diff --git a/.github/ISSUE_TEMPLATE/extension-submission.yml b/.github/ISSUE_TEMPLATE/extension-submission.yml
new file mode 100644
index 0000000..31809f1
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/extension-submission.yml
@@ -0,0 +1,82 @@
+name: Submit a community extension
+description: Ask for your Burrow extension to be listed on the Community extensions page.
+title: "Community extension: "
+labels: ["community-extension"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Prefer a pull request? Add an `[[extension]]` entry to `extensions/community.toml` instead (see "Submit your extension" on the Extensions page of the documentation).
+
+        **The Burrow maintainers don't review, verify, audit or endorse community extensions.** We check that the entry is well-formed, add it, and the listing says it is used at the reader's own risk. Don't put an email address or other personal data in this form.
+  - type: input
+    id: name
+    attributes:
+      label: Name
+      description: The `name` in your extension.toml. Lowercase kebab-case, at most 40 characters.
+      placeholder: wordcount
+    validations:
+      required: true
+  - type: input
+    id: title
+    attributes:
+      label: Title
+      description: A short human name, at most 60 characters.
+      placeholder: Word count
+    validations:
+      required: true
+  - type: input
+    id: description
+    attributes:
+      label: Description
+      description: One line of plain text, at most 160 characters.
+      placeholder: Shows the word count and reading time of the open draft.
+    validations:
+      required: true
+  - type: input
+    id: repo
+    attributes:
+      label: Source repository
+      description: An https:// link to the public source code.
+      placeholder: https://github.com/example/burrow-ext-wordcount
+    validations:
+      required: true
+  - type: input
+    id: homepage
+    attributes:
+      label: Homepage (optional)
+      placeholder: https://example.com/wordcount
+  - type: input
+    id: author
+    attributes:
+      label: Author
+      description: Your GitHub handle, without the @. Not an email address.
+      placeholder: example
+    validations:
+      required: true
+  - type: textarea
+    id: capabilities
+    attributes:
+      label: Capabilities
+      description: Exactly what your manifest's `capabilities` asks for, one per line (or "none").
+      placeholder: |
+        items.read
+        ui
+    validations:
+      required: true
+  - type: checkboxes
+    id: platforms
+    attributes:
+      label: Platforms
+      options:
+        - label: macOS
+        - label: Windows
+  - type: checkboxes
+    id: understood
+    attributes:
+      label: Before you submit
+      options:
+        - label: I wrote this extension, or I maintain it, and its source code is public.
+          required: true
+        - label: I understand the maintainers check the entry's format only, and that the listing can be removed if it's reported as malicious or misleading.
+          required: true
diff --git a/.github/PULL_REQUEST_TEMPLATE/extension.md b/.github/PULL_REQUEST_TEMPLATE/extension.md
new file mode 100644
index 0000000..0e20c03
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE/extension.md
@@ -0,0 +1,23 @@
+<!--
+Listing a community extension. This template is for a pull request that adds
+(or updates, or removes) one [[extension]] entry in extensions/community.toml.
+Open it with ?template=extension.md on the compare URL.
+-->
+
+## Extension
+
+- **Name:** <!-- e.g. wordcount -->
+- **Source:** <!-- e.g. https://github.com/example/burrow-ext-wordcount -->
+
+## Checklist
+
+- [ ] This pull request changes only `extensions/community.toml`, and only one entry.
+- [ ] The entry is in alphabetical order by `name`.
+- [ ] `name` matches the `name` in my `extension.toml`.
+- [ ] `capabilities` lists exactly what my manifest asks for.
+- [ ] `repo` links to the extension's source code, which is public.
+- [ ] `author` is my GitHub handle, and there's no email address anywhere in the entry.
+- [ ] `python3 scripts/community-extensions.py check` passes.
+- [ ] I understand that the Burrow maintainers check the entry's format only.
+      They don't review, verify, audit or endorse the extension, and the listing
+      says so. A listing can be removed if it's reported as malicious or misleading.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a480ee8..6792915 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -97,6 +97,11 @@ jobs:
         with:
           persist-credentials: false
 
+      # The community extension list: format only (valid TOML, required
+      # fields, names, https URLs, sorted). It never fetches or runs anything.
+      - name: Check the community extension list
+        run: python3 scripts/community-extensions.py check
+
       # The pinned mdBook; fails on mdBook errors or broken links.
       - name: Build the book
         run: scripts/build-site.sh
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 20ad3f3..d34aaff 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -15,6 +15,8 @@ on:
       - "CHANGELOG.md"
       - "scripts/build-site.sh"
       - "scripts/site-linkcheck.py"
+      - "scripts/community-extensions.py"
+      - "extensions/community.toml"
       - ".github/workflows/pages.yml"
   workflow_dispatch:
 
diff --git a/.gitignore b/.gitignore
index aaee0d0..0bc099b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,5 @@
 
 # The documentation site build (mdbook build site)
 /site/book/
+# Made from extensions/community.toml by scripts/build-site.sh
+/site/src/generated/community-extensions.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cab06bd..56dc9e1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,25 @@ teaches something new in the tour, set the newest entry's `version` in
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-10-09
+
+### Added
+
+- **Turn an extension off.** Manage extensions (⇧⌘P › Manage extensions…) has **Turn off** for any extension that's on, whatever state it's in. It stops the extension and keeps what you allowed, so Turn on brings it back as it was. **Forget permissions** turns it off and clears what you allowed, so the next Turn on asks again. The consent sheet gains **⌘⌫ turn off**, so you can back out the moment you see what an extension asks for.
+- **Several notes folders.** markdown-notes can open any number of folders (Obsidian vaults, say). The Notes tab in the notes drawer has a chip for each folder, plus **Add folder…** and **Remove from Burrow** (which only removes the folder from Burrow and never touches your files), and remembers the folder you were in. Settings › Notes folders lists them, and you can add several at once. ⌘K's notes chip searches every folder. In the config they are `vault=` for the first and `vault-<label>=` for each one after.
+- **Reading time and Inspect**, two bundled extensions ported from Blygger Studio 0.39, both off until you turn them on. **reading-time** puts an estimated reading time at the end of each post's byline in the Stream and the Reader ("· 4 min"; hover for the word count), counted the way the studio counts. **inspect** adds a ⋯ chip to each post you read, with an Inspect sheet showing the record Burrow holds (ids, versions, references, hashes) and its JSON with the bodies left out, with Copy JSON.
+- **Extensions can add to what you read.** Two new slots in the extension protocol, behind the `reading.read` permission: a short marker at the end of each post's byline, and rows in a post's ⋯ sheet. See [Extensions](https://aneeshsathe.github.io/blygger-desktop/extensions.html).
+- **Import and export subscriptions as OPML.** Blyg › Import Subscriptions from OPML… (or Import OPML… on the Subscriptions screen) reads an export from another feed reader, lists its feeds with the ones you already follow marked, and subscribes your blyg to the ones you tick, at a steady pace, filing them in an **Imported feeds** folder in the Reader, with a summary and Retry for any that fail. Imported feeds stay out of your public blogroll. Blyg › Export Subscriptions as OPML… saves all of them. `blygger +import-opml` and `+export-opml` do the same from a terminal.
+- **Community extensions.** The docs now list extensions other people have made, from `extensions/community.toml`; submit yours with a pull request or the issue form. Burrow's maintainers don't review or vouch for them: an extension runs with your user's rights, so read its source and use it at your own risk.
+
+### Changed
+
+- **The lineage glyph shows counts.** Beside the kinds, the glyph shows how many posts a post draws on and how many known here draw on it ("2 · 3"). The ⌘J view and the action ring show the same numbers, by kind. On a blyg that runs the studio's lineage-glyph extension, Burrow uses the blyg's own counts; elsewhere it works them out from what it holds, using the same rules. Opening a post from ⌘J marks it read, as opening it from the list does.
+- **Read state needs the `reading:state` permission** (Blygger Studio 0.39 moved marking posts read and unread there). Burrow now asks for it. **After updating, sign in again once** (Burrow › Disconnect…, then Sign in with browser, and allow every permission) so read marks sync between your Macs. Until then they're kept on this Mac and wait to be sent, and everything else syncs as usual. Studios before 0.39 are unaffected.
+- **Cross-posting stays beside your work.** A cross-post run opens the browser in the usual foldable side pane, not over the whole window, and its Preview and Post sheets sit beside the page so you can see it. Fold the pane mid-run and the run carries on ("macro running · show pane" in the status bar). The pane unfolds itself before Burrow types into the page.
+- **The tour teaches what's new.** After an update, "Show me what's new" starts at the first step for that release (NEW IN 0.11.0), and the tour now walks through extensions, Turn off, notes folders, reading time and inspect, OPML import, ⌘N, ✂ Clip and cross-post, on sample data, without changing your config. It also covers what 0.10.0 added, which its tour skipped.
+- **markdown-notes no longer assumes `~/Notes`.** With no folder chosen it asks only to show messages, and the Notes tab offers **Choose a folder…**, so the consent sheet only ever names folders you picked. A config with `vault=` works as before.
+
 ## [0.10.0] - 2026-10-09
 
 ### Added
diff --git a/Cargo.lock b/Cargo.lock
index 09755ea..0e26469 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -772,7 +772,7 @@ dependencies = [
 
 [[package]]
 name = "blyg-ai"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64 0.22.1",
  "blyg-core",
@@ -788,7 +788,7 @@ dependencies = [
 
 [[package]]
 name = "blyg-app"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "adblock",
  "ammonia",
@@ -799,7 +799,9 @@ dependencies = [
  "blyg-core",
  "blyg-ext",
  "blyg-ext-crosspost",
+ "blyg-ext-inspect",
  "blyg-ext-notes",
+ "blyg-ext-reading-time",
  "blyg-render",
  "chrono",
  "ed25519-dalek",
@@ -823,7 +825,7 @@ dependencies = [
 
 [[package]]
 name = "blyg-core"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64 0.22.1",
  "blyg-render",
@@ -842,7 +844,7 @@ dependencies = [
 
 [[package]]
 name = "blyg-ext"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "blyg-core",
  "serde",
@@ -853,16 +855,25 @@ dependencies = [
 
 [[package]]
 name = "blyg-ext-crosspost"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "blyg-ext",
  "serde_json",
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "blyg-ext-inspect"
+version = "0.11.0"
+dependencies = [
+ "blyg-core",
+ "blyg-ext",
+ "serde_json",
+]
+
 [[package]]
 name = "blyg-ext-notes"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "blyg-core",
  "blyg-ext",
@@ -871,9 +882,19 @@ dependencies = [
  "tempfile",
 ]
 
+[[package]]
+name = "blyg-ext-reading-time"
+version = "0.11.0"
+dependencies = [
+ "blyg-ext",
+ "blyg-render",
+ "regex",
+ "serde_json",
+]
+
 [[package]]
 name = "blyg-render"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "fancy-regex",
  "html-escape",
diff --git a/Cargo.toml b/Cargo.toml
index 8194c79..d3ad5aa 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,10 +1,10 @@
 [workspace]
 resolver = "3"
-members = ["crates/blyg-core", "crates/blyg-ai", "crates/blyg-render", "crates/blyg-ext", "crates/blyg-ext-notes", "crates/blyg-ext-crosspost", "crates/blyg-app"]
+members = ["crates/blyg-core", "crates/blyg-ai", "crates/blyg-render", "crates/blyg-ext", "crates/blyg-ext-notes", "crates/blyg-ext-crosspost", "crates/blyg-ext-reading-time", "crates/blyg-ext-inspect", "crates/blyg-app"]
 
 [workspace.package]
 edition = "2024"
-version = "0.10.0"
+version = "0.11.0"
 license = "MIT"
 description = "A fast, local-first macOS studio for Blygger blogs"
 # Placeholder repo; set it with scripts/set-repo.sh (see packaging/config.env).
diff --git a/crates/blyg-app/Cargo.toml b/crates/blyg-app/Cargo.toml
index 44c9a3d..1610fc1 100644
--- a/crates/blyg-app/Cargo.toml
+++ b/crates/blyg-app/Cargo.toml
@@ -16,6 +16,9 @@ blyg-ai = { path = "../blyg-ai" }
 blyg-ext = { path = "../blyg-ext" }
 blyg-ext-notes = { path = "../blyg-ext-notes" }
 blyg-ext-crosspost = { path = "../blyg-ext-crosspost" }
+# --- reading slots --- (reading-time and inspect, `blygger +ext <name>`)
+blyg-ext-reading-time = { path = "../blyg-ext-reading-time" }
+blyg-ext-inspect = { path = "../blyg-ext-inspect" }
 # gpui-kit pins the matching GPUI snapshot (gpui-pre 0.3.6) plus gpui-base /
 # gpui-component 0.6.6. We use gpui-base's unstyled textarea and draw the rest.
 gpui-kit = { version = "=0.6.6", default-features = false }
diff --git a/crates/blyg-app/src/app.rs b/crates/blyg-app/src/app.rs
index 4d38311..837fe59 100644
--- a/crates/blyg-app/src/app.rs
+++ b/crates/blyg-app/src/app.rs
@@ -2088,6 +2088,7 @@ impl Render for MainView {
             .children(self.render_sheet(&ui_font, &body_font, cx))
             .children(self.render_ai_overlay(&ui_font, &body_font, cx)) // --- AI ---
             .children(self.render_ext_overlay(&ui_font, cx)) // --- extensions ---
+            .children(self.render_slots_sheet(&ui_font, cx)) // --- reading slots ---
             .children(self.render_reading_sheet(cx)) // --- reading & versions ---
             .children(profile_overlay) // --- profiles ---
             .children(self.render_toast())
@@ -2659,6 +2660,7 @@ impl MainView {
             .children(screen.to_read.map(|t| div().id("to-read").child(t)))
             .children(self.render_server_notice())
             .children(self.render_ext_notice(cx)) // --- extensions ---
+            .children(self.render_macro_status(cx)) // --- browser macros ---
             .children(self.render_update_notice(cx)) // --- auto-update ---
             .children(self.render_ai_status()) // --- AI ---
             .child(
@@ -3089,12 +3091,13 @@ impl MainView {
                 let explain = match way {
                     ConnectWay::Browser => {
                         "Burrow opens your blyg's studio in your browser. Sign in there and \
-                         allow Burrow; it gets renewable access with all four permissions, \
+                         allow Burrow; it gets renewable access with every permission, \
                          kept in your macOS Keychain. Needs blygger-studio 0.28 or later."
                     }
                     ConnectWay::Token => {
                         "Make a token in your blyg's Studio → More → Client access: choose REST \
-                         API and all four permissions (read, draft, publish, manage). It lasts \
+                         API and every permission (read, draft, publish, manage, and reading:state \
+                         where offered). It lasts \
                          30 days. A server with Burrow's extensions can use its owner token \
                          here instead. Either is kept in your macOS Keychain."
                     }
@@ -3289,7 +3292,8 @@ impl MainView {
                 .absolute()
                 .top(px(TITLEBAR_H))
                 .left_0()
-                .right_0()
+                // --- browser macros --- beside the side pane, not over it
+                .right(self.macro_sheet_right().unwrap_or(px(0.)))
                 .flex()
                 .justify_center()
                 .child(
diff --git a/crates/blyg-app/src/browser/automation/mod.rs b/crates/blyg-app/src/browser/automation/mod.rs
index 1fb25c7..8237135 100644
--- a/crates/blyg-app/src/browser/automation/mod.rs
+++ b/crates/blyg-app/src/browser/automation/mod.rs
@@ -70,13 +70,61 @@ pub struct State {
 
 struct Running {
     stop: Rc<Cell<bool>>,
+    /// The pane before the run: open or folded, and in which mode. When the
+    /// run ends it goes back to that (see [`MainView::macro_restore_pane`]).
+    before: (bool, super::OpenMode),
+    /// The run has opened (or reused) the pane: from its first `open`.
+    shown: bool,
+    /// The user folded or unfolded the pane during the run: their choice
+    /// stands, the pane isn't put back afterwards.
+    touched: bool,
+    /// --- onboarding --- the tour's sample: nothing runs.
+    sample: bool,
 }
 
 impl State {
-    /// A macro is running (the pane is held open, and not torn down).
+    /// A macro is running (its web view is kept alive, folded or not).
     pub fn running(&self) -> bool {
         self.running.is_some()
     }
+
+    /// A run has the pane, and the user folded it: the status bar says so.
+    pub fn folded_run(&self, open: bool) -> bool {
+        !open && self.running.as_ref().is_some_and(|r| r.shown)
+    }
+
+    /// The user folded or unfolded the pane while a macro runs.
+    pub(crate) fn note_user_toggle(&mut self) {
+        if let Some(r) = self.running.as_mut() {
+            r.touched = true;
+        }
+    }
+
+    /// The run's `open` showed the pane.
+    pub(crate) fn note_shown(&mut self) {
+        if let Some(r) = self.running.as_mut() {
+            r.shown = true;
+        }
+    }
+
+    /// --- onboarding --- The tour's cross-post step: a run that has the
+    /// pane (its ■ Stop, and the status bar's mark once folded) with
+    /// nothing running. `false` ends it; a real run is never touched.
+    pub(crate) fn tour_sample(&mut self, on: bool) {
+        if on {
+            if self.running.is_none() {
+                self.running = Some(Running {
+                    stop: Rc::new(Cell::new(false)),
+                    before: (false, super::OpenMode::Slide),
+                    shown: true,
+                    touched: false,
+                    sample: true,
+                });
+            }
+        } else if self.running.as_ref().is_some_and(|r| r.sample) {
+            self.running = None;
+        }
+    }
 }
 
 /// The Preview sheet: the text, editable, before anything happens.
@@ -148,9 +196,17 @@ impl Page for UiPage<'_> {
     async fn eval(&mut self, op: &Op) -> Option<Reply> {
         let (tx, rx) = async_channel::bounded::<String>(2);
         let js = js::call(op);
+        // Typing (or getting ready to type) in the page: never folded.
+        let types = matches!(
+            op,
+            Op::Focus { .. } | Op::Prep { .. } | Op::Exec { .. } | Op::Synth { .. }
+        );
         let sent = self
             .this
-            .update(self.cx, |v, _| {
+            .update(self.cx, |v, cx| {
+                if types {
+                    v.macro_unfold(cx);
+                }
                 v.browser.with(|s| s.eval_json(&js, tx.clone())).is_some()
             })
             .unwrap_or(false);
@@ -188,15 +244,17 @@ impl Page for UiPage<'_> {
     }
 
     fn focus_page(&mut self) {
-        let _ = self
-            .this
-            .update(self.cx, |v, _| v.browser.with(|s| s.focus_page()));
+        let _ = self.this.update(self.cx, |v, cx| {
+            v.macro_unfold(cx);
+            v.browser.with(|s| s.focus_page())
+        });
     }
 
     fn paste(&mut self) {
-        let _ = self
-            .this
-            .update(self.cx, |v, _| v.browser.with(|s| s.edit_command("paste:")));
+        let _ = self.this.update(self.cx, |v, cx| {
+            v.macro_unfold(cx);
+            v.browser.with(|s| s.edit_command("paste:"))
+        });
     }
 
     fn has_edit_commands(&self) -> bool {
@@ -341,7 +399,13 @@ impl MainView {
             self.browser.with(|s| s.refresh_blocking());
         }
         let stop = Rc::new(Cell::new(false));
-        self.browser.automation.running = Some(Running { stop: stop.clone() });
+        self.browser.automation.running = Some(Running {
+            stop: stop.clone(),
+            before: (self.browser.open, self.browser.mode),
+            shown: false,
+            touched: false,
+            sample: false,
+        });
         cx.notify();
         cx.spawn_in(window, async move |this, cx| {
             let mut page = UiPage {
@@ -366,6 +430,7 @@ impl MainView {
         if let Some(r) = &self.browser.automation.running {
             r.stop.set(true);
         }
+        self.browser.automation.tour_sample(false); // --- onboarding ---
         if matches!(
             self.sheet,
             Some(Sheet::MacroPreview(_)) | Some(Sheet::MacroPost(_))
@@ -381,7 +446,7 @@ impl MainView {
         window: &mut Window,
         cx: &mut Context<Self>,
     ) {
-        self.browser.automation.running = None;
+        let ran = self.browser.automation.running.take();
         if matches!(
             self.sheet,
             Some(Sheet::MacroPreview(_)) | Some(Sheet::MacroPost(_))
@@ -443,9 +508,46 @@ impl MainView {
             }
         };
         self.show_toast(text, sub.map(Into::into), cx);
+        if let Some(r) = ran {
+            self.macro_restore_pane(&r, &out, window, cx);
+        }
         cx.notify();
     }
 
+    /// The run is over: the pane goes back to how the user had it (folded
+    /// again if it was folded), unless they folded or unfolded it during the
+    /// run, or the outcome needs the page: the text is waiting for them to
+    /// click Post themselves, the run failed (signed out, a step missed), or
+    /// it stopped after Post was clicked (check whether it posted).
+    fn macro_restore_pane(
+        &mut self,
+        r: &Running,
+        out: &Outcome,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let (was_open, mode) = r.before;
+        let needs_page = matches!(
+            out,
+            Outcome::Handed { .. } | Outcome::Failed(_) | Outcome::Cancelled { after_submit: true }
+        );
+        if r.touched || needs_page || was_open || !self.browser.open {
+            return;
+        }
+        self.close_browser(window, cx);
+        self.browser.mode = mode;
+    }
+
+    /// The run is about to type in the page, or asks the user to check it
+    /// (the Post sheet): a folded pane comes back, because a macro only
+    /// fills in the pane the user watches. Navigating and waiting go on
+    /// folded.
+    pub(crate) fn macro_unfold(&mut self, cx: &mut Context<Self>) {
+        if self.browser.automation.folded_run(self.browser.open) {
+            self.browser_reveal(cx);
+        }
+    }
+
     fn macro_show_preview(
         &mut self,
         info: Preview,
@@ -471,6 +573,8 @@ impl MainView {
                 }
             },
         ));
+        // The sheet's keys, not the page's (it may sit beside the pane).
+        self.browser.with(|s| s.focus_parent());
         editor.update(cx, |s, cx| s.focus(window, cx));
         self.sheet_gen += 1;
         self.sheet = Some(Sheet::MacroPreview(PreviewSheet {
@@ -507,6 +611,10 @@ impl MainView {
         window: &mut Window,
         cx: &mut Context<Self>,
     ) {
+        // The user checks the page beside this sheet: a folded pane comes
+        // back. ⏎ and esc are the sheet's, not the composer's.
+        self.macro_unfold(cx);
+        self.browser.with(|s| s.focus_parent());
         let focus = cx.focus_handle();
         window.focus(&focus, cx);
         self.sheet_gen += 1;
@@ -548,6 +656,41 @@ impl MainView {
             cx.background_executor()
                 .timer(Duration::from_millis(700))
                 .await;
+            // `BLYGGER_DEMO_HOLD_MS`: the sheet stays up longer (a window
+            // screenshot); with `BLYGGER_DEMO_FOLD=1`, the Post sheet's pane
+            // is folded for that time and unfolded again (⇧⌘B both ways).
+            let hold = std::env::var("BLYGGER_DEMO_HOLD_MS")
+                .ok()
+                .and_then(|v| v.parse().ok())
+                .unwrap_or(0);
+            let fold = which == "post" && std::env::var_os("BLYGGER_DEMO_FOLD").is_some();
+            if hold > 0 {
+                println!("macro-hold {which}");
+                cx.background_executor()
+                    .timer(Duration::from_millis(hold))
+                    .await;
+            }
+            if fold {
+                let _ = this.update_in(cx, |v, window, cx| {
+                    v.toggle_browser(&super::ToggleBrowser, window, cx);
+                    println!(
+                        "macro-folded open={} running={} alive={}",
+                        v.browser.open,
+                        v.browser.automation.running(),
+                        v.browser.alive()
+                    );
+                });
+                cx.background_executor()
+                    .timer(Duration::from_millis(hold.max(500)))
+                    .await;
+                let _ = this.update_in(cx, |v, window, cx| {
+                    v.toggle_browser(&super::ToggleBrowser, window, cx);
+                    println!("macro-unfolded open={}", v.browser.open);
+                });
+                cx.background_executor()
+                    .timer(Duration::from_millis(500))
+                    .await;
+            }
             if let Some(dir) = dir {
                 for _ in 0..2 {
                     let _ = cx.update(|window, cx| window.draw(cx).clear(cx));
@@ -803,6 +946,67 @@ impl MainView {
     }
 }
 
+/// The narrowest room left of the pane that a macro sheet sits in; with
+/// less, it drops over the pane as other sheets do.
+pub const SHEET_ROOM_MIN: f32 = 360.;
+
+impl MainView {
+    /// Where the Preview or Post sheet sits: beside the open side pane, over
+    /// the app's content, so the page stays in view (`Some(the pane's
+    /// width)`, the sheet's right margin). `None`: centred over the window
+    /// as other sheets are (the pane full width, folded, or the window too
+    /// narrow); the web view then hides under it.
+    pub(crate) fn macro_sheet_right(&self) -> Option<Pixels> {
+        if !matches!(
+            self.sheet,
+            Some(Sheet::MacroPreview(_)) | Some(Sheet::MacroPost(_))
+        ) {
+            return None;
+        }
+        let b = &self.browser;
+        if !b.open || b.mode != super::OpenMode::Slide {
+            return None;
+        }
+        let width = b.viewport_width();
+        let left = b.left_edge(width - self.notes.room());
+        (f32::from(left) >= SHEET_ROOM_MIN).then(|| width - left)
+    }
+
+    /// The status bar's "macro running" mark while the user has the pane
+    /// folded: a click (or ⇧⌘B) unfolds it.
+    pub(crate) fn render_macro_status(&self, cx: &mut Context<Self>) -> Option<AnyElement> {
+        if !self.browser.automation.folded_run(self.browser.open) {
+            return None;
+        }
+        let p = self.palette.on_status();
+        Some(
+            div()
+                .id("macro-folded")
+                .debug_selector(|| "macro-folded".into())
+                .flex()
+                .items_center()
+                .gap(px(5.))
+                .cursor_pointer()
+                .text_color(self.palette.on_status_text(p.accent))
+                .hover(|s| s.text_color(p.ink))
+                .tooltip(|_, cx| {
+                    cx.new(|_| {
+                        crate::app::reading::Tip(
+                            "A macro is running in the folded browser pane: show it  ⇧⌘B".into(),
+                        )
+                    })
+                    .into()
+                })
+                .on_click(cx.listener(|this, _, window, cx| {
+                    this.toggle_browser(&super::ToggleBrowser, window, cx)
+                }))
+                .child(div().size(px(6.)).rounded_full().bg(p.accent))
+                .child("macro running · show pane")
+                .into_any_element(),
+        )
+    }
+}
+
 /// A key and what it does, as the other sheets show them.
 fn sheet_key(theme: &crate::theme::Theme, k: &'static str, label: &'static str) -> Div {
     div()
@@ -865,7 +1069,7 @@ impl MainView {
                     // The fixture's own sign-in button (a session cookie).
                     let url = format!("{base}/login.html");
                     let _ = this.update_in(cx, |v, window, cx| {
-                        v.open_url_in_app(&url, super::OpenMode::Full, window, cx)
+                        v.open_url_in_app(&url, super::OpenMode::Slide, window, cx)
                     });
                     pause(1500).await;
                     let _ = this.update(cx, |v, _| {
diff --git a/crates/blyg-app/src/browser/automation/tests.rs b/crates/blyg-app/src/browser/automation/tests.rs
index 12d8c7d..932fd5c 100644
--- a/crates/blyg-app/src/browser/automation/tests.rs
+++ b/crates/blyg-app/src/browser/automation/tests.rs
@@ -1653,15 +1653,15 @@ mod ui {
             };
             assert!(!s.info.differs);
             assert!(v.browser.open, "the pane is open");
-            assert_eq!(v.browser.mode, crate::app::browser::OpenMode::Full);
+            // The ordinary side pane, not the whole window.
+            assert_eq!(v.browser.mode, crate::app::browser::OpenMode::Slide);
         });
-        // esc while it runs: the pane stays.
-        view.update_in(cx, |v, window, cx| v.close_browser(window, cx));
-        view.read_with(cx, |v, _| assert!(v.browser.open));
         view.update_in(cx, |v, window, cx| {
             v.macro_post_answer(PostChoice::Post, window, cx)
         });
         until(&view, cx, |v| !v.browser.automation.running());
+        // It was folded before the run: folded again after a post.
+        view.read_with(cx, |v, _| assert!(!v.browser.open));
         assert_eq!(dom.borrow().posted, vec![PAYLOAD.trim().to_string()]);
         // The paste went through the clipboard, and it's the user's again.
         assert_eq!(dom.borrow().commands, vec!["paste:"]);
@@ -1689,6 +1689,156 @@ mod ui {
         view.read_with(cx, |v, _| assert!(!v.browser.open));
     }
 
