diff --git a/frontend/src/lib/components/PolicyList.svelte b/frontend/src/lib/components/PolicyList.svelte
new file mode 100644
index 00000000..1d7853ff
--- /dev/null
+++ b/frontend/src/lib/components/PolicyList.svelte
@@ -0,0 +1,145 @@
+<script lang="ts">
+	/**
+	 * Reusable list-of-policy-toggles.
+	 *
+	 * Consumed by:
+	 *   - Admin "Manage policies" modal — `readonly=false`, admin edits the
+	 *     bound `values` in place.
+	 *   - Drive settings page (`/config/drive/{uuid}`) — `readonly=true`,
+	 *     drive members read the currently-in-effect state.
+	 *
+	 * The shared `policyDefs` in `$lib/utils/drivePolicies` is the single
+	 * source of truth for label + help text + implied-by relations. Adding
+	 * a policy is one push there + one row in `DrivePolicies` in
+	 * `types.ts`; the two consuming surfaces update automatically.
+	 */
+	import type { DrivePoliciesPartial } from '$lib/api/types';
+	import { isPolicyImplied, policyDefs, type PolicyDef } from '$lib/utils/drivePolicies';
+
+	interface Props {
+		/** Current values displayed on each row. */
+		values: Required<DrivePoliciesPartial>;
+		/** `true` = display only, disables the checkboxes so members can see the
+		 *  live state without a mutation affordance. When `true`, `onchange`
+		 *  is ignored — the component never emits. */
+		readonly?: boolean;
+		/** Additional disable signal (used by the admin modal during save). */
+		busy?: boolean;
+		/** Prefix for the `data-testid` on each checkbox
+		 *  (e.g. `admin-policy-…` on the admin page, `drive-policy-…` on
+		 *  the config page). Keeps test selectors stable per surface. */
+		testIdPrefix?: string;
+		/** Fired when the user toggles a checkbox (mutable surface only).
+		 *  The parent owns the storage and applies the change. Not called
+		 *  in `readonly` mode. */
+		onchange?: (key: PolicyDef['key'], next: boolean) => void;
+	}
+
+	let {
+		values,
+		readonly = false,
+		busy = false,
+		testIdPrefix = 'policy',
+		onchange
+	}: Props = $props();
+</script>
+
+<ul class="policy-list">
+	{#each policyDefs as def (def.key)}
+		{@const implied = isPolicyImplied(def, values)}
+		<li class="policy-row" class:policy-row--implied={implied}>
+			<label class="policy-row__label">
+				<span class="policy-row__head">
+					<input
+						type="checkbox"
+						data-testid={`${testIdPrefix}-${def.key}`}
+						checked={values[def.key]}
+						disabled={readonly || busy || implied}
+						onchange={(e) => onchange?.(def.key, (e.currentTarget as HTMLInputElement).checked)}
+					/>
+					<span class="policy-row__title">{def.label()}</span>
+				</span>
+				<span class="policy-row__help muted">
+					{def.help()}
+					{#if implied && def.impliedHint}
+						<span class="policy-row__implied">{def.impliedHint()}</span>
+					{/if}
+				</span>
+			</label>
+		</li>
+	{/each}
+</ul>
+
+<style>
+	/* Ported from the admin modal's original block so the visual stays
+	   identical when the modal switches to this component; the read-only
+	   surface on `/config/drive/{uuid}` gets the same look for free. */
+	.policy-list {
+		list-style: none;
+		margin: 0;
+		padding: 0;
+		display: flex;
+		flex-direction: column;
+		gap: var(--space-2);
+	}
+
+	.policy-row {
+		padding: var(--space-2);
+		border: 1px solid var(--color-border);
+		border-radius: var(--radius-md);
+	}
+
+	.policy-row__label {
+		/* Column layout: head (checkbox + title inline) on top, help
+		   text underneath. The checkbox + title share a row via
+		   `.policy-row__head` so the title sits beside the checkbox
+		   instead of wrapping to its own line. */
+		display: flex;
+		flex-direction: column;
+		gap: var(--space-1);
+		cursor: pointer;
+		margin: 0;
+	}
+
+	.policy-row__head {
+		display: flex;
+		align-items: center;
+		gap: var(--space-2);
+		min-width: 0;
+	}
+
+	.policy-row__head input[type='checkbox'] {
+		margin: 0;
+		flex-shrink: 0;
+	}
+
+	.policy-row__title {
+		font-weight: 600;
+	}
+
+	.policy-row__help {
+		/* Indent the help text under the title so the relationship is
+		   visually obvious. Width = checkbox width + the head's gap. */
+		padding-left: calc(1rem + var(--space-2));
+	}
+
+	/* Implied state — the row's gate is already covered by a broader
+	   policy (e.g. forbid_public_links when forbid_sharing is on).
+	   Visually dimmed so the admin understands they don't need to
+	   toggle it; the stored value is preserved for the moment they
+	   relax the parent policy. Same treatment used on the read-only
+	   surface so subordinate rules read as visually secondary. */
+	.policy-row--implied {
+		opacity: 0.55;
+	}
+
+	.policy-row--implied .policy-row__label {
+		cursor: not-allowed;
+	}
+
+	.policy-row__implied {
+		display: block;
+		margin-top: var(--space-1);
+		font-style: italic;
+	}
+</style>
diff --git a/frontend/src/lib/utils/drivePolicies.ts b/frontend/src/lib/utils/drivePolicies.ts
new file mode 100644
index 00000000..c0c03c7a
--- /dev/null
+++ b/frontend/src/lib/utils/drivePolicies.ts
@@ -0,0 +1,148 @@
+/**
+ * Shared drive-policy definitions.
+ *
+ * Consumed by two surfaces:
+ *   - Admin "Manage policies" modal (`routes/admin/+page.svelte`) — read+write.
+ *   - Drive settings page (`routes/config/drive/[uuid]/+page.svelte`) — read-only,
+ *     so drive members can see which policies an admin has set.
+ *
+ * Kept in a plain `.ts` module (not a component) so both consumers import the
+ * same array and the definition of "one policy" lives in exactly one place.
+ * Adding a sixth policy is a single push here + one migration + the
+ * `DrivePolicies` interface extension in `types.ts`. See
+ * `docs/plan/drive.md` §8 (forbid_* gates) + §15 (include_in_*_index scope).
+ */
+import { t } from '$lib/i18n/index.svelte';
+import type { DrivePoliciesPartial } from '$lib/api/types';
+
+/**
+ * `impliedBy` captures the semantic dependency between policies: when the
+ * named parent policy is on, this subordinate gate is moot (its enforcement
+ * is already covered by the broader rule). The admin modal disables the
+ * child toggle and shows `impliedHint` so the admin understands the
+ * hierarchy without our having to mutate the stored value — their
+ * preference is preserved for the moment they relax the parent. The
+ * read-only config surface uses the same signal to dim implied rows.
