diff --git a/apps/web/src/lib/blob-proxy.ts b/apps/web/src/lib/blob-proxy.ts
new file mode 100644
index 0000000..ac4ac0c
--- /dev/null
+++ b/apps/web/src/lib/blob-proxy.ts
@@ -0,0 +1,26 @@
+/**
+ * Rewrites a PDS getBlob URL to the site's own /blob route, which proxies the
+ * blob and applies image transformations where the platform provides them.
+ */
+
+const WIDTHS = [256, 1600] as const;
+export type BlobWidth = (typeof WIDTHS)[number];
+
+export function isBlobWidth(value: number): value is BlobWidth {
+	return (WIDTHS as readonly number[]).includes(value);
+}
+
+/** Unrecognized URLs pass through untouched. */
+export function blobProxyPath(blobUrl: string, width: BlobWidth): string {
+	let url: URL;
+	try {
+		url = new URL(blobUrl);
+	} catch {
+		return blobUrl;
+	}
+	if (url.pathname !== '/xrpc/com.atproto.sync.getBlob') return blobUrl;
+	const did = url.searchParams.get('did');
+	const cid = url.searchParams.get('cid');
+	if (!did || !cid) return blobUrl;
+	return `/blob/${encodeURIComponent(did)}/${encodeURIComponent(cid)}?w=${width}`;
+}
diff --git a/apps/web/src/lib/components/theme/SiteLayout.svelte b/apps/web/src/lib/components/theme/SiteLayout.svelte
index cfa6e43..3eab034 100644
--- a/apps/web/src/lib/components/theme/SiteLayout.svelte
+++ b/apps/web/src/lib/components/theme/SiteLayout.svelte
@@ -65,9 +65,9 @@
 	</main>
 
 	<footer>
-		<a class="handle" href="https://bsky.app/profile/{site.did}">@{site.handle}</a>
+		<a class="handle" href="https://bsky.app/profile/{site.did}" target="_blank" rel="noopener noreferrer">@{site.handle}</a>
 		<span class="rule" aria-hidden="true"></span>
-		<span>Moored with <a href="https://mooring.page">Mooring</a></span>
+		<span>Moored with <a href="https://mooring.page" target="_blank" rel="noopener noreferrer">Mooring</a></span>
 	</footer>
 </div>
 
@@ -97,6 +97,7 @@
 		--accent: #9c3218;
 		--accent-ink: #fdfbf6;
 		--rule: #e0d8c8;
+		--airmail-blue: #1c3f6e;
 
 		--font-serif: 'Iowan Old Style', 'Hoefler Text', 'Palatino Linotype', Palatino,
 			'Book Antiqua', Georgia, serif;
@@ -134,6 +135,7 @@
 			--accent: #d4714f;
 			--accent-ink: #101520;
 			--rule: #242c3a;
+			--airmail-blue: #3a6ea8;
 		}
 	}
 
@@ -144,7 +146,7 @@
 			-45deg,
 			var(--accent) 0 10px,
 			var(--paper) 10px 20px,
-			#1c3f6e 20px 30px,
+			var(--airmail-blue) 20px 30px,
 			var(--paper) 30px 40px
 		);
 	}
@@ -183,7 +185,9 @@
 	nav a {
 		color: var(--muted);
 		text-decoration: none;
-		padding-bottom: 2px;
+		/* Small type, big target: pad the hit area without moving the layout. */
+		padding: 0.5rem 0.25rem 2px;
+		margin: -0.5rem -0.25rem 0;
 		border-bottom: 1px solid transparent;
 		transition: color 160ms ease, border-color 160ms ease;
 	}
@@ -227,6 +231,9 @@
 
 	footer a {
 		color: inherit;
+		display: inline-block;
+		padding: 0.45rem 0.25rem;
+		margin: -0.45rem -0.25rem;
 	}
 
 	.handle {
diff --git a/apps/web/src/lib/components/theme/SiteSections.svelte b/apps/web/src/lib/components/theme/SiteSections.svelte
index 09801ab..b5d84f2 100644
--- a/apps/web/src/lib/components/theme/SiteSections.svelte
+++ b/apps/web/src/lib/components/theme/SiteSections.svelte
@@ -1,7 +1,9 @@
 <script lang="ts">
 	import type { RenderedSection, SiteView } from '$lib/site-view';
+	import { blobProxyPath } from '$lib/blob-proxy';
 	import { formatDate } from '$lib/date-format';
 	import { linkify } from '$lib/linkify';
+	import { clampSummary } from '$lib/summary-clamp';
 
 	let { site, base }: { site: SiteView; base: string } = $props();
 
