diff --git a/CHANGELOG.md b/CHANGELOG.md
index f980fd9..e433327 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,25 @@ through a browser store and has not been submitted. No surface is stable.
 
 ## [Unreleased]
 
+### Removed
+
+- **Annotations, entirely.** The daemon's `annot` module, the `/_control/annotations` routes,
+  the extension's content script, and the two npm dependencies it pulled in. souta's call, and
+  the right one: a site that wants notes should have notes built into it, and this product's
+  job is to let you see that site working.
+  What it bought is a property rather than a saving. **The daemon has no write path to a
+  remote** — not "writes are restricted", absent. The SFTP requests it can issue are `OPEN`,
+  `CLOSE`, `READ`, `OPENDIR`, `READDIR` and `REALPATH`, and the only open flag it defines is
+  `FXF_READ`; `RemoteFs` has no `append` or `mkdirs` to call.
+  The extension lost its only content script with it, so it no longer runs in, reads from, or
+  modifies the sites it opens, and it dropped the `scripting` permission and the
+  `http://*/*` optional host permission. It now asks for `proxy`, `storage` and
+  `http://127.0.0.1/*` and nothing else. The bundle went from ~152 KB to ~14 KB, of which the
+  138 KB content script was parsed on every page load.
+  Also gone with it: `--author` and `[server] author`, which existed only to name a log;
+  `Entry.owner` and the `longname` owner parse, which existed only to check one; and
+  `SECURITY.md`'s two sections about what was written and who a log belonged to.
+
 ### Fixed
 
 - The extension was never attached to a release automatically. `release-assets.yml`
diff --git a/PRIVACY.md b/PRIVACY.md
index 3c0d372..e972c41 100644
--- a/PRIVACY.md
+++ b/PRIVACY.md
@@ -20,19 +20,13 @@ In `chrome.storage.local`, which is local to your browser profile:
 | aliases | the alias names the daemon reported, e.g. `docs`, `cluster` |
 
 The control token is the piece worth singling out. It lives in the extension's service worker
-and is never handed to a content script, because a page served from an alias origin is code
-from the remote host and the extension treats it as untrusted. That is why annotating asks the
-worker to act rather than acting inside the page.
+and nothing else ever holds it, because a page served from an alias origin is code from the
+remote host and the extension treats it as untrusted.
 
 ## What it reads
 
-On a page under your configured suffix, and on no other page:
-
-- **the page's URL**, which is how the extension knows which document a note belongs to
-- **the page's text**, when it places a note — anchoring means finding the quoted words again,
-  which cannot be done without reading them
-
-Both stay in the browser except as described next.
+Nothing on any page. The extension has no content script: it does not run in, read from, or
+modify the sites it helps you open. What loads is the site, unchanged.
 
 ## Where anything goes
 
@@ -40,9 +34,9 @@ To `http://127.0.0.1:<your port>`, and nowhere else. That is your own daemon, on
 machine. It passes what it is given to the SSH host you configured, over your own SSH
 connection, as the account you already had.
 
-A note you write is therefore stored on your host, in a file beside the document, under your
-own name. Nobody else receives it and nobody else can, because there is no intermediary to
-receive it.
+Nothing is written to your host. The daemon has no write path: the SFTP requests it can issue
+are `OPEN`, `CLOSE`, `READ`, `OPENDIR`, `READDIR` and `REALPATH`, and the only open flag it
+defines is read.
 
 You can check rather than take this on trust: `extension/src/background.ts` contains exactly
 one `fetch`, in `callDaemon`, and its URL begins `http://127.0.0.1:`.
@@ -60,20 +54,14 @@ one `fetch`, in `callDaemon`, and its URL begins `http://127.0.0.1:`.
   it. Without it you would configure the browser's proxy by hand instead.
 - **`storage`** — remembers the four things above, so you do not retype a 64-character token
   on every page.
-- **`scripting`** — registers the annotation script at runtime, for your configured suffix
-  only. At runtime precisely so the extension need not declare a match pattern covering every
-  site: the suffix is yours to choose, and anything declared in advance would have to be broad
-  enough for any choice you might make.
-- **`http://127.0.0.1/*`** — talking to your daemon.
-- **`http://*/*`, optional, requested when you click Connect** — the narrowest pattern that
-  can be *declared* ahead of time, because your suffix is not known until you connect. What is
-  actually *requested* is `http://*.<your suffix>/*`, and that is what the browser asks you to
-  approve. Declining leaves reading working and annotation off.
+- **`http://127.0.0.1/*`** — talking to your daemon. It is the only host the extension is
+  allowed to reach, and there is no optional permission to grant later: it never asks to run
+  on the sites you open.
 
 ## Removing it
 
-Uninstalling deletes everything in the table above with it. Notes already written are files on
-your own host and stay there; delete them as you would any other file.
+Uninstalling deletes everything in the table above with it. Nothing of yours is left behind
+anywhere else, because nothing of yours was written anywhere else.
 
 ## Questions
 
diff --git a/README.md b/README.md
index b554856..3be33ab 100644
--- a/README.md
+++ b/README.md
@@ -261,17 +261,14 @@ cached, so a seek does not pull the whole file and does not evict the page bodie
 make revisits free. `If-Range` is never honoured, because the only validator on offer
 is weak and the whole representation is the specified answer to that.
 
-Annotations are per-author append-only logs beside the document, so two people annotating
-one page write to different files and neither can lose the other's work. They are reachable
-from the control API directly,
-
-```
-curl -H "x-ssh-browser-token: $TOKEN" -X POST   --data '{"doc":"docs/index.html","op":"add","body":"a note"}'   http://127.0.0.1:7391/_control/annotations
-```
-
-and the extension draws them. Highlights use the CSS Custom Highlight API and the panel is a
-closed shadow root, so the document is never modified — no wrapper elements, no `<style>`
-node, nothing a page script can see by walking the DOM.
+**Nothing is written to your remote.** Not restricted, absent: the SFTP requests this can
+issue are `OPEN`, `CLOSE`, `READ`, `OPENDIR`, `READDIR` and `REALPATH`, and the only open
+flag it defines is `FXF_READ`. Nothing is injected into a page either — the extension has no
+content script, so what you see is the site, unchanged.
+
+There used to be an annotation feature here, writing per-author logs into a sidecar
+directory. It is gone. A site that wants notes should have notes built into it; this is for
+seeing that site work.
 
 Four things are said rather than hidden, because each one means somebody's note is not
 saying what it appears to say:
diff --git a/SECURITY.md b/SECURITY.md
index 14b68e4..0c468c9 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -42,9 +42,9 @@ consume an interactive credential.
 
 ## The control API
 
-Writes will go through a control API. It exists now, even though nothing writes yet,
-because the boundary is easier to get right before there is something behind it than
-after. Three things keep it away from the pages this daemon serves.
+The control API is how the extension opens a host, stops one, and chooses a theme. It
+writes nothing to your remote — see **Nothing is ever written** — but it does have effects,
+and three things keep it away from the pages this daemon serves.
 
 **It is routed only for requests whose Host is the loopback listener.** That is a
 different classification from an alias request, so a page served under an alias origin
@@ -117,29 +117,21 @@ means underneath any page already open in it, which is the one thing an origin m
 The comparison resolves `~` first, so `~/work` and `/home/me/work` are recognised as the
 same place rather than refused as different ones.
 
-## What the control API writes
+## Nothing is ever written
 
-Exactly one shape of path:
+This daemon has no write path to your remote. Not "writes are restricted to one shape of
+path" — there is no code that writes.
 
-```
-<dir>/.ssh-browser/<filename>/ann/<author>.jsonl
-```
+That is checkable rather than promised. The SFTP requests it can issue are `OPEN`, `CLOSE`,
+`READ`, `OPENDIR`, `READDIR` and `REALPATH`, and the only open flag it defines is
+`FXF_READ`. `WRITE` and `MKDIR` are not in the wire module; `RemoteFs` has no `append` or
+`mkdirs` to call.
 
-Nothing else. The path is computed from the document rather than taken from the request,
-so a caller cannot name a destination at all. The document is resolved through the same
-guards the read path uses — normalised after percent-decoding, and refused if any
-component is a symlink — and the symlink rule matters more here than on the read side,
-because a write that reached through a symlinked directory could place a file outside the
-alias base entirely.
-
-**The author is this daemon's configuration, not the request's.** A caller cannot write as
-somebody else however it words the request. The id of a new annotation is minted by the
-daemon and carries the author within it, and the timestamp is the daemon's clock: a caller
-able to choose either could name someone else or reorder their log.
-
-Writes are appends. A log has exactly one writer by construction, which is the only
-arrangement that is safe without a lock, and it is why the format is per-author logs
-rather than one shared file.
+It reached that state by losing a feature. Annotations used to be written into a sidecar
+directory beside each document, with per-author append-only logs and an ownership check on
+them. They are gone, because they were the wrong thing for this product to own: a site that
+wants notes should have notes built into it, and this daemon's job is to let you see that
+site working.
 
 ## What is never served
 
@@ -166,36 +158,3 @@ through the control API, which does not come this way.
 
