring-offset-2 dark:bg-red-900/20 dark:text-red-300 dark:hover:bg-red-900/40"
                   @click="removeRule(idx)"
@@ -337,7 +354,8 @@ const save = async () => {
     <StoragePickerDialog
       v-model="pickerOpen"
       choose-folder
-      :title="t('settings.access.browse')"
+      :title="t('settings.access.pickFolderTitle')"
+      :initial-path="pickerRule?.path || ''"
       @select="chosen"
     />
   </div>
diff --git a/frontend/src/views/settings/SettingsFilesThumbnails.vue b/frontend/src/views/settings/SettingsFilesThumbnails.vue
index 7a794abad..b0efbe27b 100644
--- a/frontend/src/views/settings/SettingsFilesThumbnails.vue
+++ b/frontend/src/views/settings/SettingsFilesThumbnails.vue
@@ -23,8 +23,8 @@ const dirty = computed(
     local.quality !== original.value.quality ||
     local.size !== original.value.size ||
     // A stored section without a concurrency means the default the field shows,
-    // not a change: read as one, the page offered to save before the settings
-    // had even loaded, and saving then wrote its defaults over what was stored.
+    // not a change: read as one, the page offered to save before settings had
+    // even loaded, and saving then wrote its defaults over what was stored.
     local.concurrency !== (original.value.concurrency ?? 10)
 );
 
@@ -41,9 +41,10 @@ watch(
   { immediate: true }
 );
 
-// The bounds the server holds these to. A value outside them was sent as typed
-// and brought within them there, and an emptied field was dropped: what was
-// saved was not what the page showed.
+// The bounds the server holds these to (THUMBNAIL_BOUNDS in
+// backend/src/services/settingsService.js). A value outside them was sent as
+// typed and brought within them there, and an emptied field was dropped: what
+// was saved was not what the page showed.
 const BOUNDS = {
   quality: [1, 100],
   size: [64, 1024],
@@ -149,15 +150,15 @@ const save = async () => {
           <div class="flex items-center gap-3">
             <input
               type="range"
-              min="1"
-              max="100"
+              :min="BOUNDS.quality[0]"
+              :max="BOUNDS.quality[1]"
               v-model.number="local.quality"
               class="w-64 h-2 rounded-lg appearance-none bg-zinc-200 dark:bg-zinc-700 accent-zinc-900 dark:accent-zinc-100"
             />
             <input
               type="number"
-              min="1"
-              max="100"
+              :min="BOUNDS.quality[0]"
+              :max="BOUNDS.quality[1]"
               v-model.number="local.quality"
               class="w-20 rounded-md border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-zinc-900 dark:text-zinc-100 shadow-xs focus:border-zinc-500 focus:ring-zinc-500 sm:text-sm p-2 border text-center"
             />
@@ -179,8 +180,8 @@ const save = async () => {
           <div class="flex items-center gap-3">
             <input
               type="number"
-              min="64"
-              max="1024"
+              :min="BOUNDS.size[0]"
+              :max="BOUNDS.size[1]"
               step="1"
               v-model.number="local.size"
               class="w-24 rounded-md border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-zinc-900 dark:text-zinc-100 shadow-xs focus:border-zinc-500 focus:ring-zinc-500 sm:text-sm p-2 border text-center"
@@ -204,20 +205,24 @@ const save = async () => {
           <div class="flex items-center gap-3">
             <input
               type="range"
-              min="1"
-              max="50"
+              :min="BOUNDS.concurrency[0]"
+              :max="BOUNDS.concurrency[1]"
               v-model.number="local.concurrency"
               class="w-64 h-2 rounded-lg appearance-none bg-zinc-200 dark:bg-zinc-700 accent-zinc-900 dark:accent-zinc-100"
             />
             <input
               type="number"
-              min="1"
-              max="50"
+              :min="BOUNDS.concurrency[0]"
+              :max="BOUNDS.concurrency[1]"
               v-model.number="local.concurrency"
               class="w-20 rounded-md border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-zinc-900 dark:text-zinc-100 shadow-xs focus:border-zinc-500 focus:ring-zinc-500 sm:text-sm p-2 border text-center"
             />
           </div>
         </div>
+
+        <p v-if="invalid" data-test="thumbnail-settings-invalid" class="text-sm text-red-600">
+          {{ t('settings.thumbs.invalid') }}
+        </p>
       </div>
     </div>
   </div>
diff --git a/frontend/src/views/settings/SettingsUserPreferences.vue b/frontend/src/views/settings/SettingsUserPreferences.vue
index 12ce62dad..857192cc1 100644
--- a/frontend/src/views/settings/SettingsUserPreferences.vue
+++ b/frontend/src/views/settings/SettingsUserPreferences.vue
@@ -3,15 +3,8 @@ import { computed, onMounted, reactive, watch } from 'vue';
 import { useAppSettings } from '@/stores/appSettings';
 import { useFeaturesStore } from '@/stores/features';
 import { useI18n } from 'vue-i18n';
-import ToggleSwitch from '@/components/ToggleSwitch.vue';
 import { languageLabel, supportedLocaleOptions } from '@/i18n';
-
-// Each language named in itself — Deutsch, Français — since whoever is looking
-// for theirs may not read the one the page is in.
-const languages = supportedLocaleOptions.map(({ code }) => ({
-  code,
-  label: languageLabel(code),
-}));
+import ToggleSwitch from '@/components/ToggleSwitch.vue';
 