@@ -72,7 +74,13 @@
 
 {#snippet bio()}
 	{#if site.profile?.description}
-		<p class="bio">{#each linkify(site.profile.description) as segment}{#if segment.url}<a href={segment.url}>{segment.text}</a>{:else}{segment.text}{/if}{/each}</p>
+		<p class="bio">{#each linkify(site.profile.description, site.handle) as segment}{#if segment.url}<a href={segment.url} target="_blank" rel="noopener noreferrer">{segment.text}</a>{:else}{segment.text}{/if}{/each}</p>
+	{/if}
+{/snippet}
+
+{#snippet contact()}
+	{#if site.contactEmail}
+		<a class="cta" href="mailto:{site.contactEmail}">Write to me</a>
 	{/if}
 {/snippet}
 
@@ -81,14 +89,21 @@
 		{@const banner = site.profile?.bannerUrl}
 		{#if banner && section.style === 'band'}
 			<div class="banner-band" class:with-avatar={section.showAvatar && site.avatarUrl}>
-				<img class="banner" src={banner} alt="" fetchpriority="high" />
+				<img class="banner" src={blobProxyPath(banner, 1600)} alt="" fetchpriority="high" />
 				{#if section.showAvatar && site.avatarUrl}
-					<img class="avatar overlap" src={site.avatarUrl} alt="" width="128" height="128" />
+					<img
+						class="avatar overlap"
+						src={blobProxyPath(site.avatarUrl, 256)}
+						alt={site.name}
+						width="128"
+						height="128"
+					/>
 				{/if}
 			</div>
 			<section class="hero band-hero" style="--step:{i}">
 				<div class="lede">
 					{@render nameBlock(section)}
+					{@render contact()}
 				</div>
 				<div class="aside">
 					{@render bio()}
@@ -98,23 +113,37 @@
 			<section class="hero postcard-hero" style="--step:{i}">
 				<div class="lede">
 					{#if section.showAvatar && site.avatarUrl}
-						<img class="avatar" src={site.avatarUrl} alt="" width="112" height="112" />
+						<img
+							class="avatar"
+							src={blobProxyPath(site.avatarUrl, 256)}
+							alt={site.name}
+							width="112"
+							height="112"
+						/>
 					{/if}
 					{@render nameBlock(section)}
 					{@render bio()}
+					{@render contact()}
 				</div>
 				<figure class="postcard">
-					<img src={banner} alt="" fetchpriority="high" />
+					<img src={blobProxyPath(banner, 1600)} alt="" fetchpriority="high" />
 				</figure>
 			</section>
 		{:else}
 			<section class="hero plain-hero" style="--step:{i}">
 				{#if section.showAvatar && site.avatarUrl}
-					<img class="avatar large" src={site.avatarUrl} alt="" width="184" height="184" />
+					<img
+						class="avatar large"
+						src={blobProxyPath(site.avatarUrl, 256)}
+						alt={site.name}
+						width="184"
+						height="184"
+					/>
 				{/if}
 				<div class="lede">
 					{@render nameBlock(section)}
 					{@render bio()}
+					{@render contact()}
 				</div>
 			</section>
 		{/if}
@@ -128,26 +157,34 @@
 						{#each section.documents as doc (doc.uri)}
 							<li>
 								{#if doc.url}
-									<a class="title" href={doc.url}>{doc.title}</a>
+									<a class="title" href={doc.url} target="_blank" rel="noopener noreferrer"
+										>{doc.title}</a
+									>
 								{:else}
 									<span class="title">{doc.title}</span>
 								{/if}
 								{#if doc.description}
 									<p class="excerpt">{doc.description}</p>
 								{/if}
-								<span class="meta">
-									{#if doc.publishedAt}<time datetime={doc.publishedAt}
-											>{formatDate(doc.publishedAt)}</time
-										>{/if}
-									{#if doc.url}<a href={doc.url}>Read →</a>{/if}
-								</span>
+								{#if doc.publishedAt}
+									<span class="meta"
+										><time datetime={doc.publishedAt}>{formatDate(doc.publishedAt)}</time></span
+									>
+								{/if}
 							</li>
 						{/each}
 					</ul>
 				{:else if section.kind === 'career'}
 					{@const dated = careerHasDates(section)}
 					{#if site.sifaProfile?.summary}
-						<p class="about">{site.sifaProfile.summary}</p>
+						{@const summary = clampSummary(site.sifaProfile.summary)}
+						<p class="about">{summary.lead}</p>
+						{#if summary.rest}
+							<details class="more-about">
+								<summary>More</summary>
+								<p class="about">{summary.rest}</p>
+							</details>
+						{/if}
 					{/if}
 					{#if site.sifaProfile?.openTo?.length}
 						<div class="open-to">
@@ -156,6 +193,11 @@
 								{#each site.sifaProfile.openTo as label (label)}
 									<li>{label}</li>
 								{/each}
+								{#if site.contactEmail}
+									<li class="say-hello">
+										<a href="mailto:{site.contactEmail}">Say hello →</a>
+									</li>
+								{/if}
 							</ul>
 						</div>
 					{/if}
@@ -209,9 +251,14 @@
 					<ul class="notes">
 						{#each section.posts as post (post.uri)}
 							<li>
-								<p>{#each post.segments as segment}{#if segment.url}<a href={segment.url}>{segment.text}</a>{:else}{segment.text}{/if}{/each}</p>
+								<p>{#each post.segments as segment}{#if segment.url}<a href={segment.url} target="_blank" rel="noopener noreferrer">{segment.text}</a>{:else}{segment.text}{/if}{/each}</p>
 								{#if post.url}
-									<a class="when" href={post.url}
+									<a
+										class="when"
+										href={post.url}
+										target="_blank"
+										rel="noopener noreferrer"
+										aria-label="View on Bluesky — {formatDate(post.createdAt)}"
 										><time datetime={post.createdAt}>{formatDate(post.createdAt)}</time
 										>{#if post.hasEmbed}&nbsp;· view on Bluesky{/if} ↗</a
 									>
@@ -431,6 +478,27 @@
 		white-space: pre-line;
 	}
 
