diff --git a/CLAUDE.md b/CLAUDE.md
index 783224b8..7980e5e8 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -54,9 +54,10 @@ No Go on the host; Node 24 for the frontend.
   `/web-interface` from a real camera. Needs Docker and network access to the
   camera; everything else is in the image it builds. Run it when the WebUI
   changes shape (every few months). It redacts the camera's identity,
-  substitutes a scene over the live player, refuses to open the CGIs that reset
-  or reboot on render, and fails the run rather than installing if anything
-  identifying survives. `tools/webui-gallery/README.md` has the traps.
+  substitutes a scene over every picture from the camera, refuses to open the
+  CGIs that reset or reboot on render, and fails the run rather than installing
+  if anything identifying survives. Look at every capture anyway: the checks
+  read text and DOM, never pixels. `tools/webui-gallery/README.md` has the traps.
 
 ## Deploying
 
diff --git a/data/locales/pages.en.yml b/data/locales/pages.en.yml
index 322e5b28..ed3009cf 100644
--- a/data/locales/pages.en.yml
+++ b/data/locales/pages.en.yml
@@ -846,8 +846,14 @@ en:
       step3_title: 'Keep'
       title: 'Video encoding'
     web_interface:
-      intro: 'Every OpenIPC camera serves this interface itself, over its own address — there is no cloud account and no app in between. These are the pages of a camera running a current build.'
-      scene_credit_html: 'The beach in the Camera Preview and Majestic Settings shots is the view from a camera belonging to <a href="https://github.com/OpenIPC/majestic/issues/300#issuecomment-5405996706">@usa-</a>, an OpenIPC user, published with permission.'
+      detection_title: 'Person detection and tracking'
+      detection_tracking_html: 'Detections arrive a few times a second, not with every frame, and the video shows what makes that enough: a tracker that keeps each person''s number through the gaps. Here it runs on detections made from the recording at that rate; it is a prototype, not yet in the firmware.'
+      detection_video_caption: 'White flash: a detection arriving, about 2.5 a second. Coloured box and number: the same person, carried between detections. Faces pixelated.'
+      detection_video_label: 'Tracking people between detections, on a recorded street scene'
+      detection_what_html: 'Object detection (<code>objectDetect</code> in the settings) reports people in the picture. Every box goes where motion already goes: drawn over the picture in the browser, into the ONVIF metadata track and the track inside a recording, to pan/tilt following, and out of <code>/api/v1/analytics</code>.'
+      detection_where_html: 'On the GK7205V500, V510 and V530 it is YOLOv8 on the neural accelerator, with the models in the firmware, and it tells people from vehicles and animals (<a href="/news/npu-detection-and-sharper-ptz">more</a>).'
+      intro: 'Every OpenIPC camera serves this interface itself, over its own address — there is no cloud account and no app in between. These are the pages of a camera running a current build: the live picture, recordings played back from the memory card, detection drawn over the picture, and the settings behind them.'
+      scene_credit_html: 'The beach on the Dashboard, Live, Recordings and Camera - Settings shots is the view from a camera belonging to <a href="https://github.com/OpenIPC/majestic/issues/300#issuecomment-5405996706">@usa-</a>, an OpenIPC user, published with permission. The Motion detection shot is staged: the street is a frame of the recording in the video below, with faces pixelated, and its three boxes were handed to the interface''s own overlay, because the lab camera''s build carries no person detector.'
       title: Web Interface
     # The one-question strip on / and /get-started (#185). REMOVE AFTER 2027-01.
     why:
diff --git a/data/locales/pages.ru.yml b/data/locales/pages.ru.yml
index 116e6140..69ff68d6 100644
--- a/data/locales/pages.ru.yml
+++ b/data/locales/pages.ru.yml
@@ -884,8 +884,14 @@ ru:
       step3_title: 'Сопровождение'
       title: 'Видеокодирование'
     web_interface:
-      intro: 'Каждая камера с OpenIPC отдаёт этот интерфейс сама, по собственному адресу: ни облачного аккаунта, ни приложения-посредника. Ниже — страницы камеры с актуальной сборкой.'
-      scene_credit_html: 'Пляж на снимках Camera Preview и Majestic Settings — это вид с камеры пользователя OpenIPC <a href="https://github.com/OpenIPC/majestic/issues/300#issuecomment-5405996706">@usa-</a>, опубликован с разрешения владельца.'
+      detection_title: 'Детекция и сопровождение людей'
+      detection_tracking_html: 'Детекции приходят несколько раз в секунду, а не с каждым кадром, и видео показывает, почему этого хватает: трекер сохраняет за каждым человеком его номер в промежутках между детекциями. Здесь он работает на детекциях, сделанных по записи с той же частотой; это прототип, в прошивке его пока нет.'
+      detection_video_caption: 'Белая вспышка — пришла детекция, примерно 2,5 раза в секунду. Цветная рамка с номером — тот же человек между детекциями. Лица размыты.'
+      detection_video_label: 'Сопровождение людей между детекциями на записи улицы'
+      detection_what_html: 'Детекция объектов (<code>objectDetect</code> в настройках) сообщает о людях в кадре. Каждая рамка идёт туда же, куда и движение: поверх картинки в браузере, в дорожку метаданных ONVIF и в дорожку внутри записи, в слежение поворотной камеры и в <code>/api/v1/analytics</code>.'
+      detection_where_html: 'На GK7205V500, V510 и V530 это YOLOv8 на нейроускорителе, модели уже лежат в прошивке, и он отличает людей от транспорта и животных (<a href="/news/npu-detection-and-sharper-ptz">подробнее</a>).'
+      intro: 'Каждая камера с OpenIPC отдаёт этот интерфейс сама, по собственному адресу: ни облачного аккаунта, ни приложения-посредника. Ниже — страницы камеры с актуальной сборкой: живая картинка, записи с карты памяти, детекция поверх изображения и настройки за всем этим.'
+      scene_credit_html: 'Пляж на снимках Dashboard, Live, Recordings и Camera - Settings — это вид с камеры пользователя OpenIPC <a href="https://github.com/OpenIPC/majestic/issues/300#issuecomment-5405996706">@usa-</a>, опубликован с разрешения владельца. Снимок Motion detection постановочный: улица — кадр из записи в видео ниже, лица размыты, а три рамки переданы собственному оверлею интерфейса, потому что в сборке лабораторной камеры нет детектора людей.'
       title: Веб интерфейс
     why:
       close: "Закрыть"
diff --git a/data/locales/pages.zh.yml b/data/locales/pages.zh.yml
index 1eb28f5a..6df4a45f 100644
--- a/data/locales/pages.zh.yml
+++ b/data/locales/pages.zh.yml
@@ -846,8 +846,14 @@ zh:
       step3_title: '维护'
       title: '视频编码'
     web_interface:
-      intro: '每台运行 OpenIPC 的摄像机都由自身提供这个界面，通过它自己的地址访问：无需云端账户，也不需要任何中间应用。以下是一台运行当前版本固件的摄像机的页面。'
-      scene_credit_html: '“Camera Preview”和“Majestic Settings”截图中的海滩，来自 OpenIPC 用户 <a href="https://github.com/OpenIPC/majestic/issues/300#issuecomment-5405996706">@usa-</a> 的摄像机画面，已获授权发布。'
+      detection_title: '人形检测与跟踪'
+      detection_tracking_html: '检测结果每秒到达几次，而不是每一帧都有，视频展示了为什么这已经足够：跟踪器在两次检测之间为每个人保留其编号。这里它运行在以同样频率从录像中得到的检测结果上；它还是一个原型，尚未进入固件。'
+      detection_video_caption: '白色闪烁：一次检测到达，约每秒 2.5 次。彩色框和编号：两次检测之间保持不变的同一个人。人脸已打码。'
+      detection_video_label: '在一段街道录像上，于两次检测之间跟踪行人'
+      detection_what_html: '目标检测（设置中的 <code>objectDetect</code>）报告画面中的人。每个框都会送到运动检测结果已经送达的地方：浏览器中叠加在画面上、ONVIF 元数据轨道和录像内的轨道、云台跟随，以及 <code>/api/v1/analytics</code>。'
+      detection_where_html: '在 GK7205V500、V510 和 V530 上，它是神经网络加速器上的 YOLOv8，模型已内置在固件中，并能区分人、车辆和动物（<a href="/news/npu-detection-and-sharper-ptz">详情</a>）。'
+      intro: '每台运行 OpenIPC 的摄像机都由自身提供这个界面，通过它自己的地址访问：无需云端账户，也不需要任何中间应用。以下是一台运行当前版本固件的摄像机的页面：实时画面、从存储卡回放的录像、叠加在画面上的检测框，以及它们背后的设置。'
+      scene_credit_html: 'Dashboard、Live、Recordings 和 Camera - Settings 截图中的海滩，来自 OpenIPC 用户 <a href="https://github.com/OpenIPC/majestic/issues/300#issuecomment-5405996706">@usa-</a> 的摄像机画面，已获授权发布。Motion detection 截图是摆拍的：街道是下方视频中录像的一帧，人脸已打码，三个框交由界面自身的叠加层绘制，因为实验室摄像机的固件版本不带人形检测器。'
       title: 页面展示
     why:
       close: "关闭"
diff --git a/data/webui_gallery.yml b/data/webui_gallery.yml
index 56ee44f5..4d4eb789 100644
--- a/data/webui_gallery.yml
+++ b/data/webui_gallery.yml
@@ -3,14 +3,14 @@
 # One entry per screenshot, in the order the page lays them out. Two things read
 # this file and they must not drift apart:
 #
-#   * app/views/pages/web_interface.html.erb, through WebuiGallery, to build the
-#     tiles;
+#   * the site, through `npm run export -w @openipc/site`, to build the tiles
+#     of frontend/apps/site/src/components/pages/WebInterface.astro;
 #   * tools/webui-gallery, to know which pages of a camera to photograph.
 #
 # Adding a screenshot is therefore one edit here plus a run of the tool. See
 # tools/webui-gallery/README.md.
 #
-#   slug     basename of the pair in app/assets/images/webui/ --
+#   slug     basename of the pair in frontend/apps/site/src/assets/webui/ --
 #            <slug>.webp is the full 2560px capture, <slug>-thumb.webp the tile.
 #   caption  the page's name as the camera prints it -- the word in the nav
 #            bar, prefixed by its menu where it has one, exactly as the page's
@@ -26,19 +26,42 @@
 #            at goes on the public site, so the tool lays a still picture over
 #            the player -- and fails the run if it cannot find one to cover,
 #            rather than quietly photographing the camera's own view when the
-#            WebUI changes shape.
+#            WebUI changes shape. A file name instead of true takes that
+#            picture from tools/webui-gallery/scene/ for this page alone.
+#   analytics  a fixture in tools/webui-gallery/scene/: the boxes of the people
+#            in this page's scene, answered on /ws/analytics in place of the
+#            camera, so the WebUI's own overlay draws them. A staged screen --
+#            the page that shows it says so.
 screens:
   - slug: dashboard
     caption: Dashboard
     cgi: dashboard.cgi
-    settle: 2500
+    # The graphs are drawn from samples the page takes while it is open, over
+    # a two-minute window: shot sooner, they are empty axes.
+    settle: 100000
 
