diff --git a/zddc/internal/apps/embedded/archive.html b/zddc/internal/apps/embedded/archive.html
index 7964633..0a7cced 100644
--- a/zddc/internal/apps/embedded/archive.html
+++ b/zddc/internal/apps/embedded/archive.html
@@ -2470,7 +2470,7 @@ td[data-field="trackingNumber"] {
                 </svg>
                 <div class="header-title-group">
                     <span class="app-header__title">ZDDC Archive</span>
-                    <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:48:41 · f7f018c</span></span>
+                    <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 19:45:42 · 72c0552</span></span>
                 </div>
                 <button id="addDirectoryBtn" class="btn btn-primary">Add Local Directory</button>
                 <button id="refreshHeaderBtn" class="btn btn-secondary hidden" title="Refresh Data">⟳</button>
diff --git a/zddc/internal/apps/embedded/browse.html b/zddc/internal/apps/embedded/browse.html
index b4c7109..aa318ea 100644
--- a/zddc/internal/apps/embedded/browse.html
+++ b/zddc/internal/apps/embedded/browse.html
@@ -1639,6 +1639,15 @@ html, body {
     outline-offset: -1px;
 }
 
+.sort-control__checkbox {
+    /* Pair with the "Show hidden" label as a unified control. The
+       parent .sort-control already does horizontal flex + gap, so the
+       checkbox just needs sensible vertical alignment + a clickable
+       hit target. */
+    margin: 0;
+    cursor: pointer;
+}
+
 /* Older .md-fm-section / .fm-list / .md-toc-resizer rules were replaced
    by the .md-shell BEM block above. */
 
@@ -1657,7 +1666,7 @@ html, body {
             </svg>
             <div class="header-title-group">
                 <span class="app-header__title">ZDDC Browse</span>
-                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:48:42 · f7f018c</span></span>
+                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 19:45:42 · 72c0552</span></span>
             </div>
             <button id="addDirectoryBtn" class="btn btn-primary">Add Local Directory</button>
             <button id="refreshHeaderBtn" class="btn btn-secondary hidden" title="Refresh listing" aria-label="Refresh listing">⟳</button>
@@ -1705,6 +1714,12 @@ html, body {
                         <option value="ext:asc">Type (A→Z)</option>
                     </select>
                 </label>
+                <label class="sort-control" for="showHidden"
+                       title="Surface .-prefixed and _-prefixed entries (.zddc, .converted/, _app/, …). ACL still applies — you only see what you'd already be allowed to read.">
+                    <input type="checkbox" id="showHidden" class="sort-control__checkbox"
+                           aria-label="Show hidden files">
+                    <span class="sort-control__label">Show hidden</span>
+                </label>
             </div>
 
             <!-- Browse mode (default): two-pane tree + preview -->
@@ -5417,7 +5432,15 @@ var e=function(t,n){return e=Object.setPrototypeOf||{__proto__:[]}instanceof Arr
     // the same UX for anything else and for non-zddc-server backends.
     async function fetchServerChildren(path) {
         if (!path.endsWith('/')) path += '/';
-        var resp = await fetch(path, {
+        // ?hidden=1 surfaces .-prefixed and _-prefixed entries when the
+        // user has flipped the "Show hidden" toggle. The server still
+        // ACL-gates per-entry, so this is purely additive — anyone
+        // without read on the parent dir already sees nothing.
+        var url = path;
+        if (window.app && window.app.state && window.app.state.showHidden) {
+            url += (url.indexOf('?') === -1 ? '?' : '&') + 'hidden=1';
+        }
+        var resp = await fetch(url, {
             headers: { 'Accept': 'application/json' },
             credentials: 'same-origin'
         });
@@ -7610,6 +7633,21 @@ var e=function(t,n){return e=Object.setPrototypeOf||{__proto__:[]}instanceof Arr
             });
         }
 
