feat(settings,index): per-user index sub-path, strip dead PP settings, scope duplicates

Lets a user pick a sub-folder under their library as a working index root,
stored server-side (new sidecar user_prefs table). The Library tree, reindex,
and both duplicate views (stacks + cross-folder scan) now re-root to it via a
single userLibraryBase() helper. Also fixes the cross-folder scan/archive
endpoints, which previously walked/touched the whole originals root instead
of being scoped per-user (archive now rejects out-of-scope paths, 403).

Removes PhotoPrism settings (Search/Maps/Server-UI/Features/Import) that only
steered PhotoPrism's own bundled SPA and were never read by mulimage's UI.

Also fixes the Library tree occasionally getting stuck on "Loading folders…"
by dropping gcTime:0 and gating the spinner on isLoading instead of isPending.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -65,6 +65,19 @@ PP_GID=1000
 # OIDC_ROLE=user
 
 
+# ── USER LIBRARY ISOLATION ───────────────────────────────────────────────────
+# Maps PhotoPrism usernames to originals-relative subdirectories so each
+# user only sees their own photos. Format: comma-separated user:path pairs.
+# The sidecar reconciler applies this to auth_users.base_path on boot and
+# every 60s. Leave empty for single-user deployments.
+#
+# USER_BASEPATHS="alice:alice, bob:bob"
+
+# Sidecar DB password — provisioned by mariadb/init/01-sidecar.sql on first
+# boot. Rotate before any non-local deployment.
+# SIDECAR_DB_PASSWORD=replace-at-m4-bringup
+
+
 # ── LOGGING ──────────────────────────────────────────────────────────────────
 
 PP_LOG_LEVEL=info

.hermes/plans/2026-06-06_120000-photos_users-label-isolation.md

@@ -0,0 +1,247 @@
+# Plan: Populate `photos_users` to fix label isolation in PhotoPrism
+
+**Date:** 2026-06-06  
+**Author:** Hermes Agent  
+**Status:** Draft
+
+---
+
+## 1. Goal
+
+Fix the label isolation leak where a user with `base_path` set (e.g. `muli`) sees photos from other users' directories (e.g. `dtoro`) in PhotoPrism's labels view.
+
+## 2. Current Context
+
+### The problem
+- PhotoPrism's `base_path` feature correctly scopes the main search (`/api/v1/photos`).
+- Label views (`/api/v1/labels`) do **not** respect `base_path` — labels show photo counts and thumbnails from the entire library.
+- User reports: "all photos on the main labels page are a mix of both" muli and dtoro.
+
+### What we know
+- **53 files changed** in the sidecar (Go + GORM, gorm.io/gorm v1.31.1).
+- Sidecar has a working PhotoPrism DB connection via `PpDSN` (user: `photoprism`, schema: `photoprism.*`).
+- The `photos_users` table exists in PhotoPrism's MariaDB schema but is **empty** (0 rows).
+- Schema of `photos_users`:
+
+```
+photos_users:
+  uid        varbinary(42)   NOT NULL  PRI  (composite PK or single?)
+  user_uid   varbinary(42)   NOT NULL  PRI
+  team_uid   varbinary(42)   YES       MUL
+  perm       int(10) unsigned YES
+```
+
+- Known user UIDs: `dtoro=utfetfdk0so2z9zl`, `muli=utg7jjbd8iwaghn6`
+- Known base paths: `dtoro→dtoro`, `muli→muli`
+- The `photo_path` column in `photos` stores paths like `muli/files/Photo Archive...` or `dtoro/Memories/...`
+- Currently: ~88K photos, ~52K files indexed.
+
+### The sidecar's current reconciler (`users.go`)
+- Runs every 60s.
+- Only calls `UPDATE auth_users SET base_path = ? WHERE user_name = ?`.
+- Does **not** touch `photos_users`.
+
+### Unknowns
+1. **Does PhotoPrism use `photos_users` for general label filtering?** The table appears designed for explicit sharing (e.g. share a specific photo with another user), not for base_path ACL. PhotoPrism may ignore `photos_users` in label queries.
+2. **Performance impact**: 88K photos × 2 users = up to 176K rows. Could slow label queries.
+3. **Side effects**: If `photos_users` controls sharing, adding auto-entries might break explicit share workflow.
+4. **`perm` values**: Unclear what `perm` value grants "view" access. Likely a bitmap (bit 0 = view).
+
+## 3. Proposed Approach
+
+### Phase 1: Investigate (prove the approach works before building)
+
+**Step 1.1: Insert test rows into `photos_users` manually**
+
+On the production DB, insert a few `photos_users` entries for muli mapping to some of muli's own photos, plus one entry mapping to a dtoro photo. Use a guessed `perm` value (e.g. `1` = view).
+
+Then check:
+- Does muli see fewer photos now? (If `photos_users` works as an exclusive ACL, yes.)
+- Does the dtoro photo with a `photos_users` entry for muli show up for muli?
+- Does the label view change?
+
+**Step 1.2: Test with `perm` variations**
+
+If `perm=1` does nothing, try `perm=2`, `perm=7`, or `perm=15` (common Unix-ish bitmap patterns).
+
+**Step 1.3: Examine PhotoPrism source**
+
+Check PhotoPrism's search/label code to confirm whether `photos_users` is joined in label queries. This tells us definitively whether the approach is viable.
+
+### Phase 2: Build (if Phase 1 confirms the approach works)
+
+**Step 2.1: Add `photos_users` GORM model**
+
+New struct in `db.go` or a new file `perms.go`:
+
+```go
+type PhotoUser struct {
+    PhotoUID string `gorm:"primaryKey;size:42;column:uid"`
+    UserUID  string `gorm:"primaryKey;size:42;column:user_uid"`
+    TeamUID  string `gorm:"size:42;column:team_uid"`
+    Perm     int    `gorm:"column:perm"`
+}
+
+func (PhotoUser) TableName() string { return "photos_users" }
+```
+
+Note: GORM `AutoMigrate` is called on `mule_sidecar` schema, not `photoprism.*`. The `photos_users` table already exists in the `photoprism` schema — we only query/insert, never migrate.
+
+**Step 2.2: Add `reconcilePhotoUsers` function**
+
+New function in a new file `perms.go` alongside `users.go`. Signature:
+
+```go
+func reconcilePhotoUsers(ppDSN, originalsRoot string, mapping map[string]string) error
+```
+
+Logic:
+1. For each `username:path` pair in `mapping`, look up the user's `user_uid` in `auth_users`.
+2. Query `photos` for all `photo_uid` where `photo_path LIKE 'path/%'`.
+3. Batch-insert entries into `photos_users` with a default `perm` value (to be determined in Phase 1).
+4. Use `INSERT IGNORE` or `ON DUPLICATE KEY UPDATE` for idempotency.
+5. Handle deletions: if a photo's path is changed (via rename), the old `photos_users` entry should be cleaned up.
+
+**Step 2.3: Wire into reconciler loop**
+
+Extend the existing `startUserBasepathReconciler` to call `reconcilePhotoUsers` after `reconcileUserBasepaths`.
+
+```go
+func apply() {
+    reconcileUserBasepaths(...)
+    reconcilePhotoUsers(...)
+}
+```
+
+**Step 2.4: Handle re-index edge cases**
+
+- When new photos are indexed, they won't have `photos_users` entries until the next 60s tick.
+- Could add a webhook or a one-shot trigger after PhotoPrism's index completes.
+- Alternative: accept the 60s lag as a design trade-off (current base_path reconciler already has this lag).
+
+### Phase 3: Validate (if Phase 1 confirms)
+
+1. Build the binary: `cd sidecar && CGO_ENABLED=0 go build -o mule-sidecar .`
+2. Rebuild the Docker image and restart the sidecar.
+3. Check `photos_users` has expected rows.
+4. Log in as `muli` via Authentik SSO, browse labels — verify dtoro photos are gone.
+5. Log in as `dtoro` — verify still sees own photos.
+6. Verify no regression: search, album, folder views still work for both users.
+
+## 4. Files Likely to Change
+
+| File | Change |
+|------|--------|
+| `sidecar/perms.go` | **New file** — `PhotoUser` model, `reconcilePhotoUsers` function |
+| `sidecar/db.go` | Add `photos_users`-related constants/helpers (optional) |
+| `sidecar/users.go` | Extend `reconcileUserBasepaths` or add a phase to the existing reconciler |
+| `sidecar/main.go` | Wire the new reconciler phase (minor — call from existing ticker) |
+| `sidecar/Dockerfile` | Unchanged (Go build picks up new `.go` files automatically) |
+
+## 5. Tests & Validation
+
+1. **Build check**: `go build ./...` from `sidecar/`
+2. **Manual DB test** (Phase 1): Insert test `photos_users` rows via `docker exec pp-mariadb mysql ...`
+3. **Integration test**: After deploy, check `photos_users` row count matches expected photo count per user.
+4. **Label isolation check**: Browse labels as each user — confirm no cross-user leaks.
+
+## 6. Source Code Analysis (Completed)
+
+### How base_path scoping works in PhotoPrism
+
+Found the critical function `ScopePhotosForSession` in `internal/entity/search/photos_scope.go`:
+
+```go
+func ScopePhotosForSession(stmt *gorm.DB, sess *entity.Session) *gorm.DB {
+    // Admin/library role → no scoping needed
+    if sess == nil || acl.Rules.AllowAny(acl.ResourcePhotos, sess.GetUserRole(), acl.Permissions{acl.AccessAll, acl.AccessLibrary}) {
+        return stmt
+    }
+    user := sess.GetUser()
+    if basePath := user.GetBasePath(); basePath == "" {
+        return stmt.Where(sharedAlbums + "photos.created_by = ? OR ...", ...)
+    } else {
+        return stmt.Where(sharedAlbums + "... OR photos.photo_path = ? OR photos.photo_path LIKE ?",
+            ..., basePath, basePath + "/%")
+    }
+}
+```
+
+Key: base_path filtering is done by adding `WHERE photos.photo_path LIKE 'muli/%'` to the SQL query. It is **NOT** done via `photos_users`.
+
+### How endpoints use base_path
+
+| Endpoint | Function | Applies base_path? |
+|----------|----------|-------------------|
+| `GET /api/v1/photos` | `SearchPhotos` → `UserPhotos` → `searchPhotos` → **`ScopePhotosForSession`** | ✅ Yes |
+| `GET /api/v1/labels` | `SearchLabels` → `search.Labels(frm)` — no session passed | ❌ **No** |
+| Review tab | Uses `GET /api/v1/photos?quality=3` → goes through `ScopePhotosForSession` | ✅ Should scope |
+| Archive tab | Uses `GET /api/v1/photos?archived=true` → goes through `ScopePhotosForSession` | ✅ Should scope |
+| Albums | TBD — depends on whether they use `ScopePhotosForSession` | ⚠️ Unknown |
+
+### The `photos_users` table
+
+Found in `internal/entity/photo_user.go`:
+
+```go
+type PhotoUser struct {
+    UID     string  // photo_uid
+    UserUID string  // user_uid
+    TeamUID string  // team_uid
+    Perm    uint    // permission bitmap
+}
+```
+
+This table is **not referenced** in `ScopePhotosForSession`, `searchPhotos`, or any label/album search function. It is only used for **explicit sharing** (via `FirstOrCreatePhotoUser` called when sharing a specific photo with another user).
+
+**Conclusion: Populating `photos_users` will NOT fix the label, review, or archive tab isolation.** PhotoPrism does not consult this table for any of these queries.
+
+### Why review/archive might show cross-user photos
+
+Since review and archive use `GET /api/v1/photos` which goes through `ScopePhotosForSession`, they **should** be scoped. The issue might be:
+1. **Pre-computed counts** in the sidebar tabs show total numbers across all users
+2. **Label thumbnails** and category summaries are computed from the `labels` table which is global
+3. The actual photo list in review/archive should be correctly scoped — the user may be seeing dtoro photos only in the summary/counts
+
+### DB experiment results
+
+Confirmed `photos_users` is empty (0 rows). Inserted 100 muli-photo entries + 1 dtoro-photo entry for muli with `perm=1`. Label API response unchanged — `photo_count` values remained the same (Dog: 733, Cat: 57), confirming labels ignore `photos_users`.
+
+## 7. Updated Recommendation
+
+**Abandon the `photos_users` approach.** It won't fix the problem because PhotoPrism never consults this table for labels, review, or archive queries.
+
+### Real fix options
+
+1. **Sidecar label filter** (recommended) — The sidecar already validates sessions via `resolveSession()` which returns the user's `BasePath`. Extend the sidecar to expose a **proxied `/api/v1/labels`** endpoint that:
+   - Accepts the caller's `X-Auth-Token` (already validated by `requireSession`)
+   - Forwards the request to PhotoPrism's `/api/v1/labels`
+   - **Filters the response** to remove labels whose `Thumb` belongs to a photo outside the user's `base_path`
+   - Recalculates `PhotoCount` for the user's scope (count photos under `base_path/%` for that label)
+   - Also filter `Count` values in the sidebar summary response
+   
+   **Why this works:** The sidecar already has DB access to PhotoPrism's schema (`PpDSN`) and validates sessions. It can query `photos` to count label intersections per base_path.
+
+2. **Same approach for review/archive sidebar counts** — Intercept the relevant metadata/summary endpoints to scope counts by base_path.
+
+3. **Accept the limitation** — Labels show cross-user thumbnails/counts but the actual photo list is scoped.
+
+### Implementation sketch for option 1
+
+```
+sidecar/
+├── proxy.go              # New file
+│   ├── handleLabels(c)   → GET /api/sidecar/labels → proxies to PP, filters by base_path
+│   ├── handleReviewCount(c) → GET /api/sidecar/review → returns scoped count
+│   └── handleArchiveCount(c) → GET /api/sidecar/archive → returns scoped count
+```
+
+The SvelteKit frontend would call `/api/sidecar/labels` instead of `/api/v1/labels`.
+
+### Clean up: remove test rows from photos_users
+
+Since the approach won't work, remove the test rows inserted during Phase 1:
+
+```sql
+DELETE FROM photoprism.photos_users WHERE user_uid = 'utg7jjbd8iwaghn6';
+```

.hermes/plans/2026-06-06_124500-label-review-archive-isolation.md

@@ -0,0 +1,301 @@
+# Plan: Fix user isolation in PhotoPrism — labels, review, and archive views
+
+**Date:** 2026-06-06  
+**Author:** Hermes Agent  
+**Status:** Draft
+
+---
+
+## 1. Goal
+
+Fix the three views where a user with `base_path` set (e.g. `muli`) sees photos from other users (e.g. `dtoro`):
+
+1. **Labels** — labels list + label drill-down show all library photos
+2. **Review** — photos needing review tab shows cross-user photos
+3. **Archive** — archived photos tab shows cross-user photos
+
+## 2. Current Context & Source Analysis
+
+### 2.1 How base_path scoping works
+
+PhotoPrism's `ScopePhotosForSession` (in `internal/entity/search/photos_scope.go`) is the only function that enforces user isolation. It adds `WHERE photos.photo_path = '<basePath>' OR photos.photo_path LIKE '<basePath>/%'` to the SQL query.
+
+This is called by `searchPhotos()` — used by the **`GET /api/v1/photos`** endpoint (search, timeline, folders).
+
+### 2.2 How endpoints use base_path
+
+| View | Endpoint | Function chain | Applies base_path? |
+|------|----------|----------------|-------------------|
+| Main timeline | `GET /api/v1/photos` | `SearchPhotos` → `searchPhotos` → `ScopePhotosForSession` | ✅ Yes |
+| Folders | `GET /api/v1/photos` with path filter | Same chain | ✅ Yes |
+| **Labels** | `GET /api/v1/labels` | `SearchLabels` → `search.Labels(frm)` — **no session** | ❌ **No** — queries `labels` table directly |
+| Label drill-down | `GET /api/v1/photos?label=X` | Uses `searchPhotos` → `ScopePhotosForSession` | ✅ Should scope (if label= param doesn't bypass) |
+| **Review tab** | `GET /api/v1/photos?q=review:true` | `searchPhotos` → `ScopePhotosForSession` | ✅ Should scope, BUT... |
+| **Archive tab** | `GET /api/v1/photos?q=archived:true` | Same | ✅ Should scope, BUT... |
+
+### 2.3 The review/archive problem: ACL overrides
+
+In `searchPhotosForm()` (internal/api/photos_search.go):
+
+```go
+if acl.Rules.Deny(acl.ResourcePhotos, s.GetUserRole(), acl.ActionManage) {
+    frm.Quality = 3
+}
+```
+
+For role=user, `Deny(ActionManage)` → true → sets `frm.Quality = 3` (minimum quality).
+
+Then in `searchPhotos()` (internal/entity/search/photos.go):
+
+```go
+if acl.Rules.Deny(acl.ResourcePhotos, aclRole, acl.ActionDelete) {
+    frm.Archived = false
+    frm.Review = false
+}
+```
+
+For role=user, `Deny(ActionDelete)` → true → **overrides `review:true` and `archived:true` to false**.
+
+So the review and archive filters are **completely ignored** for the `user` role. The frontend sends `review:true` but the server discards it. The result: the review/archive tabs show ALL photos scoped by base_path (no quality/review/archive filter), which means basically the same as the main timeline.
+
+### 2.4 Label problem: no session scoping at all
+
+`search.Labels()` queries the `labels` table directly with a `WHERE photo_count > 0` clause. There is no session parameter, no `ScopePhotosForSession`, and no base_path or user filtering whatsoever. Labels are **library-wide** in PhotoPrism.
+
+The label drill-down (click into a label) uses `GET /api/v1/photos?label=X` which DOES go through `ScopePhotosForSession`, so the photo list itself should be scoped — but the label thumbnails, counts, and covers are global.
+
+### 2.5 ACL GrantDefaults — missing RoleUser entry
+
+```go
+var GrantDefaults = Roles{
+    RoleAdmin:    GrantFullAccess,   // FullAccess = AccessLibrary + everything
+    RoleGuest:    GrantReactShared,  // Only shared content
+    RoleVisitor:  GrantViewShared,   // Only shared content
+    RolePortal:   GrantFullAccess,
+    RoleClient:   GrantFullAccess,
+    // RoleUser and RoleViewer are NOT listed → fallback to RoleDefault (also missing) → denied
+}
+```
+
+Because `RoleUser` is absent from `GrantDefaults`, the `Allow()` function falls back to `RoleDefault` which is also absent → returns `false` for all permissions. This means:
+- `ScopePhotosForSession` correctly enters the `base_path` branch (good — user is isolated)
+- BUT `ActionDelete` is denied → review/archive filters are forced off (bad — can't browse review/archive)
+
+### 2.6 The `photos_users` table — ruled out
+
+`internal/entity/photo_user.go` defines `PhotoUser` but it is **not referenced** in `ScopePhotosForSession`, `searchPhotos`, or any label/album search function. Populating it won't fix any of these issues.
+
+## 3. Proposed Approach
+
+### Phase 1: Sidecar proxy for labels (direct fix)
+
+Extend the sidecar to expose a **scoped labels endpoint**:
+
+```
+GET /api/sidecar/labels → proxies to GET /api/v1/labels → filters by base_path
+```
+
+**How it works:**
+
+1. Sidecar receives the caller's `X-Auth-Token`
+2. `requireSession` middleware resolves the token → returns user's `BasePath`
+3. Sidecar makes the same `/api/v1/labels` request to PhotoPrism (using the caller's token)
+4. **Filter step**: for each label in the response, query the DB to count photos with that label AND `photo_path LIKE '<base_path>/%'`
+5. Return filtered labels with corrected `PhotoCount` and `Thumb`
+
+**Implementation:**
+
+New file `sidecar/handlers_labels.go`:
+
+```go
+// handleLabels proxies to PP's /api/v1/labels, then post-filters
+// counts and thumbnails by the caller's base_path.
+func handleLabels(pp *ppClient, ppDSN string) gin.HandlerFunc {
+    return func(c *gin.Context) {
+        token := ctxToken(c)
+        user := ctxUser(c) // resolved from session, includes BasePath
+        
+        // 1. Get raw labels from PhotoPrism
+        resp, _ := pp.call(c, "GET", "/api/v1/labels?"+c.Request.URL.RawQuery, token, nil)
+        
+        // 2. Decode labels
+        var labels []PpLabel
+        json.Unmarshal(resp.Body, &labels)
+        
+        // 3. For each label, recalculate count for this user's base_path
+        for i, l := range labels {
+            // Count photos with this label AND where photo_path matches base_path
+            var count int
+            db.Raw(`SELECT COUNT(*) FROM photos_labels pl 
+                     JOIN photos p ON pl.photo_uid = p.photo_uid 
+                     WHERE pl.label_uid = ? AND p.photo_path LIKE ?`,
+                l.UID, user.BasePath+"/%").Scan(&count)
+            labels[i].PhotoCount = count
+            
+            // If count is 0, the thumb from the global label doesn't apply
+            // Could also update thumb to a user-scoped one
+        }
+        
+        c.JSON(http.StatusOK, labels)
+    }
+}
+```
+
+**Frontend change:** Update the label query in `web/src/routes/tags/[category]/[[value]]/+page.svelte` to call `/api/sidecar/labels` instead of `/api/v1/labels`.
+
+### Phase 2: Fix review/archive — skip the ACL override
+
+Two options:
+
+**Option A (Recommended): Sidecar proxy for photos search**
+
+Extend the sidecar with:
+```
+GET /api/sidecar/photos → proxies to GET /api/v1/photos → adds path filter
+```
+
+The sidecar intercepts the photos request and adds the `path:<basePath>` query parameter to PhotoPrism's API call. This forces PhotoPrism to add `WHERE photo_path LIKE '<base_path>/%'`.
+
+For review/archive, the sidecar also adds `review:true` or `archived:true` BEFORE the ACL override happens (since the sidecar doesn't hit the ACL code).
+
+**Option B: Custom frontend query**
+
+The frontend explicitly adds `path:muli` to the query string for review/archive tabs:
+```
+GET /api/v1/photos?q=review:true path:muli&count=50
+```
+
+The `path` filter is a standard PhotoPrism search operator that adds `WHERE photos.photo_path = '<path>'`. But this only matches the exact path, not `path/%` (subdirectories). The `path:` operator does `photo_path = ?` (exact match) per the code at line 668.
+
+**Option A is better** because:
+- Works for all users without frontend changes
+- Can add the proper `LIKE` prefix match
+- Centralized logic in the sidecar
+
+### Phase 3: Sidecar proxy for sidebar counts
+
+The session response (or `GET /api/v1/config`) includes library-wide counts:
+```json
+"count": {
+    "review": 248,
+    "archived": 94,
+    "all": 88203,
+    "photos": 88000
+}
+```
+
+These show the TOTAL across all users. The sidecar can proxy this and recalculate counts per base_path.
+
+## 4. Step-by-step Plan
+
+### Step 1: Sidecar — labels proxy
+
+Files: `sidecar/handlers_labels.go` (new), `sidecar/main.go` (route wiring)
+
+1. New types: `PpLabel` (mirrors PhotoPrism's label response shape)
+2. Handler function `handleLabels()` that:
+   - Validates token via `requireSession`
+   - Gets `BasePath` from session
+   - Calls PhotoPrism's `/api/v1/labels`
+   - For each label, queries photos_labels + photos to count user-scoped photos
+   - Returns filtered labels
+3. Wire route: `auth.GET("/labels", handleLabels(...))` in `main.go`
+4. Frontend: change label fetch URL from `/api/v1/labels` to `/api/sidecar/labels`
+
+### Step 2: Sidecar — photos proxy (review/archive fix)
+
+Files: `sidecar/handlers_photos.go` (new), `sidecar/main.go` (route wiring)
+
+1. Handler function `handlePhotos()` that:
+   - Validates token
+   - Gets `BasePath` from session
+   - Parses the query string to detect `review:true` or `archived:true`
+   - Forwards to PhotoPrism's `/api/v1/photos` with `path:<basePath>` added to query
+   - For review/archive, also ensures `review/archived` filter is NOT stripped
+   - Returns PhotoPrism's response
+
+2. Two implementation variants:
+
+   **Variant A** (simpler): add `path:<basePath>` to the forwarded query. This only matches exact path, not subdirs (PhotoPrism's `path:` operator does exact match). Might miss photos in subdirectories.
+
+   **Variant B** (correct): Forward the query without path, then post-filter the response to remove photos whose `photo_path` doesn't match `basePath/%`. This is more robust.
+
+### Step 3: Validation
+
+1. Build sidecar: `cd sidecar && CGO_ENABLED=0 go build -o mule-sidecar .`
+2. Rebuild Docker image: `docker compose build sidecar`
+3. Restart sidecar: `docker compose up -d sidecar`
+4. Test labels as muli — verify only muli's labels appear
+5. Test review tab as muli — verify only muli's photos needing review appear
+6. Test archive tab as muli — verify only muli's archived photos appear
+7. Test same views as admin — verify dtoro still sees all
+
+## 5. Files Likely to Change
+
+| File | Change |
+|------|--------|
+| `sidecar/handlers_labels.go` | **New** — label proxy handler |
+| `sidecar/handlers_photos.go` | **New** — photos proxy handler (or merged into one proxy.go) |
+| `sidecar/handlers_folder.go` | Reference for existing handler patterns |
+| `sidecar/main.go` | Wire new routes under `auth` group |
+| `sidecar/pp.go` | May need new helper methods for label/photo API calls |
+| `sidecar/users.go` | No change |
+| `sidecar/db.go` | May add types for PpLabel, PpPhoto |
+| `web/src/routes/tags/[category]/[[value]]/+page.svelte` | Change label fetch URL |
+| `web/src/lib/stores/filters.svelte.ts` | Possibly change how review/archive queries are built |
+
+## 6. Tests & Validation
+
+**Build**: `cd sidecar && go build ./... && go vet ./...`
+
+**Manual validation on LXC 120:**
+
+```bash
+# Test labels endpoint
+curl -s "http://localhost:8000/api/sidecar/labels?count=5" \
+  -H "X-Auth-Token: <muli-token>" | python3 -c "import sys,json;d=json.load(sys.stdin);[print(l.get('Name','?'),l.get('PhotoCount')) for l in d[:5]]"
+
+# Test photos endpoint with review
+curl -s "http://localhost:8000/api/sidecar/photos?q=review:true&count=5" \
+  -H "X-Auth-Token: <muli-token>" | python3 -c "import sys,json;d=json.load(sys.stdin);print(f'{len(d)} photos')"
+
+# Verify vs. admin token — counts should differ
+```
+
+**Cross-user check:** Log in as `muli` and `dtoro` in separate browser sessions. Verify:
+- Labels show different counts per user
+- Review photos are scoped per user
+- Archive photos are scoped per user
+
+## 7. Risks, Tradeoffs & Open Questions
+
+### Risks
+
+| Risk | Impact | Mitigation |
+|------|--------|------------|
+| Sidecar proxying adds latency | Slower page loads | Labels are small payloads; single DB query per label is fast |
+| Frontend needs URL changes | Breaks if not updated | Do frontend change alongside sidecar deploy |
+| Photo count queries on every label request | DB load | Cache results for 30s in the sidecar |
+| PhotoPrism's label `PhotoCount` is stale | Mismatch with actual count | Acceptable — PhotoPrism's count is already cached |
+| Review/archive fix depends on how PhotoPrism handles `path:` operator | Photos in subdirs missed | Use Variant B (post-filter by path prefix) |
+
+### Open Questions
+
+- **Q1**: For review/archive — is the user seeing dtoro's photos in the *grid* or only the *sidebar counts*? Need to verify actual API response vs what the frontend renders.
+- **Q2**: What's the performance impact of running `SELECT COUNT(*) FROM photos_labels ... JOIN photos ...` for every label in the response? (Labels list is typically short, < 100)
+- **Q3**: Does the frontend cache the label response aggressively? Need to invalidate cache on user switch.
+- **Q4**: For the `path:` operator — does it do exact match or LIKE? From source: `WHERE photos.photo_path = ?` — exact match only.
+
+### Tradeoffs
+
+- **Sidecar proxy vs. frontend-only**: Proxy centralizes logic but adds network hop. Frontend-only is faster but more complex (every route needs path filtering).
+- **Label count accuracy**: Recalculated per-user counts will differ from the library-wide counts. This is intentional — labels are scoped now.
+- **Sidecar vs. patching PhotoPrism**: Sidecar approach is non-invasive (no fork/build of PP). PhotoPrism patch would be cleaner but requires maintaining a fork.
+
+## 8. Recommendation
+
+1. **Build the labels proxy** (Phase 1) — it directly solves the label isolation problem and can be done with existing sidecar infrastructure
+2. **Investigate review/archive leak** first — run the actual API query as muli to confirm whether the photos search is actually scoped. The code analysis says it should be, but the user reports otherwise. If confirmed as a real leak, implement the sidecar photos proxy (Phase 2)
+3. **Sidebar counts** (Phase 3) — lower priority, can be done after labels and review/archive are fixed
+
+Before building, confirm with the user whether they see cross-user photos in the actual grid or only in the sidebar counts for review/archive.

.hermes/plans/2026-06-06_210000-remaining-fixes.md

@@ -0,0 +1,227 @@
+# Plan: Fix remaining user isolation issues — 404 errors and folder tree
+
+**Date:** 2026-06-06  
+**Author:** Hermes Agent  
+**Status:** Draft
+
+---
+
+## 1. Goal
+
+Fix the remaining issues after deploying the sidecar scoping proxy:
+
+1. **404 on photo grid** — "Request failed with status code 404" in private window
+2. **Folder tree shows other users** — on first load, the library tree lists other users' folders; a refresh fixes it
+
+## 2. Current Context
+
+### What's deployed
+
+| Component | Status |
+|-----------|--------|
+| Sidecar labels proxy (`/api/sidecar/labels`) | ✅ Working |
+| Sidecar counts proxy (`/api/sidecar/counts`) | ✅ Working |
+| Sidecar timeline proxy (`/api/sidecar/timeline`) | ✅ Working through Caddy |
+| Caddy fallback for `/api/v1/api/sidecar/*` | ✅ Working |
+| Frontend rebuild with `sidecar` axios instance | ✅ Built and deployed |
+
+### Verified working via Caddy
+
+```bash
+# Through public URL with valid admin token
+curl https://photos.hubris.network/api/sidecar/timeline?count=1 → HTTP 200
+curl https://photos.hubris.network/api/v1/photos?count=1     → HTTP 200
+```
+
+Both endpoints return 200 when tested directly through Caddy with a valid token.
+
+### Reported issues
+
+1. **404 on photo grid** — even in private window (no cache interference)
+2. **Folder tree shows other users' folders** on first load, fixed by refresh
+
+## 3. Root Cause Analysis
+
+### Issue 1: 404 on photo grid
+
+The `sidecar` axios instance (`baseURL: ''`) is missing the **response interceptor** that:
+- Handles 401 → clears session → redirects to login
+- Re-throws with meaningful error message
+
+The `http` instance (for `/api/v1` endpoints) has this interceptor. Without it on `sidecar`:
+- If the sidecar returns a non-2xx (401, 502 from upstream PP failure, etc.), axios throws a raw error
+- The TanStack Query error boundary catches it and shows "Request failed with status code <status>"
+- Very likely the sidecar is returning 401 on some calls (token expired / session not yet established) and the error message might show 404 because Caddy's catch-all returns 404 when a matcher doesn't find a route
+
+**Hypothesis:** During OIDC login flow, the frontend may make some sidecar calls BEFORE the session is fully established (token loaded into `session.accessToken`). The `sidecar` interceptor checks `session.accessToken` but it might be null. Then the request to `/api/sidecar/timeline` has no auth header → sidecar returns 401 → no response interceptor → raw error.
+
+**Fix:** Add the same 401 → login redirect interceptor to the `sidecar` instance.
+
+### Issue 2: Folder tree shows other users
+
+`listFolders()` calls `http.get('/folders/originals')` which hits PhotoPrism directly. PhotoPrism returns **all folders across the library** regardless of user. The frontend then filters by `userBasePath()` on the result:
+
+```typescript
+const bp = userBasePath();
+if (bp === '') return folders;  // On first load, bp might be empty!
+return folders.filter((f) => f.Path === bp || f.Path.startsWith(bp + '/'))
+```
+
+On first load, `userBasePath()` returns `""` because:
+1. The session data is loaded asynchronously
+2. `session.user.BasePath` might not yet be populated when `listFolders` fires
+3. The TanStack Query cache from a previous session might still have old data
+
+After a refresh, the session is fully loaded, and `userBasePath()` returns the correct value.
+
+A secondary issue: the `http` interceptor's 401 handler clears the session on 401. If the session expires during the app's lifetime, all subsequent requests fail with 401.
+
+## 4. Proposed Approach
+
+### Phase 1: Fix 404 — add response interceptor to sidecar
+
+**File:** `web/src/lib/services/photoprism.ts`
+
+Add the same 401 → login redirect interceptor to `sidecar` as already exists on `http`:
+
+```typescript
+sidecar.interceptors.response.use(
+    (r) => r,
+    (err: AxiosError) => {
+        if (err.response?.status === 401 && browser) {
+            clearSession();
+            const url = err.config?.url ?? '';
+            if (!url.endsWith('/session')) {
+                void goto('/login', { replaceState: true });
+            }
+        }
+        return Promise.reject(err);
+    }
+);
+```
+
+### Phase 2: Fix folder tree — sidecar folder proxy
+
+**File:** `sidecar/handlers_folders.go` (new)
+
+Add a sidecar endpoint that proxies `/folders/originals` and post-filters by BasePath:
+
+```
+GET /api/sidecar/folders → proxies to GET /api/v1/folders/originals
+                         → removes folders not under user's base_path
+                         → returns filtered list
+```
+
+This avoids the timing issue entirely by filtering on the server side.
+
+**Alternative (simpler):** Fix the frontend timing issue by ensuring `listFolders` doesn't fire until the session is ready.
+
+### Phase 3: Change folder tree in frontend
+
+**File:** `web/src/lib/services/photoprism.ts`
+
+Change `listFolders()` to use `sidecar` instance and call `/api/sidecar/folders`:
+
+```typescript
+export async function listFolders(): Promise<PpFolder[]> {
+    const { data } = await sidecar.get<{ folders?: PpFolder[] }>(
+        '/api/sidecar/folders',
+        { params: { recursive: true, uncached: true, files: false } }
+    );
+    const bp = userBasePath();
+    const folders = data.folders ?? [];
+    if (bp === '') return folders;
+    return folders
+        .filter((f) => f.Path === bp || f.Path.startsWith(bp + '/'))
+        .map((f) => ({ ...f, Path: toUserPath(f.Path) }));
+}
+```
+
+## 5. Step-by-step Plan
+
+### Step 1: Add sidecar response interceptor
+
+1. Edit `web/src/lib/services/photoprism.ts`
+2. Add the 401-handling response interceptor to the `sidecar` instance
+3. The interceptor mirrors the existing `http` response interceptor exactly
+
+### Step 2: Rebuild frontend
+
+```bash
+cd /opt/mule-image/web && npm run build
+```
+
+### Step 3: (Optional) Add sidecar folder proxy
+
+1. New file `sidecar/handlers_folders_proxy.go`
+2. Handler similar to `handlePhotos` — proxies to `/api/v1/folders/originals`, post-filters by `Path` prefix
+3. Wire route in `main.go`: `auth.GET("/folders", handleFoldersProxy(pp))`
+4. Build Docker image, restart sidecar
+
+### Step 4: Update listFolders to use sidecar
+
+1. Change `listFolders()` to use `sidecar` instance
+2. Call `/api/sidecar/folders` instead of `/folders/originals`
+
+### Step 5: Rebuild + validate
+
+```bash
+# Rebuild frontend
+cd /opt/mule-image/web && npm run build
+
+# Test through Caddy
+curl -s "https://photos.hubris.network/api/sidecar/timeline?count=1" \
+  -H "X-Auth-Token: <token>" | head -c 200
+
+# Verify folders
+curl -s "https://photos.hubris.network/api/sidecar/folders" \
+  -H "X-Auth-Token: <token>" | python3 -c "import sys,json;d=json.load(sys.stdin);print(json.dumps(d[:3],indent=2))"
+```
+
+### Step 6: Commit
+
+```bash
+git add -A && git commit -m "fix: add sidecar response interceptor + folder proxy" && git push
+```
+
+## 6. Files Likely to Change
+
+| File | Change |
+|------|--------|
+| `web/src/lib/services/photoprism.ts` | Add response interceptor to sidecar instance; change listFolders URL |
+| `sidecar/handlers_folders_proxy.go` | **New** — folder proxy handler |
+| `sidecar/main.go` | Wire folder proxy route |
+
+## 7. Tests & Validation
+
+**Manual:**
+1. Open private window → navigate to photos.hubris.network
+2. Log in as muli via Authentik OIDC
+3. Verify photo grid loads without 404
+4. Verify folder tree shows only muli's folders
+5. Switch to dtoro account → verify folders/timeline scoped to dtoro
+
+**API tests:**
+```bash
+# Sidecar timeline (no token → 401 redirect)
+curl -s "https://photos.hubris.network/api/sidecar/timeline?count=1"
+
+# Sidecar folders
+curl -s "https://photos.hubris.network/api/sidecar/folders"
+```
+
+## 8. Risks & Open Questions
+
+### Risks
+
+| Risk | Impact | Mitigation |
+|------|--------|------------|
+| Sidecar returns 401 during OIDC login flow before session is ready | 404 showing instead of graceful redirect | Add response interceptor in Phase 1 |
+| Folder proxy adds latency | Slower folder tree loading | Minimal — single proxy call, same as PP direct |
+| `userBasePath()` timing issue in listFolders persists even with sidecar | Folder tree still shows wrong folders on first load | Sidecar filter is server-side → no timing dependency |
+
+### Open Questions
+
+- **Q1**: Are there other API calls that bypass the `sidecar` instance and might also be unscoped? (e.g., `listSubjects`, `listGeo`, etc.)
+- **Q2**: Does the sidecar need a folder proxy, or is the timing fix sufficient? The timing fix (delaying `listFolders` until session is ready) is simpler but fragile.
+- **Q3**: Could the 404 be from Caddy's catch-all returning 404 when the sidecar isn't reachable? The Caddy fallback timeout for the sidecar might need tuning.

docker-compose.yml

@@ -42,7 +42,7 @@ services:
       # silently no-op on Debian/Ubuntu and macOS Docker Desktop.
       - ./mariadb/init:/docker-entrypoint-initdb.d:ro,Z
     healthcheck:
-      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      test: ["CMD", "/usr/bin/mariadb-admin", "ping", "-h", "127.0.0.1", "--silent"]
       interval: 10s
       timeout: 5s
       retries: 12

sidecar/auth.go

@@ -11,7 +11,7 @@ import (
 // is the only authority, and we probe PhotoPrism with it before doing any
 // destructive work. The handler reads the validated token off the context
 // via ctxToken so it can keep forwarding it to PhotoPrism for the actual
-// operation.
+// operation. The resolved username is available via ctxUserName.
 func requireSession(pp *ppClient) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		token := c.GetHeader("X-Auth-Token")
@@ -19,11 +19,15 @@ func requireSession(pp *ppClient) gin.HandlerFunc {
 			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "no token"})
 			return
 		}
-		if !pp.validateSession(c.Request.Context(), token) {
+		user := pp.resolveSession(c.Request.Context(), token)
+		if user == nil {
 			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid session"})
 			return
 		}
 		c.Set("token", token)
+		c.Set("userName", user.UserName)
+		c.Set("userUID", user.UserUID)
+		c.Set("basePath", user.BasePath)
 		c.Next()
 	}
 }
@@ -42,3 +46,42 @@ func ctxToken(c *gin.Context) string {
 	}
 	return s
 }
+
+// ctxUserName returns the PhotoPrism username resolved by requireSession.
+func ctxUserName(c *gin.Context) string {
+	v, ok := c.Get("userName")
+	if !ok {
+		return ""
+	}
+	s, ok := v.(string)
+	if !ok {
+		return ""
+	}
+	return s
+}
+
+// ctxUserUID returns the PhotoPrism user UID resolved by requireSession.
+func ctxUserUID(c *gin.Context) string {
+	v, ok := c.Get("userUID")
+	if !ok {
+		return ""
+	}
+	s, ok := v.(string)
+	if !ok {
+		return ""
+	}
+	return s
+}
+
+// ctxBasePath returns the PhotoPrism user BasePath resolved by requireSession.
+func ctxBasePath(c *gin.Context) string {
+	v, ok := c.Get("basePath")
+	if !ok {
+		return ""
+	}
+	s, ok := v.(string)
+	if !ok {
+		return ""
+	}
+	return s
+}

sidecar/db.go

@@ -9,13 +9,13 @@ import (
 )
 
