diff --git a/booth/app.py b/booth/app.py
index c98d902..b72f794 100644
--- a/booth/app.py
+++ b/booth/app.py
@@ -136,7 +136,21 @@ def set_booth_blurred(booth: Path, on: bool) -> bool:
     state the caller asked for, exactly as unflagging an unflagged item is."""
     marker = booth / BOOTH_BLUR_FILE
     if on:
-        marker.touch(exist_ok=True)
+        # NEVER through a link (r2b, heid bug-hunt). `touch()` followed a
+        # planted `.blurbooth` symlink: a click rewrote an outside file's
+        # mtime, or created a dangling target — the class `record_view` was
+        # hardened against. Anything already at the name, a link included,
+        # already reads as fogged (`is_booth_blurred`), so there is nothing to
+        # write; otherwise create exclusively, never following a link.
+        try:
+            os.lstat(marker)
+            return True
+        except FileNotFoundError:
+            pass
+        try:
+            os.close(os.open(marker, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o644))
+        except FileExistsError:
+            pass                                   # lost a race to another fog: still fogged
         return True
     try:
         marker.unlink()
@@ -680,6 +694,8 @@ def list_booths(data_dir: Path, ttl_seconds: float, now: float | None = None) ->
                 "has_index": (child / "index.html").is_file(),
                 "uploaded": (child / UPLOAD_MARKER).exists(),
                 "kept": is_kept(child),
+                # r2b D2b: the whole-booth fog, so a blurred strip says why.
+                "booth_blurred": is_booth_blurred(child),
                 "marks_total": len(marks),
                 # `open_marks` and nothing else (INV-2). The count this replaced
                 # tested `answer is None`, so a half-answered pick read as closed
@@ -746,6 +762,10 @@ def build_gallery(child: Path) -> list[dict]:
     suite reaches for it by name in nine places.
     """
     out = []
+    # r2b D2b: the item's OWN blur, apart from the booth's. `blurred` is the
+    # composed fact the surfaces render; the per-item control changes only
+    # this, and must not claim an un-blur the booth flag would override.
+    own_blur = read_blurred(child)
     for it in booth_items(child):
         body = render_doc_body(child, it)
         rendered, rendered_html = body if body is not None else (None, False)
@@ -768,6 +788,7 @@ def build_gallery(child: Path) -> list[dict]:
                 "rendered": rendered,
                 "rendered_html": rendered_html,
                 "blurred": it.blurred,
+                "blurred_self": it.rel in own_blur,
             }
         )
     return out
@@ -1193,6 +1214,8 @@ def create_app(
                 # The page could not previously tell keep from release, so it
                 # offered neither and you had to go back to the index.
                 "kept": is_kept(booth),
+                # r2b D2b: the header's blur-booth control says what IS.
+                "booth_blurred": is_booth_blurred(booth),
                 # THE GRID RENDERS `shown`; everything else reads `gallery`.
                 # Filtering is a VIEW: `shown` is `gallery` with non-matching
                 # items removed and NOTHING re-sorted, so "the third one" means
@@ -1824,6 +1847,8 @@ def create_app(
             **base_ctx,
             "name": name,
             "name_url": quote(name, safe=""),
+            # r2b D2b: the review's blur-booth control says what IS.
+            "booth_blurred": is_booth_blurred(booth),
             "file": f,
             "file_url": quote(f, safe="/"),
             # The facts this route never used to carry.
@@ -2132,7 +2157,10 @@ def create_app(
         booth = resolve_booth(name)
         set_booth_blurred(booth, on not in ("0", "false", ""))
         landing = f"/b/{quote(name, safe='')}/"
-        if back:
+        # The review only for an item of the review ring (r2b, heid bug-hunt),
+        # exactly as the mark routes' back=view: a stale or foreign `back`
+        # would otherwise land on a 404. Built from the ring, never echoed.
+        if back and back in review_chain(booth_items(booth)):
             landing += f"view?f={quote(back, safe='/')}"
         return RedirectResponse(url=landing, status_code=303)
 
diff --git a/booth/templates/base.html b/booth/templates/base.html
index bd2f110..a1ccf47 100644
--- a/booth/templates/base.html
+++ b/booth/templates/base.html
@@ -1,8 +1,22 @@
 <!doctype html>
-<html lang="en">
+<html lang="en"{% block html_attrs %}{% endblock %}>
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
+{# r2b: per-browser state applied BEFORE FIRST PAINT, so a revealed booth does
+   not flash blurred on the next page of the reel. Every change of page is a
+   full load (the in-place client re-fetches the current URL and never
+   navigates), so this runs on every page and decides afresh from THIS page's
+   `data-booth` — booth A's reveal cannot follow you into booth B. Storage that
+   throws reads as the default and never raises. #}
+<script>
+  (function () {
+    var d = document.documentElement, b = d.getAttribute('data-booth');
+    try {
+      if (b !== null && sessionStorage.getItem('booth.reveal:' + b) === '1') d.classList.add('reveal-all');
+    } catch (e) {}
+  })();
+</script>
 <title>{% block title %}The Booth{% endblock %}</title>
 <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='7' fill='%2315191d'/%3E%3Cpath d='M7 12V7h5M20 7h5v5M7 20v5h5M25 20v5h-5' fill='none' stroke='%23b2cd12' stroke-width='2.5' stroke-linecap='round' stroke-linejoin='round'/%3E%3Ccircle cx='16' cy='16' r='3' fill='%23b2cd12'/%3E%3C/svg%3E">
 {# The two SVOS voices. display=swap and the system stacks in --font-sans /
@@ -535,6 +549,9 @@
   .flagtoggle:has(input[name="on"][value="0"]) button{border-color:var(--success);color:var(--success-text);
     background:var(--success-soft);font-weight:600}
   .blurtoggle:has(input[name="on"][value="0"]) button{color:var(--text-heading);border-style:dashed}
+  /* blurred with the booth, not on its own (r2b D2b): a label, never a button */
+  .blur-by-booth{font-family:var(--font-mono);font-size:var(--size-micro);padding:4px 7px;
+    border:1px dashed var(--border-default);border-radius:var(--radius-sm);color:var(--text-muted);cursor:help}
 
   /* A flag is the operator's stamp. Sage, not green: judged, not armed. The
      stamp is drawn by the tile itself, so no markup is added. */
@@ -579,6 +596,33 @@
   /* Cover thumbs on the index inherit the blur so the front page cannot undo it. */
   .blurred-thumb{filter:blur(16px)}
 
+  /* REVEAL ALL (r2b D2) — one class on <html>, per booth, per tab. It lifts the
+     blur on every booth surface; the index never carries data-booth, so the
+     Desk strip (.blurred-thumb) is deliberately NOT in this list. The per-item
+     reveal buttons stand down BY STYLESHEET, so tiles swapped in after a save
+     obey it with no script; an item's own `revealed` class is never touched,
+     so "blur again" returns each item exactly as it was. */
+  .reveal-all .item.blurred img,.reveal-all .item.blurred video,
+  .reveal-all .item.blurred .doc-body,.reveal-all .item.blurred .textview,
+  .reveal-all .tray-item.is-blurred img,.reveal-all .film-f.is-blurred img,
+  .reveal-all .review .vstage.is-blurred img,.reveal-all .review .vstage.is-blurred video{filter:none}
+  .reveal-all .item.blurred .reveal,.reveal-all #vreveal{display:none}
+  /* The two booth-wide blur controls: the fog (server state, a form) and the
+     reveal (this tab only, a button). Same quiet chip as the rest of the chrome. */
+  .blur-all{display:inline-block;margin:0}
+  .blur-all button,.reveal-all-btn{font-family:var(--font-mono);font-size:var(--size-caption);
+    padding:5px 9px;border-radius:var(--radius-md);border:1px solid var(--border-default);
+    background:none;color:var(--text-muted);cursor:pointer;-webkit-backdrop-filter:none;backdrop-filter:none}
+  .blur-all button:hover,.reveal-all-btn:hover{color:var(--text-body);border-color:var(--border-strong)}
+  .blur-all.is-on button{color:var(--text-body);border-color:var(--border-strong)}
+  .reveal-all-btn[aria-pressed="true"]{color:var(--text-body);border-color:var(--border-strong)}
+  /* One line each, always: a top bar at phone width squeezed these into
+     four-line stacks. Below 600px the reveal drops its "— blur is cosmetic"
+     tail; the title still says it, as does every per-item reveal. */
+  .blur-all button,.reveal-all-btn{white-space:nowrap}
+  @media (max-width:600px){.reveal-all-btn .ra-note{display:none}}
+  .badge-blur{color:var(--text-muted)}
+
   /* ---- inline docs ------------------------------------------------------
      A .md/.txt/.log shows in place, collapsible and closable, spanning the
      full grid width so prose has a readable measure. */
@@ -1030,6 +1074,36 @@
     if (window.ResizeObserver) new ResizeObserver(set).observe(rail);
   })();
 </script>
+<script>
+  /* REVEAL ALL (r2b D2). Every [data-reveal-all] control on the page shows the
+     one state of this booth; all of them sit OUTSIDE every data-region, so an
+     in-place swap never replaces or unbinds them. The click applies to the
+     page first and is REMEMBERED second: storage that throws (a private
+     window) costs the memory, never the click. */
+  (function () {
+    var d = document.documentElement, b = d.getAttribute('data-booth');
+    var ctl = document.querySelectorAll('[data-reveal-all]');
+    if (b === null || !ctl.length) return;
+    var key = 'booth.reveal:' + b;
+    function show(btn) {
+      var on = d.classList.contains('reveal-all');
+      btn.querySelector('.ra-label').textContent = on ? '🙈 blur again' : '👁 reveal all';
+      btn.querySelector('.ra-note').hidden = on;
+      btn.setAttribute('aria-pressed', on ? 'true' : 'false');
+    }
+    ctl.forEach(function (btn) {
+      btn.hidden = false;
+      show(btn);
+      btn.addEventListener('click', function () {
+        var on = d.classList.toggle('reveal-all');
+        try {
+          if (on) sessionStorage.setItem(key, '1'); else sessionStorage.removeItem(key);
+        } catch (e) {}
+        ctl.forEach(show);
+      });
+    });
+  })();
+</script>
 <footer class="foot">
   drop a folder into <code>{{ data_dir }}</code>{% if host %} · {{ host }}{% endif %}
 </footer>
diff --git a/booth/templates/booth.html b/booth/templates/booth.html
index bcb4c99..d6cd1ff 100644
--- a/booth/templates/booth.html
+++ b/booth/templates/booth.html
@@ -6,13 +6,20 @@
    them, so docs rendered with no control at all. A macro makes "patched two of
    three" impossible rather than merely unlikely. #}
 {% macro blurtoggle(name_url, it, cls='') -%}
+  {# Blurred only because the whole booth is (r2b D2b): say so, and offer no
+     per-item un-blur — the booth flag would keep it blurred, so the control
+     would do nothing visible. The header un-blurs the booth. #}
+  {% if it.blurred and not it.blurred_self %}
+  <span class="blurtoggle blur-by-booth {{ cls }}" title="blurred with the whole booth — un-blur the booth in the header">◉ booth</span>
+  {% else %}
   <form class="blurtoggle {{ cls }}" method="post" action="/b/{{ name_url }}/blur">
     <input type="hidden" name="f" value="{{ it.name }}">
-    <input type="hidden" name="on" value="{{ '0' if it.blurred else '1' }}">
-    <button title="{{ 'un-blur this item' if it.blurred else 'blur this item — cosmetic only, the file is still served' }}"
-            aria-label="{{ 'un-blur' if it.blurred else 'blur' }} {{ it.name }}"
-            >{{ '◉ blurred' if it.blurred else '◌ blur' }}</button>
+    <input type="hidden" name="on" value="{{ '0' if it.blurred_self else '1' }}">
+    <button title="{{ 'un-blur this item' if it.blurred_self else 'blur this item — cosmetic only, the file is still served' }}"
+            aria-label="{{ 'un-blur' if it.blurred_self else 'blur' }} {{ it.name }}"
+            >{{ '◉ blurred' if it.blurred_self else '◌ blur' }}</button>
   </form>
+  {% endif %}
 {%- endmacro %}
 
 {# The per-item MARK controls: flag (the operator pointing at this one) and a
@@ -62,6 +69,7 @@
 {%- endmacro %}
 
 {% block title %}{{ name }} · The Booth{% endblock %}
+{% block html_attrs %} data-booth="{{ name }}"{% endblock %}
 {% block content %}
 <div class="boothhead">
   <a class="back" href="/">‹ all booths</a>
@@ -94,6 +102,23 @@
     <input type="hidden" name="next" value="/b/{{ name_url }}/">
     <button title="keep — exempt from the TTL sweep">☆ keep</button>
   </form>
+  {% endif %}
+  {# r2b D2b + D2: the booth-wide blur controls, outside every data-region.