 This is not a permission system. Everything else under the base is readable by anything else
 under the base, and that is what an origin means.
-
-## Who a log really belongs to
-
-A log's filename is the only thing naming its author, so the filename is checked against
-the file's owner. Two different problems show up in the same place.
-
-The first is a misconfiguration: this daemon is set to write as `souta` while the SSH
-account it reaches the host as is somebody else. Every note it writes then carries a name
-nobody can support.
-
-The second is a forgery. On a group-writable annotation directory, whoever gets there
-first creates the file. If bob creates `alice.jsonl`, he can write records whose ids begin
-`alice:` — and those ids are exactly what the merge accepts as alice's. POSIX permissions
-are what should prevent this; the check is what notices when they did not.
-
-The owner comes from the `longname` field of a listing, which is the only place SFTP v3
-carries an owner's *name*. The numeric `uid` in the attrs cannot answer the question at
-all: turning a number into an account name needs a passwd lookup, and the transport never
-runs a shell. The parse declines anything that is not clearly a listing line, and a remote
-that prints a number where a name should go is reported as unchecked rather than as a
-mismatch — reading it as a mismatch would accuse whoever the number belongs to.
-
-Three outcomes, and **"not checked" is kept apart from "checked and fine"**. The check is
-worthless if a reader cannot tell those apart, and a daemon talking to a server that
-reports owners differently would otherwise look as though it had verified something.
-
-It costs nothing. The owner arrives on the listing a load already performs, so there is no
-faster variant of this that works by skipping it.
-
-**This is detection, not prevention.** By the time a mismatch is visible the records are
-already written, and nothing here deletes them: hiding somebody's annotations on the
-strength of a parsed `ls -l` line would be the worse failure. The mismatch is shown beside
-the note, naming both the author the log claims and the account that owns the file.
diff --git a/crates/ssh-browser/src/annot/mod.rs b/crates/ssh-browser/src/annot/mod.rs
deleted file mode 100644
index f769154..0000000
--- a/crates/ssh-browser/src/annot/mod.rs
+++ /dev/null
@@ -1,942 +0,0 @@
-//! Annotations as per-author append-only logs.
-//!
-//! There is no central authority here, so the three things one would normally provide —
-//! a total order, an identity, and a notification — are replaced rather than reproduced.
-//!
-//! The order is not reproduced at all: it is made unnecessary. Every log has exactly one
-//! writer, so merging is a set union of lines, which is commutative, idempotent and
-//! associative. The order the logs are read in cannot change the result, and nobody has
-//! to agree on anything.
-//!
-//! The identity is the SSH account, which is what the log's filename says. A record's id
-//! carries its author too, so a log that tries to touch someone else's record is ignored
-//! rather than obeyed — and "you cannot delete someone else's annotation" stops being a
-//! rule anyone has to enforce and becomes a fact about the shape of the data.
-//!
-//! Notification is not this module's problem; it is a `readdir` of one directory, which
-//! returns every log's mtime and size in a single round trip.
-
-use std::collections::HashMap;
-
-use anyhow::{Context, Result, anyhow, ensure};
-use serde::{Deserialize, Serialize};
-
-use crate::fs::RemoteFs;
-
-/// The directory that holds a document's sidecar data.
-///
-/// Beside the document rather than in one central place, so that copying a tree copies
-/// its annotations along with it.
-pub const SIDECAR: &str = ".ssh-browser";
-
-const ID_BYTES: usize = 8;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum Op {
-    Add,
-    Update,
-    Delete,
-}
-
-/// One line of one author's log.
-///
-/// No `author` field, deliberately. The author is the log's filename, which is a fact the
-/// filesystem owns; a field would be a second source for the same thing and the two could
-/// disagree.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct Record {
-    pub op: Op,
-    pub id: String,
-    /// Unix epoch seconds.
-    ///
-    /// A number rather than an RFC 3339 string: rendering one needs a calendar, and a
-    /// number cannot be ambiguous about its timezone. It is also not what orders the log —
-    /// position in the file does that, because the file is append-only and a clock is not
-    /// trustworthy.
-    pub at: u64,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub body: Option<String>,
-    /// Carried through without interpretation.
-    ///
-    /// Anchoring belongs to the extension, because the extension is what has a DOM.
-    /// Storing selectors opaquely means a new selector type needs no daemon release, which
-    /// matters when the two halves ship through different channels at different speeds.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub selectors: Option<serde_json::Value>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub reply_to: Option<String>,
-}
-
-/// Whether the filesystem agrees with what a log's filename claims about its author.
-///
-/// The claim is worth checking because it is the only thing naming an author, and on a
-/// group-writable directory somebody else may get there first: a log called `alice.jsonl`
-/// that bob created lets bob write records with ids beginning `alice:`, which [`merge`] will
-/// accept and attribute to alice. Permissions are what should stop that. This is what
-/// notices when they did not.
-///
-/// Detection, not prevention. By the time a reader can see a mismatch the forged records are
-/// already on disk, so the useful thing is to say so rather than to imply otherwise.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
-#[serde(tag = "state", rename_all = "lowercase")]
-pub enum Attribution {
-    /// The log is owned by the account its filename names.
-    Owned,
-    /// It is owned by somebody else, who is named here.
-    Mismatched { owner: String },
-    /// Nothing was checked, because the remote did not report an owner legibly.
-    ///
-    /// Kept apart from `Owned` deliberately. The whole value of the check is lost if "not
-    /// checked" and "checked and fine" look the same to a reader.
-    Unchecked,
-}
-
-/// Judge one log's filename against the owner a listing reported.
-pub fn attribution(author: &str, owner: Option<&str>) -> Attribution {
-    match owner {
-        None => Attribution::Unchecked,
-        // A remote that could not resolve a uid to a name prints the number instead. That is
-        // no evidence about a name, so it cannot be evidence of a mismatch — calling it one
-        // would accuse whoever the number turns out to belong to — and it is no evidence of
-        // agreement either.
-        //
-        // Tested before the names are compared, and that order is the whole point. An author
-        // configured as `1000`, which `is_safe_name` permits, would otherwise match an
-        // unresolved uid of 1000 and be reported as verified on the strength of two numerals
-        // coinciding. "Not checked" and "checked and fine" have to stay apart even when the
-        // strings happen to be equal.
-        Some(who) if who.bytes().all(|b| b.is_ascii_digit()) => Attribution::Unchecked,
-        Some(who) if who == author => Attribution::Owned,
-        Some(who) => Attribution::Mismatched {
-            owner: who.to_string(),
-        },
-    }
-}
-
-/// What a reader sees after the logs are folded together.
-#[derive(Debug, Clone, PartialEq, Serialize)]
-pub struct Annotation {
-    pub id: String,
-    pub author: String,
-    pub at: u64,
-    pub body: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub selectors: Option<serde_json::Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reply_to: Option<String>,
-    /// Carried per annotation although the fact is per log.
-    ///
-    /// A reader renders annotations, so putting it here saves the half that ships through a
-    /// store review from having to join against a separate table of authors.
-    pub attribution: Attribution,
-}
-
-pub struct AuthorLog {
-    pub author: String,
-    pub records: Vec<Record>,
-    /// What the filesystem says about whether this log is really `author`'s.
-    pub attribution: Attribution,
-}
-
-/// What `load` found, including what it could not read.
-#[derive(Debug)]
-pub struct Loaded {
-    pub annotations: Vec<Annotation>,
-    /// Lines that did not parse.
-    ///
-    /// Counted and reported rather than hidden. One line written by some future version
-    /// must not make every other annotation quietly invisible, and a caller that knows how
-    /// many were skipped can say so.
-    pub skipped: usize,
-}
-
-/// Mint an id for a new record.
-///
-/// The author is part of the id, which is what makes ownership checkable without a
-/// registry: any reader can tell whose record it is by looking at it.
-pub fn new_id(author: &str) -> Result<String> {
-    ensure!(is_safe_name(author), "author {author:?} is not a safe name");
-    let mut bytes = [0u8; ID_BYTES];
-    getrandom::fill(&mut bytes).map_err(|e| anyhow!("reading OS entropy for an id: {e}"))?;
-    let mut hex = String::with_capacity(ID_BYTES * 2);
-    for b in bytes {
-        hex.push(nibble(b >> 4));
-        hex.push(nibble(b & 0x0f));
-    }
-    Ok(format!("{author}:{hex}"))
-}
-
-fn nibble(n: u8) -> char {
-    match n {
-        0..=9 => (b'0' + n) as char,
-        _ => (b'a' + n - 10) as char,
-    }
-}
-
-/// Does this id belong to this author?
-fn owns(author: &str, id: &str) -> bool {
-    id.split_once(':').is_some_and(|(owner, _)| owner == author)
-}
-
-/// Safe as a single path component.
-///
-/// An author name becomes a filename, so a name that could climb out of its directory is
-/// a path traversal with extra steps.
-pub(crate) fn is_safe_name(s: &str) -> bool {
-    !s.is_empty()
-        && s.len() <= 64
-        && !s.starts_with('.')
-        && !s.contains("..")
-        && s.bytes()
-            .all(|b| b.is_ascii_alphanumeric() || b == b'-' || b == b'_' || b == b'.')
-}
-
-/// Where a document's annotation logs live.
-///
-/// `/srv/docs/index.html` becomes `/srv/docs/.ssh-browser/index.html/ann`.
-pub fn ann_dir(doc: &str) -> String {
-    let (parent, name) = match doc.rsplit_once('/') {
-        Some((p, n)) => (p, n),
-        None => ("", doc),
-    };
-    format!("{parent}/{SIDECAR}/{name}/ann")
-}
-
-/// Fold every author's log into the annotations that survive.
-///
-/// Within one log, later lines win over earlier ones, and position in the file is the
-/// ordering. Across logs there is nothing to order: an id belongs to exactly one author, so
-/// two logs never describe the same record, which is why the union is commutative and why
-/// no lock is needed anywhere in this design.
-pub fn merge(logs: &[AuthorLog]) -> Vec<Annotation> {
-    let mut live: HashMap<String, Annotation> = HashMap::new();
-
-    for log in logs {
-        for record in &log.records {
-            // An id names its author, and a log naming someone else's record is ignored.
-            // File permissions should already have prevented it, but a shared account has
-            // no permissions to rely on and this check costs nothing.
-            if !owns(&log.author, &record.id) {
-                continue;
-            }
-
-            match record.op {
-                Op::Delete => {
-                    live.remove(&record.id);
-                }
-                Op::Add | Op::Update => {
-                    let entry = live.entry(record.id.clone()).or_insert_with(|| Annotation {
-                        id: record.id.clone(),
-                        author: log.author.clone(),
-                        at: record.at,
-                        body: String::new(),
-                        selectors: None,
-                        reply_to: None,
-                        attribution: log.attribution.clone(),
-                    });
-                    entry.at = record.at;
-                    if let Some(body) = &record.body {
-                        entry.body = body.clone();
-                    }
-                    if record.selectors.is_some() {
-                        entry.selectors = record.selectors.clone();
-                    }
-                    if record.reply_to.is_some() {
-                        entry.reply_to = record.reply_to.clone();
-                    }
-                }
-            }
-        }
-    }
-
-    let mut out: Vec<Annotation> = live.into_values().collect();
-    // Sorted so the same logs always produce the same order however the files were read.
-    // Without this the union would be commutative in content but not in presentation,
-    // which is a difference a caller would notice and come to depend on.
-    out.sort_by(|a, b| (a.at, &a.id).cmp(&(b.at, &b.id)));
-    out
-}
-
-/// Parse a log, reporting how many lines could not be read.
-///
-/// A malformed line is skipped rather than failing the load. One bad line — from a future
-/// version of the format, or a partial write — must not make every other annotation
-/// invisible.
-pub fn parse(body: &[u8]) -> (Vec<Record>, usize) {
-    let mut records = Vec::new();
-    let mut skipped = 0;
-    for line in body.split(|b| *b == b'\n') {
-        if line.iter().all(u8::is_ascii_whitespace) {
-            continue;
-        }
-        match serde_json::from_slice::<Record>(line) {
-            Ok(r) => records.push(r),
-            Err(_) => skipped += 1,
-        }
-    }
-    (records, skipped)
-}
-
-/// The author a log belongs to, taken from its filename.
-fn author_of(path: &str) -> Result<String> {
-    let name = path.rsplit('/').next().unwrap_or(path);
-    let author = name
-        .strip_suffix(".jsonl")
-        .with_context(|| format!("log file {name:?} does not end in .jsonl"))?;
-    ensure!(
-        is_safe_name(author),
-        "log file {name:?} is not a safe author name"
-    );
-    Ok(author.to_string())
-}
-
-pub struct Store<'a, F> {
-    fs: &'a F,
-}
-
-impl<'a, F: RemoteFs> Store<'a, F> {
-    pub fn new(fs: &'a F) -> Self {
-        Self { fs }
-    }
-
-    /// Read every author's annotations for one document.
-    pub async fn load(&self, doc: &str) -> Result<Loaded> {
-        let dir = ann_dir(doc);
-        let entries = match self.fs.list_dir(&dir).await {
-            Ok(entries) => entries,
-            // No annotation directory means no annotations. That is the ordinary case for
-            // every document nobody has annotated, so it is not an error.
-            Err(e) if crate::fs::is_absent(&e) => {
-                return Ok(Loaded {
-                    annotations: Vec::new(),
-                    skipped: 0,
-                });
-            }
-            // Anything else is a real failure and must not read as an empty page. A dropped
-            // session or a permission problem would otherwise hide every note anybody had
-            // written — including the mismatch warnings this module exists to surface — and
-            // would look exactly like a document nobody had annotated.
-            Err(e) => return Err(e.context(format!("listing {dir}"))),
-        };
-
-        // The owner travels with the path because the listing already reported it. That is
-        // what makes checking who wrote a log cost nothing: it rides the round trip this
-        // load was going to spend anyway, so there is no version of this that is cheaper by
-        // skipping the check.
-        let logs_found: Vec<(String, Option<String>)> = entries
-            .iter()
-            .filter(|e| !e.attrs.is_dir() && e.name.ends_with(".jsonl"))
-            .map(|e| (format!("{dir}/{}", e.name), e.owner.clone()))
-            .collect();
-        if logs_found.is_empty() {
-            return Ok(Loaded {
-                annotations: Vec::new(),
-                skipped: 0,
-            });
-        }
-        let paths: Vec<String> = logs_found.iter().map(|(p, _)| p.clone()).collect();
-
-        // Every author's log in one batch, so the cost does not grow with the number of
-        // people annotating.
-        let bodies = self.fs.read_batch(&paths).await;
-
-        let mut logs = Vec::new();
-        let mut skipped = 0;
-        for ((path, owner), body) in logs_found.iter().zip(bodies) {
-            let author = author_of(path)?;
-            let attribution = attribution(&author, owner.as_deref());
-            let body = body.with_context(|| format!("reading {path}"))?;
-            let (records, bad) = parse(&body);
-            skipped += bad;
-            logs.push(AuthorLog {
-                author,
-                records,
-                attribution,
-            });
-        }
-
-        Ok(Loaded {
-            annotations: merge(&logs),
-            skipped,
-        })
-    }
-
-    /// Append one record to one author's log.
-    pub async fn append(&self, doc: &str, author: &str, record: &Record) -> Result<()> {
-        ensure!(is_safe_name(author), "author {author:?} is not a safe name");
-        // Refused here as well as ignored at merge time. Writing a record that would then
-        // be discarded on read is a silent no-op, and a caller deserves to be told.
-        ensure!(
-            owns(author, &record.id),
-            "record {} does not belong to {author}",
-            record.id
-        );
-
-        let dir = ann_dir(doc);
-        self.fs
-            .mkdirs(&dir)
-            .await
-            .with_context(|| format!("creating {dir}"))?;
-
-        let mut line = serde_json::to_vec(record).context("serialising the record")?;
-        line.push(b'\n');
-        let path = format!("{dir}/{author}.jsonl");
-        self.fs
-            .append(&path, &line)
-            .await
-            .with_context(|| format!("appending to {path}"))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::testing::{FakeRemote, file_attrs};
-
-    const DOC: &str = "/srv/index.html";
-
-    async fn store_over_empty_tree() -> crate::fs::sftp::SftpFs {
-        FakeRemote::new().dir("/srv", vec![]).spawn().await
-    }
-
-    fn rec(op: Op, id: &str, at: u64, body: Option<&str>) -> Record {
-        Record {
-            op,
-            id: id.to_string(),
-            at,
-            body: body.map(str::to_string),
-            selectors: None,
-            reply_to: None,
-        }
-    }
-
-    fn log(author: &str, records: Vec<Record>) -> AuthorLog {
-        AuthorLog {
-            author: author.to_string(),
-            records,
-            attribution: Attribution::Owned,
-        }
-    }
-
-    #[test]
-    fn annotations_live_beside_their_document() {
-        assert_eq!(
-            ann_dir("/srv/docs/index.html"),
-            "/srv/docs/.ssh-browser/index.html/ann"
-        );
-        assert_eq!(ann_dir("/a.html"), "/.ssh-browser/a.html/ann");
-    }
-
-    #[test]
-    fn an_id_carries_its_author() {
-        let id = new_id("souta").expect("entropy");
-        assert!(id.starts_with("souta:"));
-        assert!(owns("souta", &id));
-        assert!(!owns("alice", &id));
-        assert!(new_id("../etc").is_err());
-    }
-
-    /// The whole reason the format is per-author logs: the order they are read in cannot
-    /// matter, so no lock and no agreement is needed.
-    #[test]
-    fn merging_is_commutative() {
-        let a = || {
-            log(
-                "alice",
-                vec![rec(Op::Add, "alice:1", 10, Some("from alice"))],
-            )
-        };
-        let b = || log("bob", vec![rec(Op::Add, "bob:1", 20, Some("from bob"))]);
-
-        let forward = merge(&[a(), b()]);
-        let backward = merge(&[b(), a()]);
-        assert_eq!(forward, backward);
-        assert_eq!(forward.len(), 2);
-    }
-
-    #[test]
-    fn merging_is_idempotent() {
-        let once = merge(&[log(
-            "alice",
-            vec![rec(Op::Add, "alice:1", 10, Some("hello"))],
-        )]);
-        let twice = merge(&[
-            log("alice", vec![rec(Op::Add, "alice:1", 10, Some("hello"))]),
-            log("alice", vec![rec(Op::Add, "alice:1", 10, Some("hello"))]),
-        ]);
-        assert_eq!(once, twice);
-    }
-
-    /// Position in the file is the ordering, not the clock: the second line wins even
-    /// though its timestamp is older.
-    #[test]
-    fn later_lines_win_over_earlier_ones_regardless_of_timestamp() {
-        let merged = merge(&[log(
-            "alice",
-            vec![
-                rec(Op::Add, "alice:1", 100, Some("first")),
-                rec(Op::Update, "alice:1", 50, Some("second")),
-            ],
-        )]);
-        assert_eq!(merged.len(), 1);
-        assert_eq!(merged[0].body, "second");
-        assert_eq!(merged[0].at, 50, "the later line's timestamp is kept");
-    }
-
-    #[test]
-    fn a_delete_removes_the_annotation() {
-        let merged = merge(&[log(
-            "alice",
-            vec![
-                rec(Op::Add, "alice:1", 10, Some("hello")),
-                rec(Op::Delete, "alice:1", 20, None),
-            ],
-        )]);
-        assert!(merged.is_empty());
-    }
-
-    /// Authorisation falling out of the shape of the data rather than out of a rule
-    /// someone has to remember to check.
-    #[test]
-    fn a_log_cannot_touch_another_authors_record() {
-        let merged = merge(&[
-            log("alice", vec![rec(Op::Add, "alice:1", 10, Some("mine"))]),
-            // Bob's log trying to delete Alice's annotation, and to edit it.
-            log(
-                "bob",
-                vec![
-                    rec(Op::Delete, "alice:1", 20, None),
-                    rec(Op::Update, "alice:1", 30, Some("vandalised")),
-                ],
-            ),
-        ]);
-        assert_eq!(merged.len(), 1);
-        assert_eq!(merged[0].body, "mine");
-        assert_eq!(merged[0].author, "alice");
-    }
-
-    #[test]
-    fn the_author_comes_from_the_filename() {
-        assert_eq!(
-            author_of("/srv/.ssh-browser/a.html/ann/souta.jsonl").unwrap(),
-            "souta"
-        );
-        assert!(author_of("/srv/ann/souta.txt").is_err());
-        assert!(author_of("/srv/ann/...jsonl").is_err());
-    }
-
-    #[test]
-    fn unsafe_author_names_are_refused() {
-        assert!(!is_safe_name(""));
-        assert!(!is_safe_name("../etc"));
-        assert!(!is_safe_name("a/b"));
-        assert!(!is_safe_name(".hidden"));
-        assert!(!is_safe_name(&"x".repeat(65)));
-        assert!(is_safe_name("souta"));
-        assert!(is_safe_name("first.last"));
-        assert!(is_safe_name("user_1-2"));
-    }
-
-    /// One unreadable line must not hide the rest, and the count must be reported rather
-    /// than swallowed.
-    #[test]
-    fn a_malformed_line_is_skipped_and_counted() {
-        let body = b"{\"op\":\"add\",\"id\":\"alice:1\",\"at\":10,\"body\":\"ok\"}\nnot json\n{\"op\":\"add\",\"id\":\"alice:2\",\"at\":20}\n";
-        let (records, skipped) = parse(body);
-        assert_eq!(records.len(), 2);
-        assert_eq!(skipped, 1);
-    }
-
-    #[test]
-    fn blank_lines_are_not_counted_as_damage() {
-        let (records, skipped) = parse(b"\n\n  \n");
-        assert!(records.is_empty());
-        assert_eq!(skipped, 0);
-    }
-
-    #[test]
-    fn a_record_round_trips_through_json() {
-        let record = Record {
-            op: Op::Add,
-            id: "souta:a1b2c3d4e5f6a7b8".to_string(),
-            at: 1_757_600_000,
-            body: Some("a note".to_string()),
-            selectors: Some(serde_json::json!([{"type": "TextQuoteSelector"}])),
-            reply_to: Some("alice:1".to_string()),
-        };
-        let line = serde_json::to_vec(&record).expect("serialises");
-        let (back, skipped) = parse(&line);
-        assert_eq!(skipped, 0);
-        assert_eq!(back.len(), 1);
-        assert_eq!(back[0].id, record.id);
-        assert_eq!(back[0].at, record.at);
-        assert_eq!(back[0].reply_to.as_deref(), Some("alice:1"));
-        assert!(back[0].selectors.is_some(), "selectors survive untouched");
-    }
-
-    /// A reply is an ordinary record in the replier's own log, which is what makes a thread
-    /// work without anyone writing to anyone else's file.
-    #[test]
-    fn a_reply_to_another_authors_annotation_is_just_a_record() {
-        let mut reply = rec(Op::Add, "bob:1", 20, Some("agreed"));
-        reply.reply_to = Some("alice:1".to_string());
-        let merged = merge(&[
-            log("alice", vec![rec(Op::Add, "alice:1", 10, Some("a claim"))]),
-            log("bob", vec![reply]),
-        ]);
-        assert_eq!(merged.len(), 2);
-        assert_eq!(merged[1].reply_to.as_deref(), Some("alice:1"));
-        assert_eq!(merged[1].author, "bob");
-    }
-
-    #[tokio::test]
-    async fn a_record_written_comes_back_out() {
-        let fs = store_over_empty_tree().await;
-        let store = Store::new(&fs);
-        let id = new_id("souta").expect("entropy");
-
-        store
-            .append(DOC, "souta", &rec(Op::Add, &id, 100, Some("a note")))
-            .await
-            .expect("append");
-
-        let loaded = store.load(DOC).await.expect("load");
-        assert_eq!(loaded.skipped, 0);
-        assert_eq!(loaded.annotations.len(), 1);
-        assert_eq!(loaded.annotations[0].body, "a note");
-        assert_eq!(
-            loaded.annotations[0].author, "souta",
-            "the author comes from the filename the daemon chose, not from the record"
-        );
-    }
-
-    /// Two people annotating one document touch different files, so neither can lose the
-    /// other's work. This is the property the whole format exists for.
-    #[tokio::test]
-    async fn two_authors_do_not_overwrite_each_other() {
-        let fs = store_over_empty_tree().await;
-        let store = Store::new(&fs);
-        let souta = new_id("souta").expect("entropy");
-        let alice = new_id("alice").expect("entropy");
-
-        store
-            .append(DOC, "souta", &rec(Op::Add, &souta, 100, Some("from souta")))
-            .await
-            .expect("souta appends");
-        store
-            .append(DOC, "alice", &rec(Op::Add, &alice, 200, Some("from alice")))
-            .await
-            .expect("alice appends");
-
-        let loaded = store.load(DOC).await.expect("load");
-        assert_eq!(loaded.annotations.len(), 2);
-        let bodies: Vec<&str> = loaded.annotations.iter().map(|a| a.body.as_str()).collect();
-        assert!(bodies.contains(&"from souta"));
-        assert!(bodies.contains(&"from alice"));
-    }
-
-    /// An edit is another line, not a rewrite of the file. That is what makes it safe
-    /// without a lock.
-    #[tokio::test]
-    async fn an_update_appends_rather_than_rewriting() {
-        let fs = store_over_empty_tree().await;
-        let store = Store::new(&fs);
-        let id = new_id("souta").expect("entropy");
-
-        store
-            .append(DOC, "souta", &rec(Op::Add, &id, 100, Some("first")))
-            .await
-            .expect("add");
-        store
-            .append(DOC, "souta", &rec(Op::Update, &id, 200, Some("edited")))
-            .await
-            .expect("update");
-
-        let loaded = store.load(DOC).await.expect("load");
-        assert_eq!(
-            loaded.annotations.len(),
-            1,
-            "an update is not a second record"
-        );
-        assert_eq!(loaded.annotations[0].body, "edited");
-    }
-
-    #[tokio::test]
-    async fn a_delete_survives_a_round_trip() {
-        let fs = store_over_empty_tree().await;
-        let store = Store::new(&fs);
-        let id = new_id("souta").expect("entropy");
-
-        store
-            .append(DOC, "souta", &rec(Op::Add, &id, 100, Some("doomed")))
-            .await
-            .expect("add");
-        store
-            .append(DOC, "souta", &rec(Op::Delete, &id, 200, None))
-            .await
-            .expect("delete");
-
-        assert!(store.load(DOC).await.expect("load").annotations.is_empty());
-    }
-
-    /// The ordinary case for every document nobody has annotated: no directory, no error.
-    #[tokio::test]
-    async fn a_document_with_no_annotations_loads_empty() {
-        let fs = store_over_empty_tree().await;
-        let store = Store::new(&fs);
-        let loaded = store.load(DOC).await.expect("load");
-        assert!(loaded.annotations.is_empty());
-        assert_eq!(loaded.skipped, 0);
-    }
-
-    /// Refused at write time as well as ignored at merge time. Writing a record that would
-    /// be silently discarded on read is worse than an error.
-    #[tokio::test]
-    async fn appending_someone_elses_record_is_refused() {
-        let fs = store_over_empty_tree().await;
-        let store = Store::new(&fs);
-        let alice = new_id("alice").expect("entropy");
-
-        let result = store
-            .append(DOC, "souta", &rec(Op::Add, &alice, 100, Some("vandalism")))
-            .await;
-        assert!(
-            result.is_err(),
-            "souta must not be able to write a record owned by alice"
-        );
-    }
-
-    #[test]
-    fn a_log_owned_by_the_account_it_names_is_owned() {
-        assert_eq!(attribution("souta", Some("souta")), Attribution::Owned);
-    }
-
-    /// The forgery this exists to catch: bob got to `alice.jsonl` first, so records with
-    /// ids beginning `alice:` are bob's and would otherwise read as alice's.
-    #[test]
-    fn a_log_owned_by_somebody_else_is_a_mismatch() {
-        assert_eq!(
-            attribution("alice", Some("bob")),
-            Attribution::Mismatched {
-                owner: "bob".to_string()
-            }
-        );
-    }
-
-    /// Two different reasons to conclude nothing, and neither may be reported as agreement.
-    #[test]
-    fn no_legible_owner_means_unchecked_rather_than_fine() {
-        assert_eq!(attribution("souta", None), Attribution::Unchecked);
-        // A remote that could not resolve the uid prints the number. Calling that a mismatch
-        // would accuse whoever the number belongs to, which may well be souta.
-        assert_eq!(attribution("souta", Some("1000")), Attribution::Unchecked);
-    }
-
-    /// An unresolved uid is not evidence of agreement either, even when the author happens to
-    /// be spelled the same way. `is_safe_name` permits a numeric author, so this is reachable
-    /// by configuration rather than only in theory, and reporting it as verified would be the
-    /// one thing the three-valued answer exists to prevent.
-    #[test]
-    fn a_numeric_author_matching_an_unresolved_uid_is_still_unchecked() {
-        assert_eq!(attribution("1000", Some("1000")), Attribution::Unchecked);
-        assert!(
-            is_safe_name("1000"),
-            "the case is reachable by configuration"
-        );
-    }
-
-    /// Free, and that is the design claim: the owner arrives on the listing `load` already
-    /// spends. Measured as a comparison rather than against a fixed number, because the
-    /// claim is about the difference — a later "improvement" that stat'ed each log to find
-    /// its owner would break this while every other test kept passing.
-    #[tokio::test]
-    async fn checking_who_wrote_each_log_costs_no_extra_round_trips() {
-        async fn cost_of_load(remote: FakeRemote) -> (u64, Attribution) {
-            let fs = remote.spawn().await;
-            let store = Store::new(&fs);
-            let id = new_id("souta").expect("entropy");
-            store
-                .append(DOC, "souta", &rec(Op::Add, &id, 100, Some("mine")))
-                .await
-                .expect("append");
-
-            let before = fs.round_trips();
-            let loaded = store.load(DOC).await.expect("load");
-            let attribution = loaded.annotations[0].attribution.clone();
-            (fs.round_trips() - before, attribution)
-        }
-
-        let (with_owner, checked) =
-            cost_of_load(FakeRemote::new().reached_as("souta").dir("/srv", vec![])).await;
-        let (without_owner, unchecked) = cost_of_load(FakeRemote::new().dir("/srv", vec![])).await;
-
-        assert_eq!(checked, Attribution::Owned, "an owner was reported");
-        assert_eq!(unchecked, Attribution::Unchecked, "none was");
-        assert_eq!(
-            with_owner, without_owner,
-            "the check rides the listing rather than adding to it"
-        );
-    }
-
-    /// Invariant 1 on the annotation path: ten authors cost what one does. This is what the
-    /// per-author format is for — reading them is one batch, not one request each.
-    #[tokio::test]
-    async fn a_document_with_ten_authors_costs_what_one_author_costs() {
-        fn tree(authors: usize) -> FakeRemote {
-            let dir = ann_dir(DOC);
-            let logs: Vec<(String, String)> = (0..authors)
-                .map(|i| {
-                    (
-                        format!("author{i}.jsonl"),
-                        format!(
-                            "{{\"op\":\"add\",\"id\":\"author{i}:1\",\"at\":10,\"body\":\"x\"}}\n"
-                        ),
-                    )
-                })
-                .collect();
-
-            let mut remote = FakeRemote::new().dir(
-                &dir,
-                logs.iter()
-                    .map(|(name, line)| (name.as_str(), file_attrs(line.len() as u64, 1)))
-                    .collect(),
-            );
-            for (name, line) in &logs {
-                remote = remote.file(&format!("{dir}/{name}"), line.as_bytes());
-            }
-            remote
-        }
-
-        async fn cost_of_load(remote: FakeRemote, expected: usize) -> u64 {
-            let fs = remote.spawn().await;
-            let before = fs.round_trips();
-            let loaded = Store::new(&fs).load(DOC).await.expect("load");
-            assert_eq!(loaded.annotations.len(), expected);
-            fs.round_trips() - before
-        }
-
-        let one = cost_of_load(tree(1), 1).await;
-        let ten = cost_of_load(tree(10), 10).await;
-        assert_eq!(
-            one, ten,
-            "the cost must not grow with the number of authors"
-        );
-    }
-
-    /// The question `SECURITY.md` used to leave open: this daemon is configured to write as
-    /// souta, but the account it actually reaches the remote as is somebody else.
-    #[tokio::test]
-    async fn a_configured_author_the_remote_does_not_write_as_is_caught() {
-        let fs = FakeRemote::new()
-            .reached_as("sshimozono")
-            .dir("/srv", vec![])
-            .spawn()
-            .await;
-        let store = Store::new(&fs);
-        let id = new_id("souta").expect("entropy");
-        store
-            .append(DOC, "souta", &rec(Op::Add, &id, 100, Some("a note")))
-            .await
-            .expect("append");
-
-        let loaded = store.load(DOC).await.expect("load");
-        assert_eq!(loaded.annotations.len(), 1, "the note is still shown");
-        assert_eq!(
-            loaded.annotations[0].attribution,
-            Attribution::Mismatched {
-                owner: "sshimozono".to_string()
-            },
-            "the log says souta, the filesystem says sshimozono"
-        );
-    }
-
-    /// A mismatch is surfaced, never censored. Dropping the records would hide somebody's
-    /// annotations on the strength of a heuristic parse of an `ls -l` line.
-    #[tokio::test]
-    async fn a_mismatched_log_still_yields_its_annotations() {
-        let body = b"{\"op\":\"add\",\"id\":\"alice:1\",\"at\":10,\"body\":\"is this alice?\"}\n";
-        let dir = ann_dir(DOC);
-        let fs = FakeRemote::new()
-            .dir(
-                &dir,
-                vec![("alice.jsonl", file_attrs(body.len() as u64, 1))],
-            )
-            .owner(&format!("{dir}/alice.jsonl"), "bob")
-            .file(&format!("{dir}/alice.jsonl"), body)
-            .spawn()
-            .await;
-
-        let loaded = Store::new(&fs).load(DOC).await.expect("load");
-        assert_eq!(loaded.annotations.len(), 1);
-        assert_eq!(loaded.annotations[0].author, "alice");
-        assert_eq!(loaded.annotations[0].body, "is this alice?");
-        assert_eq!(
-            loaded.annotations[0].attribution,
-            Attribution::Mismatched {
-                owner: "bob".to_string()
-            }
-        );
-    }
-
-    /// The one refusal that is an ordinary answer. Every document nobody has annotated has
-    /// no sidecar directory, and saying so is not an error.
-    #[tokio::test]
-    async fn a_missing_annotation_directory_is_not_an_error() {
-        let fs = store_over_empty_tree().await;
-        let loaded = Store::new(&fs).load(DOC).await.expect("load");
-        assert!(loaded.annotations.is_empty());
-    }
-
-    /// And every other refusal is. A listing that fails for any reason other than absence
-    /// must not come back as "nobody has annotated this": that hides whatever anybody wrote,
-    /// including the mismatch warnings this module exists to raise, behind a page that looks
-    /// perfectly normal. This is the failure `CONTRIBUTING.md` names, one layer up from where
-    /// it was found the first time.
-    #[tokio::test]
-    async fn a_refused_listing_is_an_error_rather_than_an_empty_page() {
-        const PERMISSION_DENIED: u32 = 3;
-        let dir = ann_dir(DOC);
-        let fs = FakeRemote::new()
-            .dir("/srv", vec![])
-            .dir(&dir, vec![("souta.jsonl", file_attrs(10, 1))])
-            .refuses_listing(&dir, PERMISSION_DENIED)
-            .spawn()
-            .await;
-
-        let e = Store::new(&fs)
-            .load(DOC)
-            .await
-            .expect_err("a refused listing must not read as an empty page");
-        let text = format!("{e:#}");
-        assert!(
-            text.contains("permission denied"),
-            "the error has to say what the remote said, got: {text}"
-        );
-    }
-
-    /// A remote that reports nothing legible must not make every annotation look verified.
-    #[tokio::test]
-    async fn a_remote_that_reports_no_owner_reads_as_unchecked() {
-        let fs = store_over_empty_tree().await;
-        let store = Store::new(&fs);
-        let id = new_id("souta").expect("entropy");
-        store
-            .append(DOC, "souta", &rec(Op::Add, &id, 100, Some("a note")))
-            .await
-            .expect("append");
-
-        let loaded = store.load(DOC).await.expect("load");
-        assert_eq!(loaded.annotations[0].attribution, Attribution::Unchecked);
-    }
-
-    #[tokio::test]
-    async fn an_unsafe_author_name_never_reaches_the_filesystem() {
-        let fs = store_over_empty_tree().await;
-        let store = Store::new(&fs);
-        let result = store
-            .append(DOC, "../etc", &rec(Op::Add, "../etc:1", 100, Some("x")))
-            .await;
-        assert!(result.is_err());
-    }
-}
diff --git a/crates/ssh-browser/src/cache/mod.rs b/crates/ssh-browser/src/cache/mod.rs
index 7fbefc5..ef6f549 100644
--- a/crates/ssh-browser/src/cache/mod.rs
+++ b/crates/ssh-browser/src/cache/mod.rs
@@ -31,7 +31,7 @@ struct Listing {
     /// `listing_entries` hands back an `Entry`, and an `Entry` with no owner asserts that
     /// the remote did not report one. Dropping it here would make the cache quietly say
     /// something false about the remote rather than something incomplete about itself.
-    entries: HashMap<String, (Attrs, Option<String>)>,
+    entries: HashMap<String, Attrs>,
     fetched: Instant,
 }
 