 // Mark mirrors the per-photo extras the web client stores via the marks
-// endpoints — rating + four-colour label. PhotoUID is the row key; both
-// payload fields are nullable so the sparse "no rating / no colour" state
-// round-trips cleanly. The Node prototype kept this in a JSON file; we
-// migrate to MariaDB here so the M4 sharing work has a real table to
-// extend.
+// endpoints — rating + four-colour label. Composite primary key
+// (photo_uid, user_name) so each user has independent marks. Both payload
+// fields are nullable so the sparse "no rating / no colour" state
+// round-trips cleanly.
 type Mark struct {
 	PhotoUID  string    `gorm:"primaryKey;size:64;column:photo_uid" json:"-"`
+	UserName  string    `gorm:"primaryKey;size:128;column:user_name" json:"-"`
 	Rating    *int      `gorm:"column:rating" json:"rating,omitempty"`
 	Color     *string   `gorm:"size:16;column:color" json:"color,omitempty"`
 	UpdatedAt time.Time `gorm:"column:updated_at" json:"updatedAt"`
@@ -26,6 +26,21 @@ type Mark struct {
 // nothing surprising lands in the schema.
 func (Mark) TableName() string { return "marks" }
 
+// UserPref holds the per-user, server-side preferences PhotoPrism's account
+// model has no slot for. Today that's just `IndexPath` — the originals-
+// relative sub-folder (under the user's BasePath) the web client re-roots the
+// Library tree to and scopes the reindex to. Empty string = "whole folder".
+// Keyed by username so each user has independent prefs, matching `Mark`.
+type UserPref struct {
+	UserName  string    `gorm:"primaryKey;size:128;column:user_name" json:"-"`
+	IndexPath string    `gorm:"size:1024;column:index_path" json:"indexPath"`
+	UpdatedAt time.Time `gorm:"column:updated_at" json:"-"`
+}
+
+// TableName pins the table name (GORM would pluralise to `user_prefs` anyway,
+// but pin it explicitly to stay consistent with Mark).
+func (UserPref) TableName() string { return "user_prefs" }
+
 // asJSON returns the wire shape clients expect — same flat object the
 // Node prototype emitted. An empty Mark (rating=nil, color=nil) renders
 // as `{}` which the client treats as "no mark on this photo".
@@ -56,7 +71,7 @@ func openDB(dsn string) (*gorm.DB, error) {
 	if err != nil {
 		return nil, err
 	}
-	if err := db.AutoMigrate(&Mark{}); err != nil {
+	if err := db.AutoMigrate(&Mark{}, &UserPref{}); err != nil {
 		return nil, err
 	}
 	return db, nil

sidecar/fs.go

@@ -108,6 +108,37 @@ func uniqueName(destDir, basename string) (abs, name string, ok bool) {
 	return "", "", false
 }
 
+// uniqueStem finds a base name (extension stripped) that is free for *every*
+// extension in `exts` under destDir, appending `-1`, `-2`, … on collision —
+// the multi-file analogue of uniqueName. Moving a photo's originals siblings
+// (e.g. IMG_1234.JPG + IMG_1234.MOV) under a single shared stem keeps
+// PhotoPrism stacking them as one photo after reindex; picking the stem once
+// for the whole group is what stops the video from being orphaned under a
+// differently-suffixed name than its poster. Caps at 1000 attempts to match
+// uniqueName. The passed extensions keep their on-disk case (we compare
+// case-sensitively via os.Stat, which is correct on the case-sensitive
+// volumes PhotoPrism targets).
+func uniqueStem(destDir, primaryBase string, exts []string) (stem string, ok bool) {
+	base := strings.TrimSuffix(primaryBase, filepath.Ext(primaryBase))
+	for i := 0; i < 1000; i++ {
+		candidate := base
+		if i > 0 {
+			candidate = base + "-" + itoa(i)
+		}
+		free := true
+		for _, ext := range exts {
+			if _, err := os.Stat(filepath.Join(destDir, candidate+ext)); !errors.Is(err, os.ErrNotExist) {
+				free = false
+				break
+			}
+		}
+		if free {
+			return candidate, true
+		}
+	}
+	return "", false
+}
+
 // itoa is the tiny stdlib-free formatter we use inside hot loops.
 func itoa(n int) string {
 	if n == 0 {

sidecar/handlers_countries.go

@@ -0,0 +1,70 @@
+package main
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+// PpCountry is the country aggregation row returned to the client: a
+// 2-letter ISO 3166-1 code, the user-scoped photo count, and a representative
+// thumb hash for the sidebar row.
+type PpCountry struct {
+	Code       string `json:"Code"`
+	PhotoCount int    `json:"PhotoCount"`
+	Thumb      string `json:"Thumb"`
+}
+
+// handleCountries aggregates photos.photo_country directly against
+// PhotoPrism's DB (no upstream proxy needed — this is a simple GROUP BY)
+// and scopes the result to the caller's BasePath, mirroring handleLabels.
+//
+// Route: GET /api/sidecar/countries  (behind requireSession, ppDb != nil)
+func handleCountries(ppDb *gorm.DB) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		basePath := ctxBasePath(c)
+
+		type countryStat struct {
+			Code      string `gorm:"column:code"`
+			Cnt       int64  `gorm:"column:cnt"`
+			ThumbHash string `gorm:"column:thumb_hash"`
+		}
+		var stats []countryStat
+
+		query := ppDb.Table("photos p").
+			Select(`p.photo_country AS code,
+			        COUNT(DISTINCT p.id) AS cnt,
+			        COALESCE(MIN(f.file_hash), '') AS thumb_hash`).
+			Joins(`LEFT JOIN files f ON f.photo_uid = p.photo_uid
+			                       AND f.file_primary = 1
+			                       AND f.file_missing = 0`).
+			Where("p.deleted_at IS NULL").
+			Where("p.photo_country != '' AND p.photo_country != 'zz'")
+
+		if basePath != "" {
+			prefix := basePath + "/%"
+			query = query.Where("(p.photo_path = ? OR p.photo_path LIKE ?)", basePath, prefix)
+		}
+
+		if err := query.
+			Group("p.photo_country").
+			Having("cnt > 0").
+			Order("cnt DESC").
+			Scan(&stats).Error; err != nil {
+			c.JSON(http.StatusBadGateway, gin.H{"error": "country stats query failed"})
+			return
+		}
+
+		out := make([]PpCountry, 0, len(stats))
+		for _, s := range stats {
+			out = append(out, PpCountry{
+				Code:       s.Code,
+				PhotoCount: int(s.Cnt),
+				Thumb:      s.ThumbHash,
+			})
+		}
+
+		c.JSON(http.StatusOK, out)
+	}
+}

sidecar/handlers_dups.go

@@ -9,10 +9,12 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
+	"strings"
 	"sync"
 	"time"
 
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 )
 
 const quarantineDir = ".duplicates"
@@ -36,17 +38,41 @@ type dupListPhoto struct {
 	Files []ppFile `json:"Files"`
 }
 
-func handleDupScan(cfg *Config, pp *ppClient) gin.HandlerFunc {
+func handleDupScan(cfg *Config, pp *ppClient, db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		token := ctxToken(c)
 		start := time.Now()
-		slog.Info("dup.scan starting", "root", cfg.OriginalsRoot)
 
-		all, err := walkFiles(cfg.OriginalsRoot)
+		// Scope the walk to the user's effective library root (BasePath +
+		// chosen index sub-path), same as the folders/timeline/reindex scope —
+		// otherwise a narrowed root would still surface every other user's
+		// files in the cross-folder duplicate scan. "" means whole library
+		// (today's admin-without-BasePath default).
+		root := effectiveLibraryRoot(c, db)
+		scanRoot := cfg.OriginalsRoot
+		if root != "" {
+			abs, err := resolveUnderRoot(cfg.OriginalsRoot, root, true)
+			if err != nil {
+				c.JSON(http.StatusBadRequest, gin.H{"error": "invalid library root"})
+				return
+			}
+			scanRoot = abs
+		}
+		slog.Info("dup.scan starting", "root", scanRoot)
+
+		all, err := walkFiles(scanRoot)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
 		}
+		// walkFiles computes RelPath relative to scanRoot; re-prefix with the
+		// scoped sub-path so RelPath stays originals-root-relative, matching
+		// what handleDupArchive (and the rest of the API) expects.
+		if root != "" {
+			for i := range all {
+				all[i].RelPath = root + "/" + all[i].RelPath
+			}
+		}
 
 		// Group by size first: byte-identical files necessarily share size,
 		// so size-collision is a cheap O(N) prefilter that lets us skip
@@ -149,7 +175,7 @@ type dupArchiveErr struct {
 	Error string `json:"error"`
 }
 
-func handleDupArchive(cfg *Config, pp *ppClient) gin.HandlerFunc {
+func handleDupArchive(cfg *Config, pp *ppClient, db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		token := ctxToken(c)
 		var body dupArchiveBody
@@ -158,6 +184,23 @@ func handleDupArchive(cfg *Config, pp *ppClient) gin.HandlerFunc {
 			return
 		}
 
+		// Authz: every path must live under the caller's effective library
+		// root. The scan above already only ever returns paths from there,
+		// but this endpoint takes paths straight from the request body, so a
+		// scoped (non-admin, or admin-with-sub-path) user could otherwise
+		// pass an arbitrary originals-relative path and archive (move) files
+		// outside their own folder.
+		root := effectiveLibraryRoot(c, db)
+		if root != "" {
+			for _, p := range body.Paths {
+				clean := strings.Trim(p, "/")
+				if clean != root && !strings.HasPrefix(clean, root+"/") {
+					c.JSON(http.StatusForbidden, gin.H{"error": "path outside your library root"})
+					return
+				}
+			}
+		}
+
 		// Each archive batch lands in its own timestamped subdir so the
 		// user can browse what was quarantined when (and recover by hand
 		// if they change their mind).

sidecar/handlers_folders_proxy.go

@@ -0,0 +1,70 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+// handleFoldersProxy proxies PhotoPrism's /api/v1/folders/originals and
+// post-filters by the caller's BasePath so the folder tree only shows
+// folders under the user's library root.
+//
+// Route: GET /api/sidecar/folders  (behind requireSession)
+func handleFoldersProxy(pp *ppClient) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		token := ctxToken(c)
+		basePath := ctxBasePath(c)
+
+		// Forward query params to PhotoPrism.
+		query := c.Request.URL.RawQuery
+		if query == "" {
+			query = "recursive=true&uncached=true&files=false"
+		}
+
+		resp, err := pp.call(c.Request.Context(), http.MethodGet, "/api/v1/folders/originals?"+query, token, nil)
+		if err != nil || !resp.OK {
+			c.JSON(http.StatusBadGateway, gin.H{"error": "upstream folders request failed"})
+			return
+		}
+
+		// Decode the response — PhotoPrism returns { folders: [...] }.
+		var payload struct {
+			Folders []map[string]any `json:"folders"`
+		}
+		if err := json.Unmarshal(resp.Body, &payload); err != nil {
+			c.Data(resp.Status, "application/json", resp.Body)
+			return
+		}
+
+		// If the user has no BasePath (admin/empty), return as-is.
+		if basePath == "" {
+			c.JSON(http.StatusOK, payload)
+			return
+		}
+
+		prefix := basePath + "/"
+
+		// Post-filter folders by Path field only — frontend handles BasePath
+		// prefix stripping via toUserPath().
+		filtered := make([]map[string]any, 0, len(payload.Folders))
+		for _, f := range payload.Folders {
+			rawPath, ok := f["Path"]
+			if !ok {
+				continue
+			}
+			pathStr, ok := rawPath.(string)
+			if !ok {
+				continue
+			}
+			// Keep only folders under the user's base path.
+			if pathStr == basePath || strings.HasPrefix(pathStr, prefix) {
+				filtered = append(filtered, f)
+			}
+		}
+
+		c.JSON(http.StatusOK, gin.H{"folders": filtered})
+	}
+}

sidecar/handlers_heap.go

@@ -83,35 +83,17 @@ func handleHeapConvert(cfg *Config, pp *ppClient) gin.HandlerFunc {
 			subfolder = s
 		}
 
-		// Resolve destination. resolveUnderRoot ensures the target lives
-		// inside ORIGINALS_ROOT and that its parent is a real directory.
-		// Empty / "/" / "." are valid here — they mean "drop these into
-		// originals/ itself" (the modal's "Root" option). resolveUnderRoot
-		// rejects those for safety, so handle the root case explicitly.
-		var targetAbs string
-		trimmed := strings.Trim(body.TargetFolder, "/")
-		if trimmed == "" || trimmed == "." {
-			targetAbs = cfg.OriginalsRoot
-		} else {
-			abs, err := resolveUnderRoot(cfg.OriginalsRoot, body.TargetFolder, true)
-			if err != nil {
-				c.JSON(http.StatusBadRequest, gin.H{"error": "invalid targetFolder"})
-				return
-			}
-			targetAbs = abs
+		// Resolve destination under ORIGINALS_ROOT. Empty / "/" / "." mean
+		// "drop these into originals/ itself" (the modal's "Root" option).
+		targetAbs, err := resolveMoveTarget(cfg, body.TargetFolder)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid targetFolder"})
+			return
 		}
-		destAbs := targetAbs
-		if subfolder != "" {
-			destAbs = filepath.Join(targetAbs, subfolder)
-			if err := os.MkdirAll(destAbs, 0o755); err != nil {
-				c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-				return
-			}
-		}
-
-		// Pull the heap's photos via the q=album:UID query. count=1000 covers
-		// every realistic heap; merged=true expands stacked variants so we
-		// move the JPG/HEIC sibling alongside the primary.
+		// Pull the heap's membership via the q=album:UID query (count=1000
+		// covers every realistic heap). We only need the UID list here — the
+		// search's Files array is trimmed and drops videos, so we re-resolve
+		// each photo's full file set below via resolvePhotosFull.
 		q := url.QueryEscape("album:" + albumUID)
 		listURL := "/api/v1/photos?q=" + q + "&count=1000&merged=true"
 		resp, err := pp.call(c.Request.Context(), http.MethodGet, listURL, token, nil)
@@ -123,114 +105,31 @@ func handleHeapConvert(cfg *Config, pp *ppClient) gin.HandlerFunc {
 			c.JSON(resp.Status, gin.H{"error": "list photos failed"})
 			return
 		}
-		var photos []heapPhoto
-		if err := json.Unmarshal(resp.Body, &photos); err != nil {
+		var listed []heapPhoto
+		if err := json.Unmarshal(resp.Body, &listed); err != nil {
 			c.JSON(http.StatusBadGateway, gin.H{"error": "decode photo list"})
 			return
 		}
-
-		sourceParents := map[string]struct{}{}
-		errs := []heapErr{}
-		moved, copied := 0, 0
-
-		for _, photo := range photos {
-			// Pick the file to physically move. PhotoPrism's "primary" file
-			// for a HEIC photo is the generated `.HEIC.jpg` preview that
-			// lives in storage/sidecar (Root=="sidecar"), not in originals
-			// — moving that path would fail "file missing on disk" every
-			// time. Prefer the primary that lives in originals (Root=="/")
-			// and fall back to the first originals-rooted file. PhotoPrism
-			// regenerates sidecars on reindex, so they don't need to follow.
-			var file ppFile
-			found := false
-			for _, f := range photo.Files {
-				if f.Root == "/" && f.Primary {
-					file, found = f, true
-					break
-				}
-			}
-			if !found {
-				for _, f := range photo.Files {
-					if f.Root == "/" {
-						file, found = f, true
-						break
-					}
-				}
-			}
-			if !found {
-				errs = append(errs, heapErr{UID: photo.UID, Reason: "no originals-rooted file"})
-				continue
-			}
-			srcRel := file.Name
-			srcAbs := filepath.Join(cfg.OriginalsRoot, srcRel)
-			if !sameOrUnder(srcAbs, cfg.OriginalsRoot) {
-				errs = append(errs, heapErr{UID: photo.UID, Reason: "path escapes originals"})
-				continue
-			}
-			st, err := os.Stat(srcAbs)
-			if err != nil || !st.Mode().IsRegular() {
-				errs = append(errs, heapErr{UID: photo.UID, Reason: "file missing on disk"})
-				continue
-			}
-			if filepath.Dir(srcAbs) == destAbs {
-				errs = append(errs, heapErr{UID: photo.UID, Reason: "already in target"})
-				continue
-			}
-			_, name, ok := uniqueName(destAbs, filepath.Base(srcAbs))
-			if !ok {
-				errs = append(errs, heapErr{UID: photo.UID, Reason: "too many collisions"})
-				continue
-			}
-			dstAbs := filepath.Join(destAbs, name)
-			if mode == "move" {
-				if err := os.Rename(srcAbs, dstAbs); err != nil {
-					// Cross-device renames fail with EXDEV — fall back to
-					// copy+remove so a library that spans filesystems still
-					// works.
-					if err2 := copyFile(srcAbs, dstAbs); err2 != nil {
-						errs = append(errs, heapErr{UID: photo.UID, Reason: err.Error()})
-						continue
-					}
-					if err2 := os.Remove(srcAbs); err2 != nil {
-						errs = append(errs, heapErr{UID: photo.UID, Reason: "rename ok, source remove failed: " + err2.Error()})
-						continue
-					}
-				}
-				moved++
-			} else {
-				if err := copyFile(srcAbs, dstAbs); err != nil {
-					errs = append(errs, heapErr{UID: photo.UID, Reason: err.Error()})
-					continue
-				}
-				copied++
-			}
-			sourceParents[filepath.Dir(srcRel)] = struct{}{}
+		uids := make([]string, 0, len(listed))
+		for _, p := range listed {
+			uids = append(uids, p.UID)
 		}
 
-		// Reindex the destination + every source parent so PhotoPrism's
-		// DB catches up. We block on these so the response only goes out
-		// after the index reflects the move — callers (the frontend's
-		// invalidateQueries refetch in particular) need the next /photos
-		// fetch to return the moved files, otherwise the folder view
-		// looks unchanged. PhotoPrism's index endpoint serialises calls
-		// internally; running them sequentially matches that contract
-		// without surprising the server.
-		destRel, _ := filepath.Rel(cfg.OriginalsRoot, destAbs)
-		paths := map[string]struct{}{destRel: {}}
-		for p := range sourceParents {
-			paths[p] = struct{}{}
+		// Re-fetch each photo's complete file list so videos (and other multi-
+		// file photos) move whole — the album search alone would orphan the
+		// .mov. See resolvePhotosFull.
+		photos, resolveErrs, err := resolvePhotosFull(c.Request.Context(), pp, token, uids)
+		if err != nil {
+			c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+			return
 		}
-		if subfolder != "" {
-			parent, _ := filepath.Rel(cfg.OriginalsRoot, targetAbs)
-			paths[parent] = struct{}{}
-		}
-		for p := range paths {
-			reindex := "/"
-			if p != "" && p != "." {
-				reindex = "/" + p
-			}
-			fireReindex(cfg, pp, token, reindex)
+
+		moved, copied, errs, err := movePhotoFiles(cfg, pp, token, photos, targetAbs, subfolder, mode)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
 		}
+		errs = append(resolveErrs, errs...)
 
 		heapDeleted := false
 		if deleteHeap {
@@ -260,3 +159,180 @@ func handleHeapConvert(cfg *Config, pp *ppClient) gin.HandlerFunc {
 		})
 	}
 }
+
+// movePhotoFiles moves (or copies) each photo's originals-rooted primary file
+// into targetAbs — optionally into `subfolder` under it — then blocks on a
+// PhotoPrism reindex of the destination plus every source parent so the next
+// /photos fetch reflects the move. Shared by handleHeapConvert (album-scoped)
+// and handlePhotosMove (UID-list scoped); both resolve `photos` differently
+// but move them identically. Returns per-photo errors in `errs`; the returned
+// top-level error is only for a fatal precondition (subfolder mkdir failed).
+func movePhotoFiles(cfg *Config, pp *ppClient, token string, photos []heapPhoto, targetAbs, subfolder, mode string) (moved, copied int, errs []heapErr, err error) {
+	destAbs := targetAbs
+	if subfolder != "" {
+		destAbs = filepath.Join(targetAbs, subfolder)
+		if e := os.MkdirAll(destAbs, 0o755); e != nil {
+			return 0, 0, nil, e
+		}
+	}
+
+	sourceParents := map[string]struct{}{}
+	errs = []heapErr{}
+
+	for _, photo := range photos {
+		// Gather *every* originals-rooted file of the photo, not just the
+		// primary. A video, Live Photo, or RAW+JPG pair keeps several files
+		// under Root "/" (e.g. the poster IMG.JPG and its IMG.MOV), and they
+		// must travel together — moving only the primary orphans the rest, so
+		// the photo looks "moved" in PhotoPrism (the poster defines its path)
+		// while the actual video is left behind and silently breaks. Sidecar-
+		// rooted files (Root=="sidecar": HEIC previews, .json) are regenerated
+		// on reindex and intentionally skipped. Pick the stem from the primary
+		// (or the first originals file) so the siblings re-stack under one name.
+		var group []ppFile
+		var primary ppFile
+		havePrimary := false
+		for _, f := range photo.Files {
+			if f.Root != "/" {
+				continue
+			}
+			group = append(group, f)
+			if f.Primary && !havePrimary {
+				primary, havePrimary = f, true
+			}
+		}
+		if len(group) == 0 {
+			errs = append(errs, heapErr{UID: photo.UID, Reason: "no originals-rooted file"})
+			continue
+		}
+		if !havePrimary {
+			primary = group[0]
+		}
+
+		// Choose one collision-free stem for the whole group up front, so the
+		// siblings land as `<stem>.JPG`, `<stem>.MOV`, … and stay stacked.
+		exts := make([]string, 0, len(group))
+		extSeen := map[string]struct{}{}
+		for _, f := range group {
+			ext := filepath.Ext(f.Name)
+			if _, dup := extSeen[ext]; !dup {
+				extSeen[ext] = struct{}{}
+				exts = append(exts, ext)
+			}
+		}
+		stem, ok := uniqueStem(destAbs, filepath.Base(primary.Name), exts)
+		if !ok {
+			errs = append(errs, heapErr{UID: photo.UID, Reason: "too many collisions"})
+			continue
+		}
+
+		// Move/copy each sibling. A failure on any one fails the whole photo
+		// (surfaced in errs) rather than leaving a half-moved stack unreported.
+		var failure string
+		movedAny := false
+		usedNames := map[string]struct{}{}
+		for _, f := range group {
+			srcRel := f.Name
+			srcAbs := filepath.Join(cfg.OriginalsRoot, srcRel)
+			if !sameOrUnder(srcAbs, cfg.OriginalsRoot) {
+				failure = "path escapes originals"
+				break
+			}
+			st, statErr := os.Stat(srcAbs)
+			if statErr != nil || !st.Mode().IsRegular() {
+				failure = "file missing on disk"
+				break
+			}
+			if filepath.Dir(srcAbs) == destAbs {
+				// Already in the target folder — nothing to do for this sibling,
+				// but the photo isn't an error just because one file is in place.
+				continue
+			}
+			name := stem + filepath.Ext(srcAbs)
+			// Two originals files sharing an extension (rare) would collide on
+			// the shared stem; keep the extra one's own unique name so neither
+			// overwrites the other.
+			if _, clash := usedNames[name]; clash {
+				_, n, uok := uniqueName(destAbs, filepath.Base(srcAbs))
+				if !uok {
+					failure = "too many collisions"
+					break
+				}
+				name = n
+			}
+			usedNames[name] = struct{}{}
+			dstAbs := filepath.Join(destAbs, name)
+			if mode == "move" {
+				if mvErr := os.Rename(srcAbs, dstAbs); mvErr != nil {
+					// Cross-device renames fail with EXDEV — fall back to
+					// copy+remove so a library that spans filesystems still
+					// works.
+					if err2 := copyFile(srcAbs, dstAbs); err2 != nil {
+						failure = mvErr.Error()
+						break
+					}
+					if err2 := os.Remove(srcAbs); err2 != nil {
+						failure = "rename ok, source remove failed: " + err2.Error()
+						break
+					}
+				}
+			} else {
+				if cpErr := copyFile(srcAbs, dstAbs); cpErr != nil {
+					failure = cpErr.Error()
+					break
+				}
+			}
+			movedAny = true
+			sourceParents[filepath.Dir(srcRel)] = struct{}{}
+		}
+		if failure != "" {
+			errs = append(errs, heapErr{UID: photo.UID, Reason: failure})
+			continue
+		}
+		if !movedAny {
+			errs = append(errs, heapErr{UID: photo.UID, Reason: "already in target"})
+			continue
+		}
+		if mode == "move" {
+			moved++
+		} else {
+			copied++
+		}
+	}
+
+	// Reindex the destination + every source parent so PhotoPrism's DB
+	// catches up. We block on these so the response only goes out after the
+	// index reflects the move — the frontend's invalidateQueries refetch
+	// needs the next /photos fetch to return the moved files, otherwise the
+	// folder view looks unchanged. PhotoPrism's index endpoint serialises
+	// calls internally; running them sequentially matches that contract.
+	destRel, _ := filepath.Rel(cfg.OriginalsRoot, destAbs)
+	paths := map[string]struct{}{destRel: {}}
+	for p := range sourceParents {
+		paths[p] = struct{}{}
+	}
+	if subfolder != "" {
+		parent, _ := filepath.Rel(cfg.OriginalsRoot, targetAbs)
+		paths[parent] = struct{}{}
+	}
+	for p := range paths {
+		reindex := "/"
+		if p != "" && p != "." {
+			reindex = "/" + p
+		}
+		fireReindex(cfg, pp, token, reindex)
+	}
+
+	return moved, copied, errs, nil
+}
+
+// resolveMoveTarget translates a targetFolder (Originals-relative; ""/"/"/"."
+// mean the Originals root itself) into a validated absolute path under the
+// root. Shared by the heap-convert and photos-move destination handling.
+func resolveMoveTarget(cfg *Config, targetFolder string) (string, error) {
+	trimmed := strings.Trim(targetFolder, "/")
+	if trimmed == "" || trimmed == "." {
+		return cfg.OriginalsRoot, nil
+	}
+	return resolveUnderRoot(cfg.OriginalsRoot, targetFolder, true)
+}

sidecar/handlers_labels.go

@@ -0,0 +1,171 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+// PpLabel mirrors the shape PhotoPrism's /api/v1/labels endpoint returns.
+// We decode enough to filter + recalculate PhotoCount; fields the client
+// doesn't render are skipped for token efficiency.
+type PpLabel struct {
+	UID        string `json:"UID"`
+	Name       string `json:"Name"`
+	Slug       string `json:"Slug"`
+	CustomSlug string `json:"CustomSlug"`
+	Priority   int    `json:"Priority"`
+	Favorite   bool   `json:"Favorite"`
+	PhotoCount int    `json:"PhotoCount"`
+	Thumb      string `json:"Thumb"`
+	CreatedAt  string `json:"CreatedAt"`
+	UpdatedAt  string `json:"UpdatedAt"`
+}
+
+// handleLabels proxies PhotoPrism's /api/v1/labels and then post-filters
+// each label's PhotoCount (and removes labels with zero count) so they
+// reflect only photos under the caller's BasePath.
+//
+// Route: GET /api/sidecar/labels  (behind requireSession)
+func handleLabels(pp *ppClient, ppDb *gorm.DB) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		token := ctxToken(c)
+		basePath := ctxBasePath(c)
+
+		// Forward the query string (count, offset, q, all, …) to PhotoPrism.
+		query := c.Request.URL.RawQuery
+
+		// Call PhotoPrism's labels endpoint using the caller's token.
+		resp, err := pp.call(c.Request.Context(), http.MethodGet, "/api/v1/labels?"+query, token, nil)
+		if err != nil || !resp.OK {
+			c.JSON(http.StatusBadGateway, gin.H{"error": "upstream labels request failed"})
+			return
+		}
+
+		// Decode labels.
+		var labels []PpLabel
+		if err := json.Unmarshal(resp.Body, &labels); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to parse labels"})
+			return
+		}
+
+		// If the user has no BasePath (admin/empty), return labels as-is.
+		if basePath == "" || ppDb == nil {
+			c.JSON(http.StatusOK, labels)
+			return
+		}
+
+		// One query: count + a representative scoped thumb for every label
+		// the user can see. Replaces N per-label queries with a single JOIN.
+		prefix := basePath + "/%"
+
+		type labelStat struct {
+			LabelUID  string `gorm:"column:label_uid"`
+			Cnt       int64  `gorm:"column:cnt"`
+			ThumbHash string `gorm:"column:thumb_hash"`
+		}
+		var stats []labelStat
+		if err := ppDb.Raw(`
+			SELECT lb.label_uid                          AS label_uid,
+			       COUNT(DISTINCT p.id)                  AS cnt,
+			       COALESCE(MIN(f.file_hash), '')        AS thumb_hash
+			FROM   photos_labels pl
+			JOIN   photos p  ON pl.photo_id  = p.id
+			JOIN   labels lb ON pl.label_id  = lb.id
+			LEFT JOIN files f ON f.photo_uid   = p.photo_uid
+			                 AND f.file_primary = 1
+			                 AND f.file_missing = 0
+			WHERE  (p.photo_path = ? OR p.photo_path LIKE ?)
+			  AND  p.deleted_at IS NULL
+			GROUP  BY lb.label_uid
+			HAVING cnt > 0
+		`, basePath, prefix).Scan(&stats).Error; err != nil {
+			c.JSON(http.StatusBadGateway, gin.H{"error": "label stats query failed"})
+			return
+		}
+
+		cntMap := make(map[string]int64, len(stats))
+		thumbMap := make(map[string]string, len(stats))
+		for _, s := range stats {
+			cntMap[s.LabelUID] = s.Cnt
+			thumbMap[s.LabelUID] = s.ThumbHash
+		}
+
+		filtered := make([]PpLabel, 0, len(stats))
+		for _, l := range labels {
+			cnt, ok := cntMap[l.UID]
+			if !ok || cnt == 0 {
+				continue
+			}
+			l.PhotoCount = int(cnt)
+			if th := thumbMap[l.UID]; th != "" {
+				l.Thumb = th
+			}
+			filtered = append(filtered, l)
+		}
+
+		c.JSON(http.StatusOK, filtered)
+	}
+}
+
+// Now also handle the session/config count scoping.
+
+// PpCounts mirrors PhotoPrism's session config.count block that drives
+// the sidebar badges (review, archive, all, etc.).
+type PpCounts struct {
+	All      int `json:"all"`
+	Photos   int `json:"photos"`
+	Media    int `json:"media"`
+	Videos   int `json:"videos"`
+	Review   int `json:"review"`
+	Archived int `json:"archived"`
+	Hidden   int `json:"hidden"`
+	Private  int `json:"private"`
+	Favorites int `json:"favorites"`
+}
+
+// handleScopedCounts returns user-scoped counts for review/archive/all
+// so the sidebar badges match what the user actually sees.
+//
+// Route: GET /api/sidecar/counts  (behind requireSession)
+func handleScopedCounts(ppDb *gorm.DB) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		basePath := ctxBasePath(c)
+		if basePath == "" || ppDb == nil {
+			// Admin or no DB — can't scope, return empty.
+			c.JSON(http.StatusOK, PpCounts{})
+			return
+		}
+
+		prefix := basePath + "/%"
+		pathCond := "(p.photo_path = ? OR p.photo_path LIKE ?)"
+		args := []any{basePath, prefix}
+
+		var counts PpCounts
+
+		// All non-deleted photos in this user's scope.
+		ppDb.Raw(`SELECT COUNT(*) FROM photos p WHERE p.deleted_at IS NULL AND `+pathCond, args...).Scan(&counts.All)
+
+		// Photos needing review (quality < 3).
+		ppDb.Raw(`SELECT COUNT(*) FROM photos p WHERE p.deleted_at IS NULL AND p.photo_quality < 3 AND `+pathCond, args...).Scan(&counts.Review)
+
+		// Archived (soft-deleted) photos.
+		ppDb.Raw(`SELECT COUNT(*) FROM photos p WHERE p.deleted_at IS NOT NULL AND `+pathCond, args...).Scan(&counts.Archived)
+
+		// Private photos.
+		ppDb.Raw(`SELECT COUNT(*) FROM photos p WHERE p.deleted_at IS NULL AND p.photo_private = 1 AND `+pathCond, args...).Scan(&counts.Private)
+
+		// Photos (type image).
+		ppDb.Raw(`SELECT COUNT(*) FROM photos p WHERE p.deleted_at IS NULL AND p.photo_type IN ('image','raw','live','animated') AND `+pathCond, args...).Scan(&counts.Photos)
+
+		// Videos.
+		ppDb.Raw(`SELECT COUNT(*) FROM photos p WHERE p.deleted_at IS NULL AND p.photo_type IN ('video','hdr','burst','live') AND `+pathCond, args...).Scan(&counts.Videos)
+
+		// Favorites.
+		ppDb.Raw(`SELECT COUNT(*) FROM photos p WHERE p.deleted_at IS NULL AND p.photo_favorite = 1 AND `+pathCond, args...).Scan(&counts.Favorites)
+
+		c.JSON(http.StatusOK, counts)
+	}
+}

sidecar/handlers_marks.go

@@ -10,13 +10,18 @@ import (
 	"gorm.io/gorm"
 )
 
-// validColors is the four-color palette mule-image always shipped. The
-// empty string is the explicit "clear color" sentinel.
+// validColors is the color palette the web client offers (COLOR_SWATCHES in
+// web/src/lib/utils/tagGroups.ts) — keep the two in sync. The empty string is
+// the explicit "clear color" sentinel.
 var validColors = map[string]struct{}{
 	"red":    {},
 	"orange": {},
 	"yellow": {},
 	"green":  {},
+	"teal":   {},
+	"blue":   {},
+	"purple": {},
+	"pink":   {},
 }
 
 // markPatch is the request body for all three mutating mark endpoints.
@@ -70,12 +75,12 @@ func (p *markPatch) apply(m *Mark) bool {
 	return m.Rating != nil || (m.Color != nil && *m.Color != "")
 }
 
-// allMarksJSON renders the entire `marks` table as the wire shape
+// allMarksJSON renders the current user's marks as the wire shape
 // `{"<uid>": {"rating": …, "color": …, "updatedAt": …}, …}`. Used by
 // GET /photos/marks which the web client calls once on session start.
-func allMarksJSON(db *gorm.DB) (map[string]map[string]any, error) {
+func allMarksJSON(db *gorm.DB, userName string) (map[string]map[string]any, error) {
 	var rows []Mark
-	if err := db.Find(&rows).Error; err != nil {
+	if err := db.Where("user_name = ?", userName).Find(&rows).Error; err != nil {
 		return nil, err
 	}
 	out := make(map[string]map[string]any, len(rows))
@@ -87,7 +92,7 @@ func allMarksJSON(db *gorm.DB) (map[string]map[string]any, error) {
 
 func handleMarksAll(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		marks, err := allMarksJSON(db)
+		marks, err := allMarksJSON(db, ctxUserName(c))
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
@@ -100,7 +105,7 @@ func handleMarkGet(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		uid := c.Param("uid")
 		var m Mark
-		err := db.Where("photo_uid = ?", uid).First(&m).Error
+		err := db.Where("photo_uid = ? AND user_name = ?", uid, ctxUserName(c)).First(&m).Error
 		if errors.Is(err, gorm.ErrRecordNotFound) {
 			c.JSON(http.StatusOK, gin.H{})
 			return
@@ -115,18 +120,18 @@ func handleMarkGet(db *gorm.DB) gin.HandlerFunc {
 