+ */
+export interface PolicyDef {
+	key: keyof Required<DrivePoliciesPartial>;
+	label: () => string;
+	help: () => string;
+	impliedBy?: keyof Required<DrivePoliciesPartial>;
+	impliedHint?: () => string;
+}
+
+/**
+ * Mirrors the entity field order in `src/domain/entities/drive.rs` so a
+ * future policy lands here as one literal-array push.
+ */
+export const policyDefs: PolicyDef[] = [
+	{
+		key: 'forbid_sharing',
+		label: () => t('admin.drive_policy.forbid_sharing', 'Forbid per-resource sharing'),
+		help: () =>
+			t(
+				'admin.drive_policy.forbid_sharing_help',
+				'Block per-file / per-folder grants (covers public links and external sharing as well). Drive-level membership still works.'
+			)
+	},
+	{
+		key: 'forbid_public_links',
+		label: () => t('admin.drive_policy.forbid_public_links', 'Forbid public links'),
+		help: () =>
+			t(
+				'admin.drive_policy.forbid_public_links_help',
+				'Block anonymous share links on resources in this drive.'
+			),
+		impliedBy: 'forbid_sharing',
+		impliedHint: () =>
+			t(
+				'admin.drive_policy.implied_by_forbid_sharing',
+				'Already enforced by Forbid per-resource sharing.'
+			)
+	},
+	{
+		key: 'forbid_external_sharing',
+		label: () => t('admin.drive_policy.forbid_external_sharing', 'Forbid external sharing'),
+		help: () =>
+			t(
+				'admin.drive_policy.forbid_external_sharing_help',
+				'Block grants to external users (email invitations and pre-existing external accounts).'
+			),
+		impliedBy: 'forbid_sharing',
+		impliedHint: () =>
+			t(
+				'admin.drive_policy.implied_by_forbid_sharing',
+				'Already enforced by Forbid per-resource sharing.'
+			)
+	},
+	{
+		key: 'forbid_cross_drive_move',
+		label: () => t('admin.drive_policy.forbid_cross_drive_move', 'Forbid cross-drive move'),
+		help: () =>
+			t(
+				'admin.drive_policy.forbid_cross_drive_move_help',
+				'Block moving files or folders out to another drive. Does not stop download + re-upload.'
+			)
+	},
+	{
+		key: 'forbid_owner_role_change',
+		label: () => t('admin.drive_policy.forbid_owner_role_change', 'Lock Owner roster'),
+		help: () =>
+			t(
+				'admin.drive_policy.forbid_owner_role_change_help',
+				'Only admin can add, remove, or demote drive Owners while this is on.'
+			)
+	},
+	{
+		key: 'include_in_photo_index',
+		label: () => t('admin.drive_policy.include_in_photo_index', 'Include in Photos'),
+		help: () =>
+			t(
+				'admin.drive_policy.include_in_photo_index_help',
+				'Show image and video files from this drive in the Photos timeline and on the Places map. Default personal drives are opted in automatically; turn on for shared drives that genuinely hold photos (e.g. "Family Photos").'
+			)
+	},
+	{
+		key: 'include_in_music_index',
+		label: () => t('admin.drive_policy.include_in_music_index', 'Include in Music'),
+		help: () =>
+			t(
+				'admin.drive_policy.include_in_music_index_help',
+				'Include audio files from this drive in the Music library. Default personal drives are opted in automatically; turn on for shared drives that genuinely hold a music collection (e.g. "Family Music", "Band Collaboration").'
+			)
+	}
+];
+
+/**
+ * True when `def` is subordinate to another policy whose value is currently
+ * `true` in `values`. Both surfaces use this to gray out implied rows.
+ */
+export function isPolicyImplied(def: PolicyDef, values: Required<DrivePoliciesPartial>): boolean {
+	return def.impliedBy != null && values[def.impliedBy];
+}
+
+/**
+ * JSONB reader — the backend may hold a raw `Record<string, unknown>` bag
+ * (unknown keys preserved verbatim), so any missing / non-bool key resolves
+ * to `false`. Shared between the admin modal (initialising the edit draft)
+ * and the config/drive page (reading the current state for display).
+ */
+export function readPolicyBool(p: Record<string, unknown>, key: string): boolean {
+	const v = p[key];
+	return typeof v === 'boolean' ? v : false;
+}
+
+/**
+ * Populate a full `Required<DrivePoliciesPartial>` from the JSONB bag by
+ * reading each known key with `readPolicyBool`. Both admin and config
+ * surfaces call this on load; the admin edits the returned object in
+ * place while the config surface renders it read-only.
+ */
+export function readAllPolicies(p: Record<string, unknown>): Required<DrivePoliciesPartial> {
+	const out = {} as Required<DrivePoliciesPartial>;
+	for (const def of policyDefs) {
+		out[def.key] = readPolicyBool(p, def.key);
+	}
+	return out;
+}
diff --git a/frontend/src/routes/admin/+page.svelte b/frontend/src/routes/admin/+page.svelte
index 62ef4263..7e667e70 100644
--- a/frontend/src/routes/admin/+page.svelte
+++ b/frontend/src/routes/admin/+page.svelte
@@ -69,8 +69,10 @@
 	import Icon from '$lib/icons/Icon.svelte';
 	import Modal from '$lib/components/Modal.svelte';
 	import OwnerAvatarStack from '$lib/components/OwnerAvatarStack.svelte';
+	import PolicyList from '$lib/components/PolicyList.svelte';
 	import UserVignette from '$lib/components/UserVignette.svelte';
 	import { t } from '$lib/i18n/index.svelte';
+	import { readPolicyBool } from '$lib/utils/drivePolicies';
 	import { session } from '$lib/stores/session.svelte';
 	import { drives as drivesStore } from '$lib/stores/drives.svelte';
 	import { ui } from '$lib/stores/ui.svelte';
@@ -1091,14 +1093,6 @@
 	let managePoliciesError = $state<string | null>(null);
 	let managePoliciesBusy = $state(false);
 
-	function readPolicyBool(p: Record<string, unknown>, key: string): boolean {
-		// JSONB returns unknown keys verbatim; default missing/non-bool to
-		// `false` so a freshly-created drive (empty `{}` bag) shows every
-		// toggle off without ad-hoc nullish handling per row.
-		const v = p[key];
-		return typeof v === 'boolean' ? v : false;
-	}
-
 	function openManagePolicies(d: Drive) {
 		managePoliciesDrive = d;
 		managePoliciesError = null;
@@ -1142,105 +1136,10 @@
 		}
 	}
 
-	// Policy keys + labels for the toggle list. Mirrors the entity field
-	// order in `src/domain/entities/drive.rs` so a future 6th policy lands
-	// here as one literal-array push.
-	//
-	// `impliedBy` captures the semantic dependency between policies: when
-	// the named parent policy is on, this subordinate gate is moot
-	// (its enforcement is already covered by the broader rule). The UI
-	// disables the toggle and shows a hint so the admin understands the
-	// hierarchy without our having to actually mutate the stored value —
-	// their preference is preserved for the moment they relax the parent.