   - slug: live
     caption: Live
     cgi: live.cgi
+    # The pan/tilt pad shows only on a camera with a head to turn, so this one
+    # is shot from such a camera, on its own:
+    #   tools/webui-gallery/run.sh --camera <ptz camera> --only live
     settle: 14000
     scene: true
 
+  - slug: recordings
+    caption: Recordings
+    cgi: recordings.cgi
+    settle: 9000
+    scene: true
+
+  - slug: motion-detection
+    caption: Camera - Settings - Motion detection
+    cgi: camera.cgi?tab=motionDetect
+    settle: 9000
+    scene: street.jpg
+    analytics: street.json
+
   - slug: camera-settings
     caption: Camera - Settings
     cgi: camera.cgi
@@ -55,6 +78,11 @@ screens:
     cgi: config.cgi
     settle: 3000
 
+  - slug: sd-card
+    caption: System - SD Card
+    cgi: sdcard.cgi
+    settle: 4000
+
   - slug: logs
     caption: System - Logs
     cgi: logs.cgi
@@ -89,3 +117,8 @@ screens:
     caption: Services - Telegram
     cgi: telegram.cgi
     settle: 3000
+
+  - slug: openwall
+    caption: Services - OpenWall
+    cgi: openwall.cgi
+    settle: 3000
diff --git a/frontend/apps/site/public/video/person-tracking.mp4 b/frontend/apps/site/public/video/person-tracking.mp4
new file mode 100644
index 00000000..0d82f0e5
Binary files /dev/null and b/frontend/apps/site/public/video/person-tracking.mp4 differ
diff --git a/frontend/apps/site/public/video/person-tracking.webp b/frontend/apps/site/public/video/person-tracking.webp
new file mode 100644
index 00000000..07b11b19
Binary files /dev/null and b/frontend/apps/site/public/video/person-tracking.webp differ
diff --git a/frontend/apps/site/src/assets/webui/camera-settings-thumb.webp b/frontend/apps/site/src/assets/webui/camera-settings-thumb.webp
index 25e80fe4..40d5f569 100644
Binary files a/frontend/apps/site/src/assets/webui/camera-settings-thumb.webp and b/frontend/apps/site/src/assets/webui/camera-settings-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/camera-settings.webp b/frontend/apps/site/src/assets/webui/camera-settings.webp
index ceb238cf..2bdbc146 100644
Binary files a/frontend/apps/site/src/assets/webui/camera-settings.webp and b/frontend/apps/site/src/assets/webui/camera-settings.webp differ
diff --git a/frontend/apps/site/src/assets/webui/config-file-thumb.webp b/frontend/apps/site/src/assets/webui/config-file-thumb.webp
index bb5d7f0f..170ad569 100644
Binary files a/frontend/apps/site/src/assets/webui/config-file-thumb.webp and b/frontend/apps/site/src/assets/webui/config-file-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/config-file.webp b/frontend/apps/site/src/assets/webui/config-file.webp
index 7658129f..364cf1b1 100644
Binary files a/frontend/apps/site/src/assets/webui/config-file.webp and b/frontend/apps/site/src/assets/webui/config-file.webp differ
diff --git a/frontend/apps/site/src/assets/webui/console-thumb.webp b/frontend/apps/site/src/assets/webui/console-thumb.webp
index bb1de2ce..0b8259de 100644
Binary files a/frontend/apps/site/src/assets/webui/console-thumb.webp and b/frontend/apps/site/src/assets/webui/console-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/console.webp b/frontend/apps/site/src/assets/webui/console.webp
index 86dbbf0e..e4f87d5c 100644
Binary files a/frontend/apps/site/src/assets/webui/console.webp and b/frontend/apps/site/src/assets/webui/console.webp differ
diff --git a/frontend/apps/site/src/assets/webui/dashboard-thumb.webp b/frontend/apps/site/src/assets/webui/dashboard-thumb.webp
index 63dcfd64..c92aacdf 100644
Binary files a/frontend/apps/site/src/assets/webui/dashboard-thumb.webp and b/frontend/apps/site/src/assets/webui/dashboard-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/dashboard.webp b/frontend/apps/site/src/assets/webui/dashboard.webp
index 76bcba00..8788d129 100644
Binary files a/frontend/apps/site/src/assets/webui/dashboard.webp and b/frontend/apps/site/src/assets/webui/dashboard.webp differ
diff --git a/frontend/apps/site/src/assets/webui/file-manager-thumb.webp b/frontend/apps/site/src/assets/webui/file-manager-thumb.webp
index 6c2a34bc..f567f457 100644
Binary files a/frontend/apps/site/src/assets/webui/file-manager-thumb.webp and b/frontend/apps/site/src/assets/webui/file-manager-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/file-manager.webp b/frontend/apps/site/src/assets/webui/file-manager.webp
index cea3df07..b1b47906 100644
Binary files a/frontend/apps/site/src/assets/webui/file-manager.webp and b/frontend/apps/site/src/assets/webui/file-manager.webp differ
diff --git a/frontend/apps/site/src/assets/webui/firmware-update-thumb.webp b/frontend/apps/site/src/assets/webui/firmware-update-thumb.webp
index 9c73563d..7eb49a6b 100644
Binary files a/frontend/apps/site/src/assets/webui/firmware-update-thumb.webp and b/frontend/apps/site/src/assets/webui/firmware-update-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/firmware-update.webp b/frontend/apps/site/src/assets/webui/firmware-update.webp
index 00d458e2..d7e7802d 100644
Binary files a/frontend/apps/site/src/assets/webui/firmware-update.webp and b/frontend/apps/site/src/assets/webui/firmware-update.webp differ
diff --git a/frontend/apps/site/src/assets/webui/live-thumb.webp b/frontend/apps/site/src/assets/webui/live-thumb.webp
index 0be3e8a4..dd0bef3b 100644
Binary files a/frontend/apps/site/src/assets/webui/live-thumb.webp and b/frontend/apps/site/src/assets/webui/live-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/live.webp b/frontend/apps/site/src/assets/webui/live.webp
index d5a2ce3b..4d513de1 100644
Binary files a/frontend/apps/site/src/assets/webui/live.webp and b/frontend/apps/site/src/assets/webui/live.webp differ
diff --git a/frontend/apps/site/src/assets/webui/logs-thumb.webp b/frontend/apps/site/src/assets/webui/logs-thumb.webp
index 812ae0ef..fa21cf43 100644
Binary files a/frontend/apps/site/src/assets/webui/logs-thumb.webp and b/frontend/apps/site/src/assets/webui/logs-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/logs.webp b/frontend/apps/site/src/assets/webui/logs.webp