@@ -118,7 +118,7 @@ impl Cache {
         if listing.fetched.elapsed() >= self.ttl {
             return None;
         }
-        listing.entries.get(name).map(|(attrs, _)| *attrs)
+        listing.entries.get(name).copied()
     }
 
     /// A fresh listing as entries, for rendering a directory index.
@@ -135,10 +135,9 @@ impl Cache {
             listing
                 .entries
                 .iter()
-                .map(|(name, (attrs, owner))| Entry {
+                .map(|(name, attrs)| Entry {
                     name: name.clone(),
                     attrs: *attrs,
-                    owner: owner.clone(),
                 })
                 .collect(),
         )
@@ -147,7 +146,7 @@ impl Cache {
     pub fn put_listing(&self, dir: &str, entries: &[Entry]) {
         let map = entries
             .iter()
-            .map(|e| (e.name.clone(), (e.attrs, e.owner.clone())))
+            .map(|e| (e.name.clone(), e.attrs))
             .collect::<HashMap<_, _>>();
         self.listings
             .lock()
@@ -251,7 +250,6 @@ mod tests {
         Entry {
             name: name.to_string(),
             attrs: a,
-            owner: Some("souta".to_string()),
         }
     }
 
diff --git a/crates/ssh-browser/src/config/mod.rs b/crates/ssh-browser/src/config/mod.rs
index eeb0aef..6c44dc8 100644
--- a/crates/ssh-browser/src/config/mod.rs
+++ b/crates/ssh-browser/src/config/mod.rs
@@ -23,7 +23,6 @@ use crate::origin::Alias;
 pub struct Server {
     pub port: Option<u16>,
     pub suffix: Option<String>,
-    pub author: Option<String>,
     /// What directory listings look like. See `crate::theme`.
     ///
     /// The starting value only: a theme chosen later from the dashboard is remembered
@@ -120,7 +119,6 @@ pub const DEFAULT_SUFFIX: &str = "ssh-browser";
 pub struct Overrides {
     pub port: Option<u16>,
     pub suffix: Option<String>,
-    pub author: Option<String>,
     pub aliases: Vec<Alias>,
 }
 
@@ -129,7 +127,6 @@ pub struct Overrides {
 pub struct Resolved {
     pub port: u16,
     pub suffix: String,
-    pub author: String,
     pub aliases: Vec<Alias>,
 }
 
@@ -142,7 +139,7 @@ pub struct Resolved {
 /// The command line wins, because it is what was typed for this run. Aliases are the
 /// exception and are added rather than replacing: naming one host on the command line should
 /// not silently drop the six in the file.
-pub fn merge(cli: Overrides, file: Config, default_author: String) -> Result<Resolved> {
+pub fn merge(cli: Overrides, file: Config) -> Result<Resolved> {
     let mut aliases = file.aliases;
     aliases.extend(cli.aliases);
     ensure_distinct(&aliases)?;
@@ -153,7 +150,6 @@ pub fn merge(cli: Overrides, file: Config, default_author: String) -> Result<Res
             .suffix
             .or(file.server.suffix)
             .unwrap_or_else(|| DEFAULT_SUFFIX.to_string()),
-        author: cli.author.or(file.server.author).unwrap_or(default_author),
         aliases,
     })
 }
@@ -185,7 +181,6 @@ mod tests {
 [server]
 port = 7391
 suffix = "ssh-browser"
-author = "souta"
 
 [[alias]]
 name = "docs"
@@ -203,7 +198,6 @@ base = "/home/me/public_html"
         let c = parse(FULL).expect("parses");
         assert_eq!(c.server.port, Some(7391));
         assert_eq!(c.server.suffix.as_deref(), Some("ssh-browser"));
-        assert_eq!(c.server.author.as_deref(), Some("souta"));
         assert_eq!(c.aliases.len(), 2);
         assert_eq!(c.aliases[0].name(), "docs");
         assert_eq!(c.aliases[1].base(), Some("/home/me/public_html"));
@@ -302,7 +296,6 @@ base = "/home/me/public_html"
             Server {
                 port: Some(1111),
                 suffix: Some("from-file".to_string()),
-                author: Some("from-file".to_string()),
                 theme: None,
                 scheme: None,
             },
@@ -311,14 +304,12 @@ base = "/home/me/public_html"
         let cli = Overrides {
             port: Some(2222),
             suffix: Some("from-cli".to_string()),
-            author: Some("from-cli".to_string()),
             aliases: vec![],
         };
 
-        let r = merge(cli, file, "fallback".to_string()).expect("merges");
+        let r = merge(cli, file).expect("merges");
         assert_eq!(r.port, 2222);
         assert_eq!(r.suffix, "from-cli");
-        assert_eq!(r.author, "from-cli");
     }
 
     #[test]
@@ -327,28 +318,21 @@ base = "/home/me/public_html"
             Server {
                 port: Some(1111),
                 suffix: Some("from-file".to_string()),
-                author: None,
                 theme: None,
                 scheme: None,
             },
             vec![],
         );
 
-        let r = merge(Overrides::default(), file, "fallback".to_string()).expect("merges");
+        let r = merge(Overrides::default(), file).expect("merges");
         assert_eq!(r.port, 1111);
         assert_eq!(r.suffix, "from-file");
         // Neither said, so the default stands.
-        assert_eq!(r.author, "fallback");
     }
 
     #[test]
     fn what_neither_supplies_falls_back() {
-        let r = merge(
-            Overrides::default(),
-            file_with(Server::default(), vec![]),
-            "fallback".to_string(),
-        )
-        .expect("merges");
+        let r = merge(Overrides::default(), file_with(Server::default(), vec![])).expect("merges");
         assert_eq!(r.port, DEFAULT_PORT);
         assert_eq!(r.suffix, DEFAULT_SUFFIX);
     }
@@ -363,7 +347,6 @@ base = "/home/me/public_html"
                 ..Overrides::default()
             },
             file_with(Server::default(), vec![alias("file", "h")]),
-            "fallback".to_string(),
         )
         .expect("merges");
 
@@ -381,7 +364,6 @@ base = "/home/me/public_html"
                 ..Overrides::default()
             },
             file_with(Server::default(), vec![alias("docs", "from-file")]),
-            "fallback".to_string(),
         )
         .expect_err("refused");
         assert!(format!("{e:#}").contains("docs"), "{e:#}");
diff --git a/crates/ssh-browser/src/control/mod.rs b/crates/ssh-browser/src/control/mod.rs
index f433fe0..0f9bbeb 100644
--- a/crates/ssh-browser/src/control/mod.rs
+++ b/crates/ssh-browser/src/control/mod.rs
@@ -230,7 +230,7 @@ struct Hello<'a> {
 /// refusal if there is one.
 ///
 /// Separated from routing so that a caller cannot reach a route without going through it:
-/// there is no path to the annotation handlers that does not pass this function first.
+/// there is no path to a control route that does not pass this function first.
 /// Whether a request could have come from a page.
 ///
 /// Measured rather than assumed. In Chromium an extension's `fetch` arrives with
@@ -461,7 +461,7 @@ mod tests {
     #[test]
     fn routes_are_named_after_the_prefix() {
         assert_eq!(route_of("/_control/hello"), "hello");
-        assert_eq!(route_of("/_control/annotations"), "annotations");
+        assert_eq!(route_of("/_control/open"), "open");
         assert_eq!(route_of("/not-control"), "");
     }
 
diff --git a/crates/ssh-browser/src/fs/mod.rs b/crates/ssh-browser/src/fs/mod.rs
index a2d91cc..dcf1e93 100644
--- a/crates/ssh-browser/src/fs/mod.rs
+++ b/crates/ssh-browser/src/fs/mod.rs
@@ -56,12 +56,6 @@ pub fn is_absent(e: &anyhow::Error) -> bool {
 pub struct Entry {
     pub name: String,
     pub attrs: Attrs,
-    /// The owner's account name, when the listing reported one legibly.
-    ///
-    /// `None` means the remote did not say, or said it in a shape not worth guessing at —
-    /// not that the file is unowned. Callers have to keep those two apart, because the one
-    /// thing this feeds is the check on who wrote an annotation log.
-    pub owner: Option<String>,
 }
 