 const appSettings = useAppSettings();
 const features = useFeaturesStore();
@@ -20,15 +13,17 @@ const { t } = useI18n();
 const local = reactive({
   showHiddenFiles: false,
   showThumbnails: true,
-  showVersionMarks: true,
-  documentsOpenInNewTab: false,
-  locale: null,
   showSidebarFavorites: true,
   showSidebarShares: true,
   showSidebarTools: true,
   defaultShareExpirationValue: null,
   defaultShareExpirationUnit: 'weeks',
   skipHome: null, // null = use env, true/false = override
+  defaultView: null, // null = the built-in default, otherwise a view mode
+  markdownOpensInEditor: false,
+  documentsOpenInNewTab: false,
+  showVersionMarks: true,
+  locale: null,
 });
 
 const original = computed(() => appSettings.userSettings);
@@ -42,17 +37,27 @@ const dirty = computed(() => {
   return (
     local.showHiddenFiles !== orig.showHiddenFiles ||
     local.showThumbnails !== orig.showThumbnails ||
-    local.showVersionMarks !== (orig.showVersionMarks ?? true) ||
-    local.documentsOpenInNewTab !== (orig.documentsOpenInNewTab ?? false) ||
-    local.locale !== (orig.locale ?? null) ||
     local.showSidebarFavorites !== (orig.showSidebarFavorites ?? true) ||
     local.showSidebarShares !== (orig.showSidebarShares ?? true) ||
     local.showSidebarTools !== (orig.showSidebarTools ?? true) ||
     JSON.stringify(localExpiration) !== JSON.stringify(origExpiration) ||
-    local.skipHome !== orig.skipHome
+    local.skipHome !== orig.skipHome ||
+    local.defaultView !== orig.defaultView ||
+    local.markdownOpensInEditor !== (orig.markdownOpensInEditor ?? false) ||
+    local.documentsOpenInNewTab !== (orig.documentsOpenInNewTab ?? false) ||
+    local.showVersionMarks !== (orig.showVersionMarks ?? true) ||
+    local.locale !== (orig.locale ?? null)
   );
 });
 
+// Empty means no default. Anything else has to be a whole number of at least
+// one, as the server takes it: minus three weeks used to be sent as it was.
+const expirationInvalid = computed(() => {
+  const value = local.defaultShareExpirationValue;
+  if (value === null || value === '') return false;
+  return !(Number.isInteger(value) && value >= 1);
+});
+
 const hiddenFilePatternsLabel = computed(() => {
   const patterns = Array.isArray(features.hiddenFilePatterns) ? features.hiddenFilePatterns : [];
   return patterns.length ? patterns.join(', ') : t('common.disabled');
@@ -62,6 +67,13 @@ onMounted(() => {
   features.ensureLoaded();
 });
 