+    /// The Post sheet sits beside the side pane, over the app's content, so
+    /// the page stays on screen while the user checks it.
+    #[gpui_kit::test]
+    fn the_post_sheet_leaves_the_page_in_view(cx: &mut TestAppContext) {
+        let dom = quick_dom();
+        let (view, cx) = setup(cx, dom.clone());
+        cx.simulate_resize(gpui_kit::size(gpui_kit::px(1400.), gpui_kit::px(900.)));
+        start(&view, cx);
+        view.update_in(cx, |v, window, cx| v.macro_preview_answer(true, window, cx));
+        until(&view, cx, |v| matches!(v.sheet, Some(Sheet::MacroPost(_))));
+        cx.run_until_parked();
+        view.read_with(cx, |v, _| {
+            let right = v.macro_sheet_right().expect("beside the pane");
+            let pane_w = 1400. * crate::app::browser::view::SLIDE_WIDTH;
+            assert!(
+                (f32::from(right) - pane_w).abs() < 1.5,
+                "the sheet's right margin is the pane: {right:?}"
+            );
+            assert!(v.browser.visible(), "the page isn't hidden under the sheet");
+            assert!(
+                !dom.borrow().web_focused,
+                "⏎ is the sheet's, not the page's"
+            );
+        });
+        view.update_in(cx, |v, window, cx| {
+            v.macro_post_answer(PostChoice::Cancel, window, cx)
+        });
+        until(&view, cx, |v| !v.browser.automation.running());
+        // Too narrow beside the pane: the sheet drops over the window and the
+        // web view hides under it, as for any sheet.
+        cx.simulate_resize(gpui_kit::size(gpui_kit::px(900.), gpui_kit::px(700.)));
+        view.update_in(cx, |v, window, cx| {
+            v.open_url_in_app(
+                "https://social.example.com/notes",
+                crate::app::browser::OpenMode::Slide,
+                window,
+                cx,
+            )
+        });
+        cx.executor().advance_clock(Duration::from_secs(70)); // min-interval
+        start(&view, cx);
+        view.update_in(cx, |v, window, cx| v.macro_preview_answer(true, window, cx));
+        until(&view, cx, |v| matches!(v.sheet, Some(Sheet::MacroPost(_))));
+        cx.run_until_parked();
+        view.read_with(cx, |v, _| {
+            assert!(v.macro_sheet_right().is_none());
+            assert!(!v.browser.visible());
+        });
+    }
+
+    /// Folding the pane (esc, ×, ⇧⌘B) while a macro runs doesn't stop it:
+    /// the web view lives on, parked off the window's edge, and the status
+    /// bar says a macro is running. Before it types, the pane comes back.
+    #[gpui_kit::test]
+    fn folding_keeps_the_run_alive_and_it_unfolds_to_type(cx: &mut TestAppContext) {
+        let dom = quick_dom();
+        // The page loads when the test says (its clock doesn't move).
+        dom.borrow_mut().load_time = Duration::from_secs(1);
+        let (view, cx) = setup(cx, dom.clone());
+        start(&view, cx);
+        view.update_in(cx, |v, window, cx| v.macro_preview_answer(true, window, cx));
+        until(&view, cx, |v| v.browser.open);
+        view.read_with(cx, |v, _| {
+            assert_eq!(v.browser.mode, crate::app::browser::OpenMode::Slide);
+            assert!(!v.browser.automation.folded_run(v.browser.open));
+        });
+        cx.simulate_keystrokes(&crate::keymap::keys("cmd-shift-b")); // fold
+        cx.run_until_parked();
+        view.read_with(cx, |v, _| {
+            assert!(!v.browser.open, "folded");
+            assert!(v.browser.automation.running(), "still running");
+            assert!(v.browser.alive(), "the web view is kept");
+            assert!(v.browser.parked(), "parked off-screen, not hidden");
+            assert!(!v.browser.visible());
+            assert!(v.browser.automation.folded_run(v.browser.open));
+        });
+        assert!(
+            cx.debug_bounds("macro-folded").is_some(),
+            "the status bar shows the folded run"
+        );
+        // A teardown never takes a running macro's page.
+        cx.executor()
+            .advance_clock(crate::app::browser::TEARDOWN_AFTER + Duration::from_secs(1));
+        cx.run_until_parked();
+        assert!(view.read_with(cx, |v, _| v.browser.alive()));
+        assert!(dom.borrow().posted.is_empty());
+        // The page loads; before the text goes in, the pane unfolds.
+        dom.borrow().clock.set(Duration::from_secs(2));
+        until(&view, cx, |v| matches!(v.sheet, Some(Sheet::MacroPost(_))));
+        cx.run_until_parked();
+        view.read_with(cx, |v, _| {
+            assert!(v.browser.open, "unfolded to type and to check");
+            assert!(!v.browser.parked());
+            assert!(v.browser.visible());
+        });
+        assert!(cx.debug_bounds("macro-folded").is_none());
+        view.update_in(cx, |v, window, cx| {
+            v.macro_post_answer(PostChoice::Post, window, cx)
+        });
+        until(&view, cx, |v| !v.browser.automation.running());
+        assert_eq!(dom.borrow().posted, vec![PAYLOAD.trim().to_string()]);
+        // The user folded it during the run: their choice stands (it's open
+        // now, as the run left it), it isn't put back to folded.
+        view.read_with(cx, |v, _| assert!(v.browser.open));
+    }
+
+    /// A pane the user had open is reused as it is and stays open; "I'll
+    /// click Post myself" keeps a pane that was folded open too.
+    #[gpui_kit::test]
+    fn an_open_pane_is_reused_and_handing_over_keeps_it(cx: &mut TestAppContext) {
+        let dom = quick_dom();
+        let (view, cx) = setup(cx, dom.clone());
+        view.update_in(cx, |v, window, cx| {
+            v.open_url_in_app(
+                "https://social.example.com/notes",
+                crate::app::browser::OpenMode::Full,
+                window,
+                cx,
+            )
+        });
+        start(&view, cx);
+        view.update_in(cx, |v, window, cx| v.macro_preview_answer(true, window, cx));
+        until(&view, cx, |v| matches!(v.sheet, Some(Sheet::MacroPost(_))));
+        view.read_with(cx, |v, _| {
+            assert_eq!(v.browser.mode, crate::app::browser::OpenMode::Full);
+            // No room beside a full-width pane: the sheet covers as usual.
+            assert!(v.macro_sheet_right().is_none());
+        });
+        view.update_in(cx, |v, window, cx| {
+            v.macro_post_answer(PostChoice::Cancel, window, cx)
+        });
+        until(&view, cx, |v| !v.browser.automation.running());
+        view.read_with(cx, |v, _| {
+            assert!(v.browser.open, "it was open: it stays");
+            assert_eq!(v.browser.mode, crate::app::browser::OpenMode::Full);
+        });
+        // Folded, then a run handed over to the user: the pane stays open.
+        view.update_in(cx, |v, window, cx| v.close_browser(window, cx));
+        start(&view, cx);
+        view.update_in(cx, |v, window, cx| v.macro_preview_answer(true, window, cx));
+        until(&view, cx, |v| matches!(v.sheet, Some(Sheet::MacroPost(_))));
+        view.update_in(cx, |v, window, cx| {
+            v.macro_post_answer(PostChoice::Myself, window, cx)
+        });
+        until(&view, cx, |v| !v.browser.automation.running());
+        view.read_with(cx, |v, _| {
+            assert!(v.browser.open, "Click Post in the pane: it's there");
+        });
+    }
+
     #[gpui_kit::test]
     fn cancel_on_the_post_sheet_posts_nothing(cx: &mut TestAppContext) {
         let dom = quick_dom();
diff --git a/crates/blyg-app/src/browser/capture.rs b/crates/blyg-app/src/browser/capture.rs
index 0f25641..2b8ab1f 100644
--- a/crates/blyg-app/src/browser/capture.rs
+++ b/crates/blyg-app/src/browser/capture.rs
@@ -663,6 +663,14 @@ impl MainView {
 
     /// ✂ Clip / ⇧⌘C / Post › Clip Page to Draft.
     pub(crate) fn browser_clip(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        // --- onboarding --- the tour's clip step, on its sample page.
+        if self.onboarding.tutorial.is_some() {
+            self.tutorial_key(crate::app::onboarding::Key::Clip, window, cx);
+            if self.browser_tour_page() {
+                let block = self.browser_tour_clip();
+                return self.clip_into_draft(block, window, cx);
+            }
+        }
         let Some(rx) = self.browser_capture(cx) else {
             return self.show_toast("Open a page in the browser pane to clip it", None, cx);
         };
diff --git a/crates/blyg-app/src/browser/view.rs b/crates/blyg-app/src/browser/view.rs
index 89baebb..240f01e 100644
--- a/crates/blyg-app/src/browser/view.rs
+++ b/crates/blyg-app/src/browser/view.rs
@@ -47,6 +47,10 @@ const CHROME_H: f32 = 38.;
 /// --- onboarding --- The tutorial's sample page.
 const TOUR_TITLE: &str = "Sample page · a link from a post";
 const TOUR_BODY: &str = "A link you click in a post opens here. (Tour sample: nothing is loaded.)";
+/// What ✂ Clip quotes from the sample page, and its link.
+const TOUR_CLIP: &str = "Tide tables are poems nobody reads aloud. High water at 6:12, low just \
+                         after noon.";
+const TOUR_LINK: &str = "https://blyg.example.com/tide-tables";
 
 /// The web view and where it was last put, shared with the pane's canvas.
 #[derive(Default)]
@@ -59,6 +63,11 @@ struct Placed {
     /// --- notes --- The notes drawer's left edge while it's out: the view
     /// is cut off there (a native view would cover the drawer).
     clip_right: Option<Pixels>,
+    /// --- browser macros --- Folded while a macro runs: the view is shown
+    /// but placed off the window's right edge, so the page stays live (a
+    /// hidden web view may have its timers throttled) and nothing of it is
+    /// seen. It never keeps the keyboard there.
+    parked: bool,
 }
 
 impl Placed {
@@ -66,6 +75,7 @@ impl Placed {
         let Some(s) = self.surface.as_mut() else {
             return;
         };
+        self.parked = false;
         // --- notes ---
         let mut bounds = bounds;
         if let Some(edge) = self.clip_right {
@@ -89,12 +99,36 @@ impl Placed {
     }
 
     fn hide(&mut self) {
+        self.parked = false;
         if let (Some(s), true) = (self.surface.as_mut(), self.visible) {
             s.set_visible(false);
             self.visible = false;
         }
     }
 
+    /// --- browser macros --- See `parked`. `viewport` is the window's size.
+    fn park(&mut self, viewport: Size<Pixels>) {
+        let Some(s) = self.surface.as_mut() else {
+            return;
+        };
+        if self.parked {
+            return;
+        }
+        s.focus_parent();
+        let size = self
+            .frame
+            .map(|f| f.size)
+            .unwrap_or_else(|| size(viewport.width * SLIDE_WIDTH, viewport.height));
+        let off = Bounds::new(point(viewport.width + px(64.), px(0.)), size);
+        s.set_frame(off);
+        self.frame = Some(off);
+        if !self.visible {
+            s.set_visible(true);
+            self.visible = true;
+        }
+        self.parked = true;
+    }
+
     fn with<R>(&mut self, f: impl FnOnce(&mut dyn BrowserSurface) -> R) -> Option<R> {
         self.surface.as_mut().map(|s| f(s.as_mut()))
     }
@@ -203,9 +237,23 @@ impl Browser {
         self.placed.borrow().surface.is_some()
     }
 
+    /// On screen (shown, and not parked off the window's edge).
     #[cfg(test)]
     pub fn visible(&self) -> bool {
-        self.placed.borrow().visible
+        let p = self.placed.borrow();
+        p.visible && !p.parked
+    }
+
+    /// --- browser macros --- Folded under a running macro: shown, off the
+    /// window's edge (see `Placed::parked`).
+    #[cfg(test)]
+    pub fn parked(&self) -> bool {
+        self.placed.borrow().parked
+    }
+
+    /// The window's width, as of the last frame.
+    pub fn viewport_width(&self) -> Pixels {
+        self.viewport_w
     }
 
     /// Blocking applies to the current page.
@@ -371,9 +419,11 @@ impl MainView {
         if self.browser.open {
             self.close_browser(window, cx);
         } else if !self.browser.page.url.is_empty() {
+            self.browser.automation.note_user_toggle(); // --- browser macros ---
             let url = self.browser.page.url.clone();
             let mode = self.browser.mode;
-            if self.browser.alive() {
+            // --- onboarding --- the tour's sample page is never loaded.
+            if self.browser.alive() || self.browser_tour_page() {
                 self.browser.open = true;
                 self.browser.shown += 1;
                 self.browser.close_gen += 1;
@@ -397,15 +447,10 @@ impl MainView {
         if !b.open {
             return;
         }
-        // --- browser macros --- the pane stays while a macro runs in it.
-        if b.automation.running() {
-            self.show_toast(
-                "A macro is running in the browser pane",
-                Some("■ Stop in the pane's bar stops it".into()),
-                cx,
-            );
-            return;
-        }
+        // --- browser macros --- folding the pane doesn't stop a macro: its
+        // web view stays (parked off-screen by `browser_frame`, never torn
+        // down while it runs) and the status bar says it's running.
+        b.automation.note_user_toggle();
         b.open = false;
         b.editing = false;
         {
@@ -812,8 +857,11 @@ impl MainView {
 
     // ------------------------------------------------------ browser macros
 
-    /// --- browser macros --- A run's `open`: the pane full width and
-    /// visible on `url`, loaded even if it's the page already showing.
+    /// --- browser macros --- A run's `open`: `url` in the browser pane,
+    /// loaded even if it's the page already showing. The pane is the
+    /// ordinary side pane (from the right, `SLIDE_WIDTH` of the window); an
+    /// open pane is reused as it is (full width after a ⌘-click), and one
+    /// the user folded during the run stays folded (the page loads parked).
     pub(crate) fn browser_run_open(
         &mut self,
         url: &str,
@@ -823,12 +871,14 @@ impl MainView {
         if !super::is_web_url(url) {
             return;
         }
+        let first = !self.browser.automation.folded_run(false);
+        self.browser.automation.note_shown();
         let b = &mut self.browser;
-        if !b.open || b.mode != OpenMode::Full {
+        if first && !b.open {
             b.shown += 1;
+            b.open = true;
+            b.mode = OpenMode::Slide;
         }
-        b.open = true;
-        b.mode = OpenMode::Full;
         b.editing = false;
         b.close_gen += 1;
         b.teardown = None;
@@ -839,6 +889,21 @@ impl MainView {
         cx.notify();
     }
 
+    /// --- browser macros --- Unfold the pane on its page (as ⇧⌘B does,
+    /// without taking the keyboard).
+    pub(crate) fn browser_reveal(&mut self, cx: &mut Context<Self>) {
+        let b = &mut self.browser;
+        if b.open {
+            return;
+        }
+        b.open = true;
+        b.shown += 1;
+        b.editing = false;
+        b.close_gen += 1;
+        b.teardown = None;
+        cx.notify();
+    }
+
     /// --- browser macros --- The page as a run sees it (`None`: no web
     /// view). A load still waiting for the block lists counts as loading.
     pub(crate) fn browser_run_state(&mut self, cx: &mut Context<Self>) -> Option<PageState> {
@@ -881,6 +946,17 @@ impl MainView {
         cx.notify();
     }
 
+    /// --- onboarding --- The pane shows the tutorial's sample page.
+    pub(crate) fn browser_tour_page(&self) -> bool {
+        self.browser.tour.is_some() && self.browser.page.title == TOUR_TITLE
+    }
+
+    /// --- onboarding --- ✂ Clip on the sample page: its text, title and
+    /// link, as a clip of a real page would quote them.
+    pub(crate) fn browser_tour_clip(&self) -> String {
+        crate::app::notes::quote_with_source(TOUR_CLIP, TOUR_TITLE, Some(TOUR_LINK))
+    }
+
     /// --- onboarding --- The tutorial starts: remember the page, mode and
     /// pane (once), and take the pane away.
     pub(crate) fn browser_tour_park(&mut self, cx: &mut Context<Self>) {
@@ -940,7 +1016,10 @@ impl MainView {
     /// when the pane is closed or covered, and keep the reader's and the
     /// preview's web views out from under the pane.
     pub(crate) fn browser_frame(&mut self, window: &mut Window, cx: &mut Context<Self>) {
-        let covered = self.sheet.is_some()
+        // --- browser macros --- a macro's sheet beside the side pane
+        // leaves the page in view.
+        let sheet_covers = self.sheet.is_some() && self.macro_sheet_right().is_none();
+        let covered = sheet_covers
             || self.ai.has_overlay()
             || self.ext.has_overlay() // --- extensions ---
             || self.reading.sheet.is_some()
@@ -948,10 +1027,14 @@ impl MainView {
             || self.onboarding.tutorial.is_some()
             || self.profile_sheet_open();
         let showing = self.browser.open && !covered;
+        // --- browser macros --- folded while a macro runs: parked.
+        let park = !self.browser.open && self.browser.automation.running();
         {
             let mut p = self.browser.placed.borrow_mut();
             p.suppressed = !showing;
-            if !showing {
+            if park {
+                p.park(window.viewport_size());
+            } else if !showing {
                 p.hide();
             }
         }
@@ -1161,6 +1244,7 @@ impl MainView {
         let loading = pg.loading;
         let shield_on = b.blocking_here();
         let has_page = super::is_web_url(&pg.url);
+        let tour_page = self.browser_tour_page(); // --- onboarding --- ✂ Clip works on it
         let address: AnyElement = match (&b.address, b.editing) {
             (Some(input), true) => div()
                 .flex_1()
@@ -1315,7 +1399,7 @@ impl MainView {
                 button(
                     "browser-clip",
                     "✂ Clip",
-                    has_page,
+                    has_page || tour_page,
                     "Clip the page (or the passage selected on it) into your draft, with its link  ⇧⌘C",
                 )
                 .on_mouse_down(MouseButton::Left, keep_selection())
diff --git a/crates/blyg-app/src/cli.rs b/crates/blyg-app/src/cli.rs
index 92cf93b..48d2f61 100644
--- a/crates/blyg-app/src/cli.rs
+++ b/crates/blyg-app/src/cli.rs
@@ -8,6 +8,7 @@
 //! - `blygger +list-keybinds`
 //! - `blygger +list-extensions`
 //! - `blygger +ext <bundled extension>` (run by Burrow itself, over stdio)
+//! - `blygger +import-opml <file> [--dry-run]`, `blygger +export-opml <file>`
 //! - `blygger +version`
 //! - `blygger +help`
 
@@ -84,8 +85,16 @@ With no action, Burrow starts. Actions:
   +list-extensions        every extension, bundled and installed: whether it's
                           on, what it's granted, what it still asks for, its
                           sites and macros, and problems with installed ones
-  +ext <name>             run a bundled extension (markdown-notes,
-                          cross-post) over stdin/stdout; Burrow starts it itself
+  +ext <name>             run a bundled extension (markdown-notes, cross-post,
+                          reading-time, inspect) over stdin/stdout; Burrow
+                          starts it itself
+  +import-opml <file> [--dry-run]
+                          subscribe your blyg to every feed in another
+                          reader's OPML export, slowly (about 30 a minute),
+                          into the Reader folder Imported feeds; feeds you
+                          already follow are left alone. --dry-run lists
+                          what would be added
+  +export-opml <file>     save every subscription as an OPML 2.0 file
   +version                print the version
   +help                   this help
 
@@ -136,6 +145,9 @@ pub fn exec(action: &str, args: &[&str], load: &mut dyn FnMut() -> ConfigStore)
             o.code = 2;
         }
         "+list-extensions" => o.stdout = list_extensions(&load()),
+        // --- OPML ---
+        "+import-opml" => import_opml(args, &load(), &mut o),
+        "+export-opml" => export_opml(args, &load(), &mut o),
         "+show-config" => match ShowOptions::from_args(args.iter().copied()) {
             Ok(opts) => {
                 let store = load();
@@ -234,6 +246,206 @@ pub fn exec(action: &str, args: &[&str], load: &mut dyn FnMut() -> ConfigStore)
     o
 }
 
+// --- OPML ---
+
+/// The configured blyg, opened without the sync worker (nothing pushed),
+/// its subscriptions freshly pulled. `Err` says why not.
+fn opml_backend(store: &ConfigStore) -> Result<blyg_core::LiveBackend, String> {
+    use blyg_core::config::{MemoryTokenStore, TokenStore};
+    let url = store
+        .config()
+        .blyg_url()
+        .ok_or("no blyg is connected (open Burrow and connect one first)")?
+        .to_string();
+    // BLYGGER_TEST_TOKEN: an in-memory token (a local studio), no Keychain.
+    let tokens: std::sync::Arc<dyn TokenStore> = match std::env::var("BLYGGER_TEST_TOKEN") {
+        Ok(t) => {
+            let m = MemoryTokenStore::default();
+            let _ = m.set(&url, t.trim());
+            std::sync::Arc::new(m)
+        }
+        Err(_) => std::sync::Arc::new(blyg_core::config::KeychainTokenStore),
+    };
+    let opts = blyg_core::SyncOptions {
+        start_worker: false,
+        ..Default::default()
+    };
+    let live =
+        crate::connection::open_live_with(&blyg_core::config::data_dir(), &url, &tokens, opts)
+            .map_err(|e| format!("couldn't open the local database: {e}"))?
+            .ok_or_else(|| {
+                format!("no owner credential for {url} in the Keychain; connect again in Burrow")
+            })?;
+    live.pull_now()
+        .map_err(|e| format!("couldn't reach your blyg: {e}"))?;
+    Ok(live)
+}
+
+fn import_opml(args: &[&str], store: &ConfigStore, o: &mut Outcome) {
+    use blyg_core::Backend as _;
+    use blyg_core::opml::{self, Outcome as Got, Pace, Progress, Summary};
+    let dry = args.contains(&"--dry-run");
+    let Some(file) = args.iter().find(|a| !a.starts_with("--")) else {
+        o.stderr = "usage: blygger +import-opml <file> [--dry-run]\n".into();
+        o.code = 2;
+        return;
+    };
+    let parsed = match opml::read_file(std::path::Path::new(file)) {
+        Ok(p) => p,
+        Err(e) => {
+            o.stderr = format!("blygger +import-opml: {e}\n");
+            o.code = 1;
+            return;
+        }
+    };
+    let backend = match opml_backend(store) {
+        Ok(b) => Some(b),
+        Err(e) if dry => {
+            o.stderr = format!(
+                "blygger +import-opml: {e}; listing the file without checking what you follow\n"
+            );
+            None
+        }
+        Err(e) => {
+            o.stderr = format!("blygger +import-opml: {e}\n");
+            o.code = 1;
+            return;
+        }
+    };
+    let subs = backend
+        .as_ref()
+        .map(|b| b.subscriptions())
+        .unwrap_or_default();
+    let (already, new): (Vec<_>, Vec<_>) = parsed
+        .feeds
+        .iter()
+        .partition(|f| opml::followed(f, &subs).is_some());
+    let mut notes = vec![];
+    if parsed.duplicates > 0 {
+        notes.push(format!("{} duplicates collapsed", parsed.duplicates));
+    }
+    if parsed.without_feed > 0 {
+        notes.push(format!(
+            "{} without a feed address skipped",
+            parsed.without_feed
+        ));
+    }
+    let note = if notes.is_empty() {
+        String::new()
+    } else {
+        format!(" ({})", notes.join(", "))
+    };
+    let line = |label: &str, f: &opml::OpmlFeed, extra: &str| {
+        let folder = f
+            .folder
+            .as_deref()
+            .map(|d| format!(" [{d}]"))
+            .unwrap_or_default();
+        format!("  {label:<18} {}{folder}  {}{extra}\n", f.title, f.xml_url)
+    };
+    if dry {
+        o.stdout = format!("{} feeds in {file}{note}.\n", parsed.feeds.len());
+        for f in &new {
+            o.stdout.push_str(&line("would add", f, ""));
+        }
+        for f in &already {
+            o.stdout.push_str(&line("already followed", f, ""));
+        }
+        o.stdout.push_str(&format!(
+            "Would add {} (into the Reader folder \"{}\"); {} already followed. Nothing was changed.\n",
+            new.len(),
+            opml::IMPORT_FOLDER,
+            already.len()
+        ));
+        return;
+    }
+    let Some(backend) = backend else { return };
+    let feeds: Vec<opml::OpmlFeed> = new.into_iter().cloned().collect();
+    let pace = Pace::default();
+    eprintln!(
+        "Importing {} of {} feeds from {file}{note}, about 30 a minute (each new subscription fetches its archive). Ctrl-C stops; what's done stays done.",
+        feeds.len(),
+        parsed.feeds.len()
+    );
+    let total = feeds.len();
+    let done = std::sync::atomic::AtomicUsize::new(0);
+    let results = opml::run_import(
+        &backend,
+        &feeds,
+        &pace,
+        &std::sync::atomic::AtomicBool::new(false),
+        &|p| match p {
+            Progress::Waiting { seconds } => {
+                eprintln!("  the blyg asked Burrow to slow down: waiting {seconds} s")
+            }
+            Progress::Done { index, outcome } => {
+                let n = done.fetch_add(1, std::sync::atomic::Ordering::Relaxed) + 1;
+                let what = match &outcome {
+                    Got::Added { .. } => "added".to_string(),
+                    Got::AlreadyFollowing => "already followed".to_string(),
+                    Got::Failed { kind, reason } => format!("failed ({}): {reason}", kind.label()),
+                };
+                eprintln!("  {n}/{total} {}: {what}", feeds[index].xml_url);
+            }
+        },
+    );
+    let mut sum = Summary::of(&results);
+    sum.already += already.len();
+    for f in &already {
+        o.stdout.push_str(&line("already followed", f, ""));
+    }
+    for (i, r) in results.iter().enumerate() {
+        match r {
+            Some(Got::Added { .. }) => o.stdout.push_str(&line("added", &feeds[i], "")),
+            Some(Got::AlreadyFollowing) => {
+                o.stdout.push_str(&line("already followed", &feeds[i], ""))
+            }
+            Some(Got::Failed { kind, reason }) => o.stdout.push_str(&line(
+                &format!("failed ({})", kind.label()),
+                &feeds[i],
+                &format!(": {reason}"),
+            )),
+            None => {}
+        }
+    }
+    o.stdout.push_str(&sum.line());
+    if sum.added > 0 {
+        o.stdout
+            .push_str(&format!(". {}", crate::app::reading::opml::WHERE_THEY_GO));
+    }
+    o.stdout.push_str(".\n");
+    if !sum.failed.is_empty() {
+        o.code = 1;
+    }
+}
+
+fn export_opml(args: &[&str], store: &ConfigStore, o: &mut Outcome) {
+    use blyg_core::Backend as _;
+    let Some(file) = args.first() else {
+        o.stderr = format!(
+            "usage: blygger +export-opml <file>   (e.g. {})\n",
+            blyg_core::opml::EXPORT_FILE_NAME
+        );
+        o.code = 2;
+        return;
+    };
+    let subs = match opml_backend(store) {
+        Ok(b) => b.subscriptions(),
+        Err(e) => {
+            o.stderr = format!("blygger +export-opml: {e}\n");
+            o.code = 1;
+            return;
+        }
+    };
+    match std::fs::write(file, blyg_core::opml::export(&subs)) {
+        Ok(()) => o.stdout = format!("Saved {} subscriptions to {file}\n", subs.len()),
+        Err(e) => {
+            o.stderr = format!("blygger +export-opml: couldn't write {file}: {e}\n");
+            o.code = 1;
+        }
+    }
+}
+
 /// The config's problems: the settings' own, then the extensions'.
 fn diagnostics(store: &ConfigStore) -> Vec<Diagnostic> {
     let mut out = crate::settings::diagnostics(store.loaded(), &themes_of(store));
@@ -244,13 +456,21 @@ fn diagnostics(store: &ConfigStore) -> Vec<Diagnostic> {
 // --- extensions ---
 
 /// The extensions built into the app, each run as `blygger +ext <name>`.
-const BUNDLED_EXTENSIONS: &[&str] = &[blyg_ext_notes::NAME, blyg_ext_crosspost::NAME];
+const BUNDLED_EXTENSIONS: &[&str] = &[
+    blyg_ext_notes::NAME,
+    blyg_ext_crosspost::NAME,
+    blyg_ext_reading_time::NAME, // --- reading slots ---
+    blyg_ext_inspect::NAME,
+];
 