 /// One byte range of one file.
@@ -112,23 +106,6 @@ pub trait RemoteFs {
     /// that a reader waits for.
     async fn home(&self) -> Result<String>;
 
-    /// Append bytes to a file, creating it if absent.
-    ///
-    /// Append rather than write, and single rather than batched, because that is the
-    /// only write this design needs and the only one that is safe without a lock. A log
-    /// has exactly one writer by construction, so an append cannot interleave with
-    /// anyone else's — which is precisely why the annotation format is per-author logs
-    /// and not one shared file.
-    async fn append(&self, path: &str, bytes: &[u8]) -> Result<()>;
-
-    /// Create a directory and every missing parent.
-    ///
-    /// Every level is issued at once and per-level failures are ignored: a level that
-    /// already exists reports one, and the only outcome that matters is whether the
-    /// deepest level is there afterwards. Walking down a level per round trip would
-    /// cost depth round trips for something that happens once per document.
-    async fn mkdirs(&self, path: &str) -> Result<()>;
-
     /// Flushes issued so far. One flush is one remote round trip, so this is the
     /// invariant made observable, and assertable in tests.
     fn round_trips(&self) -> u64;
diff --git a/crates/ssh-browser/src/fs/sftp.rs b/crates/ssh-browser/src/fs/sftp.rs
index 3372666..0c72126 100644
--- a/crates/ssh-browser/src/fs/sftp.rs
+++ b/crates/ssh-browser/src/fs/sftp.rs
@@ -18,16 +18,14 @@ use tokio::sync::{mpsc, oneshot};
 use super::{Entry, RangeReq, Refused, RemoteFs};
 use crate::sftp::transport::{self, SshChild};
 use crate::sftp::wire::{
-    Attrs, CLOSE, DATA, Dec, Enc, FXF_APPEND, FXF_CREAT, FXF_READ, FXF_WRITE, HANDLE, MKDIR, NAME,
-    OPEN, OPENDIR, READ, READDIR, REALPATH, STATUS, STATUS_EOF, STATUS_OK, WRITE,
-    owner_of_longname,
+    Attrs, CLOSE, DATA, Dec, Enc, FXF_READ, HANDLE, NAME, OPEN, OPENDIR, READ, READDIR, REALPATH,
+    STATUS, STATUS_EOF,
 };
 use crate::sftp::{Reply, Rx, Sftp, Tx};
 
 const QUEUE_DEPTH: usize = 1024;
 const MAX_BATCH: usize = 256;
 const READ_CHUNK: u32 = 32 * 1024;
-const WRITE_CHUNK: usize = 32 * 1024;
 
 /// How long the writer waits for sibling callers before committing to a flush.
 /// Against a 16 ms RTT this costs roughly 1%, and it is what collapses N
@@ -120,13 +118,11 @@ fn decode_names(payload: &[u8]) -> Result<Vec<Entry>> {
     let mut out = Vec::with_capacity(count as usize);
     for _ in 0..count {
         let name = String::from_utf8_lossy(d.str().context("filename")?).into_owned();
-        // The longname is the only place a v3 listing carries the owner's *name*. The
-        // attrs carry a numeric uid, which cannot be compared with an account name
-        // without a passwd lookup the sftp subsystem has no way to perform.
-        let longname = String::from_utf8_lossy(d.str().context("longname")?).into_owned();
-        let owner = owner_of_longname(&longname).map(str::to_string);
+        // Read and discarded: the field is on the wire whether or not anything wants it,
+        // and a decoder that skipped it would read the attrs from the wrong offset.
+        d.str().context("longname")?;
         let attrs = Attrs::decode(&mut d).context("attrs")?;
-        out.push(Entry { name, attrs, owner });
+        out.push(Entry { name, attrs });
     }
     Ok(out)
 }
@@ -381,101 +377,6 @@ impl RemoteFs for SftpFs {
         Ok(path)
     }
 
-    async fn append(&self, path: &str, bytes: &[u8]) -> Result<()> {
-        // WRITE | APPEND | CREAT. In append mode the server ignores the offset in each
-        // WRITE and places the data at the end, which is what makes this safe for a
-        // single writer with no lock at all. It would not be safe for two, and the
-        // annotation format is per-author logs precisely so that there are never two.
-        let opened = await_reply(
-            self.issue(
-                OPEN,
-                Enc::new()
-                    .str(path.as_bytes())
-                    .u32(FXF_WRITE | FXF_APPEND | FXF_CREAT)
-                    .u32(0)
-                    .done(),
-            )
-            .await?,
-        )
-        .await?;
-        let handle = handle_from(&opened, path)?;
-
-        // Chunked and issued together, for the same reason reads are.
-        let mut rxs = Vec::new();
-        let mut at = 0usize;
-        while at < bytes.len() {
-            let end = at.saturating_add(WRITE_CHUNK).min(bytes.len());
-            rxs.push(
-                self.issue(
-                    WRITE,
-                    Enc::new()
-                        .str(&handle)
-                        .u64(at as u64)
-                        .str(&bytes[at..end])
-                        .done(),
-                )
-                .await?,
-            );
-            at = end;
-        }
-
-        // Every reply is drained before returning, and any failure is kept. A write that
-        // reported an error and was treated as success would lose an annotation while
-        // telling the user it was saved.
-        let mut failure = None;
-        for rx in rxs {
-            match await_reply(rx).await {
-                Ok(r) => {
-                    let code = Dec::new(r.payload()).u32().unwrap_or(u32::MAX);
-                    if r.kind != STATUS || code != STATUS_OK {
-                        failure = Some(anyhow!("writing {path} failed with sftp status {code}"));
-                    }
-                }
-                Err(e) => failure = Some(e),
-            }
-        }
-
-        let _ = self.issue(CLOSE, Enc::new().str(&handle).done()).await;
-        match failure {
-            Some(e) => Err(e),
-            None => Ok(()),
-        }
-    }
-
-    async fn mkdirs(&self, path: &str) -> Result<()> {
-        let mut levels = Vec::new();
-        let mut at = String::new();
-        for part in path.split('/').filter(|p| !p.is_empty()) {
-            at.push('/');
-            at.push_str(part);
-            levels.push(at.clone());
-        }
-
-        let mut rxs = Vec::with_capacity(levels.len());
-        for level in &levels {
-            rxs.push(
-                self.issue(MKDIR, Enc::new().str(level.as_bytes()).u32(0).done())
-                    .await?,
-            );
-        }
-        for rx in rxs {
-            // Ignored on purpose. "Already exists" and "created" are both acceptable
-            // outcomes here and servers do not report them distinguishably.
-            let _ = await_reply(rx).await;
-        }
-
-        // The only check worth making: is it a directory now? Trusting the mkdir replies
-        // would report success for a path that is not there, which is the failure mode
-        // this whole codebase is trying not to have.
-        let one = [path.to_string()];
-        let mut got = self.list_dirs(&one).await;
-        match got.pop() {
-            Some(Ok(_)) => Ok(()),
-            Some(Err(e)) => Err(e.context(format!("creating {path}"))),
-            None => Err(anyhow!("list_dirs returned nothing for {path}")),
-        }
-    }
-
     async fn list_dirs(&self, paths: &[String]) -> Vec<Result<Vec<Entry>>> {
         // Every opendir goes out before any reply is awaited, for the same reason
         // read_batch does it. A symlink check walks a whole path, and one round
diff --git a/crates/ssh-browser/src/lib.rs b/crates/ssh-browser/src/lib.rs
index a090151..be2940c 100644
--- a/crates/ssh-browser/src/lib.rs
+++ b/crates/ssh-browser/src/lib.rs
@@ -1,6 +1,5 @@
 //! Turn an SSH host into a real browser origin.
 
-pub mod annot;
 pub mod cache;
 pub mod config;
 pub mod control;
diff --git a/crates/ssh-browser/src/main.rs b/crates/ssh-browser/src/main.rs
index 9085f80..2ff71ee 100644
--- a/crates/ssh-browser/src/main.rs
+++ b/crates/ssh-browser/src/main.rs
@@ -9,7 +9,7 @@ use ssh_browser::origin::{Alias, Origin, pac};
 use ssh_browser::ssh_config;
 use ssh_browser::theme;
 
-const USAGE: &str = "usage:\n  ssh-browser serve [--config FILE] [--port N] [--suffix S] [--author NAME] [--new-token] [<alias>=<ssh-host>[:<base>] ...]\n  ssh-browser pac   [--config FILE] [--port N] [--suffix S]
+const USAGE: &str = "usage:\n  ssh-browser serve [--config FILE] [--port N] [--suffix S] [--new-token] [<alias>=<ssh-host>[:<base>] ...]\n  ssh-browser pac   [--config FILE] [--port N] [--suffix S]
   ssh-browser hosts\n\nWith no --config, a file at <config dir>/ssh-browser/config.toml is used if it exists:\n\n  [server]\n  port = 7391\n  suffix = \"ssh-browser\"\n\n  [[alias]]\n  name = \"docs\"\n  host = \"myhost\"\n  base = \"~/docs\"   # or an absolute path; omit for the home directory itself";
 
 #[tokio::main]
@@ -43,9 +43,6 @@ async fn main() -> Result<()> {
             "--suffix" => {
                 cli.suffix = Some(args.next().context("--suffix needs a value")?.clone());
             }
-            "--author" => {
-                cli.author = Some(args.next().context("--author needs a value")?.clone());
-            }
             // A flag rather than a value, so it consumes nothing: rotating is a thing you
             // do, not a thing you configure.
             "--new-token" => new_token = true,
@@ -75,9 +72,8 @@ async fn main() -> Result<()> {
     let config::Resolved {
         port,
         suffix,
-        author,
         aliases,
-    } = config::merge(cli, from_file, default_author())?;
+    } = config::merge(cli, from_file)?;
 
     match command.as_str() {
         // Prints what the extension's host list will show, so a host that does not
@@ -143,7 +139,6 @@ async fn main() -> Result<()> {
                 "  the extension sends it as {}",
                 ssh_browser::control::TOKEN_HEADER
             );
-            eprintln!("  annotations are written as {author}");
             eprintln!();
 
             // Said before the wait rather than after it, so a slow handshake looks like a
@@ -161,7 +156,7 @@ async fn main() -> Result<()> {
             let theme = theme::remembered()
                 .or_else(|| from_file_theme.clone())
                 .unwrap_or_else(|| theme::DEFAULT.to_string());
-            let bound = Origin::bind(aliases, suffix.clone(), port, token, author, theme).await?;
+            let bound = Origin::bind(aliases, suffix.clone(), port, token, theme).await?;
 
             // Everything from here is true by the time it is said. The routes come from
             // the bound origin rather than from the aliases, because an alias rooted at
@@ -193,23 +188,6 @@ async fn main() -> Result<()> {
     }
 }
 
-/// Who annotations are written as, unless `--author` says otherwise.
-///
-/// The local account name, which is a guess at the remote one. The SFTP transport never
-/// runs a shell, so the remote account is not something this process can ask for, and
-/// inferring it from a home directory path would be a guess presented as a fact. Naming it
-/// explicitly with `--author` is the honest alternative.
-///
-/// The guess does not go unchecked: what a log claims is compared against the owner a
-/// listing reports, and a mismatch is shown beside the note. See `annot::Attribution`. That
-/// comparison uses the owner's *name* out of the listing's `longname`, not the numeric uid,
-/// which cannot answer the question at all.
-fn default_author() -> String {
-    std::env::var("USER")
-        .or_else(|_| std::env::var("USERNAME"))
-        .unwrap_or_else(|_| "unknown".to_string())
-}
-
 /// Parse `<alias>=<ssh-host>[:<absolute-base>]`.
 ///
 /// Without the base it means the remote's home directory, which is the short form worth
diff --git a/crates/ssh-browser/src/origin/mod.rs b/crates/ssh-browser/src/origin/mod.rs
index bfe5aaf..e95acee 100644
--- a/crates/ssh-browser/src/origin/mod.rs
+++ b/crates/ssh-browser/src/origin/mod.rs
@@ -33,10 +33,8 @@ use hyper::server::conn::http1;
 use hyper::service::service_fn;
 use hyper::{Method, Request, Response, StatusCode};
 use hyper_util::rt::TokioIo;
-use serde::{Deserialize, Serialize};
 use tokio::net::TcpListener;
 
-use crate::annot;
 use crate::cache::{self, Cache};
 use crate::control::{self, Token};
 use crate::fs::sftp::SftpFs;
@@ -270,14 +268,6 @@ pub struct Origin {
     /// is one setting for every alias: an origin that looked different from its neighbour
     /// for no reason the reader chose would be a bug rather than a feature.
     theme: RwLock<String>,
-    /// Whose annotations this daemon writes.
-    ///
-    /// Configured rather than discovered. The SFTP transport never runs a shell, so the
-    /// remote account name is not something this process can ask for; guessing it from a
-    /// home directory path would be a guess presented as a fact. What it is checked
-    /// against is the owner a listing reports, which catches a configured name the remote
-    /// does not actually write as — see `annot::Attribution`.
-    author: String,
 }
 
 /// A listening socket and the origin that will answer on it.
@@ -316,7 +306,6 @@ impl Origin {
         suffix: String,
         port: u16,
         token: Token,
-        author: String,
         theme: String,
     ) -> Result<Bound> {
         let addr = SocketAddr::from(([127, 0, 0, 1], port));
@@ -331,17 +320,9 @@ impl Origin {
             pac::is_suffix(&suffix),
             "suffix {suffix:?} must be lowercase letters, digits, hyphens and dots"
         );
-        // The author becomes a filename, and the only check on it used to live inside the
-        // write path. A typo therefore started a daemon that read pages perfectly well and
-        // then answered the reader's first note with a 500. It is configuration, so it is
+        // Refused here rather than at the first listing: it is configuration, so it is
         // refused where the rest of the configuration is.
-        // Refused here rather than at the first listing, for the same reason the author name
-        // is: it is configuration, so it is refused where the rest of the configuration is.
         theme::check(&theme)?;
-        ensure!(
-            annot::is_safe_name(&author),
-            "author {author:?} must be letters, digits, dots, dashes or underscores: it becomes a filename"
-        );
 
         let mut sessions = HashMap::new();
         let mut routes = Vec::new();
@@ -395,7 +376,6 @@ impl Origin {
                 cache: Cache::default(),
                 token,
                 theme: RwLock::new(theme),
-                author,
             }),
             listener,
         })
@@ -524,7 +504,7 @@ impl Origin {
             ) {
                 return refusal;
             }
-            return self.control(method, path, query, body).await;
+            return self.control(method, path, body).await;
         }
 
         if path == "/proxy.pac" {
@@ -751,13 +731,7 @@ impl Origin {
         }
     }
 
-    async fn control(
-        &self,
-        method: &Method,
-        path: &str,
-        query: Option<&str>,
-        body: &[u8],
-    ) -> Response<Full<Bytes>> {
+    async fn control(&self, method: &Method, path: &str, body: &[u8]) -> Response<Full<Bytes>> {
         match (method, control::route_of(path)) {
             (&Method::GET, "hello") => {
                 let aliases = self.alias_names().await;
@@ -768,8 +742,6 @@ impl Origin {
             (&Method::POST, "close") => self.close_alias(body).await,
             (&Method::GET, "theme") => self.show_theme().await,
             (&Method::POST, "theme") => self.set_theme(body).await,
-            (&Method::GET, "annotations") => self.list_annotations(query).await,
-            (&Method::POST, "annotations") => self.add_annotation(body).await,
             (&Method::GET, route) => {
                 control::text(StatusCode::NOT_FOUND, format!("no control route {route:?}"))
             }
@@ -780,32 +752,6 @@ impl Origin {
         }
     }
 
-    /// Turn `<alias>/<path>` into a session and an absolute path.
-    ///
-    /// Runs the same guards the read path runs, and the symlink one matters more here: a
-    /// write that reached through a symlinked directory could place a file outside the
-    /// alias base entirely.
-    async fn resolve_doc(&self, doc: &str) -> Result<(Arc<Session>, String), (StatusCode, String)> {
-        let (alias, rest) = doc.split_once('/').unwrap_or((doc, ""));
-        let Some(session) = self.session(alias).await else {
-            return Err((StatusCode::NOT_FOUND, format!("no alias named {alias:?}")));
-        };
-        let resolved = match guard::resolve(&session.base, &format!("/{rest}")) {
-            Ok(p) => p,
-            Err(e) => return Err((StatusCode::FORBIDDEN, format!("{e:#}"))),
-        };
-
-        let chain = components(&session.base, &resolved);
-        // A failure here shows up as the symlink check below finding nothing to check,
-        // and then as the write failing with the remote's own reason. There is no better
-        // answer to give from here.
-        let held = self.held_listings(&session, &chain).await;
-        if let Some(at) = first_symlink(&held, &chain) {
-            return Err((StatusCode::FORBIDDEN, format!("refusing symlink at {at}")));
-        }
-        Ok((session, resolved))
-    }
-
     /// `GET /_control/hosts`
     ///
     /// What ssh already knows how to reach, which is the list the extension offers. It
@@ -1150,97 +1096,6 @@ impl Origin {
         })
     }
 