index 8d7b673a..02a26d46 100644
Binary files a/frontend/apps/site/src/assets/webui/logs.webp and b/frontend/apps/site/src/assets/webui/logs.webp differ
diff --git a/frontend/apps/site/src/assets/webui/motion-detection-thumb.webp b/frontend/apps/site/src/assets/webui/motion-detection-thumb.webp
new file mode 100644
index 00000000..08de353e
Binary files /dev/null and b/frontend/apps/site/src/assets/webui/motion-detection-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/motion-detection.webp b/frontend/apps/site/src/assets/webui/motion-detection.webp
new file mode 100644
index 00000000..b7b9f4f7
Binary files /dev/null and b/frontend/apps/site/src/assets/webui/motion-detection.webp differ
diff --git a/frontend/apps/site/src/assets/webui/network-thumb.webp b/frontend/apps/site/src/assets/webui/network-thumb.webp
index db016f6b..5620717b 100644
Binary files a/frontend/apps/site/src/assets/webui/network-thumb.webp and b/frontend/apps/site/src/assets/webui/network-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/network.webp b/frontend/apps/site/src/assets/webui/network.webp
index 8469cd8e..18fcd642 100644
Binary files a/frontend/apps/site/src/assets/webui/network.webp and b/frontend/apps/site/src/assets/webui/network.webp differ
diff --git a/frontend/apps/site/src/assets/webui/openwall-thumb.webp b/frontend/apps/site/src/assets/webui/openwall-thumb.webp
new file mode 100644
index 00000000..f4cf5e5a
Binary files /dev/null and b/frontend/apps/site/src/assets/webui/openwall-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/openwall.webp b/frontend/apps/site/src/assets/webui/openwall.webp
new file mode 100644
index 00000000..b029e5ff
Binary files /dev/null and b/frontend/apps/site/src/assets/webui/openwall.webp differ
diff --git a/frontend/apps/site/src/assets/webui/recordings-thumb.webp b/frontend/apps/site/src/assets/webui/recordings-thumb.webp
new file mode 100644
index 00000000..c820d970
Binary files /dev/null and b/frontend/apps/site/src/assets/webui/recordings-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/recordings.webp b/frontend/apps/site/src/assets/webui/recordings.webp
new file mode 100644
index 00000000..1b95d5b7
Binary files /dev/null and b/frontend/apps/site/src/assets/webui/recordings.webp differ
diff --git a/frontend/apps/site/src/assets/webui/sd-card-thumb.webp b/frontend/apps/site/src/assets/webui/sd-card-thumb.webp
new file mode 100644
index 00000000..07a0b2ec
Binary files /dev/null and b/frontend/apps/site/src/assets/webui/sd-card-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/sd-card.webp b/frontend/apps/site/src/assets/webui/sd-card.webp
new file mode 100644
index 00000000..ca5253fc
Binary files /dev/null and b/frontend/apps/site/src/assets/webui/sd-card.webp differ
diff --git a/frontend/apps/site/src/assets/webui/stream-urls-thumb.webp b/frontend/apps/site/src/assets/webui/stream-urls-thumb.webp
index 47e48b55..9e5da0db 100644
Binary files a/frontend/apps/site/src/assets/webui/stream-urls-thumb.webp and b/frontend/apps/site/src/assets/webui/stream-urls-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/stream-urls.webp b/frontend/apps/site/src/assets/webui/stream-urls.webp
index 58effc15..a8874ea0 100644
Binary files a/frontend/apps/site/src/assets/webui/stream-urls.webp and b/frontend/apps/site/src/assets/webui/stream-urls.webp differ
diff --git a/frontend/apps/site/src/assets/webui/telegram-thumb.webp b/frontend/apps/site/src/assets/webui/telegram-thumb.webp
index e4087cf9..2e3d360f 100644
Binary files a/frontend/apps/site/src/assets/webui/telegram-thumb.webp and b/frontend/apps/site/src/assets/webui/telegram-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/telegram.webp b/frontend/apps/site/src/assets/webui/telegram.webp
index f9f3ffad..55158234 100644
Binary files a/frontend/apps/site/src/assets/webui/telegram.webp and b/frontend/apps/site/src/assets/webui/telegram.webp differ
diff --git a/frontend/apps/site/src/assets/webui/time-thumb.webp b/frontend/apps/site/src/assets/webui/time-thumb.webp
index fb1e9d5a..69e13d52 100644
Binary files a/frontend/apps/site/src/assets/webui/time-thumb.webp and b/frontend/apps/site/src/assets/webui/time-thumb.webp differ
diff --git a/frontend/apps/site/src/assets/webui/time.webp b/frontend/apps/site/src/assets/webui/time.webp
index 673dc478..0a6e7786 100644
Binary files a/frontend/apps/site/src/assets/webui/time.webp and b/frontend/apps/site/src/assets/webui/time.webp differ
diff --git a/frontend/apps/site/src/components/pages/WebInterface.astro b/frontend/apps/site/src/components/pages/WebInterface.astro
index df80f4fc..e848d004 100644
--- a/frontend/apps/site/src/components/pages/WebInterface.astro
+++ b/frontend/apps/site/src/components/pages/WebInterface.astro
@@ -8,10 +8,15 @@
  * page cannot disagree about what the gallery
  * contains.
  *
- * The two pages with a live player show a beach rather than the bench of
- * cables the lab camera actually faces; see the credit under the grid. The
- * scene is laid over the <video> in the DOM at capture time, the same way the
- * lab's address and MAC are rewritten out of the text.
+ * The pages with a picture from the camera show a beach rather than the
+ * bench of cables the lab camera actually faces; see the credit under the
+ * grid. The scene is laid over the player in the DOM at capture time, the same
+ * way the lab's address and MAC are rewritten out of the text. The motion
+ * detection screen is staged -- a street scene, and person boxes fed to the
+ * WebUI's own overlay -- and the credit says so.
+ *
+ * The tracking video under it is not from the lab camera: rendered from a street
+ * recording with every face pixelated, and served from public/video.
  */
 import Container from '../Container.astro';
 import PageTitle from '../PageTitle.astro';
@@ -34,6 +39,33 @@ const k = (s: string) => t(`pages.web_interface.${s}`);
     </div>
 