 /// How to serve a bundled extension over this process's stdin/stdout.
 fn bundled_extension(name: &str) -> Option<fn() -> ExitCode> {
     match name {
         blyg_ext_notes::NAME => Some(blyg_ext_notes::run_stdio),
         blyg_ext_crosspost::NAME => Some(blyg_ext_crosspost::run_stdio),
+        // --- reading slots ---
+        blyg_ext_reading_time::NAME => Some(blyg_ext_reading_time::run_stdio),
+        blyg_ext_inspect::NAME => Some(blyg_ext_inspect::run_stdio),
         _ => None,
     }
 }
@@ -279,7 +499,16 @@ pub(crate) fn host_config(store: &ConfigStore) -> blyg_ext::HostConfig {
             vec!["+ext".into(), blyg_ext_notes::NAME.into()],
             &notes,
         ),
-        blyg_ext_crosspost::bundled(exe, vec!["+ext".into(), blyg_ext_crosspost::NAME.into()]),
+        blyg_ext_crosspost::bundled(
+            exe.clone(),
+            vec!["+ext".into(), blyg_ext_crosspost::NAME.into()],
+        ),
+        // --- reading slots ---
+        blyg_ext_reading_time::bundled(
+            exe.clone(),
+            vec!["+ext".into(), blyg_ext_reading_time::NAME.into()],
+        ),
+        blyg_ext_inspect::bundled(exe, vec!["+ext".into(), blyg_ext_inspect::NAME.into()]),
     ];
     c
 }
@@ -593,6 +822,58 @@ mod tests {
         move || ConfigStore::open(blyg_core::config::ConfigFiles::single(dir.join("config")))
     }
 
+    // --- OPML --- without a connected blyg (the e2e runs the real thing).
+    #[test]
+    fn opml_commands_without_a_blyg() {
+        let dir = tempfile::tempdir().unwrap();
+        let file = dir.path().join("feeds.opml");
+        std::fs::write(
+            &file,
+            r#"<opml version="2.0"><body><outline text="Tech">
+              <outline text="Kit" xmlUrl="https://kit.example.org/feed.xml"/>
+              <outline text="Kit again" xmlUrl="https://kit.example.org/feed.xml"/>
+            </outline></body></opml>"#,
+        )
+        .unwrap();
+        let f = file.to_str().unwrap();
+        let o = exec("+import-opml", &[f, "--dry-run"], &mut on_disk(dir.path()));
+        assert_eq!(o.code, 0, "{}", o.stderr);
+        assert!(o.stderr.contains("no blyg is connected"), "{}", o.stderr);
+        assert!(o.stdout.contains("1 feeds in"), "{}", o.stdout);
+        assert!(o.stdout.contains("1 duplicates collapsed"), "{}", o.stdout);
+        assert!(
+            o.stdout
+                .contains("would add          Kit [Tech]  https://kit.example.org/feed.xml"),
+            "{}",
+            o.stdout
+        );
+        assert!(o.stdout.contains("Nothing was changed"), "{}", o.stdout);
+
+        let o = exec("+import-opml", &[f], &mut on_disk(dir.path()));
+        assert_eq!(o.code, 1);
+        assert!(o.stderr.contains("no blyg is connected"), "{}", o.stderr);
+        assert_eq!(exec("+import-opml", &[], &mut on_disk(dir.path())).code, 2);
+        let missing = dir.path().join("nope.opml");
+        let o = exec(
+            "+import-opml",
+            &[missing.to_str().unwrap()],
+            &mut on_disk(dir.path()),
+        );
+        assert!(o.stderr.contains("Couldn't read the file"), "{}", o.stderr);
+
+        let out = dir.path().join("out.opml");
+        let o = exec(
+            "+export-opml",
+            &[out.to_str().unwrap()],
+            &mut on_disk(dir.path()),
+        );
+        assert_eq!(o.code, 1);
+        assert!(!out.exists());
+        assert_eq!(exec("+export-opml", &[], &mut on_disk(dir.path())).code, 2);
+        assert!(HELP.contains("+import-opml <file> [--dry-run]"));
+        assert!(HELP.contains("+export-opml <file>"));
+    }
+
     #[test]
     fn copy_theme_round_trips_every_builtin() {
         use blyg_core::config::theme::{BUILTIN, Registry};
@@ -720,7 +1001,7 @@ mod tests {
         };
         has(
             1,
-            "extension: `markdown-notes` asks for fs:~/Notes, ui; nothing is granted yet",
+            "extension: `markdown-notes` asks for ui; nothing is granted yet",
         );
         has(
             2,
diff --git a/crates/blyg-app/src/connection.rs b/crates/blyg-app/src/connection.rs
index 7f35f1d..5f1dc31 100644
--- a/crates/blyg-app/src/connection.rs
+++ b/crates/blyg-app/src/connection.rs
@@ -94,6 +94,20 @@ pub fn open_live(
     url: &str,
     tokens: &Arc<dyn TokenStore>,
 ) -> Result<Option<Arc<dyn Backend>>> {
+    Ok(
+        open_live_with(data_dir, url, tokens, blyg_core::SyncOptions::default())?
+            .map(|l| Arc::new(l) as Arc<dyn Backend>),
+    )
+}
+
+/// `open_live` with sync options (`blygger +import-opml` opens it without
+/// the sync worker).
+pub fn open_live_with(
+    data_dir: &Path,
+    url: &str,
+    tokens: &Arc<dyn TokenStore>,
+    opts: blyg_core::SyncOptions,
+) -> Result<Option<LiveBackend>> {
     let Some(cred) = blyg_core::config::load_credential(tokens, url)? else {
         return Ok(None);
     };
@@ -113,9 +127,9 @@ pub fn open_live(
             }
         }
     }
-    let live = LiveBackend::open(data_dir, url, cred)?;
+    let live = LiveBackend::open_with(data_dir, url, cred, opts)?;
     std::fs::write(&owner, url).map_err(|e| CoreError::Storage(e.to_string()))?;
-    Ok(Some(Arc::new(live)))
+    Ok(Some(live))
 }
 
 /// Delete the local copy (database, its WAL, cached themes and images).
@@ -627,6 +641,33 @@ impl Backend for SwitchBackend {
     fn public_pinned(&self, origin: &str, id: &str, version: u32) -> Result<PinnedVersion> {
         self.cur().public_pinned(origin, id, version)
     }
+    // --- lineage counts ---
+    fn lineage_summaries(
+        &self,
+        keys: &[String],
+        max_age_ms: i64,
+    ) -> Option<std::collections::HashMap<String, blyg_core::lineage::LineageSummary>> {
+        self.cur().lineage_summaries(keys, max_age_ms)
+    }
+    fn cached_lineage_summaries(
+        &self,
+        keys: &[String],
+    ) -> Option<std::collections::HashMap<String, blyg_core::lineage::LineageSummary>> {
+        self.cur().cached_lineage_summaries(keys)
+    }
+    fn lineage_graph(
+        &self,
+        centre: &blyg_core::lineage::Centre,
+        max_age_ms: i64,
+    ) -> Option<blyg_core::lineage::LineageGraph> {
+        self.cur().lineage_graph(centre, max_age_ms)
+    }
+    fn cached_lineage_graph(
+        &self,
+        centre: &blyg_core::lineage::Centre,
+    ) -> Option<blyg_core::lineage::LineageGraph> {
+        self.cur().cached_lineage_graph(centre)
+    }
 }
 
 #[cfg(test)]
diff --git a/crates/blyg-app/src/extensions/library.rs b/crates/blyg-app/src/extensions/library.rs
index 5412fda..1ccd233 100644
--- a/crates/blyg-app/src/extensions/library.rs
+++ b/crates/blyg-app/src/extensions/library.rs
@@ -44,6 +44,13 @@ pub(crate) struct OpenNote {
     pub folder: Option<String>,
 }
 
+/// A quote picker hit, with the library (vault) it came from.
+#[derive(Debug, Clone)]
+pub(crate) struct PickerHit {
+    pub lib: LibraryRef,
+    pub hit: SourceEntry,
+}
+
 /// The panel's state (part of `Extensions`).
 #[derive(Default)]
 pub(crate) struct Library {
@@ -63,14 +70,29 @@ pub(crate) struct Library {
     pub editor: Option<Entity<TextareaState>>,
     /// Setting the editor's text (not an edit).
     loading: bool,
+    /// The library (vault) chosen in the switcher, by id; `None` or one
+    /// that's gone: the first. Kept in `state.json` (`notes_vault`).
+    pub vault: Option<String>,
+    /// `vault` has been read from `state.json`.
+    vault_loaded: bool,
     // --- the quote picker's Notes chip ---
     pub picker: bool,
-    pub picker_hits: Vec<SourceEntry>,
+    /// Hits from every library (vault), in library order.
+    pub picker_hits: Vec<PickerHit>,
     picker_gen: u64,
     pub picker_status: Option<String>,
 }
 
 impl Library {
+    /// --- onboarding --- The tour's panel: the first sample folder, and
+    /// nothing read from (or written to) `state.json`.
+    pub fn for_tour() -> Library {
+        Library {
+            vault_loaded: true,
+            ..Library::default()
+        }
+    }
+
     /// The open note has edits not saved yet.
     pub fn dirty(&self, cx: &App) -> bool {
         match (&self.note, &self.editor) {
@@ -91,9 +113,106 @@ fn failure(lib: &LibraryRef, e: &ExtError) -> String {
 }
 
 impl MainView {
-    /// The library the panel shows: the first running extension's first.
+    /// Every running library, in order (each markdown-notes vault is one).
+    pub(crate) fn ext_libraries(&self) -> Vec<LibraryRef> {
+        self.ext
+            .host
+            .as_ref()
+            .map(|h| h.libraries())
+            .unwrap_or_default()
+    }
+
+    /// The library the panel shows: the one chosen in the switcher, else
+    /// the first.
     pub(crate) fn ext_library(&self) -> Option<LibraryRef> {
-        self.ext.host.as_ref()?.libraries().into_iter().next()
+        let all = self.ext_libraries();
+        let chosen = self.ext.lib.vault.as_deref();
+        all.iter()
+            .find(|l| Some(l.library.id.as_str()) == chosen)
+            .cloned()
+            .or_else(|| all.into_iter().next())
+    }
+
+    /// markdown-notes is turned on (its tab shows even with no folder, to
+    /// offer one).
+    pub(crate) fn ext_notes_on(&self) -> bool {
+        self.ext.host.as_ref().is_some_and(|h| {
+            h.status()
+                .iter()
+                .any(|s| s.name == super::NOTES && s.enabled)
+        })
+    }
+
+    /// The markdown-notes libraries whose folder isn't allowed yet.
+    fn ext_vaults_denied(&self, cx: &App) -> Vec<String> {
+        let Some(host) = self.ext.host.as_ref() else {
+            return vec![];
+        };
+        let Some(st) = host.status().into_iter().find(|s| s.name == super::NOTES) else {
+            return vec![];
+        };
+        self.ext_vaults(cx)
+            .1
+            .into_iter()
+            .filter(|v| {
+                st.missing
+                    .contains(&blyg_ext::Capability::Fs(v.path.clone()))
+            })
+            .map(|v| v.library)
+            .collect()
+    }
+
+    /// Show library `id` (`None`: the first) and remember it. An edit to
+    /// the open note is saved first.
+    pub(crate) fn ext_lib_choose(
+        &mut self,
+        id: Option<String>,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        self.ext_lib_load_choice();
+        if self.ext.lib.vault == id {
+            return;
+        }
+        let keep = self.ext.lib.note.as_ref().is_some_and(|n| n.stale);
+        if self.ext.lib.dirty(cx) && !keep {
+            self.ext_lib_save(window, cx);
+        }
+        self.ext.lib.vault = id.clone();
+        self.ext.lib.note = None;
+        self.ext.lib.path = None;
+        self.ext.lib.entries.clear();
+        self.ext.lib.hits = None;
+        self.ext.lib.status = None;
+        // (The tour's sample folders aren't remembered.)
+        if let Some(d) = self.ext.launch.as_ref().map(|l| &l.data_dir)
+            && !self.ext_tour_on()
+        {
+            let _ = blyg_core::state::AppState::update(d, |s| s.notes_vault = id);
+        }
+        self.ext_lib_refresh(window, cx);
+        cx.notify();
+    }
+
+    /// Read the remembered vault from `state.json` (once).
+    fn ext_lib_load_choice(&mut self) {
+        if self.ext.lib.vault_loaded {
+            return;
+        }
+        self.ext.lib.vault_loaded = true;
+        if self.ext.lib.vault.is_none() {
+            self.ext.lib.vault = self
+                .ext
+                .launch
+                .as_ref()
+                .map(|l| blyg_core::state::AppState::load(&l.data_dir))
+                .and_then(|s| s.notes_vault);
+        }
+    }
+
+    /// `lib` is still the library on screen.
+    fn ext_lib_is(&self, lib: &LibraryRef) -> bool {
+        self.ext_library().as_ref() == Some(lib)
     }
 
     fn ext_lib_host(&self) -> Option<(Host, LibraryRef)> {
@@ -102,6 +221,7 @@ impl MainView {
 
     /// Make the search box and the note editor (once).
     fn ext_lib_ensure(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        self.ext_lib_load_choice();
         if self.ext.lib.search.is_none() {
             let search = cx.new(|cx| InputState::new(window, cx).placeholder("Search notes…"));
             self._subs.push(cx.subscribe_in(
@@ -148,7 +268,7 @@ impl MainView {
 
     /// Open the drawer on the library (the palette's "Browse Notes").
     pub(crate) fn ext_lib_show(&mut self, window: &mut Window, cx: &mut Context<Self>) {
-        if self.ext_library().is_none() {
+        if self.ext_library().is_none() && !self.ext_notes_on() {
             return self.show_toast("No notes library is running", None, cx);
         }
         self.ext_lib_ensure(window, cx);
@@ -187,7 +307,9 @@ impl MainView {
 
     /// The drawer shows the library now.
     pub(crate) fn ext_lib_showing(&self) -> bool {
-        self.ext.lib.tab && self.ext.host.is_some() && self.ext_library().is_some()
+        self.ext.lib.tab
+            && self.ext.host.is_some()
+            && (self.ext_library().is_some() || self.ext_notes_on())
     }
 
     /// List the folder on screen again (and search again), when shown.
@@ -222,6 +344,9 @@ impl MainView {
         cx.spawn_in(window, async move |this, cx| {
             let r = task.await;
             let _ = this.update_in(cx, |v, _, cx| {
+                if !v.ext_lib_is(&lib) {
+                    return; // another vault was chosen meanwhile
+                }
                 match r {
                     Ok(entries) => {
                         v.ext.lib.path = path;
@@ -267,7 +392,7 @@ impl MainView {
         cx.spawn_in(window, async move |this, cx| {
             let r = task.await;
             let _ = this.update_in(cx, |v, _, cx| {
-                if v.ext.lib.search_gen != gen_ {
+                if v.ext.lib.search_gen != gen_ || !v.ext_lib_is(&lib) {
                     return; // a newer search is on its way
                 }
                 match r {
@@ -298,6 +423,9 @@ impl MainView {
         cx.spawn_in(window, async move |this, cx| {
             let r = task.await;
             let _ = this.update_in(cx, |v, window, cx| {
+                if !v.ext_lib_is(&lib) {
+                    return;
+                }
                 match r {
                     Ok(doc) => v.ext_lib_load(doc, window, cx),
                     Err(e) => v.ext.lib.status = Some(failure(&lib, &e)),
@@ -424,6 +552,13 @@ impl MainView {
         cx.spawn_in(window, async move |this, cx| {
             let r = task.await;
             let _ = this.update_in(cx, |v, window, cx| {
+                if !v.ext_lib_is(&lib) {
+                    // Saved on the way to another vault: nothing to show.
+                    if let Err(e) = &r {
+                        v.show_toast(failure(&lib, e), None, cx);
+                    }
+                    return;
+                }
                 match r {
                     Ok(doc) => {
                         let id = doc.id.clone();
@@ -548,39 +683,57 @@ impl MainView {
         self.ext.lib.picker && self.ext_library().is_some()
     }
 
-    /// Search the notes for the picker's box (only the newest answer shows).
+    /// Search the notes for the picker's box: every library (vault), in
+    /// order, together at most [`SEARCH_LIMIT`] hits; a vault that refuses
+    /// (not allowed yet) is skipped. Only the newest answer shows.
     pub(crate) fn ext_picker_search(&mut self, query: String, cx: &mut Context<Self>) {
         if !self.ext.lib.picker {
             return;
         }
-        let Some((host, lib)) = self.ext_lib_host() else {
+        let Some(host) = self.ext.host.clone() else {
             return;
         };
+        let libs = self.ext_libraries();
+        if libs.is_empty() {
+            return;
+        }
         self.ext.lib.picker_gen += 1;
         let gen_ = self.ext.lib.picker_gen;
-        let p = LibrarySearchParams {
-            library: Some(lib.library.id.clone()),
-            query,
-            limit: SEARCH_LIMIT,
-        };
-        let e = lib.ext.clone();
-        let task = cx.background_spawn(async move { host.library_search(&e, &p) });
-        cx.spawn(async move |this, cx| {
-            let r = task.await;
-            let _ = this.update(cx, |v, cx| {
-                if v.ext.lib.picker_gen != gen_ {
-                    return;
-                }
-                match r {
+        let task = cx.background_spawn(async move {
+            let mut hits = vec![];
+            let mut failed = None;
+            let mut answered = false;
+            for lib in libs {
+                let p = LibrarySearchParams {
+                    library: Some(lib.library.id.clone()),
+                    query: query.clone(),
+                    limit: SEARCH_LIMIT,
+                };
+                match host.library_search(&lib.ext, &p) {
                     Ok(h) => {
-                        v.ext.lib.picker_hits = h;
-                        v.ext.lib.picker_status = None;
+                        answered = true;
+                        hits.extend(h.into_iter().map(|hit| PickerHit {
+                            lib: lib.clone(),
+                            hit,
+                        }));
                     }
                     Err(e) => {
-                        v.ext.lib.picker_hits.clear();
-                        v.ext.lib.picker_status = Some(failure(&lib, &e));
+                        failed.get_or_insert_with(|| failure(&lib, &e));
                     }
                 }
+            }
+            hits.truncate(SEARCH_LIMIT);
+            (hits, failed.filter(|_| !answered))
+        });
+        cx.spawn(async move |this, cx| {
+            let (hits, failed) = task.await;
+            let _ = this.update(cx, |v, cx| {
+                if v.ext.lib.picker_gen != gen_ {
+                    return;
+                }
+                // A failure only shows when no vault answered.
+                v.ext.lib.picker_status = failed;
+                v.ext.lib.picker_hits = hits;
                 cx.notify();
             });
         })
@@ -596,10 +749,10 @@ impl MainView {
         window: &mut Window,
         cx: &mut Context<Self>,
     ) {
-        let Some((host, lib)) = self.ext_lib_host() else {
+        let Some(host) = self.ext.host.clone() else {
             return;
         };
-        let Some(hit) = self.ext.lib.picker_hits.get(i).cloned() else {
+        let Some(PickerHit { lib, hit }) = self.ext.lib.picker_hits.get(i).cloned() else {
             return;
         };
         let p = LibraryReadParams {
@@ -659,7 +812,11 @@ impl MainView {
                 .text_size(px(11.))
                 .cursor_pointer()
                 .hover(|s| s.bg(p.hover()))
-                .child(lib.library.title.to_lowercase())
+                .child(if lib.ext == super::NOTES {
+                    "notes".to_string()
+                } else {
+                    lib.library.title.to_lowercase()
+                })
                 .on_click(
                     cx.listener(move |this, _, _, cx| this.ext_picker_toggle(query.clone(), cx)),
                 )
@@ -691,12 +848,19 @@ impl MainView {
                     .into_any_element(),
             ];
         }
+        let several = self.ext_libraries().len() > 1;
         self.ext
             .lib
             .picker_hits
             .iter()
             .enumerate()
-            .map(|(i, h)| {
+            .map(|(i, ph)| {
+                let h = &ph.hit;
+                let from = if several {
+                    format!("{} · ", ph.lib.library.title)
+                } else {
+                    String::new()
+                };
                 let when =
                     h.at.as_deref()
                         .map(|t| crate::vm::relative_time(t, now))
@@ -728,7 +892,7 @@ impl MainView {
                             .text_size(px(10.5))
                             .text_color(p.muted)
                             .truncate()
-                            .child(format!("note · quoted as text · {when}")),
+                            .child(format!("note · {from}quoted as text · {when}")),
                     )
                     .into_any_element()
             })
@@ -739,7 +903,13 @@ impl MainView {
 
     /// Hook (the drawer's top): "Reading notes | Notes" when a library runs.
     pub(crate) fn render_ext_tabs(&self, cx: &mut Context<Self>) -> Option<AnyElement> {
-        let lib = self.ext_library()?;
+        // markdown-notes shows its tab with no folder yet, to offer one.
+        let (title, ext): (SharedString, String) = match self.ext_library() {
+            Some(l) if l.ext != super::NOTES => (l.library.title.into(), l.ext),
+            Some(_) => ("Notes".into(), super::NOTES.into()),
+            None if self.ext_notes_on() => ("Notes".into(), super::NOTES.into()),
+            None => return None,
+        };
         let p = self.palette;
         let theme = &*self.theme;
         let on = self.ext.lib.tab;
@@ -771,18 +941,11 @@ impl MainView {
                         cx.listener(|this, _, window, cx| this.ext_lib_tab(false, window, cx)),
                     ),
                 )
-                .child(
-                    tab("notes-tab-library", lib.library.title.clone().into(), on).on_click(
-                        cx.listener(|this, _, window, cx| this.ext_lib_tab(true, window, cx)),
-                    ),
-                )
+                .child(tab("notes-tab-library", title, on).on_click(
+                    cx.listener(|this, _, window, cx| this.ext_lib_tab(true, window, cx)),
+                ))
                 .child(div().flex_1())
-                .child(
-                    div()
-                        .text_size(px(10.5))
-                        .text_color(p.muted)
-                        .child(lib.ext.clone()),
-                )
+                .child(div().text_size(px(10.5)).text_color(p.muted).child(ext))
                 .into_any_element(),
         )
     }
@@ -796,7 +959,20 @@ impl MainView {
         if !self.ext_lib_showing() {
             return None;
         }
-        let lib = self.ext_library()?;
+        let Some(lib) = self.ext_library() else {
+            return Some(self.render_ext_lib_empty(cx));
+        };
+        let switcher = self.render_ext_vault_switcher(&lib, cx);
+        let denied = (lib.ext == super::NOTES)
+            .then(|| {
+                let denied = self.ext_vaults_denied(cx);
+                self.ext_vaults(cx)
+                    .1
+                    .into_iter()
+                    .find(|v| v.library == lib.library.id && denied.contains(&v.library))
+                    .map(|v| v.path)
+            })
+            .flatten();
         let search = self.ext.lib.search.clone()?;
         let editor = self.ext.lib.editor.clone()?;
         let p = self.palette;
@@ -1001,6 +1177,7 @@ impl MainView {
                 .flex_col()
                 .gap(px(6.))
                 .rule_b(&p)
+                .children(switcher)
                 .child(
                     div()
                         .flex()
@@ -1107,6 +1284,18 @@ impl MainView {
         };
         let empty = rows.is_empty();
         let searching = self.ext.lib.hits.is_some();
+        // The vault on screen isn't allowed yet: say so, offer to ask.
+        if let Some(path) = denied {
+            let body = message_body(
+                &p,
+                format!("Burrow needs your permission to read and write {path}."),
+                chip("lib-vault-allow", "Allow…".into()).on_click(
+                    cx.listener(|this, _, window, cx| this.ext_ask_again(super::NOTES, window, cx)),
+                ),
+            );
+            let footer = footer_hint("Your other notes folders work meanwhile");
+            return Some((header, body, footer));
+        }
         let body = div()
             .id("lib-list")
             .flex_1()
@@ -1145,6 +1334,162 @@ impl MainView {
         Some((header, body, footer))
     }
 
+    /// A small chip for the drawer (`active`: the chosen one).
+    fn ext_lib_chip(&self, id: ElementId, label: SharedString, active: bool) -> Stateful<Div> {
+        let p = self.palette;
+        div()
+            .id(id)
+            .flex_none()
+            .px(px(7.))
+            .h(px(22.))
+            .flex()
+            .items_center()
+            .map(|d| crate::theme_ext::chip(d, &self.theme, active))
+            .when(active, |d| d.bg(p.pick()))
+            .text_size(px(11.5))
+            .text_color(p.ink)
+            .cursor_pointer()
+            .hover(|s| s.bg(p.hover()))
+            .child(label)
+    }
+
+    /// The vault switcher above markdown-notes' folders: a chip per vault
+    /// (one not allowed yet in the warning colour), "Add folder…", and the
+    /// chosen vault's folder with "Remove from Burrow" (the config line
+    /// only; the folder is never touched).
+    fn render_ext_vault_switcher(
+        &self,
+        lib: &LibraryRef,
+        cx: &mut Context<Self>,
+    ) -> Option<AnyElement> {
+        if lib.ext != super::NOTES {
+            return None;
+        }
+        let p = self.palette;
+        let vaults = self.ext_vaults(cx).1;
+        let denied = self.ext_vaults_denied(cx);
+        let libs: Vec<LibraryRef> = self
+            .ext_libraries()
+            .into_iter()
+            .filter(|l| l.ext == super::NOTES)
+            .collect();
+        let mut chips: Vec<AnyElement> = vec![];
+        for (i, l) in libs.iter().enumerate() {
+            let active = l.library.id == lib.library.id;
+            let id = l.library.id.clone();
+            let warn = denied.contains(&l.library.id);
+            chips.push(
+                self.ext_lib_chip(
+                    ElementId::NamedInteger("lib-vault".into(), i as u64),
+                    l.library.title.clone().into(),
+                    active,
+                )
+                .debug_selector(move || format!("lib-vault-{i}"))
+                .when(warn, |d| d.text_color(p.warn_text()))
+                .on_click(cx.listener(move |this, _, window, cx| {
+                    this.ext_lib_choose(Some(id.clone()), window, cx)
+                }))
+                .into_any_element(),
+            );
+        }
+        chips.push(
+            self.ext_lib_chip("lib-vault-add".into(), "Add folder…".into(), false)
+                .debug_selector(|| "lib-vault-add".into())
+                .text_color(p.muted)
+                .on_click(cx.listener(|this, _, window, cx| this.ext_pick_vaults(window, cx)))
+                .into_any_element(),
+        );
+        let spec = vaults.into_iter().find(|v| v.library == lib.library.id);
+        Some(
+            div()
+                .flex()
+                .flex_col()
+                .gap(px(4.))
+                .child(
+                    div()
+                        .flex()
+                        .flex_wrap()
+                        .items_center()
+                        .gap(px(5.))
+                        .children(chips),
+                )
+                .children(spec.map(|v| {
+                    let key = v.key.clone();
+                    div()
+                        .flex()
+                        .items_center()
+                        .gap(px(6.))
+                        .text_size(px(10.5))
+                        .text_color(p.muted)
+                        .child(div().flex_1().min_w_0().truncate().child(v.path))
+                        .child(
+                            div()
+                                .id("lib-vault-remove")
+                                .debug_selector(|| "lib-vault-remove".into())
+                                .flex_none()
+                                .cursor_pointer()
+                                .hover(|s| s.underline().text_color(p.ink))
+                                .child("Remove from Burrow")
+                                .on_click(cx.listener(move |this, _, window, cx| {
+                                    this.ext_remove_vault(&key, window, cx)
+                                })),
+                        )
+                }))
+                .into_any_element(),
+        )
+    }
+
+    /// The Notes tab with no library to show: no folder chosen yet
+    /// ("Choose a folder…"), or folders waiting for permission ("Allow…").
+    fn render_ext_lib_empty(&self, cx: &mut Context<Self>) -> (AnyElement, AnyElement, AnyElement) {
+        let p = self.palette;
+        let (_, vaults) = self.ext_vaults(cx);
+        let header = div()
+            .flex_none()
+            .px(px(14.))
+            .pt(px(8.))
+            .pb(px(8.))
+            .rule_b(&p)
+            .text_size(px(13.))
+            .font_weight(FontWeight::SEMIBOLD)
+            .child("Notes")
+            .into_any_element();
+        let body = if vaults.is_empty() {
+            message_body(
+                &p,
+                "Pick a folder of Markdown notes, an Obsidian vault say. Burrow reads and \
+                 writes only the folders you choose, and you can add more later."
+                    .to_string(),
+                self.ext_lib_chip("lib-choose".into(), "Choose a folder…".into(), false)
+                    .debug_selector(|| "lib-choose".into())
+                    .on_click(cx.listener(|this, _, window, cx| this.ext_pick_vaults(window, cx))),
+            )
+        } else {
+            let names: Vec<String> = vaults.iter().map(|v| v.path.clone()).collect();
+            message_body(
+                &p,
+                format!(
+                    "Notes isn't running yet. It's waiting for your permission to use {}.",
+                    names.join(", ")
+                ),
+                self.ext_lib_chip("lib-vault-allow".into(), "Allow…".into(), false)
+                    .on_click(cx.listener(|this, _, window, cx| {
+                        this.ext_ask_again(super::NOTES, window, cx)
+                    })),
+            )
+        };
+        let footer = div()
+            .flex_none()
+            .px(px(14.))
+            .py(px(6.))
+            .rule_t(&p)
+            .text_size(px(11.))
+            .text_color(p.muted)
+            .child("Settings › Notes folders lists them too")
+            .into_any_element();
+        (header, body, footer)
+    }
+
     /// A click on the picker's note row `i`.
     fn ext_picker_pick_row(&mut self, i: usize, window: &mut Window, cx: &mut Context<Self>) {
         self.ext_picker_select(i);
@@ -1159,6 +1504,24 @@ impl MainView {
     }
 }
 