-	const policyDefs: Array<{
-		key: keyof Required<DrivePoliciesPartial>;
-		label: () => string;
-		help: () => string;
-		impliedBy?: keyof Required<DrivePoliciesPartial>;
-		impliedHint?: () => string;
-	}> = [
-		{
-			key: 'forbid_sharing',
-			label: () => t('admin.drive_policy.forbid_sharing', 'Forbid per-resource sharing'),
-			help: () =>
-				t(
-					'admin.drive_policy.forbid_sharing_help',
-					'Block per-file / per-folder grants (covers public links and external sharing as well). Drive-level membership still works.'
-				)
-		},
-		{
-			key: 'forbid_public_links',
-			label: () => t('admin.drive_policy.forbid_public_links', 'Forbid public links'),
-			help: () =>
-				t(
-					'admin.drive_policy.forbid_public_links_help',
-					'Block anonymous share links on resources in this drive.'
-				),
-			impliedBy: 'forbid_sharing',
-			impliedHint: () =>
-				t(
-					'admin.drive_policy.implied_by_forbid_sharing',
-					'Already enforced by Forbid per-resource sharing.'
-				)
-		},
-		{
-			key: 'forbid_external_sharing',
-			label: () => t('admin.drive_policy.forbid_external_sharing', 'Forbid external sharing'),
-			help: () =>
-				t(
-					'admin.drive_policy.forbid_external_sharing_help',
-					'Block grants to external users (email invitations and pre-existing external accounts).'
-				),
-			impliedBy: 'forbid_sharing',
-			impliedHint: () =>
-				t(
-					'admin.drive_policy.implied_by_forbid_sharing',
-					'Already enforced by Forbid per-resource sharing.'
-				)
-		},
-		{
-			key: 'forbid_cross_drive_move',
-			label: () => t('admin.drive_policy.forbid_cross_drive_move', 'Forbid cross-drive move'),
-			help: () =>
-				t(
-					'admin.drive_policy.forbid_cross_drive_move_help',
-					'Block moving files or folders out to another drive. Does not stop download + re-upload.'
-				)
-		},
-		{
-			key: 'forbid_owner_role_change',
-			label: () => t('admin.drive_policy.forbid_owner_role_change', 'Lock Owner roster'),
-			help: () =>
-				t(
-					'admin.drive_policy.forbid_owner_role_change_help',
-					'Only admin can add, remove, or demote drive Owners while this is on.'
-				)
-		},
-		{
-			key: 'include_in_photo_index',
-			label: () => t('admin.drive_policy.include_in_photo_index', 'Include in Photos'),
-			help: () =>
-				t(
-					'admin.drive_policy.include_in_photo_index_help',
-					'Show image and video files from this drive in the Photos timeline and on the Places map. Default personal drives are opted in automatically; turn on for shared drives that genuinely hold photos (e.g. "Family Photos").'
-				)
-		},
-		{
-			key: 'include_in_music_index',
-			label: () => t('admin.drive_policy.include_in_music_index', 'Include in Music'),
-			help: () =>
-				t(
-					'admin.drive_policy.include_in_music_index_help',
-					'Include audio files from this drive in the Music library. Default personal drives are opted in automatically; turn on for shared drives that genuinely hold a music collection (e.g. "Family Music", "Band Collaboration").'
-				)
-		}
-	];
-
-	// Reactive helper for the template: is this policy currently
-	// disabled because its parent policy implies it?
-	function isPolicyImplied(def: (typeof policyDefs)[number]): boolean {
-		return def.impliedBy !== undefined && managePoliciesDraft[def.impliedBy];
-	}
+	// Policy definitions live in `$lib/utils/drivePolicies` so the same
+	// list drives the admin "Manage policies" modal AND the read-only
+	// summary on `/config/drive/{uuid}`. Adding a policy is one literal-
+	// array push there + one field in `DrivePolicies` in `types.ts`.
 
 	// Admin-driven delete-drive flow (D3b). Guarded by the confirm modal
 	// because the action is destructive and irreversible. The backend
@@ -2869,30 +2768,14 @@
 					'Policies are admin-only — drive owners cannot mutate them. Each toggle controls one enforcement gate.'
 				)}
 			</p>
-			<ul class="policy-list">
-				{#each policyDefs as def (def.key)}
-					{@const implied = isPolicyImplied(def)}
-					<li class="policy-row" class:policy-row--implied={implied}>
-						<label class="policy-row__label">
-							<span class="policy-row__head">
-								<input
-									type="checkbox"
-									data-testid={`admin-policy-${def.key}`}
-									bind:checked={managePoliciesDraft[def.key]}
-									disabled={managePoliciesBusy || implied}
-								/>
-								<span class="policy-row__title">{def.label()}</span>
-							</span>
-							<span class="policy-row__help muted">
-								{def.help()}
-								{#if implied && def.impliedHint}
-									<span class="policy-row__implied">{def.impliedHint()}</span>
-								{/if}
-							</span>
-						</label>
-					</li>
-				{/each}
-			</ul>
+			<PolicyList
+				values={managePoliciesDraft}
+				busy={managePoliciesBusy}
+				testIdPrefix="admin-policy"
+				onchange={(key, next) => {
+					managePoliciesDraft[key] = next;
+				}}
+			/>
 			{#if managePoliciesError}
 				<p class="status--error">{managePoliciesError}</p>
 			{/if}
@@ -3904,76 +3787,10 @@
 		white-space: nowrap;
 	}
 
-	/* D5 policy editor (admin-only). Same row shape as `.owners-list__row`
-	   so the modal feels consistent; the label inside is a flex row so the
-	   checkbox sits beside the text instead of stacking vertically. */
-	.policy-list {
-		list-style: none;
-		margin: 0;
-		padding: 0;
-		display: flex;
-		flex-direction: column;
-		gap: var(--space-2);
-	}
-
-	.policy-row {
-		padding: var(--space-2);
-		border: 1px solid var(--color-border);
-		border-radius: var(--radius-md);
-	}
-
-	.policy-row__label {
-		/* Column layout: head (checkbox + title inline) on top, help
-		   text underneath. The checkbox + title share a row via
-		   `.policy-row__head` so the title sits beside the checkbox
-		   instead of wrapping to its own line. */
-		display: flex;
-		flex-direction: column;
-		gap: var(--space-1);
-		cursor: pointer;
-		margin: 0;
-	}
-
-	.policy-row__head {
-		display: flex;
-		align-items: center;
-		gap: var(--space-2);
-		min-width: 0;
-	}
-
-	.policy-row__head input[type='checkbox'] {
-		margin: 0;
-		flex-shrink: 0;
-	}
-
-	.policy-row__title {
-		font-weight: 600;
-	}
-
-	.policy-row__help {
-		/* Indent the help text under the title so the relationship is
-		   visually obvious. Width = checkbox width + the head's gap. */
-		padding-left: calc(1rem + var(--space-2));
-	}
-
-	/* Implied state — the row's gate is already covered by a broader
-	   policy (e.g. forbid_public_links when forbid_sharing is on).