+     The fog is server state for every viewer and a plain form (works with
+     scripts off); its label says what IS. Reveal all lifts it for this tab
+     only, and is markup only when something here is blurred. A BOARD gets
+     them too when it holds files: only the one-click wipe is board-suppressed,
+     and an item's "◉ booth" label points here. #}
+  {% if all_items %}
+  {# The fog form IS a region: its label is server state, so an in-place save
+     refreshes it with everything else (a fog set elsewhere since this page
+     loaded would otherwise leave it saying "blur booth"). Reveal all is not:
+     its state lives in this tab, and a swap must never reset it. #}
+  <span class="region-wrap" data-region="blur-booth"><form class="blur-all{% if booth_blurred %} is-on{% endif %}" method="post" action="/b/{{ name_url }}/blurbooth">
+    <input type="hidden" name="on" value="{{ '0' if booth_blurred else '1' }}">
+    <button title="{{ 'un-blur the whole booth — per-item blur stays as it was' if booth_blurred else 'blur every image and video in this booth — cosmetic only, the files are still served' }}">{{ '◉ booth blurred' if booth_blurred else '◌ blur booth' }}</button>
+  </form></span>
+  {% if all_items | selectattr('blurred') | list %}<button type="button" class="reveal-all-btn" data-reveal-all hidden title="blur is cosmetic — the files are still served"><span class="ra-label">👁 reveal all</span><span class="ra-note"> — blur is cosmetic</span></button>{% endif %}
   {% endif %}
     {% if not board %}
   <form class="wipe wipe-lg" method="post" action="/b/{{ name_url }}/delete"
diff --git a/booth/templates/doc.html b/booth/templates/doc.html
index 2f89bb9..f9985b5 100644
--- a/booth/templates/doc.html
+++ b/booth/templates/doc.html
@@ -1,11 +1,15 @@
 {% extends "base.html" %}
 {% block title %}{{ file }} · {{ name }} · The Booth{% endblock %}
+{% block html_attrs %} data-booth="{{ name }}"{% endblock %}
 {% block content %}
 <div class="docview">
   <div class="vbar">
     <a class="vbtn vx" href="/b/{{ name_url }}/" title="back to gallery (Esc)">✕</a>
     <span class="vname">{{ file }}</span>
     <span class="vspacer"></span>
+    {# Reveal all can lift this page's blur, so this page must be able to put it
+       back (r2b, heid bug-hunt). #}
+    {% if blurred %}<button type="button" class="reveal-all-btn" data-reveal-all hidden title="blur is cosmetic — the files are still served"><span class="ra-label">👁 reveal all</span><span class="ra-note"> — blur is cosmetic</span></button>{% endif %}
     <a class="vbtn" href="{{ file_url }}?dl=1" title="download {{ file }}">⬇</a>
   </div>
   {# Same record, same reason as the image viewer: the sidecar that says what
@@ -16,11 +20,17 @@
     {% for m in marks if m.shape == 'note' %}<pre class="vnote">{{ m.text }}</pre>{% endfor %}
   </div>
   {% endif %}
+  {# Blur honesty reaches the full page too (r2b, heid code-review): a blurred
+     doc's own page rendered clear. Its reveal is per-page and JS-only, like the
+     review stage's; Reveal all lifts it by the same <html> class. #}
+  <div class="docbody{% if blurred %} is-blurred{% endif %}" id="docbody">
+  {% if blurred %}<button type="button" class="reveal" id="docreveal" hidden>👁 reveal — blur is cosmetic</button>{% endif %}
   {% if is_html %}
     <article class="markdown-body">{{ body|safe }}</article>
   {% else %}
     <pre class="textview">{{ body }}</pre>
   {% endif %}
+  </div>
 </div>
 <style>
   /* .markdown-body and .textview live in base.html (shared with the inline
@@ -31,6 +41,14 @@
   .doccap{margin:0 0 20px;padding:8px 14px;font-size:var(--size-body);line-height:var(--leading-body);
     color:var(--text-body);border-left:3px solid var(--border-strong);white-space:pre-wrap}
   .docmarks{display:flex;flex-direction:column;gap:8px;margin:0 0 20px}
+  .docbody{position:relative}
+  .docbody.is-blurred .markdown-body,.docbody.is-blurred .textview{filter:blur(22px);transition:filter var(--dur-2)}
+  .docbody.is-blurred.revealed .markdown-body,.docbody.is-blurred.revealed .textview,
+  .reveal-all .docbody.is-blurred .markdown-body,.reveal-all .docbody.is-blurred .textview{filter:none}
+  .reveal-all #docreveal{display:none}
+  #docreveal{position:absolute;top:10px;left:10px;z-index:2;cursor:pointer;font-family:var(--font-mono);
+    font-size:var(--size-micro);line-height:1;padding:6px 9px;border-radius:var(--radius-md);
+    border:1px solid rgb(255 255 255 / .16);background:oklch(0.17 0.01 250 / .86);color:oklch(0.91 0.008 216)}
 </style>
 <script>
   (function () {
@@ -41,6 +59,14 @@
       return !!(el && (el.isContentEditable ||
                        /^(input|textarea|select)$/i.test(el.tagName || '')));
     }
+    var rv = document.getElementById('docreveal');
+    if (rv) {
+      rv.hidden = false;
+      rv.addEventListener('click', function () {
+        var on = document.getElementById('docbody').classList.toggle('revealed');
+        rv.textContent = on ? '🙈 hide' : '👁 reveal — blur is cosmetic';
+      });
+    }
     document.addEventListener('keydown', function (e) {
       if (isEditable(e.target)) return;
       if (e.key === 'Escape') window.location.href = {{ ('/b/' ~ name_url ~ '/')|tojson }};
diff --git a/booth/templates/index.html b/booth/templates/index.html
index 25f69e6..5d20d74 100644
--- a/booth/templates/index.html
+++ b/booth/templates/index.html
@@ -68,12 +68,14 @@
     </div>
     {# Badges only: a row with none renders no side column, so it reserves
        no room (the row is flex — an absent item costs no gap). #}
-    {% if b.marks_open or b.hold == "unreadable" or section == 'new' or b.uploaded %}
+    {% if b.marks_open or b.hold == "unreadable" or section == 'new' or b.uploaded or b.booth_blurred %}
     <div class="desk-side">
       {% if b.marks_open %}<span class="badge badge-mark">? {{ b.marks_open }} open</span>
       {% elif b.hold == "unreadable" %}<span class="badge badge-broken">marks unreadable</span>
       {% elif section == 'new' %}<span class="badge badge-new">new</span>{% endif %}
       {% if b.uploaded %}<span class="badge">⬆ pickup</span>{% endif %}
+      {# r2b D2b: a fogged strip says why. Information, not the control. #}
+      {% if b.booth_blurred %}<span class="badge badge-blur" title="the whole booth is blurred — cosmetic only">◉ blurred</span>{% endif %}
     </div>
     {% endif %}
   </article>
diff --git a/booth/templates/marks.html b/booth/templates/marks.html
index 4ecd97c..7ded995 100644
--- a/booth/templates/marks.html
+++ b/booth/templates/marks.html
@@ -1,6 +1,7 @@
 {% extends "base.html" %}
 {% from "_lifetime.html" import lifetime %}
 {% block title %}{{ name }} · marks · The Booth{% endblock %}
+{% block html_attrs %} data-booth="{{ name }}"{% endblock %}
 {% block content %}
 {# The marks page for a booth whose own index.html is served VERBATIM. That page
    cannot render the panel inline (it is returned untouched by design), so the
diff --git a/booth/templates/view.html b/booth/templates/view.html
index 9557cf4..354e78e 100644
--- a/booth/templates/view.html
+++ b/booth/templates/view.html
@@ -1,5 +1,6 @@
 {% extends "base.html" %}
 {% block title %}{{ file }} · {{ name }} · The Booth{% endblock %}
+{% block html_attrs %} data-booth="{{ name }}"{% endblock %}
 {# THE REVIEW (R2 C6). One media item at full size — image, video or audio —
    with the judgment on screen beside it, the whole set as a filmstrip below and
    the tape above. Docs keep doc.html. Everything a mark can change is a
@@ -20,6 +21,14 @@
       <button type="button" class="vseg on" id="btn-fit">Fit</button><button type="button" class="vseg" id="btn-one">1:1</button>
     </span>
     {% endif %}
+    {# r2b D2b + D2, in the top bar: outside every data-region, so no swap
+       replaces them. The fog form carries `back` and lands on this item. #}
+    <span class="region-wrap" data-region="blur-booth"><form class="blur-all{% if booth_blurred %} is-on{% endif %}" method="post" action="/b/{{ name_url }}/blurbooth">
+      <input type="hidden" name="on" value="{{ '0' if booth_blurred else '1' }}">
+      <input type="hidden" name="back" value="{{ file }}">
+      <button title="{{ 'un-blur the whole booth' if booth_blurred else 'blur every image and video in this booth — cosmetic only' }}">{{ '◉ booth blurred' if booth_blurred else '◌ blur booth' }}</button>
+    </form></span>
+    {% if film | selectattr('blurred') | list %}<button type="button" class="reveal-all-btn" data-reveal-all hidden title="blur is cosmetic — the files are still served"><span class="ra-label">👁 reveal all</span><span class="ra-note"> — blur is cosmetic</span></button>{% endif %}
     <a class="vbtn" href="{{ file_url }}" download title="download {{ file }}">⬇</a>
   </div>
 
@@ -221,7 +230,10 @@
       if (e.key === 'Escape') window.location.href = BACK;
       else if (e.key === 'ArrowLeft' && PREV) window.location.href = PREV;
       else if (e.key === 'ArrowRight' && NEXT) window.location.href = NEXT;
-      else if (e.key === ' ' && NEXT && e.target !== player) { e.preventDefault(); window.location.href = e.shiftKey && PREV ? PREV : NEXT; }
+      /* ...and never from a focused control: Space is how a keyboard presses a
+         button or follows a link (r2b, heid bug-hunt — Reveal all and the fog
+         control could not be pressed). */
+      else if (e.key === ' ' && NEXT && e.target !== player && !(e.target.closest && e.target.closest('button, a, summary'))) { e.preventDefault(); window.location.href = e.shiftKey && PREV ? PREV : NEXT; }
       else if (e.key === 'f' || e.key === 'F') {
         var b = document.getElementById('vflag-btn');   /* re-read: the rail may have been swapped */
         if (b) { e.preventDefault(); b.click(); }
diff --git a/docs/contracts/r2b_desk_reveal_theme.contract.md b/docs/contracts/r2b_desk_reveal_theme.contract.md
new file mode 100644
index 0000000..6c314c9
--- /dev/null
+++ b/docs/contracts/r2b_desk_reveal_theme.contract.md
@@ -0,0 +1,320 @@
+---
+contract_version: "0.1"
+status: "PROPOSED 2026-09-23 by design-dev, from operator rulings relayed by booth-dev the same day (thread 01M38BJ30WVQT870MS6WGM49EK): blur=A; three Desk-row rulings; a theme toggle. Contract panel folded. Both open points answered by the operator (thread 01M38CT9DH2N3Z4FSJ0MNE4DR1): × hides (A), and the theme reaches inside verbatim pages. DELIVERED IN TWO MERGES, blur first (operator: 'per booth blurring is now important since we are showing up to 4 images'): merge 1 = D2 + D2b, merge 2 = D1 + D3."