+// Named in their own language, so somebody looking for theirs finds it even
+// when the page is in one they do not read.
+const languages = supportedLocaleOptions.map(({ code }) => ({
+  code,
+  label: languageLabel(code),
+}));
+
 const sidebarPreferenceRows = [
   {
     key: 'showSidebarFavorites',
@@ -85,11 +97,6 @@ watch(
   (userSettings) => {
     local.showHiddenFiles = userSettings.showHiddenFiles ?? false;
     local.showThumbnails = userSettings.showThumbnails ?? true;
-    local.showVersionMarks = userSettings.showVersionMarks ?? true;
-    local.documentsOpenInNewTab = userSettings.documentsOpenInNewTab ?? false;
-    local.locale = userSettings.locale ?? null;
-    local.locale = userSettings.locale ?? null;
-    local.documentsOpenInNewTab = userSettings.documentsOpenInNewTab ?? false;
     local.showSidebarFavorites = userSettings.showSidebarFavorites ?? true;
     local.showSidebarShares = userSettings.showSidebarShares ?? true;
     local.showSidebarTools = userSettings.showSidebarTools ?? true;
@@ -104,6 +111,11 @@ watch(
     }
 
     local.skipHome = userSettings.skipHome ?? null;
+    local.defaultView = userSettings.defaultView ?? null;
+    local.markdownOpensInEditor = userSettings.markdownOpensInEditor ?? false;
+    local.documentsOpenInNewTab = userSettings.documentsOpenInNewTab ?? false;
+    local.showVersionMarks = userSettings.showVersionMarks ?? true;
+    local.locale = userSettings.locale ?? null;
   },
   { immediate: true }
 );
@@ -112,7 +124,6 @@ const reset = () => {
   const userSettings = appSettings.userSettings;
   local.showHiddenFiles = userSettings.showHiddenFiles ?? false;
   local.showThumbnails = userSettings.showThumbnails ?? true;
-  local.showVersionMarks = userSettings.showVersionMarks ?? true;
   local.showSidebarFavorites = userSettings.showSidebarFavorites ?? true;
   local.showSidebarShares = userSettings.showSidebarShares ?? true;
   local.showSidebarTools = userSettings.showSidebarTools ?? true;
@@ -127,9 +138,15 @@ const reset = () => {
   }
 
   local.skipHome = userSettings.skipHome ?? null;
+  local.defaultView = userSettings.defaultView ?? null;
+  local.markdownOpensInEditor = userSettings.markdownOpensInEditor ?? false;
+  local.documentsOpenInNewTab = userSettings.documentsOpenInNewTab ?? false;
+  local.showVersionMarks = userSettings.showVersionMarks ?? true;
+  local.locale = userSettings.locale ?? null;
 };
 
 const save = async () => {
+  if (expirationInvalid.value) return;
   const defaultShareExpiration = local.defaultShareExpirationValue
     ? { value: local.defaultShareExpirationValue, unit: local.defaultShareExpirationUnit }
     : null;
@@ -138,14 +155,16 @@ const save = async () => {
     user: {
       showHiddenFiles: local.showHiddenFiles,
       showThumbnails: local.showThumbnails,
-      showVersionMarks: local.showVersionMarks,
-      documentsOpenInNewTab: local.documentsOpenInNewTab,
-      locale: local.locale,
       showSidebarFavorites: local.showSidebarFavorites,
       showSidebarShares: local.showSidebarShares,
       showSidebarTools: local.showSidebarTools,
       defaultShareExpiration,
       skipHome: local.skipHome,
+      defaultView: local.defaultView,
+      markdownOpensInEditor: local.markdownOpensInEditor,
+      documentsOpenInNewTab: local.documentsOpenInNewTab,
+      showVersionMarks: local.showVersionMarks,
+      locale: local.locale,
     },
   });
 };
@@ -160,7 +179,10 @@ const save = async () => {
       <div class="text-sm">{{ t('common.unsavedChanges') }}</div>
       <div class="flex gap-2">
         <button
-          class="rounded-md bg-yellow-500 px-3 py-1 text-black hover:bg-yellow-400"
+          type="button"
+          data-test="preferences-save"
+          class="rounded-md bg-yellow-500 px-3 py-1 text-black hover:bg-yellow-400 disabled:opacity-50"
+          :disabled="expirationInvalid"
           @click="save"
         >
           {{ t('common.save') }}
@@ -189,6 +211,31 @@ const save = async () => {
       class="bg-white dark:bg-zinc-900 rounded-lg border border-zinc-200 dark:border-zinc-800 p-6"
     >
       <div class="space-y-6">
+        <div
+          class="flex items-center justify-between py-3 border-b border-zinc-100 dark:border-zinc-800 last:border-0"
+        >
+          <div>
+            <div class="font-medium text-zinc-900 dark:text-zinc-100">
+              {{ t('i18n.language') }}
+            </div>
+            <div class="text-sm text-zinc-500 dark:text-zinc-400 mt-1">
+              {{ t('settings.userPreferences.languageHelp') }}
+            </div>
+          </div>
+          <div class="flex items-center gap-2">
+            <select
+              v-model="local.locale"
+              data-test="preferences-language"
+              class="rounded-md border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-zinc-900 dark:text-zinc-100 shadow-xs focus:border-zinc-500 focus:ring-zinc-500 sm:text-sm p-2 border"
+            >
+              <option :value="null">{{ t('i18n.followBrowser') }}</option>
+              <option v-for="language in languages" :key="language.code" :value="language.code">
+                {{ language.label }}
+              </option>
+            </select>
+          </div>
+        </div>
+
         <div
           class="flex items-center justify-between py-3 border-b border-zinc-100 dark:border-zinc-800 last:border-0"
         >
@@ -226,13 +273,13 @@ const save = async () => {
         >
           <div>
             <div class="font-medium text-zinc-900 dark:text-zinc-100">
-              {{ t('settings.userPreferences.showVersionMarks') }}
+              {{ t('settings.userPreferences.markdownOpensInEditor') }}
             </div>
             <div class="text-sm text-zinc-500 dark:text-zinc-400 mt-1">
-              {{ t('settings.userPreferences.showVersionMarksHelp') }}
+              {{ t('settings.userPreferences.markdownOpensInEditorHelp') }}
             </div>
           </div>
-          <ToggleSwitch v-model="local.showVersionMarks" data-test="show-version-marks" />
+          <ToggleSwitch v-model="local.markdownOpensInEditor" />
         </div>
 