-	   Visually dimmed so the admin understands they don't need to
-	   toggle it; the stored value is preserved for the moment they
-	   relax the parent policy. */
-	.policy-row--implied {
-		opacity: 0.55;
-	}
-
-	.policy-row--implied .policy-row__label {
-		cursor: not-allowed;
-	}
-
-	.policy-row__implied {
-		display: block;
-		margin-top: var(--space-1);
-		font-style: italic;
-	}
+	/* Policy list styles moved to `PolicyList.svelte`. The modal now
+	   embeds `<PolicyList bind:values={managePoliciesDraft} … />` and the
+	   read-only summary on `/config/drive/{uuid}` reuses the same
+	   component. */
 
 	/* Drives table action cell — same shape as `.actions` plus a fixed
 	   3-column grid so the [users] [policies] [delete] icons line up
diff --git a/frontend/src/routes/config/drive/[uuid]/+page.svelte b/frontend/src/routes/config/drive/[uuid]/+page.svelte
index 426e5ab8..88373d55 100644
--- a/frontend/src/routes/config/drive/[uuid]/+page.svelte
+++ b/frontend/src/routes/config/drive/[uuid]/+page.svelte
@@ -9,7 +9,8 @@
 	import { renameFolder } from '$lib/api/endpoints/folders';
 	import { errorToast } from '$lib/utils/errors';
 	import { ui } from '$lib/stores/ui.svelte';
-	import type { Drive, DriveMember, DriveRole } from '$lib/api/types';
+	import type { Drive, DriveMember, DriveRole, DrivePoliciesPartial } from '$lib/api/types';
+	import PolicyList from '$lib/components/PolicyList.svelte';
 	import ShareDialog from '$lib/components/ShareDialog.svelte';
 	import UserVignette from '$lib/components/UserVignette.svelte';
 	import Icon from '$lib/icons/Icon.svelte';
@@ -17,6 +18,7 @@
 	import { drives as drivesStore, driveIcon } from '$lib/stores/drives.svelte';
 	import { formatDate } from '$lib/utils/display';
 	import { formatBytes } from '$lib/utils/format';
+	import { readAllPolicies } from '$lib/utils/drivePolicies';
 
 	const uuid = $derived(page.params.uuid ?? '');
 	const drive = $derived<Drive | null>(drivesStore.findById(uuid));
@@ -179,10 +181,15 @@
 		return Math.min(100, (drive.used_bytes / drive.quota_bytes) * 100);
 	});
 
-	// Drive policies are OxiCloud-admin-only post-D5 — owners can no
-	// longer mutate them, so this page no longer surfaces them at all
-	// (the admin panel hosts the policy editor). See
-	// `docs/plan/drive.md` §8.
+	// Drive policies are OxiCloud-admin-only for mutation (§8), but
+	// visible read-only here so members understand what rules apply to
+	// the drive they're on. The admin's "Manage policies" modal on
+	// `/admin` is the only editor. `readAllPolicies` normalises the raw
+	// JSONB bag into a `Required<DrivePoliciesPartial>` — unknown keys
+	// (or missing ones) resolve to `false`.
+	const drivePoliciesView = $derived<Required<DrivePoliciesPartial>>(
+		readAllPolicies((drive?.policies ?? {}) as Record<string, unknown>)
+	);
 
 	onMount(() => {
 		void drivesStore.load();
@@ -386,6 +393,26 @@
 			{/if}
 		</div>
 
+		<!-- Policies card — read-only summary of the current drive rules.
+		     Content is dense (seven toggle rows), so the whole card folds
+		     into a native `<details>` disclosure. Closed by default; the
+		     admin-only mutation surface still lives on `/admin`. -->
+		<details class="card policies-card">
+			<summary class="policies-card__summary">
+				<h2><Icon name="shield-alt" /> {t('drive.policies', 'Policies')}</h2>
+				<span class="policies-card__caret" aria-hidden="true">
+					<Icon name="chevron-down" />
+				</span>
+			</summary>
+			<p class="muted">
+				{t(
+					'drive.policies_help',
+					"Rules an OxiCloud admin has set for this drive. Only admins can change them; you're seeing the current state."
+				)}
+			</p>
+			<PolicyList values={drivePoliciesView} readonly testIdPrefix="drive-policy" />
+		</details>
+
 		{#if canDelete}
 			<!-- Danger zone: drive delete (D3b). Only rendered for Owners on
 			     non-default drives. Backend enforces the empty-drive rule —
@@ -462,6 +489,49 @@
 		color: var(--color-text-heading);
 	}
 
+	/* Policies card is a `<details>` disclosure — the summary bar carries
+	   the h2 title on the left and a chevron on the right that rotates
+	   when the section opens. Native `<details>` handles the interaction
+	   (click / keyboard / accessible affordance) — no Svelte state
+	   needed. */
+	.policies-card__summary {
+		display: flex;
+		align-items: center;
+		justify-content: space-between;
+		gap: 1rem;
+		cursor: pointer;
+		list-style: none;
+	}
+
+	.policies-card__summary::-webkit-details-marker {
+		/* Chrome/Safari: hide the default triangle so our chevron is the
+		   only disclosure affordance. Firefox uses `list-style: none`
+		   above. */
+		display: none;
+	}
+
+	.policies-card__summary h2 {
+		margin: 0;
+	}
+
+	.policies-card__caret {
+		color: var(--color-text-muted);
+		transition: transform 150ms ease;
+	}
+
+	details[open] > .policies-card__summary .policies-card__caret {
+		transform: rotate(180deg);
+	}
+
+	/* When closed the summary is the entire card content, so we drop the
+	   card's default bottom padding. When open the help paragraph +
+	   policy list need breathing room from the summary — restore the
+	   spacing by nudging the first child. */
+	details.policies-card > .muted {
+		margin-top: 1rem;
+		margin-bottom: 0.75rem;
+	}
+
 	.info-grid {
 		display: grid;
 		grid-template-columns: max-content 1fr;
diff --git a/frontend/static/locales/ar.json b/frontend/static/locales/ar.json
index 21c71864..b52a50ec 100644
--- a/frontend/static/locales/ar.json
+++ b/frontend/static/locales/ar.json
@@ -821,6 +821,10 @@
       "forbid_cross_drive_move_help": "منع نقل الملفات أو المجلدات إلى سائق آخر. لا يمنع التنزيل ثم إعادة الرفع.",
       "forbid_owner_role_change": "قفل قائمة المالكين",
       "forbid_owner_role_change_help": "يمكن للمسؤول فقط إضافة أو إزالة أو خفض مالكي السائق عندما يكون هذا مفعّلاً.",
+      "include_in_photo_index": "تضمين في الصور",
+      "include_in_photo_index_help": "عرض ملفات الصور والفيديو من هذا Drive في الجدول الزمني للصور وعلى خريطة الأماكن. تُضمَّن Drives الشخصية الافتراضية تلقائيًا؛ فعِّل هذا الخيار مع Drives المشتركة التي تحتوي فعلاً على صور (مثل «صور العائلة»).",
+      "include_in_music_index": "تضمين في الموسيقى",
+      "include_in_music_index_help": "تضمين الملفات الصوتية من هذا Drive في مكتبة الموسيقى. تُضمَّن Drives الشخصية الافتراضية تلقائيًا؛ فعِّل هذا الخيار مع Drives المشتركة التي تحتوي فعلاً على مجموعة موسيقية (مثل «موسيقى العائلة»، «تعاون فرقة»).",
       "implied_by_forbid_sharing": "مُطبَّق بالفعل من قبل «منع المشاركة لكل مورد»."