+module: "templates + base.html CSS/JS + the vendored token sheet (the Desk row, Reveal all, the theme toggle)"
+purpose: "Three operator rulings, one contract. THE DESK ROW: kept vs ephemeral reads at a glance; download/keep/release appear only on hover, at no space cost; the zip link leaves the middle. REVEAL ALL: one control reveals every blurred item in a booth for the life of the tab. THE THEME TOGGLE: System / Light / Dark at the top of every page."
+depends_on:
+  - "booth.items.booth_items + Item.blurred (INV-1 of r2: the one resolver). Reveal all reads Item.blurred and nothing else. booth-dev is adding a booth-level blur flag that feeds Item.blurred (composes with `.blurred`, never overrides); this contract needs no change when it lands."
+  - "templates/_lifetime.html `lifetime(kept, hold, expires_in)` — its OUTPUT is unchanged; the Desk wraps it."
+  - "booth.app.index / list_booths row fields `kept`, `hold`, `expires_in`, `name`, `name_url`, `count`, `flags`, `marks_open`, `uploaded` (unchanged)."
+  - "booth.app.booth_view / booth_view_file contexts (`name`, `items`, the review ring)."
+  - "the in-place client in base.html (r2 C3): POSTs a form, re-fetches the CURRENT URL and swaps its `data-region` elements. It never navigates — every change of page, booth to booth included, is a full load — and it never touches <html>, the top bar, or anything outside a region."
+  - "booth.items.is_booth_blurred(booth) + BOOTH_BLUR_FILE `.blurbooth` (booth-dev, c1108a1): the whole-booth blur marker. Fails toward BLURRED on an unreadable read."
+  - "POST /b/{name}/blurbooth with `on=1|0` and optional `back=<rel>` → 303 to the booth, or to `view?f=<rel>` (booth-dev, c1108a1). Not a mark route: no 204, always the 303."
+language: "jinja + css + a little javascript"
+complexity: "medium"
+estimated_loc: 350
+confidence: 0.7
+touches:
+  - "booth/templates/index.html (the row: facts line, lifetime pill, the hover cluster, the `blurred` badge; the confirm script unchanged)"
+  - "booth/app.py (READS only, no new route: `booth_blurred` in the booth_view and booth_view_file contexts and on each list_booths row; `blurred_self` on each gallery dict from build_gallery's one `read_blurred`)"
+  - "booth/templates/base.html (Desk row CSS; reveal-all CSS; the theme toggle markup in the top bar; the early <head> script; the toggle script)"
+  - "booth/templates/booth.html (Reveal all in the booth header; per-tile reveal defers to it)"
+  - "booth/templates/view.html (Reveal all in the review; the stage reveal defers to it)"
+  - "booth/templates/_svos_tokens.css (RE-VENDORED at the same SVOS SHA ed2f8d8 with a new scoping transform; no value changes)"
+  - "booth/static/embed.js (the `.bk-ask` colours follow the theme choice; D3)"
+  - "tests/test_flow_browser.py, tests/test_flow.py (new tests; two assertions change, see below)"
+  - "tests/mutations/r2_flow.toml (rows whose anchors this moves are re-aimed, never deleted without a replacement)"
+assumptions:
+  - "ONE VIEWER, per r2. A reveal and a theme are per-browser; the server stores neither."
+  - "EVERY JUDGMENT WORKS WITH JAVASCRIPT OFF (INV-3 of r2). Keep, release, wipe and zip stay plain forms and a link. Reveal all and the toggle are JS-only affordances and do not render without JS."
+resolved_questions:
+  - "OPEN-1: does × (wipe) hide until hover with download/keep/release? ANSWERED YES by the operator (2026-09-23), the recommendation."
+  - "Does the theme toggle reach the ask chrome (`.bk-ask`) inside verbatim pages? ANSWERED YES by the operator: 'theme toggle reaches inside'."
+---
+
+# R2b — the Desk row, Reveal all, the theme toggle
+
+## D1 — the Desk row
+
+The operator, verbatim: *"let's make it obvious which are kept and which are
+ephemeral"*; *"the zip download button is in between keep/release and wipe, and
+looks awkward"*; *"let's have the download, keep and release buttons only appear
+on mouseover"*.
+
+- **The lifetime is a pill in the row's right column, always visible.** It is
+  state, not a control, so it stays when the controls hide, and the right column
+  scans down the Desk as one column of state.
+  - `life-kept` when `b.kept`: sage (SVOS: a judgment made), prefixed `★`.
+  - `life-held` when not kept and `b.hold` is `open` or `unreadable`: amber.
+  - `life-count` otherwise: neutral outline, prefixed `◷`.
+  - The pill wraps `lifetime(...)`, whose output is unchanged; the class is
+    chosen from `kept`/`hold` alone.
+  - The badges (open count, new, pickup, marks unreadable) stay in the same
+    column, above the pill. The column always renders now, because every row
+    has a lifetime.
+- **The facts line is facts only**: item count and flag count. The lifetime and
+  every control leave it.
+- **The controls are one cluster, `.desk-acts`, in this order:** `⬇ zip`, then
+  `★ keep` or `release`, then `× wipe`, set apart from the other two. Zip leaves
+  the middle; release stays next to × (the operator's earlier "x next to
+  release").
+- **Where a real hover exists, the cluster takes no room.** "Real hover" is
+  `(hover: hover) and (pointer: fine)` with NO coarse pointer present
+  (`any-pointer: coarse` does not match). A touch laptop reports a mouse, but a
+  finger on it cannot hover, so it gets the touch treatment below.
+  - At rest the cluster is absolutely positioned over the top-right corner of
+    the row's preview strip, at opacity 0 and `pointer-events: none`. On row
+    `:hover` or `:focus-within`, BOTH are restored: opacity 1 and
+    `pointer-events: auto`. A visible control that cannot be clicked is a
+    defect.
+  - It covers pictures, never information: its box never intersects
+    `.desk-main` or `.desk-side` at any width.
+  - Keyboard: the controls stay in the tab order while hidden (opacity, never
+    `visibility`/`display`), and focusing one reveals the cluster.
+  - At ≤700px the strip is the row's first line, full width, and the text
+    column, pill and badges wrap below it. The cluster sits at the strip's
+    top-right, which is still picture.
+- **Everywhere else (no hover, a coarse primary pointer, or any coarse pointer
+  present), the cluster is visible and in flow**, on its own line at the
+  bottom of the row. Hover-only would mean no
+  controls at all on touch. Every control there is at least 28px square
+  (r2's Slate T2 floor).
+- **× hides with the others** (OPEN-1, answered yes). A visible × on every row
+  would be a standing invitation to the one irreversible action. A visible × on
+  every row is a standing invitation to the one irreversible action, and hiding
+  the safe controls while the destructive one stays inverts the priority. It
+  appears with the cluster, last, set apart.
+- Unchanged: the forms, their POST targets, `data-confirm`, `data-booth`, the
+  confirm script and its `shown()`, the ≥28px coarse-pointer floor, and "no page
+  scrolls sideways at any width".
+
+### D1b — dates (operator, added 2026-09-23: "I think I want creation and update dates on the booths now too")
+
+Merge 2, with the row. booth-dev has put both on the record (thread
+01M38D39ANKF2TW2F15TEYJ1GT):
+- `created_at` is the directory's birth time via `statx`, a float epoch, or
+  None when the filesystem cannot say. None renders as NOTHING, never a guess.
+- "Updated" is `landed_at`, the content clock the "new" section already reads.
+
+They render on the Desk row and in the booth header as dated FACTS, a
+different kind of thing from the lifetime pill (state) and the controls
+(actions). Their exact form is settled in merge 2 against the built row.
+
+## D2 — Reveal all (blur ruling A)
+
+- **One STATE per booth, shown by a control in two places: "👁 reveal all —
+  blur is cosmetic" / "🙈 blur again".** It appears in the booth header, the
+  review's top bar and a blurred doc's own top bar. Every instance sits OUTSIDE
+  every `data-region`, so no in-place swap replaces it: its state lives in the
+  tab, and a swap must never reset it. Below 600px it reads "👁 reveal all";
+  its title still says the blur is cosmetic. The server puts the control in the markup only
+  where it can act, and always with the `hidden` attribute: in the header when
+  any item of the booth is blurred (`Item.blurred`), and in the review when any
+  item of the review RING is (a blurred doc is not on the review page, so a
+  control there would act on nothing). The script removes `hidden` and binds it. Without
+  JS it is in the markup but never shown.
+- **State: `sessionStorage["booth.reveal:" + <booth name>] = "1"`.** Per booth,
+  per tab, gone when the tab closes, so a blurred booth is blurred again next
+  time. Nothing reaches the server.
+  - A READ that throws (a private window, blocked site data) reads as "not
+    revealed".
+  - A WRITE that throws still applies the click to the page in front of you:
+    it is only not remembered for the next page. A control that does nothing
+    when clicked is a defect. Neither case ever raises.
+- **The mechanism is one class on `<html>`, `reveal-all`.** CSS lifts the blur
+  under it on every booth surface: tiles, the flag tray, the filmstrip and the
+  review stage. `<html>` is outside every `data-region`, so an in-place swap
+  can never drop it.
+  - `<html data-booth="<name>">` is on EVERY page rendered for one booth: the
+    booth page, the review, the doc view and the marks page. It is an
+    autoescaped attribute, read by `getAttribute` and never templated into
+    script. An early `<head>` script adds `reveal-all` before first paint when
+    that booth's key is set, so a revealed booth does not flash blurred on the
+    next page of the reel.