+/// The drawer's body for a message and one button under it.
+fn message_body(p: &crate::theme::Palette, text: String, button: impl IntoElement) -> AnyElement {
+    div()
+        .id("lib-message")
+        .flex_1()
+        .min_h_0()
+        .px(px(14.))
+        .py(px(14.))
+        .flex()
+        .flex_col()
+        .items_start()
+        .gap(px(10.))
+        .text_size(px(12.5))
+        .child(div().text_color(p.muted).child(text))
+        .child(button)
+        .into_any_element()
+}
+
 /// What "Copy into post" puts in the draft: the text quoted with the
 /// note's name (`> …` then `> — Title`), or the text as it is.
 pub fn copy_block(text: &str, title: &str, quote: bool) -> String {
diff --git a/crates/blyg-app/src/extensions/macros.rs b/crates/blyg-app/src/extensions/macros.rs
index ab6f3dd..9e393d8 100644
--- a/crates/blyg-app/src/extensions/macros.rs
+++ b/crates/blyg-app/src/extensions/macros.rs
@@ -143,7 +143,7 @@ impl MainView {
             );
         }
         let home = entry.site.home.clone();
-        self.open_url_in_app(&home, crate::app::browser::OpenMode::Full, window, cx);
+        self.open_url_in_app(&home, crate::app::browser::OpenMode::Slide, window, cx);
     }
 
     /// A macro row was chosen: check, fill in, prepare, run.
diff --git a/crates/blyg-app/src/extensions/mod.rs b/crates/blyg-app/src/extensions/mod.rs
index e8db94c..8669f76 100644
--- a/crates/blyg-app/src/extensions/mod.rs
+++ b/crates/blyg-app/src/extensions/mod.rs
@@ -19,7 +19,9 @@
 
 mod library;
 mod macros;
+pub(crate) mod reading_slots; // --- reading slots ---
 mod sheets;
+mod tour; // --- onboarding --- the tour's sample extensions
 
 #[cfg(test)]
 #[path = "tests.rs"]
@@ -70,6 +72,9 @@ pub struct Launch {
     pub args: Vec<String>,
     /// cross-post: `program crosspost_args…`.
     pub crosspost_args: Vec<String>,
+    /// --- reading slots --- reading-time and inspect: `program args…`.
+    pub reading_time_args: Vec<String>,
+    pub inspect_args: Vec<String>,
     pub data_dir: PathBuf,
     pub timing: Timing,
 }
@@ -83,12 +88,40 @@ impl Launch {
             program: std::env::current_exe().ok()?,
             args: vec!["+ext".into(), NOTES.into()],
             crosspost_args: vec!["+ext".into(), blyg_ext_crosspost::NAME.into()],
+            reading_time_args: vec!["+ext".into(), blyg_ext_reading_time::NAME.into()],
+            inspect_args: vec!["+ext".into(), blyg_ext_inspect::NAME.into()],
             data_dir,
             timing: Timing::default(),
         })
     }
 }
 
+/// Tests elsewhere (the tour's): every bundled extension, run as this test
+/// binary's child tests (`tests.rs`, `reading_slots_tests.rs`).
+#[cfg(test)]
+pub(crate) fn test_launch(data_dir: PathBuf) -> Launch {
+    let m = module_path!();
+    let m = m.split_once("::").map(|(_, rest)| rest).unwrap_or(m);
+    let args = |t: &str| -> Vec<String> {
+        vec![
+            "--exact".into(),
+            format!("{m}::{t}"),
+            "--ignored".into(),
+            "--quiet".into(),
+            "--test-threads=1".into(),
+        ]
+    };
+    Launch {
+        program: std::env::current_exe().expect("the test binary"),
+        args: args("tests::markdown_notes_child"),
+        crosspost_args: args("tests::cross_post_child"),
+        reading_time_args: args("reading_slots::tests::reading_time_child"),
+        inspect_args: args("reading_slots::tests::inspect_child"),
+        data_dir,
+        timing: Timing::default(),
+    }
+}
+
 /// The host's configuration from the config file: what's enabled, what's
 /// granted, each extension's settings, and the bundled markdown-notes
 /// (whose manifest names the configured vault).
@@ -103,6 +136,7 @@ pub fn host_config(store: &ConfigStore, launch: &Launch) -> HostConfig {
         blyg_ext_notes::bundled(launch.program.clone(), launch.args.clone(), &notes),
         blyg_ext_crosspost::bundled(launch.program.clone(), launch.crosspost_args.clone()),
     ];
+    hc.bundled.extend(reading_slots::bundled(launch)); // --- reading slots ---
     hc.timing = launch.timing.clone();
     hc
 }
@@ -133,25 +167,133 @@ pub fn allow_changes(cfg: &Config, name: &str, caps: &[Capability]) -> Vec<(&'st
     out
 }
 
-/// The config changes that point markdown-notes at `vault` (and enable it):
-/// `extension = markdown-notes`, `extension-setting = markdown-notes
-/// vault=<vault>` replacing an earlier vault line (other settings stay).
-pub fn vault_changes(cfg: &Config, vault: &str) -> Vec<(&'static str, Change)> {
+/// `key`'s values without the ones `drop` picks; `Remove` (no `key =`
+/// line left behind) when none stay.
+fn without_values(
+    cfg: &Config,
+    key: &'static str,
+    drop: impl Fn(&str) -> bool,
+) -> Option<(&'static str, Change)> {
+    let v = cfg.list(key);
+    let kept: Vec<String> = v.iter().filter(|x| !drop(x)).cloned().collect();
+    if kept.len() == v.len() {
+        return None;
+    }
+    Some((
+        key,
+        if kept.is_empty() {
+            Change::Remove
+        } else {
+            Change::List(kept)
+        },
+    ))
+}
+
+/// The config changes that turn `name` off: its `extension` lines go.
+/// Its `extension-allow` and `extension-setting` lines stay, so Turn on
+/// brings it back as it was, unless `forget_grants`, which drops its
+/// `extension-allow` lines too (the next Turn on asks again).
+pub fn disable_changes(
+    cfg: &Config,
+    name: &str,
+    forget_grants: bool,
+) -> Vec<(&'static str, Change)> {
+    let mut out = vec![];
+    out.extend(without_values(cfg, "extension", |v| v.trim() == name));
+    if forget_grants {
+        out.extend(without_values(cfg, "extension-allow", |v| {
+            v.split_whitespace().next() == Some(name)
+        }));
+    }
+    out
+}
+
+/// markdown-notes' settings as the config has them now.
+fn notes_settings(cfg: &Config) -> BTreeMap<String, String> {
+    blyg_ext::settings_from_lines(&cfg.list("extension-setting"))
+        .0
+        .remove(NOTES)
+        .unwrap_or_default()
+}
+
+/// The vaults the config names for markdown-notes (enabled or not).
+pub fn configured_vaults(cfg: &Config) -> Vec<blyg_ext_notes::VaultSpec> {
+    blyg_ext_notes::vaults(&notes_settings(cfg))
+}
+
+/// An `extension-setting` value that sets markdown-notes' `key`.
+fn is_notes_setting(line: &str, key: &str) -> bool {
+    line.trim()
+        .split_once(char::is_whitespace)
+        .is_some_and(|(name, kv)| {
+            name == NOTES && kv.split_once('=').is_some_and(|(k, _)| k.trim() == key)
+        })
+}
+
+/// The config changes that add `folders` to markdown-notes (and enable
+/// it): a `vault=` line for the first vault, `vault-<label>=` for each one
+/// after (label from the folder's name). Folders already there are skipped;
+/// other lines are kept as they are. The new keys come back too.
+pub fn vault_add_changes(
+    cfg: &Config,
+    folders: &[String],
+) -> (Vec<(&'static str, Change)>, Vec<String>) {
     let mut out = vec![];
     out.extend(with_values(cfg, "extension", &[NOTES.to_string()]));
-    let line = format!("{NOTES} vault={vault}");
-    let mut settings: Vec<String> = cfg
+    let mut settings = notes_settings(cfg);
+    let mut lines = cfg.list("extension-setting");
+    let mut keys = vec![];
+    for f in folders {
+        let Some(key) = blyg_ext_notes::new_vault_key(&settings, f) else {
+            continue;
+        };
+        // An empty `vault=` (or a bad one) is replaced, not shadowed.
+        lines.retain(|l| !is_notes_setting(l, &key));
+        lines.push(format!("{NOTES} {key}={f}"));
+        settings.insert(key.clone(), f.clone());
+        keys.push(key);
+    }
+    if !keys.is_empty() {
+        out.push(("extension-setting", Change::List(lines)));
+    }
+    (out, keys)
+}
+
+/// The config changes that drop markdown-notes' vault `key`: its setting
+/// lines, and the `fs:` grant for its folder when no other vault uses it.
+/// The folder and its notes are never touched.
+pub fn vault_remove_changes(cfg: &Config, key: &str) -> Vec<(&'static str, Change)> {
+    let vaults = configured_vaults(cfg);
+    let Some(gone) = vaults.iter().find(|v| v.key == key) else {
+        return vec![];
+    };
+    let mut out = vec![];
+    let lines: Vec<String> = cfg
         .list("extension-setting")
         .into_iter()
-        .filter(|l| {
-            let mut w = l.split_whitespace();
-            !(w.next() == Some(NOTES)
-                && w.next()
-                    .is_some_and(|kv| kv.split('=').next().map(str::trim) == Some("vault")))
-        })
+        .filter(|l| !is_notes_setting(l, key))
         .collect();
-    settings.push(line);
-    out.push(("extension-setting", Change::List(settings)));
+    out.push(("extension-setting", Change::List(lines)));
+    let shared = vaults
+        .iter()
+        .any(|v| v.key != key && blyg_ext_notes::same_folder(&v.path, &gone.path));
+    if !shared {
+        let grant = Capability::Fs(gone.path.clone());
+        let allow = cfg.list("extension-allow");
+        let kept: Vec<String> = allow
+            .iter()
+            .filter(|l| {
+                let mut w = l.split_whitespace();
+                !(w.next() == Some(NOTES)
+                    && w.next().and_then(Capability::parse).as_ref() == Some(&grant)
+                    && w.next().is_none())
+            })
+            .cloned()
+            .collect();
+        if kept.len() != allow.len() {
+            out.push(("extension-allow", Change::List(kept)));
+        }
+    }
     out
 }
 
@@ -210,12 +352,17 @@ pub(crate) struct Extensions {
     pub inbox: Arc<std::sync::Mutex<std::collections::VecDeque<ExtEvent>>>,
     // --- library ---
     pub lib: Library,
+    /// --- reading slots --- byline markers and the ⋯ sheet.
+    pub slots: reading_slots::Slots,
+    /// --- onboarding --- the tour's sample extensions, while it runs.
+    pub tour: Option<tour::Tour>,
 }
 
 impl Extensions {
-    /// A palette, consent or manage sheet is up (web views hide).
+    /// A palette, consent or manage sheet (or a reading entry's ⋯ sheet)
+    /// is up (web views hide).
     pub fn has_overlay(&self) -> bool {
-        self.overlay.is_some()
+        self.overlay.is_some() || self.slots.sheet.is_some()
     }
 }
 
@@ -306,6 +453,9 @@ impl MainView {
         let (Some(host), Some(launch)) = (self.ext.host.clone(), self.ext.launch.clone()) else {
             return;
         };
+        if self.ext_tour_defer_reload() {
+            return; // --- onboarding --- the tour's host isn't the config's
+        }
         if !self.ext.started {
             return; // the first start reads the config itself
         }
@@ -379,12 +529,14 @@ impl MainView {
                 None => break,
             }
         }
+        self.ext_tour_pump(window, cx); // --- onboarding ---
     }
 
     /// What the host says, on the UI thread.
     pub(crate) fn ext_event(&mut self, ev: ExtEvent, window: &mut Window, cx: &mut Context<Self>) {
         match ev {
             ExtEvent::Started { name, .. } => {
+                self.ext.slots.forget(&name); // --- reading slots ---
                 if self.ext.notices.get(&name) != Some(&Notice::NeedsPermission) {
                     self.ext.notices.remove(&name);
                 }
@@ -479,6 +631,10 @@ impl MainView {
         window: &mut Window,
         cx: &mut Context<Self>,
     ) -> bool {
+        // --- onboarding --- the tour writes nothing.
+        if self.ext_tour_refuses("Not during the tour".into(), cx) {
+            return false;
+        }
         if let Err(e) = crate::settings::write(changes, cx) {
             self.show_toast(e, None, cx);
             return false;
@@ -494,37 +650,125 @@ impl MainView {
         true
     }
 
-    /// Settings › Notes folder: point markdown-notes at `folder` (enabling
-    /// it); the consent sheet follows for the new folder.
-    pub(crate) fn ext_set_vault(
+    /// Settings › Notes folders and the drawer's "Add folder…": add
+    /// `folders` to markdown-notes (enabling it); the consent sheet follows
+    /// for the new folders. The drawer then shows the first one added.
+    pub(crate) fn ext_add_vaults(
         &mut self,
-        folder: &std::path::Path,
+        folders: &[std::path::PathBuf],
         window: &mut Window,
         cx: &mut Context<Self>,
     ) {
-        let text = vault_text(folder);
-        let changes = vault_changes(crate::settings::get(cx).store.config(), &text);
+        let texts: Vec<String> = folders.iter().map(|f| vault_text(f)).collect();
+        let cfg = crate::settings::get(cx).store.config().clone();
+        let (changes, keys) = vault_add_changes(&cfg, &texts);
+        // From Settings: out of the way, so the consent sheet can follow.
+        if self.sheet.is_some() {
+            self.close_sheet(window, cx);
+        }
+        if keys.is_empty() {
+            if changes.is_empty() {
+                return self.show_toast("Already a notes folder", None, cx);
+            }
+            // Only turning it on (the folders were configured already).
+            self.ext_write_config(&changes, window, cx);
+            return;
+        }
         // A new folder is a new question.
         self.ext.asked.retain(|(n, _)| n != NOTES);
+        if !self.ext_write_config(&changes, window, cx) {
+            return;
+        }
+        let now = configured_vaults(crate::settings::get(cx).store.config());
+        if let Some(v) = now.iter().find(|v| v.key == keys[0]) {
+            self.ext_lib_choose(Some(v.library.clone()), window, cx);
+        }
+        let (what, it) = if keys.len() == 1 {
+            let added = now.iter().find(|v| v.key == keys[0]);
+            let path = added.map(|v| v.path.clone()).unwrap_or_default();
+            (format!("Notes folder: {path}"), "it")
+        } else {
+            (format!("{} notes folders added", keys.len()), "them")
+        };
+        self.show_toast(
+            what,
+            Some(format!("{NOTES} reads and writes {it}, once you allow it").into()),
+            cx,
+        );
+    }
+
+    /// "Remove from Burrow": drop vault `key` from the config (its setting
+    /// and folder grant). The folder and its notes stay as they are.
+    pub(crate) fn ext_remove_vault(
+        &mut self,
+        key: &str,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let cfg = crate::settings::get(cx).store.config().clone();
+        // --- onboarding --- a sample folder stays where it is.
+        if let Some(t) = self.ext.tour.as_ref() {
+            let title = t
+                .vaults
+                .iter()
+                .find(|v| v.key == key)
+                .map_or_else(String::new, |v| v.title.clone());
+            self.ext_tour_refuses(format!("“{title}” would be removed from Burrow"), cx);
+            return;
+        }
+        let Some(gone) = configured_vaults(&cfg).into_iter().find(|v| v.key == key) else {
+            return;
+        };
+        let changes = vault_remove_changes(&cfg, key);
+        if self.ext.lib.vault.as_deref() == Some(gone.library.as_str()) {
+            self.ext_lib_choose(None, window, cx);
+        }
         if self.ext_write_config(&changes, window, cx) {
             self.show_toast(
-                format!("Notes folder: {text}"),
-                Some(format!("{NOTES} reads and writes it, once you allow it").into()),
+                format!("Removed “{}” from Burrow", gone.title),
+                Some(format!("{} and its notes stay as they are", gone.path).into()),
                 cx,
             );
         }
     }
 
-    /// The vault the config names for markdown-notes, when it's enabled.
-    pub(crate) fn ext_vault(&self, cx: &App) -> Option<String> {
-        let cfg = cx
-            .try_global::<crate::settings::AppConfig>()?
-            .store
-            .config();
-        cfg.extensions_enabled()
-            .iter()
-            .any(|n| n == NOTES)
-            .then(|| blyg_ext_notes::vault_setting(&cfg.extension_settings(NOTES)))
+    /// The vaults the config names for markdown-notes, and whether it's on.
+    pub(crate) fn ext_vaults(&self, cx: &App) -> (bool, Vec<blyg_ext_notes::VaultSpec>) {
+        // --- onboarding --- the tour's sample folders.
+        if let Some(t) = self.ext.tour.as_ref() {
+            return (true, t.vaults.clone());
+        }
+        let Some(conf) = cx.try_global::<crate::settings::AppConfig>() else {
+            return (false, vec![]);
+        };
+        let cfg = conf.store.config();
+        let on = cfg.extensions_enabled().iter().any(|n| n == NOTES);
+        (on, configured_vaults(cfg))
+    }
+
+    /// The folder picker for notes folders (several at once); what's
+    /// picked is added.
+    pub(crate) fn ext_pick_vaults(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        // --- onboarding --- no folder picker in the tour.
+        if self.ext_tour_refuses("Add folder… asks for a folder of notes".into(), cx) {
+            return;
+        }
+        let rx = cx.prompt_for_paths(PathPromptOptions {
+            files: false,
+            directories: true,
+            multiple: true,
+            prompt: Some("Add as notes folder".into()),
+        });
+        cx.spawn_in(window, async move |this, cx| {
+            let Ok(Ok(Some(paths))) = rx.await else {
+                return;
+            };
+            if paths.is_empty() {
+                return;
+            }
+            let _ = this.update_in(cx, |v, window, cx| v.ext_add_vaults(&paths, window, cx));
+        })
+        .detach();
     }
 