     <p class="mt-4 text-sm text-body-secondary lg:w-2/3" set:html={k('scene_credit_html')} />
+
+    <section id="detection" class="mt-12">
+      <h2 class="mb-4 text-2xl">{k('detection_title')}</h2>
+      <div class="grid items-start gap-6 lg:grid-cols-2">
+        <figure class="m-0">
+          <video
+            class="block h-auto w-full rounded-lg border border-hairline bg-black"
+            src="/video/person-tracking.mp4"
+            poster="/video/person-tracking.webp"
+            width="900"
+            height="824"
+            controls
+            muted
+            loop
+            playsinline
+            preload="none"
+            aria-label={k('detection_video_label')}
+          />
+          <figcaption class="mt-2 text-sm text-body-secondary">{k('detection_video_caption')}</figcaption>
+        </figure>
+        <div class="space-y-3 lg:pt-1">
+          <p set:html={k('detection_what_html')} />
+          <p set:html={k('detection_where_html')} />
+          <p set:html={k('detection_tracking_html')} />
+        </div>
+      </div>
+    </section>
   </article>
 </Container>
 
diff --git a/frontend/apps/site/src/data/webui-gallery.json b/frontend/apps/site/src/data/webui-gallery.json
index 375a9a86..708d1d2b 100644
--- a/frontend/apps/site/src/data/webui-gallery.json
+++ b/frontend/apps/site/src/data/webui-gallery.json
@@ -9,6 +9,16 @@
     "caption": "Live",
     "alt": "Live page of the OpenIPC web interface"
   },
+  {
+    "slug": "recordings",
+    "caption": "Recordings",
+    "alt": "Recordings page of the OpenIPC web interface"
+  },
+  {
+    "slug": "motion-detection",
+    "caption": "Camera - Settings - Motion detection",
+    "alt": "Camera - Settings - Motion detection page of the OpenIPC web interface"
+  },
   {
     "slug": "camera-settings",
     "caption": "Camera - Settings",
@@ -24,6 +34,11 @@
     "caption": "Camera - Config file",
     "alt": "Camera - Config file page of the OpenIPC web interface"
   },
+  {
+    "slug": "sd-card",
+    "caption": "System - SD Card",
+    "alt": "System - SD Card page of the OpenIPC web interface"
+  },
   {
     "slug": "logs",
     "caption": "System - Logs",
@@ -58,5 +73,10 @@
     "slug": "telegram",
     "caption": "Services - Telegram",
     "alt": "Services - Telegram page of the OpenIPC web interface"
+  },
+  {
+    "slug": "openwall",
+    "caption": "Services - OpenWall",
+    "alt": "Services - OpenWall page of the OpenIPC web interface"
   }
 ]
diff --git a/frontend/apps/site/src/i18n/en.json b/frontend/apps/site/src/i18n/en.json
index 5484f0b4..08deb5af 100644
--- a/frontend/apps/site/src/i18n/en.json
+++ b/frontend/apps/site/src/i18n/en.json
@@ -1044,8 +1044,14 @@
       "title": "Video encoding"
     },
     "web_interface": {
-      "intro": "Every OpenIPC camera serves this interface itself, over its own address — there is no cloud account and no app in between. These are the pages of a camera running a current build.",
-      "scene_credit_html": "The beach in the Camera Preview and Majestic Settings shots is the view from a camera belonging to <a href=\"https://github.com/OpenIPC/majestic/issues/300#issuecomment-5405996706\">@usa-</a>, an OpenIPC user, published with permission.",
+      "detection_title": "Person detection and tracking",
+      "detection_tracking_html": "Detections arrive a few times a second, not with every frame, and the video shows what makes that enough: a tracker that keeps each person's number through the gaps. Here it runs on detections made from the recording at that rate; it is a prototype, not yet in the firmware.",
+      "detection_video_caption": "White flash: a detection arriving, about 2.5 a second. Coloured box and number: the same person, carried between detections. Faces pixelated.",
+      "detection_video_label": "Tracking people between detections, on a recorded street scene",
+      "detection_what_html": "Object detection (<code>objectDetect</code> in the settings) reports people in the picture. Every box goes where motion already goes: drawn over the picture in the browser, into the ONVIF metadata track and the track inside a recording, to pan/tilt following, and out of <code>/api/v1/analytics</code>.",
+      "detection_where_html": "On the GK7205V500, V510 and V530 it is YOLOv8 on the neural accelerator, with the models in the firmware, and it tells people from vehicles and animals (<a href=\"/news/npu-detection-and-sharper-ptz\">more</a>).",
+      "intro": "Every OpenIPC camera serves this interface itself, over its own address — there is no cloud account and no app in between. These are the pages of a camera running a current build: the live picture, recordings played back from the memory card, detection drawn over the picture, and the settings behind them.",
+      "scene_credit_html": "The beach on the Dashboard, Live, Recordings and Camera - Settings shots is the view from a camera belonging to <a href=\"https://github.com/OpenIPC/majestic/issues/300#issuecomment-5405996706\">@usa-</a>, an OpenIPC user, published with permission. The Motion detection shot is staged: the street is a frame of the recording in the video below, with faces pixelated, and its three boxes were handed to the interface's own overlay, because the lab camera's build carries no person detector.",
       "title": "Web Interface"
     },
     "why": {
diff --git a/frontend/apps/site/src/i18n/ru.json b/frontend/apps/site/src/i18n/ru.json
index 04b879e8..2bcc888d 100644
--- a/frontend/apps/site/src/i18n/ru.json
+++ b/frontend/apps/site/src/i18n/ru.json
@@ -1050,8 +1050,14 @@
       "title": "Видеокодирование"
     },
     "web_interface": {
-      "intro": "Каждая камера с OpenIPC отдаёт этот интерфейс сама, по собственному адресу: ни облачного аккаунта, ни приложения-посредника. Ниже — страницы камеры с актуальной сборкой.",
-      "scene_credit_html": "Пляж на снимках Camera Preview и Majestic Settings — это вид с камеры пользователя OpenIPC <a href=\"https://github.com/OpenIPC/majestic/issues/300#issuecomment-5405996706\">@usa-</a>, опубликован с разрешения владельца.",
+      "detection_title": "Детекция и сопровождение людей",
+      "detection_tracking_html": "Детекции приходят несколько раз в секунду, а не с каждым кадром, и видео показывает, почему этого хватает: трекер сохраняет за каждым человеком его номер в промежутках между детекциями. Здесь он работает на детекциях, сделанных по записи с той же частотой; это прототип, в прошивке его пока нет.",
+      "detection_video_caption": "Белая вспышка — пришла детекция, примерно 2,5 раза в секунду. Цветная рамка с номером — тот же человек между детекциями. Лица размыты.",
+      "detection_video_label": "Сопровождение людей между детекциями на записи улицы",
+      "detection_what_html": "Детекция объектов (<code>objectDetect</code> в настройках) сообщает о людях в кадре. Каждая рамка идёт туда же, куда и движение: поверх картинки в браузере, в дорожку метаданных ONVIF и в дорожку внутри записи, в слежение поворотной камеры и в <code>/api/v1/analytics</code>.",
+      "detection_where_html": "На GK7205V500, V510 и V530 это YOLOv8 на нейроускорителе, модели уже лежат в прошивке, и он отличает людей от транспорта и животных (<a href=\"/news/npu-detection-and-sharper-ptz\">подробнее</a>).",
+      "intro": "Каждая камера с OpenIPC отдаёт этот интерфейс сама, по собственному адресу: ни облачного аккаунта, ни приложения-посредника. Ниже — страницы камеры с актуальной сборкой: живая картинка, записи с карты памяти, детекция поверх изображения и настройки за всем этим.",
+      "scene_credit_html": "Пляж на снимках Dashboard, Live, Recordings и Camera - Settings — это вид с камеры пользователя OpenIPC <a href=\"https://github.com/OpenIPC/majestic/issues/300#issuecomment-5405996706\">@usa-</a>, опубликован с разрешения владельца. Снимок Motion detection постановочный: улица — кадр из записи в видео ниже, лица размыты, а три рамки переданы собственному оверлею интерфейса, потому что в сборке лабораторной камеры нет детектора людей.",
       "title": "Веб интерфейс"
     },
     "why": {
diff --git a/frontend/apps/site/src/i18n/zh.json b/frontend/apps/site/src/i18n/zh.json
index 627eea70..319202b5 100644
--- a/frontend/apps/site/src/i18n/zh.json
+++ b/frontend/apps/site/src/i18n/zh.json
@@ -1034,8 +1034,14 @@
       "title": "视频编码"
     },
     "web_interface": {
-      "intro": "每台运行 OpenIPC 的摄像机都由自身提供这个界面，通过它自己的地址访问：无需云端账户，也不需要任何中间应用。以下是一台运行当前版本固件的摄像机的页面。",
-      "scene_credit_html": "“Camera Preview”和“Majestic Settings”截图中的海滩，来自 OpenIPC 用户 <a href=\"https://github.com/OpenIPC/majestic/issues/300#issuecomment-5405996706\">@usa-</a> 的摄像机画面，已获授权发布。",
+      "detection_title": "人形检测与跟踪",
+      "detection_tracking_html": "检测结果每秒到达几次，而不是每一帧都有，视频展示了为什么这已经足够：跟踪器在两次检测之间为每个人保留其编号。这里它运行在以同样频率从录像中得到的检测结果上；它还是一个原型，尚未进入固件。",
+      "detection_video_caption": "白色闪烁：一次检测到达，约每秒 2.5 次。彩色框和编号：两次检测之间保持不变的同一个人。人脸已打码。",
+      "detection_video_label": "在一段街道录像上，于两次检测之间跟踪行人",
+      "detection_what_html": "目标检测（设置中的 <code>objectDetect</code>）报告画面中的人。每个框都会送到运动检测结果已经送达的地方：浏览器中叠加在画面上、ONVIF 元数据轨道和录像内的轨道、云台跟随，以及 <code>/api/v1/analytics</code>。",
+      "detection_where_html": "在 GK7205V500、V510 和 V530 上，它是神经网络加速器上的 YOLOv8，模型已内置在固件中，并能区分人、车辆和动物（<a href=\"/news/npu-detection-and-sharper-ptz\">详情</a>）。",
+      "intro": "每台运行 OpenIPC 的摄像机都由自身提供这个界面，通过它自己的地址访问：无需云端账户，也不需要任何中间应用。以下是一台运行当前版本固件的摄像机的页面：实时画面、从存储卡回放的录像、叠加在画面上的检测框，以及它们背后的设置。",
+      "scene_credit_html": "Dashboard、Live、Recordings 和 Camera - Settings 截图中的海滩，来自 OpenIPC 用户 <a href=\"https://github.com/OpenIPC/majestic/issues/300#issuecomment-5405996706\">@usa-</a> 的摄像机画面，已获授权发布。Motion detection 截图是摆拍的：街道是下方视频中录像的一帧，人脸已打码，三个框交由界面自身的叠加层绘制，因为实验室摄像机的固件版本不带人形检测器。",
       "title": "页面展示"
     },
     "why": {
diff --git a/frontend/apps/site/src/lib/pages.build.test.ts b/frontend/apps/site/src/lib/pages.build.test.ts
index 4eac398f..1f4460bd 100644
--- a/frontend/apps/site/src/lib/pages.build.test.ts
+++ b/frontend/apps/site/src/lib/pages.build.test.ts
@@ -731,4 +731,19 @@ describe('the WebUI gallery credits its scene', () => {
       expect(html, `${locale}${path} lost the scene credit`).toContain('@usa-');
     }
   });
+
+  // The two things maintainers asked to see on the site (playback from the
+  // card, people in boxes) and the tracking video, in every language.
+  test('every locale shows playback, detection and the tracking video', () => {
+    let seen = 0;
+    for (const [locale, path, html] of PAGES) {
+      if (path !== '/web-interface') continue;
+      seen++;
+      expect(html, `${locale}${path}`).toContain('src="/video/person-tracking.mp4"');
+      expect(html, `${locale}${path}`).toContain('poster="/video/person-tracking.webp"');
+      expect(html, `${locale}${path}`).toContain('alt="Recordings page of the OpenIPC web interface"');
+      expect(html, `${locale}${path}`).toContain('alt="Camera - Settings - Motion detection page of the OpenIPC web interface"');
+    }
+    expect(seen).toBe(3);
+  });
 });
diff --git a/tools/webui-gallery/README.md b/tools/webui-gallery/README.md
index 950e7e49..49ba5af4 100644
--- a/tools/webui-gallery/README.md
+++ b/tools/webui-gallery/README.md
@@ -69,8 +69,14 @@ findable by anyone who reads the screenshot.
 