+  - Because every change of page is a full load, the class is re-decided per
+    page, from that page's `data-booth`. Booth A's reveal cannot follow you
+    into booth B.
+  - The index's `<html>` carries no `data-booth` (its rows' own `data-booth`
+    attributes are unrelated), so **nothing on the index is revealed by D2**,
+    the Desk strip included.
+- **A board holding files gets both controls.** Only the one-click wipe is
+  board-suppressed; an item's "◉ booth" label points at the header control,
+  so the control must be there.
+- **The full-page doc view is blurred honestly.** A blurred doc's own page
+  renders its body blurred, with its own JS-only reveal; Reveal all lifts it
+  by the same `<html>` class.
+- **The per-item reveal defers to it, BY STYLESHEET.** Under `.reveal-all` the
+  per-tile and stage reveal buttons are `display: none`. That is a CSS
+  consequence of the class, so markup swapped in after a save obeys it with no
+  script. Reveal all never touches an item's own `revealed` class: "blur
+  again" returns every item to exactly the per-item state it had, an item
+  revealed on its own staying revealed.
+- INV-8 of r2 holds: the server renders every blurred item blurred; the reveal
+  stays per-browser and client-side; the copy keeps saying it is cosmetic.
+
+## D2b — the booth blur toggle (added after the contract panel was dispatched)
+
+booth-dev landed the whole-booth marker and its route while the panel was
+reading; this is the control the operator uses, which the blur ruling assumed.
+
+- **"◌ blur booth" / "◉ booth blurred" in the booth header and the review's
+  top bar (`.vbar`)**, each wrapped in its OWN region, `blur-booth`. Its label is
+  server state, so an in-place save refreshes it with everything else; a fog
+  set elsewhere since the page loaded would otherwise leave it saying "blur
+  booth". It is a plain `<form method=post action=/b/<name>/blurbooth>` with
+  `on=1|0`, so it works with scripts off (INV-2). From the review it carries
+  `back=<rel>`. The route lands on the review only when `back` is an item of
+  the review ring, and otherwise on the booth page; the landing is built from
+  the ring, never echoed.
+- **Fogging never writes through a link.** booth-dev's `set_booth_blurred` used
+  `touch()`, which followed a planted `.blurbooth` symlink: a click of this
+  control rewrote an outside file's mtime, or created a dangling target. Any
+  entry already at the name reads as fogged, so nothing is written; otherwise
+  the marker is created with `O_CREAT | O_EXCL | O_NOFOLLOW`.
+- **Space never hijacks a focused control.** The review's Space-to-advance
+  ignores a focused button, link or summary, so a keyboard can press these
+  controls.
+- **Its state comes from the server**, never from the client:
+  `booth_blurred = is_booth_blurred(booth)` in both contexts. The label says
+  what IS, and pressing it flips it.
+- **The Desk row carries a `blurred` badge** when `booth_blurred`, so a fogged
+  strip says why. It is one `is_booth_blurred` call per booth in the pass
+  `list_booths` already makes. The badge is information: it is not the
+  control, and it does not hide on hover.
+- It is independent of Reveal all. Fogging a booth sets server state for every
+  viewer; Reveal all lifts the fog for one tab.
+- **Each item's own blur control tells the truth under a fogged booth.**
+  `Item.blurred` is the COMPOSED fact (own OR booth). The per-item form changes
+  only the item's own entry in `.blurred`, so the gallery also carries
+  `blurred_self`, read from the same single `read_blurred`.
+  - An item blurred only because the booth is shows "◉ booth", a label with no
+    form, pointing at the header. A per-item un-blur there would be overridden
+    by the booth flag and visibly do nothing.
+  - An item blurred on its own keeps its "◉ blurred" un-blur.
+  - Found by rendering the built page, not by any review.
+
+## D3 — the theme toggle
+
+- **System · Light · Dark, in the top bar of every page.** A segmented control
+  of three buttons with `aria-pressed`. The top bar is outside every
+  `data-region`, so no swap replaces it. It is in the markup with `hidden`,
+  and the script removes that and binds it.
+- **State: `localStorage["booth.theme"]` ∈ {`light`, `dark`}; absent = System.**
+  The opposite lifetime to Reveal all, deliberately: a theme should outlive the
+  tab, a reveal must not. A READ that throws reads as System. A WRITE that
+  throws still applies the choice to this page, and it is only not
+  remembered.
+- **Mechanism: `data-theme` on `<html>`.** Absent = the OS preference, exactly
+  today's sheet. An early `<head>` script sets it before first paint, so a
+  forced theme never flashes the other one.
+- **System is live-following BY CONSTRUCTION.** Choosing System removes
+  `data-theme`, and the `prefers-color-scheme` media query takes over. A media
+  query tracks the OS live, so no `matchMedia` listener is needed: JS never
+  computes the theme.
+- **The token sheet is re-vendored at the same SVOS SHA (ed2f8d8) with a new
+  scoping transform, and no value changes.** The complete selector list:
+
+  | block | selector |
+  |---|---|
+  | primitives, dark, art layer | `:root` (unconditional: dark is the default, and what forced dark leaves standing) |
+  | light + art-light | `@media (prefers-color-scheme: light)` → `:root:not([data-theme="dark"])` |
+  | light + art-light | `:root[data-theme="light"]` |
+  | dark-hc | `@media (prefers-contrast: more)` → `:root` |
+  | light-hc | `@media (prefers-contrast: more) and (prefers-color-scheme: light)` → `:root:not([data-theme="dark"])` |
+  | light-hc | `@media (prefers-contrast: more)` → `:root[data-theme="light"]` |
+
+  - **Forced dark** excludes both light rows, so the unconditional dark block
+    stands, with dark-hc under more contrast.
+  - **Forced light** matches the bare light row at specificity (0,2,0), which
+    beats dark-hc's `:root` (0,1,0). The light-hc row then applies under more
+    contrast.
+  - **The preservation check runs in BOTH directions at vendoring time**:
+    every declaration of the old sheet is in the new, and the new has none the
+    old lacked. The committed test checks each re-scoped copy against the
+    UNMOVED dark block. SVOS's light and dark declare the same 42 properties,
+    and its dark-hc and light-hc the same 41, so a declaration the transform
+    drops fails it.
+- **No JS: no toggle, and the page follows the OS**, as today.
+- **The toggle reaches inside verbatim pages** (operator: "theme toggle reaches
+  inside"). `embed.js` reads the same `localStorage["booth.theme"]` (the same
+  origin) and marks each `.bk-ask` it injects with `data-bk-theme`. Its
+  colours follow that attribute exactly as the Booth's own sheet follows
+  `data-theme`: forced when set, OS when absent. It follows a change made in
+  another tab through the `storage` event. It sets nothing on the host page's
+  own `<html>`: the author's page is not ours to theme, only our guest chrome
+  inside it. If a forced theme makes the chrome look actively broken against
+  a host page, that goes back to the operator rather than being absorbed.
+
+## Invariants
+
+- **INV-1 — nothing new on the server beyond READS.** No route and no file are
+  added: `booth_blurred` in two contexts and on the Desk row (`is_booth_blurred`),
+  and `blurred_self` per gallery item (`read_blurred`, once per page). D2 and D3 are per-browser state; D1 is markup and CSS.
+- **INV-2 — JS-off parity (r2 INV-3).** Every control on the row works with
+  scripts off. Reveal all and the toggle do not render without JS. The page
+  follows the OS.
+- **INV-3 — no reserved room for a hidden control** where a real hover exists.
+  The box of every element in the row other than the cluster — the strip, each
+  preview image, the text column, the side column, the pill — is identical
+  with the cluster present or removed.
+- **INV-4 — blur honesty (r2 INV-8).** Nothing on the index is revealed by D2.
+- **INV-5 — autoescape.** The booth name reaches the reveal-state machinery
+  only as an escaped attribute value (`data-booth`), read by `getAttribute` and
+  never templated into a script.
+- **INV-6 — no flash.** A forced theme and a set reveal are applied before
+  first paint.
+
+## TESTS
+
+- `the_row_controls_take_no_room_where_a_hover_exists` [tracer]: at rest the
+  cluster is at opacity 0 and cannot be clicked. On row hover it is at opacity 1
+  and a click on keep reaches the server. The box of every other element in
+  the row is identical with the cluster removed. The cluster's box never
+  intersects the text or side column, at 390 / 720 / 1000 / 1400px.
+- `on_touch_the_row_controls_are_visible_in_flow_and_at_least_28px`: a touch
+  context (no hover, coarse pointer).
+- `the_lifetime_pill_class_is_kept_held_or_counting`: the class is chosen by
+  state, the lifetime words are unchanged, and the pill is visible with no
+  hover.
+- `the_row_controls_run_zip_keep_or_release_then_wipe`.
+- `reveal_all_reveals_every_blurred_surface_and_survives_the_next_page`: tiles
+  and tray on the booth page, stage and filmstrip on the review, across a
+  navigation in the same tab; a fresh tab (new context) is blurred again.
+- `reveal_all_never_reaches_the_desk`.
+- `the_booth_blur_toggle_works_without_js_and_lands_back_on_the_review`: header
+  and review forms POST `/blurbooth`; the label follows `is_booth_blurred`; the
+  review form carries `back`; the Desk row shows `blurred`.
+- `reveal_all_survives_an_in_place_save`: after a save, the blur is still
+  lifted, the control still reads "blur again" and still works, and the
+  per-tile buttons are still hidden.
+- `reveal_all_on_booth_a_does_not_reveal_booth_b`.
+- `blur_again_restores_each_items_own_reveal`.
+- `reveal_all_is_absent_without_blurred_items_and_hidden_without_js`: no markup
+  when nothing is blurred; with blurred items, the markup carries `hidden` and
+  a JS-disabled context never shows it.
+- `a_storage_failure_still_applies_the_click`: sessionStorage and localStorage
+  throwing on write; the reveal and the theme still apply to the page.
+- `the_theme_toggle_forces_light_and_dark_and_system_follows_the_os_live`:
+  pressing Light/Dark changes `--surface-base` and survives a reload (new page,
+  same context); System plus an emulated OS scheme flip changes it WITHOUT a
+  reload.
+- `a_forced_theme_follows_high_contrast`: forced dark + `prefers-contrast:
+  more` resolves dark-hc's surface token.
+- `a_forced_theme_and_the_os_theme_are_the_same_declarations`: each light copy
+  equals the other and declares exactly the dark block's property set; each
+  light-hc copy equals the other and declares exactly the dark-hc block's.
+
+## Assertions that change (declared before the code)
+
+| test | today | after | why |
+|---|---|---|---|
+| test_flow_browser `test_a_rows_keep_release_and_wipe_take_no_room_of_their_own` | controls visible at rest; a row with no badge has no side column (gap ≤14px) | replaced by `the_row_controls_take_no_room_where_a_hover_exists` | the operator ruled hover-reveal; the side column now always holds the lifetime pill |
+| test_flow_browser `test_on_a_touch_screen_the_row_controls_keep_their_tap_floor` | measures `.desk-facts form button` | the same floor, measured on `.desk-acts` controls | the controls moved; the floor did not |
+
+## Out of scope
+
+- The booth page header's keep / release / wipe (`.keep-lg`, `.wipe-lg`) — the
+  rulings named the Desk row.