     // ------------------------------------------------------------ context
@@ -752,7 +996,7 @@ impl MainView {
         self.sheet.is_some()
             || self.reading.sheet.is_some()
             || self.ai.has_overlay()
-            || self.ext.overlay.is_some()
+            || self.ext.has_overlay()
             || self.onboarding.flow.is_some()
             || self.onboarding.tutorial.is_some()
     }
@@ -812,6 +1056,7 @@ impl MainView {
     ) {
         match (scenario, n) {
             (_, 0) => self.ext_start(window, cx),
+            (s, n) if s.starts_with("ext-slots") => self.slots_demo(s, n, window, cx), // --- reading slots ---
             ("ext-palette", 1) => self.ext_toggle_palette(window, cx),
             ("ext-manage", 1) => self.ext_open_manage(window, cx),
             ("ext-notes", 1) => self.ext_lib_show(window, cx),
diff --git a/crates/blyg-app/src/extensions/reading_slots.rs b/crates/blyg-app/src/extensions/reading_slots.rs
new file mode 100644
index 0000000..535c0c5
--- /dev/null
+++ b/crates/blyg-app/src/extensions/reading_slots.rs
@@ -0,0 +1,764 @@
+//! --- reading slots --- What extensions add to each reading entry
+//! (docs/EXTENSIONS.md § Reading slots; `blyg_ext::reading`), mirroring the
+//! web Studio's `entryByline` and `entryActions`:
+//!
+//! - a **byline marker** at the end of each entry's byline, in the stream
+//!   and in the reader's header. Asked of the extension off the main thread
+//!   the first time an entry is drawn, and cached by (extension, entry,
+//!   version): drawing never waits, and an entry with no answer yet (or
+//!   none at all) simply shows nothing.
+//! - a **⋯ chip** in an entry's actions when an extension adds rows: it
+//!   opens a sheet listing them; choosing one asks the extension and shows
+//!   its answer natively (text, label/value fields, a monospaced code block
+//!   with a Copy button).
+//!
+//! Only running extensions granted `reading.read` take part
+//! (`Host::entry_slots`). The bundled `reading-time` and `inspect` are the
+//! two that ship, both off until the config names them.
+
+use std::cell::{Cell, RefCell};
+use std::collections::{HashMap, HashSet};
+
+use blyg_core::ReadingItem;
+use blyg_ext::reading::{EntryActionSpec, EntryByline, EntrySheet, ReadingEntry};
+use blyg_ext::{ExtError, Installed};
+use gpui_kit::prelude::FluentBuilder as _;
+use gpui_kit::*;
+
+use super::Launch;
+use crate::app::reading::Tip;
+use crate::app::{MainView, TITLEBAR_H};
+
+#[cfg(test)]
+#[path = "reading_slots_tests.rs"]
+mod tests;
+
+/// The bundled reading-slot extensions, run from `launch` (each off until
+/// the config names it).
+pub(crate) fn bundled(launch: &Launch) -> Vec<Installed> {
+    vec![
+        blyg_ext_reading_time::bundled(launch.program.clone(), launch.reading_time_args.clone()),
+        blyg_ext_inspect::bundled(launch.program.clone(), launch.inspect_args.clone()),
+    ]
+}
+
+/// A marker's cache key: (extension, subscription id, remote id, version).
+pub(crate) type MarkerKey = (String, String, String, u32);
+
+fn marker_key(ext: &str, r: &ReadingItem) -> MarkerKey {
+    (
+        ext.to_string(),
+        r.subscription_id.clone(),
+        r.remote_id.clone(),
+        r.version,
+    )
+}
+
+/// The window's reading-slot state (a field of `Extensions`). The marker
+/// cache is filled from drawing code, which only has `&self`, hence the
+/// cells.
+#[derive(Default)]
+pub(crate) struct Slots {
+    /// Answers: `None` = nothing to show (or no answer, an error).
+    markers: RefCell<HashMap<MarkerKey, Option<EntryByline>>>,
+    /// Asked and not answered yet.
+    pending: RefCell<HashSet<MarkerKey>>,
+    /// To ask at the next flush.
+    queue: RefCell<Vec<(MarkerKey, ReadingEntry)>>,
+    flush_scheduled: Cell<bool>,
+    /// The ⋯ sheet, when it's up.
+    pub sheet: Option<SlotSheet>,
+    pub sheet_gen: usize,
+}
+
+impl Slots {
+    /// The cached marker, if answered.
+    pub fn marker(&self, key: &MarkerKey) -> Option<Option<EntryByline>> {
+        self.markers.borrow().get(key).cloned()
+    }
+
+    /// Drop what `ext` said (it restarted: its settings may have changed).
+    pub fn forget(&self, ext: &str) {
+        self.markers.borrow_mut().retain(|k, _| k.0 != ext);
+    }
+
+    /// How many markers have been asked for, answered or not (tests).
+    #[cfg(test)]
+    pub fn asked(&self) -> usize {
+        self.markers.borrow().len() + self.pending.borrow().len()
+    }
+}
+
+/// The ⋯ sheet of one entry.
+pub(crate) struct SlotSheet {
+    pub item: ReadingItem,
+    /// Each row with the extension it's from.
+    pub rows: Vec<(String, EntryActionSpec)>,
+    pub selected: usize,
+    pub phase: Phase,
+    pub focus: FocusHandle,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum Phase {
+    /// The rows, to pick one.
+    Choose,
+    /// Asked the extension for row `n`'s sheet.
+    Loading(usize),
+    /// Its answer.
+    Shown(usize, EntrySheet),
+    /// It failed (the message names the extension).
+    Failed(usize, String),
+}
+
+/// The monospaced font for code (Menlo has a Windows substitute).
+fn mono() -> &'static str {
+    if cfg!(target_os = "windows") {
+        "Consolas"
+    } else {
+        "Menlo"
+    }
+}
+
+impl MainView {
+    // ------------------------------------------------------------ byline
+
+    /// Hook (the stream's byline and the reader's header): each byline
+    /// extension's marker for `r`, as "· text" with its tip on hover.
+    /// Draws what's cached and asks for what isn't, off the main thread.
+    pub(crate) fn slots_byline(&self, r: &ReadingItem, cx: &mut Context<Self>) -> Vec<AnyElement> {
+        let Some(host) = &self.ext.host else {
+            return vec![];
+        };
+        let p = self.palette.on_page();
+        let mut out = vec![];
+        for s in host.entry_slots().into_iter().filter(|s| s.byline) {
+            let key = marker_key(&s.ext, r);
+            match self.ext.slots.marker(&key) {
+                Some(Some(m)) => {
+                    let tip = m.tip.clone();
+                    let ext = s.ext.clone();
+                    out.push(div().child("·").into_any_element());
+                    out.push(
+                        div()
+                            .id(SharedString::from(format!("slot-byline-{ext}")))
+                            .debug_selector(move || format!("slot-byline-{ext}"))
+                            .text_color(p.muted)
+                            .child(m.text)
+                            .when_some(tip, |d, tip| {
+                                d.tooltip(move |_, cx| cx.new(|_| Tip(tip.clone())).into())
+                            })
+                            .into_any_element(),
+                    );
+                }
+                Some(None) => {}
+                None => self.slots_ask(key, r, cx),
+            }
+        }
+        out
+    }
+
+    /// Queue `key` (once) and schedule a flush after this frame.
+    fn slots_ask(&self, key: MarkerKey, r: &ReadingItem, cx: &mut Context<Self>) {
+        let slots = &self.ext.slots;
+        if !slots.pending.borrow_mut().insert(key.clone()) {
+            return;
+        }
+        slots.queue.borrow_mut().push((key, ReadingEntry::of(r)));
+        if slots.flush_scheduled.replace(true) {
+            return;
+        }
+        let this = cx.weak_entity();
+        cx.defer(move |cx| {
+            let _ = this.update(cx, |v, cx| v.slots_flush(cx));
+        });
+    }
+
+    /// Ask the extensions for the queued markers, one after another on a
+    /// background thread; cache the answers and redraw.
+    pub(crate) fn slots_flush(&mut self, cx: &mut Context<Self>) {
+        self.ext.slots.flush_scheduled.set(false);
+        let queue = std::mem::take(&mut *self.ext.slots.queue.borrow_mut());
+        let Some(host) = self.ext.host.clone() else {
+            self.ext.slots.pending.borrow_mut().clear();
+            return;
+        };
+        if queue.is_empty() {
+            return;
+        }
+        let task = cx.background_spawn(async move {
+            queue
+                .into_iter()
+                .map(|(key, entry)| {
+                    let r = host.entry_byline(&key.0, &entry);
+                    (key, r)
+                })
+                .collect::<Vec<_>>()
+        });
+        cx.spawn(async move |this, cx| {
+            let answers = task.await;
+            let _ = this.update(cx, |v, cx| {
+                let slots = &v.ext.slots;
+                for (key, r) in answers {
+                    slots.pending.borrow_mut().remove(&key);
+                    // An error shows nothing, and isn't asked again until
+                    // the extension restarts (`Slots::forget`).
+                    let m = r.unwrap_or_else(|e: ExtError| {
+                        eprintln!("{}: byline: {}", key.0, e.message(&key.0));
+                        None
+                    });
+                    // A marker can wrap the byline: the stream measures
+                    // that post again.
+                    if m.is_some()
+                        && let Some(ix) = v.reading.shown_pos(&(key.1.clone(), key.2.clone()))
+                    {
+                        v.reading.stream.list.remeasure_items(ix..ix + 1);
+                    }
+                    slots.markers.borrow_mut().insert(key, m);
+                }
+                cx.notify();
+            });
+        })
+        .detach();
+    }
+
+    // ------------------------------------------------------------ ⋯
+
+    /// The rows extensions add to every entry's ⋯ sheet.
+    fn slots_rows(&self) -> Vec<(String, EntryActionSpec)> {
+        let Some(host) = &self.ext.host else {
+            return vec![];
+        };
+        host.entry_slots()
+            .into_iter()
+            .flat_map(|s| {
+                let ext = s.ext;
+                s.actions.into_iter().map(move |a| (ext.clone(), a))
+            })
+            .collect()
+    }
+
+    /// Hook (the stream's and the reader's action rows): "⋯" when an
+    /// extension adds rows to `r`'s ⋯ sheet.
+    pub(crate) fn slots_more_chip(
+        &self,
+        r: &ReadingItem,
+        cx: &mut Context<Self>,
+    ) -> Option<AnyElement> {
+        if self.slots_rows().is_empty() {
+            return None;
+        }
+        let p = self.palette.on_page();
+        let item = r.clone();
+        Some(
+            div()
+                .id("slot-more")
+                .debug_selector(|| "slot-more".into())
+                .px(px(8.))
+                .py(px(3.))
+                .rounded(px(self.theme.chip_radius))
+                .map(|d| crate::ornament::border(d, self.theme.chip_border, p.line))
+                .cursor_pointer()
+                .font_family(self.chrome())
+                .text_size(px(11.5))
+                .font_weight(FontWeight::MEDIUM)
+                .text_color(p.ink)
+                .hover(|s| s.border_color(p.accent))
+                .child("⋯")
+                .tooltip(|_, cx| cx.new(|_| Tip("More, from extensions".into())).into())
+                .on_click(cx.listener(move |this, _, window, cx| {
+                    cx.stop_propagation();
+                    this.slots_open(item.clone(), window, cx)
+                }))
+                .into_any_element(),
+        )
+    }
+
+    /// Open `item`'s ⋯ sheet (nothing when no extension adds a row, or
+    /// another sheet is up).
+    pub(crate) fn slots_open(
+        &mut self,
+        item: ReadingItem,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let rows = self.slots_rows();
+        // (The tour's slots step opens it, so the tutorial doesn't block it.)
+        let blocked = self.ext_blocked() && !self.ext_tour_on();
+        if rows.is_empty() || blocked {
+            return;
+        }
+        let focus = cx.focus_handle();
+        window.focus(&focus, cx);
+        self.ext.slots.sheet_gen += 1;
+        self.ext.slots.sheet = Some(SlotSheet {
+            item,
+            rows,
+            selected: 0,
+            phase: Phase::Choose,
+            focus,
+        });
+        cx.notify();
+    }
+
+    pub(crate) fn slots_close(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if self.ext.slots.sheet.take().is_none() {
+            return;
+        }
+        if self.reading.view == crate::app::reading::View::Posts {
+            self.focus_after_sheet(window, cx);
+        } else {
+            window.focus(&self.reading.focus, cx);
+        }
+        self.ext_next_ask(window, cx);
+        cx.notify();
+    }
+
+    /// Run row `n`: ask its extension for the sheet, off the main thread.
+    pub(crate) fn slots_choose(&mut self, n: usize, cx: &mut Context<Self>) {
+        let Some(host) = self.ext.host.clone() else {
+            return;
+        };
+        let Some(s) = self.ext.slots.sheet.as_mut() else {
+            return;
+        };
+        let Some((ext, action)) = s.rows.get(n).cloned() else {
+            return;
+        };
+        s.selected = n;
+        s.phase = Phase::Loading(n);
+        let item = s.item.clone();
+        let gen_ = self.ext.slots.sheet_gen;
+        let task = cx.background_spawn(async move { host.entry_action(&ext, &action.id, &item) });
+        let ext = s.rows[n].0.clone();
+        cx.spawn(async move |this, cx| {
+            let r = task.await;
+            let _ = this.update(cx, |v, cx| {
+                if v.ext.slots.sheet_gen != gen_ {
+                    return; // closed, or another entry's
+                }
+                if let Some(s) = v.ext.slots.sheet.as_mut() {
+                    s.phase = match r {
+                        Ok(sheet) => Phase::Shown(n, sheet),
+                        Err(e) => Phase::Failed(n, e.message(&ext)),
+                    };
+                }
+                cx.notify();
+            });
+        })
+        .detach();
+        cx.notify();
+    }
+
+    /// Copy the shown sheet's code (else its text) to the clipboard.
+    pub(crate) fn slots_copy(&mut self, cx: &mut Context<Self>) {
+        let Some(SlotSheet {
+            phase: Phase::Shown(_, sheet),
+            ..
+        }) = &self.ext.slots.sheet
+        else {
+            return;
+        };
+        let text = sheet.code.clone().unwrap_or_else(|| sheet.text.clone());
+        let json = sheet.copy_label() == "Copy JSON";
+        cx.write_to_clipboard(ClipboardItem::new_string(text));
+        self.show_toast(if json { "JSON copied" } else { "Copied" }, None, cx);
+    }
+
+    fn slots_key(&mut self, ev: &KeyDownEvent, window: &mut Window, cx: &mut Context<Self>) {
+        let Some(s) = self.ext.slots.sheet.as_mut() else {
+            return;
+        };
+        let k = &ev.keystroke;
+        let n = s.rows.len();
+        let choosing = s.phase == Phase::Choose;
+        let cmd = k.modifiers.platform || k.modifiers.control;
+        match k.key.as_str() {
+            "escape" => self.slots_close(window, cx),
+            "up" | "k" if choosing && !cmd => {
+                s.selected = (s.selected + n - 1) % n;
+                cx.notify();
+            }
+            "down" | "j" if choosing && !cmd => {
+                s.selected = (s.selected + 1) % n;
+                cx.notify();
+            }
+            "enter" if choosing => {
+                let i = s.selected;
+                self.slots_choose(i, cx);
+            }
+            "c" if cmd && !choosing => self.slots_copy(cx),
+            d if choosing && !cmd && d.len() == 1 => {
+                if let Some(i) = d
+                    .parse::<usize>()
+                    .ok()
+                    .filter(|i| (1..=n.min(9)).contains(i))
+                {
+                    self.slots_choose(i - 1, cx);
+                }
+            }
+            _ => return,
+        }
+        cx.stop_propagation();
+    }
+
+    /// `BLYGGER_DEMO=ext-slots` (the reading stream with the first post
+    /// selected: its byline markers and ⋯ chip) and `ext-slots-inspect`
+    /// (then its ⋯ sheet, running the first row). The config decides what
+    /// runs.
+    pub(crate) fn slots_demo(
+        &mut self,
+        scenario: &str,
+        n: usize,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        match n {
+            1 => {
+                self.show_view(crate::app::reading::View::Reading, window, cx);
+                self.stream_move(1, window, cx);
+            }
+            2 if scenario == "ext-slots-inspect" => {
+                let item = self.reading.sel.as_ref().and_then(|k| {
+                    self.reading
+                        .rows
+                        .iter()
+                        .find(|r| r.subscription_id == k.0 && r.remote_id == k.1)
+                        .cloned()
+                });
+                if let Some(item) = item {
+                    self.slots_open(item, window, cx);
+                    self.slots_choose(0, cx);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    // ------------------------------------------------------------ render
+
+    /// Hook: the ⋯ sheet, over everything.
+    pub(crate) fn render_slots_sheet(
+        &self,
+        ui_font: &SharedString,
+        cx: &mut Context<Self>,
+    ) -> Option<AnyElement> {
+        let s = self.ext.slots.sheet.as_ref()?;
+        let p = self.palette;
+        let content = match &s.phase {
+            Phase::Choose => self.render_slots_rows(s, cx),
+            Phase::Loading(n) => self.render_slots_status(s, *n, "…", p.muted),
+            Phase::Failed(n, m) => self.render_slots_status(s, *n, m, p.warn),
+            Phase::Shown(n, sheet) => self.render_slots_shown(s, *n, sheet, cx),
+        };
+        let gen_ = self.ext.slots.sheet_gen;
+        Some(
+            div()
+                .absolute()
+                .top(px(TITLEBAR_H))
+                .bottom_0()
+                .left_0()
+                .right_0()
+                .flex()
+                .justify_center()
+                .items_start()
+                .child(
+                    div()
+                        .id("slot-sheet")
+                        .debug_selector(|| "slot-sheet".into())
+                        .track_focus(&s.focus)
+                        .on_key_down(cx.listener(|this, ev: &KeyDownEvent, window, cx| {
+                            this.slots_key(ev, window, cx)
+                        }))
+                        .occlude()
+                        .w(px(560.))
+                        .max_w(relative(0.92))
+                        .max_h(relative(0.86))
+                        .overflow_y_scroll()
+                        .map(|d| crate::theme_ext::sheet(d, &self.theme))
+                        .px(px(18.))
+                        .py(px(16.))
+                        .font_family(ui_font.clone())
+                        .text_size(px(13.))
+                        .text_color(p.ink)
+                        .child(content)
+                        .with_animation(
+                            ("slot-sheet-in", gen_),
+                            Animation::new(std::time::Duration::from_millis(220))
+                                .with_easing(ease_out_quint()),
+                            |d, t| d.mt(px(-240.0 * (1.0 - t))).opacity(t.min(1.0) * 0.4 + 0.6),
+                        ),
+                )
+                .into_any_element(),
+        )
+    }
+
+    /// The post the sheet is about, as its first line.
+    fn slots_subject(&self, s: &SlotSheet) -> Div {
+        let r = &s.item;
+        let title = crate::app::reading::vm::post_title(r);
+        div()
+            .mb(px(10.))
+            .text_size(px(12.))
+            .text_color(self.palette.muted)
+            .truncate()
+            .child(format!(
+                "{} · {}",
+                crate::app::reading::vm::host(&r.origin),
+                title
+            ))
+    }
+
+    fn render_slots_rows(&self, s: &SlotSheet, cx: &mut Context<Self>) -> AnyElement {
+        let p = self.palette;
+        div()
+            .flex()
+            .flex_col()
+            .child(Self::slot_heading("More"))
+            .child(self.slots_subject(s))
+            .children(s.rows.iter().enumerate().map(|(i, (ext, a))| {
+                let on = i == s.selected;
+                div()
+                    .id(("slot-row", i))
+                    .debug_selector(move || format!("slot-row-{i}"))
+                    .flex()
+                    .items_center()
+                    .gap(px(10.))
+                    .px(px(8.))
+                    .py(px(6.))
+                    .rounded(px(self.theme.corner(6.)))
+                    .cursor_pointer()
+                    .when(on, |d| d.bg(p.sel))
+                    .hover(|d| d.bg(p.sel))
+                    .on_click(cx.listener(move |this, _, _, cx| this.slots_choose(i, cx)))
+                    .child(
+                        div()
+                            .w(px(28.))
+                            .flex_none()
+                            .font_family(mono())
+                            .text_size(px(12.))
+                            .text_color(p.muted)
+                            .child(a.icon.clone().unwrap_or_default()),
+                    )
+                    .child(
+                        div()
+                            .flex_1()
+                            .min_w_0()
+                            .flex()
+                            .flex_col()
+                            .child(div().font_weight(FontWeight::MEDIUM).child(a.title.clone()))
+                            .when(!a.detail.is_empty(), |d| {
+                                d.child(
+                                    div()
+                                        .text_size(px(12.))
+                                        .text_color(p.muted)
+                                        .child(a.detail.clone()),
+                                )
+                            }),
+                    )
+                    .when(i < 9, |d| d.child(self.slot_kbd(DIGITS[i])))
+                    .child(
+                        div()
+                            .flex_none()
+                            .text_size(px(11.5))
+                            .text_color(p.muted)
+                            .child(ext.clone()),
+                    )
+            }))
+            .child(
+                self.slot_keys_row()
+                    .child(self.slot_key_hint("↑↓", "choose"))
+                    .child(self.slot_key_hint("⏎", "open"))
+                    .child(self.slot_key_hint("esc", "close")),
+            )
+            .into_any_element()
+    }
+
+    fn render_slots_status(&self, s: &SlotSheet, n: usize, text: &str, color: Hsla) -> AnyElement {
+        let title = s.rows.get(n).map(|r| r.1.title.clone()).unwrap_or_default();
+        div()
+            .flex()
+            .flex_col()
+            .child(Self::slot_heading(title))
+            .child(self.slots_subject(s))
+            .child(
+                div()
+                    .id("slot-status")
+                    .debug_selector(|| "slot-status".into())
+                    .text_color(color)
+                    .child(text.to_string()),
+            )
+            .child(
+                self.slot_keys_row()
+                    .child(self.slot_key_hint("esc", "close")),
+            )
+            .into_any_element()
+    }
+
+    fn render_slots_shown(
+        &self,
+        s: &SlotSheet,
+        n: usize,
+        sheet: &EntrySheet,
+        cx: &mut Context<Self>,
+    ) -> AnyElement {
+        let p = self.palette;
+        let ext = s.rows.get(n).map(|r| r.0.clone()).unwrap_or_default();
+        let title = if sheet.title.trim().is_empty() {
+            s.rows.get(n).map(|r| r.1.title.clone()).unwrap_or_default()
+        } else {
+            sheet.title.clone()
+        };
+        let copyable = sheet.code.is_some() || !sheet.text.is_empty();
+        div()
+            .flex()
+            .flex_col()
+            .gap(px(8.))
+            .child(
+                div()
+                    .flex()
+                    .items_baseline()
+                    .gap(px(8.))
+                    .child(Self::slot_heading(title).mb_0())
+                    .child(div().flex_1())
+                    .child(
+                        div()
+                            .text_size(px(11.5))
+                            .text_color(p.muted)
+                            .child(format!("from {ext}")),
+                    ),
+            )
+            .child(self.slots_subject(s).mb_0())
+            .when_some(sheet.description.clone(), |d, t| {
+                d.child(div().text_color(p.muted).child(t))
+            })
+            .children(
+                sheet
+                    .text
+                    .split("\n\n")
+                    .filter(|t| !t.trim().is_empty())
+                    .map(|t| div().child(t.to_string())),
+            )
+            .when(!sheet.fields.is_empty(), |d| {
+                d.child(
+                    div()
+                        .id("slot-fields")
+                        .debug_selector(|| "slot-fields".into())
+                        .flex()
+                        .flex_col()
+                        .gap(px(3.))
+                        .children(sheet.fields.iter().map(|f| {
+                            div()
+                                .flex()
+                                .gap(px(8.))
+                                .child(
+                                    div()
+                                        .w(px(110.))
+                                        .flex_none()
+                                        .text_color(p.muted)
+                                        .child(f.label.clone()),
+                                )
+                                .child(
+                                    div()
+                                        .flex_1()
+                                        .min_w_0()
+                                        .font_family(mono())
+                                        .text_size(px(11.5))
+                                        .child(f.value.clone()),
+                                )
+                        })),
+                )
+            })
+            .when_some(sheet.code.clone(), |d, code| {
+                d.child(
+                    div()
+                        .id("slot-code")
+                        .debug_selector(|| "slot-code".into())
+                        .max_h(px(340.))
+                        .overflow_y_scroll()
+                        .p(px(8.))
+                        .rounded(px(self.theme.corner(8.)))
+                        .border_1()
+                        .border_color(p.line)
+                        .font_family(mono())
+                        .text_size(px(11.))
+                        .line_height(relative(1.35))
+                        .child(code),
+                )
+            })
+            .child(
+                self.slot_keys_row()
+                    .items_center()
+                    .when(copyable, |d| {
+                        d.child(
+                            div()
+                                .id("slot-copy")
+                                .debug_selector(|| "slot-copy".into())
+                                .px(px(8.))
+                                .py(px(3.))
+                                .rounded(px(self.theme.chip_radius))
+                                .map(|d| crate::ornament::border(d, self.theme.chip_border, p.line))
+                                .cursor_pointer()
+                                .text_size(px(11.5))
+                                .font_weight(FontWeight::MEDIUM)
+                                .text_color(p.ink)
+                                .hover(|s| s.border_color(p.accent))
+                                .child(sheet.copy_label())
+                                .on_click(cx.listener(|this, _, _, cx| this.slots_copy(cx))),
+                        )
+                    })
+                    .when(copyable, |d| d.child(self.slot_key_hint(COPY_KEY, "copy")))
+                    .child(self.slot_key_hint("esc", "close")),
+            )
+            .into_any_element()
+    }
+}
+
+const DIGITS: [&str; 9] = ["1", "2", "3", "4", "5", "6", "7", "8", "9"];
+
+const COPY_KEY: &str = if cfg!(target_os = "windows") {
+    "Ctrl+C"
+} else {
+    "⌘C"
+};
+
+// The extension sheets' small parts, as `sheets.rs` draws them.
+impl MainView {
+    fn slot_kbd(&self, k: &'static str) -> Div {
+        crate::theme_ext::kbd(div(), &self.theme)
+            .px(px(6.))
+            .py(px(1.))
+            .min_w(px(20.))
+            .flex()
+            .justify_center()
+            .font_weight(FontWeight::MEDIUM)
+            .text_size(px(11.5))
+            .child(k)
+    }
+
+    fn slot_key_hint(&self, k: &'static str, label: &'static str) -> Div {
+        div()
+            .flex()
+            .items_center()
+            .gap(px(5.))
+            .child(self.slot_kbd(k))
+            .child(label)
+    }
+
+    fn slot_heading(s: impl Into<SharedString>) -> Div {
+        div()
+            .mb(px(8.))
+            .font_weight(FontWeight::SEMIBOLD)
+            .text_size(px(13.))
+            .child(s.into())
+    }
+
+    fn slot_keys_row(&self) -> Div {
+        div()
+            .mt(px(12.))
+            .flex()
+            .flex_wrap()
+            .gap(px(14.))
+            .text_color(self.palette.muted)
+    }
+}
diff --git a/crates/blyg-app/src/extensions/reading_slots_tests.rs b/crates/blyg-app/src/extensions/reading_slots_tests.rs
new file mode 100644
index 0000000..12a7089
--- /dev/null
+++ b/crates/blyg-app/src/extensions/reading_slots_tests.rs
@@ -0,0 +1,362 @@
+//! --- reading slots --- The window driving a real `Host` running the real
+//! bundled reading-time and inspect over the fake's invented reading rows:
+//! the byline marker (asked off the main thread, cached, drawn in the
+//! stream), nothing without `reading.read`, and the ⋯ chip, sheet, inspect's
+//! answer and Copy.
+//!
+//! As in `tests.rs`, the extensions run as child processes of this test
+//! binary, each running only its `…_child` test below (which serves the
+//! same `run_stdio` that `blygger +ext <name>` calls).
+
+use std::path::PathBuf;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use blyg_core::config::MemoryTokenStore;
+use blyg_core::{Backend, ConfigStore, ReadingItem};
+use blyg_ext::reading::ReadingEntry;
+use gpui_kit::{Entity, TestAppContext, VisualTestContext};
+
+use super::super::{Launch, host_config};
+use super::Phase;
+use crate::app::MainView;
+use crate::fake::reading_seed::*;
+use crate::fake::{FakeBackend, Timing};
+use crate::prefs::Prefs;
+
+const RT: &str = blyg_ext_reading_time::NAME;
+const INSPECT: &str = blyg_ext_inspect::NAME;
+
+// ------------------------------------------------------------ the children
+
+fn child_test(name: &str) -> String {
+    let m = module_path!();
+    let m = m.split_once("::").map(|(_, rest)| rest).unwrap_or(m);
+    format!("{m}::{name}")
+}
+
+fn child_args(name: &str) -> Vec<String> {
+    vec![
+        "--exact".into(),
+        child_test(name),
+        "--ignored".into(),
+        "--quiet".into(),
+        "--test-threads=1".into(),
+    ]
+}
+
+/// Not a test: the bundled reading-time's process for the tests below.
+#[test]
+#[ignore = "the reading-time child process of the reading-slot tests"]
+fn reading_time_child() {
+    if std::env::args().any(|a| a == child_test("reading_time_child")) {
+        let _ = blyg_ext_reading_time::run_stdio();
+    }
+}
+
+/// Not a test: the bundled inspect's process for the tests below.
+#[test]
+#[ignore = "the inspect child process of the reading-slot tests"]
+fn inspect_child() {
+    if std::env::args().any(|a| a == child_test("inspect_child")) {
+        let _ = blyg_ext_inspect::run_stdio();
+    }
+}
+
+fn launch(data_dir: PathBuf) -> Launch {
+    Launch {
+        program: std::env::current_exe().expect("the test binary"),
+        args: vec![],
+        crosspost_args: vec![],
+        reading_time_args: child_args("reading_time_child"),
+        inspect_args: child_args("inspect_child"),
+        data_dir,
+        timing: blyg_ext::Timing::default(),
+    }
+}
+
+// ------------------------------------------------------------ the window
+
+struct Env<'a> {
+    _dir: tempfile::TempDir,
+    view: Entity<MainView>,
+    fake: Arc<FakeBackend>,
+    cx: &'a mut VisualTestContext,
+}
+
+fn setup<'a>(cx: &'a mut TestAppContext, config: &str) -> Env<'a> {
+    let dir = tempfile::tempdir().unwrap();
+    let config = format!("blyg-url = https://blyg.example.com\n{config}");
+    let prefs = Prefs::from_config(ConfigStore::in_memory(&config).config());
+    let l = launch(dir.path().join("data"));
+    cx.update(|cx| {
+        gpui_kit::init(cx);
+        crate::app::bind_keys(cx);
+        crate::settings::init(
+            ConfigStore::in_memory(&config),
+            Arc::new(MemoryTokenStore::default()),
+            None,
+            cx,
+        );
+        cx.set_global(l);
+    });
+    let fake = Arc::new(FakeBackend::with_timing(Timing::instant()).without_media_cache());
+    let backend: Arc<dyn Backend> = fake.clone();
+    let f2 = fake.clone();
+    let (view, cx) = cx.add_window_view(move |window, cx| {
+        MainView::new(backend, Some(f2), prefs, Instant::now(), window, cx)
+    });
+    cx.run_until_parked();
+    Env {
+        _dir: dir,
+        view,
+        fake,
+        cx,
+    }
+}
+
+impl Env<'_> {
+    /// Run the window until `done` (the extensions answer from other
+    /// processes, in real time).
+    fn wait(&mut self, what: &str, mut done: impl FnMut(&MainView) -> bool) {
+        let t = Instant::now();
+        loop {
+            self.cx.run_until_parked();
+            self.view
+                .update_in(self.cx, |v, window, cx| v.ext_pump(window, cx));
+            self.cx.update(|window, _| window.refresh());
+            self.cx.run_until_parked();
+            if self.view.read_with(self.cx, |v, _| done(v)) {
+                return;
+            }
+            assert!(
+                t.elapsed() < Duration::from_secs(20),
+                "timed out waiting for {what}"
+            );
+            std::thread::sleep(Duration::from_millis(15));
+        }
+    }
+
+    fn start(&mut self) {
+        self.view
+            .update_in(self.cx, |v, window, cx| v.ext_start(window, cx));
+    }
+
+    /// The reading screen, in the stream.
+    fn reading(&mut self) {
+        self.cx.simulate_keystrokes(&crate::keymap::keys("cmd-r"));
+        self.cx.run_until_parked();
+    }
+
+    fn row(&self, id: &str) -> ReadingItem {
+        self.fake
+            .reading()
+            .into_iter()
+            .find(|r| r.remote_id == id)
+            .expect("a seeded row")
+    }
+}
+
+fn running(v: &MainView, name: &str) -> bool {
+    v.ext
+        .host
+        .as_ref()
+        .is_some_and(|h| h.entry_slots().iter().any(|s| s.ext == name))
+}
+
+const BOTH: &str = "extension = reading-time\nextension-allow = reading-time reading.read\n\
+                    extension = inspect\nextension-allow = inspect reading.read\n";
+
+#[test]
+fn the_host_config_carries_both_bundled_slot_extensions() {
+    let store = ConfigStore::in_memory(BOTH);
+    let l = launch(PathBuf::from("/data"));
+    let hc = host_config(&store, &l);
+    assert_eq!(hc.enabled, [RT, INSPECT]);
+    for (name, args) in [(RT, &l.reading_time_args), (INSPECT, &l.inspect_args)] {
+        let b = hc
+            .bundled
+            .iter()
+            .find(|b| b.manifest.name == name)
+            .unwrap_or_else(|| panic!("{name} is bundled"));
+        match &b.origin {
+            blyg_ext::Origin::Bundled { program, args: a } => {
+                assert_eq!(program, &l.program);
+                assert_eq!(a, args);
+            }
+            o => panic!("{o:?}"),
+        }
+    }
+    // The app runs them as its own `+ext <name>`.
+    let app = crate::cli::host_config(&store);
+    for name in [RT, INSPECT] {
+        let b = app
+            .bundled
+            .iter()
+            .find(|b| b.manifest.name == name)
+            .unwrap();
+        let blyg_ext::Origin::Bundled { args, .. } = &b.origin else {
+            panic!()
+        };
+        assert_eq!(args, &["+ext".to_string(), name.to_string()]);
+    }
+}
+
+#[gpui_kit::test]
+fn the_stream_byline_shows_reading_time_once_it_answers(cx: &mut TestAppContext) {
+    let mut env = setup(cx, BOTH);
+    env.reading();
+    // Nothing runs before the start, and nothing is drawn or asked.
+    assert!(env.cx.debug_bounds("slot-byline-reading-time").is_none());
+    env.view
+        .read_with(env.cx, |v, _| assert_eq!(v.ext.slots.asked(), 0));
+    env.start();
+    env.wait("reading-time to run", |v| running(v, RT));
+    let row = env.row(RUE_TRUST);
+    let want = blyg_ext_reading_time::byline(&ReadingEntry::of(&row)).expect("it has text");
+    let key = (
+        RT.to_string(),
+        row.subscription_id.clone(),
+        row.remote_id.clone(),
+        row.version,
+    );
+    env.wait("the marker", |v| v.ext.slots.marker(&key).is_some());
+    env.view.read_with(env.cx, |v, _| {
+        assert_eq!(v.ext.slots.marker(&key), Some(Some(want.clone())));
+    });
+    env.cx.update(|window, _| window.refresh());
+    env.cx.run_until_parked();
+    assert!(
+        env.cx.debug_bounds("slot-byline-reading-time").is_some(),
+        "drawn at the end of the byline"
+    );
+    // Asked once per entry and version: drawing again asks nothing new.
+    let asked = env.view.read_with(env.cx, |v, _| v.ext.slots.asked());
+    for _ in 0..3 {
+        env.cx.update(|window, _| window.refresh());
+        env.cx.run_until_parked();
+    }
+    assert_eq!(
+        env.view.read_with(env.cx, |v, _| v.ext.slots.asked()),
+        asked
+    );
+}
+
+#[gpui_kit::test]
+fn without_reading_read_nothing_is_asked_or_drawn(cx: &mut TestAppContext) {
+    // Enabled, and allowed nothing: consent first, no slots meanwhile.
+    let mut env = setup(cx, "extension = reading-time\n");
+    env.reading();
+    env.start();
+    env.wait("the consent sheet", |v| v.ext.overlay.is_some());
+    env.view.read_with(env.cx, |v, _| {
+        assert!(!running(v, RT));
+        assert_eq!(v.ext.slots.asked(), 0, "nothing sent");
+    });
+    assert!(env.cx.debug_bounds("slot-byline-reading-time").is_none());
+}
+
+#[gpui_kit::test]
+fn the_more_chip_opens_inspect_and_copies_the_json(cx: &mut TestAppContext) {
+    let mut env = setup(cx, BOTH);
+    env.reading();
+    env.start();
+    env.wait("inspect to run", |v| running(v, INSPECT));
+    // The selected post's actions end with "⋯".
+    env.cx.simulate_keystrokes("j");
+    env.cx.run_until_parked();
+    env.cx.update(|window, _| window.refresh());
+    env.cx.run_until_parked();
+    let chip = env.cx.debug_bounds("slot-more").expect("the ⋯ chip");
+    env.cx
+        .simulate_click(chip.center(), gpui_kit::Modifiers::none());
+    env.cx.run_until_parked();
+    env.view.read_with(env.cx, |v, _| {
+        let s = v.ext.slots.sheet.as_ref().expect("the ⋯ sheet");
+        assert_eq!(s.item.remote_id, RUE_TRUST);
+        assert_eq!(s.phase, Phase::Choose);
+        let rows: Vec<(&str, &str)> = s
+            .rows
+            .iter()
+            .map(|(e, a)| (e.as_str(), a.title.as_str()))
+            .collect();
+        assert_eq!(rows, [(INSPECT, "inspect")]);
+        assert!(v.ext.has_overlay(), "web views hide under it");
+    });
+    assert!(env.cx.debug_bounds("slot-row-0").is_some());
+    // ⏎ runs the row; inspect answers with the record.
+    env.cx.simulate_keystrokes("enter");
+    env.wait("inspect's sheet", |v| {
+        matches!(
+            v.ext.slots.sheet.as_ref().map(|s| &s.phase),
+            Some(Phase::Shown(..))
+        )
+    });
+    let row = env.row(RUE_TRUST);
+    env.view.read_with(env.cx, |v, _| {
+        let Some(Phase::Shown(_, sheet)) = v.ext.slots.sheet.as_ref().map(|s| &s.phase) else {
+            unreachable!()
+        };
+        assert_eq!(sheet.title, "inspect");
+        let field = |l: &str| {
+            sheet
+                .fields
+                .iter()
+                .find(|f| f.label == l)
+                .map(|f| f.value.clone())
+        };
+        assert_eq!(field("id").as_deref(), Some(RUE_TRUST));
+        assert_eq!(field("version"), Some(row.version.to_string()));
+        assert_eq!(
+            field("content hash"),
+            Some(blyg_core::content_hash(&row.content_md))
+        );
+        let code = sheet.code.as_deref().unwrap();
+        assert!(code.contains("\"remote_id\""), "{code}");
+        assert!(
+            !code.contains(row.content_md.lines().next().unwrap_or("x")),
+            "the body is elided"
+        );
+    });
+    env.cx.update(|window, _| window.refresh());
+    env.cx.run_until_parked();
+    assert!(env.cx.debug_bounds("slot-fields").is_some());
+    assert!(env.cx.debug_bounds("slot-code").is_some());
+    // The sheet slides in in real time: click Copy once it has stopped
+    // moving, or the click can land where it was (seen on Windows CI).
+    let started = std::time::Instant::now();
+    let mut last = None;
+    let copy = loop {
+        env.cx.update(|window, _| window.refresh());
+        env.cx.run_until_parked();
+        let b = env.cx.debug_bounds("slot-copy").expect("Copy JSON");
+        if last == Some(b) {
+            break b;
+        }
+        assert!(
+            started.elapsed() < std::time::Duration::from_secs(5),
+            "Copy JSON kept moving"
+        );
+        last = Some(b);
+        std::thread::sleep(std::time::Duration::from_millis(40));
+    };
+    env.cx
+        .simulate_click(copy.center(), gpui_kit::Modifiers::none());
+    env.cx.run_until_parked();
+    let clip = env
+        .cx
+        .update(|_, cx| cx.read_from_clipboard().and_then(|c| c.text()))
+        .unwrap_or_default();
+    let json: serde_json::Value = serde_json::from_str(&clip).expect("the JSON");
+    assert_eq!(json["remote_id"], RUE_TRUST);
+    assert!(
+        json["content_md"]
+            .as_str()
+            .is_some_and(|s| s.ends_with("characters, not shown›"))
+    );
+    // esc closes it.
+    env.cx.simulate_keystrokes("escape");
+    env.cx.run_until_parked();
+    env.view
+        .read_with(env.cx, |v, _| assert!(v.ext.slots.sheet.is_none()));
+}
diff --git a/crates/blyg-app/src/extensions/sheets.rs b/crates/blyg-app/src/extensions/sheets.rs
index 2b34792..340bd96 100644
--- a/crates/blyg-app/src/extensions/sheets.rs
+++ b/crates/blyg-app/src/extensions/sheets.rs
@@ -22,7 +22,11 @@ pub(crate) enum RowAction {
     /// A granted macro site's `home`, in the browser pane (to sign in).
     OpenSite { ext: String, site: String },
     /// A library's notes, in the notes drawer.
-    Library { ext: String, title: String },
+    Library {
+        ext: String,
+        id: String,
+        title: String,
+    },
     /// The Manage extensions sheet.
     Manage,
 }
@@ -89,6 +93,7 @@ impl MainView {
                 rows.push(Row {
                     action: RowAction::Library {
                         ext: l.ext.clone(),
+                        id: l.library.id.clone(),
                         title: l.library.title.clone(),
                     },
                     label: format!("Browse {}", l.library.title),
@@ -131,6 +136,8 @@ impl MainView {
         if let Some(Overlay::Consent { reply, name, .. }) = self.ext.overlay.take() {
             match reply {
                 Some(r) => r.answer(false),
+                // (The tour's sample question leaves no notice.)
+                None if self.ext_tour_on() => {}
                 None => {
                     self.ext.notices.insert(name, Notice::NeedsPermission);
                 }
@@ -179,7 +186,10 @@ impl MainView {
         self.focus_after_sheet(window, cx);
         match row.action {
             RowAction::Manage => self.ext_open_manage(window, cx),
-            RowAction::Library { .. } => self.ext_lib_show(window, cx),
+            RowAction::Library { id, .. } => {
+                self.ext_lib_show(window, cx);
+                self.ext_lib_choose(Some(id), window, cx);
+            }
             RowAction::Command { ext, id } => self.ext_run_command(ext, id, screen, window, cx),
             RowAction::Macro { ext, id } => self.ext_run_macro(ext, id, window, cx),
             RowAction::OpenSite { ext, site } => self.ext_open_site(&ext, &site, window, cx),
@@ -299,6 +309,16 @@ impl MainView {
         }
         let unticked: Vec<Capability> = caps.iter().filter(|c| !c.1).map(|c| c.0.clone()).collect();
         let name = name.clone();
+        // --- onboarding --- the tour's sample sheet: say so, write nothing.
+        if self.ext_tour_on() {
+            if let Some(Overlay::Consent { reply: Some(r), .. }) = self.ext.overlay.take() {
+                r.answer(false);
+            }
+            self.ext.overlay = None;
+            self.focus_after_sheet(window, cx);
+            self.ext_tour_refuses(format!("{name} would be allowed"), cx);
+            return;
+        }
         if !unticked.is_empty() {
             self.ext.declined.push((name.clone(), unticked));
         }
@@ -334,10 +354,89 @@ impl MainView {
 