-    /// `GET /_control/annotations?doc=<alias>/<path>`
-    async fn list_annotations(&self, query: Option<&str>) -> Response<Full<Bytes>> {
-        let Some(doc) = param(query, "doc") else {
-            return control::text(
-                StatusCode::BAD_REQUEST,
-                "annotations needs a doc parameter, e.g. ?doc=docs/index.html",
-            );
-        };
-        let (session, resolved) = match self.resolve_doc(doc).await {
-            Ok(v) => v,
-            Err((status, detail)) => return control::text(status, detail),
-        };
-
-        match annot::Store::new(&session.fs).load(&resolved).await {
-            Ok(loaded) => control::json(&AnnotationsBody {
-                doc: resolved,
-                annotations: loaded.annotations,
-                skipped: loaded.skipped,
-            }),
-            Err(e) => control::text(StatusCode::INTERNAL_SERVER_ERROR, format!("{e:#}")),
-        }
-    }
-
-    /// `POST /_control/annotations`
-    ///
-    /// The request carries no author. The author is this daemon's, so a caller cannot
-    /// write as somebody else however it words the request.
-    async fn add_annotation(&self, body: &[u8]) -> Response<Full<Bytes>> {
-        let request: AddBody = match serde_json::from_slice(body) {
-            Ok(r) => r,
-            Err(e) => {
-                return control::text(StatusCode::BAD_REQUEST, format!("malformed request: {e}"));
-            }
-        };
-
-        let (session, resolved) = match self.resolve_doc(&request.doc).await {
-            Ok(v) => v,
-            Err((status, detail)) => return control::text(status, detail),
-        };
-
-        // The id is minted here when adding, rather than accepted, so it cannot name an
-        // author other than the one doing the writing. For an update or a delete the
-        // caller has to name the record, and the store checks that the name belongs to
-        // this author before anything is written.
-        let id = match (request.op, request.id) {
-            (annot::Op::Add, None) => match annot::new_id(&self.author) {
-                Ok(id) => id,
-                Err(e) => {
-                    return control::text(StatusCode::INTERNAL_SERVER_ERROR, format!("{e:#}"));
-                }
-            },
-            (annot::Op::Add, Some(_)) => {
-                return control::text(
-                    StatusCode::BAD_REQUEST,
-                    "an id is minted by the daemon; do not send one when adding",
-                );
-            }
-            (_, Some(id)) => id,
-            (_, None) => {
-                return control::text(StatusCode::BAD_REQUEST, "an update or a delete needs an id");
-            }
-        };
-
-        // The timestamp is the daemon's too. A caller that could choose it could reorder
-        // someone's log, and position in the file is what actually decides anything.
-        let at = std::time::SystemTime::now()
-            .duration_since(std::time::UNIX_EPOCH)
-            .map_or(0, |d| d.as_secs());
-
-        let record = annot::Record {
-            op: request.op,
-            id: id.clone(),
-            at,
-            body: request.body,
-            selectors: request.selectors,
-            reply_to: request.reply_to,
-        };
-
-        match annot::Store::new(&session.fs)
-            .append(&resolved, &self.author, &record)
-            .await
-        {
-            Ok(()) => control::json(&AddedBody {
-                id,
-                at,
-                author: &self.author,
-            }),
-            Err(e) => control::text(StatusCode::INTERNAL_SERVER_ERROR, format!("{e:#}")),
-        }
-    }
-
     async fn autoindex_of(
         &self,
         session: &Session,
@@ -1678,48 +1533,6 @@ impl Origin {
     }
 }
 
-#[derive(Serialize)]
-struct AnnotationsBody {
-    doc: String,
-    annotations: Vec<annot::Annotation>,
-    /// Lines that could not be parsed, reported rather than hidden.
-    skipped: usize,
-}
-
-#[derive(Serialize)]
-struct AddedBody<'a> {
-    id: String,
-    at: u64,
-    author: &'a str,
-}
-
-/// No author field, deliberately: see `add_annotation`.
-#[derive(Deserialize)]
-struct AddBody {
-    doc: String,
-    op: annot::Op,
-    /// Absent when adding — the daemon mints it. Required when updating or deleting.
-    #[serde(default)]
-    id: Option<String>,
-    #[serde(default)]
-    body: Option<String>,
-    #[serde(default)]
-    selectors: Option<serde_json::Value>,
-    #[serde(default)]
-    reply_to: Option<String>,
-}
-
-/// One raw value out of a query string.
-///
-/// Deliberately not percent-decoded here: `guard::resolve` decodes the path it is handed,
-/// and decoding twice would turn a literal `%2e%2e` in a filename into a traversal.
-fn param<'q>(query: Option<&'q str>, want: &str) -> Option<&'q str> {
-    query?.split('&').find_map(|pair| {
-        let (key, value) = pair.split_once('=')?;
-        (key == want).then_some(value)
-    })
-}
-
 /// Every step from the alias base down to the file, as `(directory to list, name to
 /// check inside it)`, base first.
 ///
@@ -2311,11 +2124,6 @@ mod tests {
             .expect("request builds")
     }
 
-    async fn json_of(res: Response<Full<Bytes>>) -> serde_json::Value {
-        let bytes = body_of(res).await;
-        serde_json::from_slice(&bytes).expect("a control response is json")
-    }
-
     fn ranged(path: &str, range: &str) -> Request<Empty<Bytes>> {
         Request::builder()
             .uri(format!("http://docs.ssh-browser{path}"))
@@ -2349,7 +2157,6 @@ mod tests {
             cache,
             theme: RwLock::new(theme::DEFAULT.to_string()),
             token: Token::from_hex(TEST_TOKEN),
-            author: "souta".to_string(),
         }
     }
 
@@ -2772,7 +2579,6 @@ mod tests {
             "ssh-browser".to_string(),
             port,
             Token::from_hex(TEST_TOKEN),
-            "souta".to_string(),
             theme::DEFAULT.to_string(),
         )
         .await;
@@ -2902,7 +2708,6 @@ mod tests {
                 permissions: Some(if dir { 0o040755 } else { 0o100644 }),
                 ..Attrs::default()
             },
-            owner: None,
         }
     }
 
@@ -3571,190 +3376,6 @@ mod tests {
         assert_eq!(&body_of(res).await[..], b"hello");
     }
 
-    /// The round trip the extension will make: write one, read it back.
-    #[tokio::test]
-    async fn an_annotation_written_through_control_comes_back_out() {
-        let origin = origin_with(one_page()).await;
-
-        let added = origin
-            .handle(control_post(
-                "/_control/annotations",
-                Some(TEST_TOKEN),
-                r#"{"doc":"docs/a.html","op":"add","body":"a note"}"#,
-            ))
-            .await;
-        assert_eq!(added.status(), StatusCode::OK);
-        let added = json_of(added).await;
-        let id = added["id"].as_str().expect("an id was minted").to_string();
-        assert!(
-            id.starts_with("souta:"),
-            "the id must name the daemon's author, got {id}"
-        );
-        assert_eq!(added["author"], "souta");
-
-        let listed = origin
-            .handle(loopback(
-                "/_control/annotations?doc=docs/a.html",
-                Some(TEST_TOKEN),
-            ))
-            .await;
-        assert_eq!(listed.status(), StatusCode::OK);
-        let listed = json_of(listed).await;
-        assert_eq!(listed["skipped"], 0);
-        let annotations = listed["annotations"].as_array().expect("an array");
-        assert_eq!(annotations.len(), 1);
-        assert_eq!(annotations[0]["body"], "a note");
-        assert_eq!(annotations[0]["id"], id.as_str());
-        assert_eq!(annotations[0]["author"], "souta");
-        // This fixture's remote reports no owner, so the honest answer is that nobody
-        // checked. The field must be there saying so rather than absent, because an
-        // extension cannot tell an absent field from a daemon that verified and approved.
-        assert_eq!(annotations[0]["attribution"]["state"], "unchecked");
-    }
-
-    /// The wire shape the extension reads for a forged log: a tagged state and the name of
-    /// the account that actually owns the file.
-    #[tokio::test]
-    async fn a_mismatched_author_reaches_the_extension_as_json() {
-        let dir = "/srv/.ssh-browser/a.html/ann";
-        let log = b"{\"op\":\"add\",\"id\":\"alice:1\",\"at\":10,\"body\":\"is this alice?\"}\n";
-        let origin = origin_with(
-            one_page()
-                .dir(dir, vec![("alice.jsonl", file_attrs(log.len() as u64, 1))])
-                .owner(&format!("{dir}/alice.jsonl"), "bob")
-                .file(&format!("{dir}/alice.jsonl"), log),
-        )
-        .await;
-
-        let listed = origin
-            .handle(loopback(
-                "/_control/annotations?doc=docs/a.html",
-                Some(TEST_TOKEN),
-            ))
-            .await;
-        assert_eq!(listed.status(), StatusCode::OK);
-        let listed = json_of(listed).await;
-        let annotations = listed["annotations"].as_array().expect("an array");
-        assert_eq!(annotations.len(), 1, "the note is served, not censored");
-        assert_eq!(annotations[0]["author"], "alice");
-        assert_eq!(annotations[0]["attribution"]["state"], "mismatched");
-        assert_eq!(annotations[0]["attribution"]["owner"], "bob");
-    }
-
-    #[tokio::test]
-    async fn writing_an_annotation_without_the_token_is_refused() {
-        let origin = origin_with(one_page()).await;
-        let res = origin
-            .handle(control_post(
-                "/_control/annotations",
-                None,
-                r#"{"doc":"docs/a.html","op":"add","body":"a note"}"#,
-            ))
-            .await;
-        assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
-    }
-
-    /// An id chosen by the caller could name a different author, which the store would
-    /// then refuse. Refusing the id outright removes the possibility instead of catching
-    /// it later.
-    #[tokio::test]
-    async fn an_add_may_not_carry_an_id() {
-        let origin = origin_with(one_page()).await;
-        let res = origin
-            .handle(control_post(
-                "/_control/annotations",
-                Some(TEST_TOKEN),
-                r#"{"doc":"docs/a.html","op":"add","id":"alice:1","body":"x"}"#,
-            ))
-            .await;
-        assert_eq!(res.status(), StatusCode::BAD_REQUEST);
-    }
-
-    #[tokio::test]
-    async fn an_update_without_an_id_is_refused() {
-        let origin = origin_with(one_page()).await;
-        let res = origin
-            .handle(control_post(
-                "/_control/annotations",
-                Some(TEST_TOKEN),
-                r#"{"doc":"docs/a.html","op":"update","body":"x"}"#,
-            ))
-            .await;
-        assert_eq!(res.status(), StatusCode::BAD_REQUEST);
-    }
-
-    #[tokio::test]
-    async fn listing_annotations_needs_a_doc() {
-        let origin = origin_with(one_page()).await;
-        let res = origin
-            .handle(loopback("/_control/annotations", Some(TEST_TOKEN)))
-            .await;
-        assert_eq!(res.status(), StatusCode::BAD_REQUEST);
-    }
-
-    #[tokio::test]
-    async fn an_unknown_alias_is_a_404() {
-        let origin = origin_with(one_page()).await;
-        let res = origin
-            .handle(loopback(
-                "/_control/annotations?doc=nope/a.html",
-                Some(TEST_TOKEN),
-            ))
-            .await;
-        assert_eq!(res.status(), StatusCode::NOT_FOUND);
-    }
-
-    /// A traversal in the doc parameter must not place a log outside the alias base.
-    #[tokio::test]
-    async fn a_traversal_in_the_doc_parameter_is_refused() {
-        let origin = origin_with(one_page()).await;
-        let res = origin
-            .handle(control_post(
-                "/_control/annotations",
-                Some(TEST_TOKEN),
-                r#"{"doc":"docs/../../etc/passwd","op":"add","body":"x"}"#,
-            ))
-            .await;
-        assert_eq!(res.status(), StatusCode::FORBIDDEN);
-    }
-
-    /// The same symlink rule the read path uses, and it matters more here: a write that
-    /// reached through a symlinked directory could place a file outside the base entirely.
-    #[tokio::test]
-    async fn writing_through_a_symlinked_directory_is_refused() {
-        let origin = origin_with(
-            FakeRemote::new()
-                .dir("/srv", vec![("link", symlink_attrs())])
-                .dir("/srv/link", vec![("inside.html", file_attrs(2, 1))])
-                .file("/srv/link/inside.html", b"hi"),
-        )
-        .await;
-
-        let res = origin
-            .handle(control_post(
-                "/_control/annotations",
-                Some(TEST_TOKEN),
-                r#"{"doc":"docs/link/inside.html","op":"add","body":"x"}"#,
-            ))
-            .await;
-        assert_eq!(res.status(), StatusCode::FORBIDDEN);
-    }
-
-    /// A document nobody has annotated is an empty list, not an error.
-    #[tokio::test]
-    async fn an_unannotated_document_lists_empty() {
-        let origin = origin_with(one_page()).await;
-        let res = origin
-            .handle(loopback(
-                "/_control/annotations?doc=docs/a.html",
-                Some(TEST_TOKEN),
-            ))
-            .await;
-        assert_eq!(res.status(), StatusCode::OK);
-        let body = json_of(res).await;
-        assert_eq!(body["annotations"].as_array().expect("array").len(), 0);
-    }
-
     /// The form souta asked for: bring the home directory into the config rather than
     /// writing out another machine's account layout by hand.
     #[tokio::test]
diff --git a/crates/ssh-browser/src/sftp/wire.rs b/crates/ssh-browser/src/sftp/wire.rs
index 107b242..166e54b 100644
--- a/crates/ssh-browser/src/sftp/wire.rs
+++ b/crates/ssh-browser/src/sftp/wire.rs
@@ -5,11 +5,9 @@ pub const VERSION: u8 = 2;
 pub const OPEN: u8 = 3;
 pub const CLOSE: u8 = 4;
 pub const READ: u8 = 5;
-pub const WRITE: u8 = 6;
 pub const LSTAT: u8 = 7;
 pub const OPENDIR: u8 = 11;
 pub const READDIR: u8 = 12;
-pub const MKDIR: u8 = 14;
 pub const REALPATH: u8 = 16;
 pub const STATUS: u8 = 101;
 pub const HANDLE: u8 = 102;
@@ -17,12 +15,8 @@ pub const DATA: u8 = 103;
 pub const NAME: u8 = 104;
 pub const ATTRS: u8 = 105;
 
+/// The only open mode this daemon has. There is no write path.
 pub const FXF_READ: u32 = 0x0000_0001;
-pub const FXF_WRITE: u32 = 0x0000_0002;
-/// In append mode the offset in each WRITE is ignored and the server places the data at
-/// the end. That is what makes a single-writer log safe without any locking.
-pub const FXF_APPEND: u32 = 0x0000_0004;
-pub const FXF_CREAT: u32 = 0x0000_0008;
 
 /// A read ending in SSH_FX_EOF is a normal end of file. Any other status is a
 /// real failure, and conflating the two turns a directory into an empty 200.
@@ -116,11 +110,6 @@ impl<'a> Dec<'a> {
 ///
 /// `size` and `mtime` form the cache key, which is why a single READDIR can
 /// replace a per-file STAT and keep the round trips flat.
-///
-/// `uid` deliberately does not answer "does this log belong to the account it
-/// names": it is a number, an author is a name, and turning one into the other
-/// needs a passwd lookup there is no way to perform over the sftp subsystem.
-/// [`owner_of_longname`] is what answers that.
 #[derive(Debug, Clone, Copy, Default)]
 pub struct Attrs {
     pub size: Option<u64>,
@@ -167,51 +156,6 @@ impl Attrs {
     }
 }
 