+- A site-wide blur switch (ruling A, not B).
+- The tagline copy.
diff --git a/tests/conftest.py b/tests/conftest.py
new file mode 100644
index 0000000..c4cc057
--- /dev/null
+++ b/tests/conftest.py
@@ -0,0 +1,135 @@
+"""Browser-test failure artefacts: a Playwright trace kept for every browser
+test that FAILS, captured from the run that failed.
+
+Why this exists: the browser tests flake under FULL-SUITE load only — three
+different tests have each failed once, every one passes in isolation, and a
+narrowed repro that passes is the trap (operator, 2026-09-23: "let him diagnose
+it properly"). Pass/fail counts cannot say why; a trace — screenshots, DOM
+snapshots, console and network per action — can.
+
+OPT-IN, because tracing is not free and the harness is part of the number:
+with it on, every page does more work, so the suite's timing (the very thing
+under suspicion) moves. Default runs are untouched.
+
+    BOOTH_TRACE=1 .venv/bin/python -m pytest -q        # screenshots + DOM snapshots
+    BOOTH_TRACE=light .venv/bin/python -m pytest -q    # actions + network only
+
+LIGHT exists because the full mode perturbs the thing it watches: 8 traced
+full-suite runs went 8/8 green while untraced runs on the same tree went red.
+Network and action records are nearly free, and a goto that never reaches
+"networkidle" is answered by the network record alone — which request never
+finished.
+
+Traces land in $BOOTH_TRACE_DIR (default: <tmp>/booth-test-traces/<run>/),
+named after the test; open one with `playwright show-trace <file>`. The
+terminal summary lists every trace kept.
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import tempfile
+import time
+from pathlib import Path
+
+import pytest
+
+TRACE_MODE = os.environ.get("BOOTH_TRACE", "")
+TRACE = TRACE_MODE in ("1", "light")
+_KEPT: list[Path] = []
+
+
+@pytest.hookimpl(hookwrapper=True)
+def pytest_runtest_makereport(item, call):
+    outcome = yield
+    rep = outcome.get_result()
+    setattr(item, "rep_" + rep.when, rep)
+
+
+def _trace_dir() -> Path:
+    root = os.environ.get("BOOTH_TRACE_DIR") or os.path.join(tempfile.gettempdir(), "booth-test-traces")
+    d = Path(root) / time.strftime("%Y%m%d-%H%M%S", time.localtime(_RUN_STARTED))
+    d.mkdir(parents=True, exist_ok=True)
+    return d
+
+
+_RUN_STARTED = time.time()
+
+
+@pytest.fixture(autouse=True)
+def _trace_browser_tests(request):
+    """Wrap the module's `browser` so every context it opens is traced.
+
+    A test usually closes its page BEFORE asserting (it collects, closes, then
+    checks), and a closed context can no longer write its trace — so each
+    context's trace is written at close time, to a scratch file, and only moved
+    to the kept set if the test then fails. A page from `browser.new_page` owns
+    its context, as Playwright's own does: closing the page closes it."""
+    if not TRACE or "browser" not in request.fixturenames:
+        yield
+        return
+    browser = request.getfixturevalue("browser")
+    scratch = Path(tempfile.mkdtemp(prefix="booth-trace-"))
+    written: list[Path] = []
+    opened: list = []
+    real_new_context = browser.new_context
+
+    def stop(ctx, n=[0]):
+        if getattr(ctx, "_booth_traced", False):
+            ctx._booth_traced = False
+            n[0] += 1
+            path = scratch / f"{n[0]}.zip"
+            try:
+                ctx.tracing.stop(path=str(path))
+                written.append(path)
+            except Exception:  # noqa: BLE001 - a lost trace must not fail the test
+                pass
+
+    def new_context(*args, **kwargs):
+        ctx = real_new_context(*args, **kwargs)
+        heavy = TRACE_MODE == "1"
+        ctx.tracing.start(screenshots=heavy, snapshots=heavy)
+        ctx._booth_traced = True
+        real_close = ctx.close
+
+        def close(*a, **k):
+            stop(ctx)
+            return real_close(*a, **k)
+
+        ctx.close = close
+        opened.append(ctx)
+        return ctx
+
+    def new_page(*args, **kwargs):
+        ctx = new_context(*args, **kwargs)
+        page = ctx.new_page()
+        page.close = lambda *a, **k: ctx.close()
+        return page
+
+    browser.new_context, browser.new_page = new_context, new_page
+    try:
+        yield
+    finally:
+        del browser.new_context, browser.new_page
+        for ctx in opened:
+            stop(ctx)
+            try:
+                ctx.close()
+            except Exception:  # noqa: BLE001
+                pass
+        rep = getattr(request.node, "rep_call", None)
+        if rep is not None and rep.failed and written:
+            dest = _trace_dir()
+            for i, path in enumerate(written, 1):
+                kept = dest / f"{request.node.name}-{i}.zip"
+                shutil.move(str(path), kept)
+                _KEPT.append(kept)
+        shutil.rmtree(scratch, ignore_errors=True)
+
+
+def pytest_terminal_summary(terminalreporter):
+    if _KEPT:
+        terminalreporter.section("browser traces kept for failed tests")
+        for p in _KEPT:
+            terminalreporter.write_line(str(p))
diff --git a/tests/mutations/r2b.toml b/tests/mutations/r2b.toml
new file mode 100644
index 0000000..8b0f494
--- /dev/null
+++ b/tests/mutations/r2b.toml
@@ -0,0 +1,284 @@
+# R2b — the Desk row, Reveal all, the theme toggle: every falsifier the
+# contract claims (docs/contracts/r2b_desk_reveal_theme.contract.md), and the
+# change each forbids. Merge 1 is D2 + D2b (the blur half); merge 2 adds D1 + D3.
+
+unit = "reveal all, the booth blur toggle (merge 1)"
+
+[[mutation]]
+label = "D2 reveal all does not lift the tile's blur"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_reveal_all_reveals_every_blurred_surface_and_survives_the_next_page"
+old = '''
+  .reveal-all .item.blurred img,.reveal-all .item.blurred video,'''
+new = '''
+  .reveal-all-OFF .item.blurred img,.reveal-all .item.blurred video,'''
+
+[[mutation]]
+label = "D2 no pre-paint re-application: the next page of the reel is blurred again"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_reveal_all_reveals_every_blurred_surface_and_survives_the_next_page"
+old = '''
+      if (b !== null && sessionStorage.getItem('booth.reveal:' + b) === '1') d.classList.add('reveal-all');'''
+new = '''
+      if (false) d.classList.add('reveal-all');'''
+
+[[mutation]]
+label = "D2 the reveal is not scoped to the booth (any reveal in the tab reveals every booth)"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_reveal_all_on_booth_a_does_not_reveal_booth_b_or_the_desk"
+old = '''
+      if (b !== null && sessionStorage.getItem('booth.reveal:' + b) === '1') d.classList.add('reveal-all');'''
+new = '''
+      if (b !== null && sessionStorage.length > 0) d.classList.add('reveal-all');'''
+
+[[mutation]]
+label = "D2 per-tile reveal buttons do not stand down under reveal all"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_reveal_all_survives_an_in_place_save"
+old = '''
+  .reveal-all .item.blurred .reveal,.reveal-all #vreveal{display:none}'''
+new = '''
+  .reveal-all-OFF .item.blurred .reveal,.reveal-all #vreveal{display:none}'''
+
+[[mutation]]
+label = "D2 blur again wipes each item's own reveal"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_blur_again_restores_each_items_own_reveal"
+old = '''
+        var on = d.classList.toggle('reveal-all');
+        try {'''
+new = '''
+        var on = d.classList.toggle('reveal-all');
+        document.querySelectorAll('.item.revealed').forEach(function (i) { i.classList.remove('revealed'); });
+        try {'''
+
+[[mutation]]
+label = "D2 a storage write that throws swallows the click"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_reveal_all_never_shows_without_js_and_a_storage_failure_still_applies_the_click"
+old = '''
+        var on = d.classList.toggle('reveal-all');
+        try {'''
+new = '''
+        sessionStorage.setItem(key, '1');
+        var on = d.classList.toggle('reveal-all');
+        try {'''
+
+[[mutation]]
+label = "D2 the control shows without JS (server markup not hidden)"
+file = "booth/templates/booth.html"
+test = "tests/test_flow_browser.py::test_reveal_all_never_shows_without_js_and_a_storage_failure_still_applies_the_click"
+old = '''
+  {% if all_items | selectattr('blurred') | list %}<button type="button" class="reveal-all-btn" data-reveal-all hidden title='''
+new = '''
+  {% if all_items | selectattr('blurred') | list %}<button type="button" class="reveal-all-btn" data-reveal-all title='''
+
+[[mutation]]
+label = "D2 the control is markup even when nothing is blurred"
+file = "booth/templates/booth.html"
+test = "tests/test_flow.py::test_reveal_all_is_in_the_markup_only_when_something_is_blurred_and_always_hidden"
+old = '''
+  {% if all_items | selectattr('blurred') | list %}<button'''
+new = '''
+  {% if true %}<button'''
+
+[[mutation]]
+label = "D2 the review page does not carry data-booth"
+file = "booth/templates/view.html"
+test = "tests/test_flow.py::test_reveal_all_is_in_the_markup_only_when_something_is_blurred_and_always_hidden"
+old = '''
+{% block html_attrs %} data-booth="{{ name }}"{% endblock %}'''
+new = '''
+{% block html_attrs %}{% endblock %}'''
+
+[[mutation]]
+label = "D2b the header control's label does not follow the server's fog state"
+file = "booth/templates/booth.html"
+test = "tests/test_flow.py::test_the_booth_blur_toggle_works_without_js_and_lands_back_on_the_review"
+old = '''
+    <input type="hidden" name="on" value="{{ '0' if booth_blurred else '1' }}">
+    <button title="{{ 'un-blur the whole booth'''
+new = '''
+    <input type="hidden" name="on" value="1">
+    <button title="{{ 'un-blur the whole booth'''
+
+[[mutation]]
+label = "D2b the review's control drops `back` (fogging ejects you from the review)"
+file = "booth/templates/view.html"
+test = "tests/test_flow.py::test_the_booth_blur_toggle_works_without_js_and_lands_back_on_the_review"
+old = '''
+      <input type="hidden" name="back" value="{{ file }}">'''
+new = '''
+'''
+
+[[mutation]]
+label = "D2b the Desk row does not say a booth is fogged"
+file = "booth/templates/index.html"