+	/* The contact affordance: a stamp on the letter. */
+	.cta {
+		display: inline-block;
+		align-self: flex-start;
+		margin-top: 1.4rem;
+		padding: 0.5rem 0.9rem;
+		background: var(--accent);
+		color: var(--accent-ink);
+		font-family: var(--font-mono);
+		font-size: 0.72rem;
+		letter-spacing: 0.12em;
+		text-transform: uppercase;
+		text-decoration: none;
+		border-radius: 2px;
+	}
+
+	.cta:hover,
+	.cta:focus-visible {
+		background: color-mix(in srgb, var(--accent) 82%, var(--ink));
+	}
+
 	/* ——— sections ——— */
 
 	.band {
@@ -533,6 +601,45 @@
 		letter-spacing: 0.04em;
 	}
 
+	/* The one chip that acts: filled, unlike its outlined siblings. */
+	.open-to li.say-hello {
+		padding: 0;
+		background: var(--accent);
+	}
+
+	.say-hello a {
+		display: block;
+		padding: 0.2rem 0.55rem;
+		color: var(--accent-ink);
+		text-decoration: none;
+	}
+
+	.more-about {
+		margin-top: 0.5rem;
+	}
+
+	.more-about summary {
+		display: inline-block;
+		cursor: pointer;
+		font-family: var(--font-mono);
+		font-size: 0.72rem;
+		letter-spacing: 0.04em;
+		color: var(--accent);
+		list-style: none;
+	}
+
+	.more-about summary::-webkit-details-marker {
+		display: none;
+	}
+
+	.more-about[open] summary {
+		display: none;
+	}
+
+	.more-about .about {
+		margin-top: 0.5rem;
+	}
+
 	.sublabel {
 		margin: 1.5rem 0 0.25rem;
 		font-family: var(--font-mono);
@@ -711,11 +818,6 @@
 		color: var(--muted);
 	}
 
-	.articles .meta a {
-		color: var(--accent);
-		text-decoration: none;
-	}
-
 	/* ——— posts ——— */
 
 	.notes {
@@ -742,6 +844,10 @@
 	.notes a.when {
 		color: var(--muted);
 		text-decoration: none;
+		/* Small type, big target: pad the hit area without moving the layout. */
+		display: inline-block;
+		padding: 0.45rem 0.35rem;
+		margin: -0.45rem -0.35rem;
 	}
 
 	.notes a.when:hover,
diff --git a/apps/web/src/lib/linkify.ts b/apps/web/src/lib/linkify.ts
index 195cade..55abbbc 100644
--- a/apps/web/src/lib/linkify.ts
+++ b/apps/web/src/lib/linkify.ts
@@ -10,14 +10,22 @@ import type { TextSegment } from './site-view';
 const URL_PATTERN = /https?:\/\/[^\s<>]+|(?<![\w@.])[a-z0-9][a-z0-9-]*(?:\.[a-z0-9-]+)*\.[a-z]{2,}(?:\/[^\s<>]*)?/gi;
 const TRAILING_PUNCTUATION = /[.,;:!?)'"\]]+$/;
 