     }
   },
diff --git a/frontend/static/locales/de.json b/frontend/static/locales/de.json
index 5c5dfdfd..a4c3d5d5 100644
--- a/frontend/static/locales/de.json
+++ b/frontend/static/locales/de.json
@@ -821,6 +821,10 @@
       "forbid_cross_drive_move_help": "Blockiert das Verschieben von Dateien oder Ordnern in einen anderen Drive. Verhindert kein Herunterladen + erneutes Hochladen.",
       "forbid_owner_role_change": "Eigentümerliste sperren",
       "forbid_owner_role_change_help": "Nur Administratoren können Drive-Eigentümer hinzufügen, entfernen oder zurückstufen, solange diese Regel aktiv ist.",
+      "include_in_photo_index": "In Fotos einschließen",
+      "include_in_photo_index_help": "Bilder und Videos aus diesem Drive im Fotos-Zeitstrahl und auf der Orte-Karte anzeigen. Standardmäßig persönliche Drives sind automatisch enthalten; für freigegebene Drives einschalten, die tatsächlich Fotos enthalten (z. B. „Familienfotos\").",
+      "include_in_music_index": "In Musik einschließen",
+      "include_in_music_index_help": "Audiodateien aus diesem Drive in die Musikbibliothek aufnehmen. Standardmäßig persönliche Drives sind automatisch enthalten; für freigegebene Drives einschalten, die tatsächlich eine Musiksammlung enthalten (z. B. „Familienmusik\", „Bandkooperation\").",
       "implied_by_forbid_sharing": "Bereits durch „Freigabe pro Ressource verbieten\" durchgesetzt."
     }
   },
diff --git a/frontend/static/locales/en.json b/frontend/static/locales/en.json
index c78463bb..0664206d 100644
--- a/frontend/static/locales/en.json
+++ b/frontend/static/locales/en.json
@@ -1106,6 +1106,10 @@
       "forbid_cross_drive_move_help": "Block moving files or folders out to another drive. Does not stop download + re-upload.",
       "forbid_owner_role_change": "Lock Owner roster",
       "forbid_owner_role_change_help": "Only admin can add, remove, or demote drive Owners while this is on.",
+      "include_in_photo_index": "Include in Photos",
+      "include_in_photo_index_help": "Show image and video files from this drive in the Photos timeline and on the Places map. Default personal drives are opted in automatically; turn on for shared drives that genuinely hold photos (e.g. \"Family Photos\").",
+      "include_in_music_index": "Include in Music",
+      "include_in_music_index_help": "Include audio files from this drive in the Music library. Default personal drives are opted in automatically; turn on for shared drives that genuinely hold a music collection (e.g. \"Family Music\", \"Band Collaboration\").",
       "implied_by_forbid_sharing": "Already enforced by Forbid per-resource sharing."
     }
   },
diff --git a/frontend/static/locales/es.json b/frontend/static/locales/es.json
index 3a6f8288..2d1c8bf3 100644
--- a/frontend/static/locales/es.json
+++ b/frontend/static/locales/es.json
@@ -836,6 +836,10 @@
       "forbid_cross_drive_move_help": "Bloquea mover archivos o carpetas a otro Drive. No impide descargar y volver a subir.",
       "forbid_owner_role_change": "Bloquear lista de propietarios",
       "forbid_owner_role_change_help": "Solo los administradores pueden añadir, retirar o degradar propietarios del Drive mientras esta política esté activa.",
+      "include_in_photo_index": "Incluir en Fotos",
+      "include_in_photo_index_help": "Muestra los archivos de imagen y vídeo de este Drive en la línea de tiempo de Fotos y en el mapa de Lugares. Los Drives personales predeterminados se incluyen automáticamente; activa esta opción en Drives compartidos que realmente contengan fotos (p. ej. «Fotos de familia»).",
+      "include_in_music_index": "Incluir en Música",
+      "include_in_music_index_help": "Incluir los archivos de audio de este Drive en la biblioteca de Música. Los Drives personales predeterminados se incluyen automáticamente; activa esta opción en Drives compartidos que realmente contengan una colección musical (p. ej. «Música de familia», «Colaboración de banda»).",
       "implied_by_forbid_sharing": "Ya aplicada por «Prohibir compartir por recurso»."
     }
   },
diff --git a/frontend/static/locales/fa.json b/frontend/static/locales/fa.json
index 0ce03a27..1c45505d 100644
--- a/frontend/static/locales/fa.json
+++ b/frontend/static/locales/fa.json
@@ -804,6 +804,10 @@
       "forbid_cross_drive_move_help": "انتقال پرونده‌ها یا پوشه‌ها به درایو دیگر را مسدود می‌کند. مانع از دانلود و آپلود مجدد نمی‌شود.",
       "forbid_owner_role_change": "قفل کردن فهرست مالکان",
       "forbid_owner_role_change_help": "تنها مدیر می‌تواند مالکان درایو را اضافه، حذف یا تنزل دهد در حالی که این فعال است.",
+      "include_in_photo_index": "گنجاندن در عکس‌ها",
+      "include_in_photo_index_help": "نمایش فایل‌های تصویری و ویدیویی این Drive در جدول زمانی عکس‌ها و نقشه مکان‌ها. Drive‌های شخصی پیش‌فرض به‌طور خودکار گنجانده می‌شوند؛ برای Drive‌های مشترکی که واقعاً حاوی عکس هستند (مانند «عکس‌های خانواده») فعال کنید.",
+      "include_in_music_index": "گنجاندن در موسیقی",
+      "include_in_music_index_help": "گنجاندن فایل‌های صوتی این Drive در کتابخانه موسیقی. Drive‌های شخصی پیش‌فرض به‌طور خودکار گنجانده می‌شوند؛ برای Drive‌های مشترکی که واقعاً حاوی مجموعه موسیقی هستند (مانند «موسیقی خانواده»، «همکاری گروه») فعال کنید.",
       "implied_by_forbid_sharing": "در حال حاضر توسط «ممنوعیت اشتراک‌گذاری به‌صورت منبع‌به‌منبع» اعمال می‌شود."