 // upsert applies the patch and writes back. Returns the resulting JSON
 // shape (empty map if the row was deleted).
-func upsert(db *gorm.DB, uid string, patch *markPatch) (map[string]any, error) {
+func upsert(db *gorm.DB, uid, userName string, patch *markPatch) (map[string]any, error) {
 	var m Mark
-	err := db.Where("photo_uid = ?", uid).First(&m).Error
+	err := db.Where("photo_uid = ? AND user_name = ?", uid, userName).First(&m).Error
 	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
 		return nil, err
 	}
 	m.PhotoUID = uid
+	m.UserName = userName
 	keep := patch.apply(&m)
 	m.UpdatedAt = time.Now().UTC()
 	if !keep {
-		// Drop the row entirely so a re-fetch returns {}.
-		if err := db.Where("photo_uid = ?", uid).Delete(&Mark{}).Error; err != nil {
+		if err := db.Where("photo_uid = ? AND user_name = ?", uid, userName).Delete(&Mark{}).Error; err != nil {
 			return nil, err
 		}
 		return map[string]any{}, nil
@@ -149,7 +154,7 @@ func handleMarkPut(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
-		out, err := upsert(db, uid, &patch)
+		out, err := upsert(db, uid, ctxUserName(c), &patch)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
@@ -178,6 +183,7 @@ func handleMarkBulk(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		userName := ctxUserName(c)
 		applied := make(map[string]map[string]any, len(body.IDs))
 		// Single transaction so a partial failure rolls back. The client
 		// expects atomic semantics for a bulk star/colour stamp.
@@ -186,7 +192,7 @@ func handleMarkBulk(db *gorm.DB) gin.HandlerFunc {
 				if uid == "" {
 					continue
 				}
-				out, err := upsert(tx, uid, &body.Patch)
+				out, err := upsert(tx, uid, userName, &body.Patch)
 				if err != nil {
 					return err
 				}

sidecar/handlers_move.go

@@ -0,0 +1,196 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+
+	"github.com/gin-gonic/gin"
+)
+
+type photosMoveBody struct {
+	UIDs         []string `json:"uids"`
+	TargetFolder string   `json:"targetFolder"`
+	Mode         string   `json:"mode"`      // "move" or "copy"
+	Subfolder    string   `json:"subfolder"` // optional, sanitized to a single segment
+}
+
+// handlePhotosMove moves/copies an arbitrary list of photos (by UID) into a
+// folder under originals/. Mirrors handleHeapConvert but resolves the photos
+// from a UID list instead of an album query, then shares movePhotoFiles for
+// the on-disk work + reindex. Backs the grid's "Move to folder" action.
+func handlePhotosMove(cfg *Config, pp *ppClient) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		token := ctxToken(c)
+
+		var body photosMoveBody
+		if err := c.ShouldBindJSON(&body); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid json"})
+			return
+		}
+		if len(body.UIDs) == 0 {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "no uids"})
+			return
+		}
+		mode := body.Mode
+		if mode != "copy" {
+			mode = "move"
+		}
+
+		var subfolder string
+		if body.Subfolder != "" {
+			s, ok := sanitizeFilename(body.Subfolder)
+			if !ok {
+				c.JSON(http.StatusBadRequest, gin.H{"error": "invalid subfolder name"})
+				return
+			}
+			subfolder = s
+		}
+
+		targetAbs, err := resolveMoveTarget(cfg, body.TargetFolder)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid targetFolder"})
+			return
+		}
+
+		// Resolve each photo's FULL file list via the single-photo endpoint
+		// rather than the /photos search (see resolvePhotosFull) — the search
+		// drops a photo's video file from its trimmed Files array and filters
+		// videos out by quality/review, so the .mov never gets listed to move.
+		photos, resolveErrs, err := resolvePhotosFull(c.Request.Context(), pp, token, body.UIDs)
+		if err != nil {
+			c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+			return
+		}
+
+		moved, copied, errs, err := movePhotoFiles(cfg, pp, token, photos, targetAbs, subfolder, mode)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		// Surface UIDs PhotoPrism couldn't resolve alongside any per-file
+		// errors so the client's "N skipped" summary stays accurate.
+		errs = append(resolveErrs, errs...)
+
+		slog.Info("photos.move",
+			"requested", len(body.UIDs),
+			"mode", mode,
+			"moved", moved,
+			"copied", copied,
+			"errors", len(errs),
+		)
+		c.JSON(http.StatusOK, gin.H{
+			"moved":  moved,
+			"copied": copied,
+			"errors": errs,
+		})
+	}
+}
+
+// resolvePhotosFull fetches each photo's complete file list via the
+// single-photo endpoint (GET /photos/:uid). Use this instead of the /photos
+// search whenever you need every file of a photo: the search — even with
+// merged=true — can return a trimmed Files array that omits the photo's video
+// file, and it applies PhotoPrism's default quality/review/archive filters.
+// Both silently drop videos (which PhotoPrism routinely files under review)
+// from a move. The per-UID lookup returns every file and ignores those
+// filters. UIDs PhotoPrism can't resolve are returned in `errs` so the batch
+// continues; a transport-level failure aborts with a fatal error. Mirrors
+// handleRename's single-photo resolution.
+func resolvePhotosFull(ctx context.Context, pp *ppClient, token string, uids []string) (photos []heapPhoto, errs []heapErr, err error) {
+	photos = make([]heapPhoto, 0, len(uids))
+	for _, uid := range uids {
+		resp, e := pp.call(ctx, http.MethodGet, "/api/v1/photos/"+url.PathEscape(uid), token, nil)
+		if e != nil {
+			return nil, nil, e
+		}
+		if !resp.OK {
+			errs = append(errs, heapErr{UID: uid, Reason: "photo not found"})
+			continue
+		}
+		var p heapPhoto
+		if e := json.Unmarshal(resp.Body, &p); e != nil {
+			return nil, nil, e
+		}
+		photos = append(photos, p)
+	}
+	return photos, errs, nil
+}
+
+type folderMoveBody struct {
+	// Originals-relative destination parent. ""/"/"/"." mean the root.
+	TargetParent string `json:"targetParent"`
+}
+
+// handleFolderMove reparents a folder: moves the directory (and everything in
+// it) under a different parent, keeping its own name. Mirrors
+// handleFolderRename but the destination is a parent folder rather than a new
+// name. A whole-tree os.Rename preserves subfolder structure.
+func handleFolderMove(cfg *Config, pp *ppClient) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		token := ctxToken(c)
+		rel, ok := pathParam(c, "rel")
+		if !ok {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid path"})
+			return
+		}
+		var body folderMoveBody
+		if err := c.ShouldBindJSON(&body); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid json"})
+			return
+		}
+		oldAbs, err := resolveUnderRoot(cfg.OriginalsRoot, rel, true)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid path"})
+			return
+		}
+		st, err := os.Stat(oldAbs)
+		if err != nil || !st.IsDir() {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "not a directory"})
+			return
+		}
+		targetParentAbs, err := resolveMoveTarget(cfg, body.TargetParent)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid targetParent"})
+			return
+		}
+		// Can't move a folder into itself or one of its own descendants.
+		if sameOrUnder(targetParentAbs, oldAbs) {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "cannot move a folder into itself"})
+			return
+		}
+		newAbs := filepath.Join(targetParentAbs, filepath.Base(oldAbs))
+		if newAbs == oldAbs {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "already in that folder"})
+			return
+		}
+		if !sameOrUnder(newAbs, cfg.OriginalsRoot) {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "target escapes root"})
+			return
+		}
+		if _, err := os.Stat(newAbs); err == nil {
+			c.JSON(http.StatusConflict, gin.H{"error": "target already exists"})
+			return
+		}
+		if err := os.Rename(oldAbs, newAbs); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		oldRel, _ := filepath.Rel(cfg.OriginalsRoot, oldAbs)
+		newRel, _ := filepath.Rel(cfg.OriginalsRoot, newAbs)
+		slog.Info("folder.move", "from", oldRel, "to", newRel)
+		// Reindex both the old and new parents so PhotoPrism drops the moved
+		// rows from the source view and picks them up under the destination.
+		fireReindex(cfg, pp, token, "/"+filepath.Dir(oldRel))
+		fireReindex(cfg, pp, token, "/"+filepath.Dir(newRel))
+		c.JSON(http.StatusOK, gin.H{
+			"ok":      true,
+			"oldPath": oldRel,
+			"newPath": newRel,
+		})
+	}
+}

sidecar/handlers_photos.go

@@ -0,0 +1,141 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+// handlePhotos proxies PhotoPrism's /api/v1/photos and then post-filters
+// the response so only photos under the caller's BasePath are returned.
+// This fixes the review/archive tab cross-user leak.
+//
+// Route: GET /api/sidecar/timeline  (behind requireSession)
+func handlePhotos(pp *ppClient) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		token := ctxToken(c)
+		basePath := ctxBasePath(c)
+
+		// Forward the raw query string to PhotoPrism.
+		query := c.Request.URL.RawQuery
+
+		resp, err := pp.call(c.Request.Context(), http.MethodGet, "/api/v1/photos?"+query, token, nil)
+		if err != nil || !resp.OK {
+			c.JSON(http.StatusBadGateway, gin.H{"error": "upstream photos request failed"})
+			return
+		}
+
+		// Decode as a generic array so we can inspect Path without
+		// committing to a rigid struct (PhotoPrism's photo response
+		// varies between list/detail/search endpoints).
+		var photos []map[string]any
+		if err := json.Unmarshal(resp.Body, &photos); err != nil {
+			// If it's not an array (e.g. error, single object), pass through.
+			c.Data(resp.Status, "application/json", resp.Body)
+			return
+		}
+
+		// If the user has no BasePath (admin/empty), return as-is.
+		if basePath == "" {
+			// Forward PhotoPrism's X-Count header for countPhotos().
+			if count := resp.Header.Get("X-Count"); count != "" {
+				c.Header("X-Count", count)
+			}
+			c.JSON(http.StatusOK, photos)
+			return
+		}
+
+		prefix := basePath + "/"
+
+		// Post-filter by FileName field (originals-relative path).
+		filtered := make([]map[string]any, 0, len(photos))
+		for _, ph := range photos {
+			rawPath, ok := ph["FileName"]
+			if !ok {
+				continue
+			}
+			pathStr, ok := rawPath.(string)
+			if !ok {
+				continue
+			}
+			// Match exact basePath or basePath/...
+			if pathStr == basePath || strings.HasPrefix(pathStr, prefix) {
+				filtered = append(filtered, ph)
+			}
+		}
+
+		// Forward X-Count header adjusted to the filtered count.
+		c.Header("X-Count", itoa(len(filtered)))
+		c.JSON(http.StatusOK, filtered)
+	}
+}
+
+// handleNotes pages PhotoPrism's photo list to completion and returns only
+// photos carrying a non-empty Caption (mule-image's "Note"), scoped to the
+// caller's BasePath. Paging server-side is what makes this correct: the
+// client can't tell when the *BasePath-filtered* list is exhausted (a full
+// upstream page can filter down to a short — or empty — slice), but here we
+// can key the loop off the raw upstream page length.
+//
+// Route: GET /api/sidecar/notes  (behind requireSession)
+func handleNotes(pp *ppClient) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		token := ctxToken(c)
+		basePath := ctxBasePath(c)
+		prefix := basePath + "/"
+
+		const pageSize = 1000
+		out := make([]map[string]any, 0, 64)
+		seen := make(map[string]struct{})
+
+		for offset := 0; ; offset += pageSize {
+			path := fmt.Sprintf("/api/v1/photos?count=%d&offset=%d&merged=true&order=newest", pageSize, offset)
+			resp, err := pp.call(c.Request.Context(), http.MethodGet, path, token, nil)
+			if err != nil || !resp.OK {
+				c.JSON(http.StatusBadGateway, gin.H{"error": "upstream photos request failed"})
+				return
+			}
+
+			var photos []map[string]any
+			if err := json.Unmarshal(resp.Body, &photos); err != nil {
+				c.JSON(http.StatusBadGateway, gin.H{"error": "unexpected photos response"})
+				return
+			}
+			rawLen := len(photos)
+
+			for _, ph := range photos {
+				// BasePath scope — same rule as handlePhotos.
+				if basePath != "" {
+					pathStr, _ := ph["FileName"].(string)
+					if pathStr != basePath && !strings.HasPrefix(pathStr, prefix) {
+						continue
+					}
+				}
+				// Non-empty caption only.
+				caption, _ := ph["Caption"].(string)
+				if strings.TrimSpace(caption) == "" {
+					continue
+				}
+				// Dedupe by UID — `merged` can still repeat a photo at a page seam.
+				uid, _ := ph["UID"].(string)
+				if uid != "" {
+					if _, ok := seen[uid]; ok {
+						continue
+					}
+					seen[uid] = struct{}{}
+				}
+				out = append(out, ph)
+			}
+
+			// A short upstream page means PhotoPrism has no more rows.
+			if rawLen < pageSize {
+				break
+			}
+		}
+
+		c.JSON(http.StatusOK, out)
+	}
+}

sidecar/handlers_prefs.go

@@ -0,0 +1,117 @@
+package main
+
+import (
+	"errors"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+// Per-user preferences the PhotoPrism account model can't hold. Currently a
+// single field — the index sub-path the web client re-roots the Library tree
+// to and scopes the reindex to. Stored in the sidecar's own DB keyed by
+// username (see UserPref in db.go); never touches PhotoPrism's auth_users.
+
+// prefsBody is the wire shape for GET responses and PUT requests alike.
+type prefsBody struct {
+	IndexPath string `json:"indexPath"`
+}
+
+// loadUserPref reads the row for a user, returning a zero-value pref (empty
+// IndexPath) when none exists yet — the "whole folder" default.
+func loadUserPref(db *gorm.DB, userName string) (UserPref, error) {
+	var p UserPref
+	err := db.Where("user_name = ?", userName).First(&p).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return UserPref{UserName: userName}, nil
+	}
+	return p, err
+}
+
+func handlePrefsGet(db *gorm.DB) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		p, err := loadUserPref(db, ctxUserName(c))
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, prefsBody{IndexPath: p.IndexPath})
+	}
+}
+
+// handlePrefsPut validates the requested index sub-path lives under the user's
+// BasePath (an existing directory, no traversal) and upserts it. An empty
+// string clears the sub-path back to "whole folder".
+func handlePrefsPut(cfg *Config, db *gorm.DB) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var body prefsBody
+		if err := c.ShouldBindJSON(&body); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid body"})
+			return
+		}
+
+		// Normalise to originals-relative, no leading/trailing slashes —
+		// the same shape the web client and auth_users.base_path use.
+		sub := strings.Trim(strings.TrimSpace(body.IndexPath), "/")
+
+		if sub != "" {
+			// The sub-path is relative to the user's BasePath; resolve the
+			// combined originals-relative path and require it to be an
+			// existing directory inside the originals root. resolveUnderRoot
+			// already rejects traversal and symlink escapes.
+			base := strings.Trim(ctxBasePath(c), "/")
+			combined := sub
+			if base != "" {
+				combined = base + "/" + sub
+			}
+			abs, err := resolveUnderRoot(cfg.OriginalsRoot, combined, true)
+			if err != nil {
+				c.JSON(http.StatusBadRequest, gin.H{"error": "invalid index path: " + err.Error()})
+				return
+			}
+			info, err := os.Stat(abs)
+			if err != nil || !info.IsDir() {
+				c.JSON(http.StatusBadRequest, gin.H{"error": "index path is not a folder"})
+				return
+			}
+		}
+
+		userName := ctxUserName(c)
+		p := UserPref{UserName: userName, IndexPath: sub, UpdatedAt: time.Now().UTC()}
+		// Upsert: a clear (sub == "") persists an empty string rather than
+		// deleting the row, so the GET path stays a single code branch.
+		if err := db.Save(&p).Error; err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, prefsBody{IndexPath: sub})
+	}
+}
+
+// effectiveLibraryRoot returns the requesting user's working library root,
+// originals-relative with no leading/trailing slash: their BasePath narrowed
+// by their chosen index sub-path (if any). Mirrors the web client's
+// `userLibraryBase()` — handlers that walk the filesystem on a user's behalf
+// (duplicate scan/archive) should scope to this instead of cfg.OriginalsRoot
+// so a narrowed root also narrows what those handlers can see or touch.
+// Returns "" for "whole library" (no BasePath and no sub-path set — today's
+// admin default).
+func effectiveLibraryRoot(c *gin.Context, db *gorm.DB) string {
+	base := strings.Trim(ctxBasePath(c), "/")
+	pref, err := loadUserPref(db, ctxUserName(c))
+	sub := ""
+	if err == nil {
+		sub = strings.Trim(pref.IndexPath, "/")
+	}
+	if sub == "" {
+		return base
+	}
+	if base == "" {
+		return sub
+	}
+	return base + "/" + sub
+}

sidecar/main.go

@@ -20,6 +20,7 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 )
 
 func main() {
@@ -46,6 +47,18 @@ func main() {
 	// BasePath wired without an admin restart.
 	startUserBasepathReconciler(cfg)
 
+	// Open a second DB handle pointed at PhotoPrism's own schema for
+	// handlers that need to query auth_users, photos, labels, etc.
+	// May be nil if PpDSN is empty (no PP_DB_PASSWORD set).
+	var ppDb *gorm.DB
+	if cfg.PpDSN != "" {
+		if d, err := openDB(cfg.PpDSN); err == nil {
+			ppDb = d
+		} else {
+			slog.Warn("pp db open failed — scoped labels/counts unavailable", "err", err)
+		}
+	}
+
 	gin.SetMode(gin.ReleaseMode)
 	r := gin.New()
 	// Keep `%2F` literal in path params so callers can pass URL-encoded
@@ -66,25 +79,49 @@ func main() {
 
 	// Every other endpoint runs behind the session gate. Mounting them
 	// under one group keeps the middleware wiring obvious.
-	auth := r.Group("/api/sidecar", requireSession(pp))
-	{
-		auth.GET("/photos/marks", handleMarksAll(db))
-		auth.GET("/photos/:uid/marks", handleMarkGet(db))
-		auth.PUT("/photos/:uid/marks", handleMarkPut(db))
-		auth.POST("/photos/marks/bulk", handleMarkBulk(db))
+		auth := r.Group("/api/sidecar", requireSession(pp))
+		{
+			auth.GET("/prefs", handlePrefsGet(db))
+			auth.PUT("/prefs", handlePrefsPut(cfg, db))
 
-		auth.POST("/files/:uid/rename", handleRename(cfg, pp))
+			auth.GET("/photos/marks", handleMarksAll(db))
+			auth.GET("/photos/:uid/marks", handleMarkGet(db))
+			auth.PUT("/photos/:uid/marks", handleMarkPut(db))
+			auth.POST("/photos/marks/bulk", handleMarkBulk(db))
 
-		auth.POST("/folders", handleFolderCreate(cfg, pp))
-		auth.POST("/folders/counts", handleFolderCounts(pp))
-		auth.POST("/folders/:rel/rename", handleFolderRename(cfg, pp))
-		auth.DELETE("/folders/:rel", handleFolderDelete(cfg, pp))
+			auth.POST("/files/:uid/rename", handleRename(cfg, pp))
 
-		auth.POST("/albums/:uid/convert", handleHeapConvert(cfg, pp))
+			auth.POST("/folders", handleFolderCreate(cfg, pp))
+			auth.POST("/folders/counts", handleFolderCounts(pp))
+			auth.POST("/folders/:rel/rename", handleFolderRename(cfg, pp))
+			auth.POST("/folders/:rel/move", handleFolderMove(cfg, pp))
+			auth.DELETE("/folders/:rel", handleFolderDelete(cfg, pp))
 
-		auth.GET("/duplicates/scan", handleDupScan(cfg, pp))
-		auth.POST("/duplicates/archive", handleDupArchive(cfg, pp))
-	}
+			auth.POST("/albums/:uid/convert", handleHeapConvert(cfg, pp))
+			auth.POST("/photos/move", handlePhotosMove(cfg, pp))
+
+			auth.GET("/duplicates/scan", handleDupScan(cfg, pp, db))
+			auth.POST("/duplicates/archive", handleDupArchive(cfg, pp, db))
+
+						// User-scoped proxies — require PpDSN connection.
+						if ppDb != nil {
+							auth.GET("/labels", handleLabels(pp, ppDb))
+							auth.GET("/counts", handleScopedCounts(ppDb))
+							auth.GET("/countries", handleCountries(ppDb))
+						}
+
+						// User-scoped photos — post-filters by BasePath so review/archive
+									// tabs only show photos the user owns.
+									auth.GET("/timeline", handlePhotos(pp))
+
+									// Photos carrying a Note (Caption) — pages PhotoPrism fully so
+									// the /notes view isn't capped to the newest slice.
+									auth.GET("/notes", handleNotes(pp))
+
+									// User-scoped folders — post-filters the folder tree by BasePath
+									// so the sidebar shows only folders under the user's library root.
+									auth.GET("/folders", handleFoldersProxy(pp))
+					}
 
 	addr := cfg.ListenAddr + ":" + itoa(cfg.Port)
 	srv := &http.Server{

sidecar/pp.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"encoding/json"
 	"io"
+	"log/slog"
 	"net/http"
 	"net/url"
 	"time"
@@ -85,6 +86,44 @@ func (c *ppClient) call(ctx context.Context, method, urlPath, token string, body
 	}, nil
 }
 
+// ppSessionUser is the subset of PhotoPrism's session response we need.
+type ppSessionUser struct {
+	UserUID  string `json:"UID"`
+	UserName string `json:"Name"`
+	BasePath string `json:"BasePath"`
+}
+
+type ppSessionResponse struct {
+	User ppSessionUser `json:"user"`
+}
+
+// resolveSession validates the token AND returns the authenticated user.
+// Returns nil when the token is invalid or the response can't be parsed.
+func (c *ppClient) resolveSession(ctx context.Context, token string) *ppSessionUser {
+	if token == "" {
+		return nil
+	}
+	r, err := c.call(ctx, http.MethodGet, "/api/v1/session", token, nil)
+	if err != nil {
+		slog.Warn("resolveSession: call failed", "err", err)
+		return nil
+	}
+	if !r.OK {
+		slog.Warn("resolveSession: not OK", "status", r.Status, "body", string(r.Body[:min(len(r.Body), 200)]))
+		return nil
+	}
+	var resp ppSessionResponse
+	if err := json.Unmarshal(r.Body, &resp); err != nil {
+		slog.Warn("resolveSession: unmarshal failed", "err", err, "body", string(r.Body[:min(len(r.Body), 200)]))
+		return nil
+	}
+	if resp.User.UserName == "" {
+		slog.Warn("resolveSession: empty username", "body", string(r.Body[:min(len(r.Body), 200)]))
+		return nil
+	}
+	return &resp.User
+}
+
 // validateSession is the cheapest probe that the supplied token is live:
 // list one photo. 401 → bad/expired token. We never read the payload.
 func (c *ppClient) validateSession(ctx context.Context, token string) bool {

web/package-lock.json

@@ -14,7 +14,6 @@
 				"bits-ui": "^2.18.1",
 				"clsx": "^2.1.1",
 				"lucide-svelte": "^1.0.1",
-				"maplibre-gl": "^5.24.0",
 				"mode-watcher": "^1.1.0",
 				"svelte-sonner": "^1.1.1",
 				"tailwind-merge": "^3.6.0",
@@ -148,110 +147,6 @@
 				"@jridgewell/sourcemap-codec": "^1.4.14"
 			}
 		},
-		"node_modules/@mapbox/jsonlint-lines-primitives": {
-			"version": "2.0.2",
-			"resolved": "https://registry.npmjs.org/@mapbox/jsonlint-lines-primitives/-/jsonlint-lines-primitives-2.0.2.tgz",
-			"integrity": "sha512-rY0o9A5ECsTQRVhv7tL/OyDpGAoUB4tTvLiW1DSzQGq4bvTPhNw1VpSNjDJc5GFZ2XuyOtSWSVN05qOtcD71qQ==",
-			"engines": {
-				"node": ">= 0.6"
-			}
-		},
-		"node_modules/@mapbox/point-geometry": {
-			"version": "1.1.0",
-			"resolved": "https://registry.npmjs.org/@mapbox/point-geometry/-/point-geometry-1.1.0.tgz",
-			"integrity": "sha512-YGcBz1cg4ATXDCM/71L9xveh4dynfGmcLDqufR+nQQy3fKwsAZsWd/x4621/6uJaeB9mwOHE6hPeDgXz9uViUQ==",
-			"license": "ISC"
-		},
-		"node_modules/@mapbox/tiny-sdf": {
-			"version": "2.2.0",
-			"resolved": "https://registry.npmjs.org/@mapbox/tiny-sdf/-/tiny-sdf-2.2.0.tgz",
-			"integrity": "sha512-LVL4wgI9YAum5V+LNVQO6QgFBPw7/MIIY4XJPNsPDMrjEwcE+JfKk1LuIl8GnF197ejVdC9QdPaxrx5gfgdGXg==",
-			"license": "BSD-2-Clause"
-		},
-		"node_modules/@mapbox/unitbezier": {
-			"version": "0.0.1",
-			"resolved": "https://registry.npmjs.org/@mapbox/unitbezier/-/unitbezier-0.0.1.tgz",
-			"integrity": "sha512-nMkuDXFv60aBr9soUG5q+GvZYL+2KZHVvsqFCzqnkGEf46U2fvmytHaEVc1/YZbiLn8X+eR3QzX1+dwDO1lxlw==",
-			"license": "BSD-2-Clause"
-		},
-		"node_modules/@mapbox/vector-tile": {
-			"version": "2.0.4",
-			"resolved": "https://registry.npmjs.org/@mapbox/vector-tile/-/vector-tile-2.0.4.tgz",
-			"integrity": "sha512-AkOLcbgGTdXScosBWwmmD7cDlvOjkg/DetGva26pIRiZPdeJYjYKarIlb4uxVzi6bwHO6EWH82eZ5Nuv4T5DUg==",
-			"license": "BSD-3-Clause",
-			"dependencies": {
-				"@mapbox/point-geometry": "~1.1.0",
-				"@types/geojson": "^7946.0.16",
-				"pbf": "^4.0.1"
-			}
-		},
-		"node_modules/@mapbox/whoots-js": {
-			"version": "3.1.0",
-			"resolved": "https://registry.npmjs.org/@mapbox/whoots-js/-/whoots-js-3.1.0.tgz",
-			"integrity": "sha512-Es6WcD0nO5l+2BOQS4uLfNPYQaNDfbot3X1XUoloz+x0mPDS3eeORZJl06HXjwBG1fOGwCRnzK88LMdxKRrd6Q==",
-			"license": "ISC",
-			"engines": {
-				"node": ">=6.0.0"
-			}
-		},
-		"node_modules/@maplibre/geojson-vt": {
-			"version": "6.1.0",
-			"resolved": "https://registry.npmjs.org/@maplibre/geojson-vt/-/geojson-vt-6.1.0.tgz",
-			"integrity": "sha512-2eIY4gZxeKIVOZVNkAMb+5NgXhgsMQpOveTQAvnp53LYqHGJZDidk7Ew0Tged9PThidpbS+NFTh0g4zivhPDzQ==",
-			"license": "ISC",
-			"dependencies": {
-				"kdbush": "^4.0.2"
-			}
-		},
-		"node_modules/@maplibre/maplibre-gl-style-spec": {
-			"version": "24.8.5",
-			"resolved": "https://registry.npmjs.org/@maplibre/maplibre-gl-style-spec/-/maplibre-gl-style-spec-24.8.5.tgz",
-			"integrity": "sha512-EzEJmMt6thioRH7GI9LWS7ahXTcAhAPGWCe6oTP2Ps4YnsXOOAfeqx854lZaiDnwURfHmcCKV1mr6oo0i23x6w==",
-			"license": "ISC",
-			"dependencies": {
-				"@mapbox/jsonlint-lines-primitives": "~2.0.2",
-				"@mapbox/unitbezier": "^0.0.1",
-				"json-stringify-pretty-compact": "^4.0.0",
-				"minimist": "^1.2.8",
-				"quickselect": "^3.0.0",
-				"tinyqueue": "^3.0.0"
-			},
-			"bin": {
-				"gl-style-format": "dist/gl-style-format.mjs",
-				"gl-style-migrate": "dist/gl-style-migrate.mjs",
-				"gl-style-validate": "dist/gl-style-validate.mjs"
-			}
-		},
-		"node_modules/@maplibre/mlt": {
-			"version": "1.1.9",
-			"resolved": "https://registry.npmjs.org/@maplibre/mlt/-/mlt-1.1.9.tgz",
-			"integrity": "sha512-g/tD8EYJB97udq33ipuJ9a4Q7fcbZnTEnUrgnEc/tLMmEL+zaCbR+X5fkDBO2dgpaAMsLH179qE3UXg2N0Nc/g==",
-			"license": "(MIT OR Apache-2.0)",
-			"dependencies": {
-				"@mapbox/point-geometry": "^1.1.0"
-			}
-		},
-		"node_modules/@maplibre/vt-pbf": {
-			"version": "4.3.0",
-			"resolved": "https://registry.npmjs.org/@maplibre/vt-pbf/-/vt-pbf-4.3.0.tgz",
-			"integrity": "sha512-jIvp8F5hQCcreqOOpEt42TJMUlsrEcpf/kI1T2v85YrQRV6PPXUcEXUg5karKtH6oh47XJZ4kHu56pUkOuqA7w==",
-			"license": "MIT",
-			"dependencies": {
-				"@mapbox/point-geometry": "^1.1.0",
-				"@mapbox/vector-tile": "^2.0.4",
-				"@maplibre/geojson-vt": "^5.0.4",
-				"@types/geojson": "^7946.0.16",
-				"@types/supercluster": "^7.1.3",
-				"pbf": "^4.0.1",
-				"supercluster": "^8.0.1"
-			}
-		},
-		"node_modules/@maplibre/vt-pbf/node_modules/@maplibre/geojson-vt": {
-			"version": "5.0.4",
-			"resolved": "https://registry.npmjs.org/@maplibre/geojson-vt/-/geojson-vt-5.0.4.tgz",
-			"integrity": "sha512-KGg9sma45S+stfH9vPCJk1J0lSDLWZgCT9Y8u8qWZJyjFlP8MNP1WGTxIMYJZjDvVT3PDn05kN1C95Sut1HpgQ==",
-			"license": "ISC"
-		},
 		"node_modules/@napi-rs/wasm-runtime": {
 			"version": "1.1.4",
 			"resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
@@ -998,12 +893,6 @@
 			"integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
 			"license": "MIT"
 		},
-		"node_modules/@types/geojson": {
-			"version": "7946.0.16",
-			"resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.16.tgz",
-			"integrity": "sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==",
-			"license": "MIT"
-		},
 		"node_modules/@types/node": {
 			"version": "25.8.0",
 			"resolved": "https://registry.npmjs.org/@types/node/-/node-25.8.0.tgz",
@@ -1014,15 +903,6 @@
 				"undici-types": ">=7.24.0 <7.24.7"
 			}
 		},
-		"node_modules/@types/supercluster": {
-			"version": "7.1.3",
-			"resolved": "https://registry.npmjs.org/@types/supercluster/-/supercluster-7.1.3.tgz",
-			"integrity": "sha512-Z0pOY34GDFl3Q6hUFYf3HkTwKEE02e7QgtJppBt+beEAxnyOpJua+voGFvxINBHa06GwLFFym7gRPY2SiKIfIA==",
-			"license": "MIT",
-			"dependencies": {
-				"@types/geojson": "*"
-			}
-		},
 		"node_modules/@types/trusted-types": {
 			"version": "2.0.7",
 			"resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
@@ -1248,12 +1128,6 @@
 				"node": ">= 0.4"
 			}
 		},
-		"node_modules/earcut": {
-			"version": "3.0.2",
-			"resolved": "https://registry.npmjs.org/earcut/-/earcut-3.0.2.tgz",
-			"integrity": "sha512-X7hshQbLyMJ/3RPhyObLARM2sNxxmRALLKx1+NVFFnQ9gKzmCrxm9+uLIAdBcvc8FNLpctqlQ2V6AE92Ol9UDQ==",
-			"license": "ISC"
-		},
 		"node_modules/enhanced-resolve": {
 			"version": "5.21.3",
 			"resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.3.tgz",
@@ -1451,12 +1325,6 @@
 				"node": ">= 0.4"
 			}
 		},
-		"node_modules/gl-matrix": {
-			"version": "3.4.4",
-			"resolved": "https://registry.npmjs.org/gl-matrix/-/gl-matrix-3.4.4.tgz",
-			"integrity": "sha512-latSnyDNt/8zYUB6VIJ6PCh2jBjJX6gnDsoCZ7LyW7GkqrD51EWwa9qCoGixj8YqBtETQK/xY7OmpTF8xz1DdQ==",
-			"license": "MIT"
-		},
 		"node_modules/gopd": {
 			"version": "1.2.0",
 			"resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
@@ -1553,18 +1421,6 @@
 				"jiti": "lib/jiti-cli.mjs"
 			}
 		},
-		"node_modules/json-stringify-pretty-compact": {
-			"version": "4.0.0",
-			"resolved": "https://registry.npmjs.org/json-stringify-pretty-compact/-/json-stringify-pretty-compact-4.0.0.tgz",
-			"integrity": "sha512-3CNZ2DnrpByG9Nqj6Xo8vqbjT4F6N+tb4Gb28ESAZjYZ5yqvmc56J+/kuIwkaAMOyblTQhUW7PxMkUb8Q36N3Q==",
-			"license": "MIT"
-		},
-		"node_modules/kdbush": {
-			"version": "4.0.2",
-			"resolved": "https://registry.npmjs.org/kdbush/-/kdbush-4.0.2.tgz",
-			"integrity": "sha512-WbCVYJ27Sz8zi9Q7Q0xHC+05iwkm3Znipc2XTlrnJbsHMYktW4hPhXUE8Ys1engBrvffoSCqbil1JQAa7clRpA==",
-			"license": "ISC"
-		},
 		"node_modules/kleur": {
 			"version": "4.1.5",
 			"resolved": "https://registry.npmjs.org/kleur/-/kleur-4.1.5.tgz",
@@ -1879,40 +1735,6 @@
 				"@jridgewell/sourcemap-codec": "^1.5.5"
 			}
 		},
-		"node_modules/maplibre-gl": {
-			"version": "5.24.0",
-			"resolved": "https://registry.npmjs.org/maplibre-gl/-/maplibre-gl-5.24.0.tgz",
-			"integrity": "sha512-ALyFxgtd5R+65UqZ/++lOqwWcC0SNho9c27fYSyLmG7AfnAul2o46F05aDJGPbFU57wos9dgcIySHs0Xe6ia3A==",
-			"license": "BSD-3-Clause",
-			"dependencies": {
-				"@mapbox/jsonlint-lines-primitives": "^2.0.2",
-				"@mapbox/point-geometry": "^1.1.0",
-				"@mapbox/tiny-sdf": "^2.1.0",
-				"@mapbox/unitbezier": "^0.0.1",
-				"@mapbox/vector-tile": "^2.0.4",
-				"@mapbox/whoots-js": "^3.1.0",
-				"@maplibre/geojson-vt": "^6.1.0",
-				"@maplibre/maplibre-gl-style-spec": "^24.8.1",
-				"@maplibre/mlt": "^1.1.8",
-				"@maplibre/vt-pbf": "^4.3.0",
-				"@types/geojson": "^7946.0.16",
-				"earcut": "^3.0.2",
-				"gl-matrix": "^3.4.4",
-				"kdbush": "^4.0.2",
-				"murmurhash-js": "^1.0.0",
-				"pbf": "^4.0.1",
-				"potpack": "^2.1.0",
-				"quickselect": "^3.0.0",
-				"tinyqueue": "^3.0.0"
-			},
-			"engines": {
-				"node": ">=16.14.0",
-				"npm": ">=8.1.0"
-			},
-			"funding": {
-				"url": "https://github.com/maplibre/maplibre-gl-js?sponsor=1"
-			}
-		},
 		"node_modules/math-intrinsics": {
 			"version": "1.1.0",
 			"resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
@@ -1952,15 +1774,6 @@
 				"node": ">= 0.6"
 			}
 		},
-		"node_modules/minimist": {
-			"version": "1.2.8",
-			"resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
-			"integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
-			"license": "MIT",
-			"funding": {
-				"url": "https://github.com/sponsors/ljharb"
-			}
-		},
 		"node_modules/mode-watcher": {
 			"version": "1.1.0",
 			"resolved": "https://registry.npmjs.org/mode-watcher/-/mode-watcher-1.1.0.tgz",
@@ -2050,12 +1863,6 @@
 			"integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
 			"license": "MIT"
 		},
-		"node_modules/murmurhash-js": {
-			"version": "1.0.0",
-			"resolved": "https://registry.npmjs.org/murmurhash-js/-/murmurhash-js-1.0.0.tgz",
-			"integrity": "sha512-TvmkNhkv8yct0SVBSy+o8wYzXjE4Zz3PCesbfs8HiCXXdcTuocApFv11UWlNFWKYsP2okqrhb7JNlSm9InBhIw==",
-			"license": "MIT"
-		},
 		"node_modules/nanoid": {
 			"version": "3.3.12",
 			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
@@ -2086,18 +1893,6 @@
 			],
 			"license": "MIT"
 		},
-		"node_modules/pbf": {
-			"version": "4.0.1",
-			"resolved": "https://registry.npmjs.org/pbf/-/pbf-4.0.1.tgz",
-			"integrity": "sha512-SuLdBvS42z33m8ejRbInMapQe8n0D3vN/Xd5fmWM3tufNgRQFBpaW2YVJxQZV4iPNqb0vEFvssMEo5w9c6BTIA==",
-			"license": "BSD-3-Clause",
-			"dependencies": {
-				"resolve-protobuf-schema": "^2.1.0"
-			},
-			"bin": {
-				"pbf": "bin/pbf"
-			}
-		},
 		"node_modules/picocolors": {
 			"version": "1.1.1",
 			"resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -2147,18 +1942,6 @@
 				"node": "^10 || ^12 || >=14"
 			}
 		},
-		"node_modules/potpack": {
-			"version": "2.1.0",
-			"resolved": "https://registry.npmjs.org/potpack/-/potpack-2.1.0.tgz",
-			"integrity": "sha512-pcaShQc1Shq0y+E7GqJqvZj8DTthWV1KeHGdi0Z6IAin2Oi3JnLCOfwnCo84qc+HAp52wT9nK9H7FAJp5a44GQ==",
-			"license": "ISC"
-		},
-		"node_modules/protocol-buffers-schema": {
-			"version": "3.6.1",
-			"resolved": "https://registry.npmjs.org/protocol-buffers-schema/-/protocol-buffers-schema-3.6.1.tgz",
-			"integrity": "sha512-VG2K63Igkiv9p76tk1lilczEK1cT+kCjKtkdhw1dQZV3k3IXJbd3o6Ho8b9zJZaHSnT2hKe4I+ObmX9w6m5SmQ==",
-			"license": "MIT"
-		},
 		"node_modules/proxy-from-env": {
 			"version": "2.1.0",
 			"resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
@@ -2168,12 +1951,6 @@
 				"node": ">=10"
 			}
 		},
-		"node_modules/quickselect": {
-			"version": "3.0.0",
-			"resolved": "https://registry.npmjs.org/quickselect/-/quickselect-3.0.0.tgz",
-			"integrity": "sha512-XdjUArbK4Bm5fLLvlm5KpTFOiOThgfWWI4axAZDWg4E/0mKdZyI9tNEfds27qCi1ze/vwTR16kvmmGhRra3c2g==",
-			"license": "ISC"
-		},
 		"node_modules/readdirp": {
 			"version": "4.1.2",
 			"resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
@@ -2188,15 +1965,6 @@
 				"url": "https://paulmillr.com/funding/"
 			}
 		},
-		"node_modules/resolve-protobuf-schema": {
-			"version": "2.1.0",
-			"resolved": "https://registry.npmjs.org/resolve-protobuf-schema/-/resolve-protobuf-schema-2.1.0.tgz",
-			"integrity": "sha512-kI5ffTiZWmJaS/huM8wZfEMer1eRd7oJQhDuxeCLe3t7N7mX3z94CN0xPxBQxFYQTSNz9T0i+v6inKqSdK8xrQ==",
-			"license": "MIT",
-			"dependencies": {
-				"protocol-buffers-schema": "^3.3.1"
-			}
-		},
 		"node_modules/rolldown": {
 			"version": "1.0.1",
 			"resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.1.tgz",
@@ -2309,15 +2077,6 @@
 				"inline-style-parser": "0.2.7"
 			}
 		},
-		"node_modules/supercluster": {
-			"version": "8.0.1",
-			"resolved": "https://registry.npmjs.org/supercluster/-/supercluster-8.0.1.tgz",
-			"integrity": "sha512-IiOea5kJ9iqzD2t7QJq/cREyLHTtSmUT6gQsweojg9WH2sYJqZK9SswTu6jrscO6D1G5v5vYZ9ru/eq85lXeZQ==",
-			"license": "ISC",
-			"dependencies": {
-				"kdbush": "^4.0.2"
-			}
-		},
 		"node_modules/svelte": {
 			"version": "5.55.7",
 			"resolved": "https://registry.npmjs.org/svelte/-/svelte-5.55.7.tgz",
@@ -2489,12 +2248,6 @@
 				"url": "https://github.com/sponsors/SuperchupuDev"
 			}
 		},
-		"node_modules/tinyqueue": {
-			"version": "3.0.0",
-			"resolved": "https://registry.npmjs.org/tinyqueue/-/tinyqueue-3.0.0.tgz",
-			"integrity": "sha512-gRa9gwYU3ECmQYv3lslts5hxuIa90veaEcxDYuu3QGOIAEM2mOZkVHp48ANJuu1CURtRdHKUBY5Lm1tHV+sD4g==",
-			"license": "ISC"
-		},
 		"node_modules/totalist": {
 			"version": "3.0.1",
 			"resolved": "https://registry.npmjs.org/totalist/-/totalist-3.0.1.tgz",

web/package.json

@@ -30,7 +30,6 @@
 		"bits-ui": "^2.18.1",
 		"clsx": "^2.1.1",
 		"lucide-svelte": "^1.0.1",
-		"maplibre-gl": "^5.24.0",
 		"mode-watcher": "^1.1.0",
 		"svelte-sonner": "^1.1.1",
 		"tailwind-merge": "^3.6.0",

web/src/lib/actions/gridKeyNav.ts

@@ -15,6 +15,7 @@ import { suggestDateFromPath } from '$lib/utils/suggestDateFromPath';
 import { photoNameAndDir } from '$lib/types/photoprism';
 import { queryClient } from '$lib/queryClient';
 import { filters } from '$lib/stores/filters.svelte';
+import { openMove } from '$lib/stores/moveDialog.svelte';
 import {
 	clearBulkToFirst,
 	clearSelection,
@@ -27,6 +28,14 @@ import {
 	toggle
 } from '$lib/stores/selection.svelte';
 import { popAndRun, push as pushUndo } from '$lib/stores/undo.svelte';
+import {
+	startBulk,
+	doneBulk,
+	removedBulk,
+	failBulk,
+	setDetail,
+	markRemoved
+} from '$lib/stores/bulkAction.svelte';
 import { openPreview, toggleLeftSidebar, toggleRightSidebar, view } from '$lib/stores/view.svelte';
 
 /**
@@ -162,6 +171,8 @@ export function gridKeyNav(node: HTMLElement, params: GridKeyNavParams = {}) {
 		return [];
 	}
 
+	const delay = (ms: number) => new Promise<void>((r) => setTimeout(r, ms));
+
 	async function toggleArchive(direction: 'archive' | 'restore' | 'toggle') {
 		const ids = cullTargets();
 		if (ids.length === 0) {
@@ -180,34 +191,43 @@ export function gridKeyNav(node: HTMLElement, params: GridKeyNavParams = {}) {
 			target = !(first?.Archived ?? false);
 		}
 