-/// The owner's account name out of an SFTP v3 `longname`, if one can be read with
-/// confidence.
-///
-/// Version 3 says only that the field looks like `ls -l` output, so this parses a
-/// convention rather than a grammar, and it is written to decline rather than to
-/// guess. That direction is the whole point. The one thing this feeds is the check
-/// that an annotation log belongs to the account its filename names, and a wrongly
-/// parsed owner would accuse a real person of writing somebody else's log — strictly
-/// worse than having no check at all. So the leading fields are all validated, and
-/// anything unfamiliar yields `None`, which the caller reports as "not checked"
-/// rather than as agreement.
-///
-/// Nothing past the size is looked at. The name at the end may contain spaces, and
-/// the date is the `ls -l` mixture of `Mon DD HH:MM` and `Mon DD  YYYY` depending on
-/// the file's age — neither is needed here, so neither is interpreted.
-pub fn owner_of_longname(longname: &str) -> Option<&str> {
-    let mut fields = longname.split_ascii_whitespace();
-    if !is_mode_string(fields.next()?) {
-        return None;
-    }
-    // Link count and size are parsed only to be discarded: they are what distinguishes
-    // a real listing line from a string that merely opens like one.
-    fields.next()?.parse::<u64>().ok()?;
-    let owner = fields.next()?;
-    let _group = fields.next()?;
-    fields.next()?.parse::<u64>().ok()?;
-    Some(owner)
-}
-
-/// Does this look like the ten-character mode column of a listing?
-fn is_mode_string(s: &str) -> bool {
-    // A trailing `+` or `.` marks an ACL or a security context on some systems, which
-    // says nothing about the owner either way.
-    let b = s
-        .strip_suffix('+')
-        .or_else(|| s.strip_suffix('.'))
-        .unwrap_or(s)
-        .as_bytes();
-    b.len() == 10
-        && matches!(b[0], b'-' | b'd' | b'l' | b'b' | b'c' | b'p' | b's')
-        && b[1..]
-            .iter()
-            .all(|c| matches!(c, b'r' | b'w' | b'x' | b's' | b't' | b'S' | b'T' | b'-'))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -263,59 +207,4 @@ mod tests {
         let a = Attrs::decode(&mut Dec::new(&bytes)).expect("attrs");
         assert_eq!(a.size, Some(1));
     }
-
-    /// The shape OpenSSH's sftp-server produces, which is the one that matters in
-    /// practice, plus the variations other servers are known to add.
-    #[test]
-    fn reads_the_owner_out_of_a_listing_line() {
-        for line in [
-            "-rw-r--r--    1 souta    devs         1234 Sep 12 01:00 souta.jsonl",
-            // An older file: the time column becomes a year, which is not looked at.
-            "-rw-r--r--    1 souta    devs         1234 Sep 12  2024 souta.jsonl",
-            "drwxrwsr-x    2 souta    devs         4096 Sep 12 01:00 ann",
-            // An ACL marker, and a setuid bit in the mode.
-            "-rwsr-xr-x+   1 souta    devs         1234 Sep 12 01:00 x",
-            // A filename with spaces in it, which is why nothing past the size is read.
-            "-rw-r--r--    1 souta    devs         1234 Sep 12 01:00 two words.jsonl",
-        ] {
-            assert_eq!(owner_of_longname(line), Some("souta"), "parsing {line:?}");
-        }
-    }
-
-    /// Declining is the load-bearing behaviour: a guessed owner would accuse somebody
-    /// of writing a log that is not theirs, which is worse than reporting no check.
-    #[test]
-    fn anything_unfamiliar_yields_no_owner() {
-        for line in [
-            "",
-            // What a listing carries when a server reports only the filename.
-            "souta.jsonl",
-            // Mode column the wrong length, or with characters that do not belong.
-            "-rw-r--r-   1 souta devs 1234 Sep 12 01:00 x",
-            "-rw-r--r--x 1 souta devs 1234 Sep 12 01:00 x",
-            "?rw-r--r--  1 souta devs 1234 Sep 12 01:00 x",
-            // Right shape up front, but the numeric columns are not numbers, so this is
-            // some other format that happens to start with ten plausible characters.
-            "-rw-r--r-- one souta devs 1234 Sep 12 01:00 x",
-            "-rw-r--r--   1 souta devs size Sep 12 01:00 x",
-            // Truncated before the owner can be established.
-            "-rw-r--r--   1 souta",
-        ] {
-            assert_eq!(owner_of_longname(line), None, "parsing {line:?}");
-        }
-    }
-
-    /// Ten bytes are not always ten characters. This is why the mode column is examined
-    /// as bytes: slicing the `str` would panic on a character boundary instead of
-    /// declining, and the remote chooses this string.
-    #[test]
-    fn a_ten_byte_mode_column_that_is_not_ten_characters_declines() {
-        let mode = "-\u{e9}-r--r--";
-        assert_eq!(mode.len(), 10, "ten bytes");
-        assert_eq!(mode.chars().count(), 9, "but nine characters");
-        assert_eq!(
-            owner_of_longname(&format!("{mode} 1 souta devs 1 Sep 12 01:00 x")),
-            None
-        );
-    }
 }
diff --git a/crates/ssh-browser/src/testing.rs b/crates/ssh-browser/src/testing.rs
index 2c7b7c0..2a3812a 100644
--- a/crates/ssh-browser/src/testing.rs
+++ b/crates/ssh-browser/src/testing.rs
@@ -13,8 +13,8 @@ use tokio::io::{AsyncRead, AsyncWrite, AsyncWriteExt};
 use crate::fs::Entry;
 use crate::fs::sftp::SftpFs;
 use crate::sftp::wire::{
-    Attrs, CLOSE, DATA, Dec, Enc, FXF_CREAT, HANDLE, INIT, MKDIR, NAME, OPEN, OPENDIR, READ,
-    READDIR, REALPATH, STATUS, VERSION, WRITE,
+    Attrs, CLOSE, DATA, Dec, Enc, HANDLE, INIT, NAME, OPEN, OPENDIR, READ, READDIR, REALPATH,
+    STATUS, VERSION,
 };
 use crate::sftp::{read_frame, write_frame};
 
@@ -53,12 +53,6 @@ pub fn symlink_attrs() -> Attrs {
 pub struct FakeRemote {
     dirs: HashMap<String, Vec<Entry>>,
     files: HashMap<String, Vec<u8>>,
-    /// The account this remote is reached as, when it reports owners at all.
-    ///
-    /// A file a WRITE creates is owned by this account. That is what makes a daemon
-    /// configured with an author name the remote does not actually write as visible in a
-    /// test, which is the one situation `SECURITY.md` could not previously claim to catch.
-    reached_as: Option<String>,
     /// Directories this remote refuses to open, and the status it refuses with.
     ///
     /// Without this the only refusal a test could produce was "no such file" — the one
@@ -103,34 +97,13 @@ impl FakeRemote {
                 .map(|(name, attrs)| Entry {
                     name: name.to_string(),
                     attrs,
-                    owner: None,
                 })
                 .collect(),
         );
         self
     }
 
-    /// The account this remote is reached as, so a WRITE creates a file owned by it.
-    pub fn reached_as(mut self, who: &str) -> Self {
-        self.reached_as = Some(who.to_string());
-        self
-    }
-
-    /// Declare who a listing reports as the owner of one already-declared path.
-    ///
-    /// Panics if the path has no listing entry yet. Doing nothing instead would let a test
     /// believe it had arranged a mismatch when it had arranged nothing at all.
-    pub fn owner(mut self, path: &str, who: &str) -> Self {
-        let (parent, name) = path.rsplit_once('/').expect("an owner needs a full path");
-        let entry = self
-            .dirs
-            .get_mut(parent)
-            .and_then(|entries| entries.iter_mut().find(|e| e.name == name))
-            .unwrap_or_else(|| panic!("no listing entry for {path}; declare it with dir() first"));
-        entry.owner = Some(who.to_string());
-        self
-    }
-
     /// Declare a file body. The listing entry is declared separately on purpose: a
     /// listing that promises a file the remote then refuses is a real situation, and
     /// the origin layer has to survive it.
@@ -164,7 +137,7 @@ fn path_of(handle: &[u8]) -> Option<String> {
     Some(path.to_string())
 }
 
-async fn serve<R, W>(mut remote: FakeRemote, mut r: R, mut w: W)
+async fn serve<R, W>(remote: FakeRemote, mut r: R, mut w: W)
 where
     R: AsyncRead + Unpin,
     W: AsyncWrite + Unpin,
@@ -217,13 +190,9 @@ where
             }
             OPEN => {
                 let path = utf8(d.str().expect("open path"));
-                let flags = d.u32().expect("open flags");
-                // A create flag makes the file exist, as it does on a real server. Without
-                // this an append could never write a log that did not already exist.
-                let creating = flags & FXF_CREAT != 0;
-                if creating {
-                    remote.files.entry(path.clone()).or_default();
-                }
+                // Read and discarded: this daemon only ever opens for reading, so there is
+                // no create flag left to honour.
+                d.u32().expect("open flags");
                 if remote.files.contains_key(&path) {
                     serial += 1;
                     (
@@ -253,38 +222,6 @@ where
                     (DATA, Enc::new().u32(id).str(&body[offset..end]).done())
                 }
             }
-            WRITE => {
-                let handle = d.str().expect("write handle").to_vec();
-                let path = path_of(&handle).expect("write handle shape");
-                // The offset is read and ignored: the client opened in append mode, and a
-                // real server places the data at the end regardless of what it says.
-                d.u64().expect("write offset");
-                let data = d.str().expect("write data").to_vec();
-                remote
-                    .files
-                    .entry(path.clone())
-                    .or_default()
-                    .extend_from_slice(&data);
-
-                // Made visible to a listing too, because a listing is how the reader finds
-                // the file at all. A fake that wrote without listing would let a broken
-                // reader pass.
-                if let Some((parent, name)) = path.rsplit_once('/') {
-                    let size = remote.files.get(&path).map_or(0, Vec::len) as u64;
-                    let entries = remote.dirs.entry(parent.to_string()).or_default();
-                    match entries.iter_mut().find(|e| e.name == name) {
-                        Some(e) => e.attrs.size = Some(size),
-                        // A file this remote creates belongs to the account it is reached
-                        // as, whatever the writer decided to call the file.
-                        None => entries.push(Entry {
-                            name: name.to_string(),
-                            attrs: file_attrs(size, 1),
-                            owner: remote.reached_as.clone(),
-                        }),
-                    }
-                }
-                (STATUS, status(id, SSH_FX_OK, "ok"))
-            }
             REALPATH => {
                 d.str().expect("realpath path");
                 match &remote.home {
@@ -299,7 +236,6 @@ where
                             &[Entry {
                                 name: home.clone(),
                                 attrs: dir_attrs(),
-                                owner: remote.reached_as.clone(),
                             }],
                         ),
                     ),
@@ -309,11 +245,6 @@ where
                     ),
                 }
             }
-            MKDIR => {
-                let path = utf8(d.str().expect("mkdir path"));
-                remote.dirs.entry(path).or_default();
-                (STATUS, status(id, SSH_FX_OK, "ok"))
-            }
             CLOSE => {
                 d.str().expect("close handle");
                 (STATUS, status(id, SSH_FX_OK, "ok"))
@@ -342,25 +273,20 @@ fn status(id: u32, code: u32, message: &str) -> Vec<u8> {
 /// SIZE | PERMISSIONS | ACMODTIME, in the order the fields are written below.
 const WRITTEN_ATTRS: u32 = 0x0000_0001 | 0x0000_0004 | 0x0000_0008;
 
-/// The `ls -l`-shaped longname a real server sends, so that the client's owner parse is
-/// exercised rather than bypassed.
+/// The `ls -l`-shaped longname a real server sends.
 ///
-/// An entry with no owner gets the bare filename instead. That is what a server reporting
-/// nothing useful looks like on the wire, and it is what the client has to decline to parse
-/// rather than read an owner out of.
+/// Nothing reads it any more — the client skips the field — but it is on the wire, so a
+/// decoder that stopped emitting it would be tested against a shape no server produces.
 ///
 /// The date is a fixed string. A real one would suggest the client reads it, and it does
 /// not: the column is ambiguous between a time and a year depending on the file's age.
 fn longname(e: &Entry) -> String {
-    match &e.owner {
-        Some(who) => format!(
-            "{} 1 {who} {who} {:>8} Jan  1 00:00 {}",
-            mode_column(&e.attrs),
-            e.attrs.size.unwrap_or(0),
-            e.name
-        ),
-        None => e.name.clone(),
-    }
+    format!(
+        "{} 1 nobody nobody {:>8} Jan  1 00:00 {}",
+        mode_column(&e.attrs),
+        e.attrs.size.unwrap_or(0),
+        e.name
+    )
 }
 
 fn mode_column(attrs: &Attrs) -> &'static str {
diff --git a/e2e/harness.mjs b/e2e/harness.mjs
index bedd74e..e6b7912 100644
--- a/e2e/harness.mjs
+++ b/e2e/harness.mjs
@@ -81,15 +81,11 @@ export async function startDaemon(port) {
   return { child, token, log: () => log };
 }
 
-/// A copy of the built extension with the alias hosts already granted.
+/// A copy of the built extension, in a directory of its own.
 ///
-/// The shipped manifest asks for them through `optional_host_permissions`, and the dashboard
-/// requests them on the first click in it. That request raises a permission bubble, which is
-/// browser chrome and not something a script can click.
-///
-/// Worth being plain about what this covers. Everything downstream of the grant is exercised
-/// for real: the worker, the token header, the content script, the annotation round trip. The
-/// act of *requesting* the permission is not, and stays a manual step.
+/// Copied rather than loaded in place so that a run cannot leave anything behind in the
+/// checkout. Nothing is patched into the manifest any more: the extension asks for
+/// `http://127.0.0.1/*` and nothing else, so there is no permission bubble to get past.
 export async function extensionWithPermissionGranted() {
   const dist = join(repo, "extension", "dist");
   let manifest;
@@ -103,9 +99,8 @@ export async function extensionWithPermissionGranted() {
 
   const dir = await mkdtemp(join(tmpdir(), "ssh-browser-ext-"));
   await cp(dist, dir, { recursive: true });
-  manifest.host_permissions = [...(manifest.host_permissions ?? []), `http://*.${SUFFIX}/*`];
-  delete manifest.optional_host_permissions;
-  await writeFile(join(dir, "manifest.json"), JSON.stringify(manifest, null, 2));
+  // Read only to fail early and clearly when the build is missing; nothing is changed.
+  void manifest;
   return dir;
 }
 
@@ -147,22 +142,15 @@ export function loadExtension(dir) {
   return [`--disable-extensions-except=${dir}`, `--load-extension=${dir}`];
 }
 
-/// The id `background.ts` registers the annotation script under.
-const CONTENT_SCRIPT_ID = "alias-pages";
-
-/// Open the dashboard, point it at the daemon, and wait until the content script is
-/// registered.
+/// Open the dashboard, point it at the daemon, and wait until it has connected.
 ///
 /// No token is typed. The dashboard asks the daemon for one, which the daemon hands over to
-/// anything that is not a page — so the first-run paste is gone, and so is the field the
-/// old popup version of this filled in.
-///
-/// Waiting on the registration rather than on the page's text, because the text is set
-/// before the registration happens. A wait that accepted the first status line won a race
-/// most of the time and lost it whenever anything else was slow — a flake that looks
-/// exactly like a broken content script.
+/// anything that is not a page.
 ///
-/// The registration is the thing the caller depends on, so it is the thing to wait for.
+/// Waiting on the daemon line rather than on a fixed delay, and by *port*: on a machine
+/// already running a daemon on the default port the dashboard connects to that one on load,
+/// so "there is a daemon line" is true before the click and a wait for it returns
+/// immediately — with the wrong daemon's sites behind it.
 export async function connectThroughDashboard(browser, port) {
   const worker =
     browser.serviceWorkers()[0] ??
@@ -192,20 +180,5 @@ export async function connectThroughDashboard(browser, port) {
   // for a test that wants the sites. Going back is the click they would make.
   await dashboard.click(".back");
 
-  const deadline = Date.now() + 20_000;
-  for (;;) {
-    const ids = await worker.evaluate(() =>
-      chrome.scripting.getRegisteredContentScripts().then((s) => s.map((x) => x.id)),
-    );
-    if (ids.includes(CONTENT_SCRIPT_ID)) {
-      break;
-    }
-    if (Date.now() > deadline) {
-      const said = await dashboard.textContent("#status");
-      throw new Error(`the content script was never registered; the dashboard said: ${said}`);
-    }
-    await new Promise((r) => setTimeout(r, 200));
-  }
-
   return { dashboard, extensionId };
 }
diff --git a/e2e/run.mjs b/e2e/run.mjs
index de53c36..cfd882c 100644
--- a/e2e/run.mjs
+++ b/e2e/run.mjs
@@ -352,10 +352,9 @@ async function main() {
 
     console.log("\nthe dashboard");
     const { dashboard } = await connectThroughDashboard(browser, PORT);
-    // Waited for, not assumed. The dashboard connects, registers the content script, *then*
-    // asks what is being served, and `connectThroughDashboard` returns on the registration
-    // -- so reading the rows straight afterwards is a race that passes most of the time. It
-    // passed for me once before I noticed, which is the worst way for it to behave.
+    // Waited for, not assumed. `connectThroughDashboard` returns once the daemon line
+    // names the port; the sites are fetched after that, so reading the rows straight
+    // afterwards is a race that passes most of the time.
     const rowFor = `#view button[data-alias="${ALIAS}"]`;
     await dashboard.waitForSelector(rowFor);
 
@@ -490,44 +489,6 @@ async function main() {
 
     await dashboard.click(".back").catch(() => {});
 
-    // A filename that needs percent-escaping, which is where the two directions of the
-    // annotation API can disagree about which document they mean. They did: a note was written
-    // under one name and looked for under another, and the panel showed nothing at all.
-    const spaced = "spaced name.html";
-    const posted = await fetch(`http://127.0.0.1:${PORT}/_control/annotations`, {
-      method: "POST",
-      headers: { [TOKEN_HEADER]: token, "content-type": "application/json" },
-      body: JSON.stringify({
-        doc: `${ALIAS}/${encodeURIComponent(spaced)}`,
-        op: "add",
-        body: "written by the harness",
-        selectors: [{ type: "TextQuoteSelector", exact: "anchor me here" }],
-      }),
-    });
-    check("the control API accepts a note on an escaped filename", () =>
-      assert.equal(posted.status, 200),
-    );
-
-    const noted = await browser.newPage();
-    await noted.goto(`http://${ALIAS}.${SUFFIX}/${encodeURIComponent(spaced)}`, {
-      waitUntil: "networkidle",
-    });
-    // The panel is a closed shadow root, so its text is deliberately unreachable from the page
-    // — that is the point of it. What is observable is that the host element exists, and that a
-    // highlight got registered, which happens only once a note has been fetched *and* anchored.
-    await noted
-      .waitForFunction(() => CSS.highlights.size > 0, { timeout: 20_000 })
-      .catch(() => {});
-    const panel = await noted.evaluate(() => ({
-      host: document.getElementById("ssh-browser-panel-host") !== null,
-      highlights: CSS.highlights.size,
-      // Nothing may be added to the document the reader came for.
-      styleTags: document.querySelectorAll("style").length,
-    }));
-
-    check("the content script ran on the alias page", () => assert.equal(panel.host, true));
-    check("the note was fetched and anchored", () => assert.equal(panel.highlights, 1));
-    check("no <style> element was added to the document", () => assert.equal(panel.styleTags, 0));
   } catch (e) {
     failures += 1;
     console.error(`\nthe run itself failed: ${e.message}`);
diff --git a/e2e/shots.mjs b/e2e/shots.mjs
index 3494bed..2c9c284 100644
--- a/e2e/shots.mjs
+++ b/e2e/shots.mjs
@@ -21,7 +21,6 @@ import { chromium } from "playwright";
 import {
   ALIAS,
   SUFFIX,
-  TOKEN_HEADER,
   browserOptions,
   connectThroughDashboard,
   extensionWithPermissionGranted,
@@ -37,9 +36,8 @@ const OUT = join(import.meta.dirname, "shots");
 const VIEW = { width: 1280, height: 800 };
 
 // The fuller of the two fixtures: a heading, an image and a script that ran.
-const DOC = "index.html";
 
-const { child, token } = await startDaemon(PORT);
+const { child } = await startDaemon(PORT);
 const profile = await mkdtemp(join(tmpdir(), "ssh-browser-shots-"));
 const extension = await extensionWithPermissionGranted();
 let browser;
@@ -73,34 +71,6 @@ try {
   await dashboard.screenshot({ path: join(OUT, "3-settings.png") });
   console.log("  shots/3-settings.png   settings: what listings look like, and which daemon");
 
-  // A note to photograph. Written through the control API rather than by driving the panel,
-  // because the picture wanted is of a note being *shown*; how it got there is the subject of
-  // the checks rather than of a listing.
-  const posted = await fetch(`http://127.0.0.1:${PORT}/_control/annotations`, {
-    method: "POST",
-    headers: { [TOKEN_HEADER]: token, "content-type": "application/json" },
-    body: JSON.stringify({
-      doc: `${ALIAS}/${encodeURIComponent(DOC)}`,
-      op: "add",
-      body: "the quoted words are highlighted, and the note sits beside them",
-      selectors: [{ type: "TextQuoteSelector", exact: "served over ssh" }],
-    }),
-  });
-  if (!posted.ok) {
-    throw new Error(`could not write the note to photograph: ${posted.status}`);
-  }
-
-  const page = await browser.newPage();
-  await page.setViewportSize(VIEW);
-  await page.goto(`http://${ALIAS}.${SUFFIX}/${encodeURIComponent(DOC)}`, {
-    waitUntil: "networkidle",
-  });
-  // The highlight is the evidence the note arrived and anchored, so waiting for it is also
-  // what stops the shot being taken half a beat early.
-  await page.waitForFunction(() => CSS.highlights.size > 0, { timeout: 20_000 });
-  await page.screenshot({ path: join(OUT, "4-annotated.png") });
-  console.log("  shots/4-annotated.png  a page served over ssh, with a note on it");
-
   const listing = await browser.newPage();
   await listing.setViewportSize(VIEW);
   await listing.goto(`http://${ALIAS}.${SUFFIX}/assets/`, { waitUntil: "networkidle" });
diff --git a/extension/STORE.md b/extension/STORE.md
index d0b6384..e08c0f7 100644
--- a/extension/STORE.md
+++ b/extension/STORE.md
@@ -22,19 +22,18 @@ on faith.
 