-export function linkify(text: string): TextSegment[] {
+/** `skipHost` keeps self-references (the site's own domain) as plain text. */
+export function linkify(text: string, skipHost?: string): TextSegment[] {
 	const segments: TextSegment[] = [];
 	let cursor = 0;
 	for (const match of text.matchAll(URL_PATTERN)) {
 		const candidate = match[0].replace(TRAILING_PUNCTUATION, '');
 		if (candidate === '') continue;
-		if (match.index > cursor) segments.push({ text: text.slice(cursor, match.index) });
 		const url = /^https?:\/\//i.test(candidate) ? candidate : `https://${candidate}`;
+		let host: string | undefined;
+		try {
+			host = new URL(url).host;
+		} catch {
+			continue;
+		}
+		if (skipHost && host.toLowerCase() === skipHost.toLowerCase()) continue;
+		if (match.index > cursor) segments.push({ text: text.slice(cursor, match.index) });
 		segments.push({ text: candidate, url });
 		cursor = match.index + candidate.length;
 	}
diff --git a/apps/web/src/lib/server/mooring/forms.ts b/apps/web/src/lib/server/mooring/forms.ts
index b2bff15..a70834b 100644
--- a/apps/web/src/lib/server/mooring/forms.ts
+++ b/apps/web/src/lib/server/mooring/forms.ts
@@ -11,6 +11,7 @@ export function siteInputFromForm(form: FormData): SiteInput {
 	return {
 		name: field(form, 'name'),
 		description: field(form, 'description'),
+		contactEmail: field(form, 'contactEmail'),
 		// An unchecked checkbox is absent from the submission.
 		discoverable: form.get('discoverable') !== null
 	};
diff --git a/apps/web/src/lib/server/mooring/records.test.ts b/apps/web/src/lib/server/mooring/records.test.ts
index 5e938bf..631eeb1 100644
--- a/apps/web/src/lib/server/mooring/records.test.ts
+++ b/apps/web/src/lib/server/mooring/records.test.ts
@@ -102,6 +102,16 @@ describe('buildSiteRecord', () => {
 		expect(buildSiteRecord({ name: '   ' }, { now: NOW, existing })).not.toHaveProperty('name');
 	});
 
+	it('stores a valid contact email and rejects malformed ones', () => {
+		expect(
+			buildSiteRecord({ contactEmail: ' jacob@example.com ' }, { now: NOW })
+		).toMatchObject({ contactEmail: 'jacob@example.com' });
+		expect(buildSiteRecord({ contactEmail: '' }, { now: NOW })).not.toHaveProperty('contactEmail');
+		expect(() => buildSiteRecord({ contactEmail: 'not-an-email' }, { now: NOW })).toThrow(
+			'name@domain'
+		);
+	});
+
 	it('stores only the discoverable opt-out', () => {
 		expect(buildSiteRecord({ discoverable: true }, { now: NOW })).not.toHaveProperty('discoverable');
 		expect(buildSiteRecord({ discoverable: false }, { now: NOW })).toMatchObject({
diff --git a/apps/web/src/lib/server/mooring/records.ts b/apps/web/src/lib/server/mooring/records.ts
index 4574adf..5c532cc 100644
--- a/apps/web/src/lib/server/mooring/records.ts
+++ b/apps/web/src/lib/server/mooring/records.ts
@@ -40,6 +40,7 @@ export class InvalidInput extends Error {}
 export interface SiteInput {
 	name?: string;
 	description?: string;
+	contactEmail?: string;
 	discoverable?: boolean;
 }
 
@@ -135,6 +136,11 @@ export function buildSiteRecord(
 	record.createdAt = inheritedString(existing, 'createdAt') ?? now;
 	setOrDelete(record, 'name', trimmed(input.name));
 	setOrDelete(record, 'description', trimmed(input.description));
+	const contactEmail = trimmed(input.contactEmail);
+	if (contactEmail !== undefined && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(contactEmail)) {
+		throw new InvalidInput('The contact email needs the shape name@domain.');
+	}
+	setOrDelete(record, 'contactEmail', contactEmail);
 	// Absent means discoverable; only the opt-out is stored.
 	setOrDelete(record, 'discoverable', input.discoverable === false ? false : undefined);
 	return validated(SITE_COLLECTION, record);
diff --git a/apps/web/src/lib/server/render/site.ts b/apps/web/src/lib/server/render/site.ts
index 5a8b759..abba674 100644
--- a/apps/web/src/lib/server/render/site.ts
+++ b/apps/web/src/lib/server/render/site.ts
@@ -26,6 +26,14 @@ export type { PageLink, RenderedSection, SiteView, ThemeColors };
 const DEFAULT_POST_LIMIT = 5;
 const DEFAULT_DOCUMENT_LIMIT = 5;
 