-		// PhotoPrism's photo PUT silently drops the Archived field — the
-		// only working path is /api/v1/batch/photos/{archive,restore}. The
-		// previous patchTargets call PUT'd `{Archived: true}` and got a 200
-		// back, so the toast fired but nothing moved.
+		const opLabel = target ? 'Archiving' : 'Restoring';
+		const doneLabel = target ? `Archived ${ids.length}` : `Restored ${ids.length}`;
+		const tid = toast.loading(`${opLabel} ${ids.length}…`);
+		startBulk(`${opLabel}…`, ids);
 		try {
 			if (target) await batchArchive(ids);
 			else await batchRestore(ids);
 		} catch (err) {
-			toast.error(err instanceof Error ? err.message : 'Archive failed');
+			failBulk(ids);
+			toast.error(err instanceof Error ? err.message : 'Archive/restore failed', { id: tid });
 			return;
 		}
-		// Move focus forward before the photos query refetches, so the
-		// user can keep X-ing through the timeline without their cursor
-		// snapping back to photo[0]. Walks past every uid we just
-		// archived/restored — relevant when the cull targets came from a
-		// multi-selection rather than the single focused tile.
-		focusAfter(ids);
-		// Drop the now-stale selection set. The archived UIDs are about
-		// to leave the timeline on refetch, but the SvelteSet membership
-		// keeps the selection ring on them until then — confusing for
-		// the user and a footgun if they Ctrl-click to add more and end
-		// up re-archiving the same photos. The BulkActionBar button path
-		// clears for the same reason; mirror it here.
-		clearSelection();
-		invalidatePhotos(ids);
-		const label = target ? `Archived ${ids.length}` : `Restored ${ids.length}`;
-		toast.success(label);
-		pushUndo(label, async () => {
+		if (target) {
+			// Destructive removal: flash a red cross, then pull the tiles out of
+			// the grid immediately (markRemoved) rather than waiting on the slow
+			// server-reconcile refetch. The grid reconciles `removedIds` against
+			// the cache and drops each id once the archived-filtered page has
+			// actually replaced it (see +page.svelte), so we don't clear here —
+			// clearing on this action's own settle raced other in-flight archives
+			// and flashed photos back in.
+			removedBulk(doneLabel, ids);
+			focusAfter(ids);
+			clearSelection();
+			await delay(500);
+			markRemoved(ids);
+			invalidatePhotos(ids);
+			void queryClient.invalidateQueries({ queryKey: ['photos'] });
+			void queryClient.invalidateQueries({ queryKey: ['marks'] });
+		} else {
+			doneBulk(doneLabel, ids);
+			focusAfter(ids);
+			clearSelection();
+			invalidatePhotos(ids);
+			void queryClient.invalidateQueries({ queryKey: ['marks'] });
+		}
+		toast.success(doneLabel, { id: tid });
+		pushUndo(doneLabel, async () => {
 			if (target) await batchRestore(ids);
 			else await batchArchive(ids);
 			invalidatePhotos(ids);
@@ -232,16 +252,27 @@ export function gridKeyNav(node: HTMLElement, params: GridKeyNavParams = {}) {
 				? 'Permanently delete this photo? This cannot be undone.'
 				: `Permanently delete ${ids.length} photos? This cannot be undone.`;
 		if (!confirm(msg)) return;
+		const tid = toast.loading(`Deleting ${ids.length}…`);
+		startBulk('Deleting…', ids);
 		try {
 			await batchDelete(ids);
 		} catch (err) {
-			toast.error(err instanceof Error ? err.message : 'Delete failed');
+			failBulk(ids);
+			toast.error(err instanceof Error ? err.message : 'Delete failed', { id: tid });
 			return;
 		}
+		// Destructive removal — same red-cross flash then immediate hide as archive.
+		removedBulk(`Deleted ${ids.length}`, ids);
 		focusAfter(ids);
 		clearSelection();
+		await delay(500);
+		markRemoved(ids);
 		invalidatePhotos(ids);
-		toast.success(`Deleted ${ids.length}`);
+		// removedIds is reconciled against the cache in +page.svelte; no
+		// settle-driven clear here (see toggleArchive note above).
+		void queryClient.invalidateQueries({ queryKey: ['photos'] });
+		void queryClient.invalidateQueries({ queryKey: ['marks'] });
+		toast.success(`Deleted ${ids.length}`, { id: tid });
 	}
 
 	/** Approve cull targets — clears them out of the review pile by
@@ -257,21 +288,27 @@ export function gridKeyNav(node: HTMLElement, params: GridKeyNavParams = {}) {
 			});
 			return;
 		}
-		const { updated, errors } = await batchEdit(ids, (id) => approvePhoto(id));
-		// Approve moves photos out of the review pile, so the same
-		// stale-selection trap as archive/delete applies — advance focus
-		// past the approved set and drop the now-irrelevant selection
-		// before invalidate refetches the (smaller) view.
+		const tid = toast.loading(`Keeping ${ids.length}…`);
+		startBulk('Keeping…', ids);
+		const { updated, errors } = await batchEdit(ids, (id) => approvePhoto(id), {
+			onProgress: (_done, _total, completedId) => {
+				const p = cachedPhoto(completedId);
+				if (p) setDetail(p.FileName ?? completedId);
+			}
+		});
+		if (errors.length) {
+			failBulk(ids);
+			toast.error(`Kept ${updated.length}; ${errors.length} failed`, {
+				id: tid,
+				description: errors[0].message
+			});
+		} else {
+			doneBulk(`Kept ${ids.length}`, ids);
+			toast.success(`Kept ${ids.length}`, { id: tid });
+		}
 		focusAfter(ids);
 		clearSelection();
 		invalidatePhotos(ids);
-		if (errors.length) {
-			toast.error(`Kept ${updated.length}; ${errors.length} failed`, {
-				description: errors[0].message
-			});
-			return;
-		}
-		toast.success(`Kept ${ids.length}`);
 	}
 
 	// ── S chord (add-to-heap) ────────────────────────────────────────────
@@ -297,25 +334,28 @@ export function gridKeyNav(node: HTMLElement, params: GridKeyNavParams = {}) {
 			});
 			return;
 		}
+		const tid = toast.loading(`Adding ${ids.length} → ${heap.Title}…`);
+		startBulk(`Adding to ${heap.Title}…`, ids);
 		try {
 			const { added } = await addToHeap(heap.UID, ids);
 			void queryClient.invalidateQueries({ queryKey: ['heaps'] });
 			void queryClient.invalidateQueries({ queryKey: ['photos'] });
-			// PhotoPrism returns 200 even when nothing was added — distinguish
-			// "really added N" from "skipped all N" so the toast tells the
-			// truth.
 			if (added.length === 0) {
+				failBulk(ids);
 				toast.error(`Nothing added to ${heap.Title}`, {
+					id: tid,
 					description: `The server rejected all ${ids.length} UIDs (already in heap, or not indexed).`
 				});
 				return;
 			}
+			doneBulk(`Added ${added.length} → ${heap.Title}`, ids);
 			if (added.length < ids.length) {
 				toast.success(`Added ${added.length}/${ids.length} → ${heap.Title}`, {
+					id: tid,
 					description: 'The rest were already in this heap.'
 				});
 			} else {
-				toast.success(`Added ${added.length} → ${heap.Title}`);
+				toast.success(`Added ${added.length} → ${heap.Title}`, { id: tid });
 			}
 			pushUndo(`Added ${added.length} to ${heap.Title}`, async () => {
 				await removeFromHeap(heap.UID, added);
@@ -323,7 +363,8 @@ export function gridKeyNav(node: HTMLElement, params: GridKeyNavParams = {}) {
 				void queryClient.invalidateQueries({ queryKey: ['photos'] });
 			});
 		} catch (err) {
-			toast.error(err instanceof Error ? err.message : 'Add-to-heap failed');
+			failBulk(ids);
+			toast.error(err instanceof Error ? err.message : 'Add-to-heap failed', { id: tid });
 		}
 	}
 
@@ -515,6 +556,23 @@ export function gridKeyNav(node: HTMLElement, params: GridKeyNavParams = {}) {
 				e.preventDefault();
 				void toggleArchive('restore');
 				return;
+			case 'm':
+			case 'M': {
+				if (meta || shift) return;
+				e.preventDefault();
+				// Move the cull targets to a folder — opens the shared
+				// move-to-folder dialog (same one the bar button and the
+				// heap/folder kebabs use).
+				const moveIds = cullTargets();
+				if (moveIds.length === 0) {
+					toast.message('Nothing to move', {
+						description: 'Click a photo or select some first'
+					});
+					return;
+				}
+				openMove({ kind: 'photos', uids: moveIds });
+				return;
+			}
 			case 's':
 			case 'S':
 				if (meta || shift) return;

web/src/lib/components/duplicates/DuplicatesView.svelte

@@ -28,6 +28,7 @@
 		type CrossFolderScanResult
 	} from '$lib/services/photoprism';
 	import type { DuplicateGroup } from '$lib/services/adapters/duplicates';
+	import { userLibraryBase } from '$lib/stores/session.svelte';
 	import StackGroupCard from './StackGroupCard.svelte';
 	import CrossFolderGroupCard from './CrossFolderGroupCard.svelte';
 	import { EmptyState, InlineLoader } from '$lib/components/feedback';
@@ -50,14 +51,14 @@
 	// "Rescan filesystem" button invalidates to force a re-scan after
 	// the user has moved files around.
 	const crossQuery = createQuery<CrossFolderScanResult>(() => ({
-		queryKey: ['duplicates-cross-folder'],
+		queryKey: ['duplicates-cross-folder', userLibraryBase()],
 		queryFn: scanCrossFolderDuplicates,
 		enabled: activeTab === 'cross-folder',
 		staleTime: 5 * 60_000
 	}));
 
 	function rescan() {
-		void qc.invalidateQueries({ queryKey: ['duplicates-cross-folder'] });
+		void qc.invalidateQueries({ queryKey: ['duplicates-cross-folder', userLibraryBase()] });
 	}
 
 	$effect(() => {

web/src/lib/components/layout/FolderTree.svelte

@@ -41,7 +41,7 @@
 	import { filters } from '$lib/stores/filters.svelte';
 	import { browser } from '$app/environment';
 	import { untrack } from 'svelte';
-	import { FolderPlus, Pencil, Trash2 } from 'lucide-svelte';
+	import { ChevronRight, FolderInput, FolderPlus, Pencil, Trash2 } from 'lucide-svelte';
 	import Self from './FolderTree.svelte';
 	import KebabMenu, { Item, Separator } from './KebabMenu.svelte';
 
@@ -50,10 +50,13 @@
 		depth?: number;
 		onPick: (path: string) => void;
 		/** Mutating callbacks are only required when readonly !== true. The
-		 *  picker (HeapConvertDialog) reuses the tree just for `onPick`. */
+		 *  picker (MoveToFolderDialog) reuses the tree just for `onPick`. */
 		onRename?: (path: string) => void;
 		onDelete?: (path: string) => void;
 		onCreateChild?: (parent: string) => void;
+		/** Reparent this folder under a chosen destination (opens the shared
+		 *  move-to-folder dialog). Sidebar only; the readonly picker omits it. */
+		onMove?: (path: string) => void;
 		/** Read-only mode: hides the kebab menu and disables double-click
 		 *  rename, so the tree can be reused as a folder picker. */
 		readonly?: boolean;
@@ -74,6 +77,7 @@
 		onRename,
 		onDelete,
 		onCreateChild,
+		onMove,
 		readonly = false,
 		selectedPath,
 		counts
@@ -160,19 +164,21 @@
 			>
 				{#if hasChildren}
 					<button
-						class="flex h-[18px] w-4 items-center justify-center text-[10px]"
+						class="flex h-[18px] w-5 items-center justify-center rounded hover:text-foreground"
 						class:text-muted-foreground={!active}
 						onclick={() => toggle(node.path)}
 						title={open ? 'Collapse' : 'Expand'}
 						aria-label={open ? 'Collapse' : 'Expand'}
 					>
-						{open ? '▾' : '▸'}
+						<ChevronRight
+							class="h-4 w-4 transition-transform duration-150 {open ? 'rotate-90' : ''}"
+						/>
 					</button>
 				{:else}
 					<!-- Spacer keeps childless siblings aligned with their chevroned
 					     peers at every depth, so labels share a common left edge
 					     across the sidebar (folders, heaps, views, manage). -->
-					<span class="inline-block h-[18px] w-4" aria-hidden="true"></span>
+					<span class="inline-block h-[18px] w-5" aria-hidden="true"></span>
 				{/if}
 				<!--
 					Count badge lives INSIDE the button so the entire row (label
@@ -219,6 +225,13 @@
 								<Pencil class="h-3.5 w-3.5 text-muted-foreground" />
 								Rename
 							</Item>
+							<Item
+								class="flex cursor-pointer items-center gap-2 rounded px-2 py-1.5 text-[12px] outline-none hover:bg-accent focus:bg-accent"
+								onSelect={() => onMove?.(node.path)}
+							>
+								<FolderInput class="h-3.5 w-3.5 text-muted-foreground" />
+								Move to folder…
+							</Item>
 							<Separator class="my-1 h-px bg-border" />
 							<Item
 								class="flex cursor-pointer items-center gap-2 rounded px-2 py-1.5 text-[12px] text-destructive outline-none hover:bg-destructive/10 focus:bg-destructive/10"
@@ -239,6 +252,7 @@
 					{onRename}
 					{onDelete}
 					{onCreateChild}
+					{onMove}
 					{readonly}
 					{selectedPath}
 					{counts}

web/src/lib/components/layout/GeneralSettingsDialog.svelte

@@ -1,24 +1,20 @@
 <!--
-	General app preferences. The UI tab owns the SvelteKit shell's
-	light/dark/system theme (mode-watcher) plus the per-user UI knobs
-	PhotoPrism's /settings exposes. Search and Maps follow the same
-	pattern — server prefs round-trip via /api/v1/settings.
+	General app preferences. Two tabs: the SvelteKit shell's
+	light/dark/system theme (mode-watcher) and the signed-in user's account
+	(identity + password change).
 
-	The Library admin dialog and this one share the ['settings'] cache,
-	so saves from either invalidate the other.
+	PhotoPrism's own per-user UI/search/maps knobs used to live here too, but
+	they only steer PhotoPrism's bundled SPA — which mulimage's users never
+	see — so they were removed. mulimage's own view prefs live in the view
+	store; the library admin knobs live under Folders → ⚙ (SettingsDialog).
 -->
 <script lang="ts">
 	import { Dialog, Tabs } from 'bits-ui';
-	import { createMutation, createQuery, useQueryClient } from '@tanstack/svelte-query';
+	import { createMutation } from '@tanstack/svelte-query';
 	import { mode, setMode } from 'mode-watcher';
 	import { toast } from 'svelte-sonner';
 	import { Loader2, Monitor, Moon, Settings as SettingsIcon, Sun, X } from 'lucide-svelte';
-	import {
-		getSettings,
-		saveSettings,
-		setUserPassword,
-		type PpSettings
-	} from '$lib/services/photoprism';
+	import { setUserPassword } from '$lib/services/photoprism';
 	import { session } from '$lib/stores/session.svelte';
 
 	interface Props {
@@ -27,9 +23,7 @@
 	}
 	let { open, onClose }: Props = $props();
 
-	const qc = useQueryClient();
-
-	let activeTab = $state<'ui' | 'search' | 'maps' | 'account'>('ui');
+	let activeTab = $state<'ui' | 'account'>('ui');
 
 	// ── Account tab — password change ─────────────────────────────────────
 	let pwOld = $state('');
@@ -59,107 +53,6 @@
 		{ value: 'system', label: 'System', Icon: Monitor }
 	] as const;
 
-	// PhotoPrism palette names from its built-in themes. Any value
-	// outside this list is preserved verbatim (see `withCurrent`).
-	const ppThemes = [
-		'default',
-		'abyss',
-		'gemstone',
-		'grayscale',
-		'lavender',
-		'legacy',
-		'neon',
-		'onyx',
-		'raspberry',
-		'shadow',
-		'yellowstone'
-	];
-
-	// IETF subtags PhotoPrism ships translations for. Extend without
-	// fear — `withCurrent` keeps unknown values visible.
-	const ppLanguages = [
-		'en', 'de', 'es', 'fr', 'it', 'pt', 'nl', 'pl', 'cs', 'sk',
-		'sv', 'no', 'da', 'fi', 'hu', 'ro', 'bg', 'el', 'ru', 'uk',
-		'tr', 'ar', 'he', 'hi', 'vi', 'th', 'ja', 'ko', 'zh'
-	];
-
-	const ppStartPages = [
-		'default',
-		'browse',
-		'albums',
-		'calendar',
-		'moments',
-		'people',
-		'places',
-		'labels',
-		'states',
-		'library'
-	];
-
-	const ppMapStyles = ['default', 'streets', 'hybrid', 'topographique', 'offline'];
-
-	// Returns `opts` with `current` prepended if it's set and not
-	// already in the list — so e.g. an experimental theme name in the
-	// server response shows up selected and editable instead of
-	// silently being overwritten by the dropdown's default.
-	function withCurrent(opts: string[], current?: string): string[] {
-		if (!current) return opts;
-		return opts.includes(current) ? opts : [current, ...opts];
-	}
-
-	const settingsQuery = createQuery<PpSettings>(() => ({
-		queryKey: ['settings'],
-		queryFn: getSettings,
-		enabled: open
-	}));
-
-	/**
-	 * Some PhotoPrism deployments return `/settings` without the
-	 * `ui` / `search` / `maps` keys (older versions, custom edits to
-	 * settings.yml). The form's `bind:value={draft.ui!.theme}` etc.
-	 * non-null-asserts those sub-objects — when they're missing the
-	 * assertion lies and the bind getter throws on the next tick. Force
-	 * the shape on every clone so every binding has a real object to
-	 * write into, and so `draft.ui` is never null while `draft` is non-
-	 * null (template gates only check `draft`).
-	 */
-	function normalize(s: PpSettings): PpSettings {
-		return {
-			...s,
-			ui: s.ui ?? {},
-			search: s.search ?? {},
-			maps: s.maps ?? {}
-		};
-	}
-
-	let draft = $state<PpSettings | null>(null);
-	// Re-clone on each open so reopening the dialog shows the freshest
-	// server state. Eagerly nulling on close used to introduce a window
-	// where Dialog's exit animation kept the form mounted while draft
-	// was already null — and bind:value getters read null, triggering
-	// "$.get(...) is null" / can't access .ui at runtime. Resetting on
-	// open instead avoids that race entirely.
-	$effect(() => {
-		if (open && settingsQuery.data) {
-			draft = normalize(structuredClone(settingsQuery.data));
-		}
-	});
-
-	const saveMut = createMutation(() => ({
-		mutationFn: (patch: PpSettings) => saveSettings(patch),
-		onSuccess: (next) => {
-			qc.setQueryData(['settings'], next);
-			draft = normalize(structuredClone(next));
-			toast.success('Settings saved');
-		},
-		onError: (err) =>
-			toast.error(err instanceof Error ? err.message : 'Could not save settings')
-	}));
-
-	function resetDraft() {
-		if (settingsQuery.data) draft = normalize(structuredClone(settingsQuery.data));
-	}
-
 	const selectClass =
 		'rounded border border-input bg-background px-2 py-1 focus:outline-none focus:ring-2 focus:ring-ring';
 </script>
@@ -198,7 +91,7 @@
 
 			<Tabs.Root bind:value={activeTab}>
 				<Tabs.List class="mb-3 flex gap-1 border-b border-border">
-					{#each ['ui', 'search', 'maps', 'account'] as const as t (t)}
+					{#each ['ui', 'account'] as const as t (t)}
 						<Tabs.Trigger
 							value={t}
 							class="-mb-px border-b-2 border-transparent px-3 py-1.5 text-[12px] capitalize text-muted-foreground hover:text-foreground data-[state=active]:border-primary data-[state=active]:text-foreground"
@@ -208,8 +101,7 @@
 					{/each}
 				</Tabs.List>
 
-				<!-- UI — local app theme (mode-watcher) on top, then the
-				     PhotoPrism per-user UI knobs that go to /settings. -->
+				<!-- UI — local app theme (mode-watcher). Persists itself; no Save. -->
 				<Tabs.Content value="ui" class="space-y-4 text-[12px] outline-none">
 					<section class="space-y-2">
 						<h3 class="text-[10px] font-semibold uppercase tracking-[0.14em] text-muted-foreground">
@@ -239,126 +131,10 @@
 							Light/dark for this app. Persists locally; no Save needed.
 						</p>
 					</section>
-
-					{#if settingsQuery.isPending}
-						<p class="px-1 text-muted-foreground">Loading server settings…</p>
-					{:else if settingsQuery.isError}
-						<p class="px-1 text-destructive">Could not load server settings.</p>
-					{:else if draft}
-						<section class="space-y-3">
-							<h3 class="text-[10px] font-semibold uppercase tracking-[0.14em] text-muted-foreground">
-								Server UI
-							</h3>
-							<label class="flex flex-col gap-1">
-								<span class="text-muted-foreground">Theme</span>
-								<select bind:value={draft.ui!.theme} class={selectClass}>
-									{#each withCurrent(ppThemes, draft.ui!.theme) as v (v)}
-										<option value={v}>{v}</option>
-									{/each}
-								</select>
-							</label>
-							<label class="flex flex-col gap-1">
-								<span class="text-muted-foreground">Language</span>
-								<select bind:value={draft.ui!.language} class={selectClass}>
-									{#each withCurrent(ppLanguages, draft.ui!.language) as v (v)}
-										<option value={v}>{v}</option>
-									{/each}
-								</select>
-							</label>
-							<label class="flex flex-col gap-1">
-								<span class="text-muted-foreground">Time zone</span>
-								<!-- IANA tz list is ~400 entries, browser support varies; use
-								     a datalist so we get autocomplete without spamming a
-								     gigantic <select>. "Local" is PhotoPrism's special
-								     "follow system" sentinel. -->
-								<input
-									type="text"
-									list="general-tz-list"
-									placeholder="Local"
-									bind:value={draft.ui!.timeZone}
-									class={selectClass}
-								/>
-							</label>
-							<label class="flex flex-col gap-1">
-								<span class="text-muted-foreground">Start page</span>
-								<select bind:value={draft.ui!.startPage} class={selectClass}>
-									{#each withCurrent(ppStartPages, draft.ui!.startPage) as v (v)}
-										<option value={v}>{v}</option>
-									{/each}
-								</select>
-							</label>
-							<label class="flex items-center gap-2">
-								<input type="checkbox" bind:checked={draft.ui!.scrollbar} />
-								Always show scrollbars
-							</label>
-							<label class="flex items-center gap-2">
-								<input type="checkbox" bind:checked={draft.ui!.zoom} />
-								Allow image zoom
-							</label>
-						</section>
-					{/if}
 				</Tabs.Content>
 
-				{#if settingsQuery.isPending && activeTab !== 'ui' && activeTab !== 'account'}
-					<Tabs.Content value={activeTab} class="outline-none">
-						<p class="px-1 text-[12px] text-muted-foreground">Loading settings…</p>
-					</Tabs.Content>
-				{:else if settingsQuery.isError && activeTab !== 'ui' && activeTab !== 'account'}
-					<Tabs.Content value={activeTab} class="outline-none">
-						<p class="px-1 text-[12px] text-destructive">
-							Could not load settings.
-						</p>
-					</Tabs.Content>
-				{:else if draft}
-					<Tabs.Content value="search" class="space-y-3 text-[12px] outline-none">
-						<label class="flex items-center gap-2">
-							<input type="checkbox" bind:checked={draft.search!.listView} />
-							Default to list view
-						</label>
-						<label class="flex items-center gap-2">
-							<input type="checkbox" bind:checked={draft.search!.showTitles} />
-							Show titles
-						</label>
-						<label class="flex items-center gap-2">
-							<input type="checkbox" bind:checked={draft.search!.showCaptions} />
-							Show captions
-						</label>
-						<label class="flex flex-col gap-1">
-							<span class="text-muted-foreground">
-								Batch size (-1 = server default)
-							</span>
-							<input
-								type="number"
-								bind:value={draft.search!.batchSize}
-								class={selectClass}
-							/>
-						</label>
-					</Tabs.Content>
-
-					<Tabs.Content value="maps" class="space-y-3 text-[12px] outline-none">
-						<label class="flex flex-col gap-1">
-							<span class="text-muted-foreground">Style</span>
-							<select bind:value={draft.maps!.style} class={selectClass}>
-								{#each withCurrent(ppMapStyles, draft.maps!.style) as v (v)}
-									<option value={v}>{v}</option>
-								{/each}
-							</select>
-						</label>
-						<label class="flex flex-col gap-1">
-							<span class="text-muted-foreground">
-								Animation duration (ms, 0 = off)
-							</span>
-							<input
-								type="number"
-								bind:value={draft.maps!.animate}
-								class={selectClass}
-							/>
-						</label>
-					</Tabs.Content>
-				{/if}
-
-				<!-- Account — independent of /settings; reads from the session
-				     store and round-trips its own mutation. -->
+				<!-- Account — reads from the session store and round-trips its own
+				     password mutation. -->
 				<Tabs.Content value="account" class="space-y-4 text-[12px] outline-none">
 					<section class="space-y-2">
 						<h3 class="text-[10px] font-semibold uppercase tracking-[0.14em] text-muted-foreground">
@@ -448,59 +224,6 @@
 					</form>
 				</Tabs.Content>
 			</Tabs.Root>
-
-			<!-- Datalist for time-zone autocomplete. Falls back to the
-			     "Local" sentinel when the browser can't enumerate the
-			     IANA list (older Safari, etc.). -->
-			<datalist id="general-tz-list">
-				<option value="Local"></option>
-				{#each tzOptions() as tz (tz)}<option value={tz}></option>{/each}
-			</datalist>
-
-			<!-- Save/Revert apply to draft (the PhotoPrism /settings round
-			     trip). The App theme group above persists itself, so we
-			     only show the action row when there's something to save.
-			     Account tab has its own Update-password button, so skip. -->
-			{#if draft && activeTab !== 'account'}
-				<div class="flex items-center justify-end gap-2 border-t border-border pt-3">
-					<button
-						type="button"
-						class="rounded border border-border px-3 py-1 text-[12px] hover:bg-accent"
-						onclick={resetDraft}
-						disabled={saveMut.isPending}
-					>
-						Revert
-					</button>
-					<button
-						type="button"
-						class="flex items-center gap-1.5 rounded bg-primary px-3 py-1 text-[12px] text-primary-foreground hover:bg-primary/90 disabled:opacity-50"
-						onclick={() => draft && saveMut.mutate(draft)}
-						disabled={saveMut.isPending}
-					>
-						{#if saveMut.isPending}
-							<Loader2 class="h-3 w-3 animate-spin" />
-						{/if}
-						Save
-					</button>
-				</div>
-			{/if}
 		</Dialog.Content>
 	</Dialog.Portal>
 </Dialog.Root>
-
-<script lang="ts" module>
-	// `Intl.supportedValuesOf` is a 2022+ API; older browsers (Safari
-	// 15.3 and below) return undefined here. The component handles that
-	// by simply showing only the "Local" sentinel in the datalist.
-	export function tzOptions(): string[] {
-		const fn = (Intl as unknown as {
-			supportedValuesOf?: (k: string) => string[];
-		}).supportedValuesOf;
-		if (typeof fn !== 'function') return [];
-		try {
-			return fn('timeZone');
-		} catch {
-			return [];
-		}
-	}
-</script>

web/src/lib/components/layout/HeapConvertDialog.svelte

@@ -1,249 +0,0 @@
-<!--
-	Move/copy every photo in a heap into a folder under originals/.
-
-	Picker reuses the existing FolderTree in readonly mode; the dialog owns
-	the selection (`pickedPath`) so it doesn't conflict with the global
-	folderPath filter the sidebar drives.
-
-	Submit goes to the sidecar's POST /albums/:uid/convert. On success we
-	invalidate the photos / folders / heaps queries so the timeline and
-	sidebar refresh; if the heap was deleted and was active, route home.
--->
-<script lang="ts">
-	import { goto } from '$app/navigation';
-	import { Dialog } from 'bits-ui';
-	import { createMutation, createQuery, useQueryClient } from '@tanstack/svelte-query';
-	import { toast } from 'svelte-sonner';
-	import { FolderInput, FolderOpen, Loader2 } from 'lucide-svelte';
-	import { EmptyState, InlineLoader } from '$lib/components/feedback';
-	import {
-		convertHeap,
-		listFolders,
-		type HeapConvertBody,
-		type HeapConvertResult,
-		type PpAlbum,
-		type PpFolder
-	} from '$lib/services/photoprism';
-	import { filters, setSection } from '$lib/stores/filters.svelte';
-	import { isAuthenticated, toOriginalsPath } from '$lib/stores/session.svelte';
-	import FolderTree, { buildTree } from './FolderTree.svelte';
-
-	interface Props {
-		heap: PpAlbum | null;
-		onClose: () => void;
-	}
-	let { heap, onClose }: Props = $props();
-
-	const qc = useQueryClient();
-
-	// Reuse the same folders cache the sidebar uses — same key so we share
-	// the in-flight request, and the picker invalidates it on success.
-	const foldersQuery = createQuery<PpFolder[]>(() => ({
-		queryKey: ['folders'],
-		queryFn: listFolders,
-		enabled: isAuthenticated()
-	}));
-	const folderTree = $derived(
-		buildTree((foldersQuery.data ?? []).map((f) => f.Path))
-	);
-
-	let pickedPath = $state<string | null>(null);
-	let mode = $state<'move' | 'copy'>('move');
-	let subfolder = $state('');
-	let deleteHeap = $state(false);
-
-	// Reset draft state whenever a new heap is picked (or the dialog closes
-	// and reopens). $effect runs after the prop change, so the form is
-	// blank on every fresh open.
-	$effect(() => {
-		void heap;
-		pickedPath = null;
-		mode = 'move';
-		subfolder = '';
-		deleteHeap = false;
-	});
-
-	const convertMut = createMutation(() => ({
-		mutationFn: (args: { uid: string; body: HeapConvertBody }) =>
-			convertHeap(args.uid, args.body),
-		onSuccess: (result: HeapConvertResult, vars) => {
-			qc.invalidateQueries({ queryKey: ['photos'] });
-			qc.invalidateQueries({ queryKey: ['folders'] });
-			qc.invalidateQueries({ queryKey: ['heaps'] });
-			const verb = mode === 'copy' ? 'Copied' : 'Moved';
-			const count = mode === 'copy' ? result.copied : result.moved;
-			const tail =
-				result.errors.length > 0
-					? ` · ${result.errors.length} skipped`
-					: '';
-			toast.success(`${verb} ${count} photo${count === 1 ? '' : 's'}${tail}`);
-			// If the heap got deleted and we were viewing it, fall back home.
-			if (
-				result.heap_deleted &&
-				filters.section === 'heap' &&
-				filters.heapUid === vars.uid
-			) {
-				setSection('all-photos');
-				void goto('/', { keepFocus: true, noScroll: true });
-			}
-			onClose();
-		},
-		onError: (err) =>
-			toast.error(err instanceof Error ? err.message : 'Convert failed')
-	}));
-
-	function submit() {
-		// pickedPath === '' is the root selection; falsy check would
-		// wrongly block it. Distinguish `null` (nothing picked) from `''`.
-		if (!heap || pickedPath === null) return;
-		// pickedPath is user-relative (listFolders strips BasePath). The
-		// sidecar moves files on disk so it needs a server-absolute path —
-		// translate before submitting.
-		convertMut.mutate({
-			uid: heap.UID,
-			body: {
-				targetFolder: toOriginalsPath(pickedPath),
-				mode,
-				subfolder: subfolder.trim() || null,
-				deleteHeap: mode === 'move' && deleteHeap
-			}
-		});
-	}
-
-	// Copy mode doesn't change membership, so "delete heap after" is
-	// meaningless. Force-clear it when the user flips back to copy.
-	$effect(() => {
-		if (mode === 'copy' && deleteHeap) deleteHeap = false;
-	});
-
-	const open = $derived(heap !== null);
-</script>
-
-<Dialog.Root
-	{open}
-	onOpenChange={(o) => {
-		if (!o) onClose();
-	}}
->
-	<Dialog.Portal>
-		<Dialog.Overlay
-			class="fixed inset-0 z-40 bg-background/80 backdrop-blur-sm data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:animate-in data-[state=open]:fade-in-0"
-		/>
-		<Dialog.Content
-			class="fixed left-1/2 top-1/2 z-50 grid w-full max-w-[520px] -translate-x-1/2 -translate-y-1/2 gap-4 rounded-lg border border-border bg-card p-5 text-card-foreground shadow-lg outline-none data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[state=open]:animate-in data-[state=open]:fade-in-0 data-[state=open]:zoom-in-95"
-		>
-			<div class="flex items-start gap-2">
-				<FolderInput class="mt-0.5 h-4 w-4 text-muted-foreground" />
-				<div class="flex-1">
-					<Dialog.Title class="text-sm font-semibold leading-tight">
-						{mode === 'copy' ? 'Copy' : 'Move'} heap to folder
-					</Dialog.Title>
-					<Dialog.Description class="mt-1 text-xs text-muted-foreground">
-						{heap?.Title ?? ''} · {heap?.PhotoCount ?? 0} photo{heap?.PhotoCount === 1
-							? ''
-							: 's'}
-					</Dialog.Description>
-				</div>
-			</div>
-
-			<!-- Folder picker. Readonly FolderTree so the user can't kebab/
-			     rename their way out of the picker mid-flow. -->
-			<div class="rounded-md border border-border bg-background p-2">
-				<div class="mb-1 text-[10px] font-semibold uppercase tracking-[0.14em] text-muted-foreground">
-					Destination
-				</div>
-				<div class="max-h-[200px] overflow-y-auto">
-					{#if foldersQuery.isPending}
-						<InlineLoader size="sm" label="Loading folders…" />
-					{:else if (foldersQuery.data ?? []).length === 0}
-						<EmptyState
-							size="compact"
-							icon={FolderOpen}
-							title="No folders"
-							description="Create one from the sidebar first."
-						/>
-					{:else}
-						<!-- Root row: lets the user drop the heap directly into
-						     originals/ without picking a subfolder. The empty
-						     string is the sidecar's "root" sentinel — matches
-						     resolveUnderRoot's special case in handlers_heap. -->
-						<button
-							type="button"
-							class="flex w-full items-center rounded px-2 py-1 text-left text-[12px] hover:bg-accent"
-							class:bg-primary={pickedPath === ''}
-							class:text-primary-foreground={pickedPath === ''}
-							class:hover:bg-primary={pickedPath === ''}
-							onclick={() => (pickedPath = '')}
-						>
-							/
-						</button>
-						<FolderTree
-							nodes={folderTree}
-							onPick={(p) => (pickedPath = p)}
-							selectedPath={pickedPath}
-							readonly
-						/>
-					{/if}
-				</div>
-			</div>
-
-			<!-- Mode + options. Plain radio + checkbox; bits-ui has dedicated
-			     primitives but inline form controls keep the dialog small. -->
-			<div class="space-y-2">
-				<div class="flex items-center gap-4 text-[12px]">
-					<label class="flex items-center gap-1.5">
-						<input type="radio" bind:group={mode} value="move" />
-						Move
-					</label>
-					<label class="flex items-center gap-1.5">
-						<input type="radio" bind:group={mode} value="copy" />
-						Copy
-					</label>
-				</div>
-				<label class="flex flex-col gap-1 text-[12px]">
-					<span class="text-muted-foreground">
-						New subfolder (optional)
-					</span>
-					<input
-						type="text"
-						placeholder="e.g. {heap?.Title ?? 'My heap'}"
-						bind:value={subfolder}
-						class="rounded border border-input bg-background px-2 py-1 text-[12px] focus:outline-none focus:ring-2 focus:ring-ring"
-					/>
-				</label>
-				<label class="flex items-center gap-1.5 text-[12px]">
-					<input
-						type="checkbox"
-						bind:checked={deleteHeap}
-						disabled={mode === 'copy'}
-					/>
-					<span class:text-muted-foreground={mode === 'copy'}>
-						Delete heap after move
-					</span>
-				</label>
-			</div>
-
-			<div class="flex items-center justify-end gap-2 pt-1">
-				<button
-					type="button"
-					class="rounded border border-border px-3 py-1 text-[12px] hover:bg-accent"
-					onclick={onClose}
-					disabled={convertMut.isPending}
-				>
-					Cancel
-				</button>
-				<button
-					type="button"
-					class="flex items-center gap-1.5 rounded bg-primary px-3 py-1 text-[12px] text-primary-foreground hover:bg-primary/90 disabled:opacity-50"
-					onclick={submit}
-					disabled={pickedPath === null || convertMut.isPending}
-				>
-					{#if convertMut.isPending}
-						<Loader2 class="h-3 w-3 animate-spin" />
-					{/if}
-					{mode === 'copy' ? 'Copy' : 'Move'}
-				</button>
-			</div>
-		</Dialog.Content>
-	</Dialog.Portal>
-</Dialog.Root>

web/src/lib/components/layout/IndexerStatusPill.svelte

@@ -1,49 +1,8 @@
-<!--
-	Compact status pill that appears in the header while PhotoPrism's
-	indexer is doing work. Driven by the indexer store, which subscribes
-	to PhotoPrism's WS channel. Renders nothing when idle so it never
-	steals header real estate from the user.
-
-	The `detail` (current path/file) is exposed via `title` rather than
-	rendered inline — the pill stays narrow even on slow flashes through
-	a deep library, and hover surfaces the detail for users who care.
--->
+<!-- PhotoPrism indexer status pill. Driven by the indexer store, which
+     subscribes to PhotoPrism's WS channel. Delegates rendering to StatusPill. -->
 <script lang="ts">
 	import { indexer } from '$lib/stores/indexer.svelte';
-	import { Loader2 } from 'lucide-svelte';
-
-	// PhotoPrism's `fileName` arrives as the full relative path
-	// (`subdir/IMG_0554.HEIC.jpg`). The basename is enough for inline
-	// recognition; the full path stays in the `title` for users who hover.
-	const basename = $derived.by(() => {
-		const d = indexer.detail;
-		if (!d) return '';
-		const i = d.lastIndexOf('/');
-		return i >= 0 ? d.slice(i + 1) : d;
-	});
+	import StatusPill from './StatusPill.svelte';
 </script>
 
-{#if indexer.active || indexer.label}
-	<div
-		class="flex items-center gap-1.5 rounded-full border border-border bg-background/80 px-2.5 py-1 text-xs text-foreground shadow-sm backdrop-blur"
-		title={indexer.detail ?? indexer.label}
-		role="status"
-		aria-live="polite"
-	>
-		{#if indexer.active}
-			<Loader2 class="h-3 w-3 animate-spin text-primary" />
-		{/if}
-		<span class="whitespace-nowrap">{indexer.label}</span>
-		{#if basename}
-			<!-- Fixed-width slot so the pill stops shrinking/growing as
-			     PhotoPrism rattles through files of different name lengths.
-			     `w-[24ch]` locks the column; `truncate` ellipsises anything
-			     longer. The full path remains in the parent's `title`. -->
-			<span
-				class="w-[24ch] truncate text-left font-mono text-[10px] text-muted-foreground"
-			>
-				{basename}
-			</span>
-		{/if}
-	</div>
-{/if}
+<StatusPill active={indexer.active} label={indexer.label} detail={indexer.detail} />

web/src/lib/components/layout/LeftSidebar.svelte

@@ -7,27 +7,23 @@
 	import { toast } from 'svelte-sonner';
 	import {
 		aggregateKeywords,
-		countPhotos,
 		createFolder,
 		createHeap,
 		deleteFolder,
 		deleteHeap,
 		duplicateHeap,
-		getConfig,
+		getIndexSubpath,
 		heapDownloadUrl,
-		listFolderCounts,
 		listFolders,
 		listHeaps,
-		listPhotosWithNotes,
 		logout,
 		renameFolder,
 		renameHeap,
 		scanCrossFolderDuplicates,
+		startIndex,
 		triggerDownload,
 		type CrossFolderScanResult,
-		type PhotoWithNote,
 		type PpAlbum,
-		type PpClientConfig,
 		type PpFolder
 	} from '$lib/services/photoprism';
 	import {
@@ -48,14 +44,25 @@
 		type Section,
 		type TagCategory
 	} from '$lib/stores/filters.svelte';
-	import { isAuthenticated, session, userBasePath } from '$lib/stores/session.svelte';
+	import {
+		isAuthenticated,
+		prefs,
+		session,
+		setIndexSubpathState,
+		userBasePath,
+		userLibraryBase,
+		toOriginalsPath,
+		toUserPath
+	} from '$lib/stores/session.svelte';
+	import { openMove } from '$lib/stores/moveDialog.svelte';
+	import { indexer } from '$lib/stores/indexer.svelte';
 	import FolderTree, { buildTree } from './FolderTree.svelte';
 	import GeneralSettingsDialog from './GeneralSettingsDialog.svelte';
-	import HeapConvertDialog from './HeapConvertDialog.svelte';
 	import KebabMenu, { Item, Separator } from './KebabMenu.svelte';
 	import SettingsDialog from './SettingsDialog.svelte';
 	import UsersDialog from './UsersDialog.svelte';
 	import {
+		ChevronRight,
 		Copy,
 		Download,
 		FolderInput,
@@ -65,6 +72,7 @@
 		LogOut,
 		Moon,
 		Pencil,
+		RefreshCw,
 		Settings,
 		Sun,
 		Trash2,
@@ -80,192 +88,59 @@
 		enabled: isAuthenticated()
 	}));
 
+	// Keyed on the effective library base (BasePath + chosen index sub-path)
+	// so re-rooting refetches, and so the post-bootstrap identity change forces
+	// a fresh fetch instead of leaving the query wedged in pending/idle (the
+	// old `gcTime: 0` + `enabled` toggle could strand it there on first paint).
 	const foldersQuery = createQuery<PpFolder[]>(() => ({
-		queryKey: ['folders'],
+		queryKey: ['folders', userLibraryBase()],
 		queryFn: listFolders,
-		enabled: isAuthenticated()
+		enabled: isAuthenticated(),
+		staleTime: 30_000,
+		retry: 2,
+		refetchOnMount: 'always'
 	}));
 