 ## Single purpose
 
-> Open files that live on a host reachable only over SSH as real web pages in the browser, and
-> annotate them.
+> Open files that live on a host reachable only over SSH as real web pages in the browser.
 
 The store wants one purpose and this is one. Everything the extension does — routing alias
-hostnames, holding the control token, drawing notes — exists to put remote files on a real
-origin and let a reader mark them up.
+hostnames, holding the control token, listing the hosts ssh already knows — exists to put
+remote files on a real origin.
 
 ## Short description
 
-The limit is 132 characters; this is 101.
+The limit is 132 characters; this is 96.
 
-> Read and annotate files on a host reachable only over SSH — rendered as real pages, not
-> previews.
+> Open files on a host reachable only over SSH as real web pages, rendered natively rather
+> than previewed.
 
 ## Detailed description
 
@@ -53,15 +52,12 @@ The limit is 132 characters; this is 101.
 > only thing that does: pages served from a remote host are treated as untrusted code, and ask
 > the extension to act on their behalf rather than being handed credentials.
 >
-> It also draws annotations. Notes are per-author append-only files kept beside the document on
-> your own host, so two people annotating one page write to different files and neither can
-> lose the other's work. Highlights use the CSS Custom Highlight API and the panel lives in a
-> closed shadow root, so the page you came to read is never modified.
+> A dashboard lists the hosts your `~/.ssh/config` already reaches, with the user, hostname,
+> port and ProxyJump that `ssh -G` resolves for each. Clicking one serves it; clicking a site
+> opens it.
 >
-> Four things are said rather than hidden, because each means a note is not saying what it
-> appears to: a note that could not be placed, a note whose quoted text has changed and which
-> was placed by position instead, a log whose filename claims an author the file's owner
-> contradicts, and a line the daemon could not parse.
+> Nothing is injected into a page: there is no content script, so what loads is the site,
+> unchanged. Nothing is written to your host either — the daemon has no write path at all.
 >
 > The daemon is separate and you run it yourself: `cargo install ssh-browser`. Source for both
 > halves is at https://github.com/QAtlasHub/ssh-browser.
@@ -84,29 +80,14 @@ The form asks for one per permission. Keep these in step with `../PRIVACY.md`.
 **`storage`**
 
 > Remembers the local daemon's port, its control token, the configured hostname suffix and the
-> alias names the daemon reported, so the user does not retype a 64-character token on every
-> page. Local to the profile, and never transmitted anywhere but 127.0.0.1.
-
-**`scripting`**
-
-> Registers the annotation content script at runtime for the user's configured suffix only.
-> At runtime rather than declared in the manifest precisely to avoid a static match pattern:
-> the suffix is the user's to choose, so anything declared in advance would have to cover
-> every site.
+> alias names the daemon reported, so the user does not retype a 64-character token every
+> time. Local to the profile, and never transmitted anywhere but 127.0.0.1.
 
 **`host_permissions: http://127.0.0.1/*`**
 
 > The extension's only network destination. This is the user's own daemon, which they started
 > themselves, listening on loopback.
 
-**`optional_host_permissions: http://*/*`**
-
-> Requested when the user clicks Connect, never at install. The suffix is not known until the
-> daemon reports it, so this is the narrowest pattern that can be *declared* in advance. What
-> is actually *requested* is `http://*.<the user's suffix>/*` — with the default configuration
-> that is `http://*.ssh-browser/*` — and that is what the browser's prompt names. Declining
-> leaves reading working and turns annotation off.
-
 **Remote code**
 
 > None. Everything the extension executes is in the uploaded package.
diff --git a/extension/build.mjs b/extension/build.mjs
index c1933a9..5f6dcf4 100644
--- a/extension/build.mjs
+++ b/extension/build.mjs
@@ -15,16 +15,16 @@ process.chdir(dirname(fileURLToPath(import.meta.url)));
 mkdirSync("dist", { recursive: true });
 
 await build({
-  entryPoints: ["src/background.ts", "src/dashboard.ts", "src/content.ts"],
+  entryPoints: ["src/background.ts", "src/dashboard.ts"],
   bundle: true,
   format: "esm",
   // The manifest's minimum_chrome_version. Keeping the two in step means a syntax the
   // stated minimum cannot parse is a build error rather than a support ticket.
   target: "chrome116",
   outdir: "dist",
-  // The content script is injected into every alias page, and Apache Annotator pulls in a
-  // core-js runtime that dominates the bundle. Minifying is not a vanity metric here: it is
-  // parse work the browser does on every page load.
+  // Nothing here is injected into a page any more, so this is a few kilobytes either way.
+  // Kept because a store reviewer reads what is shipped, and two builds of the same source
+  // should produce the same bytes.
   minify: true,
   logLevel: "info",
 });
diff --git a/extension/manifest.json b/extension/manifest.json
index e5a1197..cdab676 100644
--- a/extension/manifest.json
+++ b/extension/manifest.json
@@ -6,8 +6,7 @@
   "minimum_chrome_version": "116",
   "permissions": [
     "proxy",
-    "storage",
-    "scripting"
+    "storage"
   ],
   "host_permissions": [
     "http://127.0.0.1/*"
@@ -31,8 +30,5 @@
   },
   "omnibox": {
     "keyword": "ssh"
-  },
-  "optional_host_permissions": [
-    "http://*/*"
-  ]
+  }
 }
diff --git a/extension/package-lock.json b/extension/package-lock.json
index b6ed25d..08ae4cc 100644
--- a/extension/package-lock.json
+++ b/extension/package-lock.json
@@ -7,53 +7,12 @@
     "": {
       "name": "ssh-browser-extension",
       "version": "0.0.1",
-      "dependencies": {
-        "@apache-annotator/dom": "^0.2.0",
-        "@apache-annotator/selector": "^0.2.0"
-      },
       "devDependencies": {
         "@types/chrome": "^0.1.29",
         "esbuild": "^0.25.10",
         "typescript": "^5.9.3"
       }
     },
-    "node_modules/@apache-annotator/dom": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/@apache-annotator/dom/-/dom-0.2.0.tgz",
-      "integrity": "sha512-zXVQl5jSMSpH1rf2Vyvd/jWE1H2gpSw5Jk0q0UgkWDxlLKqsg+4PiwAbBQU16x51tvH+wj7OjkfqrHeXAUcXig==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@babel/runtime-corejs3": "^7.13.10",
-        "optimal-select": "^4.0.1"
-      },
-      "engines": {
-        "node": "^12.20 || ^14.15 || ^15.4 || ^16.0"
-      }
-    },
-    "node_modules/@apache-annotator/selector": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/@apache-annotator/selector/-/selector-0.2.0.tgz",
-      "integrity": "sha512-Y8N0OKuq3cafRqaz/FBzcuAwzJIUjmjQaOPl0BC/RFgCnTm0bE27a4KFx9lL+oQVJOx3hLRdZ5iwDL1STfo0QQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@babel/runtime-corejs3": "^7.13.10"
-      },
-      "engines": {
-        "node": "^12.20 || ^14.15 || ^15.4 || ^16.0"
-      }
-    },
-    "node_modules/@babel/runtime-corejs3": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/runtime-corejs3/-/runtime-corejs3-7.29.7.tgz",
-      "integrity": "sha512-ppj9ouYku+RX0ljtgZd+KMO5mkM2bCqg8H2PYAFWnLsHEIKIdRojqbJ2i3eVHrisuxy7nOFCmngTDdWtUCdXUQ==",
-      "license": "MIT",
-      "dependencies": {
-        "core-js-pure": "^3.48.0"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
     "node_modules/@esbuild/aix-ppc64": {
       "version": "0.25.12",
       "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
@@ -531,20 +490,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/core-js-pure": {
-      "version": "3.50.0",
-      "resolved": "https://registry.npmjs.org/core-js-pure/-/core-js-pure-3.50.0.tgz",
-      "integrity": "sha512-6GP3Pxz4IKyWjAfa747vIu/jilB5z29JWROLqH/b+pXVcpgh6tM06ZIBwSuglgVqzDYURhOK6oEzTrG0bCHitA==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/core-js"
-      }
-    },
     "node_modules/esbuild": {
       "version": "0.25.12",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
@@ -587,12 +532,6 @@
         "@esbuild/win32-x64": "0.25.12"
       }
     },
-    "node_modules/optimal-select": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/optimal-select/-/optimal-select-4.0.1.tgz",
-      "integrity": "sha512-WLLt4DicXXeI2zLU2OF85TNbtbk8zAyLLqqKTsSVBICeoo2dzdI0YKXfkmxlCz+fVqSAR7fQ5zrHsCdeoOBzAA==",
-      "license": "MIT"
-    },
     "node_modules/typescript": {
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
diff --git a/extension/package.json b/extension/package.json
index 4598dd0..79bb3bb 100644
--- a/extension/package.json
+++ b/extension/package.json
@@ -14,9 +14,5 @@
     "@types/chrome": "^0.1.29",
     "esbuild": "^0.25.10",
     "typescript": "^5.9.3"
-  },
-  "dependencies": {
-    "@apache-annotator/dom": "^0.2.0",
-    "@apache-annotator/selector": "^0.2.0"
   }
 }
diff --git a/extension/src/background.ts b/extension/src/background.ts
index 31e5b40..bbd5168 100644
--- a/extension/src/background.ts
+++ b/extension/src/background.ts
@@ -14,13 +14,6 @@ const PROTOCOL = 1;
 
 const TOKEN_HEADER = "x-ssh-browser-token";
 
-const CONTENT_SCRIPT_ID = "alias-pages";
-
-/// Which pages the content script should run in, for a given suffix.
-function matchesFor(suffix: string): string[] {
-  return [`http://*.${suffix}/*`];
-}
-
 interface Settings {
   port: number;
   token: string;
@@ -47,9 +40,6 @@ export interface Reply {
   detail: string;
   aliases?: string[];
   suffix?: string;
-  annotations?: unknown[];
-  skipped?: number;
-  id?: string;
   open?: OpenAlias[];
   current?: string;
   themes?: { name: string; label: string }[];
@@ -84,10 +74,7 @@ type Request =
   | { kind: "theme" }
   | { kind: "setTheme"; name: string }
   | { kind: "disconnect" }
-  | { kind: "status" }
-  | { kind: "register"; suffix: string }
-  | { kind: "annotations"; url: string }
-  | { kind: "annotate"; url: string; body: string; selectors?: unknown };
+  | { kind: "status" };
 
 async function stored(): Promise<Settings | null> {
   const got = await chrome.storage.local.get(["port", "token", "suffix", "aliases"]);
@@ -110,56 +97,6 @@ async function stored(): Promise<Settings | null> {
   return { port, token, suffix, aliases };
 }
 
-/// `http://docs.ssh-browser/a/b.html` becomes `docs/a/b.html`.
-///
-/// Derived here rather than in the content script, so the suffix stays knowledge this worker
-/// holds. A content script that had to know the suffix would need telling again every time it
-/// changed, and the page it runs in is not somewhere to keep configuration.
-function docOfUrl(href: string, suffix: string): string | null {
-  let url: URL;
-  try {
-    url = new URL(href);
-  } catch {
-    return null;
-  }
-  if (url.protocol !== "http:") {
-    return null;
-  }
-  const tail = `.${suffix}`;
-  if (!url.hostname.endsWith(tail)) {
-    return null;
-  }
-  const alias = url.hostname.slice(0, -tail.length);
-  // A single label only. `a.b.ssh-browser` is not an alias the daemon serves, and sending it
-  // one would be asking for a refusal we can predict.
-  if (alias === "" || alias.includes(".")) {
-    return null;
-  }
-  // Decoded here, and encoded exactly once by `encodeDoc` on the way out.
-  //
-  // `pathname` keeps its percent-escapes, and the daemon decodes what it is handed exactly
-  // once — deliberately, since decoding twice would turn a literal `%2e%2e` in a filename
-  // into a traversal. Passing the escaped form straight through meant the read path escaped
-  // it a second time and the write path did not, so a note written against
-  // `Weekly Report.html` was afterwards looked for under `Weekly%20Report.html` and never
-  // found again. Decoding first is what makes the two directions agree.
-  //
-  // Per segment, so a `%2F` stays a separator question for the daemon to answer rather than
-  // becoming one here.
-  let path: string;
-  try {
-    path = url.pathname
-      .split("/")
-      .map((segment) => decodeURIComponent(segment))
-      .join("/");
-  } catch {
-    // A malformed escape, which the daemon would refuse anyway. Saying so here beats
-    // sending it something that cannot mean anything.
-    return null;
-  }
-  return `${alias}${path}`;
-}
-
 /// Every call to the daemon goes through here, so the token is attached in exactly one place
 /// and cannot be forgotten at a call site.
 async function callDaemon(s: Settings, path: string, init: RequestInit = {}): Promise<Response> {
@@ -317,58 +254,6 @@ async function status(): Promise<Reply> {
   return connect(s.port);
 }
 
-/// Register the content script for the daemon's suffix, and only for it.
-///
-/// Registered at runtime rather than declared in the manifest, because the suffix is
-/// configurable: a manifest entry would have to match every http site in order to cover
-/// whatever suffix was chosen, and that is a permission this extension has no reason to hold.
-///
-/// The permission itself is requested from the popup, because a request needs a user gesture.
-async function registerContent(suffix: string): Promise<Reply> {
-  const matches = matchesFor(suffix);
-  if (!(await chrome.permissions.contains({ origins: matches }))) {
-    return {
-      ok: false,
-      detail: `not allowed to run on ${matches[0]} yet — grant it from the popup`,
-    };
-  }
-
-  await chrome.scripting.unregisterContentScripts({ ids: [CONTENT_SCRIPT_ID] }).catch(() => {
-    // Nothing registered yet, which is the ordinary first run.
-  });
-  await chrome.scripting.registerContentScripts([
-    {
-      id: CONTENT_SCRIPT_ID,
-      matches,
-      js: ["content.js"],
-      runAt: "document_idle",
-    },
-  ]);
-  return { ok: true, detail: `annotating pages under *.${suffix}` };
-}
-
-/// Settings plus the document a page URL names, or the refusal to report instead.
-///
-/// One resolution path for both annotation routes. The daemon settled the same question the
-/// same way — `resolve_doc` exists there so that reading and writing cannot disagree about
-/// what a document is — and the two copies here had already drifted once, which is how one
-/// direction came to escape the path and the other not.
-/// The failure arm pins `ok` to `false` rather than reusing `Reply`'s `boolean`, because a
-/// union only narrows on a discriminant that is a literal in each arm.
-type Resolved = { ok: true; s: Settings; doc: string } | (Reply & { ok: false });
-
-async function resolveDoc(url: string): Promise<Resolved> {
-  const s = await stored();
-  if (!s) {
-    return { ok: false, detail: "not connected" };
-  }
-  const doc = docOfUrl(url, s.suffix);
-  if (doc === null) {
-    return { ok: false, detail: "this page is not served by ssh-browser" };
-  }
-  return { ok: true, s, doc };
-}
-
 /// The hosts ssh already knows how to reach.
 async function listHosts(): Promise<Reply> {
   const s = await stored();
@@ -498,64 +383,6 @@ async function setTheme(name: string): Promise<Reply> {
   };
 }
 