     /// Manage › Turn on: enable a disabled extension (consent follows).
     fn ext_turn_on(&mut self, name: &str, window: &mut Window, cx: &mut Context<Self>) {
+        if self.ext_tour_refuses(format!("{name} would be turned on"), cx) {
+            return;
+        }
         let changes = super::allow_changes(crate::settings::get(cx).store.config(), name, &[]);
         self.ext_write_config(&changes, window, cx);
     }
 
+    /// Turn off (Manage, or the consent sheet's ⌘⌫): remove `name`'s
+    /// `extension` lines; the reload stops it. Its grants and settings
+    /// stay, so Turn on brings it back as it was, unless `forget` (Forget
+    /// permissions), which removes its `extension-allow` lines too. Any
+    /// question or notice about it goes away.
+    pub(crate) fn ext_turn_off(
+        &mut self,
+        name: &str,
+        forget: bool,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        // --- onboarding --- in the tour: the sheet goes, nothing is written.
+        if self.ext_tour_on() {
+            if matches!(&self.ext.overlay, Some(Overlay::Consent { name: n, .. }) if n == name) {
+                if let Some(Overlay::Consent { reply: Some(r), .. }) = self.ext.overlay.take() {
+                    r.answer(false);
+                }
+                self.ext.overlay = None;
+                self.focus_after_sheet(window, cx);
+            }
+            let what = if forget {
+                format!("{name} would be turned off, its permissions forgotten")
+            } else {
+                format!("{name} would be turned off")
+            };
+            self.ext_tour_refuses(what, cx);
+            return;
+        }
+        let cfg = crate::settings::get(cx).store.config();
+        let was_on = cfg.extensions_enabled().iter().any(|n| n == name);
+        let changes = super::disable_changes(cfg, name, forget);
+        // A consent sheet for it (on screen or queued) is answered no.
+        let consent =
+            matches!(&self.ext.overlay, Some(Overlay::Consent { name: n, .. }) if n == name);
+        if consent {
+            if let Some(Overlay::Consent { reply: Some(r), .. }) = self.ext.overlay.take() {
+                r.answer(false);
+            }
+            self.focus_after_sheet(window, cx);
+        }
+        for a in std::mem::take(&mut self.ext.asks) {
+            if a.name == name {
+                if let Some(r) = a.reply {
+                    r.answer(false);
+                }
+            } else {
+                self.ext.asks.push_back(a);
+            }
+        }
+        self.ext.notices.remove(name);
+        // Turning it on again is a fresh start: ask again.
+        self.ext.asked.retain(|(n, _)| n != name);
+        self.ext.declined.retain(|(n, _)| n != name);
+        if !changes.is_empty() && self.ext_write_config(&changes, window, cx) {
+            let text = match (was_on, forget) {
+                (true, false) => format!("{name} turned off"),
+                (true, true) => format!("{name} turned off, permissions forgotten"),
+                (false, _) => format!("{name}'s permissions forgotten"),
+            };
+            self.show_toast(text, Some("Saved in your config file".into()), cx);
+        }
+        cx.notify();
+        if consent {
+            self.ext_next_ask(window, cx);
+        }
+    }
+
+    /// The consent sheet's Turn off: the extension it asks for.
+    fn ext_consent_turn_off(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if let Some(Overlay::Consent { name, .. }) = self.ext.overlay.as_ref() {
+            let name = name.clone();
+            self.ext_turn_off(&name, false, window, cx);
+        }
+    }
+
     // ------------------------------------------------------------ render
 
     /// Hook: whichever extension sheet is up.
@@ -574,6 +673,9 @@ impl MainView {
                 match k {
                     "enter" => this.ext_allow(window, cx),
                     "escape" => this.ext_close(window, cx),
+                    "backspace" if ev.keystroke.modifiers.secondary() => {
+                        this.ext_consent_turn_off(window, cx)
+                    }
                     _ => match k.parse::<usize>() {
                         Ok(n) if n >= 1 => this.ext_toggle_cap(n - 1, cx),
                         _ => return,
@@ -612,6 +714,15 @@ impl MainView {
                                 cx.listener(|this, _, window, cx| this.ext_close(window, cx)),
                             ),
                     )
+                    .child(
+                        self.ext_key_hint(crate::keymap::hint("⌘⌫"), "turn off")
+                            .id("ext-turn-off")
+                            .debug_selector(|| "ext-turn-off".into())
+                            .cursor_pointer()
+                            .on_click(cx.listener(|this, _, window, cx| {
+                                this.ext_consent_turn_off(window, cx)
+                            })),
+                    )
                     .child(div().child("1–9 tick or untick")),
             )
             .into_any_element()
@@ -651,24 +762,7 @@ impl MainView {
         };
         let cards = status.into_iter().map(|s| {
             let (word, good) = state_word(&s.state);
-            let name = s.name.clone();
-            let n2 = s.name.clone();
-            let action = match s.state {
-                ExtState::Disabled => Some(chip(format!("ext-on-{name}"), "Turn on").on_click(
-                    cx.listener(move |this, _, window, cx| {
-                        this.ext_turn_on(&name, window, cx);
-                    }),
-                )),
-                _ if s.enabled && !s.missing.is_empty() => Some(
-                    chip(format!("ext-allow-{name}"), "Allow…").on_click(cx.listener(
-                        move |this, _, window, cx| {
-                            this.ext.overlay = None;
-                            this.ext_ask_again(&n2, window, cx);
-                        },
-                    )),
-                ),
-                _ => None,
-            };
+            let actions = self.ext_manage_actions(&s, &chip, cx);
             div()
                 .py(px(8.))
                 .border_b_1()
@@ -711,8 +805,7 @@ impl MainView {
                                 .text_size(px(11.5))
                                 .text_color(if good { p.green_text() } else { p.muted })
                                 .child(word),
-                        )
-                        .children(action),
+                        ),
                 )
                 .when(!s.description.is_empty(), |d| {
                     d.child(
@@ -724,6 +817,16 @@ impl MainView {
                 })
                 .children(caps_line("Allowed", &s.granted))
                 .children(caps_line("Not allowed", &s.missing))
+                .when(!actions.is_empty(), |d| {
+                    d.child(
+                        div()
+                            .mt(px(3.))
+                            .flex()
+                            .flex_wrap()
+                            .gap(px(6.))
+                            .children(actions),
+                    )
+                })
         });
         div()
             .track_focus(focus)
@@ -768,6 +871,48 @@ impl MainView {
             )
             .into_any_element()
     }
+
+    /// A Manage card's buttons: Turn on (off), or Allow… (something not
+    /// allowed yet) and Turn off (on, in any state); Forget permissions
+    /// (anything allowed).
+    fn ext_manage_actions(
+        &self,
+        s: &blyg_ext::ExtensionStatus,
+        chip: &dyn Fn(String, &'static str) -> Stateful<Div>,
+        cx: &Context<Self>,
+    ) -> Vec<Stateful<Div>> {
+        let mut actions = vec![];
+        let n = s.name.clone();
+        if !s.enabled {
+            actions.push(chip(format!("ext-on-{n}"), "Turn on").on_click(
+                cx.listener(move |this, _, window, cx| this.ext_turn_on(&n, window, cx)),
+            ));
+        } else {
+            if !s.missing.is_empty() {
+                let n = n.clone();
+                actions.push(
+                    chip(format!("ext-allow-{n}"), "Allow…").on_click(cx.listener(
+                        move |this, _, window, cx| {
+                            this.ext.overlay = None;
+                            this.ext_ask_again(&n, window, cx);
+                        },
+                    )),
+                );
+            }
+            actions.push(chip(format!("ext-off-{n}"), "Turn off").on_click(
+                cx.listener(move |this, _, window, cx| this.ext_turn_off(&n, false, window, cx)),
+            ));
+        }
+        if !s.granted.is_empty() {
+            let n = s.name.clone();
+            actions.push(
+                chip(format!("ext-forget-{n}"), "Forget permissions").on_click(
+                    cx.listener(move |this, _, window, cx| this.ext_turn_off(&n, true, window, cx)),
+                ),
+            );
+        }
+        actions
+    }
 }
 
 /// A state in a word, and whether it's good news.
@@ -785,21 +930,62 @@ pub fn state_word(s: &ExtState) -> (String, bool) {
 }
 
 impl MainView {
-    /// Hook (Settings): "NOTES FOLDER" with the markdown-notes vault, and
-    /// "Markdown notes folder…", which picks a folder, writes
-    /// `extension = markdown-notes` and its `vault` setting, and asks for
-    /// permission to use it.
+    /// Hook (Settings): "NOTES FOLDERS", the markdown-notes vaults, each
+    /// with Remove (the config line only; the folder is never touched),
+    /// and "Add folder…", which picks folders (several at once), writes
+    /// `extension = markdown-notes` and a `vault` / `vault-<label>` setting
+    /// for each, and asks for permission to use them.
     pub(crate) fn render_ext_settings_row(&self, cx: &mut Context<Self>) -> AnyElement {
         let p = self.palette;
-        let vault = self.ext_vault(cx);
-        let running = self.ext_library().is_some();
-        let now = match &vault {
-            Some(v) if running => format!("{v} · on"),
-            Some(v) => format!("{v} · not running yet"),
-            None => {
-                "Off: a folder of Markdown notes (an Obsidian vault) in the notes drawer".into()
+        let (on, vaults) = self.ext_vaults(cx);
+        let running = self.ext_libraries().iter().any(|l| l.ext == super::NOTES);
+        let now = match (on, vaults.is_empty()) {
+            (false, true) => {
+                "Off: folders of Markdown notes (Obsidian vaults) in the notes drawer".into()
             }
+            (false, false) => "Off: turn on markdown-notes to use them".to_string(),
+            (true, true) => "On, with no folder yet: add one".into(),
+            (true, false) if running => "On · in the notes drawer's Notes tab".into(),
+            (true, false) => "Not running yet: waiting for permission".into(),
         };
+        let rows: Vec<AnyElement> = vaults
+            .iter()
+            .enumerate()
+            .map(|(i, v)| {
+                let key = v.key.clone();
+                div()
+                    .flex()
+                    .items_center()
+                    .gap(px(8.))
+                    .min_w_0()
+                    .text_size(px(12.))
+                    .child(div().flex_none().child(v.title.clone()))
+                    .child(
+                        div()
+                            .flex_1()
+                            .min_w_0()
+                            .truncate()
+                            .text_size(px(11.5))
+                            .text_color(p.muted)
+                            .child(v.path.clone()),
+                    )
+                    .child(
+                        div()
+                            .id(("ext-vault-remove", i))
+                            .debug_selector(move || format!("ext-vault-remove-{i}"))
+                            .flex_none()
+                            .text_size(px(11.5))
+                            .text_color(p.muted)
+                            .cursor_pointer()
+                            .hover(|s| s.underline().text_color(p.ink))
+                            .child("Remove")
+                            .on_click(cx.listener(move |this, _, window, cx| {
+                                this.ext_remove_vault(&key, window, cx)
+                            })),
+                    )
+                    .into_any_element()
+            })
+            .collect();
         div()
             .flex()
             .gap(px(12.))
@@ -812,7 +998,7 @@ impl MainView {
                     .text_size(px(10.5))
                     .font_weight(FontWeight::SEMIBOLD)
                     .text_color(p.muted)
-                    .child("NOTES FOLDER"),
+                    .child("NOTES FOLDERS"),
             )
             .child(
                 div()
@@ -821,6 +1007,7 @@ impl MainView {
                     .flex()
                     .flex_col()
                     .gap(px(4.))
+                    .children(rows)
                     .child(
                         div().flex().child(
                             div()
@@ -831,9 +1018,9 @@ impl MainView {
                                 .map(|d| crate::theme_ext::chip(d, &self.theme, false))
                                 .cursor_pointer()
                                 .hover(|s| s.border_color(p.accent).bg(p.hover()))
-                                .child("Markdown notes folder…")
+                                .child("Add folder…")
                                 .on_click(cx.listener(|this, _, window, cx| {
-                                    this.ext_pick_vault(window, cx)
+                                    this.ext_pick_vaults(window, cx)
                                 })),
                         ),
                     )
@@ -847,27 +1034,4 @@ impl MainView {
             )
             .into_any_element()
     }
-
-    /// The folder picker for the notes folder.
-    fn ext_pick_vault(&mut self, window: &mut Window, cx: &mut Context<Self>) {
-        let rx = cx.prompt_for_paths(PathPromptOptions {
-            files: false,
-            directories: true,
-            multiple: false,
-            prompt: Some("Use as notes folder".into()),
-        });
-        cx.spawn_in(window, async move |this, cx| {
-            let Ok(Ok(Some(paths))) = rx.await else {
-                return;
-            };
-            let Some(dir) = paths.into_iter().next() else {
-                return;
-            };
-            let _ = this.update_in(cx, |v, window, cx| {
-                v.close_sheet(window, cx);
-                v.ext_set_vault(&dir, window, cx);
-            });
-        })
-        .detach();
-    }
 }
diff --git a/crates/blyg-app/src/extensions/tests.rs b/crates/blyg-app/src/extensions/tests.rs
index 248c749..0fc2486 100644
--- a/crates/blyg-app/src/extensions/tests.rs
+++ b/crates/blyg-app/src/extensions/tests.rs
@@ -22,7 +22,10 @@ use blyg_ext::Capability;
 use gpui_kit::{Entity, TestAppContext, VisualTestContext};
 
 use super::sheets::Overlay;
-use super::{Launch, NOTES, Notice, allow_changes, host_config, vault_changes, vault_text};
+use super::{
+    Launch, NOTES, Notice, allow_changes, configured_vaults, host_config, vault_add_changes,
+    vault_remove_changes, vault_text,
+};
 use crate::app::MainView;
 use crate::fake::{FakeBackend, Timing};
 use crate::prefs::Prefs;
@@ -77,6 +80,9 @@ fn launch(data_dir: PathBuf) -> Launch {
         program: std::env::current_exe().expect("the test binary"),
         args: child_args(child_name()),
         crosspost_args: child_args(child_test("cross_post_child")),
+        // --- reading slots --- never enabled here (reading_slots_tests.rs).
+        reading_time_args: vec![],
+        inspect_args: vec![],
         data_dir,
         timing: blyg_ext::Timing::default(),
     }
@@ -105,18 +111,20 @@ fn consent_and_settings_write_the_extension_lines() {
         "already there"
     );
 
-    // A new vault replaces the vault line and keeps the others.
-    let changes = vault_changes(s.config(), "~/Vault");
+    // A new folder is one more vault; the first stays, as do the others.
+    let (changes, keys) = vault_add_changes(s.config(), &["~/Vault".to_string()]);
+    assert_eq!(keys, ["vault-vault"]);
     s.set(&changes).unwrap();
     let cfg = s.config();
-    assert_eq!(cfg.extension_settings(NOTES)["vault"], "~/Vault");
+    assert_eq!(cfg.extension_settings(NOTES)["vault"], "~/Old");
+    assert_eq!(cfg.extension_settings(NOTES)["vault-vault"], "~/Vault");
     assert_eq!(cfg.extension_settings(NOTES)["folder"], "Inbox");
     assert_eq!(
         cfg.list("extension-setting")
             .iter()
-            .filter(|l| l.contains("vault="))
+            .filter(|l| l.contains("vault"))
             .count(),
-        1
+        2
     );
     assert_eq!(cfg.extensions_enabled(), ["other", "markdown-notes"]);
 }
@@ -396,7 +404,7 @@ fn the_palette_lists_commands_libraries_and_manage(cx: &mut TestAppContext) {
         labels,
         [
             "Save selection to notes",
-            "Browse Notes",
+            "Browse Vault",
             "Manage extensions…"
         ]
     );
@@ -691,7 +699,9 @@ fn settings_point_markdown_notes_at_a_folder_and_ask(cx: &mut TestAppContext) {
     let v = vault();
     let (view, _, cx) = setup(cx, &v, "# test\n");
     view.update_in(cx, |v, window, cx| v.ext_start(window, cx));
-    view.update_in(cx, |m, window, cx| m.ext_set_vault(&v.root, window, cx));
+    view.update_in(cx, |m, window, cx| {
+        m.ext_add_vaults(std::slice::from_ref(&v.root), window, cx)
+    });
     let text = config_text(cx);
     let r = vault_text(&v.root);
     assert!(text.contains("extension = markdown-notes"), "{text}");
@@ -913,7 +923,7 @@ mod macros {
         assert_eq!(*url.borrow(), "https://substack.com/home");
         view.read_with(cx, |v, _| {
             assert!(v.browser.open);
-            assert_eq!(v.browser.mode, crate::app::browser::OpenMode::Full);
+            assert_eq!(v.browser.mode, crate::app::browser::OpenMode::Slide);
         });
     }
 