-	// View counts come from PhotoPrism's `/config` response, which carries a
-	// precomputed counter for every common bucket (all/archived/labels/
-	// places/…) updated incrementally on every mutation. Cheap to refetch,
-	// and gives us a stable total — `/photos` only returns per-page row
-	// counts via `X-Count`, never a total.
-	//
-	// The key sits under the `['photos', …]` prefix so it inherits the
-	// existing `invalidateQueries({ queryKey: ['photos'] })` calls scattered
-	// across mutations (archive, restore, delete, heap add) — the counter
-	// map refreshes whenever the photo list does. Marks-derived counts
-	// (ratings/colors) react through the shared `['marks']` cache.
-	const configQuery = createQuery<PpClientConfig>(() => ({
-		queryKey: ['photos', 'config'],
-		queryFn: getConfig,
-		enabled: isAuthenticated()
+	// Hydrate the per-user index sub-path into the session store on load so the
+	// Library tree re-roots to it without waiting for the settings dialog to be
+	// opened. Shares the ['prefs'] key with SettingsDialog's setter.
+	const prefsQuery = createQuery<string>(() => ({
+		queryKey: ['prefs'],
+		queryFn: getIndexSubpath,
+		enabled: isAuthenticated(),
+		staleTime: 5 * 60_000
 	}));
+	$effect(() => {
+		if (prefsQuery.data !== undefined) setIndexSubpathState(prefsQuery.data);
+	});
 
-	// PhotoPrism's /api/v1/config.count returns library-wide aggregates
-	// to any authenticated session regardless of role — the timeline
-	// itself IS scoped per-user, but the precomputed counters aren't.
-	// `isAdminUser` controls the cheap path: an admin without a
-	// BasePath gets the precomputed totals from /config directly. Every
-	// other case (non-admin, or admin scoped to a subfolder) goes
-	// through `countPhotos()` which appends a `path:<base>*` filter so
-	// the badge matches what the user can actually see.
-	const isAdminUser = $derived(session.user?.Role === 'admin');
-	const wantScoped = $derived(!isAdminUser || userBasePath() !== '');
-
-	// Builds a DSL clause that mirrors PhotoPrism's ACL scoping. An
-	// admin with `BasePath === ""` gets a no-op clause and the global
-	// query; everyone else gets a `path:` clause anchored to their
-	// BasePath so unrelated folders never contribute to the badge.
-	// Non-admins with no BasePath have nothing they can see, so we
-	// short-circuit to a query that returns zero (`uid:none`).
-	function scoped(filter: string): string {
-		const bp = userBasePath();
-		if (isAdminUser && bp === '') return filter;
-		if (!isAdminUser && bp === '') return 'uid:none';
-		return `${filter} path:"${bp}*"`.trim();
-	}
-
-	function scopedCountQuery(key: string, filter: string) {
-		return createQuery<number>(() => ({
-			queryKey: ['photos', 'scoped-count', key, userBasePath(), isAdminUser],
-			queryFn: () => countPhotos(scoped(filter)),
-			enabled: isAuthenticated() && wantScoped,
-			staleTime: 60_000
-		}));
-	}
-
-	// One query per badge. Admins with no BasePath skip this
-	// (enabled:false via `wantScoped`) and the configQuery numbers are
-	// used directly — same chrome as before that fix, no extra
-	// round-trip. Review and Hidden have no aggregate badge (pure
-	// toggles in the sidebar now, like Tags), so they don't appear here.
-	const archivedCountQuery = scopedCountQuery('archived', 'archived:true');
-
-	function bucketCount(
-		key: 'archived',
-		query: { data: number | undefined; isPending: boolean }
-	): number | undefined {
-		if (wantScoped) {
-			if (query.isPending) return undefined;
-			return query.data;
-		}
-		// Admin + no BasePath: use the precomputed PhotoPrism counters
-		// (no extra round-trip).
-		const c = configQuery.data?.count;
-		if (!c) return undefined;
-		return c[key];
-	}
-
-	// Duplicates counts for the sidebar badge. Stacks is a cheap
-	// PhotoPrism query so we always fetch it; cross-folder is an
-	// O(disk) scan, so the sidebar only *observes* its cache
-	// (enabled:false) and the duplicates page itself is what populates
-	// it on first visit. Both share queryKeys with the /duplicates
-	// view so cache is reused.
+	// Stacks + cross-folder duplicate caches are warmed here so the
+	// /duplicates view (and its review tab strip) hits a warm cache. The
+	// sidebar only observes these — cross-folder is an O(disk) scan, so it
+	// stays enabled:false and the duplicates page populates it on first visit.
 	const stacksQuery = createQuery<DuplicateGroup[]>(() => ({
-		queryKey: ['duplicates'],
-		queryFn: listDuplicateGroups,
+		queryKey: ['duplicates', userLibraryBase()],
+		queryFn: () => listDuplicateGroups(userLibraryBase()),
 		enabled: isAuthenticated(),
 		staleTime: 60_000
 	}));
+	// The cross-folder scan is server-scoped to the caller's effective
+	// library root (sidecar reads BasePath + the stored index sub-path
+	// itself), but the query is still keyed on userLibraryBase() so changing
+	// the index folder invalidates the stale, differently-scoped result.
 	const crossFolderQuery = createQuery<CrossFolderScanResult>(() => ({
-		queryKey: ['duplicates-cross-folder'],
+		queryKey: ['duplicates-cross-folder', userLibraryBase()],
 		queryFn: scanCrossFolderDuplicates,
 		enabled: false,
 		staleTime: 5 * 60_000
 	}));
 
-	// Notes-view badge. Cheap (one list round-trip, no fan-out) so we
-	// fetch eagerly — sharing the queryKey with /notes means the page hits
-	// the warm cache, and the ['photos', …] prefix lets existing mutation
-	// invalidations keep both in sync.
-	const notesQuery = createQuery<PhotoWithNote[]>(() => ({
-		queryKey: ['photos', 'with-notes'],
-		queryFn: listPhotosWithNotes,
-		enabled: isAuthenticated(),
-		staleTime: 60_000
-	}));
-
 	const folderTree = $derived(
 		buildTree((foldersQuery.data ?? []).map((f) => f.Path))
 	);
 
-	// Per-folder photo counts. PhotoPrism's /folders/originals reports
-	// FileCount: 0 for every folder, so the sidecar /folders/counts
-	// endpoint resolves them in one round-trip (see listFolderCounts).
-	// Key the query off the folder-path list so it refetches when folders
-	// are added/renamed/deleted, and share the ['photos', …] prefix so it
-	// invalidates alongside the other photo caches whenever a mutation
-	// lands.
-	//
-	// `countsReady` gates the query until just after the sidebar's first
-	// paint. Even though the sidecar response is small, the per-folder
-	// fan-out it does to PhotoPrism still takes a few hundred ms cold;
-	// blocking it on idle means the folder list paints immediately and
-	// the count badges fade in instead of holding back the whole tree.
-	const folderPaths = $derived((foldersQuery.data ?? []).map((f) => f.Path));
-	let countsReady = $state(false);
-	if (browser) {
-		const kick = () => (countsReady = true);
-		// requestIdleCallback isn't in Safari yet; fall back to a short
-		// timeout so the deferral is still bounded.
-		const ric = (window as Window & { requestIdleCallback?: (cb: () => void) => number })
-			.requestIdleCallback;
-		if (typeof ric === 'function') ric(kick);
-		else setTimeout(kick, 200);
-	}
-	const folderCountsQuery = createQuery<Record<string, number>>(() => ({
-		queryKey: ['photos', 'folder-counts', [...folderPaths].sort()],
-		queryFn: () => listFolderCounts(folderPaths),
-		enabled: isAuthenticated() && folderPaths.length > 0 && countsReady,
-		staleTime: 60_000
-	}));
-	const folderCounts = $derived(folderCountsQuery.data ?? {});
-
-	// Root entry shows "the user's library" using the same filter the
-	// timeline applies at folderPath=='/' — empty q, which PhotoPrism
-	// resolves to the visible listing (no archived / hidden / review).
-	// Earlier this used /config's `count.all`, but that aggregate
-	// includes those buckets and didn't match what the user can actually
-	// click "select all" on; the discrepancy was confusing
-	// (LeftSidebar said 357, the action bar said ~329).
-	//
-	// `scopedRootCountQuery` retains the sidecar fan-out for users with
-	// a BasePath — `listFolderCounts(['''])` resolves `''` through
-	// `toOriginalsPath` to the user's BasePath and recurses, so it picks
-	// up the same subset PhotoPrism would. Empty BasePath admins use the
-	// PhotoPrism count-via-X-Count path so both surfaces agree.
-	const scopedRootCountQuery = createQuery<Record<string, number>>(() => ({
-		queryKey: ['photos', 'root-count', userBasePath()],
-		queryFn: () => listFolderCounts(['']),
-		enabled: isAuthenticated() && userBasePath() !== '',
-		staleTime: 60_000
-	}));
-	const visibleRootCountQuery = createQuery<number>(() => ({
-		queryKey: ['photos', 'visible-root-count', userBasePath()],
-		// `merged: true` so the count matches the timeline's photo entries
-		// (one per logical photo) rather than its file-row total. Without
-		// it, sidecar/companion files inflate the badge — e.g. a HEIC + JPG
-		// pair counts twice — and "select all" in the timeline never
-		// reaches the badge's number.
-		queryFn: () => countPhotos(scoped(''), { merged: true }),
-		enabled: isAuthenticated() && userBasePath() === '' && isAdminUser,
-		staleTime: 60_000
-	}));
-	const rootCount = $derived(
-		userBasePath() === ''
-			? isAdminUser
-				? (visibleRootCountQuery.data ?? 0)
-				: 0
-			: (scopedRootCountQuery.data?.[''] ?? 0)
-	);
-
-	// Archive nav entry uses this derived value rather than peeking at
-	// configQuery directly so the scoped path is invisible to the
-	// manageViews[] declarations.
-	const archivedBadge = $derived(bucketCount('archived', archivedCountQuery));
+	// Gates admin-only entry points lower in the sidebar.
+	const isAdminUser = $derived(session.user?.Role === 'admin');
 
 	const createMut = createMutation(() => ({
 		mutationFn: (title: string) => createHeap(title),
@@ -303,9 +178,6 @@
 			toast.error(err instanceof Error ? err.message : 'Could not duplicate heap')
 	}));
 
-	// Heap currently being converted (move/copy to folder). Setting this
-	// mounts <HeapConvertDialog>; the dialog clears it on close.
-	let convertingHeap = $state<PpAlbum | null>(null);
 
 	// Library/admin settings dialog visibility.
 	let settingsOpen = $state(false);
@@ -333,45 +205,13 @@
 		if (browser) localStorage.setItem(ROOT_OPEN_KEY, rootExpanded ? '1' : '0');
 	}
 
-	// Tags-submenu collapse state. Same dedicated-key pattern as `rootExpanded`
-	// above (keeping it out of `view.metadataSections`, which is reserved for
-	// the right-sidebar metadata panel). Defaults to collapsed so the sidebar
-	// doesn't grow on first paint.
-	const TAGS_OPEN_KEY = 'mule_tags_expanded';
-	let tagsExpanded = $state(loadTagsExpanded());
-	function loadTagsExpanded(): boolean {
-		if (!browser) return false;
-		const raw = localStorage.getItem(TAGS_OPEN_KEY);
-		return raw === '1';
-	}
-	function toggleTags() {
-		tagsExpanded = !tagsExpanded;
-		if (browser) localStorage.setItem(TAGS_OPEN_KEY, tagsExpanded ? '1' : '0');
-	}
-
-	// Review-submenu collapse state. Mirrors `tagsExpanded` so the Review
-	// row in Manage can expose the same set of tabs the /review page shows
-	// (cause groups + duplicates panels). Defaults to collapsed.
-	const REVIEW_OPEN_KEY = 'mule_review_expanded';
-	let reviewExpanded = $state(loadReviewExpanded());
-	function loadReviewExpanded(): boolean {
-		if (!browser) return false;
-		return localStorage.getItem(REVIEW_OPEN_KEY) === '1';
-	}
-	function toggleReview() {
-		reviewExpanded = !reviewExpanded;
-		if (browser) localStorage.setItem(REVIEW_OPEN_KEY, reviewExpanded ? '1' : '0');
-	}
-
 	// Cause-tab list is dynamic (only buckets with hits show up on /review),
-	// so the sidebar mirrors that by reusing the same query. Gated on
-	// `reviewExpanded` to avoid paying the /photos round-trip for users who
-	// never expand the section; the queryKey is shared with the /review page
-	// so visiting that route warms the cache for free.
+	// so the sidebar mirrors that by reusing the same query. The queryKey is
+	// shared with the /review page so visiting that route warms the cache for free.
 	const reviewGroupsQuery = createQuery<ReviewGroup[]>(() => ({
 		queryKey: ['review-groups'],
 		queryFn: listReviewGroups,
-		enabled: isAuthenticated() && reviewExpanded,
+		enabled: isAuthenticated(),
 		staleTime: 30_000
 	}));
 
@@ -401,7 +241,8 @@
 		keywords: 'Keywords',
 		people: 'People',
 		colors: 'Colors',
-		ratings: 'Ratings'
+		ratings: 'Ratings',
+		countries: 'Countries'
 	};
 
 	function isTagCategoryActive(cat: TagCategory): boolean {
@@ -430,6 +271,17 @@
 		session.user?.DisplayName?.trim() || session.user?.Name || '/'
 	);
 
+	// When the user has narrowed their library to an index sub-folder, the
+	// root row stands for that sub-folder — surface its leaf name so it's
+	// obvious the tree is re-rooted rather than showing the whole account.
+	const rootSubLabel = $derived(
+		prefs.indexSubpath === '' ? '' : (prefs.indexSubpath.split('/').pop() ?? '')
+	);
+	const rootTitle = $derived.by(() => {
+		const base = userBasePath() === '' ? 'Your library' : `Your library (${userBasePath()})`;
+		return prefs.indexSubpath === '' ? base : `${base} → ${prefs.indexSubpath}`;
+	});
+
 	async function onSignOut() {
 		await logout();
 		await goto('/login', { replaceState: true });
@@ -446,10 +298,15 @@
 	}
 
 	const createFolderMut = createMutation(() => ({
-		mutationFn: (relPath: string) => createFolder(relPath),
+		// The sidebar deals in user-relative paths (BasePath stripped); the
+		// sidecar operates on originals-relative paths. Translate on the way
+		// out (toOriginalsPath) and back for display (toUserPath), exactly like
+		// the move flow — otherwise a BasePath user's folder ops resolve to the
+		// wrong directory and the sidecar returns "invalid path".
+		mutationFn: (relPath: string) => createFolder(toOriginalsPath(relPath)),
 		onSuccess: (r) => {
 			qc.invalidateQueries({ queryKey: ['folders'] });
-			toast.success(`Folder created: ${r.path}`);
+			toast.success(`Folder created: ${toUserPath(r.path)}`);
 		},
 		onError: (err) =>
 			toast.error(err instanceof Error ? err.message : 'Could not create folder')
@@ -457,36 +314,59 @@
 
 	const renameFolderMut = createMutation(() => ({
 		mutationFn: (args: { rel: string; newName: string }) =>
-			renameFolder(args.rel, args.newName),
+			renameFolder(toOriginalsPath(args.rel), args.newName),
 		onSuccess: (r) => {
 			qc.invalidateQueries({ queryKey: ['folders'] });
 			qc.invalidateQueries({ queryKey: ['photos'] });
+			// Handler returns originals-relative paths; map back to the UI's
+			// user-relative space before comparing/navigating.
+			const oldUi = toUserPath(r.oldPath);
+			const newUi = toUserPath(r.newPath);
 			// If the active folder filter was on this folder, follow the rename.
-			if (filters.folderPath === r.oldPath) {
-				setFolderPath(r.newPath);
-				const params = new URLSearchParams({ folder: r.newPath });
+			if (filters.folderPath === oldUi) {
+				setFolderPath(newUi);
+				const params = new URLSearchParams({ folder: newUi });
 				void goto(`/?${params.toString()}`, { keepFocus: true, noScroll: true });
 			}
-			toast.success(`Renamed: ${r.oldPath} → ${r.newPath}`);
+			toast.success(`Renamed: ${oldUi} → ${newUi}`);
 		},
 		onError: (err) =>
 			toast.error(err instanceof Error ? err.message : 'Rename failed')
 	}));
 
 	const deleteFolderMut = createMutation(() => ({
-		mutationFn: (rel: string) => deleteFolder(rel),
+		mutationFn: (rel: string) => deleteFolder(toOriginalsPath(rel)),
 		onSuccess: (r) => {
 			qc.invalidateQueries({ queryKey: ['folders'] });
-			if (filters.folderPath && filters.folderPath.startsWith(r.path)) {
+			const ui = toUserPath(r.path);
+			if (filters.folderPath && filters.folderPath.startsWith(ui)) {
 				setFolderPath(null);
 				void goto('/', { keepFocus: true, noScroll: true });
 			}
-			toast.success(`Folder deleted: ${r.path}`);
+			toast.success(`Folder deleted: ${ui}`);
 		},
 		onError: (err) =>
 			toast.error(err instanceof Error ? err.message : 'Delete failed')
 	}));
 
+	// One-click "reindex new files": kicks off a scan of the whole library
+	// with rescan off, so PhotoPrism only picks up files it hasn't indexed
+	// yet. Progress streams in via the WebSocket indexer pill, and the grid
+	// auto-refreshes as new tiles land (see indexer store). Guarded against
+	// double-trigger while a scan is already running.
+	async function onReindex() {
+		if (indexer.active) return;
+		const tid = toast.loading('Starting reindex…');
+		try {
+			// Scope the one-click reindex to the effective library root
+			// (BasePath + chosen index sub-path) rather than the whole library.
+			await startIndex({ path: '/' + toOriginalsPath('/'), rescan: false, cleanup: false });
+			toast.success('Reindex started — new files will appear as they’re found', { id: tid });
+		} catch (err) {
+			toast.error(err instanceof Error ? err.message : 'Reindex failed', { id: tid });
+		}
+	}
+
 	function onCreateFolder(parent: string | null = null) {
 		const name = prompt(parent ? `New subfolder under "${parent}"` : 'New folder name')?.trim();
 		if (!name) return;
@@ -542,7 +422,7 @@
 	//
 	// `getCount` is a getter (not a snapshot) so the badge reads the latest
 	// derived value on every render — the arrays themselves are constant.
-	// Map and Tags intentionally render without a count badge; the count
+	// Tags intentionally renders without a count badge; the count
 	// columns inside the TagsBrowserSidebar are the canonical surface for
 	// per-tag totals. Review rolls in the duplicates tabs hosted under
 	// /review — stacks always contributes; cross-folder only contributes
@@ -557,10 +437,9 @@
 	// separate "everything regardless of folder" destination would just
 	// duplicate it for users whose photos live under the root.
 	const views: ViewItem[] = [
-		{ kind: 'route', href: '/map', label: 'Map', getCount: () => undefined }
 		// Tags is rendered as a bespoke expandable block below the
 		// `views` loop — it has sub-categories (Labels/Keywords/Colors/
-		// Ratings) and a chevron, neither of which fits the flat
+		// Ratings/Countries) and a chevron, neither of which fits the flat
 		// section/route ViewItem shape. Notes lives under that expandable
 		// alongside the tag categories.
 	];
@@ -575,7 +454,7 @@
 	// tab subitems). This list carries the flat Manage entries that
 	// follow it.
 	const manageViews: ViewItem[] = [
-		{ kind: 'section', id: 'archive', label: 'Archive', getCount: () => archivedBadge }
+		{ kind: 'section', id: 'archive', label: 'Archive', getCount: () => undefined }
 	];
 
 	function isRouteActive(href: string): boolean {
@@ -649,6 +528,17 @@
 			<span class="flex-1 text-[10px] font-semibold uppercase tracking-[0.14em] text-muted-foreground">
 				Library
 			</span>
+			<button
+				class="rounded p-0.5 text-muted-foreground hover:bg-accent hover:text-foreground group-hover/header:opacity-100"
+				class:opacity-0={!indexer.active}
+				class:opacity-100={indexer.active}
+				onclick={onReindex}
+				disabled={indexer.active}
+				title="Reindex new files"
+				aria-label="Reindex new files"
+			>
+				<RefreshCw class="h-3 w-3 {indexer.active ? 'animate-spin' : ''}" />
+			</button>
 			<button
 				class="rounded p-0.5 text-muted-foreground opacity-0 hover:bg-accent hover:text-foreground group-hover/header:opacity-100"
 				onclick={() => (settingsOpen = true)}
@@ -683,38 +573,31 @@
 			{#if hasSubfolders}
 				<button
 					type="button"
-					class="flex h-[18px] w-4 items-center justify-center text-[10px]"
+					class="flex h-[18px] w-5 items-center justify-center rounded hover:text-foreground"
 					class:text-muted-foreground={!rootActive}
 					onclick={toggleRoot}
 					title={rootExpanded ? 'Collapse' : 'Expand'}
 					aria-label={rootExpanded ? 'Collapse root' : 'Expand root'}
 				>
-					{rootExpanded ? '▾' : '▸'}
+					<ChevronRight
+						class="h-4 w-4 transition-transform duration-150 {rootExpanded ? 'rotate-90' : ''}"
+					/>
 				</button>
 			{:else}
 				<!-- Spacer keeps chevronless rows aligned with their chevroned
 				     peers, so labels share a common left edge across the sidebar. -->
-				<span class="inline-block h-[18px] w-4" aria-hidden="true"></span>
+				<span class="inline-block h-[18px] w-5" aria-hidden="true"></span>
 			{/if}
-			<!--
-				Count badge lives INSIDE the button so the entire row (label
-				+ badge) is one hit target — the badge is the most visually
-				prominent element on the row and was previously a dead zone.
-			-->
 			<button
 				type="button"
-				class="flex min-w-0 flex-1 items-center pl-1 text-left"
+				class="flex min-w-0 flex-1 items-center gap-1 pl-1 text-left"
 				onclick={() => pickFolder('/')}
-				title={userBasePath() === '' ? 'Your library' : `Your library (${userBasePath()})`}
+				title={rootTitle}
 			>
 				<span class="truncate">{rootLabel}</span>
-				{#if configQuery.data}
-					<span
-						class="ml-auto flex h-4 min-w-[24px] flex-shrink-0 items-center justify-center rounded px-1 text-[10px] tabular-nums {rootActive
-							? 'bg-primary-foreground/15 text-primary-foreground'
-							: 'bg-secondary text-muted-foreground'}"
-					>
-						{rootCount >= 1000 ? '1000+' : rootCount}
+				{#if rootSubLabel}
+					<span class="truncate text-muted-foreground" class:text-primary-foreground={rootActive}>
+						/ {rootSubLabel}
 					</span>
 				{/if}
 			</button>
@@ -734,8 +617,10 @@
 				</KebabMenu>
 			</div>
 		</div>
-		{#if foldersQuery.isPending}
+		{#if foldersQuery.isLoading}
 			<InlineLoader size="sm" label="Loading folders…" />
+		{:else if foldersQuery.isError}
+			<EmptyState size="compact" tone="destructive" icon={FolderOpen} title="Failed to load folders" description="Try reloading the page." />
 		{:else if !hasSubfolders}
 			<EmptyState size="compact" icon={FolderOpen} title="No subfolders" />
 		{:else if rootExpanded}
@@ -752,7 +637,7 @@
 				onRename={onRenameFolder}
 				onDelete={onDeleteFolder}
 				onCreateChild={(parent) => onCreateFolder(parent)}
-				counts={folderCounts}
+				onMove={(path) => openMove({ kind: 'folder', path })}
 			/>
 		{/if}
 	</div>
@@ -799,16 +684,9 @@
 							class="flex min-w-0 flex-1 items-center pl-6 text-left"
 							onclick={() => navigateTo('heap', heap.UID)}
 							ondblclick={() => onRenameHeap(heap)}
-							title={`${heap.Title} (${heap.PhotoCount ?? 0})`}
+							title={heap.Title}
 						>
 							<span class="truncate">{heap.Title}</span>
-							<span
-								class="ml-auto flex h-4 min-w-[24px] flex-shrink-0 items-center justify-center rounded px-1 text-[10px] tabular-nums {active
-									? 'bg-primary-foreground/15 text-primary-foreground'
-									: 'bg-secondary text-muted-foreground'}"
-							>
-								{heap.PhotoCount ?? 0}
-							</span>
 						</button>
 						<div class="ml-1 hidden group-hover:block has-[[data-state=open]]:block">
 							<KebabMenu label="Heap actions">
@@ -835,7 +713,7 @@
 								</Item>
 								<Item
 									class="flex cursor-pointer items-center gap-2 rounded px-2 py-1.5 text-[12px] outline-none hover:bg-accent focus:bg-accent"
-									onSelect={() => (convertingHeap = heap)}
+									onSelect={() => openMove({ kind: 'heap', heap })}
 								>
 									<FolderInput class="h-3.5 w-3.5 text-muted-foreground" />
 									Move to folder…
@@ -867,74 +745,34 @@
 		{#each views as v (v.kind === 'section' ? `s:${v.id}` : `r:${v.href}`)}
 			{@render viewRow(v)}
 		{/each}
-		<!--
-			Tags expandable. Whole row is a toggle (chevron + label); there is
-			no landing page at /tags — selecting a sub-category is the only way
-			into a real view. Counts intentionally live in the TagsBrowserSidebar
-			(secondary sidebar) so this row stays a pure navigator.
-		-->
-		<button
-			type="button"
-			class="group flex h-[22px] w-full items-center rounded pr-2 text-left text-[12px] leading-tight hover:bg-accent"
-			style="padding-left: 4px;"
-			onclick={toggleTags}
-			title={tagsExpanded ? 'Collapse tags' : 'Expand tags'}
-			aria-expanded={tagsExpanded}
-		>
-			<span
-				class="flex h-[18px] w-4 items-center justify-center text-[10px] text-muted-foreground"
-			>
-				{tagsExpanded ? '▾' : '▸'}
-			</span>
-			<span class="flex min-w-0 flex-1 items-center pl-1">
-				<span class="truncate">Tags</span>
-			</span>
-		</button>
-		{#if tagsExpanded}
-			<!--
-				Notes lives alongside the tag categories — same indent and row
-				chrome — but routes to /notes rather than /tags/*. Tucked at
-				the top of the expandable so it's the first thing the user
-				sees when opening Tags. Count badge renders once the shared
-				['photos', 'with-notes'] query has resolved.
-			-->
+		<!-- Notes -->
+		{#if true}
 			{@const notesActive = isNotesActive()}
-			{@const notesCount = notesQuery.data?.length}
 			<a
 				href="/notes"
-				class="flex h-[22px] items-center rounded pr-2 text-[12px] leading-tight hover:bg-accent"
+				class="flex h-[22px] items-center rounded pl-6 pr-2 text-[12px] leading-tight hover:bg-accent"
 				class:bg-primary={notesActive}
 				class:text-primary-foreground={notesActive}
 				class:hover:bg-primary={notesActive}
-				style="padding-left: 36px;"
 			>
 				<span class="truncate">Notes</span>
-				{#if notesCount !== undefined}
-					<span
-						class="ml-auto flex h-4 min-w-[24px] flex-shrink-0 items-center justify-center rounded px-1 text-[10px] tabular-nums {notesActive
-							? 'bg-primary-foreground/15 text-primary-foreground'
-							: 'bg-secondary text-muted-foreground'}"
-					>
-						{notesCount}
-					</span>
-				{/if}
 			</a>
-			{#each TAG_CATEGORIES as cat (cat)}
-				{@const active = isTagCategoryActive(cat)}
-				<a
-					href={`/tags/${cat}`}
-					class="flex h-[22px] items-center rounded pr-2 text-[12px] leading-tight hover:bg-accent"
-					class:bg-primary={active}
-					class:text-primary-foreground={active}
-					class:hover:bg-primary={active}
-					style="padding-left: 36px;"
-					onmouseenter={cat === 'keywords' ? prefetchKeywords : undefined}
-					onfocus={cat === 'keywords' ? prefetchKeywords : undefined}
-				>
-					<span class="truncate">{TAG_CATEGORY_LABELS[cat]}</span>
-				</a>
-			{/each}
 		{/if}
+		<!-- Tag categories -->
+		{#each TAG_CATEGORIES as cat (cat)}
+			{@const active = isTagCategoryActive(cat)}
+			<a
+				href={`/tags/${cat}`}
+				class="flex h-[22px] items-center rounded pl-6 pr-2 text-[12px] leading-tight hover:bg-accent"
+				class:bg-primary={active}
+				class:text-primary-foreground={active}
+				class:hover:bg-primary={active}
+				onmouseenter={cat === 'keywords' ? prefetchKeywords : undefined}
+				onfocus={cat === 'keywords' ? prefetchKeywords : undefined}
+			>
+				<span class="truncate">{TAG_CATEGORY_LABELS[cat]}</span>
+			</a>
+		{/each}
 	</div>
 
 	<!-- Manage — curation flows that decide a photo's fate. Same
@@ -946,57 +784,28 @@
 				Manage
 			</span>
 		</div>
-		<!--
-			Review expandable. Mirrors the Tags affordance — pure toggle
-			with no landing page; the only way into a tab is to expand and
-			pick a subitem. Cause buckets are dynamic (only buckets with
-			hits show up); Stacks/Cross-folder are always present.
-		-->
-		<button
-			type="button"
-			class="group flex h-[22px] w-full items-center rounded pr-2 text-left text-[12px] leading-tight hover:bg-accent"
-			style="padding-left: 4px;"
-			onclick={toggleReview}
-			title={reviewExpanded ? 'Collapse review' : 'Expand review'}
-			aria-expanded={reviewExpanded}
-		>
-			<span
-				class="flex h-[18px] w-4 items-center justify-center text-[10px] text-muted-foreground"
+		<!-- Review tabs -->
+		{#each reviewTabs as t (t.id)}
+			{@const active = isReviewTabActive(t.id)}
+			<a
+				href={`/review?tab=${t.id}`}
+				class="flex h-[22px] items-center rounded pl-6 pr-2 text-[12px] leading-tight hover:bg-accent"
+				class:bg-primary={active}
+				class:text-primary-foreground={active}
+				class:hover:bg-primary={active}
 			>
-				{reviewExpanded ? '▾' : '▸'}
-			</span>
-			<span class="flex min-w-0 flex-1 items-center pl-1">
-				<span class="truncate">Review</span>
-			</span>
-		</button>
-		{#if reviewExpanded}
-			{#each reviewTabs as t (t.id)}
-				{@const active = isReviewTabActive(t.id)}
-				<a
-					href={`/review?tab=${t.id}`}
-					class="flex h-[22px] items-center rounded pr-2 text-[12px] leading-tight hover:bg-accent"
-					class:bg-primary={active}
-					class:text-primary-foreground={active}
-					class:hover:bg-primary={active}
-					style="padding-left: 36px;"
-				>
-					<span class="truncate">{t.label}</span>
-				</a>
-			{/each}
-			<!--
-				Hidden lives under Review since it's the resting place for
-				photos dismissed during review. Section-nav (not a ?tab=),
-				so it's a button that flips filters.section like the flat
-				Manage entries — just with the subitem indent.
-			-->
+				<span class="truncate">{t.label}</span>
+			</a>
+		{/each}
+		<!-- Hidden -->
+		{#if true}
 			{@const hiddenActive = isActive('hidden')}
 			<button
 				type="button"
-				class="flex h-[22px] w-full items-center rounded pr-2 text-left text-[12px] leading-tight hover:bg-accent"
+				class="flex h-[22px] w-full items-center rounded pl-6 pr-2 text-left text-[12px] leading-tight hover:bg-accent"
 				class:bg-primary={hiddenActive}
 				class:text-primary-foreground={hiddenActive}
 				class:hover:bg-primary={hiddenActive}
-				style="padding-left: 36px;"
 				onclick={() => navigateTo('hidden')}
 			>
 				<span class="truncate">Hidden</span>
@@ -1068,7 +877,6 @@
 </footer>
 </div>
 
-<HeapConvertDialog heap={convertingHeap} onClose={() => (convertingHeap = null)} />
 <SettingsDialog open={settingsOpen} onClose={() => (settingsOpen = false)} />
 <GeneralSettingsDialog
 	open={generalSettingsOpen}

web/src/lib/components/layout/MoveToFolderDialog.svelte

@@ -0,0 +1,311 @@
+<!--
+	Move/copy photos into a folder under originals/ — the single dialog behind
+	every "move to folder" entry point (heap kebab, folder kebab, the grid's
+	BulkActionBar button, and the `m` shortcut). Driven by the moveDialog store
+	so the picker UI and the move/copy wiring live in exactly one place.
+
+	Three subjects:
+	  • heap   — move/copy an album's photos into a folder (optional subfolder,
+	             optional delete-heap-after). The original behaviour.
+	  • photos — move/copy a UID selection from the grid. Same options minus
+	             delete-heap.
+	  • folder — reparent a folder: move the directory (and its subfolders)
+	             under a chosen destination parent. Move-only, no subfolder; the
+	             folder keeps its own name. The picker excludes the folder
+	             itself and its descendants.
+
+	Picker reuses the readonly FolderTree; the dialog owns the selection
+	(`pickedPath`) so it never fights the global folderPath filter.
+-->
+<script lang="ts">
+	import { goto } from '$app/navigation';
+	import { Dialog } from 'bits-ui';
+	import { createQuery, useQueryClient } from '@tanstack/svelte-query';
+	import { toast } from 'svelte-sonner';
+	import { FolderInput, FolderOpen, Loader2 } from 'lucide-svelte';
+	import { EmptyState, InlineLoader } from '$lib/components/feedback';
+	import {
+		convertHeap,
+		movePhotosToFolder,
+		moveFolder,
+		listFolders,
+		type PpFolder
+	} from '$lib/services/photoprism';
+	import { filters, setSection, setFolderPath } from '$lib/stores/filters.svelte';
+	import { isAuthenticated, toOriginalsPath, userLibraryBase } from '$lib/stores/session.svelte';
+	import { moveDialog, closeMove } from '$lib/stores/moveDialog.svelte';
+	import FolderTree, { buildTree } from './FolderTree.svelte';
+
+	const qc = useQueryClient();
+
+	// Reuse the same folders cache the sidebar uses — same key so we share the
+	// in-flight request, and the picker invalidates it on success.
+	const foldersQuery = createQuery<PpFolder[]>(() => ({
+		queryKey: ['folders', userLibraryBase()],
+		queryFn: listFolders,
+		enabled: isAuthenticated()
+	}));
+
+	const subject = $derived(moveDialog.subject);
+	const kind = $derived(subject?.kind);
+	const open = $derived(subject !== null);
+
+	// For folder reparent, exclude the folder itself and everything under it —
+	// you can't move a directory into its own subtree.
+	const folderTree = $derived.by(() => {
+		const paths = (foldersQuery.data ?? []).map((f) => f.Path);
+		if (subject?.kind === 'folder') {
+			const self = subject.path;
+			return buildTree(paths.filter((p) => p !== self && !p.startsWith(self + '/')));
+		}
+		return buildTree(paths);
+	});
+
+	const showOptions = $derived(kind === 'heap' || kind === 'photos');
+	const showDeleteHeap = $derived(kind === 'heap');
+
+	const folderName = $derived(
+		subject?.kind === 'folder' ? (subject.path.split('/').pop() ?? subject.path) : ''
+	);
+	const headerTitle = $derived.by(() => {
+		if (subject?.kind === 'folder') return 'Move folder';
+		const verb = mode === 'copy' ? 'Copy' : 'Move';
+		if (subject?.kind === 'heap') return `${verb} heap to folder`;
+		return `${verb} photos to folder`;
+	});
+	const headerDesc = $derived.by(() => {
+		if (subject?.kind === 'heap') {
+			const n = subject.heap.PhotoCount ?? 0;
+			return `${subject.heap.Title ?? ''} · ${n} photo${n === 1 ? '' : 's'}`;
+		}
+		if (subject?.kind === 'photos') {
+			const n = subject.uids.length;
+			return `${n} photo${n === 1 ? '' : 's'} selected`;
+		}
+		if (subject?.kind === 'folder') return `${folderName} → pick a destination`;
+		return '';
+	});
+
+	let pickedPath = $state<string | null>(null);
+	let mode = $state<'move' | 'copy'>('move');
+	let subfolder = $state('');
+	let deleteHeap = $state(false);
+	let submitting = $state(false);
+
+	// Reset draft state whenever a new subject is picked (or the dialog closes
+	// and reopens), so the form is blank on every fresh open.
+	$effect(() => {
+		void subject;
+		pickedPath = null;
+		mode = 'move';
+		subfolder = '';
+		deleteHeap = false;
+		submitting = false;
+	});
+
+	// Copy mode doesn't change membership, so "delete heap after" is
+	// meaningless. Force-clear it when the user flips back to copy.
+	$effect(() => {
+		if (mode === 'copy' && deleteHeap) deleteHeap = false;
+	});
+
+	function moveSummary(verb: string, count: number, errors: number): string {
+		const tail = errors > 0 ? ` · ${errors} skipped` : '';
+		return `${verb} ${count} photo${count === 1 ? '' : 's'}${tail}`;
+	}
+
+	async function submit() {
+		const s = moveDialog.subject;
+		// pickedPath === '' is the root selection; distinguish it from `null`
+		// (nothing picked) so a falsy check doesn't wrongly block root.
+		if (!s || pickedPath === null || submitting) return;
+		submitting = true;
+
+		// Snapshot the draft before closing — closeMove() nulls the subject,
+		// which the reset effect uses to wipe pickedPath/mode/subfolder.
+		const dest = pickedPath;
+		const opMode = mode;
+		const sub = subfolder.trim() || null;
+		const delHeap = mode === 'move' && deleteHeap;
+		const labelName = folderName;
+
+		// Close the dialog immediately and run the move in the background. The
+		// move can be slow (a folder/heap with many files triggers a real
+		// disk move + reindex) and its progress surfaces in the header pill;
+		// keeping the modal + overlay up would hide exactly the feedback the
+		// user is waiting on. Mirrors the archive flow (toast + header pill).
+		closeMove();
+
+		const verbing = opMode === 'copy' ? 'Copying' : 'Moving';
+		const tid = toast.loading(`${verbing}…`);
+		try {
+			if (s.kind === 'heap') {
+				const r = await convertHeap(s.heap.UID, {
+					targetFolder: toOriginalsPath(dest),
+					mode: opMode,
+					subfolder: sub,
+					deleteHeap: delHeap
+				});
+				qc.invalidateQueries({ queryKey: ['photos'] });
+				qc.invalidateQueries({ queryKey: ['folders'] });
+				qc.invalidateQueries({ queryKey: ['heaps'] });
+				toast.success(
+					moveSummary(opMode === 'copy' ? 'Copied' : 'Moved', opMode === 'copy' ? r.copied : r.moved, r.errors.length),
+					{ id: tid }
+				);
+				if (r.heap_deleted && filters.section === 'heap' && filters.heapUid === s.heap.UID) {
+					setSection('all-photos');
+					void goto('/', { keepFocus: true, noScroll: true });
+				}
+			} else if (s.kind === 'photos') {
+				const r = await movePhotosToFolder({
+					uids: s.uids,
+					targetFolder: toOriginalsPath(dest),
+					mode: opMode,
+					subfolder: sub
+				});
+				qc.invalidateQueries({ queryKey: ['photos'] });
+				qc.invalidateQueries({ queryKey: ['folders'] });
+				toast.success(
+					moveSummary(opMode === 'copy' ? 'Copied' : 'Moved', opMode === 'copy' ? r.copied : r.moved, r.errors.length),
+					{ id: tid }
+				);
+			} else {
+				// Folder reparent (move only). Translate both the folder's own
+				// path and the destination parent to originals-relative for the
+				// sidecar, which moves real directories on disk.
+				await moveFolder(toOriginalsPath(s.path), toOriginalsPath(dest));
+				qc.invalidateQueries({ queryKey: ['photos'] });
+				qc.invalidateQueries({ queryKey: ['folders'] });
+				const newUiPath = dest === '' ? labelName : `${dest}/${labelName}`;
+				toast.success(`Moved ${labelName} → ${dest === '' ? '/' : dest}`, { id: tid });
+				// If we just moved the folder the timeline is showing, follow it.
+				if (filters.folderPath === s.path) setFolderPath(newUiPath);
+			}
+		} catch (err) {
+			toast.error(err instanceof Error ? err.message : 'Move failed', { id: tid });
+		}
+	}
+</script>
+
+<Dialog.Root
+	{open}
+	onOpenChange={(o) => {
+		if (!o) closeMove();
+	}}
+>
+	<Dialog.Portal>
+		<Dialog.Overlay
+			class="fixed inset-0 z-40 bg-background/80 backdrop-blur-sm data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:animate-in data-[state=open]:fade-in-0"
+		/>
+		<Dialog.Content
+			class="fixed left-1/2 top-1/2 z-50 grid w-full max-w-[520px] -translate-x-1/2 -translate-y-1/2 gap-4 rounded-lg border border-border bg-card p-5 text-card-foreground shadow-lg outline-none data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[state=open]:animate-in data-[state=open]:fade-in-0 data-[state=open]:zoom-in-95"
+		>
+			<div class="flex items-start gap-2">
+				<FolderInput class="mt-0.5 h-4 w-4 text-muted-foreground" />
+				<div class="flex-1">
+					<Dialog.Title class="text-sm font-semibold leading-tight">
+						{headerTitle}
+					</Dialog.Title>
+					<Dialog.Description class="mt-1 text-xs text-muted-foreground">
+						{headerDesc}
+					</Dialog.Description>
+				</div>
+			</div>
+
+			<!-- Folder picker. Readonly FolderTree so the user can't kebab/rename
+			     their way out of the picker mid-flow. -->
+			<div class="rounded-md border border-border bg-background p-2">
+				<div class="mb-1 text-[10px] font-semibold uppercase tracking-[0.14em] text-muted-foreground">
+					{kind === 'folder' ? 'Destination parent' : 'Destination'}
+				</div>
+				<div class="max-h-[200px] overflow-y-auto">
+					{#if foldersQuery.isPending}
+						<InlineLoader size="sm" label="Loading folders…" />
+					{:else if (foldersQuery.data ?? []).length === 0}
+						<EmptyState
+							size="compact"
+							icon={FolderOpen}
+							title="No folders"
+							description="Create one from the sidebar first."
+						/>
+					{:else}
+						<!-- Root row: drop straight into originals/ (the user's root)
+						     without picking a subfolder. Empty string is the
+						     sidecar's "root" sentinel. -->
+						<button
+							type="button"
+							class="flex w-full items-center rounded px-2 py-1 text-left text-[12px] hover:bg-accent"
+							class:bg-primary={pickedPath === ''}
+							class:text-primary-foreground={pickedPath === ''}
+							class:hover:bg-primary={pickedPath === ''}
+							onclick={() => (pickedPath = '')}
+						>
+							/
+						</button>
+						<FolderTree
+							nodes={folderTree}
+							onPick={(p) => (pickedPath = p)}
+							selectedPath={pickedPath}
+							readonly
+						/>
+					{/if}
+				</div>
+			</div>
+
+			<!-- Move/copy + subfolder, hidden for folder reparent (always a move
+			     that keeps the folder's own name). -->
+			{#if showOptions}
+				<div class="space-y-2">
+					<div class="flex items-center gap-4 text-[12px]">
+						<label class="flex items-center gap-1.5">
+							<input type="radio" bind:group={mode} value="move" />
+							Move
+						</label>
+						<label class="flex items-center gap-1.5">
+							<input type="radio" bind:group={mode} value="copy" />
+							Copy
+						</label>
+					</div>
+					<label class="flex flex-col gap-1 text-[12px]">
+						<span class="text-muted-foreground">New subfolder (optional)</span>
+						<input
+							type="text"
+							placeholder="e.g. 2024-summer"
+							bind:value={subfolder}
+							class="rounded border border-input bg-background px-2 py-1 text-[12px] focus:outline-none focus:ring-2 focus:ring-ring"
+						/>
+					</label>
+					{#if showDeleteHeap}
+						<label class="flex items-center gap-1.5 text-[12px]">
+							<input type="checkbox" bind:checked={deleteHeap} disabled={mode === 'copy'} />
+							<span class:text-muted-foreground={mode === 'copy'}>Delete heap after move</span>
+						</label>
+					{/if}
+				</div>
+			{/if}
+
+			<div class="flex items-center justify-end gap-2 pt-1">
+				<button
+					type="button"
+					class="rounded border border-border px-3 py-1 text-[12px] hover:bg-accent"
+					onclick={closeMove}
+					disabled={submitting}
+				>
+					Cancel
+				</button>
+				<button
+					type="button"
+					class="flex items-center gap-1.5 rounded bg-primary px-3 py-1 text-[12px] text-primary-foreground hover:bg-primary/90 disabled:opacity-50"
+					onclick={submit}
+					disabled={pickedPath === null || submitting}
+				>
+					{#if submitting}
+						<Loader2 class="h-3 w-3 animate-spin" />
+					{/if}
+					{kind === 'folder' ? 'Move' : mode === 'copy' ? 'Copy' : 'Move'}
+				</button>
+			</div>
+		</Dialog.Content>
+	</Dialog.Portal>
+</Dialog.Root>

web/src/lib/components/layout/SettingsDialog.svelte

@@ -9,24 +9,30 @@
 	import { Dialog, Tabs } from 'bits-ui';
 	import { createMutation, createQuery, useQueryClient } from '@tanstack/svelte-query';
 	import { toast } from 'svelte-sonner';
-	import { AlertCircle, CheckCircle2, Loader2, RefreshCw, Settings, X } from 'lucide-svelte';
+	import { AlertCircle, CheckCircle2, FolderOpen, Loader2, RefreshCw, Settings, X } from 'lucide-svelte';
 	import { EmptyState, InlineLoader } from '$lib/components/feedback';
 	import {
-		cancelImport,
 		cancelIndex,
 		getConfig,
 		getErrors,
 		getSettings,
+		getIndexSubpath,
+		listFoldersUnderBase,
 		saveSettings,
-		startImport,
+		setIndexSubpath,
 		startIndex,
-		type ImportBody,
 		type IndexBody,
+		type PpFolder,
 		type PpLogEntry,
 		type PpSettings
 	} from '$lib/services/photoprism';
 	import type { PpClientConfig } from '$lib/types/photoprism';
-	import { userBasePath } from '$lib/stores/session.svelte';
+	import {
+		prefs,
+		setIndexSubpathState,
+		toOriginalsPath
+	} from '$lib/stores/session.svelte';
+	import FolderTree, { buildTree } from './FolderTree.svelte';
 
 	interface Props {
 		open: boolean;
@@ -36,7 +42,7 @@
 
 	const qc = useQueryClient();
 