 `redact.js` rewrites the DOM immediately before the shutter: the hostname you
 connected to becomes `camera.local`, the address it resolved to becomes
-`192.168.1.10`, any MAC becomes `00:11:22:33:44:55`, and every remaining private
-address becomes `192.168.1.50`. Add `--map OLD=NEW` for anything specific to
+`192.168.1.10`, any MAC becomes `00:11:22:33:44:55`, every remaining private
+address becomes `192.168.1.50`, and every public one `203.0.113.10`. The public
+ones are not hypothetical: when the tool's browser opens a page with a player,
+majestic logs the WebRTC session, and that log prints the lab's own reflexive
+address and the remote candidate of whoever is watching. The firmware version
+is a dotted quad too — `2.6.10.11-lite` — so the tool reads the camera's own
+from the dashboard and leaves exactly that one alone; anything else shaped like
+an address goes, whatever follows it. Add `--map OLD=NEW` for anything specific to
 your network that deserves a tidier stand-in — a gateway, say.
 
 The same question is then asked twice. Once inside `shoot.js`, against the very
@@ -105,17 +111,28 @@ None of this inspects the pixels. Look at the captures before you commit them.
 
 ## The scene
 
-Two pages show a live player, and whatever the camera is pointed at is what goes
-on the public site. `--scene FILE` lays a still picture over the `<video>` in
-the DOM — the same trick as the redaction, applied to the image instead of the
-text — fitted to the element's content box so the player's own border and corner
-radius still frame it, and cropped with `object-fit: cover` the way real video
-fills the element.
-
-Pages that show live video are marked `scene: true` in the manifest. That mark
-is what turns a change in the WebUI into a failure rather than a leak: if the
-overlay finds no player to cover on a page that claims to have one, the run
-stops instead of photographing the camera's own view.
+Several pages show the camera's picture — the players, the dashboard's
+snapshot tile, the recordings player — and whatever the camera is pointed at
+is what goes on the public site. `--scene FILE` lays a still picture over each
+of them in the DOM — the same trick as the redaction, applied to the image
+instead of the text — fitted to the element's content box so the player's own
+border and corner radius still frame it, and cropped with `object-fit: cover`
+the way real video fills the element. It goes in as the player's next sibling,
+so whatever the page draws over its player — detection boxes, the region
+editor, the control bar — still draws over the scene.
+
+Two checks stand behind it. Pages that show live video are marked `scene: true`
+in the manifest, and if the overlay finds no player to cover on one of those,
+the run stops. And immediately before every shutter, the tool asks whether any
+`<img>`, `<video>` or player canvas is still showing that the scene did not
+cover, and fails the page if one is. The second check exists because the first
+trusts the manifest: the dashboard grew a snapshot tile, nobody marked it, and
+a run photographed the lab's room. It was caught by looking, before anything
+was installed.
+
+A camera also raises notices about itself on every page — after a crash, for
+one — and those describe the lab device, not the interface. `CAMERA_NOTICES` in
+`shoot.js` hides them for the shutter.
 
 The default scene is `scene/beach-usa.jpg`; see `scene/CREDIT.md` before
 changing it, because the page credits it by name.
@@ -127,6 +144,21 @@ somebody who has a better picture is not safety, it is a nuisance. The tool
 names the pages this affects and tells you to look at those captures before
 committing them. Do look.
 
+## Staged screens
+
+The lab camera's firmware has no object detector, and its view is replaced in
+any case, so a screen that shows detection cannot be photographed honestly as
+it is. The motion detection screen is staged, in two parts the manifest names:
+
+- `scene: street.jpg` — a picture with people in it for this screen alone,
+  instead of the run's scene;
+- `analytics: street.json` — the boxes of those people, in the picture's own
+  pixels. The tool answers the page's `/ws/analytics` socket with them, scaled
+  to the main-stream frame the camera reports at `/api/v1/osd`, as source
+  `object`, class 1 (human), and the WebUI's own overlay draws them.
+
+The page that publishes the screenshot says it is staged. Keep it that way.
+
 ## Traps
 
 Five things have cost time here. They are all still true.
@@ -179,7 +211,7 @@ see them. `redactInPage` rewrites both.
 --camera HOST     address, hostname, or URL. Required.
 --user NAME       WebUI user. Default root.
 --password PW     prompted for if omitted, which keeps it out of your history.
---scene FILE      picture for the live player, or "none".
+--scene FILE      picture for the camera's players, or "none".
 --map OLD=NEW     extra literal substitution, repeatable.
 --only SLUGS      comma-separated slugs; re-shoot part of the gallery.
 --no-install      leave the output in tmp/webui-gallery/out.
diff --git a/tools/webui-gallery/redact.js b/tools/webui-gallery/redact.js
index 798a8d67..547eb6b4 100644
--- a/tools/webui-gallery/redact.js
+++ b/tools/webui-gallery/redact.js
@@ -13,13 +13,16 @@
 // Documentation values, chosen to look like an ordinary home network.
 const CAMERA_IP = '192.168.1.10';
 const OTHER_IP = '192.168.1.50';
+// TEST-NET-3, the range RFC 5737 sets aside for documentation: a public
+// address that belongs to nobody.
+const PUBLIC_IP = '203.0.113.10';
 const CAMERA_IP6 = '2001:db8::10';
 const OTHER_IP6 = '2001:db8::50';
 const MAC = '00:11:22:33:44:55';
 const HOSTNAME = 'camera.local';
 