         <div
@@ -254,22 +301,13 @@ const save = async () => {
         >
           <div>
             <div class="font-medium text-zinc-900 dark:text-zinc-100">
-              {{ t('i18n.language') }}
+              {{ t('settings.userPreferences.showVersionMarks') }}
             </div>
             <div class="text-sm text-zinc-500 dark:text-zinc-400 mt-1">
-              {{ t('settings.userPreferences.languageHelp') }}
+              {{ t('settings.userPreferences.showVersionMarksHelp') }}
             </div>
           </div>
-          <select
-            v-model="local.locale"
-            data-test="preferences-language"
-            class="rounded-md border border-zinc-300 bg-white p-2 text-sm text-zinc-900 dark:border-zinc-700 dark:bg-zinc-800 dark:text-zinc-100"
-          >
-            <option :value="null">{{ t('i18n.followBrowser') }}</option>
-            <option v-for="language in languages" :key="language.code" :value="language.code">
-              {{ language.label }}
-            </option>
-          </select>
+          <ToggleSwitch v-model="local.showVersionMarks" data-test="show-version-marks" />
         </div>
 
         <div
@@ -298,6 +336,13 @@ const save = async () => {
             <div class="text-sm text-zinc-500 dark:text-zinc-400 mt-1">
               {{ t('settings.userPreferences.defaultShareExpirationHelp') }}
             </div>
+            <p
+              v-if="expirationInvalid"
+              data-test="expiration-invalid"
+              class="mt-1 text-sm text-red-600"
+            >
+              {{ t('settings.userPreferences.defaultShareExpirationInvalid') }}
+            </p>
           </div>
           <div class="flex items-center gap-2">
             <input
@@ -309,6 +354,7 @@ const save = async () => {
             />
             <select
               v-model="local.defaultShareExpirationUnit"
+              data-test="preferences-expiry-unit"
               class="rounded-md border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-zinc-900 dark:text-zinc-100 shadow-xs focus:border-zinc-500 focus:ring-zinc-500 sm:text-sm p-2 border"
             >
               <option value="days">{{ t('settings.userPreferences.days') }}</option>
@@ -334,6 +380,29 @@ const save = async () => {
           </div>
         </div>
 