     }
   },
diff --git a/frontend/static/locales/fr.json b/frontend/static/locales/fr.json
index 6e0d7825..4f8e19d9 100644
--- a/frontend/static/locales/fr.json
+++ b/frontend/static/locales/fr.json
@@ -821,6 +821,10 @@
       "forbid_cross_drive_move_help": "Bloque le déplacement de fichiers ou de dossiers vers un autre Drive. N'empêche pas le téléchargement puis le ré-envoi.",
       "forbid_owner_role_change": "Verrouiller la liste des propriétaires",
       "forbid_owner_role_change_help": "Seul l'administrateur peut ajouter, retirer ou rétrograder les propriétaires du Drive tant que cette règle est active.",
+      "include_in_photo_index": "Inclure dans Photos",
+      "include_in_photo_index_help": "Afficher les images et vidéos de ce Drive dans le fil Photos et sur la carte Lieux. Les Drives personnels par défaut sont inclus automatiquement ; activez cette option pour les Drives partagés qui contiennent réellement des photos (par ex. « Photos famille »).",
+      "include_in_music_index": "Inclure dans Musique",
+      "include_in_music_index_help": "Inclure les fichiers audio de ce Drive dans la bibliothèque Musique. Les Drives personnels par défaut sont inclus automatiquement ; activez cette option pour les Drives partagés qui contiennent réellement une collection musicale (par ex. « Musique famille », « Collaboration groupe »).",
       "implied_by_forbid_sharing": "Déjà appliqué par « Interdire le partage par ressource »."
     }
   },
diff --git a/frontend/static/locales/hi.json b/frontend/static/locales/hi.json
index fb48140e..5b4b0a95 100644
--- a/frontend/static/locales/hi.json
+++ b/frontend/static/locales/hi.json
@@ -821,6 +821,10 @@
       "forbid_cross_drive_move_help": "फ़ाइलों या फ़ोल्डरों को दूसरे ड्राइव में स्थानांतरित करने को रोकता है। डाउनलोड + पुनः अपलोड को नहीं रोकता।",
       "forbid_owner_role_change": "स्वामी सूची लॉक करें",
       "forbid_owner_role_change_help": "यह सक्रिय रहने पर केवल व्यवस्थापक ड्राइव के स्वामियों को जोड़, हटा या पदावनत कर सकता है।",
+      "include_in_photo_index": "फ़ोटो में शामिल करें",
+      "include_in_photo_index_help": "इस Drive की छवि और वीडियो फ़ाइलों को फ़ोटो टाइमलाइन और स्थान मानचित्र पर दिखाएँ। डिफ़ॉल्ट व्यक्तिगत Drive स्वचालित रूप से शामिल हैं; उन साझा Drives के लिए चालू करें जिनमें वास्तव में फ़ोटो हैं (उदा. «पारिवारिक फ़ोटो»)।",
+      "include_in_music_index": "संगीत में शामिल करें",
+      "include_in_music_index_help": "इस Drive की ऑडियो फ़ाइलों को संगीत लाइब्रेरी में शामिल करें। डिफ़ॉल्ट व्यक्तिगत Drive स्वचालित रूप से शामिल हैं; उन साझा Drives के लिए चालू करें जिनमें वास्तव में संगीत संग्रह है (उदा. «पारिवारिक संगीत», «बैंड सहयोग»)।",
       "implied_by_forbid_sharing": "पहले से ही «प्रति-संसाधन साझाकरण निषेध» द्वारा लागू।"
     }
   },
diff --git a/frontend/static/locales/it.json b/frontend/static/locales/it.json
index 627a2ab5..b20cde82 100644
--- a/frontend/static/locales/it.json
+++ b/frontend/static/locales/it.json
@@ -821,6 +821,10 @@
       "forbid_cross_drive_move_help": "Blocca lo spostamento di file o cartelle verso un altro Drive. Non impedisce download + nuovo upload.",
       "forbid_owner_role_change": "Blocca elenco proprietari",
       "forbid_owner_role_change_help": "Solo l'amministratore può aggiungere, rimuovere o retrocedere i proprietari del Drive mentre questa regola è attiva.",
+      "include_in_photo_index": "Includi in Foto",
+      "include_in_photo_index_help": "Mostra i file di immagine e video di questo Drive nella timeline Foto e sulla mappa Luoghi. I Drive personali predefiniti sono inclusi automaticamente; attiva questa opzione per i Drive condivisi che contengono davvero foto (ad es. «Foto famiglia»).",
+      "include_in_music_index": "Includi in Musica",
+      "include_in_music_index_help": "Includi i file audio di questo Drive nella libreria Musica. I Drive personali predefiniti sono inclusi automaticamente; attiva questa opzione per i Drive condivisi che contengono davvero una raccolta musicale (ad es. «Musica famiglia», «Collaborazione band»).",
       "implied_by_forbid_sharing": "Già imposto da «Vieta condivisione per risorsa»."
     }
   },
diff --git a/frontend/static/locales/ja.json b/frontend/static/locales/ja.json
index ce788f39..7ace97a8 100644
--- a/frontend/static/locales/ja.json
+++ b/frontend/static/locales/ja.json
@@ -821,6 +821,10 @@
       "forbid_cross_drive_move_help": "別のドライブへのファイル・フォルダーの移動をブロックします。ダウンロード + 再アップロードは防げません。",
       "forbid_owner_role_change": "所有者リストをロック",
       "forbid_owner_role_change_help": "有効中は、管理者のみがドライブ所有者を追加・削除・降格できます。",
+      "include_in_photo_index": "写真に含める",
+      "include_in_photo_index_help": "この Drive の画像・動画ファイルを「写真」タイムラインと「場所」マップに表示します。デフォルトの個人 Drive は自動的に含まれます。実際に写真を含む共有 Drive の場合はオンにしてください (例: 「家族写真」)。",
+      "include_in_music_index": "音楽に含める",
+      "include_in_music_index_help": "この Drive の音声ファイルを「音楽」ライブラリに含めます。デフォルトの個人 Drive は自動的に含まれます。実際に音楽コレクションを含む共有 Drive の場合はオンにしてください (例: 「家族の音楽」「バンド共同作業」)。",
       "implied_by_forbid_sharing": "すでに「リソース単位の共有を禁止」によって適用済み。"
     }
   },
diff --git a/frontend/static/locales/ko.json b/frontend/static/locales/ko.json
index 009ff8f8..4ae4f0c9 100644
--- a/frontend/static/locales/ko.json
+++ b/frontend/static/locales/ko.json
@@ -821,6 +821,10 @@
       "forbid_cross_drive_move_help": "파일이나 폴더를 다른 드라이브로 이동하는 것을 차단합니다. 다운로드 + 재업로드는 막지 않습니다.",
       "forbid_owner_role_change": "소유자 명단 잠금",
       "forbid_owner_role_change_help": "이 설정이 켜져 있는 동안 관리자만 드라이브 소유자를 추가, 제거, 강등할 수 있습니다.",
+      "include_in_photo_index": "사진에 포함",
+      "include_in_photo_index_help": "이 Drive의 이미지 및 동영상 파일을 사진 타임라인과 장소 지도에 표시합니다. 기본 개인 Drive는 자동으로 포함됩니다. 실제로 사진이 있는 공유 Drive에서 켜세요 (예: 「가족 사진」).",
+      "include_in_music_index": "음악에 포함",
+      "include_in_music_index_help": "이 Drive의 오디오 파일을 음악 라이브러리에 포함합니다. 기본 개인 Drive는 자동으로 포함됩니다. 실제로 음악 컬렉션이 있는 공유 Drive에서 켜세요 (예: 「가족 음악」, 「밴드 협업」).",
       "implied_by_forbid_sharing": "이미 「리소스별 공유 금지」에 의해 적용됨."