@@ -1175,3 +1185,563 @@ mod macros {
         assert_eq!(got.markdown.trim(), "The tide went out.");
     }
 }
+
+// ---- multiple vaults
+
+#[test]
+fn vaults_are_added_and_removed_as_config_lines() {
+    let mut s = ConfigStore::in_memory(
+        "# mine\nextension-setting = markdown-notes folder=Inbox\n\
+         extension-allow = markdown-notes ui\n",
+    );
+    // The first folder is `vault=`, so a config that names one still reads.
+    let (changes, keys) = vault_add_changes(s.config(), &["~/Notes".to_string()]);
+    assert_eq!(keys, ["vault"]);
+    s.set(&changes).unwrap();
+    // Several at once; one already there is skipped.
+    let (changes, keys) = vault_add_changes(
+        s.config(),
+        &[
+            "~/Work/Vault".to_string(),
+            "~/Notes/".to_string(),
+            "~/Work/Notes".to_string(),
+        ],
+    );
+    assert_eq!(keys, ["vault-vault", "vault-work-notes"]);
+    s.set(&changes).unwrap();
+    let text = s.text().unwrap().to_string();
+    assert!(text.starts_with("# mine\n"), "comments kept: {text}");
+    assert!(text.contains("extension = markdown-notes"), "{text}");
+    assert!(text.contains("extension-setting = markdown-notes vault=~/Notes"));
+    assert!(text.contains("extension-setting = markdown-notes vault-vault=~/Work/Vault"));
+    let titles: Vec<String> = configured_vaults(s.config())
+        .into_iter()
+        .map(|v| v.title)
+        .collect();
+    assert_eq!(titles, ["Notes", "Vault", "work notes"]);
+    assert!(
+        vault_add_changes(s.config(), &["~/Notes".to_string()])
+            .1
+            .is_empty()
+    );
+
+    // Allowed, then removed: the line and its grant go, nothing else.
+    s.set(&allow_changes(
+        s.config(),
+        NOTES,
+        &[Capability::Fs("~/Work/Vault".into())],
+    ))
+    .unwrap();
+    s.set(&vault_remove_changes(s.config(), "vault-vault"))
+        .unwrap();
+    let text = s.text().unwrap().to_string();
+    assert!(!text.contains("~/Work/Vault"), "{text}");
+    assert!(
+        text.contains("extension-allow = markdown-notes ui"),
+        "{text}"
+    );
+    assert!(text.contains("folder=Inbox"), "{text}");
+    // Removing the first leaves the others; a new one becomes the first.
+    s.set(&vault_remove_changes(s.config(), "vault")).unwrap();
+    let keys: Vec<String> = configured_vaults(s.config())
+        .into_iter()
+        .map(|v| v.key)
+        .collect();
+    assert_eq!(keys, ["vault-work-notes"]);
+    let (_, keys) = vault_add_changes(s.config(), &["~/Garden".to_string()]);
+    assert_eq!(keys, ["vault"]);
+    assert!(vault_remove_changes(s.config(), "vault.nope").is_empty());
+}
+
+#[test]
+fn the_host_config_asks_for_each_vault_and_none_by_default() {
+    let l = launch(PathBuf::from("/data"));
+    let none = ConfigStore::in_memory("extension = markdown-notes\n");
+    let m = &host_config(&none, &l).bundled[0].manifest;
+    assert_eq!(m.capabilities, [Capability::Ui], "no silent ~/Notes");
+    assert!(m.libraries.is_empty());
+    let two = ConfigStore::in_memory(
+        "extension = markdown-notes\nextension-setting = markdown-notes vault=~/Notes\n\
+         extension-setting = markdown-notes vault-work=~/Work/Vault\n",
+    );
+    let m = &host_config(&two, &l).bundled[0].manifest;
+    assert_eq!(
+        m.capabilities,
+        [
+            Capability::Fs("~/Notes".into()),
+            Capability::Fs("~/Work/Vault".into()),
+            Capability::Ui
+        ]
+    );
+    let ids: Vec<&str> = m.libraries.iter().map(|l| l.id.as_str()).collect();
+    assert_eq!(ids, ["notes", "notes.work"]);
+}
+
+/// A second vault beside [`vault`]'s, under the same temporary folder.
+fn work_vault(v: &Vault) -> PathBuf {
+    let root = v.root.parent().unwrap().join("Work").join("Vault");
+    std::fs::create_dir_all(&root).unwrap();
+    std::fs::write(
+        root.join("Standup.md"),
+        "# Standup\n\nThe bench repair ships Friday.\n",
+    )
+    .unwrap();
+    root
+}
+
+/// Two vaults (the first `vault=`, the second `vault-work=`), both
+/// allowed unless `allow_work` is false.
+fn two_running<'a>(
+    cx: &'a mut TestAppContext,
+    v: &Vault,
+    work: &Path,
+    allow_work: bool,
+) -> (
+    Entity<MainView>,
+    Arc<FakeBackend>,
+    &'a mut VisualTestContext,
+) {
+    let r = root_text(v);
+    let w = work.to_string_lossy().into_owned();
+    let mut config = format!(
+        "extension = markdown-notes\nextension-allow = markdown-notes fs:{r}\n\
+         extension-allow = markdown-notes ui\nextension-setting = markdown-notes vault={r}\n\
+         extension-setting = markdown-notes vault-work={w}\n"
+    );
+    if allow_work {
+        config.push_str(&format!("extension-allow = markdown-notes fs:{w}\n"));
+    }
+    let (view, fake, cx) = setup(cx, v, &config);
+    view.update_in(cx, |v, window, cx| v.ext_start(window, cx));
+    wait(&view, cx, "both libraries", |cx| {
+        view.read_with(cx, |v, _| v.ext_libraries().len() == 2)
+    });
+    (view, fake, cx)
+}
+
+#[gpui_kit::test]
+fn the_drawer_switches_vaults_and_remembers(cx: &mut TestAppContext) {
+    let v = vault();
+    let work = work_vault(&v);
+    let (view, fake, cx) = two_running(cx, &v, &work, true);
+    view.update_in(cx, |v, window, cx| v.ext_lib_show(window, cx));
+    wait(&view, cx, "the first vault", |cx| {
+        view.read_with(cx, |v, _| v.ext.lib.entries.len() == 2)
+    });
+    cx.update(|window, _| window.refresh());
+    cx.run_until_parked();
+    assert!(cx.debug_bounds("lib-vault-0").is_some(), "the switcher");
+    assert!(cx.debug_bounds("lib-vault-1").is_some());
+    assert!(cx.debug_bounds("lib-vault-add").is_some());
+    assert!(cx.debug_bounds("lib-vault-remove").is_some());
+
+    // The work vault: its notes, its search.
+    view.update_in(cx, |v, window, cx| {
+        v.ext_lib_choose(Some("notes.work".into()), window, cx)
+    });
+    wait(&view, cx, "the work vault", |cx| {
+        view.read_with(cx, |v, _| {
+            v.ext.lib.entries.len() == 1 && v.ext.lib.entries[0].title == "Standup"
+        })
+    });
+    cx.simulate_input("bench");
+    wait(&view, cx, "a work hit", |cx| {
+        view.read_with(cx, |v, _| {
+            v.ext.lib.hits.as_ref().is_some_and(|h| h.len() == 1)
+        })
+    });
+    let id = view.read_with(cx, |v, _| v.ext.lib.hits.as_ref().unwrap()[0].id.clone());
+    assert_eq!(id, "Standup.md", "only the chosen vault is searched");
+
+    // Quote into post from it.
+    let draft = fake.create_draft(Kind::Fragment, "My take.").unwrap();
+    view.update_in(cx, |v, window, cx| {
+        v.open(&draft, window, cx);
+        v.ext_lib_open(id.clone(), window, cx);
+    });
+    wait(&view, cx, "the note", |cx| {
+        view.read_with(cx, |v, _| v.ext.lib.note.is_some())
+    });
+    view.update_in(cx, |v, window, cx| v.ext_lib_copy(true, window, cx));
+    cx.run_until_parked();
+    let text = fake.item(&draft).unwrap().content_md;
+    assert!(text.contains("> The bench repair ships Friday."), "{text}");
+    assert!(text.contains("> — Standup"), "{text}");
+
+    // A new note lands in the chosen vault.
+    view.update_in(cx, |v, window, cx| {
+        v.ext.lib.note = None;
+        v.ext_lib_new(window, cx);
+        v.ext
+            .lib
+            .editor
+            .as_ref()
+            .unwrap()
+            .update(cx, |s, cx| s.set_value("Retro\n\nWent well.\n", window, cx));
+        v.ext_lib_save(window, cx);
+    });
+    let new = work.join("Retro.md");
+    wait(&view, cx, "the new note", |_| new.exists());
+    assert!(!v.root.join("Retro.md").exists());
+
+    // Remembered in state.json.
+    let st = blyg_core::state::AppState::load(&v.data);
+    assert_eq!(st.notes_vault.as_deref(), Some("notes.work"));
+
+    // Remove from Burrow: the config lines go, the folder stays.
+    view.update_in(cx, |v, window, cx| {
+        v.ext_remove_vault("vault-work", window, cx)
+    });
+    let text = config_text(cx);
+    assert!(!text.contains("vault-work"), "{text}");
+    assert!(
+        !text.contains(&format!("fs:{}", work.to_string_lossy())),
+        "{text}"
+    );
+    assert!(work.join("Standup.md").exists() && new.exists());
+    assert_eq!(view.read_with(cx, |v, _| v.ext.lib.vault.clone()), None);
+    wait(&view, cx, "one library", |cx| {
+        view.read_with(cx, |v, _| v.ext_libraries().len() == 1)
+    });
+}
+
+#[gpui_kit::test]
+fn the_quote_picker_searches_every_vault(cx: &mut TestAppContext) {
+    let v = vault();
+    let work = work_vault(&v);
+    let (view, _, cx) = two_running(cx, &v, &work, true);
+    view.update_in(cx, |v, _, cx| {
+        v.ext.lib.picker = true;
+        v.ext_picker_search("bench".into(), cx);
+    });
+    wait(&view, cx, "hits from both", |cx| {
+        view.read_with(cx, |v, _| v.ext.lib.picker_hits.len() == 3)
+    });
+    view.read_with(cx, |v, _| {
+        let from: Vec<(&str, &str)> = v
+            .ext
+            .lib
+            .picker_hits
+            .iter()
+            .map(|h| (h.lib.library.id.as_str(), h.hit.id.as_str()))
+            .collect();
+        assert!(from.contains(&("notes.work", "Standup.md")), "{from:?}");
+        assert!(from.contains(&("notes", "Garden/Benches.md")), "{from:?}");
+        assert!(from.contains(&("notes", "Tide tables.md")), "{from:?}");
+    });
+}
+
+#[gpui_kit::test]
+fn a_vault_without_permission_says_so_and_the_other_works(cx: &mut TestAppContext) {
+    let v = vault();
+    let work = work_vault(&v);
+    let (view, _, cx) = two_running(cx, &v, &work, false);
+    view.update_in(cx, |v, window, cx| {
+        // The consent sheet came up for the missing folder: not now.
+        v.ext.overlay = None;
+        v.ext_lib_show(window, cx);
+        v.ext_lib_choose(Some("notes.work".into()), window, cx);
+    });
+    cx.update(|window, _| window.refresh());
+    cx.run_until_parked();
+    assert!(
+        cx.debug_bounds("lib-vault-allow").is_some(),
+        "needs permission"
+    );
+    view.update_in(cx, |v, window, cx| {
+        v.ext_lib_choose(Some("notes".into()), window, cx)
+    });
+    wait(&view, cx, "the first vault", |cx| {
+        view.read_with(cx, |v, _| v.ext.lib.entries.len() == 2)
+    });
+    cx.update(|window, _| window.refresh());
+    cx.run_until_parked();
+    assert!(cx.debug_bounds("lib-vault-allow").is_none());
+}
+
+#[gpui_kit::test]
+fn no_folder_offers_to_choose_one_and_adding_asks(cx: &mut TestAppContext) {
+    let v = vault();
+    let (view, _, cx) = setup(
+        cx,
+        &v,
+        "extension = markdown-notes\nextension-allow = markdown-notes ui\n",
+    );
+    view.update_in(cx, |v, window, cx| v.ext_start(window, cx));
+    wait(&view, cx, "markdown-notes running", |cx| {
+        view.read_with(cx, |v, _| {
+            v.ext
+                .host
+                .as_ref()
+                .unwrap()
+                .status()
+                .iter()
+                .any(|s| s.name == NOTES && s.state == blyg_ext::ExtState::Running)
+        })
+    });
+    view.read_with(cx, |v, _| {
+        assert!(v.ext_libraries().is_empty(), "no silent default folder");
+        assert!(v.ext.overlay.is_none(), "nothing more to ask");
+    });
+    view.update_in(cx, |v, window, cx| v.ext_lib_show(window, cx));
+    cx.update(|window, _| window.refresh());
+    cx.run_until_parked();
+    assert!(cx.debug_bounds("notes-tab-library").is_some(), "the tab");
+    assert!(cx.debug_bounds("lib-choose").is_some(), "Choose a folder…");
+
+    // Two folders picked at once: two vault lines, and consent for both.
+    let work = work_vault(&v);
+    view.update_in(cx, |m, window, cx| {
+        m.ext_add_vaults(&[v.root.clone(), work.clone()], window, cx)
+    });
+    let text = config_text(cx);
+    let (r, w) = (vault_text(&v.root), vault_text(&work));
+    assert!(
+        text.contains(&format!("extension-setting = markdown-notes vault={r}")),
+        "{text}"
+    );
+    assert!(
+        text.contains(&format!(
+            "extension-setting = markdown-notes vault-work-vault={w}"
+        )),
+        "{text}"
+    );
+    wait(&view, cx, "the consent sheet", |cx| {
+        view.read_with(cx, |v, _| {
+            matches!(v.ext.overlay, Some(Overlay::Consent { .. }))
+        })
+    });
+    view.read_with(cx, |v, _| {
+        let Some(Overlay::Consent { caps, .. }) = &v.ext.overlay else {
+            unreachable!()
+        };
+        let caps: Vec<&Capability> = caps.iter().map(|c| &c.0).collect();
+        assert_eq!(caps, [&Capability::Fs(r), &Capability::Fs(w)]);
+    });
+}
+
+// ---- turn off
+
+#[test]
+fn turning_off_removes_only_the_extension_line() {
+    use super::disable_changes;
+    let store = ConfigStore::in_memory(
+        "# mine\nextension = other\nextension = markdown-notes\n\
+         extension-allow = markdown-notes ui\nextension-allow = other ui\n\
+         extension-allow = markdown-notes fs:~/Notes\n\
+         extension-setting = markdown-notes vault=~/Notes\n",
+    );
+    let mut s = ConfigStore::in_memory(store.text().unwrap());
+    s.set(&disable_changes(store.config(), NOTES, false))
+        .unwrap();
+    let text = s.text().unwrap().to_string();
+    assert!(text.starts_with("# mine\n"), "comments kept: {text}");
+    assert_eq!(s.config().extensions_enabled(), ["other"]);
+    assert!(
+        text.contains("extension-allow = markdown-notes ui"),
+        "{text}"
+    );
+    assert!(text.contains("extension-allow = markdown-notes fs:~/Notes"));
+    assert!(text.contains("extension-setting = markdown-notes vault=~/Notes"));
+    // Already off: nothing to write.
+    assert!(disable_changes(s.config(), NOTES, false).is_empty());
+
+    // Forget permissions: its grants go, the other extension's stay.
+    let changes = disable_changes(s.config(), NOTES, true);
+    s.set(&changes).unwrap();
+    let cfg = s.config();
+    assert_eq!(cfg.list("extension-allow"), ["other ui"]);
+    assert_eq!(cfg.extension_settings(NOTES)["vault"], "~/Notes");
+    assert!(disable_changes(cfg, NOTES, true).is_empty());
+
+    // The last extension line goes without leaving `extension =` behind.
+    let store = ConfigStore::in_memory("extension = markdown-notes\nextension = markdown-notes\n");
+    let mut s = ConfigStore::in_memory(store.text().unwrap());
+    s.set(&disable_changes(store.config(), NOTES, true))
+        .unwrap();
+    let text = s.text().unwrap().to_string();
+    assert!(!text.contains("extension"), "{text}");
+    assert!(s.config().extensions_enabled().is_empty());
+}
+
+/// Click `selector` once the sheet has stopped sliding in (its animation
+/// runs in real time, so the bounds move until it's done).
+fn click(cx: &mut VisualTestContext, selector: &'static str) {
+    let t = Instant::now();
+    let mut last = None;
+    let b = loop {
+        cx.update(|window, _| window.refresh());
+        cx.run_until_parked();
+        let b = cx
+            .debug_bounds(selector)
+            .unwrap_or_else(|| panic!("{selector} isn't drawn"));
+        if last == Some(b) {
+            break b;
+        }
+        assert!(
+            t.elapsed() < Duration::from_secs(5),
+            "{selector} kept moving"
+        );
+        last = Some(b);
+        std::thread::sleep(Duration::from_millis(40));
+    };
+    cx.simulate_click(b.center(), gpui_kit::Modifiers::none());
+    cx.run_until_parked();
+}
+
+fn notes_state(view: &Entity<MainView>, cx: &mut VisualTestContext) -> blyg_ext::ExtState {
+    view.read_with(cx, |v, _| {
+        let st = v.ext.host.as_ref().unwrap().status();
+        st.into_iter().find(|s| s.name == NOTES).unwrap().state
+    })
+}
+
+fn toast_text(view: &Entity<MainView>, cx: &mut VisualTestContext) -> String {
+    view.read_with(cx, |v, _| {
+        v.toast
+            .as_ref()
+            .map(|t| t.text.to_string())
+            .unwrap_or_default()
+    })
+}
+
+#[gpui_kit::test]
+fn turn_off_in_manage_stops_it_and_turn_on_brings_it_back(cx: &mut TestAppContext) {
+    let v = vault();
+    let r = root_text(&v);
+    let (view, _, cx) = running(cx, &v);
+    view.update_in(cx, |v, window, cx| v.ext_open_manage(window, cx));
+    click(cx, "ext-off-markdown-notes");
+    wait(&view, cx, "it to stop", |cx| {
+        notes_state(&view, cx) == blyg_ext::ExtState::Disabled
+    });
+    view.read_with(cx, |v, _| {
+        assert!(v.ext_library().is_none(), "the child is gone");
+        assert!(v.ext.notices.is_empty());
+        // Manage stays up, showing it off.
+        assert!(matches!(v.ext.overlay, Some(Overlay::Manage { .. })));
+    });
+    assert_eq!(toast_text(&view, cx), "markdown-notes turned off");
+    let text = config_text(cx);
+    assert!(!text.contains("extension = markdown-notes"), "{text}");
+    assert!(text.contains(&format!("extension-allow = markdown-notes fs:{r}")));
+    assert!(text.contains("extension-allow = markdown-notes ui"));
+    assert!(text.contains(&format!("extension-setting = markdown-notes vault={r}")));
+
+    // Turn on: its grants are still there, so it runs without asking.
+    click(cx, "ext-on-markdown-notes");
+    wait(&view, cx, "the library again", |cx| {
+        view.read_with(cx, |v, _| v.ext_library().is_some())
+    });
+    assert!(view.read_with(cx, |v, _| matches!(
+        v.ext.overlay,
+        Some(Overlay::Manage { .. })
+    )));
+}
+
+#[gpui_kit::test]
+fn forget_permissions_turns_it_off_and_turn_on_asks_again(cx: &mut TestAppContext) {
+    let v = vault();
+    let r = root_text(&v);
+    let (view, _, cx) = running(cx, &v);
+    view.update_in(cx, |v, window, cx| v.ext_open_manage(window, cx));
+    click(cx, "ext-forget-markdown-notes");
+    wait(&view, cx, "it to stop", |cx| {
+        notes_state(&view, cx) == blyg_ext::ExtState::Disabled
+    });
+    assert_eq!(
+        toast_text(&view, cx),
+        "markdown-notes turned off, permissions forgotten"
+    );
+    let text = config_text(cx);
+    assert!(!text.contains("extension = markdown-notes"), "{text}");
+    assert!(!text.contains("extension-allow"), "{text}");
+    assert!(text.contains(&format!("extension-setting = markdown-notes vault={r}")));
+    // Nothing left to forget: no chip.
+    cx.update(|window, _| window.refresh());
+    cx.run_until_parked();
+    assert!(cx.debug_bounds("ext-forget-markdown-notes").is_none());
+
+    // Turn on asks again, once Manage closes.
+    click(cx, "ext-on-markdown-notes");
+    wait(&view, cx, "the question", |cx| {
+        view.read_with(cx, |v, _| {
+            v.ext.notices.get(NOTES) == Some(&Notice::NeedsPermission)
+        })
+    });
+    cx.simulate_keystrokes("escape");
+    wait(&view, cx, "the consent sheet", |cx| {
+        view.read_with(cx, |v, _| {
+            matches!(v.ext.overlay, Some(Overlay::Consent { .. }))
+        })
+    });
+}
+
+#[gpui_kit::test]
+fn the_consent_sheet_can_turn_it_off(cx: &mut TestAppContext) {
+    let v = vault();
+    let r = root_text(&v);
+    let config = format!(
+        "# test\nextension = markdown-notes\nextension-setting = markdown-notes vault={r}\n"
+    );
+    let (view, _, cx) = setup(cx, &v, &config);
+    view.update_in(cx, |v, window, cx| v.ext_start(window, cx));
+    wait(&view, cx, "the consent sheet", |cx| {
+        view.read_with(cx, |v, _| {
+            matches!(v.ext.overlay, Some(Overlay::Consent { .. }))
+        })
+    });
+    assert!(cx.debug_bounds("ext-turn-off").is_some(), "drawn");
+    cx.simulate_keystrokes(&crate::keymap::keys("cmd-backspace"));
+    cx.run_until_parked();
+    view.read_with(cx, |v, _| {
+        assert!(v.ext.overlay.is_none());
+        assert!(v.ext.notices.is_empty(), "no nagging notice");
+    });
+    assert_eq!(toast_text(&view, cx), "markdown-notes turned off");
+    let text = config_text(cx);
+    assert!(text.contains("# test\n"), "comments kept: {text}");
+    assert!(!text.contains("extension = markdown-notes"), "{text}");
+    assert!(!text.contains("extension-allow"), "{text}");
+    assert!(text.contains(&format!("extension-setting = markdown-notes vault={r}")));
+    wait(&view, cx, "the reload", |cx| {
+        notes_state(&view, cx) == blyg_ext::ExtState::Disabled
+    });
+    view.read_with(cx, |v, _| {
+        assert!(v.ext.overlay.is_none(), "not asked again");
+        assert!(v.ext.notices.is_empty());
+    });
+}
+
+#[gpui_kit::test]
+fn turn_off_after_not_now_clears_the_notice(cx: &mut TestAppContext) {
+    let v = vault();
+    let r = root_text(&v);
+    let config =
+        format!("extension = markdown-notes\nextension-setting = markdown-notes vault={r}\n");
+    let (view, _, cx) = setup(cx, &v, &config);
+    view.update_in(cx, |v, window, cx| v.ext_start(window, cx));
+    wait(&view, cx, "the consent sheet", |cx| {
+        view.read_with(cx, |v, _| v.ext.overlay.is_some())
+    });
+    cx.simulate_keystrokes("escape");
+    cx.run_until_parked();
+    assert_eq!(
+        view.read_with(cx, |v, _| v.ext.notices.get(NOTES).cloned()),
+        Some(Notice::NeedsPermission)
+    );
+    // The notice reopens the sheet; its Turn off, clicked, backs out.
+    view.update_in(cx, |v, window, cx| v.ext_ask_again(NOTES, window, cx));
+    click(cx, "ext-turn-off");
+    view.read_with(cx, |v, _| {
+        assert!(v.ext.overlay.is_none());
+        assert!(v.ext.notices.is_empty());
+    });
+    assert!(!config_text(cx).contains("extension = markdown-notes"));
+    cx.update(|window, _| window.refresh());
+    cx.run_until_parked();
+    assert!(
+        cx.debug_bounds("ext-notice").is_none(),
+        "gone from the status bar"
+    );
+}
diff --git a/crates/blyg-app/src/extensions/tour.rs b/crates/blyg-app/src/extensions/tour.rs
new file mode 100644
index 0000000..a0c0a83
--- /dev/null
+++ b/crates/blyg-app/src/extensions/tour.rs
@@ -0,0 +1,366 @@
+//! --- onboarding --- The tour's sample extensions. The bundled extensions
+//! are off until the config names them, so a tour that showed the user's
+//! own would show nothing on most Macs. While the tutorial runs, the
+//! window's host is *parked* (like its backend) and a second host runs the
+//! real bundled markdown-notes, reading-time and inspect over invented
+//! notes in `<data dir>/tour-sample/`: two folders allowed and one not yet (its
+//! chip in the warning colour), and the reading slots on the sample
+//! reading list. cross-post isn't run: a macro would load a real website.
+//!
+//! Nothing the tour does reaches the config file: Allow, Turn on, Turn off,
+//! Forget permissions and the notes folders' Add and Remove say what they
+//! would do and leave the file alone (`ext_tour_refuses`). The tour host's
+//! events have an inbox of their own: no consent question or notice from
+//! it outlives the tour. When the tour ends its host stops, its folder is
+//! deleted, and the user's host, library panel, reading slots and sheets
+//! come back as they were.
+
+use std::collections::{BTreeMap, VecDeque};
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+
+use blyg_ext::{BackendApi, Capability, ExtEvent, Grants, Host, HostConfig};
+use gpui_kit::*;
+
+use super::{Launch, Library, NOTES, Overlay, reading_slots};
+use crate::app::MainView;
+
+/// A sample folder: (setting key, folder name, notes as (file, text),
+/// allowed).
+type SampleVault = (
+    &'static str,
+    &'static str,
+    &'static [(&'static str, &'static str)],
+    bool,
+);
+
+/// The sample folders.
+const VAULTS: &[SampleVault] = &[
+    (
+        "vault",
+        "Notes",
+        &[
+            (
+                "Tide tables.md",
+                "# Tide tables\n\nHigh water at 6:12, low just after noon. The harbour gulls \
+                 know before the chart does.\n",
+            ),
+            (
+                "Harbour walk.md",
+                "---\ntags: [walks]\n---\n# Harbour walk\n\nThree boats in, two out. The fog \
+                 horn sounded twice, then gave up.\n",
+            ),
+            (
+                "Drafts/Fog.md",
+                "# Fog\n\nFog rolls in the way a good sentence does: slowly, then all at once.\n",
+            ),
+        ],
+        true,
+    ),
+    (
+        "vault-garden",
+        "Garden",
+        &[
+            (
+                "Seed list.md",
+                "# Seed list\n\n- runner beans\n- sweet peas\n- one stubborn artichoke\n",
+            ),
+            (
+                "Compost.md",
+                "# Compost\n\nTurn it on Sundays. Coffee grounds yes, citrus no.\n",
+            ),
+        ],
+        true,
+    ),
+    (
+        // (After Garden: labels sort, and the step says "Choose Garden".)
+        "vault-shelf",
+        "Shelf",
+        &[(
+            "Old letters.md",
+            "# Old letters\n\nA box of postcards from the lighthouse.\n",
+        )],
+        false,
+    ),
+];
+
+/// The sample's folder, in the app's data folder.
+const TOUR_DIR: &str = "tour-sample";
+
+/// What the tour set aside.
+struct Parked {
+    host: Option<Host>,
+    started: bool,
+    lib: Library,
+    slots: reading_slots::Slots,
+    overlay: Option<Overlay>,
+}
+
+/// The tour's extensions, while the tutorial runs (`Extensions::tour`).
+pub(crate) struct Tour {
+    /// The sample vaults, as Settings and the drawer list them.
+    pub vaults: Vec<blyg_ext_notes::VaultSpec>,
+    dir: PathBuf,
+    parked: Option<Parked>,
+    /// Reload Config came while the tour ran: reload when it ends.
+    reload: bool,
+    inbox: Arc<Mutex<VecDeque<ExtEvent>>>,
+}
+
+/// Write the sample folders under `root`; their settings and grants.
+fn write_vaults(root: &Path) -> std::io::Result<(BTreeMap<String, String>, Vec<Capability>)> {
+    let mut settings = BTreeMap::new();
+    let mut grants = vec![Capability::Ui];
+    for (key, folder, notes, allowed) in VAULTS {
+        let dir = root.join(folder);
+        for (name, body) in *notes {
+            let path = dir.join(name);
+            if let Some(parent) = path.parent() {
+                std::fs::create_dir_all(parent)?;
+            }
+            std::fs::write(path, body)?;
+        }
+        let text = dir.to_string_lossy().into_owned();
+        if *allowed {
+            grants.push(Capability::Fs(text.clone()));
+        }
+        settings.insert(key.to_string(), text);
+    }
+    Ok((settings, grants))
+}
+
+/// The tour host's configuration: markdown-notes on the sample folders,
+/// reading-time and inspect, all from the app's own executable.
+fn tour_config(launch: &Launch, root: &Path) -> std::io::Result<HostConfig> {
+    let (notes, notes_grants) = write_vaults(&root.join("vaults"))?;
+    let mut hc = HostConfig::new(root.join("data"), env!("CARGO_PKG_VERSION"));
+    let rt = blyg_ext_reading_time::NAME;
+    let inspect = blyg_ext_inspect::NAME;
+    hc.enabled = vec![NOTES.into(), rt.into(), inspect.into()];
+    let mut grants = Grants::default();
+    for c in notes_grants {
+        grants.grant(NOTES, c);
+    }
+    grants.grant(rt, Capability::ReadingRead);
+    grants.grant(inspect, Capability::ReadingRead);
+    hc.grants = grants;
+    hc.bundled = vec![
+        blyg_ext_notes::bundled(launch.program.clone(), launch.args.clone(), &notes),
+        blyg_ext_crosspost::bundled(launch.program.clone(), launch.crosspost_args.clone()),
+    ];
+    hc.bundled.extend(reading_slots::bundled(launch));
+    hc.settings.insert(NOTES.into(), notes);
+    hc.timing = launch.timing.clone();
+    Ok(hc)
+}
+
+impl MainView {
+    /// The tutorial is running on the sample extensions.
+    pub(crate) fn ext_tour_on(&self) -> bool {
+        self.ext.tour.is_some()
+    }
+
+    /// The tutorial starts: park the user's extensions and run the sample
+    /// ones. Without a launch (a test without one) the tour shows the
+    /// user's host as it is.
+    pub(crate) fn ext_tour_start(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if self.ext.tour.is_some() {
+            return;
+        }
+        // Tests run extensions only when they say how (a `Launch` global).
+        let launch = if cfg!(test) {
+            cx.try_global::<Launch>().cloned()
+        } else {
+            self.ext.launch.clone()
+        };
+        let Some(launch) = launch else {
+            return;
+        };
+        // In the app's data folder (one app per data folder), cleared first:
+        // a tour that never ended (the app quit during it) leaves nothing
+        // behind past the next one.
+        let dir = launch.data_dir.join(TOUR_DIR);
+        let _ = std::fs::remove_dir_all(&dir);
+        let hc = match tour_config(&launch, &dir) {
+            Ok(hc) => hc,
+            Err(e) => {
+                eprintln!("tour: couldn't write the sample notes: {e}");
+                let _ = std::fs::remove_dir_all(&dir);
+                return;
+            }
+        };
+        let vaults = blyg_ext_notes::vaults(hc.settings.get(NOTES).unwrap_or(&BTreeMap::new()));
+        let inbox: Arc<Mutex<VecDeque<ExtEvent>>> = Arc::default();
+        let (wake, woken) = async_channel::bounded::<()>(1);
+        let live = !cfg!(test);
+        let sink = inbox.clone();
+        let host = Host::new(
+            hc,
+            Arc::new(BackendApi::new(self.backend.clone())),
+            move |ev| {
+                sink.lock().unwrap_or_else(|p| p.into_inner()).push_back(ev);
+                if live {
+                    let _ = wake.try_send(());
+                }
+            },
+        );
+        self._tasks.push(cx.spawn_in(window, async move |this, cx| {
+            while woken.recv().await.is_ok() {
+                if this
+                    .update_in(cx, |v, window, cx| v.ext_tour_pump(window, cx))
+                    .is_err()
+                {
+                    break;
+                }
+            }
+        }));
+        let parked = Parked {
+            host: self.ext.host.replace(host.clone()),
+            started: std::mem::replace(&mut self.ext.started, true),
+            lib: std::mem::replace(&mut self.ext.lib, Library::for_tour()),
+            slots: std::mem::take(&mut self.ext.slots),
+            overlay: self.ext.overlay.take(),
+        };
+        self.ext.tour = Some(Tour {
+            vaults,
+            dir,
+            parked: Some(parked),
+            reload: false,
+            inbox,
+        });
+        host.start();
+        cx.notify();
+    }
+
+    /// The tutorial ends: stop the sample extensions, delete their folder,
+    /// and put the user's back.
+    pub(crate) fn ext_tour_end(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        // The tour's sheets go without a word (a question of the user's own
+        // waits in the queue and is asked below).
+        if let Some(Overlay::Consent { reply: Some(r), .. }) = self.ext.overlay.take() {
+            r.answer(false);
+        }
+        self.ext.slots.sheet = None;
+        let Some(mut tour) = self.ext.tour.take() else {
+            return;
+        };
+        let Some(p) = tour.parked.take() else {
+            return;
+        };
+        let sample = std::mem::replace(&mut self.ext.host, p.host);
+        self.ext.started = p.started;
+        self.ext.lib = p.lib;
+        self.ext.slots = p.slots;
+        self.ext.overlay = p.overlay;
+        let dir = tour.dir.clone();
+        cx.background_spawn(async move {
+            if let Some(h) = sample {
+                h.shutdown();
+            }
+            let _ = std::fs::remove_dir_all(dir);
+        })
+        .detach();
+        if tour.reload {
+            self.ext_reload(window, cx);
+        }
+        if self.ext.overlay.is_none() {
+            self.ext_next_ask(window, cx);
+        }
+        cx.notify();
+    }
+
+    /// Reload Config while the tour runs: the user's host reloads when it
+    /// ends. True when the tour took it.
+    pub(crate) fn ext_tour_defer_reload(&mut self) -> bool {
+        match self.ext.tour.as_mut() {
+            Some(t) => {
+                t.reload = true;
+                true
+            }
+            None => false,
+        }
+    }
+
+    /// In the tour: say what `what` would do, write nothing, and return
+    /// true. Outside it, false.
+    pub(crate) fn ext_tour_refuses(&mut self, what: String, cx: &mut Context<Self>) -> bool {
+        if self.ext.tour.is_none() {
+            return false;
+        }
+        self.show_toast(
+            what,
+            Some("Tour sample: your config file is unchanged".into()),
+            cx,
+        );
+        cx.notify();
+        true
+    }
+
+    /// Between the tour's steps: the palette, consent and Manage sheets and
+    /// a ⋯ sheet go, and the drawer goes back to its reading notes. A
+    /// question from the user's own host (shown from its notice meanwhile)
+    /// is answered no, as Not now would.
+    pub(crate) fn ext_tour_close_sheets(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if self.ext.overlay.is_some() {
+            self.ext_close(window, cx);
+        }
+        self.ext.slots.sheet = None;
+        self.ext.lib.tab = false;
+    }
+
+    /// The consent step's sheet: markdown-notes' first start, asking for
+    /// two folders and messages (answering it writes nothing).
+    pub(crate) fn ext_tour_consent(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        self.ext_show_consent(
+            super::Ask {
+                name: NOTES.into(),
+                caps: vec![
+                    Capability::Fs("~/Notes".into()),
+                    Capability::Fs("~/Garden".into()),
+                    Capability::Ui,
+                ],
+                reply: None,
+            },
+            window,
+            cx,
+        );
+    }
+
+    /// The tour host's events. Only what draws the sample (started,
+    /// stopped, toasts, a note to open) is handled; a question it asks is
+    /// answered no and leaves no notice behind.
+    pub(crate) fn ext_tour_pump(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        loop {
+            let ev = match self.ext.tour.as_ref() {
+                Some(t) => t
+                    .inbox
+                    .lock()
+                    .unwrap_or_else(|p| p.into_inner())
+                    .pop_front(),
+                None => None,
+            };
+            let Some(ev) = ev else {
+                break;
+            };
+            match ev {
+                ExtEvent::Started { name, .. } => {
+                    self.ext.slots.forget(&name);
+                    self.ext_lib_refresh(window, cx);
+                }
+                ExtEvent::Toast { .. } | ExtEvent::OpenItem { .. } => {
+                    self.ext_event(ev, window, cx)
+                }
+                ExtEvent::CapabilityRequested { reply, .. } => reply.answer(false),
+                ExtEvent::BrowserPage { reply, .. } => reply.answer(None),
+                ExtEvent::BrowserOpen { reply, .. } => {
+                    reply.answer(Err("not during the tour".into()))
+                }
+                ExtEvent::Failed { name, message, .. } => {
+                    eprintln!("tour: {name}: {message}");
+                }
+                ExtEvent::Stopped { .. } | ExtEvent::NeedsConsent { .. } => {}
+            }
+            cx.notify();
+        }
+    }
+}
diff --git a/crates/blyg-app/src/fake.rs b/crates/blyg-app/src/fake.rs
index d4eada2..e90ffb9 100644
--- a/crates/blyg-app/src/fake.rs
+++ b/crates/blyg-app/src/fake.rs
@@ -1273,6 +1273,19 @@ impl Backend for FakeBackend {
         let p = fake_preview(url)?;
         let sub = {
             let mut st = self.lock();
+            // One subscription per source, as the studio refuses a second.
+            let feed = p.feed_url.clone().unwrap_or_else(|| url.to_string());
+            // A feed under a blyg's origin resolves to that blyg.
+            let origin = p.origin.clone().unwrap_or_default();
+            if let Some(s) = st.rd.subs.iter().find(|s| {
+                s.feed_url == feed || (s.kind == SubscriptionKind::Blyg && s.origin == origin)
+            }) {
+                return Err(CoreError::Rejected {
+                    status: 409,
+                    message: format!("already subscribed to {}", s.title),
+                    details: vec![],
+                });
+            }
             st.next_id += 1;
             let sub = Subscription {
                 id: format!("sub-{}", st.next_id),
diff --git a/crates/blyg-app/src/keymap.rs b/crates/blyg-app/src/keymap.rs
index 58bb6de..43f1e13 100644
--- a/crates/blyg-app/src/keymap.rs
+++ b/crates/blyg-app/src/keymap.rs
@@ -41,6 +41,8 @@ use crate::app::reading::{
 use crate::app::reading::stream::{ReaderMode, StreamMode};
 // --- reader folders ---
 use crate::app::reading::sources::{CheckFeeds, NewFolder, ToggleSources};
+// --- OPML ---
+use crate::app::reading::opml::{ExportOpml, ImportOpml};
 