+test = "tests/test_flow.py::test_the_booth_blur_toggle_works_without_js_and_lands_back_on_the_review"
+old = '''
+      {% if b.booth_blurred %}<span class="badge badge-blur"'''
+new = '''
+      {% if false %}<span class="badge badge-blur"'''
+
+[[mutation]]
+label = "D2b an item blurred only by the booth offers a per-item un-blur that does nothing"
+file = "booth/templates/booth.html"
+test = "tests/test_flow.py::test_under_a_fogged_booth_each_items_blur_control_tells_the_truth"
+old = '''
+  {% if it.blurred and not it.blurred_self %}'''
+new = '''
+  {% if false %}'''
+
+[[mutation]]
+label = "D2b the per-item control reads the composed blur, not the item's own"
+file = "booth/app.py"
+test = "tests/test_flow.py::test_under_a_fogged_booth_each_items_blur_control_tells_the_truth"
+old = '''
+                "blurred_self": it.rel in own_blur,'''
+new = '''
+                "blurred_self": it.blurred,'''
+
+# ---- folds: the heid code-review ("BLITZ-2") and bug-hunt ("FENRIR-6") panels on merge 1
+
+[[mutation]]
+label = "a board holding files loses the blur controls its labels point at"
+file = "booth/templates/booth.html"
+test = "tests/test_flow.py::test_a_board_with_files_gets_the_blur_controls_its_labels_point_at"
+old = '''
+  {% if all_items %}
+  {# The fog form IS a region'''
+new = '''
+  {% if not board %}
+  {# The fog form IS a region'''
+
+[[mutation]]
+label = "a blurred doc's own page renders clear"
+file = "booth/templates/doc.html"
+test = "tests/test_flow.py::test_a_blurred_docs_own_page_is_blurred_too"
+old = '''
+  <div class="docbody{% if blurred %} is-blurred{% endif %}" id="docbody">'''
+new = '''
+  <div class="docbody" id="docbody">'''
+
+[[mutation]]
+label = "the review offers Reveal all when only a doc (off the ring) is blurred"
+file = "booth/templates/view.html"
+test = "tests/test_flow.py::test_reveal_all_renders_where_it_can_act"
+old = '''
+    {% if film | selectattr('blurred') | list %}<button'''
+new = '''
+    {% if true %}<button'''
+
+[[mutation]]
+label = "the fog form is a GET (changes nothing with scripts off)"
+file = "booth/templates/booth.html"
+test = "tests/test_flow.py::test_the_booth_blur_toggle_works_without_js_and_lands_back_on_the_review"
+old = '''<form class="blur-all{% if booth_blurred %} is-on{% endif %}" method="post" action="/b/{{ name_url }}/blurbooth">
+    <input type="hidden" name="on" value="{{ '0' if booth_blurred else '1' }}">
+    <button title="{{ 'un-blur the whole booth — per-item'''
+new = '''<form class="blur-all{% if booth_blurred %} is-on{% endif %}" method="get" action="/b/{{ name_url }}/blurbooth">
+    <input type="hidden" name="on" value="{{ '0' if booth_blurred else '1' }}">
+    <button title="{{ 'un-blur the whole booth — per-item'''
+
+[[mutation]]
+label = "the swap stops carrying an item's own reveal"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_an_items_own_reveal_survives_an_in_place_save"
+old = '''
+      ['revealed', 'is-closed'].forEach(function (c) {'''
+new = '''
+      ['is-closed'].forEach(function (c) {'''
+
+[[mutation]]
+label = "a storage READ that throws raises out of the pre-paint script"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_reveal_all_never_shows_without_js_and_a_storage_failure_still_applies_the_click"
+old = '''
+    try {
+      if (b !== null && sessionStorage.getItem('booth.reveal:' + b) === '1') d.classList.add('reveal-all');
+    } catch (e) {}'''
+new = '''
+    if (b !== null && sessionStorage.getItem('booth.reveal:' + b) === '1') d.classList.add('reveal-all');'''
+
+[[mutation]]
+label = "fogging writes through a planted marker link"
+file = "booth/app.py"
+test = "tests/test_flow.py::test_fogging_never_writes_through_a_planted_marker_link"
+old = '''
+        try:
+            os.lstat(marker)
+            return True
+        except FileNotFoundError:
+            pass
+        try:
+            os.close(os.open(marker, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o644))
+        except FileExistsError:
+            pass                                   # lost a race to another fog: still fogged
+        return True'''
+new = '''
+        marker.touch(exist_ok=True)
+        return True'''
+
+[[mutation]]
+label = "the fog landing echoes `back` unchecked"
+file = "booth/app.py"
+test = "tests/test_flow.py::test_the_fog_landing_is_built_from_the_ring_never_echoed"
+old = '''
+        if back and back in review_chain(booth_items(booth)):'''
+new = '''
+        if back:'''
+
+[[mutation]]
+label = "the fog form is outside every region (a swap leaves its label stale)"
+file = "booth/templates/booth.html"
+test = "tests/test_flow.py::test_the_booth_blur_toggle_works_without_js_and_lands_back_on_the_review"
+old = '''
+  <span class="region-wrap" data-region="blur-booth"><form class="blur-all'''
+new = '''
+  <span class="region-wrap"><form class="blur-all'''
+
+[[mutation]]
+label = "Space on a focused review button moves to the next item"
+file = "booth/templates/view.html"
+test = "tests/test_flow_browser.py::test_space_on_a_focused_review_button_presses_it_and_does_not_move_on"
+old = '''e.target !== player && !(e.target.closest && e.target.closest('button, a, summary'))) {'''
+new = '''e.target !== player) {'''
+
+[[mutation]]
+label = "the top-bar controls squeeze into multi-line stacks at phone width"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_the_review_and_doc_top_bars_fit_a_phone"
+old = '''
+  .blur-all button,.reveal-all-btn{white-space:nowrap}
+  @media (max-width:600px){.reveal-all-btn .ra-note{display:none}}'''
+new = '''
+'''
+
+[[mutation]]
+label = "the Desk strip under another booth's reveal is lifted by a whisker (blur(0px) is not blurred)"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_reveal_all_on_booth_a_does_not_reveal_booth_b_or_the_desk"
+old = '''
+  .blurred-thumb{filter:blur(16px)}'''
+new = '''
+  .blurred-thumb{filter:blur(0px)}'''
+
+# ---- the flake: the test browser has no internet (positive control per file)
+
+[[mutation]]
+label = "the flow test browser can reach the internet (Google Fonts can stall networkidle)"
+file = "tests/test_flow_browser.py"
+test = "tests/test_flow_browser.py::test_the_test_browser_has_no_internet"
+old = '''
+            b = pw.chromium.launch(args=OFFLINE)'''
+new = '''
+            b = pw.chromium.launch()'''
+
+[[mutation]]
+label = "the embed test browser can reach the internet"
+file = "tests/test_embed_browser.py"
+test = "tests/test_embed_browser.py::test_the_test_browser_has_no_internet"
+old = '''
+            b = pw.chromium.launch(args=OFFLINE)'''
+new = '''
+            b = pw.chromium.launch()'''
diff --git a/tests/test_embed_browser.py b/tests/test_embed_browser.py
index 162146b..2b18fa4 100644
--- a/tests/test_embed_browser.py
+++ b/tests/test_embed_browser.py
@@ -31,11 +31,22 @@ playwright_api = pytest.importorskip(
 )
 
 
+# NO INTERNET for the test browser. Every Booth page asks fonts.googleapis.com
+# for its faces, and "networkidle" waits for that request — so a stalled request
+# to Google hung the page until goto's 30s timeout, the failure mode of the
+# full-suite flake (Page.goto timeouts in tests far apart in one run; a stalled
+# font request reproduces it exactly). Whether that was THE cause is unproven;
+# a test that depends on Google being reachable is wrong regardless. Every
+# hostname but 127.0.0.1 now fails DNS at once, and the pages fall back to the
+# system stacks the tokens declare. Positive control: test_*_has_no_internet.
+OFFLINE = ["--host-resolver-rules=MAP * ~NOTFOUND , EXCLUDE 127.0.0.1"]
+
+
 @pytest.fixture(scope="module")
 def browser():
     with playwright_api.sync_playwright() as pw:
         try:
-            b = pw.chromium.launch()
+            b = pw.chromium.launch(args=OFFLINE)
         except Exception as exc:  # noqa: BLE001 - any launch failure is a skip
             pytest.skip(f"no usable chromium: {exc}")
         yield b
@@ -638,3 +649,24 @@ def test_the_keyboard_flag_actually_submits(browser, live):
 
     assert flagged == 1, f"the f key flagged {flagged} items, expected 1"
     assert survived, "the flag reloaded the page; in-place judgment must not"
+
+
+def test_the_test_browser_has_no_internet(browser, live):
+    """Positive control for OFFLINE (booth-dev's ask: see the fix in force,
+    don't assume it). An external host fails at once, and a Booth page — whose
+    fonts are external — still goes idle in well under the goto timeout."""
+    base, root = live
+    (root / "g").mkdir()
+    page = browser.new_page()
+    t = time.time()
+    with pytest.raises(Exception) as err:
+        page.goto("https://fonts.googleapis.com/css2?family=IBM+Plex+Sans", timeout=10000)
+    external = time.time() - t
+    page.close()
+    page = browser.new_page()
+    t = time.time()
+    page.goto(f"{base}/b/g/", wait_until="networkidle")
+    local = time.time() - t
+    page.close()
+    assert "ERR_NAME_NOT_RESOLVED" in str(err.value) and external < 3, (str(err.value)[:80], external)
+    assert local < 10, local
diff --git a/tests/test_flow.py b/tests/test_flow.py
index 1f137db..5b08121 100644
--- a/tests/test_flow.py
+++ b/tests/test_flow.py
@@ -844,3 +844,156 @@ def test_the_desk_never_makes_a_non_web_url_clickable(tmp_path):
     benches = re.search(r'data-panel="benches".*?</section>', body, re.S).group(0)
     assert 'href="javascript:' not in benches
     assert 'href="http://h:1/"' in benches and "evil bench" in benches
+
+
+def _regions(body: str) -> list[str]:
+    """Every data-region element's full markup."""
+    return [_region(body, rid) for rid in dict.fromkeys(re.findall(r'data-region="([^"]+)"', body))]
+
+
+def test_the_booth_blur_toggle_works_without_js_and_lands_back_on_the_review(tmp_path):
+    """r2b D2b: the operator's control for booth-dev's whole-booth marker. A
+    plain form — scripts off, it still works — whose label says what IS
+    (read from the server), in the booth header and the review's top bar; the
+    review's carries `back` and lands on the same item. The Desk row says
+    `blurred` so a fogged strip says why."""