     }
   },
diff --git a/frontend/static/locales/nl.json b/frontend/static/locales/nl.json
index 7d514cfe..fddf31be 100644
--- a/frontend/static/locales/nl.json
+++ b/frontend/static/locales/nl.json
@@ -821,6 +821,10 @@
       "forbid_cross_drive_move_help": "Blokkeert het verplaatsen van bestanden of mappen naar een andere Drive. Voorkomt geen downloaden + opnieuw uploaden.",
       "forbid_owner_role_change": "Eigenaarsoverzicht vergrendelen",
       "forbid_owner_role_change_help": "Alleen de beheerder kan Drive-eigenaren toevoegen, verwijderen of degraderen zolang dit aanstaat.",
+      "include_in_photo_index": "Opnemen in Foto's",
+      "include_in_photo_index_help": "Toon afbeeldings- en videobestanden uit deze Drive in de Foto's-tijdlijn en op de Plaatsen-kaart. Standaard persoonlijke Drives zijn automatisch opgenomen; schakel dit in voor gedeelde Drives die daadwerkelijk foto's bevatten (bv. «Gezinsfoto's»).",
+      "include_in_music_index": "Opnemen in Muziek",
+      "include_in_music_index_help": "Neem audiobestanden uit deze Drive op in de Muziekbibliotheek. Standaard persoonlijke Drives zijn automatisch opgenomen; schakel dit in voor gedeelde Drives die daadwerkelijk een muziekcollectie bevatten (bv. «Gezinsmuziek», «Bandsamenwerking»).",
       "implied_by_forbid_sharing": "Al afgedwongen door «Per-resource delen verbieden»."
     }
   },
diff --git a/frontend/static/locales/pl.json b/frontend/static/locales/pl.json
index 61be035e..96a18fdd 100644
--- a/frontend/static/locales/pl.json
+++ b/frontend/static/locales/pl.json
@@ -821,6 +821,10 @@
       "forbid_cross_drive_move_help": "Blokuje przenoszenie plików lub folderów do innego Drive. Nie zatrzymuje pobierania + ponownego przesyłania.",
       "forbid_owner_role_change": "Zablokuj listę właścicieli",
       "forbid_owner_role_change_help": "Tylko administrator może dodawać, usuwać lub degradować właścicieli Drive, gdy ta zasada jest aktywna.",
+      "include_in_photo_index": "Uwzględnij w Zdjęciach",
+      "include_in_photo_index_help": "Wyświetlaj obrazy i filmy z tego Dysku na osi czasu Zdjęć i na mapie Miejsc. Domyślne dyski osobiste są uwzględniane automatycznie; włącz to dla dysków współdzielonych, które faktycznie zawierają zdjęcia (np. «Zdjęcia rodzinne»).",
+      "include_in_music_index": "Uwzględnij w Muzyce",
+      "include_in_music_index_help": "Uwzględniaj pliki audio z tego Dysku w bibliotece Muzyki. Domyślne dyski osobiste są uwzględniane automatycznie; włącz to dla dysków współdzielonych, które faktycznie zawierają kolekcję muzyczną (np. «Muzyka rodzinna», «Współpraca zespołu»).",
       "implied_by_forbid_sharing": "Już egzekwowane przez «Zakaz udostępniania per-zasób»."
     }
   },
diff --git a/frontend/static/locales/pt.json b/frontend/static/locales/pt.json
index 534ee279..cd71f3f8 100644
--- a/frontend/static/locales/pt.json
+++ b/frontend/static/locales/pt.json
@@ -821,6 +821,10 @@
       "forbid_cross_drive_move_help": "Bloqueia mover arquivos ou pastas para outro Drive. Não impede download + reupload.",
       "forbid_owner_role_change": "Bloquear lista de proprietários",
       "forbid_owner_role_change_help": "Apenas o administrador pode adicionar, remover ou rebaixar proprietários do Drive enquanto esta política estiver ativa.",
+      "include_in_photo_index": "Incluir em Fotos",
+      "include_in_photo_index_help": "Mostrar os ficheiros de imagem e vídeo deste Drive na cronologia Fotos e no mapa Lugares. Os Drives pessoais predefinidos são incluídos automaticamente; ative esta opção nos Drives partilhados que realmente contêm fotos (por ex. «Fotos da família»).",
+      "include_in_music_index": "Incluir em Música",
+      "include_in_music_index_help": "Incluir os ficheiros de áudio deste Drive na biblioteca Música. Os Drives pessoais predefinidos são incluídos automaticamente; ative esta opção nos Drives partilhados que realmente contêm uma coleção musical (por ex. «Música da família», «Colaboração da banda»).",
       "implied_by_forbid_sharing": "Já aplicado por «Proibir compartilhamento por recurso»."
     }
   },
diff --git a/frontend/static/locales/ru.json b/frontend/static/locales/ru.json
index 1f29fd9a..79752b0d 100644
--- a/frontend/static/locales/ru.json
+++ b/frontend/static/locales/ru.json
@@ -821,6 +821,10 @@
       "forbid_cross_drive_move_help": "Блокирует перенос файлов или папок в другой Drive. Не препятствует скачиванию + повторной загрузке.",
       "forbid_owner_role_change": "Заблокировать список владельцев",
       "forbid_owner_role_change_help": "Пока эта политика активна, только администратор может добавлять, удалять или понижать владельцев Drive.",
+      "include_in_photo_index": "Включить в Фото",
+      "include_in_photo_index_help": "Показывать изображения и видео из этого Drive в ленте Фото и на карте Мест. Диски по умолчанию включаются автоматически; включите для общих дисков, которые действительно содержат фотографии (например, «Семейные фото»).",
+      "include_in_music_index": "Включить в Музыку",
+      "include_in_music_index_help": "Включать аудиофайлы из этого Drive в библиотеку Музыки. Диски по умолчанию включаются автоматически; включите для общих дисков, которые действительно содержат музыкальную коллекцию (например, «Семейная музыка», «Совместная работа группы»).",
       "implied_by_forbid_sharing": "Уже применено политикой «Запретить общий доступ к отдельным ресурсам»."