+        <div class="flex items-center justify-between py-3">
+          <div>
+            <div class="font-medium text-zinc-900 dark:text-zinc-100">
+              {{ t('settings.userPreferences.defaultView') }}
+            </div>
+            <div class="text-sm text-zinc-500 dark:text-zinc-400 mt-1">
+              {{ t('settings.userPreferences.defaultViewHelp') }}
+            </div>
+          </div>
+          <div class="flex items-center gap-2">
+            <select
+              v-model="local.defaultView"
+              data-test="preferences-default-view"
+              class="rounded-md border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-zinc-900 dark:text-zinc-100 shadow-xs focus:border-zinc-500 focus:ring-zinc-500 sm:text-sm p-2 border"
+            >
+              <option :value="null">{{ t('settings.userPreferences.viewGrid') }}</option>
+              <option value="list">{{ t('settings.userPreferences.viewList') }}</option>
+              <option value="tab">{{ t('settings.userPreferences.viewColumns') }}</option>
+              <option value="photos">{{ t('settings.userPreferences.viewPhotos') }}</option>
+            </select>
+          </div>
+        </div>
+
         <div class="flex items-center justify-between py-3">
           <div>
             <div class="font-medium text-zinc-900 dark:text-zinc-100">
@@ -346,6 +415,7 @@ const save = async () => {
           <div class="flex items-center gap-2">
             <select
               v-model="local.skipHome"
+              data-test="preferences-start"
               class="rounded-md border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-zinc-900 dark:text-zinc-100 shadow-xs focus:border-zinc-500 focus:ring-zinc-500 sm:text-sm p-2 border"
             >
               <option :value="null">{{ t('settings.userPreferences.useEnvSetting') }}</option>
diff --git a/frontend/src/views/settings/SettingsView.vue b/frontend/src/views/settings/SettingsView.vue
index 7eec52657..fa53756c3 100644
--- a/frontend/src/views/settings/SettingsView.vue
+++ b/frontend/src/views/settings/SettingsView.vue
@@ -10,18 +10,18 @@ import {
   ChevronLeftIcon,
   BuildingOfficeIcon,
   PhotoIcon,
-  KeyIcon,
-  TrashIcon,
-  ClockIcon,
   ArrowUpTrayIcon,
-  ShieldCheckIcon,
-  FingerPrintIcon,
-  ListBulletIcon,
-  CommandLineIcon,
   CircleStackIcon,
   MagnifyingGlassIcon,
+  KeyIcon,
   UsersIcon,
   UserCircleIcon,
+  ShieldCheckIcon,
+  TrashIcon,
+  FingerPrintIcon,
+  ClipboardDocumentListIcon,
+  ClockIcon,
+  CommandLineIcon,
 } from '@heroicons/vue/24/outline';
 