+function oneLine(text: string): string {
+	return text
+		.split(/\n+/)
+		.map((paragraph) => paragraph.replace(/\s+/g, ' ').trim())
+		.filter(Boolean)
+		.join(' · ');
+}
+
 function rgb(value: unknown): string | undefined {
 	if (value === null || typeof value !== 'object') return undefined;
 	const { r, g, b } = value as Record<string, unknown>;
@@ -138,10 +146,10 @@ export async function loadSiteView(
 
 	const name =
 		(typeof site?.name === 'string' && site.name) || profile?.displayName || `@${handle}`;
-	// The description feeds <meta> tags, so multi-line input collapses to one line.
+	// The description feeds <meta> tags: one line, paragraphs joined visibly.
 	const description =
-		(typeof site?.description === 'string' && site.description.replace(/\s+/g, ' ').trim()) ||
-		(profile?.description ? markdownExcerpt(profile.description) : undefined) ||
+		(typeof site?.description === 'string' && oneLine(site.description)) ||
+		(profile?.description ? oneLine(markdownExcerpt(profile.description)) : undefined) ||
 		sifaProfile?.headline;
 
 	return {
@@ -149,6 +157,7 @@ export async function loadSiteView(
 		handle,
 		name,
 		description,
+		contactEmail: typeof site?.contactEmail === 'string' ? site.contactEmail : undefined,
 		discoverable: site?.discoverable !== false,
 		colors: themeColors(site),
 		avatarUrl: profile?.avatarUrl,
diff --git a/apps/web/src/lib/site-view.ts b/apps/web/src/lib/site-view.ts
index 1d9c0f6..7fe4e32 100644
--- a/apps/web/src/lib/site-view.ts
+++ b/apps/web/src/lib/site-view.ts
@@ -117,6 +117,8 @@ export interface SiteView {
 	handle: string;
 	name: string;
 	description?: string;
+	/** Public contact address from the site record; renders a contact affordance. */
+	contactEmail?: string;
 	discoverable: boolean;
 	colors: ThemeColors;
 	avatarUrl?: string;
diff --git a/apps/web/src/lib/summary-clamp.ts b/apps/web/src/lib/summary-clamp.ts
new file mode 100644
index 0000000..9220f55
--- /dev/null
+++ b/apps/web/src/lib/summary-clamp.ts
@@ -0,0 +1,25 @@
+/**
+ * Splits a long professional summary into a lead the page shows and a rest it
+ * tucks behind a disclosure. Short texts stay whole.
+ */
+
+export interface ClampedSummary {
+	lead: string;
+	rest?: string;
+}
+
+const CLAMP_THRESHOLD = 340;
+
+export function clampSummary(text: string): ClampedSummary {
+	if (text.length <= CLAMP_THRESHOLD) return { lead: text };
+	const firstParagraph = text.split(/\n/, 1)[0];
+	// Sentence boundaries: ". " with a capital following, to skip abbreviations
+	// poorly but predictably.
+	const sentences = firstParagraph.match(/[^.!?]+[.!?]+(?:\s+|$)/g);
+	if (!sentences || sentences.length < 2) {
+		return { lead: firstParagraph, rest: text.slice(firstParagraph.length).trim() || undefined };
+	}
+	const lead = sentences.slice(0, 2).join('').trim();
+	const rest = text.slice(text.indexOf(lead) + lead.length).trim();
+	return { lead, rest: rest || undefined };
+}
diff --git a/apps/web/src/lib/text-display.test.ts b/apps/web/src/lib/text-display.test.ts
index c677914..091d37f 100644
--- a/apps/web/src/lib/text-display.test.ts
+++ b/apps/web/src/lib/text-display.test.ts
@@ -1,6 +1,8 @@
 import { describe, expect, it } from 'vitest';
 import { linkify } from './linkify';
 import { formatDate } from './date-format';
+import { blobProxyPath } from './blob-proxy';
+import { clampSummary } from './summary-clamp';
 
 describe('linkify', () => {
 	it('links full URLs and bare domains, leaving other text alone', () => {
@@ -31,6 +33,54 @@ describe('linkify', () => {
 	});
 });
 