-async function listAnnotations(url: string): Promise<Reply> {
-  const resolved = await resolveDoc(url);
-  if (!resolved.ok) {
-    return resolved;
-  }
-  const { s, doc } = resolved;
-  const res = await callDaemon(s, `/_control/annotations?doc=${encodeDoc(doc)}`);
-  if (!res.ok) {
-    return { ok: false, detail: `${res.status}: ${await res.text()}` };
-  }
-  const body = (await res.json()) as {
-    annotations: unknown[];
-    skipped: number;
-  };
-  return {
-    ok: true,
-    // Surfaced rather than dropped: a line the daemon could not parse means an annotation
-    // somebody wrote is not being shown, and silence about that is the worst outcome.
-    detail:
-      body.skipped > 0
-        ? `${body.annotations.length} annotations, ${body.skipped} unreadable lines`
-        : `${body.annotations.length} annotations`,
-    annotations: body.annotations,
-    skipped: body.skipped,
-  };
-}
-
-async function addAnnotation(url: string, body: string, selectors?: unknown): Promise<Reply> {
-  const resolved = await resolveDoc(url);
-  if (!resolved.ok) {
-    return resolved;
-  }
-  const { s, doc } = resolved;
-  // No author and no id: the daemon decides both, so no caller — including this extension —
-  // can write as somebody else or choose an identity.
-  //
-  // `encodeDoc` here as well as on the read path, and for the same reason: the daemon
-  // decodes once, so both directions have to encode once. They did not, and a note written
-  // to a filename needing escapes could not be read back.
-  const payload: Record<string, unknown> = {
-    doc: encodeDoc(doc),
-    op: "add",
-    body,
-  };
-  if (selectors !== undefined) {
-    payload["selectors"] = selectors;
-  }
-  const res = await callDaemon(s, "/_control/annotations", {
-    method: "POST",
-    body: JSON.stringify(payload),
-  });
-  if (!res.ok) {
-    return { ok: false, detail: `${res.status}: ${await res.text()}` };
-  }
-  const added = (await res.json()) as { id: string };
-  return { ok: true, detail: "saved", id: added.id };
-}
-
 function isRequest(message: unknown): message is Request {
   return (
     typeof message === "object" &&
@@ -585,12 +412,6 @@ async function dispatch(message: unknown): Promise<Reply> {
       return disconnect();
     case "status":
       return status();
-    case "register":
-      return registerContent(message.suffix);
-    case "annotations":
-      return listAnnotations(message.url);
-    case "annotate":
-      return addAnnotation(message.url, message.body, message.selectors);
   }
 }
 
diff --git a/extension/src/content.ts b/extension/src/content.ts
deleted file mode 100644
index bf7e22b..0000000
--- a/extension/src/content.ts
+++ /dev/null
@@ -1,405 +0,0 @@
-// Runs inside an alias page, in the isolated world.
-//
-// It holds no token. Everything that touches the daemon is a message to the service worker,
-// because this script shares a process with the page and the page is untrusted code.
-//
-// It also tries hard not to change the document. The whole product is "the page renders as it
-// would anywhere else", and an annotation layer that rewrote the DOM would break that in ways
-// the reader would blame on the page.
-
-import {
-  createTextPositionSelectorMatcher,
-  createTextQuoteSelectorMatcher,
-  describeTextPosition,
-  describeTextQuote,
-} from "@apache-annotator/dom";
-
-/// The two selector shapes, per the W3C Web Annotation Data Model.
-///
-/// Declared here rather than imported, so the stored format is this extension's own
-/// commitment rather than a library's. The daemon stores them opaquely, so a third kind could
-/// be added without either side needing a release.
-interface TextQuoteSelector {
-  type: "TextQuoteSelector";
-  exact: string;
-  prefix?: string;
-  suffix?: string;
-}
-
-interface TextPositionSelector {
-  type: "TextPositionSelector";
-  start: number;
-  end: number;
-}
-
-type Selector = TextQuoteSelector | TextPositionSelector;
-
-/// What the daemon found when it checked a log's filename against the file's real owner.
-///
-/// `unchecked` is not `owned`. A remote that does not report owners legibly leaves the
-/// question open, and showing that as agreement would be the one thing this is for.
-type Attribution =
-  | { state: "owned" }
-  | { state: "mismatched"; owner: string }
-  | { state: "unchecked" };
-
-interface Annotation {
-  id: string;
-  author: string;
-  at: number;
-  body: string;
-  selectors?: Selector[];
-  reply_to?: string;
-  /// Absent when talking to a daemon from before this check existed, which reads as
-  /// unchecked — the honest answer, and the reason this is optional rather than defaulted.
-  attribution?: Attribution;
-}
-
-interface Reply {
-  ok: boolean;
-  detail: string;
-  annotations?: Annotation[];
-  skipped?: number;
-}
-
-/// Which of the two selectors placed a note.
-///
-/// Worth keeping rather than discarding once a range is in hand. A note that the quote could
-/// not place but the position could is a note whose text has changed since it was written:
-/// it is now sitting on whatever happens to occupy those character offsets, which may be
-/// nothing like what the author was looking at. That is the case this project meets most
-/// often, because a page of computed results changes in exactly the numbers people annotate.
-type AnchoredBy = "quote" | "position";
-
-interface Anchored {
-  range: Range;
-  by: AnchoredBy;
-}
-
-interface Placed {
-  annotation: Annotation;
-  anchor: Anchored | null;
-}
-
-/// TypeScript's DOM library declares `HighlightRegistry` with only `forEach`, while the spec
-/// gives it the full maplike interface. Stated once here rather than cast away at each call
-/// site, so the gap is visible and does not turn into a scattering of `as any`.
-declare global {
-  interface HighlightRegistry {
-    set(name: string, highlight: Highlight): HighlightRegistry;
-    delete(name: string): boolean;
-    clear(): void;
-  }
-}
-
-const HIGHLIGHT = "ssh-browser-annotation";
-
-/// Ask the worker to act, turning a dead channel into an answer rather than a throw.
-///
-/// `chrome.runtime.sendMessage` rejects whenever the worker is not there to receive it —
-/// most often "Extension context invalidated", which happens every time the extension
-/// reloads while a page is still open. Unhandled, that rejection escaped through `refresh`
-/// before it reached `render`, leaving the panel a bare shell with no count and no list:
-/// indistinguishable from a document nobody has annotated. A panel that says it lost contact
-/// is better than one that silently shows nothing, and this is the only channel it has.
-async function send(message: unknown): Promise<Reply> {
-  try {
-    return (await chrome.runtime.sendMessage(message)) as Reply;
-  } catch (e) {
-    return { ok: false, detail: `lost contact with the extension: ${String(e)}` };
-  }
-}
-
-async function first<T>(source: AsyncIterable<T>): Promise<T | null> {
-  for await (const item of source) {
-    return item;
-  }
-  return null;
-}
-
-/// Anchor one annotation, preferring the quote.
-///
-/// Two selectors are stored and tried in order because they fail in different ways. A quote
-/// survives the document being reflowed but not its text changing; a position survives the
-/// text changing but not a character being inserted ahead of it. Neither is reliable alone,
-/// and on a page of computed results — where the numbers themselves are what change — the
-/// quote is the one that breaks.
-///
-/// Returning null rather than a guess is the point. An annotation that cannot be placed is
-/// shown as unanchored, because dropping it silently would make somebody's note vanish with no
-/// sign it ever existed.
-///
-/// Which selector won is returned along with the range, because falling through to the
-/// position is itself a finding: it says the quoted text is no longer on the page.
-async function anchor(selectors: Selector[]): Promise<Anchored | null> {
-  const quote = selectors.find((s): s is TextQuoteSelector => s.type === "TextQuoteSelector");
-  if (quote) {
-    const found = await first(createTextQuoteSelectorMatcher(quote)(document.body));
-    if (found) {
-      return { range: found, by: "quote" };
-    }
-  }
-  const position = selectors.find(
-    (s): s is TextPositionSelector => s.type === "TextPositionSelector",
-  );
-  if (position) {
-    const found = await first(createTextPositionSelectorMatcher(position)(document.body));
-    if (found) {
-      return { range: found, by: "position" };
-    }
-  }
-  return null;
-}
-
-/// Drawn with the CSS Custom Highlight API rather than by wrapping text in elements.
-///
-/// Wrapping mutates the page: it would be visible to any script that walks the DOM, it would
-/// change which CSS selectors match, and it would make the annotation part of the document the
-/// reader came for. A highlight registry is invisible to all three.
-///
-/// It also sidesteps Apache Annotator's own warning that editing the DOM while its matcher is
-/// still searching can loop forever (incubator-annotator#112). Nothing here edits the DOM at
-/// all, so the hazard does not arise.
-function draw(ranges: Range[]): void {
-  if (ranges.length === 0) {
-    CSS.highlights.delete(HIGHLIGHT);
-    return;
-  }
-  CSS.highlights.set(HIGHLIGHT, new Highlight(...ranges));
-}
-
-/// Styles the highlight without adding a node to the document.
-///
-/// `adoptedStyleSheets` leaves no `<style>` element for a page script to find or for a CSS
-/// selector to match.
-function installHighlightStyle(): void {
-  const sheet = new CSSStyleSheet();
-  sheet.replaceSync(`::highlight(${HIGHLIGHT}) { background-color: rgba(255, 214, 0, 0.35); }`);
-  document.adoptedStyleSheets = [...document.adoptedStyleSheets, sheet];
-}
-
-/// One host element with a closed shadow root.
-///
-/// The page can see that an element exists but cannot reach inside it, and styles cannot leak
-/// in either direction. Both matter: the page is untrusted code, and the panel must not
-/// restyle the document the reader came for.
-function makePanel(): ShadowRoot {
-  const host = document.createElement("div");
-  host.id = "ssh-browser-panel-host";
-  const shadow = host.attachShadow({ mode: "closed" });
-
-  const style = document.createElement("style");
-  style.textContent = `
-    .panel {
-      background: #fffdf5;
-      border: 1px solid #d8d2bf;
-      border-radius: 6px;
-      bottom: 12px;
-      box-shadow: 0 2px 12px rgba(0, 0, 0, 0.15);
-      color: #1a1a1a;
-      font: 12px/1.45 system-ui, sans-serif;
-      max-height: 40vh;
-      overflow: auto;
-      padding: 8px 10px;
-      position: fixed;
-      right: 12px;
-      width: 260px;
-      z-index: 2147483647;
-    }
-    .head { display: flex; gap: 8px; justify-content: space-between; }
-    .head strong { font-weight: 600; }
-    button { font: inherit; padding: 2px 8px; }
-    ul { list-style: none; margin: 6px 0 0; padding: 0; }
-    li { border-top: 1px solid #eee6d0; padding: 5px 0; }
-    .who { color: #6b6450; }
-    .orphan { color: #8a6d00; }
-    .forged { color: #a31515; font-weight: 600; }
-  `;
-
-  const panel = document.createElement("div");
-  panel.className = "panel";
-
-  const head = document.createElement("div");
-  head.className = "head";
-  const title = document.createElement("strong");
-  title.textContent = "ssh-browser";
-  const add = document.createElement("button");
-  add.id = "add";
-  add.textContent = "Add note";
-  add.disabled = true;
-  head.append(title, add);
-
-  const count = document.createElement("div");
-  count.id = "count";
-  const list = document.createElement("ul");
-  list.id = "list";
-
-  panel.append(head, count, list);
-  shadow.append(style, panel);
-  document.documentElement.append(host);
-  return shadow;
-}
-
-function render(shadow: ShadowRoot, items: Placed[], skipped: number): void {
-  const count = shadow.getElementById("count");
-  const list = shadow.getElementById("list");
-  if (!count || !list) {
-    return;
-  }
-
-  const unanchored = items.filter((i) => i.anchor === null).length;
-  const drifted = items.filter((i) => i.anchor?.by === "position").length;
-  const misattributed = items.filter(
-    (i) => i.annotation.attribution?.state === "mismatched",
-  ).length;
-  const unchecked = items.filter(
-    (i) => (i.annotation.attribution?.state ?? "unchecked") === "unchecked",
-  ).length;
-
-  const parts = [`${items.length} note${items.length === 1 ? "" : "s"}`];
-  if (unanchored > 0) {
-    // Said out loud rather than hidden. An annotation whose text has since changed is exactly
-    // the case where the reader most needs to know something was written here.
-    parts.push(`${unanchored} unanchored`);
-  }
-  if (drifted > 0) {
-    parts.push(`${drifted} drifted`);
-  }
-  if (misattributed > 0) {
-    parts.push(`${misattributed} misattributed`);
-  }
-  if (unchecked > 0 && misattributed === 0) {
-    // Stated once rather than per note. The alternative is showing an author name with no
-    // hint that nobody confirmed it, which is the shape of claim this whole check exists to
-    // stop the panel from making.
-    parts.push("authors not verified");
-  }
-  if (skipped > 0) {
-    parts.push(`${skipped} unreadable`);
-  }
-  count.textContent = parts.join(", ");
-
-  list.textContent = "";
-  for (const { annotation, anchor: placement } of items) {
-    const item = document.createElement("li");
-
-    const who = document.createElement("span");
-    who.className = "who";
-    who.textContent = `${annotation.author}: `;
-
-    // textContent throughout: an annotation body is text somebody typed, and it is being shown
-    // inside a privileged shadow root.
-    const body = document.createElement("span");
-    body.textContent = annotation.body;
-
-    item.append(who, body);
-    if (placement === null) {
-      const flag = document.createElement("div");
-      flag.className = "orphan";
-      flag.textContent = "could not be placed on this page";
-      item.append(flag);
-    } else if (placement.by === "position") {
-      // Placed, but not on the words it was written about. Showing it silently in its new
-      // location would be the worst outcome: the reader would take it as a comment on
-      // whatever text is there now.
-      const flag = document.createElement("div");
-      flag.className = "orphan";
-      flag.textContent = "the text it quoted has changed; placed by position instead";
-      item.append(flag);
-    }
-    // Named here rather than counted only, because who wrote something is the claim in
-    // question and the answer is a different person's name.
-    if (annotation.attribution?.state === "mismatched") {
-      const flag = document.createElement("div");
-      flag.className = "forged";
-      flag.textContent = `the log says ${annotation.author}, the file belongs to ${annotation.attribution.owner}`;
-      item.append(flag);
-    }
-    list.append(item);
-  }
-}
-
-async function refresh(shadow: ShadowRoot): Promise<void> {
-  const reply = await send({ kind: "annotations", url: location.href });
-  const count = shadow.getElementById("count");
-  if (!reply.ok) {
-    if (count) {
-      count.textContent = reply.detail;
-    }
-    return;
-  }
-
-  const annotations = reply.annotations ?? [];
-  // Every anchor is resolved before anything is drawn. The matcher walks the DOM lazily, and
-  // collecting first keeps the search and the drawing from ever overlapping.
-  const placed: Placed[] = [];
-  const ranges: Range[] = [];
-  for (const annotation of annotations) {
-    const found = annotation.selectors ? await anchor(annotation.selectors) : null;
-    if (found) {
-      ranges.push(found.range);
-    }
-    placed.push({ annotation, anchor: found });
-  }
-
-  draw(ranges);
-  render(shadow, placed, reply.skipped ?? 0);
-}
-
-async function addForSelection(shadow: ShadowRoot): Promise<void> {
-  const selection = document.getSelection();
-  if (!selection || selection.isCollapsed || selection.rangeCount === 0) {
-    return;
-  }
-  const range = selection.getRangeAt(0);
-
-  // `prompt` from the isolated world, so a page that has replaced `window.prompt` can neither
-  // see nor intercept what is typed. A proper editor belongs inside the shadow root for the
-  // same reason, not in the page.
-  const typed = window.prompt("Note");
-  if (typed === null || typed.trim() === "") {
-    return;
-  }
-
-  // Both selectors, from the same range, for the reasons in `anchor`.
-  const quote = await describeTextQuote(range, document.body);
-  const position = await describeTextPosition(range, document.body);
-
-  const reply = await send({
-    kind: "annotate",
-    url: location.href,
-    body: typed.trim(),
-    selectors: [quote, position],
-  });
-
-  if (!reply.ok) {
-    const count = shadow.getElementById("count");
-    if (count) {
-      count.textContent = reply.detail;
-    }
-    return;
-  }
-  await refresh(shadow);
-}
-
-function main(): void {
-  installHighlightStyle();
-  const shadow = makePanel();
-
-  const add = shadow.getElementById("add") as HTMLButtonElement | null;
-  if (add) {
-    add.addEventListener("click", () => {
-      void addForSelection(shadow);
-    });
-    document.addEventListener("selectionchange", () => {
-      const selection = document.getSelection();
-      add.disabled = !selection || selection.isCollapsed;
-    });
-  }
-
-  // A page can be an alias page with the daemon disconnected, in which case the worker says so
-  // and the panel shows that rather than pretending.
-  void refresh(shadow);
-}
-
-main();
diff --git a/extension/src/dashboard.ts b/extension/src/dashboard.ts
index 5672589..0328cfd 100644
--- a/extension/src/dashboard.ts
+++ b/extension/src/dashboard.ts
@@ -527,41 +527,11 @@ async function start(): Promise<void> {
   el("daemon").textContent = `${reply.detail} on 127.0.0.1:${port}`;
   say("");
 
-  // Registered only if the permission is already held. Asking for it needs a user gesture,
-  // which a page load is not, so the request is made on the first click instead — and kept
-  // out of here so that a refusal does not stop the sites appearing. Reading a site works
-  // without it.
-  const origins = [`http://*.${reply.suffix}/*`];
-  if (await chrome.permissions.contains({ origins })) {
-    await send({ kind: "register", suffix: reply.suffix });
-  }
-
   if (await refresh()) {
     route();
   }
 }
 
-// Asked on a click rather than on load, because a permission request needs a user gesture.
-el("view").addEventListener(
-  "click",
-  () => {
-    void (async () => {
-      const { suffix } = (await chrome.storage.local.get("suffix")) as { suffix?: string };
-      if (suffix === undefined || suffix === "") {
-        return;
-      }
-      const origins = [`http://*.${suffix}/*`];
-      if (await chrome.permissions.contains({ origins })) {
-        return;
-      }
-      if (await chrome.permissions.request({ origins })) {
-        await send({ kind: "register", suffix });
-      }
-    })();
-  },
-  { capture: true, once: true },
-);
-
 window.addEventListener("hashchange", route);
 
 // The port is read back first because it says *which* daemon to look for; checking before