 // Addresses the rewriting is allowed to leave alone, because it put them there.
-const KEEP = [CAMERA_IP, OTHER_IP, '192.168.1.1'];
+const KEEP = [CAMERA_IP, OTHER_IP, PUBLIC_IP, '192.168.1.1'];
 
 // IPv6 is handled by prefix rather than by a general literal match. A regex
 // loose enough to catch every valid form also catches clock times and the MAC
@@ -53,6 +56,19 @@ function redactInPage(cfg) {
     return false;
   };
 
+  // Anything routable on the internet that is not reserved for a purpose that
+  // identifies nobody: loopback, "this network", multicast and the
+  // documentation ranges.
+  const isPublic = (ip) => {
+    const o = ip.split('.').map(Number);
+    if (o.some((n) => Number.isNaN(n) || n > 255)) return false;
+    if (isPrivate(ip) || o[0] === 0 || o[0] === 127 || o[0] >= 224) return false;
+    if (o[0] === 192 && o[1] === 0 && o[2] === 2) return false;
+    if (o[0] === 198 && o[1] === 51 && o[2] === 100) return false;
+    if (o[0] === 203 && o[1] === 0 && o[2] === 113) return false;
+    return true;
+  };
+
   const apply = (s) => {
     let out = s;
     // Operator-supplied literal substitutions run first: they are the specific
@@ -75,9 +91,13 @@ function redactInPage(cfg) {
     // sweep could take a bite out of a real one.
     out = out.replace(macRe, cfg.mac);
     for (const source of cfg.v6) out = out.replace(new RegExp(source[0], source[1]), cfg.otherIp6);
+    // Public addresses as well as private ones. WebRTC logs its reflexive
+    // address -- the lab's own public IP -- and every remote candidate, which
+    // is the public address of whoever was watching.
     out = out.replace(ipRe, (m) => {
       if (cfg.keep.includes(m)) return m;
-      return isPrivate(m) ? cfg.otherIp : m;
+      if (isPrivate(m)) return cfg.otherIp;
+      return isPublic(m) ? cfg.publicIp : m;
     });
     return out;
   };
@@ -146,12 +166,18 @@ function survivors(text, cfg) {
   for (const ip of text.match(/\b(?:\d{1,3}\.){3}\d{1,3}\b/g) || []) {
     if (cfg.keep.includes(ip) || ip.startsWith('127.')) continue;
     const o = ip.split('.').map(Number);
+    if (o.some((n) => n > 255)) continue;
     const priv = o[0] === 10
       || (o[0] === 172 && o[1] >= 16 && o[1] <= 31)
       || (o[0] === 192 && o[1] === 168)
       || (o[0] === 100 && o[1] >= 64 && o[1] <= 127)
       || (o[0] === 169 && o[1] === 254);
-    if (priv) found.add(`private address ${ip}`);
+    if (priv) { found.add(`private address ${ip}`); continue; }
+    const reserved = o[0] === 0 || o[0] >= 224
+      || (o[0] === 192 && o[1] === 0 && o[2] === 2)
+      || (o[0] === 198 && o[1] === 51 && o[2] === 100)
+      || (o[0] === 203 && o[1] === 0 && o[2] === 113);
+    if (!reserved) found.add(`public address ${ip}`);
   }
   return [...found];
 }
@@ -160,7 +186,11 @@ function survivors(text, cfg) {
 // every address it resolved to. A camera reached by bare address has no
 // hostname to strip -- treating the digits as a name would replace the address
 // with camera.local and lose the substitution that belongs to it.
-function config({ host, ips = [], maps = [] }) {
+//
+// `firmware` is the version the camera prints, "2.6.10.11-lite": its number is
+// a dotted quad, and exactly that one is left alone. Nothing else shaped like
+// an address is, whatever follows it.
+function config({ host, ips = [], maps = [], firmware = null }) {
   const looksNumeric = host ? /^\d{1,3}(\.\d{1,3}){3}$/.test(host) || host.includes(':') : false;
   const name = looksNumeric ? null : host;
   const dot = name ? name.indexOf('.') : -1;
@@ -185,11 +215,17 @@ function config({ host, ips = [], maps = [] }) {
     cameraIp: CAMERA_IP,
     cameraIp6: CAMERA_IP6,
     otherIp: OTHER_IP,
+    publicIp: PUBLIC_IP,
     otherIp6: OTHER_IP6,
     mac: MAC,
-    keep: KEEP,
+    keep: [...KEEP, ...versionQuad(firmware)],
     v6: V6_PREFIXES.map((re) => [re.source, re.flags]),
   };
 }
 
+function versionQuad(firmware) {
+  const m = /^(\d{1,3}(?:\.\d{1,3}){3})(?:-|$)/.exec(firmware || '');
+  return m ? [m[1]] : [];
+}
+
 module.exports = { redactInPage, readInPage, survivors, config };
diff --git a/tools/webui-gallery/scene/CREDIT.md b/tools/webui-gallery/scene/CREDIT.md
index 1cc374d7..1da1fccb 100644
--- a/tools/webui-gallery/scene/CREDIT.md
+++ b/tools/webui-gallery/scene/CREDIT.md
@@ -9,7 +9,8 @@ reporting a saturation bug on SSC337DE, and reused here with their permission
 It is 2400x1440 straight off the camera's `image.jpg`, with no OSD. The gallery
 crops it to the player's aspect at capture time; nothing is edited into it.
 
-It replaces the picture in the two pages that show a live player, because the
+It replaces the picture on every page that shows the camera's own -- the
+players, the dashboard's snapshot tile, the recordings player -- because the
 lab camera the gallery is shot from faces an unlit bench of cables that
 photographs as a dark smear.
 
@@ -28,3 +29,17 @@ Two things have to move with the file:
 
 If you photograph a camera whose view needs no substitution, pass
 `--scene none` and drop the credit paragraph from the view.
+
+## The street: street.jpg and street.json
+
+The street on the staged motion detection screen is frame 120 of the recording
+behind the tracking video on /web-interface (`frontend/apps/site/public/video`),
+a high-angle view of a public street. The boxes burned into that recording were
+inpainted out, and every person's head is pixelated; nothing else is edited.
+`street.json` holds the three people's boxes in that frame, from the reference
+tracks the video was made with.
+
+Both the picture and the video show passers-by. If either is ever replaced,
+pixelate every face in every frame before it is committed, and look at the
+frames: the tracks that place the pixelation lose people behind trees exactly
+where their faces still show.
diff --git a/tools/webui-gallery/scene/street.jpg b/tools/webui-gallery/scene/street.jpg
new file mode 100644
index 00000000..d0c9b3cd
Binary files /dev/null and b/tools/webui-gallery/scene/street.jpg differ
diff --git a/tools/webui-gallery/scene/street.json b/tools/webui-gallery/scene/street.json
new file mode 100644
index 00000000..74993b56
--- /dev/null
+++ b/tools/webui-gallery/scene/street.json
@@ -0,0 +1 @@
+{"w": 1920, "h": 1080, "boxes": [[253, 286, 96, 248], [231, 58, 99, 236], [716, 825, 97, 253]]}
\ No newline at end of file
diff --git a/tools/webui-gallery/selftest.js b/tools/webui-gallery/selftest.js
index 738c76d8..97666ea3 100644
--- a/tools/webui-gallery/selftest.js
+++ b/tools/webui-gallery/selftest.js
@@ -57,6 +57,16 @@ check('a hyphenated MAC', survivors('2c-6f-51-aa-bb-cc', lab), ['MAC 2c-6f-51-aa
 check('a link-local IPv6', survivors('fe80::1c2d:3e4f', lab), ['IPv6 fe80::1c2d:3e4f']);
 check('a unique-local IPv6', survivors('fd12:3456::9', lab), ['IPv6 fd12:3456::9']);
 