 const router = useRouter();
@@ -34,7 +34,7 @@ onMounted(async () => {
   if (!appSettings.loaded && !appSettings.loading) {
     try {
       await appSettings.load();
-    } catch (e) {
+    } catch (_) {
       // Settings load may fail for non-admin users trying to access system settings
       // This is handled gracefully in the store, but ensure branding is at least loaded
       if (!appSettings.publicSettings.branding.appName) {
@@ -52,10 +52,10 @@ const isLocalUser = computed(() => auth.currentUser?.provider === 'local');
 // User-facing settings
 const userCategories = [
   {
-    key: 'account-passkeys',
-    i18nKey: 'accountPasskeys',
-    name: 'Passkeys',
-    icon: FingerPrintIcon,
+    key: 'account-password',
+    i18nKey: 'accountPassword',
+    name: 'Change Password',
+    icon: Cog8ToothIcon,
     requiresLocal: true,
   },
   {
@@ -66,10 +66,10 @@ const userCategories = [
     requiresLocal: true,
   },
   {
-    key: 'account-password',
-    i18nKey: 'accountPassword',
-    name: 'Change Password',
-    icon: Cog8ToothIcon,
+    key: 'account-passkeys',
+    i18nKey: 'accountPasskeys',
+    name: 'Passkeys',
+    icon: FingerPrintIcon,
     requiresLocal: true,
   },
   {
@@ -104,18 +104,6 @@ const adminCategories = [
     name: 'Files & Thumbnails',
     icon: PhotoIcon,
   },
-  {
-    key: 'trash',
-    i18nKey: 'trash',
-    name: 'Trash',
-    icon: TrashIcon,
-  },
-  {
-    key: 'file-versions',
-    i18nKey: 'fileVersions',
-    name: 'File versions',
-    icon: ClockIcon,
-  },
   {
     key: 'uploads',
     i18nKey: 'uploads',
@@ -134,11 +122,23 @@ const adminCategories = [
     name: 'Search index',
     icon: MagnifyingGlassIcon,
   },
+  {
+    key: 'trash',
+    i18nKey: 'trash',
+    name: 'Trash',
+    icon: TrashIcon,
+  },
+  {
+    key: 'file-versions',
+    i18nKey: 'fileVersions',
+    name: 'File versions',
+    icon: ClockIcon,
+  },
   {
     key: 'activity',
     i18nKey: 'activity',
-    name: 'Activity',
-    icon: ListBulletIcon,
+    name: 'Activity log',
+    icon: ClipboardDocumentListIcon,
   },
   {
     key: 'access-control',
@@ -177,8 +177,11 @@ const closeSettings = () => {
     <!-- Body: responsive navigation + content -->
     <div class="flex flex-1 flex-col overflow-hidden md:flex-row">
       <!-- Categories navigation -->
+      <!-- The list of categories scrolls on its own. Its parent clips, so a
+           list taller than the window had its last entries simply out of
+           reach: the page scrolls the panel beside it, not this. -->
       <aside
-        class="border-b border-neutral-200 bg-neutral-50/80 px-4 py-3 text-sm dark:border-neutral-700 dark:bg-neutral-900/40 md:w-64 md:flex-shrink-0 md:border-b-0 md:border-r md:px-5 md:py-4"
+        class="border-b border-neutral-200 bg-neutral-50/80 px-4 py-3 text-sm dark:border-neutral-700 dark:bg-neutral-900/40 md:w-64 md:min-h-0 md:flex-shrink-0 md:overflow-y-auto md:border-b-0 md:border-r md:px-5 md:py-4"
       >
         <div class="mb-3 space-y-4">
           <section>
diff --git a/frontend/src/views/settings/components/UserDetail.vue b/frontend/src/views/settings/components/UserDetail.vue
index 35c86cb26..d500a0ada 100644
--- a/frontend/src/views/settings/components/UserDetail.vue
+++ b/frontend/src/views/settings/components/UserDetail.vue
@@ -11,6 +11,8 @@ import {
   PlusIcon,
   PencilIcon,
   FolderIcon,
+  LockClosedIcon,
+  LockOpenIcon,
 } from '@heroicons/vue/24/outline';
 import { useAuthStore } from '@/stores/auth';
 import { useFeaturesStore } from '@/stores/features';
@@ -32,8 +34,9 @@ const emit = defineEmits([
   'delete',
   'make-admin',
   'revoke-admin',
+  'unlock',
 ]);
-const { t } = useI18n();
+const { t, locale } = useI18n();
 const authStore = useAuthStore();
 const featuresStore = useFeaturesStore();
 
@@ -145,6 +148,15 @@ const handleSaveProfile = () => {
   });
 };
 
+// A lock that has run out refuses nothing, so it is not offered for release.
+const lockedUntil = computed(() => {
+  const until = Date.parse(props.user?.lockedUntil || '');
+  return Number.isFinite(until) && until > Date.now() ? props.user.lockedUntil : null;
+});
+
+const lockTime = (iso) =>
+  new Date(iso).toLocaleTimeString(locale?.value, { hour: '2-digit', minute: '2-digit' });
+
 const getInitials = (name) => {
   return (name || 'U').substring(0, 2).toUpperCase();
 };
@@ -237,9 +249,9 @@ const getInitials = (name) => {
           <form @submit.prevent="handleSaveProfile" class="space-y-4">
             <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
               <div>
-                <label class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1"
-                  >{{ t('settings.userDetails.displayName') }}</label
-                >
+                <label class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1">{{
+                  t('settings.userDetails.displayName')
+                }}</label>
                 <input
                   v-model="formData.displayName"
                   type="text"
@@ -247,9 +259,9 @@ const getInitials = (name) => {
                 />
               </div>
               <div>
-                <label class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1"
-                  >{{ t('settings.userDetails.username') }}</label
-                >
+                <label class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1">{{
+                  t('settings.userDetails.username')
+                }}</label>
                 <input
                   v-model="formData.username"
                   type="text"
@@ -258,9 +270,9 @@ const getInitials = (name) => {
               </div>
             </div>
             <div>
-              <label class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1"
-                >{{ t('settings.userDetails.email') }}</label
-              >
+              <label class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1">{{
+                t('settings.userDetails.email')
+              }}</label>
               <input
                 v-model="formData.email"
                 type="email"
@@ -290,7 +302,9 @@ const getInitials = (name) => {
             <div>
               <div class="flex items-center gap-2">
                 <ShieldCheckIcon class="w-5 h-5 text-zinc-500" />
-                <span class="font-medium text-zinc-900 dark:text-zinc-100">{{ t('settings.userDetails.adminRole') }}</span>
+                <span class="font-medium text-zinc-900 dark:text-zinc-100">{{
+                  t('settings.userDetails.adminRole')
+                }}</span>
               </div>
               <p class="text-sm text-zinc-500 dark:text-zinc-400 mt-1 ml-7">
                 {{ t('settings.userDetails.adminRoleHint') }}
@@ -320,7 +334,9 @@ const getInitials = (name) => {
           v-if="!isCurrentUser"
           class="bg-red-50 dark:bg-red-900/10 rounded-lg border border-red-200 dark:border-red-900/30 p-4"
         >
-          <h3 class="text-base font-semibold text-red-800 dark:text-red-300 mb-4">{{ t('settings.userDetails.dangerZone') }}</h3>
+          <h3 class="text-base font-semibold text-red-800 dark:text-red-300 mb-4">
+            {{ t('settings.userDetails.dangerZone') }}
+          </h3>
           <div class="flex items-center justify-between">
             <div>
               <p class="text-sm text-red-700 dark:text-red-400">
@@ -340,16 +356,56 @@ const getInitials = (name) => {
 