+        // "Show hidden" checkbox — toggles state.showHidden, which the
+        // loader reads to append ?hidden=1 to listing requests. Re-uses
+        // the existing refreshListing flow so the tree pulls a fresh
+        // listing. ACL is still server-side; this just relaxes the
+        // client-visible filter for entries the user is already
+        // allowed to read.
+        var hiddenCb = document.getElementById('showHidden');
+        if (hiddenCb) {
+            hiddenCb.checked = !!state.showHidden;
+            hiddenCb.addEventListener('change', function () {
+                state.showHidden = hiddenCb.checked;
+                refreshListing();
+            });
+        }
+
         // No view-mode buttons; mode is derived from the URL on every
         // scope change (resolveViewMode below). Pass-through for the
         // initial path.
diff --git a/zddc/internal/apps/embedded/classifier.html b/zddc/internal/apps/embedded/classifier.html
index 67236e9..7f72bd1 100644
--- a/zddc/internal/apps/embedded/classifier.html
+++ b/zddc/internal/apps/embedded/classifier.html
@@ -1681,7 +1681,7 @@ body.help-open .app-header {
                     </svg>
                     <div class="header-title-group">
                         <span class="app-header__title">ZDDC Classifier</span>
-                        <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:48:41 · f7f018c</span></span>
+                        <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 19:45:42 · 72c0552</span></span>
                     </div>
                     <button id="addDirectoryBtn" class="btn btn-primary">Add Local Directory</button>
                     <button id="refreshHeaderBtn" class="btn btn-secondary hidden" title="Refresh and rescan directory" aria-label="Refresh" style="font-size:1.1rem;">⟳</button>
diff --git a/zddc/internal/apps/embedded/index.html b/zddc/internal/apps/embedded/index.html
index 15d886e..c1c3a0a 100644
--- a/zddc/internal/apps/embedded/index.html
+++ b/zddc/internal/apps/embedded/index.html
@@ -1424,7 +1424,7 @@ body {
             </svg>
             <div class="header-title-group">
                 <span class="app-header__title">ZDDC</span>
-                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:48:42 · f7f018c</span></span>
+                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 19:45:42 · 72c0552</span></span>
             </div>
         </div>
         <div class="header-right">
diff --git a/zddc/internal/apps/embedded/transmittal.html b/zddc/internal/apps/embedded/transmittal.html
index ae750bc..aa5bfe6 100644
--- a/zddc/internal/apps/embedded/transmittal.html
+++ b/zddc/internal/apps/embedded/transmittal.html
@@ -2523,7 +2523,7 @@ dialog.modal--narrow {
             </svg>
             <div class="header-title-group">
                 <span class="app-header__title">ZDDC Transmittal</span>
-                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:48:41 · f7f018c</span></span>
+                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 19:45:42 · 72c0552</span></span>
             </div>
             <span id="no-js-notice" class="text-gray-400 text-xs italic">JavaScript not available</span>
             <!-- Publish split-button (Transmittal-specific primary action;
diff --git a/zddc/internal/apps/embedded/versions.txt b/zddc/internal/apps/embedded/versions.txt
index 6ea2bab..1926b4e 100644
--- a/zddc/internal/apps/embedded/versions.txt
+++ b/zddc/internal/apps/embedded/versions.txt
@@ -1,8 +1,8 @@
 # Generated by build.sh — do not edit. One <app>=<build label> per line.
-archive=v0.0.17-beta · 2026-05-13 18:48:41 · f7f018c
-transmittal=v0.0.17-beta · 2026-05-13 18:48:41 · f7f018c
-classifier=v0.0.17-beta · 2026-05-13 18:48:41 · f7f018c
-landing=v0.0.17-beta · 2026-05-13 18:48:42 · f7f018c
-form=v0.0.17-beta · 2026-05-13 18:48:42 · f7f018c
-tables=v0.0.17-beta · 2026-05-13 18:48:42 · f7f018c
-browse=v0.0.17-beta · 2026-05-13 18:48:42 · f7f018c
+archive=v0.0.17-beta · 2026-05-13 19:45:42 · 72c0552
+transmittal=v0.0.17-beta · 2026-05-13 19:45:42 · 72c0552
+classifier=v0.0.17-beta · 2026-05-13 19:45:42 · 72c0552
+landing=v0.0.17-beta · 2026-05-13 19:45:42 · 72c0552
+form=v0.0.17-beta · 2026-05-13 19:45:42 · 72c0552
+tables=v0.0.17-beta · 2026-05-13 19:45:42 · 72c0552
+browse=v0.0.17-beta · 2026-05-13 19:45:42 · 72c0552
diff --git a/zddc/internal/handler/tables.html b/zddc/internal/handler/tables.html
index 40053f4..e083daa 100644
--- a/zddc/internal/handler/tables.html
+++ b/zddc/internal/handler/tables.html
@@ -1300,7 +1300,7 @@ body.help-open .app-header {
             </svg>
             <div class="header-title-group">
                 <span class="app-header__title" id="table-title">ZDDC Table</span>
-                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:48:42 · f7f018c</span></span>
+                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 19:45:42 · 72c0552</span></span>
             </div>
         </div>
         <div class="header-right">