+// Public addresses: WebRTC logs the lab's own reflexive address and every
+// viewer's remote candidate. The firmware version is not one of them.
+check('a public address', survivors('reflexive address is 77.37.200.136:38227', lab), ['public address 77.37.200.136']);
+check('the stand-in public address', survivors('remote 203.0.113.10:4000', lab), []);
+const fw = config({ host: 'cam1.lab.example.com', ips: ['10.1.2.3'], firmware: '2.6.10.11-lite' });
+check('the firmware version', survivors('hi3516av300-imx415, 2.6.10.11-lite', fw), []);
+check('only that version', survivors('relay 8.8.8.8-relay', fw), ['public address 8.8.8.8']);
+check('no version read, none kept', survivors('2.6.10.11-lite', lab), ['public address 2.6.10.11']);
+check('multicast is nobody', survivors('mdns 224.0.0.251', lab), []);
+
 // A name that merely ends with the domain is a different site.
 check('a lookalike domain', survivors('notlab.example.com.evil.test', lab), []);
 
diff --git a/tools/webui-gallery/session.js b/tools/webui-gallery/session.js
index 8860ecc1..540d9d61 100644
--- a/tools/webui-gallery/session.js
+++ b/tools/webui-gallery/session.js
@@ -51,7 +51,9 @@ async function connect({ base, user, pass }) {
     await page.fill('#username', user);
     await page.fill('#password', pass);
     await page.click('#submit');
-    await page.waitForURL(/status\.cgi/, { timeout: 20000 });
+    // Wherever the WebUI chooses to land -- it has been status.cgi and is now
+    // live.cgi -- so long as it is no longer the sign-in form.
+    await page.waitForURL((u) => !u.pathname.endsWith('/login.html'), { timeout: 20000 });
     return page;
   };
 
@@ -66,10 +68,14 @@ async function connect({ base, user, pass }) {
   // reports twelve successes, the redaction check passes because a login form
   // has nothing to hide, and a gallery of sign-in forms gets installed. So:
   // never accept a page that is not the page that was asked for.
-  const open = async (cgi, settle) => {
+  //
+  // `prepare`, if given, runs on the new page before it is navigated: routes
+  // have to be in place before the page opens the connections they answer.
+  const open = async (cgi, settle, prepare) => {
     const want = new URL(`/cgi-bin/${cgi}`, base).pathname;
     const page = await ctx.newPage();
     try {
+      if (prepare) await prepare(page);
       let response = await goto(page, at(`/cgi-bin/${cgi}`));
       if (new URL(page.url()).pathname !== want) {
         const fresh = await signIn();
@@ -93,7 +99,23 @@ async function connect({ base, user, pass }) {
   };
 
   const home = await signIn();
-  return { ctx, home, open, close: () => browser.close() };
+
+  // The firmware version as the camera prints it -- "2.6.10.11-lite" -- read
+  // off the dashboard's own markup. Its number is a dotted quad, so redact.js
+  // has to be told which one it is: a rule for "anything that looks like a
+  // version" would also wave through an address that happened to be followed
+  // by a word. Null when it cannot be read, which costs only a version shown
+  // as the documentation address.
+  const firmware = async () => {
+    try {
+      const html = await (await home.request.get(at('/cgi-bin/dashboard.cgi'))).text();
+      const m = html.match(/<dt>Firmware<\/dt>\s*<dd>([^<]+)<\/dd>/);
+      return m ? m[1].trim() : null;
+    } catch {
+      return null;
+    }
+  };
+  return { ctx, home, open, firmware, close: () => browser.close() };
 }
 
 async function settled(page, settle) {
diff --git a/tools/webui-gallery/shoot.js b/tools/webui-gallery/shoot.js
index c6070e2e..000df468 100644
--- a/tools/webui-gallery/shoot.js
+++ b/tools/webui-gallery/shoot.js
@@ -38,7 +38,7 @@ function split(v) {
   return (v || '').split(',').map((s) => s.trim()).filter(Boolean);
 }
 
-// Cover each playing <video> with a still picture.
+// Cover each player with a still picture.
 //
 // Whatever the camera is aimed at ends up on the public site, and a lens
 // pointed at a dark bench photographs as a smear that reads as a broken image
@@ -46,16 +46,28 @@ function split(v) {
 // so a player that draws its own border and corner radius still frames the
 // picture, and object-fit:cover crops the scene the way real video fills the
 // element -- nothing is letterboxed or stretched.
+//
+// A player is any <video>, and the WebUI's own preview media: the preview
+// ladder switches between WebRTC or MSE in a <video>, a software decoder
+// drawing on a <canvas> and an MJPEG <img>, all marked .mj-pv-media. Covering
+// only <video> would publish the camera's view the day a page fell back to
+// the canvas.
+//
+// The picture goes in as the player's next sibling, positioned inside the
+// same container, rather than on top of the whole page: what the page draws
+// over its player -- detection boxes, the region editor, the control bar --
+// comes later in the DOM and still draws over the scene, as it would over
+// video.
 async function substituteScene(page, uri) {
-  return page.evaluate(async (src) => {
+  return page.evaluate(async ([src, sel]) => {
     const px = (s) => parseFloat(s) || 0;
-    const videos = [...document.querySelectorAll('video')].filter((v) => {
+    const players = [...document.querySelectorAll(sel)].filter((v) => {
       const r = v.getBoundingClientRect();
-      return r.width > 80 && r.height > 45;
+      const cs = getComputedStyle(v);
+      return r.width > 80 && r.height > 45 && cs.display !== 'none' && cs.visibility !== 'hidden';
     });
 
-    for (const v of videos) {
-      const r = v.getBoundingClientRect();
+    for (const v of players) {
       const cs = getComputedStyle(v);
       const bl = px(cs.borderLeftWidth), bt = px(cs.borderTopWidth);
       const brr = px(cs.borderRightWidth), bb = px(cs.borderBottomWidth);
@@ -67,19 +79,104 @@ async function substituteScene(page, uri) {
       img.alt = '';
       img.src = src;
       img.style.cssText = [
-        'position:fixed',
-        `left:${r.left + bl}px`, `top:${r.top + bt}px`,
-        `width:${r.width - bl - brr}px`, `height:${r.height - bt - bb}px`,
+        'position:absolute', 'left:0', 'top:0', 'margin:0', 'max-width:none',
+        `width:${v.offsetWidth - bl - brr}px`, `height:${v.offsetHeight - bt - bb}px`,
         'object-fit:cover', `border-radius:${radius}`,
-        'z-index:2147483000', 'pointer-events:none',
+        // Level with the player, so being its next sibling puts the scene
+        // above it and below whatever the page stacks over both.
+        `z-index:${cs.zIndex}`, 'pointer-events:none',
       ].join(';');
-      document.body.appendChild(img);
+      img.dataset.galleryCover = '1';
+      v.after(img);
+      v.dataset.galleryScene = '1';
+      // Placed by measurement after insertion rather than from offsetLeft:
+      // the picture starts at its containing block's corner, and is moved by
+      // however far that corner is from the player's content box.
+      const want = v.getBoundingClientRect();
+      const got = img.getBoundingClientRect();
+      img.style.left = `${want.left + bl - got.left}px`;
+      img.style.top = `${want.top + bt - got.top}px`;
       await img.decode();
     }
-    return videos.length;
-  }, uri);
+    return players.length;
+  }, [uri, PICTURES]);
+}
+
+// What on a WebUI page is a picture from the camera: the players' media, the
+// dashboard's snapshot tile (an <img> fed by polling /image.jpg through a blob
+// URL), and any image whose source is one of the camera's picture endpoints.
+// The manifest's scene flag is not trusted to know which pages have one --
+// the dashboard photographed the lab's room once because it did not say so.
+const PICTURES = [
+  'video', '.mj-pv-media', '.mj-stage-media', '.mj-still-media', '#st-prev-img',
+  'img[src^="blob:"]', 'img[src*="image.jpg"]', 'img[src*="mjpeg"]', 'img[src*="image.dng"]',
+].join(', ');
+
+// Any picture left on the page that the scene did not cover: every visible
+// <img>, <video> or player canvas of any size, except the WebUI's own
+// artwork. Asked as "is anything still showing?", like the redaction check,
+// so a player the list above does not know fails the run instead of being
+// photographed.
+async function uncoveredPictures(page) {
+  return page.evaluate((sel) => [...document.querySelectorAll(`img, video, ${sel}`)]
+    .filter((e) => {
+      if (e.dataset.galleryScene || e.dataset.galleryCover) return false;
+      const r = e.getBoundingClientRect();
+      const cs = getComputedStyle(e);
+      if (r.width <= 80 || r.height <= 45 || cs.display === 'none' || cs.visibility === 'hidden') return false;
+      if (e.tagName === 'IMG') {
+        const u = new URL(e.currentSrc || e.src, location.href);
+        if (u.protocol === 'data:' && u.href.startsWith('data:image/svg')) return false;
+        if (u.origin === location.origin && u.pathname.startsWith('/a/')) return false;
+      }
+      return true;
+    })
+    .map((e) => `${e.tagName.toLowerCase()}${e.id ? '#' + e.id : ''}`), PICTURES);
 }
 