+describe('linkify skipHost', () => {
+	it('keeps the site\'s own domain as plain text', () => {
+		expect(linkify('home: https://jzweifel.dev and more', 'jzweifel.dev')).toEqual([
+			{ text: 'home: https://jzweifel.dev and more' }
+		]);
+		expect(linkify('see other.example', 'jzweifel.dev')).toEqual([
+			{ text: 'see ' },
+			{ text: 'other.example', url: 'https://other.example' }
+		]);
+	});
+});
+
+describe('blobProxyPath', () => {
+	it('rewrites a PDS getBlob URL to the first-party route', () => {
+		expect(
+			blobProxyPath(
+				'https://pds.example/xrpc/com.atproto.sync.getBlob?did=did%3Aplc%3Ax&cid=bafyfoo',
+				256
+			)
+		).toBe('/blob/did%3Aplc%3Ax/bafyfoo?w=256');
+	});
+
+	it('passes other URLs through untouched', () => {
+		expect(blobProxyPath('https://cdn.example/pic.jpg', 256)).toBe('https://cdn.example/pic.jpg');
+		expect(blobProxyPath('not a url', 1600)).toBe('not a url');
+	});
+});
+
+describe('clampSummary', () => {
+	it('leaves short text whole', () => {
+		expect(clampSummary('Short and sweet.')).toEqual({ lead: 'Short and sweet.' });
+	});
+
+	it('leads with two sentences and tucks the rest', () => {
+		const text =
+			'First sentence about platform work spanning quite a few words so the whole text clears the clamp threshold comfortably. ' +
+			'Second sentence with considerably more detail about distributed systems and scale and operations and everything in between. ' +
+			'Third sentence that should be tucked away behind the disclosure along with everything after it.\n\nA whole second paragraph too.';
+		const { lead, rest } = clampSummary(text);
+		expect(lead).toBe(
+			'First sentence about platform work spanning quite a few words so the whole text clears the clamp threshold comfortably. ' +
+				'Second sentence with considerably more detail about distributed systems and scale and operations and everything in between.'
+		);
+		expect(rest).toContain('Third sentence');
+		expect(rest).toContain('second paragraph');
+	});
+});
+
 describe('formatDate', () => {
 	it('formats ISO timestamps for display in UTC', () => {
 		expect(formatDate('2026-08-23T22:15:00.000Z')).toBe('Aug 23, 2026');
diff --git a/apps/web/src/routes/admin/+page.server.ts b/apps/web/src/routes/admin/+page.server.ts
index bc38373..ca00b06 100644
--- a/apps/web/src/routes/admin/+page.server.ts
+++ b/apps/web/src/routes/admin/+page.server.ts
@@ -27,6 +27,7 @@ function siteFields(record: Record<string, unknown>) {
 	return {
 		name: typeof record.name === 'string' ? record.name : '',
 		description: typeof record.description === 'string' ? record.description : '',
+		contactEmail: typeof record.contactEmail === 'string' ? record.contactEmail : '',
 		discoverable: record.discoverable !== false
 	};
 }
diff --git a/apps/web/src/routes/admin/+page.svelte b/apps/web/src/routes/admin/+page.svelte
index 1116b44..b0ccd81 100644
--- a/apps/web/src/routes/admin/+page.svelte
+++ b/apps/web/src/routes/admin/+page.svelte
@@ -8,6 +8,7 @@
 			? {
 					name: form.name ?? '',
 					description: form.description ?? '',
+					contactEmail: form.contactEmail ?? '',
 					discoverable: form.discoverable !== false
 				}
 			: data.site
@@ -44,6 +45,17 @@
 			Description
 			<textarea name="description" rows="3" maxlength="3000">{site.description}</textarea>
 		</label>
+		<label>
+			Contact email
+			<input
+				type="email"
+				name="contactEmail"
+				value={site.contactEmail}
+				maxlength="254"
+				placeholder="you@example.com"
+			/>
+			<small>Shown publicly on your site as a "write to me" link. Leave empty to hide it.</small>
+		</label>
 		<label class="check">
 			<input type="checkbox" name="discoverable" checked={site.discoverable} />
 			Let search engines index this site
diff --git a/apps/web/src/routes/blob/[did]/[cid]/+server.ts b/apps/web/src/routes/blob/[did]/[cid]/+server.ts
new file mode 100644
index 0000000..7d14e3a
--- /dev/null
+++ b/apps/web/src/routes/blob/[did]/[cid]/+server.ts
@@ -0,0 +1,43 @@
+import { error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { pdsEndpoint, resolveDidDocument } from '$lib/server/atmosphere';
+import { isBlobWidth } from '$lib/blob-proxy';
+
+const DID_PATTERN = /^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$/;
+const CID_PATTERN = /^[a-z0-9]+$/;
+
+/**
+ * Serves a blob from the owner's PDS through the site's own origin, resized
+ * where the platform supports it. The source is always the PDS the DID
+ * document names, so the route cannot proxy arbitrary origins.
+ */
+export const GET: RequestHandler = async ({ params, url, fetch }) => {
+	if (!DID_PATTERN.test(params.did) || !CID_PATTERN.test(params.cid)) {
+		error(400, 'Not a blob reference.');
+	}
+	const width = Number(url.searchParams.get('w'));
+	if (!isBlobWidth(width)) error(400, 'Unsupported width.');
+
+	const didDocument = await resolveDidDocument(params.did, { fetch }).catch(() => undefined);
+	const pds = didDocument && pdsEndpoint(didDocument);
+	if (!pds) error(404, 'No PDS resolves for this DID.');
+
+	const source = new URL('/xrpc/com.atproto.sync.getBlob', pds);
+	source.searchParams.set('did', params.did);
+	source.searchParams.set('cid', params.cid);
+
+	// Image transformations apply when enabled on the zone; a failed transform
+	// falls back to the untouched blob.
+	let upstream = await fetch(source, {
+		cf: { image: { width, fit: 'scale-down', format: 'webp' } }
+	} as RequestInit);
+	if (!upstream.ok) upstream = await fetch(source);
+	if (!upstream.ok) error(502, 'The PDS did not serve this blob.');
+
+	const headers = new Headers();
+	const contentType = upstream.headers.get('content-type');
+	if (contentType) headers.set('content-type', contentType);
+	// Blobs are content-addressed; the response never changes for a given URL.
+	headers.set('cache-control', 'public, max-age=31536000, immutable');
+	return new Response(upstream.body, { headers });
+};
diff --git a/docs/NEXT.md b/docs/NEXT.md
index 17d4883..177edba 100644
--- a/docs/NEXT.md
+++ b/docs/NEXT.md
@@ -2,7 +2,7 @@
 