-	let activeTab = $state<'library' | 'index' | 'import' | 'logs' | 'about'>('library');
+	let activeTab = $state<'library' | 'index' | 'logs' | 'about'>('library');
 
 	// ── Library tab ───────────────────────────────────────────────────────
 	// Pull settings only while the dialog is open so we don't keep them
@@ -62,7 +68,6 @@
 		return {
 			...s,
 			index: s.index ?? {},
-			import: s.import ?? {},
 			stack: s.stack ?? {},
 			download: s.download ?? {}
 		};
@@ -94,17 +99,68 @@
 		if (settingsQuery.data) draft = normalize(structuredClone(settingsQuery.data));
 	}
 
+	// ── Index folder (per-user, server-side) ──────────────────────────────
+	// The originals-relative sub-folder, under the user's BasePath, that the
+	// whole app re-roots to (Library tree) and the reindex scopes to. Picked
+	// from the *full* BasePath tree (listFoldersUnderBase) so the user can
+	// choose any sub-folder — including ones outside the current root. Stored
+	// by the sidecar; mirrored into the `prefs` store so the sidebar reacts.
+	const subpathFoldersQuery = createQuery<PpFolder[]>(() => ({
+		queryKey: ['folders-under-base'],
+		queryFn: listFoldersUnderBase,
+		enabled: open && activeTab === 'library'
+	}));
+	const subpathTree = $derived(
+		buildTree((subpathFoldersQuery.data ?? []).map((f) => f.Path))
+	);
+
+	// Hydrate the picker selection from the server pref when the dialog opens,
+	// so it reflects the current choice instead of the in-memory store alone.
+	const indexPrefQuery = createQuery<string>(() => ({
+		queryKey: ['prefs'],
+		queryFn: getIndexSubpath,
+		enabled: open
+	}));
+	// Local selection: '' = whole folder. Seeded from the store, then from the
+	// server pref once it loads.
+	let pickedSubpath = $state<string>(prefs.indexSubpath);
+	$effect(() => {
+		if (open && indexPrefQuery.data !== undefined) {
+			pickedSubpath = indexPrefQuery.data;
+		}
+	});
+
+	const saveSubpathMut = createMutation(() => ({
+		mutationFn: (sub: string) => setIndexSubpath(sub),
+		onSuccess: (saved) => {
+			setIndexSubpathState(saved);
+			qc.setQueryData(['prefs'], saved);
+			// Re-root the sidebar tree + grid: both are keyed on the effective
+			// library base, which just changed.
+			qc.invalidateQueries({ queryKey: ['folders'] });
+			qc.invalidateQueries({ queryKey: ['photos'] });
+			toast.success(saved === '' ? 'Indexing whole folder' : `Index folder: ${saved}`);
+		},
+		onError: (err) =>
+			toast.error(err instanceof Error ? err.message : 'Could not save index folder')
+	}));
+
 	// ── Index tab ─────────────────────────────────────────────────────────
-	// Default the reindex path to the user's BasePath when scoping is on,
-	// so non-admins (and admins-with-BasePath) only rescan their own
-	// subtree. PhotoPrism's /index expects originals-relative paths with
-	// a leading slash; `'/'` means the whole library.
-	const _bp = userBasePath();
+	// Default the reindex path to the effective library root (BasePath +
+	// chosen index sub-path), so a manual run only rescans the user's working
+	// subtree. PhotoPrism's /index expects originals-relative paths with a
+	// leading slash; `'/'` means the whole library.
 	let indexForm = $state<IndexBody>({
-		path: _bp === '' ? '/' : `/${_bp}`,
+		path: '/' + toOriginalsPath('/'),
 		rescan: false,
 		cleanup: false
 	});
+	// SettingsDialog is mounted (open=false) before the index sub-path
+	// hydrates, so re-seed the manual-run path to the effective library root
+	// each time the dialog opens (and whenever the chosen root changes).
+	$effect(() => {
+		if (open) indexForm.path = '/' + toOriginalsPath('/');
+	});
 	const startIndexMut = createMutation(() => ({
 		mutationFn: (b: IndexBody) => startIndex(b),
 		onSuccess: (r) => toast.success(r.message || 'Indexing complete'),
@@ -118,21 +174,6 @@
 			toast.error(err instanceof Error ? err.message : 'Cancel failed')
 	}));
 
-	// ── Import tab ────────────────────────────────────────────────────────
-	let importForm = $state<ImportBody>({ path: '/', move: false, dest: '' });
-	const startImportMut = createMutation(() => ({
-		mutationFn: (b: ImportBody) => startImport(b),
-		onSuccess: (r) => toast.success(r.message || 'Import complete'),
-		onError: (err) =>
-			toast.error(err instanceof Error ? err.message : 'Import failed')
-	}));
-	const cancelImportMut = createMutation(() => ({
-		mutationFn: () => cancelImport(),
-		onSuccess: () => toast.success('Import canceled'),
-		onError: (err) =>
-			toast.error(err instanceof Error ? err.message : 'Cancel failed')
-	}));
-
 	// ── Logs tab ──────────────────────────────────────────────────────────
 	// Poll while the Logs tab is showing; pause otherwise so the dialog
 	// doesn't burn requests when the user is in another tab.
@@ -237,7 +278,7 @@
 				<Tabs.List
 					class="mb-3 flex gap-1 border-b border-border"
 				>
-					{#each ['library', 'index', 'import', 'logs', 'about'] as const as t (t)}
+					{#each ['library', 'index', 'logs', 'about'] as const as t (t)}
 						<Tabs.Trigger
 							value={t}
 							class="-mb-px border-b-2 border-transparent px-3 py-1.5 text-[12px] capitalize text-muted-foreground hover:text-foreground data-[state=active]:border-primary data-[state=active]:text-foreground"
@@ -248,7 +289,73 @@
 				</Tabs.List>
 
 				<!-- Library — general settings -->
-				<Tabs.Content value="library" class="outline-none">
+				<Tabs.Content value="library" class="space-y-4 outline-none">
+					<!-- Index folder — the per-user sub-folder the Library tree
+					     re-roots to and the reindex scopes to. Picked from the
+					     full BasePath tree so any sub-folder is reachable. -->
+					<section class="space-y-2 text-[12px]">
+						<h3 class="text-[10px] font-semibold uppercase tracking-[0.14em] text-muted-foreground">
+							Index folder
+						</h3>
+						<p class="text-muted-foreground">
+							Pick the sub-folder PhotoPrism should treat as your library
+							root. The folder tree re-roots here and the reindex only scans
+							this subtree. Leave on “Whole folder” to use everything.
+						</p>
+						<div class="rounded-md border border-border bg-background p-2">
+							<div class="max-h-[180px] overflow-y-auto">
+								{#if subpathFoldersQuery.isPending}
+									<InlineLoader size="sm" label="Loading folders…" />
+								{:else if subpathFoldersQuery.isError}
+									<EmptyState
+										size="compact"
+										tone="destructive"
+										icon={FolderOpen}
+										title="Could not load folders"
+									/>
+								{:else}
+									<!-- Whole-folder reset: '' is the "no sub-path" sentinel. -->
+									<button
+										type="button"
+										class="flex w-full items-center rounded px-2 py-1 text-left text-[12px] hover:bg-accent"
+										class:bg-primary={pickedSubpath === ''}
+										class:text-primary-foreground={pickedSubpath === ''}
+										class:hover:bg-primary={pickedSubpath === ''}
+										onclick={() => (pickedSubpath = '')}
+									>
+										Whole folder
+									</button>
+									{#if (subpathFoldersQuery.data ?? []).length > 0}
+										<FolderTree
+											nodes={subpathTree}
+											onPick={(p) => (pickedSubpath = p)}
+											selectedPath={pickedSubpath}
+											readonly
+										/>
+									{/if}
+								{/if}
+							</div>
+						</div>
+						<div class="flex items-center justify-between gap-2">
+							<span class="truncate text-[11px] text-muted-foreground">
+								Current: {prefs.indexSubpath === '' ? 'Whole folder' : prefs.indexSubpath}
+							</span>
+							<button
+								type="button"
+								class="flex items-center gap-1.5 rounded bg-primary px-3 py-1 text-[12px] text-primary-foreground hover:bg-primary/90 disabled:opacity-50"
+								onclick={() => saveSubpathMut.mutate(pickedSubpath)}
+								disabled={saveSubpathMut.isPending || pickedSubpath === prefs.indexSubpath}
+							>
+								{#if saveSubpathMut.isPending}
+									<Loader2 class="h-3 w-3 animate-spin" />
+								{/if}
+								Set index folder
+							</button>
+						</div>
+					</section>
+
+					<div class="h-px bg-border"></div>
+
 					{#if settingsQuery.isPending}
 						<p class="px-1 text-[12px] text-muted-foreground">Loading settings…</p>
 					{:else if settingsQuery.isError}
@@ -284,25 +391,6 @@
 								</label>
 							</section>
 
-							<section class="space-y-1.5">
-								<h3 class="text-[10px] font-semibold uppercase tracking-[0.14em] text-muted-foreground">
-									Importer defaults
-								</h3>
-								<label class="flex items-center gap-2">
-									<input type="checkbox" bind:checked={draft.import!.move} />
-									Move (instead of copy) on import
-								</label>
-								<label class="flex flex-col gap-1">
-									<span class="text-muted-foreground">Default destination subpath</span>
-									<input
-										type="text"
-										placeholder="e.g. 2026/05"
-										bind:value={draft.import!.dest}
-										class="rounded border border-input bg-background px-2 py-1 focus:outline-none focus:ring-2 focus:ring-ring"
-									/>
-								</label>
-							</section>
-
 							<section class="space-y-1.5">
 								<h3 class="text-[10px] font-semibold uppercase tracking-[0.14em] text-muted-foreground">
 									Stacks
@@ -411,34 +499,6 @@
 								</section>
 							{/if}
 
-							<!-- Features — PhotoPrism's gating bag. Render only the
-							     keys actually present in the response (PP version
-							     drift), labelled human-readably. -->
-							{#if draft.features && Object.keys(draft.features).length > 0}
-								<section class="space-y-1.5">
-									<h3 class="text-[10px] font-semibold uppercase tracking-[0.14em] text-muted-foreground">
-										Features
-									</h3>
-									<p class="text-muted-foreground">
-										Toggling a feature off hides it from PhotoPrism's own
-										UI and disables the underlying API surface.
-									</p>
-									<div class="grid grid-cols-2 gap-x-3 gap-y-1">
-										{#each Object.keys(draft.features).sort() as key (key)}
-											{#if typeof draft.features![key] === 'boolean'}
-												<label class="flex items-center gap-2">
-													<input
-														type="checkbox"
-														bind:checked={draft.features![key]}
-													/>
-													<span class="capitalize">{key}</span>
-												</label>
-											{/if}
-										{/each}
-									</div>
-								</section>
-							{/if}
-
 						</div>
 
 						<div class="mt-4 flex items-center justify-end gap-2">
@@ -511,58 +571,6 @@
 					</div>
 				</Tabs.Content>
 
-				<!-- Import — manual import run -->
-				<Tabs.Content value="import" class="space-y-3 text-[12px] outline-none">
-					<p class="text-muted-foreground">
-						Pulls files from the import folder into the library. With "move"
-						enabled, files are deleted from the import folder after a
-						successful import.
-					</p>
-					<label class="flex flex-col gap-1">
-						<span class="text-muted-foreground">Source path</span>
-						<input
-							type="text"
-							bind:value={importForm.path}
-							placeholder="/"
-							class="rounded border border-input bg-background px-2 py-1 focus:outline-none focus:ring-2 focus:ring-ring"
-						/>
-					</label>
-					<label class="flex items-center gap-2">
-						<input type="checkbox" bind:checked={importForm.move} />
-						Move files (don't copy) after import
-					</label>
-					<label class="flex flex-col gap-1">
-						<span class="text-muted-foreground">Destination subpath (optional)</span>
-						<input
-							type="text"
-							bind:value={importForm.dest}
-							placeholder="e.g. 2026/05"
-							class="rounded border border-input bg-background px-2 py-1 focus:outline-none focus:ring-2 focus:ring-ring"
-						/>
-					</label>
-					<div class="flex items-center justify-end gap-2 pt-1">
-						<button
-							type="button"
-							class="rounded border border-border px-3 py-1 hover:bg-accent disabled:opacity-50"
-							onclick={() => cancelImportMut.mutate()}
-							disabled={cancelImportMut.isPending || startImportMut.isPending}
-						>
-							Cancel current
-						</button>
-						<button
-							type="button"
-							class="flex items-center gap-1.5 rounded bg-primary px-3 py-1 text-primary-foreground hover:bg-primary/90 disabled:opacity-50"
-							onclick={() => startImportMut.mutate(importForm)}
-							disabled={startImportMut.isPending}
-						>
-							{#if startImportMut.isPending}
-								<Loader2 class="h-3 w-3 animate-spin" />
-							{/if}
-							Start import
-						</button>
-					</div>
-				</Tabs.Content>
-
 				<!-- About — version, library counts, env-driven config help -->
 				<Tabs.Content value="about" class="space-y-4 text-[12px] outline-none">
 					{#if configQuery.isPending}

web/src/lib/components/layout/StatusPill.svelte

@@ -0,0 +1,46 @@
+<!--
+	Generic status pill used in the header for both the PhotoPrism indexer
+	and bulk-action progress. Renders nothing when idle so it never steals
+	header real estate.
+
+	`detail` is a full path or filename; only the basename is shown inline
+	(fixed-width slot to stop the pill from resizing on every file). The
+	full string is exposed via `title` for hover.
+-->
+<script lang="ts">
+	import { Loader2 } from 'lucide-svelte';
+
+	interface Props {
+		active: boolean;
+		label: string;
+		detail?: string;
+	}
+	let { active, label, detail }: Props = $props();
+
+	const basename = $derived.by(() => {
+		if (!detail) return '';
+		const i = detail.lastIndexOf('/');
+		return i >= 0 ? detail.slice(i + 1) : detail;
+	});
+</script>
+
+{#if active || label}
+	<div
+		class="flex items-center gap-1.5 rounded-full border border-border bg-background/80 px-2.5 py-1 text-xs text-foreground shadow-sm backdrop-blur"
+		title={detail ?? label}
+		role="status"
+		aria-live="polite"
+	>
+		{#if active}
+			<Loader2 class="h-3 w-3 animate-spin text-primary" />
+		{/if}
+		<span class="whitespace-nowrap">{label}</span>
+		{#if basename}
+			<span
+				class="w-[24ch] truncate text-left font-mono text-[10px] text-muted-foreground"
+			>
+				{basename}
+			</span>
+		{/if}
+	</div>
+{/if}

web/src/lib/components/review/CauseGroupCard.svelte

@@ -13,6 +13,7 @@
 	import { useQueryClient } from '@tanstack/svelte-query';
 	import { toast } from 'svelte-sonner';
 	import { batchArchive } from '$lib/services/photoprism';
+	import { startBulk, doneBulk, failBulk } from '$lib/stores/bulkAction.svelte';
 	import PhotoGrid from '$lib/components/timeline/PhotoGrid.svelte';
 	import { type ReviewGroup } from '$lib/services/adapters/review';
 
@@ -28,14 +29,20 @@
 		if (busy || group.photos.length === 0) return;
 		if (!confirm(`Archive all ${group.photos.length} photos in "${group.meta.title}"?`))
 			return;
+		const uids = group.photos.map((p) => p.UID);
+		const tid = toast.loading(`Archiving ${uids.length}…`);
 		busy = true;
+		startBulk(`Archiving…`, uids);
 		try {
-			await batchArchive(group.photos.map((p) => p.UID));
-			toast.success(`Archived ${group.photos.length}`);
+			await batchArchive(uids);
+			doneBulk(`Archived ${uids.length}`, uids);
+			toast.success(`Archived ${uids.length}`, { id: tid });
 			void qc.invalidateQueries({ queryKey: ['review-groups'] });
 			void qc.invalidateQueries({ queryKey: ['photos'] });
+			void qc.invalidateQueries({ queryKey: ['marks'] });
 		} catch (err) {
-			toast.error(err instanceof Error ? err.message : 'Archive all failed');
+			failBulk(uids);
+			toast.error(err instanceof Error ? err.message : 'Archive all failed', { id: tid });
 		} finally {
 			busy = false;
 		}

web/src/lib/components/sidebar/BulkMetadataSidebar.svelte

@@ -17,7 +17,8 @@
 		type PhotoMarksMap,
 		type UpdatePhotoBody
 	} from '$lib/services/photoprism';
-	import { patchTargets } from '$lib/services/bulk';
+	import { patchTargets, invalidateFacets } from '$lib/services/bulk';
+	import { startBulk, doneBulk, failBulk } from '$lib/stores/bulkAction.svelte';
 	import { COLOR_SWATCHES } from '$lib/utils/tagGroups';
 
 	const qc = useQueryClient();
@@ -35,10 +36,19 @@
 	let colorDraft = $state<string | null>(null);
 	let busy = $state(false);
 
-	async function withBusy<T>(fn: () => Promise<T>): Promise<T> {
+	// `label` drives the per-photo tile overlay (pending → done / error) via the
+	// shared bulkAction store, so metadata applies show the same progress state
+	// as the archive/keep actions in BulkActionBar.
+	async function withBusy<T>(fn: () => Promise<T>, label?: string): Promise<T> {
 		busy = true;
+		if (label) startBulk(`${label}…`, ids);
 		try {
-			return await fn();
+			const result = await fn();
+			if (label) doneBulk(label, ids);
+			return result;
+		} catch (e) {
+			if (label) failBulk(ids);
+			throw e;
 		} finally {
 			busy = false;
 		}
@@ -47,13 +57,16 @@
 	async function applyNote() {
 		if (busy) return;
 		const value = noteDraft;
-		await withBusy(() =>
-			patchTargets(
-				ids,
-				{ Caption: value, CaptionSrc: 'manual' },
-				value ? `Note → ${ids.length}` : `Cleared note on ${ids.length}`,
-				(p) => ({ Caption: p.Caption ?? '', CaptionSrc: 'manual' })
-			)
+		const label = value ? `Note → ${ids.length}` : `Cleared note on ${ids.length}`;
+		await withBusy(
+			() =>
+				patchTargets(
+					ids,
+					{ Caption: value, CaptionSrc: 'manual' },
+					label,
+					(p) => ({ Caption: p.Caption ?? '', CaptionSrc: 'manual' })
+				),
+			label
 		);
 		noteDraft = '';
 	}
@@ -64,27 +77,28 @@
 		// Date-only input — stamp midnight UTC and let PhotoPrism's backwrite
 		// fill the local timezone field downstream.
 		const iso = `${dateDraft}T00:00:00Z`;
-		await withBusy(() =>
-			patchTargets(
-				ids,
-				buildTakenAtPatch(iso),
-				`Date → ${ids.length}`,
-				(p) =>
-					p.TakenAt
-						? buildTakenAtPatch(p.TakenAt)
-						: ({ TakenSrc: '' } as UpdatePhotoBody)
-			)
+		const label = `Date → ${ids.length}`;
+		await withBusy(
+			() =>
+				patchTargets(
+					ids,
+					buildTakenAtPatch(iso),
+					label,
+					(p) =>
+						p.TakenAt
+							? buildTakenAtPatch(p.TakenAt)
+							: ({ TakenSrc: '' } as UpdatePhotoBody)
+				),
+			label
 		);
 		dateDraft = '';
 	}
 
 	async function applyMarks(patch: PhotoMark, label: string) {
 		if (busy) return;
+		const tid = toast.loading(`${label}…`);
+		startBulk(`${label}…`, ids);
 		await withBusy(async () => {
-			// Optimistic: patch every selected photo's mark in the local
-			// cache before round-tripping. Sidecar bulk endpoint is
-			// authoritative; on failure we just invalidate so the next
-			// list query overrides.
 			qc.setQueryData<PhotoMarksMap>(['marks'], (prev) => {
 				const map = { ...(prev ?? {}) };
 				for (const id of ids) {
@@ -98,9 +112,14 @@
 			});
 			try {
 				await bulkSetMarks(ids, patch);
-				toast.success(`${label} · ${ids.length}`);
+				doneBulk(label, ids);
+				// Refresh the Colors / Ratings facet panels — they sit on
+				// `['marks']` + `['photos','marks-pool']`, not the optimistic write above.
+				invalidateFacets();
+				toast.success(`${label} · ${ids.length}`, { id: tid });
 			} catch (err) {
-				toast.error(err instanceof Error ? err.message : 'Save failed');
+				failBulk(ids);
+				toast.error(err instanceof Error ? err.message : 'Save failed', { id: tid });
 				void qc.invalidateQueries({ queryKey: ['marks'] });
 			}
 		});
@@ -125,23 +144,26 @@
 		const kw = keywordDraft.trim().replace(/,/g, '');
 		if (!kw) return;
 		keywordDraft = '';
-		await withBusy(() =>
-			patchTargets(
-				ids,
-				(p) => {
-					const cur = (p.Details?.Keywords ?? '')
-						.split(',')
-						.map((k) => k.trim())
-						.filter(Boolean);
-					if (cur.includes(kw)) return {};
-					const next = [...cur, kw].join(', ');
-					return { Details: { Keywords: next, KeywordsSrc: 'manual' } };
-				},
-				`Tagged "${kw}" → ${ids.length}`,
-				(p) => ({
-					Details: { Keywords: p.Details?.Keywords ?? '', KeywordsSrc: 'manual' }
-				})
-			)
+		const label = `Tagged "${kw}" → ${ids.length}`;
+		await withBusy(
+			() =>
+				patchTargets(
+					ids,
+					(p) => {
+						const cur = (p.Details?.Keywords ?? '')
+							.split(',')
+							.map((k) => k.trim())
+							.filter(Boolean);
+						if (cur.includes(kw)) return {};
+						const next = [...cur, kw].join(', ');
+						return { Details: { Keywords: next, KeywordsSrc: 'manual' } };
+					},
+					label,
+					(p) => ({
+						Details: { Keywords: p.Details?.Keywords ?? '', KeywordsSrc: 'manual' }
+					})
+				),
+			label
 		);
 	}
 

web/src/lib/components/sidebar/RightSidebar.svelte

@@ -6,7 +6,6 @@
 	PUT (Details fields need the full body).
 -->
 <script lang="ts">
-	import { goto } from '$app/navigation';
 	import { page } from '$app/state';
 	import { createMutation, createQuery, useQueryClient } from '@tanstack/svelte-query';
 	import { toast } from 'svelte-sonner';
@@ -16,10 +15,10 @@
 		Calendar,
 		File,
 		Folder,
+		Globe,
 		HardDrive,
 		ImageIcon,
 		Loader2,
-		Map as MapIcon,
 		MapPin,
 		Star,
 		Tag,
@@ -37,12 +36,15 @@
 		type PhotoMarksMap,
 		type UpdatePhotoBody
 	} from '$lib/services/photoprism';
+	import { invalidateFacets } from '$lib/services/bulk';
+	import { startBulk, doneBulk, failBulk } from '$lib/stores/bulkAction.svelte';
 	import { isAuthenticated } from '$lib/stores/session.svelte';
 	import { push as pushUndo } from '$lib/stores/undo.svelte';
 	import { getMetadataSectionOpen, setMetadataSection } from '$lib/stores/view.svelte';
 	import { photoNameAndDir, primaryFile, type PpPhoto } from '$lib/types/photoprism';
-	import { navigateToFolder } from '$lib/stores/filters.svelte';
+	import { navigateToFolder, navigateToTag } from '$lib/stores/filters.svelte';
 	import { COLOR_SWATCHES } from '$lib/utils/tagGroups';
+	import { countryName } from '$lib/utils/countries';
 	import { suggestDateFromPath } from '$lib/utils/suggestDateFromPath';
 
 	interface Props {
@@ -91,12 +93,20 @@
 			const fresh = qc.getQueryData<PpPhoto>(['photo', photo.UID]) ?? photo;
 			return updatePhoto(fresh, patch);
 		},
+		onMutate: () => {
+			startBulk('Saving…', [photo.UID]);
+		},
 		onSuccess: (data) => {
 			qc.setQueryData(['photo', data.UID], data);
 			void qc.invalidateQueries({ queryKey: ['photos'] });
+			// Keep the keyword / notes facet panels in sync with the edit.
+			invalidateFacets();
+			doneBulk('Saved', [photo.UID]);
 		},
-		onError: (err) =>
-			toast.error(err instanceof Error ? err.message : 'Save failed')
+		onError: (err) => {
+			failBulk([photo.UID]);
+			toast.error(err instanceof Error ? err.message : 'Save failed');
+		}
 	}));
 
 	function commit(patch: UpdatePhotoBody) {
@@ -234,12 +244,17 @@
 		if (!optimistic.rating) delete optimistic.rating;
 		if (!optimistic.color) delete optimistic.color;
 		patchMarksCache(photo.UID, optimistic);
+		startBulk('Saving…', [photo.UID]);
 		try {
 			const saved = await setMark(photo.UID, patch);
 			patchMarksCache(photo.UID, saved);
+			// Refresh the Colors / Ratings facet panels off the sidecar truth.
+			invalidateFacets();
+			doneBulk('Saved', [photo.UID]);
 		} catch (err) {
 			// Rollback on failure.
 			patchMarksCache(photo.UID, prev);
+			failBulk([photo.UID]);
 			toast.error(err instanceof Error ? err.message : 'Save failed');
 		}
 	}
@@ -417,28 +432,22 @@
 			</span>
 		</div>
 
-		<!-- Location (read-only label + open-on-map icon). The arrow-up-
-		     right icon flies the in-app map to the photo's coordinates at
-		     zoom 17 (close enough for the photo's marker to be its own,
-		     out of any cluster). Hidden when the photo has no
-		     coordinates. -->
+		<!-- Location (read-only label + jump-to-country icon). Hidden when
+		     the photo has no resolved country. -->
 		<div class="flex items-center gap-2">
 			<MapPin class="h-3.5 w-3.5 shrink-0 text-muted-foreground" />
 			<span class="min-w-0 flex-1 truncate px-1 py-0.5 text-muted-foreground">
 				{placeLabel || 'No location'}
 			</span>
-			{#if photo.Lat && photo.Lng}
+			{#if photo.Country && photo.Country !== 'zz'}
 				<button
 					type="button"
 					class="text-muted-foreground hover:text-foreground"
-					onclick={() =>
-						void goto(
-							`/map?lat=${photo.Lat}&lng=${photo.Lng}&zoom=17&focus=${photo.UID}`
-						)}
-					title="Open on map"
-					aria-label="Open on map"
+					onclick={() => void navigateToTag('countries', photo.Country ?? null)}
+					title={`View other photos from ${countryName(photo.Country)}`}
+					aria-label={`View other photos from ${countryName(photo.Country)}`}
 				>
-					<MapIcon class="h-3 w-3" />
+					<Globe class="h-3 w-3" />
 				</button>
 			{/if}
 		</div>

web/src/lib/components/sidebar/TagsBrowserSidebar.svelte

@@ -3,11 +3,13 @@
 	import {
 		aggregateKeywords,
 		getAllMarks,
+		listCountries,
 		listLabels,
-		listPhotos,
+		listPhotosByUids,
 		listSubjects,
 		type AggregatedKeyword,
 		type PhotoMarksMap,
+		type PpCountry,
 		type PpLabel,
 		type PpSubject
 	} from '$lib/services/photoprism';
@@ -20,9 +22,10 @@
 		COLOR_SWATCHES,
 		starLabel
 	} from '$lib/utils/tagGroups';
+	import { countryFlag, countryName } from '$lib/utils/countries';
 	import type { PpPhoto } from '$lib/types/photoprism';
 	import { EmptyState, InlineLoader } from '$lib/components/feedback';
-	import { Hash, Tag, User } from 'lucide-svelte';
+	import { Globe, Hash, Tag, User } from 'lucide-svelte';
 
 	interface Props {
 		category: TagCategory;
@@ -64,6 +67,12 @@
 		enabled: isAuthenticated() && category === 'people'
 	}));
 
+	const countriesQuery = createQuery<PpCountry[]>(() => ({
+		queryKey: ['countries'],
+		queryFn: listCountries,
+		enabled: isAuthenticated() && category === 'countries'
+	}));
+
 	const marksQuery = createQuery<PhotoMarksMap>(() => ({
 		queryKey: ['marks'],
 		queryFn: getAllMarks,
@@ -72,12 +81,17 @@
 	}));
 
 	// Same marks-pool query the drill page uses — colors/ratings need a
-	// representative photo per bucket for the count rollup. Cheap once
-	// cached; the drill page kicks the same key.
+	// representative photo per bucket for the count rollup. Resolved from the
+	// marked UIDs (complete set, any age) so the rollup counts every marked
+	// photo, not just those in the newest-N timeline slice.
+	const markedUids = $derived(Object.keys(marksQuery.data ?? {}));
 	const marksPoolQuery = createQuery<PpPhoto[]>(() => ({
-		queryKey: ['photos', 'marks-pool'],
-		queryFn: () => listPhotos({ count: 1000, order: 'newest', merged: true }),
-		enabled: isAuthenticated() && (category === 'ratings' || category === 'colors')
+		queryKey: ['photos', 'marks-pool', [...markedUids].sort()],
+		queryFn: () => listPhotosByUids(markedUids),
+		enabled:
+			isAuthenticated() &&
+			(category === 'ratings' || category === 'colors') &&
+			markedUids.length > 0
 	}));
 
 	// PhotoPrism returns labels in arbitrary order; sort by photo count
@@ -120,6 +134,19 @@
 		);
 	});
 
+	// PhotoPrism returns countries unsorted; sort by photo count descending so
+	// the most-photographed countries surface first (mirrors labels/people).
+	const countriesSorted = $derived(
+		[...(countriesQuery.data ?? [])].sort((a, b) => b.PhotoCount - a.PhotoCount)
+	);
+	const filteredCountries = $derived.by(() => {
+		const q = filterText.trim().toLowerCase();
+		if (!q) return countriesSorted;
+		return countriesSorted.filter((c) =>
+			countryName(c.Code).toLowerCase().includes(q)
+		);
+	});
+
 	const ratingGroups = $derived(
 		buildRatingGroups(marksQuery.data, marksPoolQuery.data)
 	);
@@ -147,9 +174,11 @@
 	const visibleLabels = $derived(filteredLabels.slice(0, visibleCount));
 	const visibleKeywords = $derived(filteredKeywords.slice(0, visibleCount));
 	const visibleSubjects = $derived(filteredSubjects.slice(0, visibleCount));
+	const visibleCountries = $derived(filteredCountries.slice(0, visibleCount));
 	const hasMoreLabels = $derived(visibleCount < filteredLabels.length);
 	const hasMoreKeywords = $derived(visibleCount < filteredKeywords.length);
 	const hasMoreSubjects = $derived(visibleCount < filteredSubjects.length);
+	const hasMoreCountries = $derived(visibleCount < filteredCountries.length);
 
 	function loadMore() {
 		visibleCount += PAGE_SIZE;
@@ -174,6 +203,9 @@
 		const s = String(r);
 		if (selectedValue !== s) onSelect(s);
 	}
+	function pickCountry(code: string) {
+		if (selectedValue !== code) onSelect(code);
+	}
 
 	// First non-empty entry for the active category. Labels/keywords are
 	// already sorted by count desc, so [0] is the most-used tag; colors
@@ -198,6 +230,9 @@
 			const g = ratingGroups[0];
 			return g ? String(g.rating) : null;
 		}
+		if (category === 'countries') {
+			return countriesSorted[0]?.Code ?? null;
+		}
 		return null;
 	});
 
@@ -223,11 +258,16 @@
 					? 'People'
 					: category === 'colors'
 						? 'Colors'
-						: 'Ratings'
+						: category === 'countries'
+							? 'Countries'
+							: 'Ratings'
 	);
 
 	const showFilterInput = $derived(
-		category === 'labels' || category === 'keywords' || category === 'people'
+		category === 'labels' ||
+			category === 'keywords' ||
+			category === 'people' ||
+			category === 'countries'
 	);
 </script>
 
@@ -443,6 +483,69 @@
 				{/if}
 			</div>
 		{/if}
+	{:else if category === 'countries'}
+		{#if countriesQuery.isPending}
+			<InlineLoader size="sm" label="Loading countries…" />
+		{:else if countriesQuery.isError}
+			<EmptyState size="compact" tone="destructive" title="Failed to load countries" />
+		{:else if filteredCountries.length === 0}
+			<EmptyState
+				size="compact"
+				icon={Globe}
+				title={filterText ? 'No countries match the filter' : 'No geotagged photos yet'}
+			/>
+		{:else}
+			<div bind:this={scrollEl} class="min-h-0 flex-1 overflow-y-auto">
+				{#each visibleCountries as countryRow (countryRow.Code)}
+					{@const active = countryRow.Code === selectedValue}
+					<button
+						type="button"
+						class="flex h-8 w-full items-center gap-2 px-3 text-left text-[12px] leading-tight hover:bg-accent"
+						class:bg-primary={active}
+						class:text-primary-foreground={active}
+						class:hover:bg-primary={active}
+						onclick={() => pickCountry(countryRow.Code)}
+						title={countryName(countryRow.Code)}
+					>
+						{#if countryRow.Thumb}
+							<img
+								src={thumbUrl(countryRow.Thumb, 'tile_50')}
+								alt=""
+								loading="lazy"
+								class="h-5 w-5 shrink-0 rounded object-cover"
+							/>
+						{:else}
+							<span class="flex h-5 w-5 shrink-0 items-center justify-center text-[14px]">
+								{countryFlag(countryRow.Code)}
+							</span>
+						{/if}
+						<span class="min-w-0 flex-1 truncate">{countryName(countryRow.Code)}</span>
+						<span
+							class="flex h-4 min-w-[20px] shrink-0 items-center justify-center rounded px-1 text-[10px] tabular-nums {active
+								? 'bg-primary-foreground/15 text-primary-foreground'
+								: 'bg-secondary text-muted-foreground'}"
+						>
+							{countryRow.PhotoCount}
+						</span>
+					</button>
+				{/each}
+				<div
+					use:nearBottom={{
+						onHit: loadMore,
+						enabled: hasMoreCountries,
+						root: scrollEl ?? null,
+						preloadPx: 400
+					}}
+					class="h-px"
+					aria-hidden="true"
+				></div>
+				{#if hasMoreCountries}
+					<p class="px-3 py-2 text-center text-[10px] text-muted-foreground/70">
+						Loading more… ({visibleCount} / {filteredCountries.length})
+					</p>
+				{/if}
+			</div>
+		{/if}
 	{:else if category === 'colors'}
 		{#if marksQuery.isPending || marksPoolQuery.isPending}
 			<p class="px-3 py-2 text-[11px] text-muted-foreground">Loading colors…</p>

web/src/lib/components/timeline/BulkActionBar.svelte

@@ -26,6 +26,15 @@
 	import { filters } from '$lib/stores/filters.svelte';
 	import { push as pushUndo } from '$lib/stores/undo.svelte';
 	import { isAuthenticated } from '$lib/stores/session.svelte';
+	import { openMove } from '$lib/stores/moveDialog.svelte';
+	import {
+		startBulk,
+		setDetail,
+		doneBulk,
+		removedBulk,
+		failBulk,
+		markRemoved
+	} from '$lib/stores/bulkAction.svelte';
 	import { EmptyState, InlineLoader } from '$lib/components/feedback';
 	import { Layers } from 'lucide-svelte';
 