       <!-- Security Tab -->
       <div v-if="activeTab === 'security'" class="space-y-6 max-w-3xl">
+        <!-- Sign-in lock -->
+        <div
+          data-test="sign-in-lock"
+          class="bg-white dark:bg-zinc-900 rounded-lg border border-zinc-200 dark:border-zinc-800 p-4"
+        >
+          <h3 class="text-base font-semibold text-zinc-900 dark:text-zinc-100 mb-4">
+            {{ t('settings.userDetails.signInLock') }}
+          </h3>
+          <div class="flex items-center justify-between gap-4">
+            <div class="flex items-start gap-2">
+              <LockClosedIcon
+                v-if="lockedUntil"
+                class="w-5 h-5 shrink-0 text-amber-600 dark:text-amber-400"
+                aria-hidden="true"
+              />
+              <LockOpenIcon v-else class="w-5 h-5 shrink-0 text-zinc-500" aria-hidden="true" />
+              <p class="text-sm text-zinc-500 dark:text-zinc-400">
+                {{
+                  lockedUntil
+                    ? t('settings.userDetails.lockedHint', { time: lockTime(lockedUntil) })
+                    : t('settings.userDetails.notLockedHint')
+                }}
+              </p>
+            </div>
+            <button
+              v-if="lockedUntil"
+              data-test="unlock"
+              type="button"
+              @click="$emit('unlock', user)"
+              class="shrink-0 text-sm font-medium text-zinc-600 hover:text-zinc-900 dark:text-zinc-400 dark:hover:text-zinc-200"
+            >
+              {{ t('settings.userDetails.unlock') }}
+            </button>
+          </div>
+        </div>
+
         <!-- Password -->
         <div
           class="bg-white dark:bg-zinc-900 rounded-lg border border-zinc-200 dark:border-zinc-800 p-4"
         >
-          <h3 class="text-base font-semibold text-zinc-900 dark:text-zinc-100 mb-4">{{ t('settings.userDetails.password') }}</h3>
+          <h3 class="text-base font-semibold text-zinc-900 dark:text-zinc-100 mb-4">
+            {{ t('settings.userDetails.password') }}
+          </h3>
           <div class="flex items-center justify-between">
             <div>
               <div class="flex items-center gap-2">
                 <KeyIcon class="w-5 h-5 text-zinc-500" />
-                <span class="font-medium text-zinc-900 dark:text-zinc-100">{{ t('settings.userDetails.localPassword') }}</span>
+                <span class="font-medium text-zinc-900 dark:text-zinc-100">{{
+                  t('settings.userDetails.localPassword')
+                }}</span>
               </div>
               <p class="text-sm text-zinc-500 dark:text-zinc-400 mt-1 ml-7">
                 {{
@@ -363,7 +419,11 @@ const getInitials = (name) => {
               @click="$emit('reset-password', user)"
               class="text-sm text-zinc-600 hover:text-zinc-900 dark:text-zinc-400 dark:hover:text-zinc-200 font-medium"
             >
-              {{ hasLocalAuth ? t('settings.userDetails.resetLocalPassword') : t('settings.userDetails.setLocalPassword') }}
+              {{
+                hasLocalAuth
+                  ? t('settings.userDetails.resetLocalPassword')
+                  : t('settings.userDetails.setLocalPassword')
+              }}
             </button>
           </div>
         </div>
@@ -390,7 +450,9 @@ const getInitials = (name) => {
                   <p class="text-sm font-medium text-zinc-900 dark:text-zinc-100">
                     {{ profile.provider || t('settings.userDetails.oidcProvider') }}
                   </p>
-                  <p class="text-xs text-zinc-500 dark:text-zinc-400">{{ t('settings.userDetails.oidcLinkedProfile') }}</p>
+                  <p class="text-xs text-zinc-500 dark:text-zinc-400">
+                    {{ t('settings.userDetails.oidcLinkedProfile') }}
+                  </p>
                 </div>
               </div>
               <!-- Placeholder for unlink action if needed in future -->
diff --git a/frontend/src/views/settings/components/UserList.vue b/frontend/src/views/settings/components/UserList.vue
index 2c7a689d8..0ebd6cd66 100644
--- a/frontend/src/views/settings/components/UserList.vue
+++ b/frontend/src/views/settings/components/UserList.vue
@@ -1,9 +1,8 @@
 <script setup>
-import { computed } from 'vue';
 import { useI18n } from 'vue-i18n';
-import { UserCircleIcon, KeyIcon, CloudIcon } from '@heroicons/vue/24/outline';
+import { UserCircleIcon, KeyIcon, CloudIcon, LockClosedIcon } from '@heroicons/vue/24/outline';
 