 The flight plan. Each item carries enough context to start cold; update this file whenever an item lands (move it to "Done") or a new one is queued. Decisions made while working an item still go through `decisions/` as usual.
 
-_Last updated: 2026-08-24 (**theme UX overhaul landed** — PR #20 merged, hero/IA PR in review. Remaining tail: /about content, lexicon republication for `heroSection.style`, re-critique after deploy)._
+_Last updated: 2026-08-24 (**re-critique after deploy: 31/40**, up from 25. Follow-up round in flight: contact CTA + career clamp + blob proxy + polish sweep)._
 
 ## Where things stand
 
@@ -14,10 +14,12 @@ Feasibility is done and the verdict was **build it** (see `FEASIBILITY.md`). All
 
 Done so far: OAuth login (loopback dev client; hosted-client path ready pending a real key + deploy) with D1-backed state/session stores; lexicon convention tests; **read-only adapters** for Bluesky (profile + posts, replies filtered), standard.site (documents/publications, `pub.leaflet.document` fallback only when no standard.site docs exist), and sifa (profile/positions/education/skills, defensively parsed) — fetch-injected modules in `apps/web/src/lib/server/atmosphere/` with unit tests, plus `detectSources` (drives the ADR 0012 default section order) and a source-overview admin page; **site/page authoring** — record builders, PDS writes through the OAuth session, and the `/admin` + `/admin/pages` CRUD routes; **the professional-presence theme** — the render pipeline in `apps/web/src/lib/server/render/` and the public routes at `/s/[handle]`. Remaining, roughly in dependency order:
 