+    b = _booth(tmp_path, "g", {"a.png": PNG, "b.png": PNG})
+    c = _client(tmp_path)
+    page = c.get("/b/g/").text
+    form = re.search(r'<form[^>]*action="/b/g/blurbooth".*?</form>', page, re.S).group(0)
+    assert 'method="post"' in form, "a GET form would not change anything with scripts off"
+    assert 'name="on" value="1"' in form and "blur booth" in form
+    # a REGION: its label is server state, so an in-place save refreshes it
+    assert form in _region(page, "blur-booth")
+    assert "badge-blur" not in re.search(r'data-booth="g".*?</article>', c.get("/").text, re.S).group(0)
+
+    r = c.post("/b/g/blurbooth", data={"on": "1"}, follow_redirects=False)
+    assert r.status_code == 303 and (b / ".blurbooth").exists()
+    page = c.get("/b/g/").text
+    form = re.search(r'<form[^>]*action="/b/g/blurbooth".*?</form>', page, re.S).group(0)
+    assert 'name="on" value="0"' in form and "booth blurred" in form
+    row = re.search(r'data-booth="g".*?</article>', c.get("/").text, re.S).group(0)
+    assert re.search(r'<span class="badge[^"]*badge-blur[^"]*"[^>]*>[^<]*blurred</span>', row)
+
+    view = c.get("/b/g/view?f=b.png").text
+    vbar = re.search(r'<div class="vbar">.*?</div>\s*\n', view, re.S).group(0)
+    vform = re.search(r'<form[^>]*action="/b/g/blurbooth".*?</form>', vbar, re.S).group(0)
+    assert 'method="post"' in vform
+    assert 'name="back" value="b.png"' in vform and 'name="on" value="0"' in vform
+    r = c.post("/b/g/blurbooth", data={"on": "0", "back": "b.png"}, follow_redirects=False)
+    assert r.headers["location"] == "/b/g/view?f=b.png" and not (b / ".blurbooth").exists()
+
+
+def test_reveal_all_is_in_the_markup_only_when_something_is_blurred_and_always_hidden(tmp_path):
+    """r2b D2: the control is server markup only when the booth has a blurred
+    item, always with `hidden` (the script unhides it; with JS off it never
+    shows), and always OUTSIDE every data-region so no in-place swap replaces
+    it. Every page rendered for one booth carries `data-booth` on <html>; the
+    index carries none, so nothing there can be revealed."""
+    from booth.app import set_blurred
+    b = _booth(tmp_path, "g", {"a.png": PNG, "b.png": PNG, "n.md": b"# n"})
+    c = _client(tmp_path)
+    assert not re.search(r"<button[^>]*data-reveal-all", c.get("/b/g/").text)
+    set_blurred(b, "a.png", True)
+    for url in ("/b/g/", "/b/g/view?f=a.png", "/b/g/view?f=b.png"):
+        page = c.get(url).text
+        ctl = re.findall(r'<button[^>]*data-reveal-all[^>]*>', page)
+        assert len(ctl) == 1 and " hidden" in ctl[0], (url, ctl)
+        assert all(not re.search(r"<button[^>]*data-reveal-all", r) for r in _regions(page)), url
+    for url in ("/b/g/", "/b/g/view?f=a.png", "/b/g/view?f=n.md", "/b/g/marks"):
+        assert re.search(r'<html lang="en" data-booth="g">', c.get(url).text), url
+    assert re.search(r'<html lang="en">', c.get("/").text)
+
+
+def test_under_a_fogged_booth_each_items_blur_control_tells_the_truth(tmp_path):
+    """r2b D2b, found rendering it: in a fogged booth every item reports
+    `blurred`, so an item blurred ONLY by the booth offered "◉ blurred" and an
+    un-blur that visibly did nothing (the booth still fogged it). Its control
+    now says it is blurred with the booth and offers no per-item action; an item
+    blurred in its own right keeps its own un-blur."""
+    from booth.app import set_blurred
+    b = _booth(tmp_path, "g", {"a.png": PNG, "b.png": PNG})
+    set_blurred(b, "a.png", True)
+    (b / ".blurbooth").write_bytes(b"")
+    page = _client(tmp_path).get("/b/g/").text
+    fig = lambda rel: re.search(r'<figure[^>]*data-item="%s".*?</figure>' % re.escape(rel), page, re.S).group(0)
+    own, booth = fig("a.png"), fig("b.png")
+    assert re.search(r'action="/b/g/blur".*?name="on" value="0".*?◉ blurred', own, re.S)
+    assert 'action="/b/g/blur"' not in booth
+    assert "◉ booth" in booth
+
+
+
+def test_a_board_with_files_gets_the_blur_controls_its_labels_point_at(tmp_path):
+    """heid code-review (4/4): both booth-wide controls sat inside the board
+    suppression meant for the one-click wipe, so a links board holding a fogged
+    picture showed "◉ booth — un-blur the booth in the header" with no such
+    control in the header. Only the wipe is board-suppressed."""
+    b = _booth(tmp_path, "links", {"links.md": b"- [x](https://example.test/)\n", "a.png": PNG})
+    (b / ".blurbooth").write_bytes(b"")
+    page = _client(tmp_path).get("/b/links/").text
+    assert re.search(r'<form[^>]*action="/b/links/blurbooth"', page)
+    assert re.search(r"<button[^>]*data-reveal-all", page)
+
+
+def test_reveal_all_renders_where_it_can_act(tmp_path):
+    """heid code-review (3/4): the header offers Reveal all when ANY item is
+    blurred; the review only when an item of the review RING is — a blurred doc
+    is not on the review page, so a control there would act on nothing."""
+    from booth.app import set_blurred
+    b = _booth(tmp_path, "g", {"a.png": PNG, "n.md": b"# n"})
+    set_blurred(b, "n.md", True)
+    c = _client(tmp_path)
+    assert re.search(r"<button[^>]*data-reveal-all", c.get("/b/g/").text)
+    assert not re.search(r"<button[^>]*data-reveal-all", c.get("/b/g/view?f=a.png").text)
+
+
+def test_a_blurred_docs_own_page_is_blurred_too(tmp_path):
+    """heid code-review (hulda): the full-page doc view never read `blurred`,
+    so a blurred doc rendered clear at the size where it is most readable.
+    Its body is blurred there too, with its own JS-only reveal."""
+    from booth.app import set_blurred
+    b = _booth(tmp_path, "g", {"n.md": b"# secret", "o.md": b"# open"})
+    set_blurred(b, "n.md", True)
+    c = _client(tmp_path)
+    blurred, clear = c.get("/b/g/view?f=n.md").text, c.get("/b/g/view?f=o.md").text
+    assert re.search(r'class="docbody is-blurred"', blurred)
+    assert re.search(r'<button[^>]*id="docreveal"[^>]*hidden', blurred)
+    assert 'class="docbody"' in clear and not re.search(r'<button[^>]*id="docreveal"', clear)
+
+
+def test_fogging_never_writes_through_a_planted_marker_link(tmp_path):
+    """heid bug-hunt (kimi, hulda): `marker.touch()` followed a planted
+    `.blurbooth` symlink — a click of the new browser control rewrote an
+    outside file's mtime, or CREATED a dangling target. The same class
+    `record_view` was hardened against. A link already there reads as fogged
+    (is_booth_blurred counts it), so fogging has nothing to write."""
+    import os
+    outside = tmp_path / "outside.txt"
+    outside.write_text("x")
+    os.utime(outside, (1_000_000, 1_000_000))
+    b = _booth(tmp_path, "g", {"a.png": PNG})
+    (b / ".blurbooth").symlink_to(outside)
+    h = _booth(tmp_path, "h", {"a.png": PNG})
+    (h / ".blurbooth").symlink_to(tmp_path / "created-by-a-click")
+    c = _client(tmp_path)
+    assert c.post("/b/g/blurbooth", data={"on": "1"}, follow_redirects=False).status_code == 303
+    assert c.post("/b/h/blurbooth", data={"on": "1"}, follow_redirects=False).status_code == 303
+    assert outside.stat().st_mtime == 1_000_000
+    assert not (tmp_path / "created-by-a-click").exists()
+    c.post("/b/g/blurbooth", data={"on": "0"}, follow_redirects=False)
+    assert not (b / ".blurbooth").is_symlink() and outside.exists()     # unlinked, target untouched
+
+
+def test_the_fog_landing_is_built_from_the_ring_never_echoed(tmp_path):
+    """heid bug-hunt (kimi, regin, groa): `back` went into the 303 unchecked, so
+    a stale or foreign value landed on a 404. Like the mark routes' back=view:
+    the review only for an item of the review ring, else the booth page."""
+    _booth(tmp_path, "g", {"a.png": PNG, "n.md": b"# n"})
+    c = _client(tmp_path)
+    loc = lambda back: c.post("/b/g/blurbooth", data={"on": "1", "back": back},
+                              follow_redirects=False).headers["location"]
+    assert loc("a.png") == "/b/g/view?f=a.png"
+    assert loc("gone.png") == "/b/g/"
+    assert loc("n.md") == "/b/g/"
+    assert loc("") == "/b/g/"
diff --git a/tests/test_flow_browser.py b/tests/test_flow_browser.py
index a5a65b8..7757147 100644
--- a/tests/test_flow_browser.py
+++ b/tests/test_flow_browser.py
@@ -24,11 +24,22 @@ playwright_api = pytest.importorskip("playwright.sync_api", reason="playwright i
 PNG = b"\x89PNG\r\n\x1a\n"
 
 
+# NO INTERNET for the test browser. Every Booth page asks fonts.googleapis.com
+# for its faces, and "networkidle" waits for that request — so a stalled request
+# to Google hung the page until goto's 30s timeout, the failure mode of the
+# full-suite flake (Page.goto timeouts in tests far apart in one run; a stalled
+# font request reproduces it exactly). Whether that was THE cause is unproven;
+# a test that depends on Google being reachable is wrong regardless. Every
+# hostname but 127.0.0.1 now fails DNS at once, and the pages fall back to the
+# system stacks the tokens declare. Positive control: test_*_has_no_internet.
+OFFLINE = ["--host-resolver-rules=MAP * ~NOTFOUND , EXCLUDE 127.0.0.1"]
+
+
 @pytest.fixture(scope="module")
 def browser():
     with playwright_api.sync_playwright() as pw:
         try:
-            b = pw.chromium.launch()
+            b = pw.chromium.launch(args=OFFLINE)
         except Exception as exc:  # noqa: BLE001 - any launch failure is a skip
             pytest.skip(f"no usable chromium: {exc}")
         yield b
@@ -550,3 +561,247 @@ def test_the_wipe_dialog_shows_what_is_being_wiped_and_never_fails_open(browser,
     shown = said[0].split("\n\n")[0]
     assert not any(c in shown for c in "‮\n"), repr(shown)
     assert "safe�gnp.xe�line2" in shown, repr(shown)
+
+
+_FILTER = "sel => { const e = document.querySelector(sel); return e ? getComputedStyle(e).filter : 'MISSING'; }"
+
+
+def _blurred_set(root: pathlib.Path, name: str = "g", blur=("a.png",), flag=("a.png",)) -> pathlib.Path:
+    from booth.app import set_blurred
+    from booth.marks import set_flag
+    b = root / name
+    b.mkdir()
+    for rel in ("a.png", "b.png", "c.png"):
+        (b / rel).write_bytes(PNG)
+    for rel in blur:
+        set_blurred(b, rel, True)
+    for rel in flag:
+        set_flag(b, rel, True)
+    return b
+
+
+def _settle(page) -> None:
+    page.wait_for_timeout(400)                  # the filter transition (--dur-2)
+
+
+def test_reveal_all_reveals_every_blurred_surface_and_survives_the_next_page(browser, live):
+    """r2b D2 (blur ruling A): one click lifts the blur on the tile, the tray,
+    the review stage and the filmstrip, and it holds on the next page of the
+    same tab. A fresh tab is blurred again — per tab, never persisted."""