@@ -113,44 +122,87 @@
 		setFocused(null);
 	}
 
-	async function withBusy<T>(fn: () => Promise<T>): Promise<T> {
+	const delay = (ms: number) => new Promise<void>((r) => setTimeout(r, ms));
+
+	interface BulkConfig {
+		ids: string[];
+		label: string;
+		doneLabel: string;
+		/** Destructive removal (archive / delete): flash a red cross, then hide
+		 *  the tiles via markRemoved after the flash instead of green check. */
+		removing?: boolean;
+	}
+
+	async function withBusy<T>(fn: () => Promise<T>, bulk?: BulkConfig): Promise<T> {
 		busy = true;
+		if (bulk) startBulk(`${bulk.label}…`, bulk.ids);
 		try {
-			return await fn();
+			const result = await fn();
+			if (bulk) {
+				if (bulk.removing) {
+					// Destructive: red-cross flash, then pull tiles from the grid.
+					removedBulk(bulk.doneLabel, bulk.ids);
+					await delay(500);
+					markRemoved(bulk.ids);
+				} else {
+					doneBulk(bulk.doneLabel, bulk.ids);
+					await delay(1000);
+				}
+			}
+			return result;
+		} catch (e) {
+			if (bulk) failBulk(bulk.ids);
+			throw e;
 		} finally {
 			busy = false;
 			void qc.invalidateQueries({ queryKey: ['photos'] });
+			void qc.invalidateQueries({ queryKey: ['marks'] });
+			void qc.invalidateQueries({ queryKey: ['review-groups'] });
+			// The optimistic-removal overlay (removedIds) is reconciled against
+			// the cache in +page.svelte — each id drops once the fresh, archived-
+			// filtered page has actually replaced it. Clearing here off this
+			// action's own settle raced other in-flight removals and flashed
+			// tiles back in.
 		}
 	}
 
 	async function onApprove() {
 		const ids = snapshotIds();
 		if (ids.length === 0) return;
+		const tid = toast.loading(`Keeping ${ids.length}…`);
 		await withBusy(async () => {
-			// PhotoPrism's approve is one-way (Quality jumps to 3+); there's
-			// no /unapprove route. We fan out per-photo because there's no
-			// batch endpoint either. Errors are tallied rather than aborting
-			// the loop so a single bad UID doesn't block the rest.
-			const { updated, errors } = await batchEdit(ids, (id) => approvePhoto(id));
+			const { updated, errors } = await batchEdit(ids, (id) => approvePhoto(id), {
+				onProgress: (_done, _total, completedId) => {
+					const p = cachedPhoto(completedId);
+					setDetail(p?.FileName ?? completedId);
+				}
+			});
 			if (errors.length) {
-				toast.error(`Kept ${updated.length}; ${errors.length} failed`);
+				toast.error(`Kept ${updated.length}; ${errors.length} failed`, { id: tid });
 			} else {
-				toast.success(`Kept ${ids.length}`);
+				toast.success(`Kept ${ids.length}`, { id: tid });
 			}
+			// Approved photos leave the review section — hide them immediately.
+			markRemoved(ids);
 			focusAfter(ids);
 			clearSelection();
-		});
+		}, { ids, label: 'Keeping', doneLabel: `Kept ${ids.length}` });
 	}
 
 	async function onAcceptDateAndKeep() {
 		const ids = snapshotIds();
 		if (ids.length === 0) return;
-		await withBusy(() => acceptDateAndKeep(ids));
+		await withBusy(() => acceptDateAndKeep(ids), {
+			ids,
+			label: 'Updating',
+			doneLabel: `Updated ${ids.length}`
+		});
 	}
 
 	async function onArchive() {
 		const ids = snapshotIds();
 		if (ids.length === 0) return;
+		const tid = toast.loading(`Archiving ${ids.length}…`);
 		await withBusy(async () => {
 			try {
 				await batchArchive(ids);
@@ -158,16 +210,13 @@
 					await batchRestore(ids);
 					void qc.invalidateQueries({ queryKey: ['photos'] });
 				});
-				// Advance focus to the photo immediately after the archived
-				// set before the multi-selection is dropped — lets the user
-				// keep stepping through the timeline with X.
 				focusAfter(ids);
 				clearSelection();
-				toast.success(`Archived ${ids.length}`);
+				toast.success(`Archived ${ids.length}`, { id: tid });
 			} catch (err) {
-				toast.error(err instanceof Error ? err.message : 'Archive failed');
+				toast.error(err instanceof Error ? err.message : 'Archive failed', { id: tid });
 			}
-		});
+		}, { ids, label: 'Archiving', doneLabel: `Archived ${ids.length}`, removing: true });
 	}
 
 	async function onDelete() {
@@ -178,61 +227,67 @@
 				? 'Permanently delete this photo? This cannot be undone.'
 				: `Permanently delete ${ids.length} photos? This cannot be undone.`;
 		if (!confirm(msg)) return;
+		const tid = toast.loading(`Deleting ${ids.length}…`);
 		await withBusy(async () => {
 			try {
 				await batchDelete(ids);
 				focusAfter(ids);
 				clearSelection();
-				toast.success(`Deleted ${ids.length}`);
+				toast.success(`Deleted ${ids.length}`, { id: tid });
 			} catch (err) {
-				toast.error(err instanceof Error ? err.message : 'Delete failed');
+				toast.error(err instanceof Error ? err.message : 'Delete failed', { id: tid });
 			}
-		});
+		}, { ids, label: 'Deleting', doneLabel: `Deleted ${ids.length}`, removing: true });
 	}
 
 	async function onRestore() {
 		const ids = snapshotIds();
 		if (ids.length === 0) return;
+		const tid = toast.loading(`Restoring ${ids.length}…`);
 		await withBusy(async () => {
 			try {
 				await batchRestore(ids);
+				markRemoved(ids);
 				pushUndo(`Restored ${ids.length}`, async () => {
 					await batchArchive(ids);
 					void qc.invalidateQueries({ queryKey: ['photos'] });
 				});
 				focusAfter(ids);
 				clearSelection();
-				toast.success(`Restored ${ids.length}`);
+				toast.success(`Restored ${ids.length}`, { id: tid });
 			} catch (err) {
-				toast.error(err instanceof Error ? err.message : 'Restore failed');
+				toast.error(err instanceof Error ? err.message : 'Restore failed', { id: tid });
 			}
-		});
+		}, { ids, label: 'Restoring', doneLabel: `Restored ${ids.length}` });
 	}
 
 	async function onAddToHeap(heap: PpAlbum) {
 		const ids = snapshotIds();
 		if (!ids.length) return;
 		heapPickerOpen = false;
+		const tid = toast.loading(`Adding ${ids.length} → ${heap.Title}…`);
+		startBulk(`Adding to ${heap.Title}…`, ids);
 		await withBusy(async () => {
 			try {
 				const { added } = await addToHeap(heap.UID, ids);
 				qc.invalidateQueries({ queryKey: ['heaps'] });
-				// PhotoPrism returns 200 even when nothing was added (UIDs
-				// already present or unknown to the index) — surface the
-				// real delta so the user isn't fooled by a green toast over
-				// a no-op.
 				if (added.length === 0) {
+					failBulk(ids);
 					toast.error(`Nothing added to ${heap.Title}`, {
+						id: tid,
 						description: `The server rejected all ${ids.length} UIDs (already in heap, or not indexed).`
 					});
 					return;
 				}
+				doneBulk(`Added ${added.length} → ${heap.Title}`, ids);
+				await delay(400);
 				if (added.length < ids.length) {
 					toast.success(`Added ${added.length}/${ids.length} → ${heap.Title}`, {
+						id: tid,
 						description: 'The rest were already in this heap.'
 					});
 				} else {
-					toast.success(`Added ${added.length} → ${heap.Title}`);
+					toast.success(`Added ${added.length} → ${heap.Title}`, { id: tid });
 				}
 				pushUndo(`Added ${added.length} to ${heap.Title}`, async () => {
 					await removeFromHeap(heap.UID, added);
@@ -240,7 +295,8 @@
 				});
 				clearSelection();
 			} catch (err) {
-				toast.error(err instanceof Error ? err.message : 'Add-to-heap failed');
+				failBulk(ids);
+				toast.error(err instanceof Error ? err.message : 'Add-to-heap failed', { id: tid });
 			}
 		});
 	}
@@ -398,6 +454,15 @@
 					Archive
 					<kbd class="rounded bg-muted px-1 text-[9px] font-medium text-muted-foreground">X</kbd>
 				</button>
+				<button
+					class="inline-flex items-center gap-1 rounded border border-border bg-background px-2 py-0.5 text-[11px] hover:bg-accent disabled:opacity-50"
+					disabled={busy}
+					onclick={() => openMove({ kind: 'photos', uids: snapshotIds() })}
+					title="Move selected photos to a folder"
+				>
+					Move to folder
+					<kbd class="rounded bg-muted px-1 text-[9px] font-medium text-muted-foreground">M</kbd>
+				</button>
 			{/if}
 			<button
 				class="inline-flex items-center gap-1 rounded px-2 py-0.5 text-[11px] text-muted-foreground hover:bg-accent hover:text-foreground"

web/src/lib/components/timeline/PhotoTile.svelte

@@ -16,6 +16,9 @@
   import { thumbSrc, thumbSrcSet, videoUrl } from "$lib/stores/session.svelte";
   import { view } from "$lib/stores/view.svelte";
   import { isVideo, primaryFile, type PpPhoto } from "$lib/types/photoprism";
+  import { bulkPhotoStates } from "$lib/stores/bulkAction.svelte";
+  import { fade } from "svelte/transition";
+  import { Loader2, Check, X } from "lucide-svelte";
 
   interface Props {
     photo: PpPhoto;
@@ -51,7 +54,7 @@
   let hoverTimer: ReturnType<typeof setTimeout> | null = null;
 
   function onMouseEnter() {
-    if (!video || selected) return;
+    if (!video || selected || bulkState) return;
     if (hoverTimer) clearTimeout(hoverTimer);
     hoverTimer = setTimeout(() => {
       hoverPlaying = true;
@@ -73,6 +76,7 @@
   const tilePx = $derived(view.thumbnailSize);
   const src1x = $derived(thumbSrc(hash, tilePx));
   const srcset = $derived(thumbSrcSet(hash, tilePx));
+  const bulkState = $derived(bulkPhotoStates.get(photo.UID));
 </script>
 
 <!--
@@ -150,6 +154,30 @@
     {#if selected}
       <div class="pointer-events-none absolute inset-0 bg-blue-500/40"></div>
     {/if}
+    {#if bulkState === 'pending'}
+      <div class="pointer-events-none absolute inset-0 bg-black/50"></div>
+      <div class="pointer-events-none absolute inset-0 flex items-center justify-center">
+        <Loader2 class="h-5 w-5 animate-spin text-white/80 drop-shadow" />
+      </div>
+    {:else if bulkState === 'done'}
+      <div
+        transition:fade={{ duration: 200 }}
+        class="pointer-events-none absolute inset-0 flex items-center justify-center bg-emerald-500/70"
+      >
+        <Check class="h-7 w-7 text-white drop-shadow-md" />
+      </div>
+    {:else if bulkState === 'removed'}
+      <div
+        transition:fade={{ duration: 200 }}
+        class="pointer-events-none absolute inset-0 flex items-center justify-center bg-red-500/70"
+      >
+        <X class="h-7 w-7 text-white drop-shadow-md" />
+      </div>
+    {:else if bulkState === 'error'}
+      <div class="pointer-events-none absolute inset-0 flex items-center justify-center bg-red-500/60">
+        <X class="h-7 w-7 text-white drop-shadow-md" />
+      </div>
+    {/if}
     {#if isVideo(photo)}
       <span
         class="absolute left-1.5 top-1.5 rounded bg-background/80 px-1 text-[10px] font-medium text-foreground"

web/src/lib/services/adapters/duplicates.ts

@@ -24,9 +24,13 @@ export interface DuplicateGroup {
 	bestFileUid: string;
 }
 
-export async function listDuplicateGroups(): Promise<DuplicateGroup[]> {
+export async function listDuplicateGroups(basePath?: string): Promise<DuplicateGroup[]> {
+	// Build query: stack:true + optional path filter
+	const pathFilter = basePath ? ` path:${basePath}*` : '';
+	const q = `stack:true${pathFilter}`;
+
 	const photos = await listPhotos({
-		q: 'stack:true',
+		q,
 		count: 200,
 		merged: true,
 		order: 'newest'

web/src/lib/services/batch.ts

@@ -13,7 +13,7 @@ export interface BatchResult<T> {
 
 export interface BatchOptions {
 	concurrency?: number;
-	onProgress?: (done: number, total: number) => void;
+	onProgress?: (done: number, total: number, completedId: string) => void;
 }
 
 export async function batchEdit<T>(
@@ -38,7 +38,7 @@ export async function batchEdit<T>(
 				errors.push({ id, message: err instanceof Error ? err.message : String(err) });
 			} finally {
 				done++;
-				opts.onProgress?.(done, ids.length);
+				opts.onProgress?.(done, ids.length, id);
 			}
 		}
 	}

web/src/lib/services/bulk.ts

@@ -32,6 +32,31 @@ export function invalidatePhotos(uids: string[]): void {
 	}
 }
 
+/**
+ * Refresh the sidebar facet sections after a metadata mutation. The Colors /
+ * Ratings panels read `['marks']` + `['photos','marks-pool']`; Notes reads
+ * `['photos','with-notes']`; keywords / labels / people read their own keys.
+ * Optimistic cache writes keep the active tile in sync, but the facet panels
+ * sit on separate queries that otherwise stay stale until their staleTime
+ * expires — so call this on the success path of any marks/keyword/note apply.
+ */
+export function invalidateFacets(): void {
+	void queryClient.invalidateQueries({ queryKey: ['marks'] });
+	void queryClient.invalidateQueries({ queryKey: ['photos', 'marks-pool'] });
+	void queryClient.invalidateQueries({ queryKey: ['photos', 'with-notes'] });
+	void queryClient.invalidateQueries({ queryKey: ['photos', 'keywords'] });
+	void queryClient.invalidateQueries({ queryKey: ['labels'] });
+	void queryClient.invalidateQueries({ queryKey: ['subjects'] });
+}
+
+export function invalidateAllPhotoCaches(): void {
+	void queryClient.invalidateQueries({ queryKey: ['photos'] });
+	void queryClient.invalidateQueries({ queryKey: ['marks'] });
+	void queryClient.invalidateQueries({ queryKey: ['labels'] });
+	void queryClient.invalidateQueries({ queryKey: ['review-groups'] });
+	void queryClient.invalidateQueries({ queryKey: ['heaps'] });
+}
+
 /**
  * Apply a patch to every uid. The patch can be a static body or a per-photo
  * function (used by keyword merges which need to read each photo's current
@@ -57,20 +82,22 @@ export async function patchTargets(
 			)
 		: null;
 
+	const tid = toast.loading(`${label} · ${ids.length}…`);
+
 	const { updated, errors } = await batchEdit(ids, async (id) => {
 		const p = await freshPhoto(id);
 		const body = typeof patch === 'function' ? patch(p) : patch;
-		// An empty body is a no-op signal — e.g. "keyword already present".
 		if (Object.keys(body).length === 0) return p;
 		return updatePhoto(p, body);
 	});
 
 	invalidatePhotos(ids);
+	invalidateFacets();
 
 	if (errors.length) {
-		toast.error(`${label} · ${updated.length} ok, ${errors.length} failed`);
+		toast.error(`${label} · ${updated.length} ok, ${errors.length} failed`, { id: tid });
 	} else {
-		toast.success(`${label} · ${ids.length}`);
+		toast.success(`${label} · ${ids.length}`, { id: tid });
 	}
 
 	if (inverses) {

web/src/lib/services/photoActions.ts

@@ -66,21 +66,20 @@ export function cachedPhoto(uid: string): PpPhoto | undefined {
  */
 export async function dismissPhotos(uids: string[]): Promise<void> {
 	if (uids.length === 0) return;
+	const tid = toast.loading(`Dismissing ${uids.length}…`);
 	const { updated, errors } = await batchEdit(uids, (id) => approvePhoto(id));
-	// Advance focus past the dismissed set before the timeline refetches
-	// so the cursor doesn't snap back to photo[0]; clear the now-stale
-	// selection ring for the same reason.
 	focusAfter(uids);
 	clearSelection();
 	invalidatePhotos(uids);
 	void queryClient.invalidateQueries({ queryKey: ['review-groups'] });
 	if (errors.length) {
 		toast.error(`Dismissed ${updated.length}; ${errors.length} failed`, {
+			id: tid,
 			description: errors[0].message
 		});
 		return;
 	}
-	toast.success(`Dismissed ${uids.length}`);
+	toast.success(`Dismissed ${uids.length}`, { id: tid });
 }
 
 /**
@@ -93,6 +92,7 @@ export async function dismissPhotos(uids: string[]): Promise<void> {
  */
 export async function acceptDateAndKeep(uids: string[]): Promise<void> {
 	if (uids.length === 0) return;
+	const tid = toast.loading(`Updating & keeping ${uids.length}…`);
 	const { updated, errors } = await batchEdit(uids, async (id) => {
 		const p = cachedPhoto(id);
 		if (p) {
@@ -113,11 +113,12 @@ export async function acceptDateAndKeep(uids: string[]): Promise<void> {
 	void queryClient.invalidateQueries({ queryKey: ['review-groups'] });
 	if (errors.length) {
 		toast.error(`Kept ${updated.length}; ${errors.length} failed`, {
+			id: tid,
 			description: errors[0].message
 		});
 		return;
 	}
-	toast.success(`Kept ${uids.length}`);
+	toast.success(`Kept ${uids.length}`, { id: tid });
 }
 
 /**
@@ -125,10 +126,11 @@ export async function acceptDateAndKeep(uids: string[]): Promise<void> {
  */
 export async function archivePhotos(uids: string[]): Promise<void> {
 	if (uids.length === 0) return;
+	const tid = toast.loading(`Archiving ${uids.length}…`);
 	try {
 		await batchArchive(uids);
 	} catch (err) {
-		toast.error(err instanceof Error ? err.message : 'Archive failed');
+		toast.error(err instanceof Error ? err.message : 'Archive failed', { id: tid });
 		return;
 	}
 	pushUndo(`Archived ${uids.length}`, async () => {
@@ -140,5 +142,5 @@ export async function archivePhotos(uids: string[]): Promise<void> {
 	clearSelection();
 	invalidatePhotos(uids);
 	void queryClient.invalidateQueries({ queryKey: ['review-groups'] });
-	toast.success(`Archived ${uids.length}`);
+	toast.success(`Archived ${uids.length}`, { id: tid });
 }

web/src/lib/services/photoprism.ts

@@ -7,7 +7,8 @@ import {
 	session,
 	toOriginalsPath,
 	toUserPath,
-	userBasePath
+	userBasePath,
+	userLibraryBase
 } from '$lib/stores/session.svelte';
 import { primaryFile } from '$lib/types/photoprism';
 import type {
@@ -28,6 +29,14 @@ const http: AxiosInstance = axios.create({
 	headers: { 'Content-Type': 'application/json' }
 });
 
+/** Axios instance for sidecar endpoints — no baseURL prefix so paths
+ *  like `/api/sidecar/timeline` resolve directly through Caddy's
+ *  `/api/sidecar/*` rule instead of becoming `/api/v1/api/sidecar/*`. */
+const sidecar: AxiosInstance = axios.create({
+	baseURL: '',
+	headers: { 'Content-Type': 'application/json' }
+});
+
 http.interceptors.request.use((config) => {
 	if (session.accessToken) {
 		config.headers = config.headers ?? {};
@@ -36,6 +45,14 @@ http.interceptors.request.use((config) => {
 	return config;
 });
 
+sidecar.interceptors.request.use((config) => {
+	if (session.accessToken) {
+		config.headers = config.headers ?? {};
+		(config.headers as Record<string, string>)['X-Auth-Token'] = session.accessToken;
+	}
+	return config;
+});
+
 http.interceptors.response.use(
 	(r) => r,
 	(err: AxiosError) => {
@@ -51,6 +68,20 @@ http.interceptors.response.use(
 	}
 );
 
+sidecar.interceptors.response.use(
+	(r) => r,
+	(err: AxiosError) => {
+		if (err.response?.status === 401 && browser) {
+			clearSession();
+			const url = err.config?.url ?? '';
+			if (!url.endsWith('/session')) {
+				void goto('/login', { replaceState: true });
+			}
+		}
+		return Promise.reject(err);
+	}
+);
+
 // ── Auth ─────────────────────────────────────────────────────────────────────
 
 export async function login(username: string, password: string): Promise<PpSessionResponse> {
@@ -144,7 +175,7 @@ export interface ListPhotosParams {
 }
 
 export async function listPhotos(params: ListPhotosParams = {}): Promise<PpPhoto[]> {
-	const { data } = await http.get<PpPhoto[]>('/photos', {
+	const { data } = await sidecar.get<PpPhoto[]>('/api/sidecar/timeline', {
 		params: {
 			count: 60,
 			offset: 0,
@@ -156,6 +187,26 @@ export async function listPhotos(params: ListPhotosParams = {}): Promise<PpPhoto
 	return data;
 }
 
+/**
+ * Resolve photos for an explicit set of UIDs. Used by the Colors / Ratings
+ * facets, whose member set comes from the mule-sidecar marks store and is NOT
+ * bounded to the newest N photos — a marked photo anywhere in the library must
+ * resolve. Fetches per-UID (concurrency-bounded) via the same `/photos/:uid`
+ * endpoint the metadata panel uses, so it can't drift from PhotoPrism's search
+ * DSL. Missing UIDs (deleted since marked) are skipped.
+ */
+export async function listPhotosByUids(uids: string[]): Promise<PpPhoto[]> {
+	if (uids.length === 0) return [];
+	const out: PpPhoto[] = [];
+	const concurrency = 8;
+	for (let i = 0; i < uids.length; i += concurrency) {
+		const slice = uids.slice(i, i + concurrency);
+		const fetched = await Promise.all(slice.map((uid) => getPhoto(uid).catch(() => null)));
+		for (const p of fetched) if (p) out.push(p);
+	}
+	return out;
+}
+
 /**
  * Fetch a page of photos *anchored at* a specific TakenAt — `before`
  * older photos preceded by `after` newer ones, merged newest-first.
@@ -260,7 +311,7 @@ export async function listPhotosAround(p: AroundParams): Promise<PpPhoto[]> {
  */
 export async function countPhotos(q: string, opts: { merged?: boolean } = {}): Promise<number> {
 	const merged = opts.merged ?? false;
-	const resp = await http.get<PpPhoto[]>('/photos', {
+	const resp = await sidecar.get<PpPhoto[]>('/api/sidecar/timeline', {
 		params: { count: 10000, offset: 0, merged, q }
 	});
 	// PhotoPrism's `X-Count` header counts SQL file rows (one row per
@@ -453,20 +504,45 @@ export interface PpFolder {
  * row itself is dropped — the sidebar synthesises the root entry. When
  * BasePath is empty (today's admin default) this is a no-op.
  */
-export async function listFolders(): Promise<PpFolder[]> {
-	const { data } = await http.get<{ folders?: PpFolder[] }>(
-		'/folders/originals',
+async function fetchFolders(): Promise<PpFolder[]> {
+	const { data } = await sidecar.get<{ folders?: PpFolder[] }>(
+		'/api/sidecar/folders',
 		{ params: { recursive: true, uncached: true, files: false } }
 	);
-	const bp = userBasePath();
-	const folders = data.folders ?? [];
-	if (bp === '') return folders;
+	return data.folders ?? [];
+}
+
+/**
+ * Filter a flat folder list to those at/under `base` (server-absolute,
+ * originals-relative) and rewrite each `Path` to be `base`-relative, dropping
+ * the `base` row itself. `base === ''` (whole library) is a no-op. Sidecar
+ * already filters by BasePath; this is the frontend's safety net + the
+ * narrowing to the chosen index sub-path.
+ */
+function scopeFolders(folders: PpFolder[], base: string): PpFolder[] {
+	if (base === '') return folders;
 	return folders
-		.filter((f) => f.Path === bp || f.Path.startsWith(bp + '/'))
-		.map((f) => ({ ...f, Path: toUserPath(f.Path) }))
+		.filter((f) => f.Path === base || f.Path.startsWith(base + '/'))
+		.map((f) => ({ ...f, Path: f.Path === base ? '' : f.Path.slice(base.length + 1) }))
 		.filter((f) => f.Path !== '');
 }
 
+export async function listFolders(): Promise<PpFolder[]> {
+	// Scoped to the *effective* library root (BasePath + chosen index
+	// sub-path) so the sidebar tree re-roots to whatever the user picked.
+	return scopeFolders(await fetchFolders(), userLibraryBase());
+}
+
+/**
+ * Like `listFolders` but scoped to the user's *whole* BasePath, ignoring the
+ * chosen index sub-path. The index-folder picker uses this so the user can
+ * choose any sub-folder of their library as a new root — including ones
+ * outside the current sub-path.
+ */
+export async function listFoldersUnderBase(): Promise<PpFolder[]> {
+	return scopeFolders(await fetchFolders(), userBasePath());
+}
+
 /**
  * Per-folder photo count for each `paths[]` entry. PhotoPrism's `/folders`
  * endpoint reports `FileCount: 0` even when populated, so the count has
@@ -496,7 +572,7 @@ export async function listFolderCounts(paths: string[]): Promise<Record<string,
 	// on the way out, then re-key the response back to user-relative on
 	// the way in so callers' map keys line up with their input array.
 	const serverPaths = paths.map((p) => toOriginalsPath(p));
-	const data = (await sidecar('POST', '/folders/counts', { paths: serverPaths })) as Record<
+	const data = (await callSidecar('POST', '/folders/counts', { paths: serverPaths })) as Record<
 		string,
 		number
 	>;
@@ -507,35 +583,19 @@ export async function listFolderCounts(paths: string[]): Promise<Record<string,
 	return out;
 }
 
-// ── Geo ──────────────────────────────────────────────────────────────────────
+// ── Countries ────────────────────────────────────────────────────────────────
 
-export interface PpGeoFeature {
-	type: 'Feature';
-	id: string;
-	geometry: { type: 'Point'; coordinates: [number, number] };
-	properties: {
-		UID: string;
-		Hash: string;
-		Title?: string;
-		TakenAt?: string;
-		FavId?: number;
-	};
+export interface PpCountry {
+	Code: string;
+	PhotoCount: number;
+	Thumb?: string;
 }
 
-export interface PpGeoCollection {
-	type: 'FeatureCollection';
-	features: PpGeoFeature[];
-	bbox?: number[];
-}
-
-export async function listGeo(q = ''): Promise<PpGeoCollection> {
-	// PhotoPrism's `/geo` returns a GeoJSON FeatureCollection of every
-	// matching geocoded photo. MapLibre's native clustering handles 50k+
-	// points without breaking a sweat (PhotoPrism upstream documents
-	// 500k); we ask for a generous cap that covers realistic libraries.
-	const { data } = await http.get<PpGeoCollection>('/geo', {
-		params: { count: 50000, q: q || undefined }
-	});
+export async function listCountries(): Promise<PpCountry[]> {
+	// Self-contained sidecar aggregation (groups photos.photo_country directly,
+	// no PhotoPrism proxy round-trip) so counts/thumbs are scoped to the
+	// caller's BasePath the same way /labels and /counts are.
+	const { data } = await sidecar.get<PpCountry[]>('/api/sidecar/countries');
 	return data;
 }
 
@@ -586,14 +646,13 @@ export interface PhotoWithNote {
 }
 
 export async function listPhotosWithNotes(): Promise<PhotoWithNote[]> {
-	const list = await listPhotos({ count: 1000, order: 'newest', merged: true });
+	// The sidecar pages PhotoPrism to completion server-side and returns only
+	// captioned, BasePath-scoped photos — paging client-side would stop early
+	// because each page is BasePath-filtered before we see it (a full upstream
+	// page can arrive short), silently hiding notes past the first slice.
+	const { data } = await sidecar.get<PpPhoto[]>('/api/sidecar/notes');
 	const out: PhotoWithNote[] = [];
-	const seen = new Set<string>();
-	for (const p of list) {
-		// `merged: true` can repeat a photo across file-rows; dedupe by UID
-		// so the same tile doesn't render twice.
-		if (seen.has(p.UID)) continue;
-		seen.add(p.UID);
+	for (const p of data) {
 		const note = p.Caption?.trim();
 		if (!note) continue;
 		out.push({ photo: p, note });
@@ -635,6 +694,35 @@ export async function aggregateKeywords(): Promise<AggregatedKeyword[]> {
 	return Array.from(buckets.values()).sort((a, b) => b.count - a.count);
 }
 
+async function hasPhotosMatching(q: string): Promise<boolean> {
+	const resp = await sidecar.get<PpPhoto[]>('/api/sidecar/timeline', {
+		params: { count: 1, offset: 0, q }
+	});
+	return Array.isArray(resp.data) && resp.data.length > 0;
+}
+
+async function filterByUserPhotos<T>(
+	items: T[],
+	queryFor: (item: T) => string
+): Promise<T[]> {
+	if (userBasePath() === '') return items;
+	const CONCURRENCY = 8;
+	const out: T[] = [];
+	for (let i = 0; i < items.length; i += CONCURRENCY) {
+		const batch = items.slice(i, i + CONCURRENCY);
+		const checks = await Promise.all(
+			batch.map(async (item) => ({
+				item,
+				has: await hasPhotosMatching(queryFor(item))
+			}))
+		);
+		for (const { item, has } of checks) {
+			if (has) out.push(item);
+		}
+	}
+	return out;
+}
+
 export async function listLabels(): Promise<PpLabel[]> {
 	// `all=true` includes labels PhotoPrism has soft-deleted (auto-hidden
 	// low-confidence classifier hits, manually-removed labels). They're
@@ -643,9 +731,16 @@ export async function listLabels(): Promise<PpLabel[]> {
 	// them out and the tags page silently shows only ~40% of the user's
 	// real tag set. `count` bumped to 1000 so a moderately tagged library
 	// returns the full list in one round-trip.
-	const { data } = await http.get<PpLabel[]>('/labels', {
-		params: { count: 1000, order: 'count', all: true }
+	//
+	// Uses the sidecar proxy (/api/sidecar/labels) instead of PhotoPrism's
+	// /api/v1/labels so PhotoCount reflects only photos under the user's
+	// BasePath. The sidecar proxies the request through to PP then
+	// post-filters each label's count.
+	const { data } = await sidecar.get<PpLabel[]>('/api/sidecar/labels', {
+		params: { count: 1000, order: 'count', all: true, perPage: 1000 }
 	});
+	// Sidecar already filters to the user's scope and sets correct counts +
+	// thumbs in one DB query — no need to probe each label individually.
 	return data;
 }
 
@@ -670,7 +765,7 @@ export async function listSubjects(): Promise<PpSubject[]> {
 	const { data } = await http.get<PpSubject[]>('/subjects', {
 		params: { count: 1000, order: 'count' }
 	});
-	return data ?? [];
+	return filterByUserPhotos(data ?? [], (s) => `person:${s.Slug}`);
 }
 
 export async function updateSubject(uid: string, patch: Partial<PpSubject>): Promise<PpSubject> {
@@ -808,7 +903,7 @@ export interface RenameResult {
 	newRelPath: string;
 }
 
-async function sidecar(method: string, urlPath: string, body?: unknown): Promise<unknown> {
+async function callSidecar(method: string, urlPath: string, body?: unknown): Promise<unknown> {
 	const res = await fetch(`/api/sidecar${urlPath}`, {
 		method,
 		headers: {
@@ -826,20 +921,20 @@ async function sidecar(method: string, urlPath: string, body?: unknown): Promise
 }
 
 export async function createFolder(relPath: string): Promise<{ path: string }> {
-	return sidecar('POST', '/folders', { path: relPath }) as Promise<{ path: string }>;
+	return callSidecar('POST', '/folders', { path: relPath }) as Promise<{ path: string }>;
 }
 
 export async function renameFolder(
 	relPath: string,
 	newName: string
 ): Promise<{ oldPath: string; newPath: string }> {
-	return sidecar('POST', `/folders/${encodeURIComponent(relPath)}/rename`, {
+	return callSidecar('POST', `/folders/${encodeURIComponent(relPath)}/rename`, {
 		newName
 	}) as Promise<{ oldPath: string; newPath: string }>;
 }
 
 export async function deleteFolder(relPath: string): Promise<{ path: string }> {
-	return sidecar('DELETE', `/folders/${encodeURIComponent(relPath)}`) as Promise<{
+	return callSidecar('DELETE', `/folders/${encodeURIComponent(relPath)}`) as Promise<{
 		path: string;
 	}>;
 }
@@ -872,7 +967,7 @@ export interface CrossFolderScanResult {
 }
 
 export async function scanCrossFolderDuplicates(): Promise<CrossFolderScanResult> {
-	return sidecar('GET', '/duplicates/scan') as Promise<CrossFolderScanResult>;
+	return callSidecar('GET', '/duplicates/scan') as Promise<CrossFolderScanResult>;
 }
 
 export interface ArchiveDuplicatesResult {
@@ -883,7 +978,7 @@ export interface ArchiveDuplicatesResult {
 export async function archiveDuplicatePaths(
 	paths: string[]
 ): Promise<ArchiveDuplicatesResult> {
-	return sidecar('POST', '/duplicates/archive', { paths }) as Promise<ArchiveDuplicatesResult>;
+	return callSidecar('POST', '/duplicates/archive', { paths }) as Promise<ArchiveDuplicatesResult>;
 }
 
 // ── Heap convert (move/copy heap photos to a folder) ────────────────────────
@@ -915,7 +1010,44 @@ export async function convertHeap(
 	uid: string,
 	body: HeapConvertBody
 ): Promise<HeapConvertResult> {
-	return sidecar('POST', `/albums/${uid}/convert`, body) as Promise<HeapConvertResult>;
+	return callSidecar('POST', `/albums/${uid}/convert`, body) as Promise<HeapConvertResult>;
+}
+
+// ── Move arbitrary photos (by UID) to a folder ──────────────────────────────
+// Same on-disk move/copy + reindex as convertHeap, but the sidecar resolves the
+// photos from a UID list instead of an album. Backs the grid's move-to-folder.
+
+export interface PhotosMoveBody {
+	uids: string[];
+	/** Originals-relative target folder. Empty string = originals root. */
+	targetFolder: string;
+	mode: 'move' | 'copy';
+	/** Optional subfolder to create under `targetFolder` and place files into. */
+	subfolder?: string | null;
+}
+
+export interface PhotosMoveResult {
+	moved: number;
+	copied: number;
+	errors: { uid: string; reason: string }[];
+}
+
+export async function movePhotosToFolder(body: PhotosMoveBody): Promise<PhotosMoveResult> {
+	return callSidecar('POST', '/photos/move', body) as Promise<PhotosMoveResult>;
+}
+
+// ── Reparent a folder (move the directory under a different parent) ──────────
+
+export interface FolderMoveResult {
+	ok: boolean;
+	oldPath: string;
+	newPath: string;
+}
+
+export async function moveFolder(rel: string, targetParent: string): Promise<FolderMoveResult> {
+	return callSidecar('POST', `/folders/${encodeURIComponent(rel)}/move`, {
+		targetParent
+	}) as Promise<FolderMoveResult>;
 }
 
 // ── Photo marks (rating + color) ─────────────────────────────────────────────
@@ -931,19 +1063,19 @@ export interface PhotoMark {
 export type PhotoMarksMap = Record<string, PhotoMark>;
 
 export async function getAllMarks(): Promise<PhotoMarksMap> {
-	const data = await sidecar('GET', '/photos/marks');
+	const data = await callSidecar('GET', '/photos/marks');
 	return (data ?? {}) as PhotoMarksMap;
 }
 
 export async function setMark(photoUid: string, patch: PhotoMark): Promise<PhotoMark> {
-	return sidecar('PUT', `/photos/${photoUid}/marks`, patch) as Promise<PhotoMark>;
+	return callSidecar('PUT', `/photos/${photoUid}/marks`, patch) as Promise<PhotoMark>;
 }
 
 export async function bulkSetMarks(
 	ids: string[],
 	patch: PhotoMark
 ): Promise<{ count: number; marks: PhotoMarksMap }> {
-	return sidecar('POST', '/photos/marks/bulk', { ids, patch }) as Promise<{
+	return callSidecar('POST', '/photos/marks/bulk', { ids, patch }) as Promise<{
 		count: number;
 		marks: PhotoMarksMap;
 	}>;
@@ -968,26 +1100,17 @@ export async function renameOnDisk(photoUid: string, newName: string): Promise<R
 // ── Settings / Admin ─────────────────────────────────────────────────────────
 //
 // Thin wrappers over PhotoPrism's admin endpoints driving the settings dialog
-// (Library / Index / Import / Logs). Shapes are deliberately partial — newer
+// (Library / Index / Logs). Shapes are deliberately partial — newer
 // PhotoPrism versions ship extra fields we don't render, and the POST endpoint
 // merges server-side, so it's safe to round-trip an incomplete object.
 