+// Answer the page's /ws/analytics with a fixture instead of the camera.
+//
+// The lab camera's firmware has no object detector and its view is replaced
+// anyway, so the boxes it could report would sit over nothing in the scene.
+// A screen that shows detection is therefore staged, and the manifest says so
+// by naming the fixture: the boxes of the people in that screen's scene, in
+// the scene's own pixels, sent the way the camera sends them -- source
+// `object`, class 1 (human) -- and drawn by the WebUI's own overlay. The page
+// that publishes the screenshot says it is staged.
+//
+// The overlay places a box in main-stream pixels, through the stream geometry
+// the camera reports at /api/v1/osd, whatever frame size the event names. So
+// the fixture, written in the scene's pixels, is scaled to that frame here.
+function analyticsFixture(file) {
+  const fx = JSON.parse(fs.readFileSync(file, 'utf8'));
+  return async (page) => {
+    let frame = [fx.w, fx.h];
+    try {
+      const osd = await (await page.request.get(new URL('/api/v1/osd', BASE).href)).json();
+      if (Array.isArray(osd.group) && osd.group[0] > 0 && osd.group[1] > 0) frame = osd.group;
+    } catch { /* the scene's own pixels, then */ }
+    const sx = frame[0] / fx.w, sy = frame[1] / fx.h;
+    const event = JSON.stringify({
+      src: 'object', active: true, w: frame[0], h: frame[1],
+      r: fx.boxes.map(([x, y, w, h]) =>
+        [Math.round(x * sx), Math.round(y * sy), Math.round(w * sx), Math.round(h * sy), 1, 80]),
+    });
+    await page.routeWebSocket(/\/ws\/analytics$/, (ws) => {
+      const timer = setInterval(() => ws.send(event), 200);
+      // Closing the page does not close a routed socket, and a live interval
+      // keeps node from ever exiting: stop on whichever comes first.
+      ws.onClose(() => clearInterval(timer));
+      page.once('close', () => clearInterval(timer));
+    });
+  };
+}
+
+// Notices about this particular camera rather than about the WebUI: the
+// banner a camera raises on every page after it recovered from a crash. The
+// lab camera has one, kept for the maintainers to read, and a gallery of the
+// interface is not the place to show it.
+const CAMERA_NOTICES = '.container:has(> .alert a[href="crashlog.cgi"]) { display: none !important; }';
+
 // Which pages the camera offers that the manifest does not mention. Not a
 // failure -- the gallery is a selection, not an inventory -- but it is the
 // signal that the WebUI grew a page worth adding, which is the whole reason
@@ -110,11 +207,9 @@ async function unlisted(page, listed) {
   // Every family, not the first answer: a camera on both stacks renders its
   // IPv6 address on the network page even when this tool reached it over v4.
   const resolved = await dns.lookup(host, { all: true }).catch(() => []);
-  const cfg = config({ host, ips: resolved.map((r) => r.address), maps: MAPS });
-  console.log(`camera ${host}${cfg.ips.length ? ` (${cfg.ips.join(', ')})` : ''}`
-    + ` -> ${cfg.hostname} / ${cfg.cameraIp}, ${MAPS.length} extra substitution(s)`);
 
-  const sceneUri = SCENE ? `data:image/jpeg;base64,${fs.readFileSync(SCENE).toString('base64')}` : null;
+  const dataUri = (file) => `data:image/jpeg;base64,${fs.readFileSync(file).toString('base64')}`;
+  const sceneUri = SCENE ? dataUri(SCENE) : null;
   if (sceneUri) {
     console.log(`scene: ${SCENE}`);
   } else if (screens.some((s) => s.scene)) {
@@ -123,27 +218,41 @@ async function unlisted(page, listed) {
       + '\n!! look at those captures before committing them.\n');
   }
 
-  const { home, open, close } = await connect({ base: BASE, user: USER, pass: PASS });
+  const { home, open, firmware, close } = await connect({ base: BASE, user: USER, pass: PASS });
   console.log(`signed in as ${USER}, landed on "${await home.title()}"`);
+  const fw = await firmware();
+  const cfg = config({ host, ips: resolved.map((r) => r.address), maps: MAPS, firmware: fw });
+  console.log(`camera ${host}${cfg.ips.length ? ` (${cfg.ips.join(', ')})` : ''}`
+    + ` -> ${cfg.hostname} / ${cfg.cameraIp}, ${MAPS.length} extra substitution(s),`
+    + ` firmware ${fw || 'unread'}`);
   const extra = await unlisted(home, all.map((s) => s.cgi));
   await home.close();
 
   fs.mkdirSync(OUT, { recursive: true });
   let failed = 0;
-  for (const { slug, cgi, settle, scene: needsScene } of screens) {
+  for (const { slug, cgi, settle, scene, analytics } of screens) {
     let page;
     try {
-      page = await open(cgi, settle);
+      // `scene: true` takes the run's scene; a file name takes that picture
+      // from scene/ for this screen alone, whatever --scene said -- a staged
+      // screen's fixture is drawn against one particular picture.
+      const needsScene = Boolean(scene);
+      const uri = typeof scene === 'string' ? dataUri(path.join(__dirname, 'scene', scene)) : sceneUri;
+      const prepare = analytics ? analyticsFixture(path.join(__dirname, 'scene', analytics)) : null;
+      page = await open(cgi, settle, prepare);
+      await page.addStyleTag({ content: CAMERA_NOTICES });
       const hits = await page.evaluate(redactInPage, cfg);
-      const covered = sceneUri ? await substituteScene(page, sceneUri) : 0;
+      const covered = uri ? await substituteScene(page, uri) : 0;
 
       // The manifest says this page shows live video. If the overlay found no
       // player, the WebUI has changed shape and the picture about to be taken
       // is the camera's own view -- which is the one outcome a scene exists to
       // prevent, and it would otherwise be installed without a word.
-      if (needsScene && sceneUri && covered === 0) {
+      if (needsScene && uri && covered === 0) {
         throw new Error('no live player found to cover -- the page has changed shape');
       }
+      // Give the overlay's repaint timer a turn to draw over the scene.
+      if (covered) await page.waitForTimeout(600);
 
       // Checked here, against the very page that is about to be photographed,
       // rather than only on the second pass in verify.js: a page reloaded a
@@ -151,6 +260,12 @@ async function unlisted(page, listed) {
       const left = survivors(await page.evaluate(readInPage), cfg);
       if (left.length) throw new Error(`would publish ${left.join('; ')}`);
 
+      // Last, immediately before the shutter: a snapshot tile that only
+      // became visible after the scene went down is still the camera's view.
+      if (uri) {
+        const bare = await uncoveredPictures(page);
+        if (bare.length) throw new Error(`camera picture left uncovered: ${bare.join(', ')}`);
+      }
       await page.screenshot({ path: path.join(OUT, `${slug}.png`) });
       console.log(`ok   ${slug.padEnd(24)} ${cgi.padEnd(22)} "${await page.title()}"`
         + ` (${hits} redacted, ${covered} scene)`);
diff --git a/tools/webui-gallery/verify.js b/tools/webui-gallery/verify.js
index 6c20e8c2..8758733c 100644
--- a/tools/webui-gallery/verify.js
+++ b/tools/webui-gallery/verify.js
@@ -38,9 +38,8 @@ const MAPS = (process.env.MAPS || '').split(',').filter(Boolean).map((m) => {
   // without them, so strip them or the substitution never matches.
   const host = new URL(BASE).hostname.replace(/^\[|\]$/g, '');
   const resolved = await dns.lookup(host, { all: true }).catch(() => []);
-  const cfg = config({ host, ips: resolved.map((r) => r.address), maps: MAPS });
-
-  const { home, open, close } = await connect({ base: BASE, user: USER, pass: PASS });
+  const { home, open, firmware, close } = await connect({ base: BASE, user: USER, pass: PASS });
+  const cfg = config({ host, ips: resolved.map((r) => r.address), maps: MAPS, firmware: await firmware() });
   await home.close();
 
   let leaking = 0;