+    base, root = live
+    _blurred_set(root)
+    ctx = browser.new_context(viewport={"width": 1400, "height": 900})
+    page = ctx.new_page()
+    page.goto(f"{base}/b/g/", wait_until="networkidle")
+    tile, tray = 'figure.item[data-item="a.png"] img', ".tray-item.is-blurred img"
+    before = [page.evaluate(_FILTER, tile), page.evaluate(_FILTER, tray)]
+    page.locator("[data-reveal-all]").click()
+    _settle(page)
+    after = [page.evaluate(_FILTER, tile), page.evaluate(_FILTER, tray)]
+    page.goto(f"{base}/b/g/view?f=a.png", wait_until="networkidle")
+    _settle(page)
+    review = [page.evaluate(_FILTER, "#vimg"), page.evaluate(_FILTER, ".film-f.is-blurred img"),
+              page.locator("[data-reveal-all]").inner_text()]
+    fresh = ctx.new_page()                      # a new tab: sessionStorage is per tab
+    fresh.goto(f"{base}/b/g/view?f=a.png", wait_until="networkidle")
+    _settle(fresh)
+    again = fresh.evaluate(_FILTER, "#vimg")
+    ctx.close()
+    assert all("blur" in f for f in before), before
+    assert after == ["none", "none"], after
+    assert review[:2] == ["none", "none"] and "blur again" in review[2], review
+    assert "blur" in again, again
+
+
+def test_reveal_all_on_booth_a_does_not_reveal_booth_b_or_the_desk(browser, live):
+    """r2b D2 + INV-4: the reveal is scoped to the booth you are in. Booth A's
+    cannot follow you into booth B, and nothing on the index is revealed."""
+    base, root = live
+    _blurred_set(root, "ga")
+    _blurred_set(root, "gb")
+    page = browser.new_page(viewport={"width": 1400, "height": 900})
+    page.goto(f"{base}/b/ga/", wait_until="networkidle")
+    page.locator("[data-reveal-all]").click()
+    page.goto(f"{base}/b/gb/", wait_until="networkidle")
+    _settle(page)
+    b_tile = page.evaluate(_FILTER, 'figure.item[data-item="a.png"] img')
+    page.goto(f"{base}/", wait_until="networkidle")
+    desk = page.evaluate("""() => [...document.querySelectorAll('.desk-strip img.blurred-thumb')]
+        .map(i => getComputedStyle(i).filter)""")
+    page.close()
+    assert b_tile == "blur(22px)", b_tile
+    assert desk and all(f == "blur(16px)" for f in desk), desk     # exact: blur(0px) is not blurred
+
+
+def test_reveal_all_survives_an_in_place_save(browser, live):
+    """r2b D2: after an in-place save the blur is still lifted — the swapped-in
+    tile included — the control still says "blur again" and still works, and
+    the per-tile reveal buttons are still stood down."""
+    base, root = live
+    _blurred_set(root, blur=("a.png", "b.png"), flag=())
+    page = browser.new_page(viewport={"width": 1400, "height": 900})
+    page.goto(f"{base}/b/g/", wait_until="networkidle")
+    page.evaluate("window.__same_page = 1")
+    page.locator("[data-reveal-all]").click()
+    page.locator('figure.item[data-item="b.png"] .flagtoggle button').click()
+    page.wait_for_selector('figure.item.is-flagged[data-item="b.png"]', timeout=10000)
+    _settle(page)
+    got = {"same": page.evaluate("window.__same_page === 1"),
+           "b": page.evaluate(_FILTER, 'figure.item[data-item="b.png"] img'),
+           "label": page.locator("[data-reveal-all]").inner_text(),
+           "tile_btn": page.evaluate("""() => getComputedStyle(
+               document.querySelector('figure.item[data-item="b.png"] .reveal')).display""")}
+    page.locator("[data-reveal-all]").click()
+    _settle(page)
+    got["back"] = page.evaluate(_FILTER, 'figure.item[data-item="b.png"] img')
+    page.close()
+    assert got["same"] and got["b"] == "none" and "blur again" in got["label"], got
+    assert got["tile_btn"] == "none" and "blur" in got["back"], got
+
+
+def test_blur_again_restores_each_items_own_reveal(browser, live):
+    """r2b D2: Reveal all never touches an item's own reveal, so "blur again"
+    returns each item exactly as it was — one revealed on its own stays so."""
+    base, root = live
+    _blurred_set(root, blur=("a.png", "b.png"), flag=())
+    page = browser.new_page(viewport={"width": 1400, "height": 900})
+    page.goto(f"{base}/b/g/", wait_until="networkidle")
+    page.locator('figure.item[data-item="a.png"] .reveal').click()
+    page.locator("[data-reveal-all]").click()
+    page.locator("[data-reveal-all]").click()
+    _settle(page)
+    got = [page.evaluate(_FILTER, f'figure.item[data-item="{r}"] img') for r in ("a.png", "b.png")]
+    page.close()
+    assert got[0] == "none" and "blur" in got[1], got
+
+
+def test_reveal_all_never_shows_without_js_and_a_storage_failure_still_applies_the_click(browser, live):
+    """r2b D2: without JS the control is in the markup but never shown. With
+    sessionStorage throwing on write (a private window), the click still
+    applies to the page — only the memory is lost."""
+    base, root = live
+    _blurred_set(root)
+    ctx = browser.new_context(java_script_enabled=False)
+    page = ctx.new_page()
+    page.goto(f"{base}/b/g/", wait_until="networkidle")
+    nojs = page.locator("[data-reveal-all]").is_visible()
+    ctx.close()
+    page = browser.new_page(viewport={"width": 1400, "height": 900})
+    errors = []
+    page.on("pageerror", lambda e: errors.append(str(e)))
+    # READS and WRITES both throw: the pre-paint read must degrade to "not
+    # revealed" without raising, and the click must still apply.
+    page.add_init_script("""Storage.prototype.setItem = function () { throw new Error('quota'); };
+                            Storage.prototype.getItem = function () { throw new Error('denied'); };""")
+    page.goto(f"{base}/b/g/", wait_until="networkidle")
+    _settle(page)
+    before = page.evaluate(_FILTER, 'figure.item[data-item="a.png"] img')
+    page.locator("[data-reveal-all]").click()
+    _settle(page)
+    lifted = page.evaluate(_FILTER, 'figure.item[data-item="a.png"] img')
+    page.close()
+    assert not nojs
+    assert before == "blur(22px)" and lifted == "none", (before, lifted)
+    assert errors == [], errors
+
+
+
+def test_an_items_own_reveal_survives_an_in_place_save(browser, live):
+    """heid code-review (groa, kimi): nothing pinned the swap carrying an item's
+    own `revealed` — deleting it from the carry list left every test green.
+    Reveal one tile, save something else in place: it stays revealed, and its
+    button still says so."""
+    base, root = live
+    _blurred_set(root, blur=("a.png", "b.png"), flag=())
+    page = browser.new_page(viewport={"width": 1400, "height": 900})
+    page.goto(f"{base}/b/g/", wait_until="networkidle")
+    page.locator('figure.item[data-item="b.png"] .reveal').click()
+    page.locator('figure.item[data-item="a.png"] .flagtoggle button').click()
+    page.wait_for_selector('figure.item.is-flagged[data-item="a.png"]', timeout=10000)
+    _settle(page)
+    got = [page.evaluate(_FILTER, 'figure.item[data-item="b.png"] img'),
+           page.locator('figure.item[data-item="b.png"] .reveal').inner_text()]
+    page.close()
+    assert got[0] == "none" and "hide" in got[1], got
+
+
+def test_reveal_all_lifts_a_blurred_docs_own_page(browser, live):
+    """The doc page's blur (heid code-review) obeys the same <html> class, and
+    its own reveal works."""
+    from booth.app import set_blurred
+    base, root = live
+    b = root / "g"
+    b.mkdir()
+    (b / "n.md").write_text("# secret\n\nbody")
+    set_blurred(b, "n.md", True)
+    page = browser.new_page(viewport={"width": 1200, "height": 800})
+    page.goto(f"{base}/b/g/view?f=n.md", wait_until="networkidle")
+    _settle(page)
+    at_rest = page.evaluate(_FILTER, "#docbody .markdown-body, #docbody .textview")
+    page.locator("#docreveal").click()
+    _settle(page)
+    own = page.evaluate(_FILTER, "#docbody .markdown-body, #docbody .textview")
+    page.close()
+    assert at_rest == "blur(22px)" and own == "none", (at_rest, own)
+
+
+def test_space_on_a_focused_review_button_presses_it_and_does_not_move_on(browser, live):
+    """heid bug-hunt (hulda): the review's document-level Space handler moved to
+    the next item before a focused button could take the key, so a keyboard
+    user could not press Reveal all or the fog control with Space."""
+    base, root = live
+    _blurred_set(root, flag=())
+    page = browser.new_page(viewport={"width": 1400, "height": 900})
+    page.goto(f"{base}/b/g/view?f=a.png", wait_until="networkidle")
+    page.locator("[data-reveal-all]").focus()
+    page.keyboard.press(" ")
+    _settle(page)
+    got = [page.url, page.evaluate("document.documentElement.classList.contains('reveal-all')")]
+    page.close()
+    assert got[0].endswith("/b/g/view?f=a.png") and got[1], got
+
+
+def test_the_review_and_doc_top_bars_fit_a_phone(browser, live):
+    """heid bug-hunt (hulda, groa; needs-repro): the top bar gained the fog
+    control and Reveal all beside the name, the fit toggle and the download.
+    At 390px no review or doc page scrolls sideways, even with a long name."""
+    from booth.app import set_blurred
+    base, root = live
+    b = _blurred_set(root, flag=())
+    long = "a-rather-long-picture-name-" * 3 + ".png"
+    (b / long).write_bytes(PNG)
+    set_blurred(b, long, True)
+    (b / "n.md").write_text("# n")
+    set_blurred(b, "n.md", True)
+    over = {}
+    for url in (f"/b/g/view?f={long}", "/b/g/view?f=n.md"):
+        page = browser.new_page(viewport={"width": 390, "height": 844})
+        page.goto(f"{base}{url}", wait_until="networkidle")
+        over[url] = page.evaluate(
+            "document.documentElement.scrollWidth - document.documentElement.clientWidth")
+        # and nothing squeezed into a stack: every top-bar control is one line
+        over[url + " tallest"] = page.evaluate("""() => Math.max(...[...document.querySelectorAll(
+            '.vbar button, .vbar .vbtn')].filter(e => e.offsetParent).map(e => e.getBoundingClientRect().height)) - 40""")
+        page.close()
+    assert all(v <= 0 for v in over.values()), over
+
+
+def test_the_test_browser_has_no_internet(browser, live):
+    """Positive control for OFFLINE (booth-dev's ask: see the fix in force,
+    don't assume it). An external host fails at once, and a Booth page — whose
+    fonts are external — still goes idle in well under the goto timeout."""
+    base, root = live
+    (root / "g").mkdir()
+    page = browser.new_page()
+    t = time.time()
+    with pytest.raises(Exception) as err:
+        page.goto("https://fonts.googleapis.com/css2?family=IBM+Plex+Sans", timeout=10000)
+    external = time.time() - t
+    page.close()
+    page = browser.new_page()
+    t = time.time()
+    page.goto(f"{base}/b/g/", wait_until="networkidle")
+    local = time.time() - t
+    page.close()
+    assert "ERR_NAME_NOT_RESOLVED" in str(err.value) and external < 3, (str(err.value)[:80], external)
+    assert local < 10, local