     }
   },
diff --git a/frontend/static/locales/zh-TW.json b/frontend/static/locales/zh-TW.json
index 607a99fc..c3d09e30 100644
--- a/frontend/static/locales/zh-TW.json
+++ b/frontend/static/locales/zh-TW.json
@@ -804,6 +804,10 @@
       "forbid_cross_drive_move_help": "封鎖將檔案或資料夾移動到另一個 Drive。並不阻止下載後再上傳。",
       "forbid_owner_role_change": "鎖定擁有者名單",
       "forbid_owner_role_change_help": "此項啟用時，僅管理員可新增、移除或降級 Drive 擁有者。",
+      "include_in_photo_index": "包含於照片中",
+      "include_in_photo_index_help": "在照片時間軸與地點地圖中顯示此 Drive 的圖像與影片檔案。預設個人 Drive 會自動包含；針對真正含有照片的共享 Drive（例如「家庭照片」），請開啟此選項。",
+      "include_in_music_index": "包含於音樂中",
+      "include_in_music_index_help": "將此 Drive 的音訊檔案包含於音樂媒體庫。預設個人 Drive 會自動包含；針對真正含有音樂收藏的共享 Drive（例如「家庭音樂」、「樂團協作」），請開啟此選項。",
       "implied_by_forbid_sharing": "已由「禁止以資源為單位的分享」強制執行。"
     }
   },
diff --git a/frontend/static/locales/zh.json b/frontend/static/locales/zh.json
index 02f1f9e8..3d9b34cc 100644
--- a/frontend/static/locales/zh.json
+++ b/frontend/static/locales/zh.json
@@ -804,6 +804,10 @@
       "forbid_cross_drive_move_help": "阻止将文件或文件夹移动到另一个 Drive。不阻止下载后再上传。",
       "forbid_owner_role_change": "锁定所有者名单",
       "forbid_owner_role_change_help": "在此项启用时，只有管理员可以添加、移除或降级 Drive 所有者。",
+      "include_in_photo_index": "包含在照片中",
+      "include_in_photo_index_help": "在照片时间线和地点地图中显示此 Drive 的图像和视频文件。默认个人 Drive 自动包含在内；对于真正包含照片的共享 Drive（例如\"家庭照片\"），请开启此选项。",
+      "include_in_music_index": "包含在音乐中",
+      "include_in_music_index_help": "将此 Drive 的音频文件包含在音乐库中。默认个人 Drive 自动包含在内；对于真正包含音乐收藏的共享 Drive（例如\"家庭音乐\"、\"乐队协作\"），请开启此选项。",
       "implied_by_forbid_sharing": "已由\"禁止按资源共享\"强制执行。"
     }
   },
diff --git a/tests/api/drive_policies.hurl b/tests/api/drive_policies.hurl
index 33f0f9c3..98f388eb 100644
--- a/tests/api/drive_policies.hurl
+++ b/tests/api/drive_policies.hurl
@@ -879,6 +879,113 @@ Content-Type: application/json
 HTTP 200
 
 
+# ─────────────────────────────────────────────────────────────
+# Step 11d — `include_in_photo_index` scope opt-in (§15).
+#
+# Default personal drives are seeded with the flag = true by the
+# `PersonalDriveLifecycleHook` + backfill migration
+# (20260901000000_default_personal_photo_music_flags.sql). Non-
+# default drives (shared, secondary personals) start opted-out
+# and only surface in `/api/photos` after an admin flips the
+# flag on via PATCH.
+#
+# Coverage:
+#   a. Upload a PNG into dp_owner's default Personal drive →
+#      surfaces in `/api/photos` (default-personal auto-opted in).
+#   b. Upload a PNG into the shared drive → does NOT surface
+#      (flag omitted).
+#   c. Admin flips `include_in_photo_index=true` on the shared
+#      drive → the shared-drive PNG surfaces in `/api/photos`.
+#
+# `/api/photos` returns a flat array of PhotoDto — each carries
+# the file's `id`. Assertions use `jsonpath "$[*].id" contains
+# "…"` to sidestep the single-match filter quirks
+# (feedback_hurl_jsonpath_filter_empty).
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/files/upload
+Authorization: Bearer {{owner_token}}
+[MultipartFormData]
+folder_id: {{personal_root_id}}
+file: file,fixtures/blue-image.png; image/png
+
+HTTP 201
+[Captures]
+personal_photo_id: jsonpath "$.id"
+
+
+# Baseline — personal-drive photo is visible in the timeline.
+GET {{base_url}}/api/photos
+Authorization: Bearer {{owner_token}}
+
+HTTP 200
+[Asserts]
+jsonpath "$[*].id" contains "{{personal_photo_id}}"
+
+
+# Upload a PNG into the SHARED drive's root. dp_owner is Owner
+# on the shared drive from earlier steps, so Create passes.
+POST {{base_url}}/api/files/upload
+Authorization: Bearer {{owner_token}}
+[MultipartFormData]
+folder_id: {{shared_root_id}}
+file: file,fixtures/red-image.png; image/png
+
+HTTP 201
+[Captures]
+shared_photo_id: jsonpath "$.id"
+
+
+# Shared drive is NOT opted-in yet — the shared photo must be
+# absent from `/api/photos`. The personal photo stays visible.
+GET {{base_url}}/api/photos
+Authorization: Bearer {{owner_token}}
+
+HTTP 200
+[Asserts]
+jsonpath "$[*].id" not contains "{{shared_photo_id}}"
+jsonpath "$[*].id" contains "{{personal_photo_id}}"
+
+
+# Flip `include_in_photo_index=true` on the shared drive.
+PATCH {{base_url}}/api/drives/{{shared_drive_id}}/policies
+Authorization: Bearer {{admin_token}}
+Content-Type: application/json
+{
+  "include_in_photo_index": true
+}
+
+HTTP 200
+[Asserts]
+jsonpath "$.include_in_photo_index" == true
+
+
+# Shared-drive photo now surfaces in `/api/photos`. Personal
+# photo remains visible — no regression on the always-in-scope
+# default drive.
+GET {{base_url}}/api/photos
+Authorization: Bearer {{owner_token}}
+
+HTTP 200
+[Asserts]
+jsonpath "$[*].id" contains "{{shared_photo_id}}"
+jsonpath "$[*].id" contains "{{personal_photo_id}}"
+
+
+# Cleanup — both photos so the shared-drive delete below finds
+# an empty drive. The personal-drive photo cascade-deletes with
+# dp_owner in Step 12; we still remove it here so the delete
+# path is exercised explicitly (deletes don't affect the flag).
+DELETE {{base_url}}/api/files/{{shared_photo_id}}
+Authorization: Bearer {{owner_token}}
+
+HTTP 204
+
+DELETE {{base_url}}/api/files/{{personal_photo_id}}
+Authorization: Bearer {{owner_token}}
+
+HTTP 204
+
+
 # Cleanup the shared drive: empty (no content was added) → delete
 # via DELETE /api/drives/{id}. dp_owner is Owner so the call
 # carries Manage; the per-drive empty-before-delete guard passes