-const props = defineProps({
+defineProps({
   users: {
     type: Array,
     default: () => [],
@@ -11,8 +10,18 @@ const props = defineProps({
   loading: Boolean,
 });
 
-const emit = defineEmits(['select', 'create']);
-const { t } = useI18n();
+defineEmits(['select', 'create']);
+const { t, locale } = useI18n();
+
+// The list is read once and can sit open past a lock's end, so a lock whose time
+// has passed is not shown: it refuses nothing any more.
+const activeLockUntil = (user) => {
+  const until = Date.parse(user?.lockedUntil || '');
+  return Number.isFinite(until) && until > Date.now() ? user.lockedUntil : null;
+};
+
+const lockTime = (iso) =>
+  new Date(iso).toLocaleTimeString(locale?.value, { hour: '2-digit', minute: '2-digit' });
 
 const getInitials = (name) => {
   return (name || 'U').substring(0, 2).toUpperCase();
@@ -99,6 +108,17 @@ const getAuthLabel = (auth) => {
                 >
                   {{ t('common.admin') }}
                 </span>
+                <span
+                  v-if="activeLockUntil(user)"
+                  data-test="locked-badge"
+                  :title="
+                    t('settings.users.lockedUntil', { time: lockTime(activeLockUntil(user)) })
+                  "
+                  class="inline-flex items-center gap-1 rounded-full bg-amber-100 px-2 py-0.5 text-xs font-medium text-amber-800 dark:bg-amber-900/30 dark:text-amber-300"
+                >
+                  <LockClosedIcon class="w-3 h-3" aria-hidden="true" />
+                  {{ t('settings.users.lockedBadge') }}
+                </span>
               </div>
               <p class="text-sm text-zinc-500 dark:text-zinc-400 truncate">
                 {{ user.email }}
diff --git a/frontend/src/views/settings/components/VolumeAssignModal.vue b/frontend/src/views/settings/components/VolumeAssignModal.vue
index e96b1dcd2..258746b9a 100644
--- a/frontend/src/views/settings/components/VolumeAssignModal.vue
+++ b/frontend/src/views/settings/components/VolumeAssignModal.vue
@@ -102,6 +102,9 @@ const selectCurrentDirectory = () => {
 };
 
 const handleSubmit = async () => {
+  // Enter in the label field submits the form whatever the button says, so a
+  // second submission while the first is on its way would add the volume twice.
+  if (saving.value) return;
   error.value = '';
 
   if (!label.value.trim()) {