-- **Theme UX overhaul, remaining tail** (the overhaul itself landed 2026-08-24 — see Done; design mockups on the "Mooring Theme Redesign" Claude Design canvas artifact, critique snapshot in `.impeccable/critique/`):
-  1. *Content* — replace the "TODO TODO" placeholder on jzweifel.dev/about; the reference instance demos the product.
-  2. *Lexicon republication* — `page.mooring.site#heroSection` gained an optional `style` field (`band` | `postcard`); the renderer already honours it and resolving PDSes tolerate the unknown field, but the on-network schema record should be republished when convenient (runbook §§3–4).
-  3. *Re-critique* — re-run the structured critique against the deployed site to move the 25/40 baseline; remaining known gaps: no RSS, no avatar downscaling (PDS serves the full-res blob; needs an image-resizing path if it ever matters), postcard hero unexercised by a real site record.
+- **Theme UX overhaul, remaining tail** (the overhaul landed 2026-08-24 and re-critiqued at **31/40** (from 25) — snapshots in `.impeccable/critique/`; the follow-up round — contact CTA, career clamp, blob proxy, polish sweep — is on the `claude/contact-cta-and-polish` PR):
+  1. *Content* — replace the "TODO TODO" placeholder on jzweifel.dev/about; the reference instance demos the product. Also: set `contactEmail` in /admin so the new "Write to me" / "Say hello →" affordances render (they answer the re-critique's P0 — "Open to" advertised availability with no way to act).
+  2. *Enable Image Transformations on the mooring.page zone* (dashboard toggle) so the new `/blob` route (ADR 0015) actually resizes — until then it proxies originals (≈1.45MB of hero imagery per first view). Ratify ADR 0015 while at it.
+  3. *Lexicon republication* — `heroSection.style` and the site record's `contactEmail` are new optional fields; republish the on-network schema when convenient (runbook §§3–4).
+  4. *Record-level career curation fields* (decided 2026-08-24, staged): the template now clamps the sifa summary and caps skills, but curation (hide/order/feature for positions, education, skills — e.g. de-emphasizing a high-school entry or dropping generic skills) should become `careerSection` fields edited in admin, once the admin UI grows a section editor.
+  5. *Re-critique after the next deploy*; residual known gaps: no RSS, mono-metadata density (flat 10.9–11.5px cluster — the detector's one finding), postcard hero unexercised by a real record, career-before-writing default order questioned when posts carry the personality.
 - **Thin deletion-honoring cache** over the direct PDS reads (ADR 0010 §4) — deliberately reordered below hosting on 2026-08-07: rendering reads live per request, which is correct until there is traffic to cache. Revisit once sites are actually served; when it comes up, start from Jetstream v2's snapshot+tail replay (`research/2026-08-14-bluesky-protocol-services.md`) rather than a relay consumer.
 - Later, when token-refresh races become real: a Durable-Object `requestLock` for the OAuth client.
 
diff --git a/docs/decisions/adr/0015-blob-serving-through-the-renderer.md b/docs/decisions/adr/0015-blob-serving-through-the-renderer.md
new file mode 100644
index 0000000..7f22968
--- /dev/null
+++ b/docs/decisions/adr/0015-blob-serving-through-the-renderer.md
@@ -0,0 +1,44 @@
+# 0015 — Blob serving through the renderer
+
+Status: Proposed (2026-08-24)
+
+## Context
+
+Rendered sites embed the owner's avatar and banner straight from the PDS via
+`com.atproto.sync.getBlob`. PDSes serve blobs at original size — a 2000×2000
+avatar (≈1MB) backs a 128px slot, and the two hero images together weigh
+≈1.45MB per first view. There is no PDS-side resizing, and third-party PDS
+hosts also observe every visitor's IP when blobs load cross-origin.
+
+Cloudflare Workers can request image transformations on a fetch via
+`cf.image` options when Image Transformations are enabled on the zone; in
+`wrangler dev` a low-fidelity mock applies, and a failed transformation
+returns a non-ok response the caller can fall back from.
+
+## Decision
+
+Rendered sites serve profile blobs through a first-party route,
+`/blob/{did}/{cid}?w={width}`:
+
+- The route resolves the DID document and fetches the blob **only from the
+  PDS that document names** — it is not an open proxy.
+- Widths are restricted to a fixed allowlist (256 for avatars, 1600 for
+  banners) to bound the cache-variant space.
+- The upstream fetch carries `cf: { image: { width, fit: 'scale-down',
+  format: 'webp' } }`; a non-ok response falls back to fetching the
+  untransformed blob. Without transformations enabled the route is a plain
+  pass-through proxy.
+- Responses are cached immutably (`max-age=31536000, immutable`) — blob URLs
+  are content-addressed by CID.
+- Theme components rewrite PDS getBlob URLs to this route at render time;
+  `og:image` keeps the absolute PDS URL, since view models stay
+  request-independent (ADR 0005) and unfurlers need an absolute URL.
+
+## Consequences
+
+- Image bandwidth moves from the user's PDS to our Worker; visitor IPs no
+  longer reach third-party PDS hosts for image loads.
+- Image Transformations must be enabled on the mooring.page zone for
+  resizing to take effect (dashboard toggle; per-transformation billing
+  above the free tier). Until then the route just proxies originals.
+- A future deletion-honoring cache (ADR 0010 §4) can sit behind this route.
diff --git a/lexicons/page/mooring/site.json b/lexicons/page/mooring/site.json
index 9b7cfdd..cf8b9f1 100644
--- a/lexicons/page/mooring/site.json
+++ b/lexicons/page/mooring/site.json
@@ -23,6 +23,12 @@
             "maxLength": 30000,
             "description": "Short description of the site, used for meta tags and previews."
           },
+          "contactEmail": {
+            "type": "string",
+            "maxGraphemes": 254,
+            "maxLength": 2540,
+            "description": "Public contact email, rendered as a contact affordance on the site. Publishing an address here makes it world-readable."
+          },
           "icon": {
             "type": "blob",
             "accept": ["image/*"],