+// PhotoPrism's /settings payload. muleimage only drives the indexer/stack/
+// download knobs from its own UI — the `ui`/`search`/`maps`/`import`/`features`
+// blocks PhotoPrism also returns only steer PhotoPrism's own SPA (which our
+// users never see), so they're intentionally omitted here and never surfaced.
+// The `[k: string]` index signature means an unknown round-tripped block is
+// preserved on save without us having to model it.
 export interface PpSettings {
-	ui?: {
-		theme?: string;
-		language?: string;
-		timeZone?: string;
-		startPage?: string;
-		scrollbar?: boolean;
-		zoom?: boolean;
-	};
-	search?: {
-		batchSize?: number;
-		listView?: boolean;
-		showTitles?: boolean;
-		showCaptions?: boolean;
-	};
-	maps?: { animate?: number; style?: string };
 	index?: {
 		path?: string;
 		convert?: boolean;
@@ -997,7 +1120,6 @@ export interface PpSettings {
 		skipRaw?: boolean;
 		skipHidden?: boolean;
 	};
-	import?: { path?: string; move?: boolean; dest?: string };
 	stack?: { uuid?: boolean; meta?: boolean; name?: boolean };
 	download?: {
 		name?: string;
@@ -1008,42 +1130,27 @@ export interface PpSettings {
 		crc32?: boolean;
 		sha1?: boolean;
 	};
-	/**
-	 * PhotoPrism's feature-flag bag. Each key gates a UI surface (and the
-	 * matching API endpoints) inside PP's own SPA — disabling `share` for
-	 * example hides every share button. Optional because older PP versions
-	 * don't return the block; the Library tab only renders toggles for
-	 * keys it actually sees in the response.
-	 */
-	features?: {
-		archive?: boolean;
-		private?: boolean;
-		review?: boolean;
-		files?: boolean;
-		folders?: boolean;
-		moments?: boolean;
-		calendar?: boolean;
-		places?: boolean;
-		edit?: boolean;
-		share?: boolean;
-		library?: boolean;
-		import?: boolean;
-		logs?: boolean;
-		search?: boolean;
-		account?: boolean;
-		settings?: boolean;
-		services?: boolean;
-		people?: boolean;
-		labels?: boolean;
-		download?: boolean;
-		upload?: boolean;
-		delete?: boolean;
-		ratings?: boolean;
-		[k: string]: boolean | undefined;
-	};
 	[k: string]: unknown;
 }
 
+// ── Per-user prefs (sidecar) ──────────────────────────────────────────────────
+//
+// The index sub-path: an originals-relative folder under the user's BasePath
+// that re-roots the Library tree and scopes the reindex. Stored server-side by
+// the sidecar, keyed by username. Empty string = "whole folder".
+
+export async function getIndexSubpath(): Promise<string> {
+	const data = (await callSidecar('GET', '/prefs')) as { indexPath?: string };
+	return (data.indexPath ?? '').replace(/^\/+|\/+$/g, '');
+}
+
+export async function setIndexSubpath(indexPath: string): Promise<string> {
+	const data = (await callSidecar('PUT', '/prefs', {
+		indexPath: indexPath.replace(/^\/+|\/+$/g, '')
+	})) as { indexPath?: string };
+	return (data.indexPath ?? '').replace(/^\/+|\/+$/g, '');
+}
+
 export async function getSettings(): Promise<PpSettings> {
 	const { data } = await http.get<PpSettings>('/settings');
 	return data;
@@ -1074,26 +1181,6 @@ export async function cancelIndex(): Promise<void> {
 	await http.delete('/index');
 }
 
-export interface ImportBody {
-	path?: string;
-	move?: boolean;
-	dest?: string;
-}
-
-export async function startImport(body: ImportBody = {}): Promise<{ message: string }> {
-	const { data } = await http.post<{ message: string }>('/import', {
-		path: '/',
-		move: false,
-		dest: '',
-		...body
-	});
-	return data;
-}
-
-export async function cancelImport(): Promise<void> {
-	await http.delete('/import');
-}
-
 export interface PpLogEntry {
 	Time: string;
 	Level: string;

web/src/lib/stores/bulkAction.svelte.ts

@@ -0,0 +1,102 @@
+/**
+ * Bulk-action status, written by BulkActionBar and read by the header
+ * StatusPill and individual PhotoTile overlays.
+ *
+ * State lifecycle:
+ *   startBulk  → pill spins, all target tiles go "pending"
+ *   setDetail  → pill shows the filename currently being processed (fan-out ops)
+ *   doneBulk   → pill shows completion label, tiles flash green, auto-clears after 3 s
+ *   removedBulk→ destructive completion (archive / delete): tiles flash a red cross,
+ *                then the caller hides them via markRemoved; map auto-clears after 3 s
+ *   failBulk   → tiles flash red, auto-clears after 2 s
+ */
+
+import { SvelteMap, SvelteSet } from 'svelte/reactivity';
+
+interface BulkActionState {
+	active: boolean;
+	label: string;
+	detail?: string;
+}
+
+export const bulkAction = $state<BulkActionState>({ active: false, label: '' });
+// SvelteMap (not `$state(new Map())`) so a `.get(uid)` read in a PhotoTile
+// reliably re-runs when the entry flips — the plain-Map proxy form wasn't
+// re-rendering the timeline tiles' overlay.
+export const bulkPhotoStates = new SvelteMap<string, 'pending' | 'done' | 'error' | 'removed'>();
+
+/**
+ * UIDs hidden from the timeline grid the instant a removing action (archive /
+ * delete / restore) succeeds, so tiles vanish without waiting on the ~1s
+ * server-reconcile refetch. The caller clears each id once the refetch lands.
+ * This is a pure UI overlay — it never touches the query cache, so it can't
+ * corrupt the facet/drill caches the way a direct cache eviction did.
+ */
+export const removedIds = $state(new SvelteSet<string>());
+
+export function markRemoved(ids: string[]): void {
+	for (const id of ids) removedIds.add(id);
+}
+
+export function clearRemoved(ids: string[]): void {
+	for (const id of ids) removedIds.delete(id);
+}
+
+let doneTimer: ReturnType<typeof setTimeout> | null = null;
+
+export function startBulk(label: string, ids: string[]): void {
+	if (doneTimer !== null) {
+		clearTimeout(doneTimer);
+		doneTimer = null;
+	}
+	bulkPhotoStates.clear();
+	for (const id of ids) bulkPhotoStates.set(id, 'pending');
+	bulkAction.active = true;
+	bulkAction.label = label;
+	bulkAction.detail = undefined;
+}
+
+export function setDetail(path: string): void {
+	bulkAction.detail = path;
+}
+
+export function doneBulk(label: string, ids: string[]): void {
+	for (const id of ids) bulkPhotoStates.set(id, 'done');
+	bulkAction.active = false;
+	bulkAction.label = label;
+	bulkAction.detail = undefined;
+	if (doneTimer !== null) clearTimeout(doneTimer);
+	doneTimer = setTimeout(() => {
+		bulkAction.label = '';
+		bulkPhotoStates.clear();
+		doneTimer = null;
+	}, 3000);
+}
+
+/**
+ * Destructive completion (archive / permanent delete): flash a red cross on the
+ * target tiles instead of the green check. The caller hides the tiles via
+ * markRemoved shortly after the flash; this timer only cleans up the state map.
+ */
+export function removedBulk(label: string, ids: string[]): void {
+	for (const id of ids) bulkPhotoStates.set(id, 'removed');
+	bulkAction.active = false;
+	bulkAction.label = label;
+	bulkAction.detail = undefined;
+	if (doneTimer !== null) clearTimeout(doneTimer);
+	doneTimer = setTimeout(() => {
+		bulkAction.label = '';
+		bulkPhotoStates.clear();
+		doneTimer = null;
+	}, 3000);
+}
+
+export function failBulk(ids: string[]): void {
+	for (const id of ids) bulkPhotoStates.set(id, 'error');
+	bulkAction.active = false;
+	bulkAction.label = '';
+	bulkAction.detail = undefined;
+	setTimeout(() => {
+		for (const id of ids) bulkPhotoStates.delete(id);
+	}, 2000);
+}

web/src/lib/stores/filters.svelte.ts

@@ -17,14 +17,21 @@ export type Section =
 	| 'hidden'
 	| 'heap';
 
-export type TagCategory = 'labels' | 'keywords' | 'people' | 'colors' | 'ratings';
+export type TagCategory =
+	| 'labels'
+	| 'keywords'
+	| 'people'
+	| 'colors'
+	| 'ratings'
+	| 'countries';
 
 export const TAG_CATEGORIES: readonly TagCategory[] = [
 	'labels',
 	'keywords',
 	'people',
 	'colors',
-	'ratings'
+	'ratings',
+	'countries'
 ] as const;
 
 export function isTagCategory(v: unknown): v is TagCategory {
@@ -239,6 +246,8 @@ export function filtersToQ(f: FilterState = filters): string {
 			parts.push(`keywords:${quoteIfNeeded(f.tagValue)}`);
 		} else if (f.tagCategory === 'people') {
 			parts.push(`person:${quoteIfNeeded(f.tagValue)}`);
+		} else if (f.tagCategory === 'countries') {
+			parts.push(`country:${quoteIfNeeded(f.tagValue)}`);
 		}
 	}
 	if (f.search) parts.push(quoteIfNeeded(f.search));

web/src/lib/stores/indexer.svelte.ts

@@ -1,4 +1,5 @@
 import { browser } from '$app/environment';
+import { queryClient } from '$lib/queryClient';
 import { isAuthenticated, session } from './session.svelte';
 
 /**
@@ -44,6 +45,27 @@ let lastFileUpdateAt = 0;
 let pendingFileTimer: ReturnType<typeof setTimeout> | null = null;
 let pendingFileName: string | undefined;
 
+// Newly indexed photos sort newest-first, so they land at the top of the
+// timeline. Refetch the photos query as files stream in so the user watches
+// new tiles arrive without a manual reload — but on a much coarser cadence
+// than the per-file pill throttle, since a timeline refetch is far heavier
+// than a label swap. Tracked independently of `lastFileUpdateAt` so the two
+// throttles don't interfere.
+const PHOTOS_REFETCH_THROTTLE_MS = 2000;
+let lastPhotosInvalidateAt = 0;
+
+function invalidatePhotosGrid(): void {
+	if (!browser || !isAuthenticated()) return;
+	void queryClient.invalidateQueries({ queryKey: ['photos'] });
+}
+
+function invalidatePhotosGridThrottled(): void {
+	const now = Date.now();
+	if (now - lastPhotosInvalidateAt < PHOTOS_REFETCH_THROTTLE_MS) return;
+	lastPhotosInvalidateAt = now;
+	invalidatePhotosGrid();
+}
+
 function url(): string {
 	const proto = location.protocol === 'https:' ? 'wss:' : 'ws:';
 	return `${proto}//${location.host}/api/v1/ws`;
@@ -134,6 +156,8 @@ function handleMessage(raw: string): void {
 			const fileName =
 				(data.fileName as string | undefined) ?? (data.baseName as string | undefined);
 			setActiveThrottled('Indexing', fileName);
+			// Stream newly indexed files into the grid as the scan runs.
+			invalidatePhotosGridThrottled();
 			return;
 		}
 		case 'index.updating': {
@@ -148,6 +172,8 @@ function handleMessage(raw: string): void {
 		case 'index.completed': {
 			const seconds = typeof data.seconds === 'number' ? data.seconds : undefined;
 			setCompleted(seconds !== undefined ? `Indexed in ${seconds}s` : 'Index complete');
+			// Final refetch so the grid lands on the fully-indexed result.
+			invalidatePhotosGrid();
 			return;
 		}
 		default:

web/src/lib/stores/moveDialog.svelte.ts

@@ -0,0 +1,28 @@
+/**
+ * Global "move to folder" dialog state. A single MoveToFolderDialog (mounted
+ * once in the root layout) renders whenever `subject` is non-null. Every entry
+ * point — heap kebab, folder kebab, the grid's BulkActionBar button, and the
+ * `m` keyboard shortcut — opens it through openMove(), so the picker UI and
+ * the move/copy logic live in exactly one place.
+ */
+
+import type { PpAlbum } from '$lib/services/photoprism';
+
+export type MoveSubject =
+	| { kind: 'heap'; heap: PpAlbum }
+	| { kind: 'photos'; uids: string[] }
+	| { kind: 'folder'; path: string };
+
+interface MoveDialogState {
+	subject: MoveSubject | null;
+}
+
+export const moveDialog = $state<MoveDialogState>({ subject: null });
+
+export function openMove(subject: MoveSubject): void {
+	moveDialog.subject = subject;
+}
+
+export function closeMove(): void {
+	moveDialog.subject = null;
+}

web/src/lib/stores/session.svelte.ts

@@ -57,6 +57,10 @@ export function adoptSession(resp: PpSessionResponse, cfg?: PpClientConfig): voi
 	// (Hit this with the `test` user seeing the admin's library counts
 	// in the left sidebar.)
 	queryClient.clear();
+	// The index sub-path is per-user; drop the prior identity's value so the
+	// app re-roots to the new user's whole folder until the ['prefs'] query
+	// rehydrates it from the sidecar.
+	prefs.indexSubpath = '';
 	session.id = resp.id;
 	session.accessToken = resp.access_token;
 	session.previewToken = (cfg ?? resp.config)?.previewToken ?? '';
@@ -71,6 +75,7 @@ export function clearSession(): void {
 	session.previewToken = null;
 	session.downloadToken = null;
 	session.user = null;
+	prefs.indexSubpath = '';
 	if (browser) localStorage.removeItem(STORAGE_KEY);
 	// Same reasoning as adoptSession — wipe the cache so the next user
 	// who logs in (or the login screen itself) doesn't render with the
@@ -163,43 +168,73 @@ export function videoUrl(hash: string, format = 'avc'): string {
 /**
  * The signed-in user's library root, originals-relative, no leading/trailing
  * slash. `""` means "whole library" — used today by admin accounts whose
- * BasePath isn't configured in PhotoPrism. Non-empty values gate every place
- * that crosses the user↔server seam (sidebar tree, timeline `path:` filter,
- * folder counts, heap convert) so each user sees only their own subtree.
+ * BasePath isn't configured in PhotoPrism. This is the user's *whole* folder
+ * as set on their PhotoPrism account; the working library root the rest of
+ * the app re-roots to is `userLibraryBase()` (BasePath + chosen sub-path).
  */
 export function userBasePath(): string {
 	return (session.user?.BasePath ?? '').replace(/^\/+|\/+$/g, '');
 }
 
+/**
+ * Per-user "index sub-path": a folder *under* the user's BasePath that they've
+ * chosen as their working library root. Stored server-side by the sidecar
+ * (keyed by username) and hydrated into this reactive state at startup via the
+ * `['prefs']` query. Empty string = "whole folder" (no narrowing). Normalized
+ * to no leading/trailing slash.
+ */
+export const prefs = $state<{ indexSubpath: string }>({ indexSubpath: '' });
+
+export function setIndexSubpathState(sub: string): void {
+	prefs.indexSubpath = (sub ?? '').replace(/^\/+|\/+$/g, '');
+}
+
+/**
+ * The effective working library root, originals-relative, no leading/trailing
+ * slash: the user's BasePath narrowed by their chosen index sub-path. This is
+ * the single point the whole app re-roots through — `toOriginalsPath` /
+ * `toUserPath` (and thus the sidebar tree, timeline `path:` filter, folder
+ * counts, folder CRUD, reindex) all derive from it. When both are empty it's
+ * `""` (whole library), matching the prior BasePath-only behavior.
+ */
+export function userLibraryBase(): string {
+	const bp = userBasePath();
+	const sub = prefs.indexSubpath;
+	if (sub === '') return bp;
+	return bp === '' ? sub : `${bp}/${sub}`;
+}
+
 /**
  * Translate a user-relative path (what the sidebar and URL deal in) to a
  * server-absolute, originals-relative path (what PhotoPrism's `path:`
- * operator and the sidecar's filesystem ops want).
+ * operator and the sidecar's filesystem ops want). Relative to the effective
+ * library root (`userLibraryBase()`), so the chosen index sub-path is folded
+ * in automatically.
  *
- *   "" or "/"          → BasePath                (user's root)
- *   "2024/01"          → "<basePath>/2024/01"
+ *   "" or "/"          → libraryBase             (user's working root)
+ *   "2024/01"          → "<libraryBase>/2024/01"
  *   null               → "" (caller decides to omit the filter entirely)
  */
 export function toOriginalsPath(uiPath: string | null): string {
 	if (uiPath === null) return '';
-	const bp = userBasePath();
+	const base = userLibraryBase();
 	const rel = uiPath.replace(/^\/+|\/+$/g, '');
-	if (rel === '') return bp;
-	return bp === '' ? rel : `${bp}/${rel}`;
+	if (rel === '') return base;
+	return base === '' ? rel : `${base}/${rel}`;
 }
 
 /**
- * Inverse of `toOriginalsPath` — strips the user's BasePath prefix so the
- * UI can render `2024/01` instead of `users/alice/2024/01`. Paths that
- * are equal to the BasePath collapse to `""` (the user's root sentinel).
- * Paths outside the BasePath are returned as-is, but callers should
- * already have filtered those out via `listFolders`'s post-filter.
+ * Inverse of `toOriginalsPath` — strips the effective library-root prefix so
+ * the UI can render `2024/01` instead of `users/alice/2024/01`. Paths that
+ * are equal to the root collapse to `""` (the user's root sentinel). Paths
+ * outside the root are returned as-is, but callers should already have
+ * filtered those out via `listFolders`'s post-filter.
  */
 export function toUserPath(serverPath: string): string {
-	const bp = userBasePath();
+	const base = userLibraryBase();
 	const sp = serverPath.replace(/^\/+|\/+$/g, '');
-	if (bp === '') return sp;
-	if (sp === bp) return '';
-	if (sp.startsWith(bp + '/')) return sp.slice(bp.length + 1);
+	if (base === '') return sp;
+	if (sp === base) return '';
+	if (sp.startsWith(base + '/')) return sp.slice(base.length + 1);
 	return sp;
 }

web/src/lib/utils/countries.ts

@@ -0,0 +1,29 @@
+// Country code (ISO 3166-1 alpha-2, lowercase — PhotoPrism's `Country` field
+// shape) → display helpers for the Countries tag-browser category.
+
+let regionNames: Intl.DisplayNames | undefined;
+function getRegionNames(): Intl.DisplayNames | undefined {
+	if (regionNames) return regionNames;
+	try {
+		regionNames = new Intl.DisplayNames(['en'], { type: 'region' });
+	} catch {
+		regionNames = undefined;
+	}
+	return regionNames;
+}
+
+export function countryName(code: string): string {
+	if (!code) return code;
+	const name = getRegionNames()?.of(code.toUpperCase());
+	return name ?? code;
+}
+
+const REGIONAL_INDICATOR_OFFSET = 0x1f1a5; // 0x1f1e6 ('A') - 'A'.charCodeAt(0)
+
+export function countryFlag(code: string): string {
+	if (!code || code.length !== 2) return '';
+	const upper = code.toUpperCase();
+	return Array.from(upper)
+		.map((ch) => String.fromCodePoint(ch.charCodeAt(0) + REGIONAL_INDICATOR_OFFSET))
+		.join('');
+}

web/src/routes/+layout.svelte

@@ -13,10 +13,13 @@
 	import { resizable } from '$lib/actions/resizable';
 	import { queryClient } from '$lib/queryClient';
 	import { startIndexerWatch, stopIndexerWatch } from '$lib/stores/indexer.svelte';
+	import { bulkAction } from '$lib/stores/bulkAction.svelte';
 	import IndexerStatusPill from '$lib/components/layout/IndexerStatusPill.svelte';
+	import StatusPill from '$lib/components/layout/StatusPill.svelte';
 	import LeftSidebar from '$lib/components/layout/LeftSidebar.svelte';
 	import AnimatedMule from '$lib/components/mule/AnimatedMule.svelte';
 	import PreviewModal from '$lib/components/preview/PreviewModal.svelte';
+	import MoveToFolderDialog from '$lib/components/layout/MoveToFolderDialog.svelte';
 
 	let { children } = $props();
 
@@ -72,6 +75,7 @@
 		<div class="flex h-screen flex-col overflow-hidden">
 			<AnimatedMule>
 				<IndexerStatusPill />
+				<StatusPill active={bulkAction.active} label={bulkAction.label} detail={bulkAction.detail} />
 			</AnimatedMule>
 			<div class="flex min-h-0 flex-1">
 				{#if !view.leftSidebarCollapsed}
@@ -114,6 +118,10 @@
 		     helper (called by the timeline / PhotoGrid dblclick paths and
 		     by gridKeyNav's Space handler). -->
 		<PreviewModal />
+		<!-- Single shared move-to-folder dialog, driven by the moveDialog
+		     store. Opened from the heap/folder kebabs, the BulkActionBar
+		     button, and the `m` shortcut — all through openMove(). -->
+		<MoveToFolderDialog />
 	{:else}
 		{@render children?.()}
 	{/if}

web/src/routes/+page.svelte

@@ -37,6 +37,7 @@
     setFocused,
     setOrder,
   } from "$lib/stores/selection.svelte";
+  import { removedIds, clearRemoved } from "$lib/stores/bulkAction.svelte";
   import {
     openPreview,
     setRightSidebarWidth,
@@ -245,7 +246,12 @@
   const dedupedAll = $derived<PpPhoto[]>(
     dedupedPhotos(photosQuery.data?.pages),
   );
-  const photos = $derived<PpPhoto[]>(applyFolderScope(dedupedAll, filters));
+  // `removedIds` hides tiles the instant a removing action (archive / delete /
+  // restore) succeeds, so the grid updates without waiting on the server-
+  // reconcile refetch (see bulkAction store / BulkActionBar).
+  const photos = $derived<PpPhoto[]>(
+    applyFolderScope(dedupedAll, filters).filter((p) => !removedIds.has(p.UID)),
+  );
   function dedupedPhotos(pages: PpPhoto[][] | undefined): PpPhoto[] {
     if (!pages) return [];
     const seen = new Set<string>();
@@ -277,6 +283,20 @@
   }
   const pageCount = $derived(photosQuery.data?.pages.length ?? 0);
 
+  // Reconcile the optimistic-removal overlay against the actual cache.
+  // `removedIds` hides a tile while its photo is still present in a loaded
+  // page; we drop an id from the set only once it has genuinely left the
+  // freshly-deduped cache (i.e. every page that held it has refetched
+  // without it). Driving the clear from the data — rather than from each
+  // archive action's invalidation promise — removes the race where settling
+  // one action's refetch un-hid a photo that other, still-stale pages
+  // continued to carry, making archived tiles flash back into the grid.
+  $effect(() => {
+    const present = new Set(dedupedAll.map((p) => p.UID));
+    const gone = [...removedIds].filter((id) => !present.has(id));
+    if (gone.length) clearRemoved(gone);
+  });
+
   $effect(() => {
     setOrder(photos.map((p) => p.UID));
   });
@@ -714,6 +734,7 @@
       return;
     }
     emptyingArchive = true;
+    const tid = toast.loading("Emptying archive…");
     let total = 0;
     try {
       while (true) {
@@ -729,9 +750,9 @@
         await batchDelete(uids);
         total += uids.length;
       }
-      toast.success(total === 0 ? "Archive already empty" : `Deleted ${total}`);
+      toast.success(total === 0 ? "Archive already empty" : `Deleted ${total}`, { id: tid });
     } catch (err) {
-      toast.error(err instanceof Error ? err.message : "Empty archive failed");
+      toast.error(err instanceof Error ? err.message : "Empty archive failed", { id: tid });
     } finally {
       emptyingArchive = false;
       void qc.invalidateQueries({ queryKey: ["photos"] });

web/src/routes/map/+page.svelte

@@ -1,423 +0,0 @@
-<script lang="ts">
-	import { onMount } from 'svelte';
-	import { createQuery } from '@tanstack/svelte-query';
-	import maplibregl, {
-		type GeoJSONSource,
-		type MapMouseEvent,
-		type MapSourceDataEvent
-	} from 'maplibre-gl';
-	import 'maplibre-gl/dist/maplibre-gl.css';
-	import { goto } from '$app/navigation';
-	import { listGeo, type PpGeoCollection, type PpGeoFeature } from '$lib/services/photoprism';
-	import { isAuthenticated, thumbUrl } from '$lib/stores/session.svelte';
-	import { setAnchor, setFocused, setOrder } from '$lib/stores/selection.svelte';
-	import Toolbar from '$lib/components/layout/Toolbar.svelte';
-
-	const geoQuery = createQuery<PpGeoCollection>(() => ({
-		queryKey: ['geo'],
-		queryFn: () => listGeo(),
-		enabled: isAuthenticated()
-	}));
-
-	let mapEl: HTMLDivElement | undefined = $state();
-	let map: maplibregl.Map | undefined;
-	/** Reactive flag flipped on once the MapLibre `load` event has fired
-	 *  and the `photos` source has been installed. The data-push `$effect`
-	 *  depends on this — otherwise, if the geoQuery resolves before the
-	 *  basemap style finishes loading, the effect runs with no source
-	 *  available and never re-runs (since `map` itself is not `$state`),
-	 *  leaving the map permanently empty. */
-	let mapReady = $state(false);
-
-	/** Markers currently attached to the map, keyed by feature id (UIDs
-	 *  for photos, `cluster:<clusterId>` for clusters). Diffed against the
-	 *  current `querySourceFeatures` set on every render to add markers
-	 *  that came into view and remove ones that scrolled out / got
-	 *  swallowed by a cluster — PhotoPrism's `markersOnScreen` pattern.
-	 *  See: https://github.com/photoprism/photoprism/blob/develop/frontend/src/page/places.vue */
-	const markers = new Map<string, maplibregl.Marker>();
-	const markersOnScreen = new Map<string, maplibregl.Marker>();
-
-	onMount(() => {
-		if (!mapEl) return;
-		map = new maplibregl.Map({
-			container: mapEl,
-			// PhotoPrism's default basemap style (CDN-hosted, no key required).
-			// The style JSON already references the correct glyphs URL, so
-			// no explicit override is needed here.
-			style: 'https://cdn.photoprism.app/maps/default.json',
-			center: [0, 20],
-			zoom: 1,
-			attributionControl: { compact: true }
-		});
-		map.addControl(
-			new maplibregl.NavigationControl({ visualizePitch: true, showZoom: true, showCompass: true }),
-			'top-right'
-		);
-		map.addControl(new maplibregl.ScaleControl({ maxWidth: 120, unit: 'metric' }), 'bottom-left');
-
-		map.on('load', () => {
-			addPhotoLayers();
-			mapReady = true;
-		});
-
-		// PhotoPrism's update strategy: re-reconcile markers on every map
-		// movement, on resize (so cluster bubbles re-balance when the
-		// viewport changes), on idle (catches the post-`fitBounds` settle),
-		// and on `sourcedata` filtered to "source fully loaded" — that's
-		// the moment MapLibre has processed clustering and
-		// `querySourceFeatures` returns meaningful results.
-		const onSourceData = (e: MapSourceDataEvent) => {
-			if (e.sourceId === 'photos' && e.isSourceLoaded) updateMarkers();
-		};
-		map.on('sourcedata', onSourceData);
-		map.on('move', updateMarkers);
-		map.on('moveend', updateMarkers);
-		map.on('resize', updateMarkers);
-		map.on('idle', updateMarkers);
-
-		return () => {
-			map?.off('sourcedata', onSourceData);
-			map?.off('move', updateMarkers);
-			map?.off('moveend', updateMarkers);
-			map?.off('resize', updateMarkers);
-			map?.off('idle', updateMarkers);
-			markersOnScreen.forEach((m) => m.remove());
-			markersOnScreen.clear();
-			markers.clear();
-			map?.remove();
-			map = undefined;
-			mapReady = false;
-		};
-	});
-
-	function addPhotoLayers() {
-		if (!map) return;
-		map.addSource('photos', {
-			type: 'geojson',
-			data: { type: 'FeatureCollection', features: [] },
-			cluster: true,
-			// PhotoPrism's clustering parameters — points within ~80px merge
-			// below zoom 17, individual photos render above that.
-			clusterMaxZoom: 17,
-			clusterRadius: 80
-		});
-		// Invisible layer for clusters — PhotoPrism does this so the source
-		// reports cluster features via `querySourceFeatures` (which only
-		// returns features actually rendered by some layer) while the
-		// visual presentation is owned by HTML markers below.
-		map.addLayer({
-			id: 'clusters',
-			type: 'circle',
-			source: 'photos',
-			filter: ['has', 'point_count'],
-			paint: { 'circle-color': '#ffffff', 'circle-opacity': 0, 'circle-radius': 0 }
-		});
-		// Click an (invisible) cluster anywhere on the map → zoom to its
-		// expansion level. The marker DOM also has a click handler, but
-		// pointer-through to the map needs this as a fallback.
-		map.on('click', 'clusters', (e: MapMouseEvent) => {
-			const features = map!.queryRenderedFeatures(e.point, { layers: ['clusters'] });
-			const clusterId = features[0]?.properties?.cluster_id;
-			if (clusterId == null) return;
-			const source = map!.getSource('photos') as GeoJSONSource;
-			source.getClusterExpansionZoom(clusterId).then((zoom) => {
-				const geometry = features[0]?.geometry;
-				if (!geometry || geometry.type !== 'Point') return;
-				map!.easeTo({ center: geometry.coordinates as [number, number], zoom });
-			});
-		});
-	}
-
-	/** Cluster bubble diameter, scaled by the number of contained photos
-	 *  — mirrors PhotoPrism's `getClusterSizeFromItemCount`. */
-	function clusterSize(count: number): number {
-		if (count >= 10000) return 74;
-		if (count >= 1000) return 70;
-		if (count >= 750) return 68;
-		if (count >= 200) return 66;
-		if (count >= 100) return 64;
-		return 60;
-	}
-
-	/** `1234` → `"1k"`, matching PhotoPrism's `abbreviateCount`. */
-	function abbreviateCount(value: number): string {
-		if (value >= 1000) return `${Math.round(value / 1000)}k`;
-		return String(value);
-	}
-
-	function buildPhotoMarker(uid: string, hash: string, title: string | undefined, allUids: string[]) {
-		const el = document.createElement('div');
-		el.className = 'marker';
-		if (title) el.title = title;
-		el.style.width = '50px';
-		el.style.height = '50px';
-		el.style.backgroundImage = `url(${thumbUrl(hash, 'tile_50')})`;
-		el.addEventListener('click', (ev) => {
-			ev.stopPropagation();
-			setOrder(allUids);
-			setFocused(uid);
-			setAnchor(uid);
-			void goto('/');
-		});
-		return el;
-	}
-
-	function buildClusterMarker(clusterId: number, count: number) {
-		const size = clusterSize(count);
-		const el = document.createElement('div');
-		el.className = 'marker';
-		el.style.width = `${size}px`;
-		el.style.height = `${size}px`;
-
-		const grid = document.createElement('div');
-		grid.className = 'cluster-marker';
-		el.appendChild(grid);
-
-		const badge = document.createElement('div');
-		badge.className = 'badge';
-		badge.textContent = abbreviateCount(count);
-		el.appendChild(badge);
-
-		// Fetch up to 4 sample thumbnails from the cluster's leaves and lay
-		// them out as a 1 / 2 / 4-image grid (PhotoPrism's pattern). The
-		// source is captured once here; `getClusterLeaves` returns a
-		// Promise, so this populates asynchronously and the bubble shows a
-		// dark placeholder until the thumbs arrive.
-		if (map) {
-			const source = map.getSource('photos') as GeoJSONSource | undefined;
-			if (source && typeof source.getClusterLeaves === 'function') {
-				source
-					.getClusterLeaves(clusterId, 4, 0)
-					.then((leaves) => {
-						const previewCount = leaves.length >= 4 ? 4 : leaves.length > 1 ? 2 : 1;
-						grid.style.gridTemplateColumns = previewCount === 1 ? '1fr' : '1fr 1fr';
-						for (let i = 0; i < previewCount; i++) {
-							const leaf = leaves[Math.floor((leaves.length * i) / previewCount)];
-							const props = (leaf?.properties ?? {}) as { Hash?: string };
-							if (!props.Hash) continue;
-							const tile = document.createElement('div');
-							tile.style.backgroundImage = `url(${thumbUrl(props.Hash, 'tile_50')})`;
-							grid.appendChild(tile);
-						}
-					})
-					.catch(() => {});
-			}
-		}
-
-		el.addEventListener('click', (ev) => {
-			ev.stopPropagation();
-			if (!map) return;
-			const source = map.getSource('photos') as GeoJSONSource;
-			source.getClusterExpansionZoom(clusterId).then((zoom) => {
-				// Use the marker's current LngLat — set just below in updateMarkers.
-				const m = markers.get(`cluster:${clusterId}`);
-				const ll = m?.getLngLat();
-				if (!ll) return;
-				map!.easeTo({ center: ll, zoom });
-			});
-		});
-		return el;
-	}
-
-	/** Reconcile HTML markers against what's currently in the rendered
-	 *  source. PhotoPrism's `updateMarkers`. */
-	function updateMarkers() {
-		if (!map || !map.isStyleLoaded() || !map.getSource('photos')) return;
-		const features = map.querySourceFeatures('photos');
-		const allUids = (geoQuery.data?.features ?? []).map((f) => f.properties.UID);
-		const seen = new Set<string>();
-
-		for (const f of features) {
-			const props = (f.properties ?? {}) as Record<string, unknown> & {
-				cluster?: boolean;
-				cluster_id?: number;
-				point_count?: number;
-				UID?: string;
-				Hash?: string;
-				Title?: string;
-			};
-			const geom = f.geometry;
-			if (geom.type !== 'Point') continue;
-			const coords = geom.coordinates as [number, number];
-
-			let key: string;
-			let buildEl: () => HTMLElement;
-			if (props.cluster) {
-				if (props.cluster_id == null) continue;
-				key = `cluster:${props.cluster_id}`;
-				const cid = props.cluster_id;
-				const count = props.point_count ?? 0;
-				buildEl = () => buildClusterMarker(cid, count);
-			} else {
-				if (!props.UID || !props.Hash) continue;
-				key = props.UID;
-				const uid = props.UID;
-				const hash = props.Hash;
-				const title = props.Title;
-				buildEl = () => buildPhotoMarker(uid, hash, title, allUids);
-			}
-
-			seen.add(key);
-			let marker = markers.get(key);
-			if (!marker) {
-				marker = new maplibregl.Marker({ element: buildEl(), anchor: 'center' }).setLngLat(coords);
-				markers.set(key, marker);
-			} else {
-				marker.setLngLat(coords);
-			}
-			if (!markersOnScreen.has(key)) {
-				marker.addTo(map);
-				markersOnScreen.set(key, marker);
-			}
-		}
-
-		for (const [key, marker] of markersOnScreen) {
-			if (!seen.has(key)) {
-				marker.remove();
-				markersOnScreen.delete(key);
-			}
-		}
-	}
-
-	// Push new geo data into the source whenever the query resolves AND
-	// the map is ready. Both orderings are handled: if data arrives first,
-	// the effect re-runs when `mapReady` flips; if the map is ready first,
-	// it re-runs when `data` arrives.
-	$effect(() => {
-		const data = geoQuery.data as
-			| (PpGeoCollection & { bbox?: number[] })
-			| undefined;
-		if (!map || !mapReady || !data) return;
-		const src = map.getSource('photos') as GeoJSONSource | undefined;
-		if (!src) return;
-		src.setData(data as GeoJSON.FeatureCollection);
-
-		// Drop stale markers; updateMarkers will rebuild for the current
-		// visible set on the next `sourcedata` (fired by setData) or `idle`.
-		markersOnScreen.forEach((m) => m.remove());
-		markersOnScreen.clear();
-		markers.clear();
-
-		// Deep-link from the RightSidebar's location open icon: `?lat=&lng=`
-		// (+ optional `zoom`, `focus`) flies the map directly to the photo
-		// rather than fitting to the full library extent. Strip the params
-		// afterwards so a manual zoom-out + reload doesn't snap back. Falls
-		// through to the default fitBounds when the params aren't present.
-		const sp = new URL(window.location.href).searchParams;
-		const latParam = Number(sp.get('lat'));
-		const lngParam = Number(sp.get('lng'));
-		if (
-			(data.features?.length ?? 0) > 0 &&
-			Number.isFinite(latParam) &&
-			Number.isFinite(lngParam) &&
-			sp.has('lat') &&
-			sp.has('lng')
-		) {
-			const zoom = Number(sp.get('zoom')) || 17;
-			map.jumpTo({ center: [lngParam, latParam], zoom });
-			const stripped = new URL(window.location.href);
-			stripped.searchParams.delete('lat');
-			stripped.searchParams.delete('lng');
-			stripped.searchParams.delete('zoom');
-			stripped.searchParams.delete('focus');
-			const qs = stripped.searchParams.toString();
-			void goto(`/map${qs ? `?${qs}` : ''}`, {
-				replaceState: true,
-				keepFocus: true,
-				noScroll: true
-			});
-			return;
-		}
-
-		// Fit to data extent on the first non-empty load — prefer the
-		// server-provided bbox (PhotoPrism returns one), else compute from
-		// the features.
-		if ((data.features?.length ?? 0) > 0) {
-			let bounds: maplibregl.LngLatBoundsLike | null = null;
-			if (Array.isArray(data.bbox) && data.bbox.length === 4) {
-				bounds = [
-					[data.bbox[0], data.bbox[1]],
-					[data.bbox[2], data.bbox[3]]
-				];
-			} else {
-				const b = new maplibregl.LngLatBounds();
-				for (const f of data.features as PpGeoFeature[]) {
-					const c = f.geometry.coordinates as [number, number];
-					if (Number.isFinite(c[0]) && Number.isFinite(c[1])) b.extend(c);
-				}
-				if (!b.isEmpty()) bounds = b;
-			}
-			if (bounds) map.fitBounds(bounds, { padding: 60, maxZoom: 17, animate: false });
-		}
-	});
-</script>
-
-<Toolbar>
-	<span class="rounded-md border border-border px-2 py-0.5 text-[11px] text-muted-foreground">
-		Map
-	</span>
-	{#snippet trailing()}
-		<span class="text-[11px] text-muted-foreground">
-			{geoQuery.data?.features?.length ?? 0} geotagged
-		</span>
-	{/snippet}
-</Toolbar>
-
-<div bind:this={mapEl} class="min-h-0 w-full flex-1"></div>
-
-<style>
-	/* PhotoPrism's marker / cluster styling, ported from
-	   frontend/src/css/places.css. `:global` because MapLibre appends
-	   markers outside Svelte's scoped CSS reach. */
-	:global(.maplibregl-map .marker) {
-		display: block;
-		border-radius: 50%;
-		cursor: pointer;
-		border: 1px solid #ffffff99;
-		background-color: rgba(23, 23, 23, 0.23);
-		background-size: cover;
-		background-position: center;
-		overflow: hidden;
-		position: relative;
-		box-shadow:
-			0px 3px 1px -2px rgba(0, 0, 0, 0.2),
-			0px 2px 2px 0px rgba(0, 0, 0, 0.14),
-			0px 1px 5px 0px rgba(0, 0, 0, 0.12);
-	}
-	:global(.maplibregl-map .cluster-marker) {
-		display: grid;
-		grid-template-columns: 1fr 1fr;
-		grid-gap: 1px;
-		overflow: hidden;
-		width: 100%;
-		height: 100%;
-		border-radius: 50%;
-	}
-	:global(.maplibregl-map .cluster-marker > div) {
-		width: 100%;
-		height: 100%;
-		background-size: cover;
-		background-position: center;
-	}
-	:global(.maplibregl-map .badge) {
-		position: absolute;
-		top: -5px;
-		right: -5px;
-		min-width: 24px;
-		height: 24px;
-		padding: 0 6px;
-		border-radius: 999px;
-		display: flex;
-		align-items: center;
-		justify-content: center;
-		font-size: 12px;
-		font-weight: 600;
-		color: #ffffff;
-		background: #53478a;
-		box-shadow:
-			0px 3px 1px -2px rgba(0, 0, 0, 0.2),
-			0px 2px 2px 0px rgba(0, 0, 0, 0.14),
-			0px 1px 5px 0px rgba(0, 0, 0, 0.12);
-	}
-</style>

web/src/routes/review/+page.svelte

@@ -30,7 +30,7 @@
 		scanCrossFolderDuplicates,
 		type CrossFolderScanResult
 	} from '$lib/services/photoprism';
-	import { isAuthenticated } from '$lib/stores/session.svelte';
+	import { isAuthenticated, userLibraryBase } from '$lib/stores/session.svelte';
 	import { clearSelection, selection } from '$lib/stores/selection.svelte';
 	import { filters, setSection, type Section } from '$lib/stores/filters.svelte';
 	import {
@@ -85,13 +85,16 @@
 	// observes its cache (enabled:false) and DuplicatesView is what
 	// triggers the actual scan when its tab is active.
 	const stacksQuery = createQuery<DuplicateGroup[]>(() => ({
-		queryKey: ['duplicates'],
-		queryFn: listDuplicateGroups,
+		queryKey: ['duplicates', userLibraryBase()],
+		queryFn: () => listDuplicateGroups(userLibraryBase()),
 		enabled: isAuthenticated(),
 		staleTime: 30_000
 	}));
+	// Scope is enforced server-side (sidecar reads the caller's BasePath +
+	// stored index sub-path), but key on userLibraryBase() so switching the
+	// index folder doesn't show a stale, differently-scoped cached result.
 	const crossFolderQuery = createQuery<CrossFolderScanResult>(() => ({
-		queryKey: ['duplicates-cross-folder'],
+		queryKey: ['duplicates-cross-folder', userLibraryBase()],
 		queryFn: scanCrossFolderDuplicates,
 		enabled: false,
 		staleTime: 5 * 60_000

web/src/routes/tags/[category]/[[value]]/+page.svelte

@@ -6,6 +6,7 @@
 		getPhoto,
 		listLabels,
 		listPhotos,
+		listPhotosByUids,
 		listSubjects,
 		type PhotoMarksMap,
 		type PpLabel,
@@ -28,6 +29,7 @@
 		COLOR_SWATCHES,
 		starLabel
 	} from '$lib/utils/tagGroups';
+	import { countryName } from '$lib/utils/countries';
 	import BulkActionBar from '$lib/components/timeline/BulkActionBar.svelte';
 	import BulkMetadataSidebar from '$lib/components/sidebar/BulkMetadataSidebar.svelte';
 	import PhotoGrid from '$lib/components/timeline/PhotoGrid.svelte';
@@ -68,7 +70,10 @@
 	// label badge of 157 could otherwise drill into 0 photos because the
 	// session is scoped to a folder that has none of them).
 	const useServer = $derived(
-		category === 'labels' || category === 'keywords' || category === 'people'
+		category === 'labels' ||
+			category === 'keywords' ||
+			category === 'people' ||
+			category === 'countries'
 	);
 	const drillQ = $derived(
 		useServer && selectedValue
@@ -97,10 +102,14 @@
 		enabled: isAuthenticated() && useLocal,
 		staleTime: 60_000
 	}));
+	// Resolve the pool from the marked UIDs themselves (complete set, any age)
+	// rather than the newest-N timeline slice, so an old marked photo still
+	// lands in its color/rating bucket.
+	const markedUids = $derived(Object.keys(marksQuery.data ?? {}));
 	const marksPoolQuery = createQuery<PpPhoto[]>(() => ({
-		queryKey: ['photos', 'marks-pool'],
-		queryFn: () => listPhotos({ count: 1000, order: 'newest', merged: true }),
-		enabled: isAuthenticated() && useLocal
+		queryKey: ['photos', 'marks-pool', [...markedUids].sort()],
+		queryFn: () => listPhotosByUids(markedUids),
+		enabled: isAuthenticated() && useLocal && markedUids.length > 0
 	}));
 
 	const ratingGroups = $derived(
@@ -156,6 +165,7 @@
 				COLOR_SWATCHES.find((c) => c.key === selectedValue)?.title ?? selectedValue
 			);
 		}
+		if (category === 'countries') return countryName(selectedValue);
 		return selectedValue;
 	});