 // --- profiles ---
 use crate::app::profiles::{MyProfile, OpenProfile, ShowProfile};
@@ -482,6 +484,17 @@ pub fn mac_table() -> Vec<Keybind> {
             "Subscribe to a blyg or feed",
             "Blyg › Subscribe…"
         ),
+        // --- OPML --- (no key: an occasional chore)
+        menu_only!(
+            ImportOpml,
+            "Import subscriptions from another reader's OPML file",
+            "Blyg › Import Subscriptions from OPML…"
+        ),
+        menu_only!(
+            ExportOpml,
+            "Save every subscription as an OPML file",
+            "Blyg › Export Subscriptions as OPML…"
+        ),
         menu_only!(
             SiteSettings,
             "The blyg's site settings (title, bio, links)",
@@ -959,6 +972,7 @@ pub fn bind_keys(cx: &mut App) {
     cx.bind_keys(out);
     // Menu-only actions have no keys; keep the compiler honest that they exist.
     let _ = (Disconnect, OpenConfigFile, SiteSettings, SubscribeTo);
+    let _ = (ImportOpml, ExportOpml); // --- OPML ---
     let _ = ShowTutorial; // --- onboarding ---
     let _ = MyProfile; // --- profiles ---
     let _ = Withdraw; // --- delete & withdraw ---
diff --git a/crates/blyg-app/src/main.rs b/crates/blyg-app/src/main.rs
index c454c1a..fda2e5c 100644
--- a/crates/blyg-app/src/main.rs
+++ b/crates/blyg-app/src/main.rs
@@ -415,6 +415,15 @@ fn menus(spellcheck: bool) -> Vec<Menu> {
                 MenuItem::action("Subscriptions", app::reading::ShowSubscriptions),
                 MenuItem::separator(),
                 MenuItem::action("Subscribe…", app::reading::SubscribeTo),
+                // --- OPML ---
+                MenuItem::action(
+                    "Import Subscriptions from OPML…",
+                    app::reading::opml::ImportOpml,
+                ),
+                MenuItem::action(
+                    "Export Subscriptions as OPML…",
+                    app::reading::opml::ExportOpml,
+                ),
                 MenuItem::action("Site Settings…", app::reading::SiteSettings),
                 // --- profiles ---
                 MenuItem::separator(),
diff --git a/crates/blyg-app/src/onboarding/mod.rs b/crates/blyg-app/src/onboarding/mod.rs
index fc1c629..865ab15 100644
--- a/crates/blyg-app/src/onboarding/mod.rs
+++ b/crates/blyg-app/src/onboarding/mod.rs
@@ -33,6 +33,7 @@ use crate::ai::settings as ais;
 use crate::fake::FakeBackend;
 use crate::theme::Rule; // --- themes --- dividers
 
+pub(crate) use steps::Key;
 pub use tutorial::Tutorial;
 
 gpui_kit::actions!(
@@ -169,7 +170,8 @@ impl MainView {
             let onboarded = state.onboarded;
             // The first launch of a newer version: what changed, then the
             // tour (or not). A first run learns it all from the tour.
-            let current = env!("CARGO_PKG_VERSION");
+            let current = whats_new::running_version();
+            let current = current.as_str();
             let news = if state.seen_version.as_deref() == Some(current) {
                 vec![]
             } else {
@@ -1023,10 +1025,18 @@ impl MainView {
             ("ob-ai", 0) => self.open_onboarding(FlowStep::Ai, window, cx),
             ("ob-buttons", 0) => self.open_onboarding(FlowStep::Buttons, window, cx),
             ("ob-tour", 0) => self.open_onboarding(FlowStep::Tutorial, window, cx),
-            // The first launch after an update.
-            ("ob-news", 0) => {
-                self.start_whats_new(whats_new::RELEASES.iter().collect(), window, cx)
+            // The first launch after an update: every release, or with
+            // `BLYGGER_DEMO_FROM=<version>` what a launch updated from it
+            // shows (up to `whats_new::running_version`).
+            // `ob-news-go`: then "Show me what's new".
+            ("ob-news" | "ob-news-go", 0) => {
+                let news = match std::env::var("BLYGGER_DEMO_FROM") {
+                    Ok(from) => whats_new::since(Some(&from), &whats_new::running_version()),
+                    Err(_) => whats_new::RELEASES.iter().collect(),
+                };
+                self.start_whats_new(news, window, cx)
             }
+            ("ob-news-go", 1) => self.tutorial_next(window, cx),
             // `tut-<id>`: the step as it begins; `tut-<id>+`: after its key.
             (s, 0) if s.starts_with("tut-") => {
                 self.start_tutorial(window, cx);
diff --git a/crates/blyg-app/src/onboarding/steps.rs b/crates/blyg-app/src/onboarding/steps.rs
index 5b7eff5..80811cd 100644
--- a/crates/blyg-app/src/onboarding/steps.rs
+++ b/crates/blyg-app/src/onboarding/steps.rs
@@ -47,6 +47,25 @@ pub enum Key {
     Lineage,
     /// Its ring of actions is open (Space on the centre).
     LineageRing,
+    /// ⌘N (New Post): an empty editor.
+    NewPost,
+    /// ✂ Clip or ⇧⌘C in the browser pane.
+    Clip,
+    /// The ⇧⌘P Extensions palette is open.
+    ExtPalette,
+    /// The Manage extensions sheet is open.
+    ExtManage,
+    /// The consent sheet was answered (⏎, esc or ⌘⌫).
+    ConsentAnswered,
+    /// A reading entry's ⋯ sheet is open.
+    SlotSheet,
+    /// The notes drawer's Notes tab shows a folder other than the first.
+    NotesVault,
+    /// The browser pane was folded while a macro runs.
+    MacroFolded,
+    /// Import OPML… (the Subscriptions screen's chip, or Blyg › Import
+    /// Subscriptions from OPML…).
+    OpmlImport,
 }
 
 /// The part of the window a step highlights.
@@ -71,6 +90,13 @@ pub enum Region {
     BrowserChrome,
     /// A sheet dropping from the title bar.
     Sheet,
+    /// The notes drawer, at the window's right edge.
+    NotesDrawer,
+    /// A macro's run: the browser pane's toolbar while it's open, the
+    /// status bar once it's folded.
+    MacroRun,
+    /// A reading screen's header (Subscriptions: its chips).
+    ScreenHeader,
     /// The whole window (no ring).
     Whole,
 }
@@ -117,12 +143,29 @@ pub enum Setup {
     Reader,
     /// The browser pane on a blank sample page (nothing is loaded).
     Browser,
+    /// The notes drawer on its Notes tab, showing the tour's first sample
+    /// folder of Markdown notes.
+    NotesLibrary,
+    /// The browser pane on its sample page, with a sample macro "running"
+    /// in it (nothing runs).
+    CrossPost,
+    /// The ⇧⌘P Extensions palette, open.
+    Palette,
+    /// A sample consent sheet for markdown-notes (answering it writes
+    /// nothing).
+    Consent,
+    /// The Subscriptions screen (⇧⌘S).
+    Subscriptions,
 }
 
 /// One step of the tour.
 #[derive(Debug, Clone, Copy)]
 pub struct Step {
     pub id: &'static str,
+    /// The release whose feature this step was added to teach. A what's-new
+    /// entry starts at the first step of its own release (`whats_new`'s
+    /// tests check it), so a release with something new adds a step for it.
+    pub since: &'static str,
     pub title: &'static str,
     /// One or two short sentences. `{hotkey}` becomes the quick-capture key.
     pub caption: &'static str,
@@ -162,6 +205,7 @@ pub const QUOTED: &str = crate::fake::reading_seed::LIN_BENCH;
 pub const STEPS: &[Step] = &[
     Step {
         id: "search",
+        since: "0.1.0",
         title: "Search is the interface",
         caption: "Type to filter every post as you go. ↑ and ↓ move the selection, and the \
                   editor previews each post as you pass it.",
@@ -176,20 +220,39 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "create",
+        since: "0.1.0",
         title: "No match? ⏎ starts writing",
         caption: "Nothing matches “tide pools”, so ⏎ creates a new draft seeded with it, \
                   with the caret at the end.",
         keys: &[Key::Enter],
         key_label: "⏎",
         region: Region::Omnibar,
-        button: Some("New"),
+        // (The toolbar's New is ⌘N, the next step.)
+        button: None,
         setup: Setup::Query("tide pools"),
         pause_ms: 500,
         settle: false,
         stay: false,
     },
+    Step {
+        id: "new",
+        since: "0.10.0",
+        title: "⌘N: a blank page",
+        caption: "⌘N opens an empty editor and leaves your search as it was. What you type is \
+                  a scratch note, kept on this Mac until ⌘D makes it a draft (⌘⏎ publishes \
+                  it). Leave without typing and nothing is kept.",
+        keys: &[Key::NewPost],
+        key_label: "⌘N",
+        region: Region::Editor,
+        button: Some("New"),
+        setup: Setup::Search,
+        pause_ms: 1400,
+        settle: false,
+        stay: true,
+    },
     Step {
         id: "autosave",
+        since: "0.1.0",
         title: "Just write",
         caption: "Every keystroke is saved on this Mac and pushed to your blyg a moment after \
                   you stop. There's no save button. Type a few words.",
@@ -204,6 +267,7 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "kinds",
+        since: "0.1.0",
         title: "Fragments and threads",
         caption: "A fragment is short: 1000 characters at most, counted down here. A thread \
                   has no limit and can quote other posts. ⌘T switches between them.",
@@ -218,6 +282,7 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "capture",
+        since: "0.1.0",
         title: "Quick capture keeps scratch notes",
         caption: "{hotkey} opens quick capture over any app. What you jot down stays on this \
                   Mac as a scratch note, listed here with its scratch pill and never synced. \
@@ -235,6 +300,7 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "publish",
+        since: "0.1.0",
         title: "⌘⏎ publishes",
         caption: "Publishing asks for an optional version note first. This is sample data, so \
                   nothing leaves your Mac.",
@@ -249,6 +315,7 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "publish-note",
+        since: "0.1.0",
         title: "Say what changed",
         caption: "Type a note such as “first version” (or leave it empty) and press ⏎. \
                   esc would cancel.",
@@ -263,6 +330,7 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "full-editor",
+        since: "0.1.0",
         title: "The full editor",
         caption: "⌘2 adds a live preview beside the list; ⌘3 is the full editor: the source \
                   and the page exactly as it will be published.",
@@ -277,6 +345,7 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "write-view",
+        since: "0.1.0",
         title: "Back to writing",
         caption: "⌘1 brings back the plain list and editor.",
         keys: &[Key::ViewWrite],
@@ -290,6 +359,7 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "tk",
+        since: "0.1.0",
         title: "Fill a gap with AI",
         caption: "Write [TK]an instruction[/TK] and press ⌘G with the caret inside: the gap is \
                   filled, tinted as generated, and disclosed when published. (A canned demo: \
@@ -305,6 +375,7 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "shorten",
+        since: "0.1.0",
         title: "Too long? Shorten to fit",
         caption: "This fragment is over 1000. ⇧⌘G proposes a shorter version; you accept or \
                   reject it. (Canned, too.)",
@@ -321,6 +392,7 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "versions",
+        since: "0.1.0",
         title: "Versions and pins",
         caption: "⌘Y shows every version of your post here, to compare or restore one. Pinning \
                   a version serves it forever: a pin can't be undone.",
@@ -335,6 +407,7 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "quotes",
+        since: "0.1.0",
         title: "Quotes",
         caption: "In a thread, ⌘K (or typing ![[ on a new line) quotes a post you already \
                   hold. The quote is a snapshot, taken when you publish.",
@@ -349,6 +422,7 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "mentions",
+        since: "0.4.0",
         title: "Mentions and spelling",
         caption: "Type @ and a name to link a blyg you know (↑ ↓ choose, ⏎ inserts). It's a \
                   plain link, so it notifies no one. A red underline marks a misspelling: \
@@ -364,6 +438,7 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "stream",
+        since: "0.4.0",
         title: "Reading, in the Stream",
         caption: "⌘R opens Reading: posts from the blygs you follow, newest first by their own \
                   date. j/k move, and a post a second on screen counts as read. ⏎, Space, a \
@@ -377,8 +452,26 @@ pub const STEPS: &[Step] = &[
         settle: false,
         stay: true,
     },
+    Step {
+        id: "slots",
+        since: "0.11.0",
+        title: "Reading time, and what's behind a post",
+        caption: "Two bundled extensions, off until you turn them on: reading-time ends a \
+                  post's byline with “· 3 min”, and inspect adds ⋯ to its actions, with the \
+                  record Burrow holds for it (ids, versions, references). Click ⋯, then \
+                  inspect.",
+        keys: &[Key::SlotSheet],
+        key_label: "click",
+        region: Region::StreamPost,
+        button: None,
+        setup: Setup::Stream,
+        pause_ms: 1800,
+        settle: false,
+        stay: true,
+    },
     Step {
         id: "original",
+        since: "0.4.0",
         title: "Quotes lead to the original",
         caption: "The grey box quotes another post: click its text to open the original beside \
                   it, or the name for the author's profile. Its pane lists who quoted, stubbed \
@@ -394,11 +487,12 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "lineage",
+        since: "0.8.0",
         title: "Lineage: where a post comes from",
-        caption: "The glyph beside a post's name shows which kinds of post it draws on (left) \
-                  and which draw on it (right): fork, reply, quote, never how many. ⌘J, or a \
-                  click on it, opens the map: arrows move, ⏎ makes a neighbour the centre, \
-                  ⌫ walks back.",
+        caption: "The glyph beside a post's name shows the kinds of post it draws on (left) \
+                  and that draw on it (right): fork, reply, quote. “1 · 2” beside it counts \
+                  them: up · down. ⌘J, or a click on it, opens the map, with the counts by the \
+                  post: arrows move, ⏎ makes a neighbour the centre, ⌫ walks back.",
         keys: &[Key::Lineage],
         key_label: "⌘J",
         region: Region::StreamPost,
@@ -410,11 +504,12 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "ring",
+        since: "0.8.0",
         title: "Actions on a ring",
         caption: "With the post in the middle selected, Space opens its actions in fixed \
-                  places: F fork, R reply, Q quote, L link post, V versions, O open. A letter \
-                  previews what it would make; ⏎ does it, esc backs out. (Sample data: \
-                  nothing is sent.)",
+                  places: F fork, R reply, Q quote, L link post, V versions, O open; “R · 2” \
+                  says two replies are known already. A letter previews what it would make; ⏎ \
+                  does it, esc backs out. (Sample data: nothing is sent.)",
         keys: &[Key::LineageRing],
         key_label: "Space",
         region: Region::Whole,
@@ -426,6 +521,7 @@ pub const STEPS: &[Step] = &[
     },
     Step {
         id: "reader",
+        since: "0.4.0",
         title: "Reader: sources, posts, post",
         caption: "⌥⌘2 switches to Reader. On the left: smart feeds (All unread, Today, Thumbed, \
                   All), your folders, which stay on this Mac, and subscriptions. [ and ] step \
@@ -439,13 +535,31 @@ pub const STEPS: &[Step] = &[
         settle: false,
         stay: true,
     },
+    Step {
+        id: "opml",
+        since: "0.11.0",
+        title: "Moving from another reader?",
+        caption: "Import OPML… (here on Subscriptions, ⇧⌘S, or Blyg › Import Subscriptions \
+                  from OPML…) reads its export: Burrow lists the feeds, ticks the new ones, and \
+                  files them in an Imported feeds folder in the Reader, out of your public \
+                  blogroll. Export OPML… saves yours. Try the sample file.",
+        keys: &[Key::OpmlImport],
+        key_label: "click",
+        region: Region::ScreenHeader,
+        button: None,
+        setup: Setup::Subscriptions,
+        pause_ms: 1600,
+        settle: false,
+        stay: true,
+    },
     Step {
         id: "notes",
+        since: "0.4.0",
         title: "Notes while you read",
-        caption: "⇧⌘N slides in the Notes drawer: running notes, kept on this Mac as a scratch \
-                  note. → Notes, at the bottom of a post, adds the post to them. Select a \
-                  passage in a post with the mouse: ⇧⌘D, or the pill beside it, quotes it in \
-                  your draft.",
+        caption: "⇧⌘N slides in the Notes drawer. Reading notes are running notes, kept on \
+                  this Mac as a scratch note; → Notes, at the bottom of a post, adds the post \
+                  to them. Select a passage in a post: ⇧⌘D, or the pill beside it, quotes it \
+                  in your draft. The drawer's Notes tab is next.",
         keys: &[Key::Notes],
         key_label: "⇧⌘N",
         region: Region::ReaderPost,
@@ -455,12 +569,31 @@ pub const STEPS: &[Step] = &[
         settle: false,
         stay: true,
     },
+    Step {
+        id: "notes-library",
+        since: "0.11.0",
+        title: "Your Markdown notes, in the drawer",
+        caption: "With markdown-notes on, the Notes tab opens folders of Markdown notes \
+                  (Obsidian vaults, say): a chip per folder, Add folder… for more, and Remove \
+                  from Burrow, which leaves the folder alone. Open a note to edit it or quote it \
+                  into your post. Choose Garden.",
+        keys: &[Key::NotesVault],
+        key_label: "click",
+        region: Region::NotesDrawer,
+        button: None,
+        setup: Setup::NotesLibrary,
+        pause_ms: 2200,
+        settle: false,
+        stay: true,
+    },
     Step {
         id: "browser",
+        since: "0.4.0",
         title: "Links open beside your reading",
-        caption: "A link in a post opens in this pane (a blank sample here). 🛡 turns ad and \
-                  tracker blocking off for one site; ↗, or ⌥-click on the link, uses your \
-                  default browser. esc closes it; ⇧⌘B brings it back.",
+        caption: "A link in a post opens in this pane (a blank sample here); ⌘-click opens it \
+                  over the whole area. 🛡 turns ad and tracker blocking off for one site; ↗, or \
+                  ⌥-click on the link, uses your default browser. esc closes it; ⇧⌘B brings it \
+                  back.",
         keys: &[Key::CloseBrowser],
         key_label: "esc",
         region: Region::BrowserChrome,
@@ -470,8 +603,89 @@ pub const STEPS: &[Step] = &[
         settle: false,
         stay: false,
     },
+    Step {
+        id: "clip",
+        since: "0.10.0",
+        title: "✂ Clip a page into your draft",
+        caption: "⇧⌘C, or ✂ Clip in the pane's bar, quotes the page (or the passage you \
+                  selected on it) in your draft, with its title and link. Clip the sample.",
+        keys: &[Key::Clip],
+        key_label: "⇧⌘C",
+        region: Region::BrowserChrome,
+        button: None,
+        setup: Setup::Browser,
+        pause_ms: 1600,
+        settle: false,
+        stay: true,
+    },
+    Step {
+        id: "cross-post",
+        since: "0.11.0",
+        title: "cross-post runs beside you",
+        caption: "The bundled cross-post (off until you turn it on) puts a published post on \
+                  Substack Notes from this pane: you check the text, it fills in the note, and \
+                  only you click Post. esc folds the pane mid-run: the status bar says “macro \
+                  running · show pane”. (A sample: nothing runs.)",
+        keys: &[Key::MacroFolded],
+        key_label: "esc",
+        region: Region::MacroRun,
+        button: None,
+        setup: Setup::CrossPost,
+        pause_ms: 1600,
+        settle: false,
+        stay: true,
+    },
+    Step {
+        id: "extensions",
+        since: "0.10.0",
+        title: "Extensions: ⇧⌘P",
+        caption: "⇧⌘P lists what your extensions offer here: their commands, Browse for each \
+                  notes folder, and Manage extensions…. Burrow asks before one may do anything, \
+                  and none can publish or see your sign-in.",
+        keys: &[Key::ExtPalette],
+        key_label: "⇧⌘P",
+        region: Region::Whole,
+        button: None,
+        setup: Setup::Posts,
+        pause_ms: 1600,
+        settle: false,
+        stay: true,
+    },
+    Step {
+        id: "manage",
+        since: "0.11.0",
+        title: "Turn off, or forget",
+        caption: "Choose Manage extensions…: what's installed, on and allowed. Turn off stops \
+                  one and keeps its permissions for next time; Forget permissions drops them \
+                  too, so it asks again. (The tour changes nothing in your config file.)",
+        keys: &[Key::ExtManage],
+        key_label: "click",
+        region: Region::Whole,
+        button: None,
+        setup: Setup::Palette,
+        pause_ms: 1600,
+        settle: false,
+        stay: true,
+    },
+    Step {
+        id: "consent",
+        since: "0.11.0",
+        title: "Burrow asks first",
+        caption: "The first time an extension starts, Burrow lists what it wants. ⏎ allows \
+                  what's ticked (1–9 untick), esc is Not now, and ⌘⌫ turns it off. Try ⌘⌫. \
+                  (A sample: nothing is saved.)",
+        keys: &[Key::ConsentAnswered],
+        key_label: "⌘⌫",
+        region: Region::Whole,
+        button: None,
+        setup: Setup::Consent,
+        pause_ms: 1200,
+        settle: false,
+        stay: false,
+    },
     Step {
         id: "done",
+        since: "0.1.0",
         title: "That's the tour",
         caption: "Everything you did here was on sample data. Your own posts come back when you \
                   finish. Settings (⌘,) › Help replays this tour.",
@@ -529,8 +743,30 @@ mod tests {
             Key::ReaderMode,
             Key::Notes,
             Key::CloseBrowser,
+            Key::NewPost,
+            Key::Clip,
+            Key::ExtPalette,
+            Key::ExtManage,
+            Key::ConsentAnswered,
+            Key::SlotSheet,
+            Key::NotesVault,
+            Key::MacroFolded,
+            Key::OpmlImport,
         ] {
             assert!(STEPS.iter().any(|s| s.accepts(k)), "{k:?} isn't taught");
         }
     }
+
+    #[test]
+    fn every_step_says_which_release_it_teaches() {
+        for s in STEPS {
+            let v: Vec<_> = s.since.split('.').collect();
+            assert!(
+                v.len() == 3 && v.iter().all(|n| n.parse::<u32>().is_ok()),
+                "{}: since = {:?}",
+                s.id,
+                s.since
+            );
+        }
+    }
 }
diff --git a/crates/blyg-app/src/onboarding/tests.rs b/crates/blyg-app/src/onboarding/tests.rs
index 90dc1f1..7dec482 100644
--- a/crates/blyg-app/src/onboarding/tests.rs
+++ b/crates/blyg-app/src/onboarding/tests.rs
@@ -236,16 +236,44 @@ fn setup_mode<'a>(
     config: &str,
     onboarded: bool,
     mode: Mode,
+) -> Env<'a> {
+    // This version already seen: no what's-new card.
+    let seen = onboarded.then_some(env!("CARGO_PKG_VERSION"));
+    setup_full(cx, config, seen, mode, false)
+}
+
+/// The tour with its sample extensions running (the bundled ones, as this
+/// test binary's children; see `extensions::test_launch`).
+fn setup_ext<'a>(cx: &'a mut TestAppContext) -> Env<'a> {
+    setup_full(
+        cx,
+        CONNECTED,
+        Some(env!("CARGO_PKG_VERSION")),
+        Mode::Fake,
+        true,
+    )
+}
+
+/// `seen`: onboarded, having last launched that version.
+fn setup_full<'a>(
+    cx: &'a mut TestAppContext,
+    config: &str,
+    seen: Option<&str>,
+    mode: Mode,
+    extensions: bool,
 ) -> Env<'a> {
     let dir = tempfile::tempdir().unwrap();
-    if onboarded {
+    if let Some(seen) = seen {
         state::AppState::update(dir.path(), |s| {
             s.onboarded = true;
-            // This version already seen: no what's-new card.
-            s.seen_version = Some(env!("CARGO_PKG_VERSION").into());
+            s.seen_version = Some(seen.into());
         })
         .unwrap();
     }
+    if extensions {
+        let launch = crate::app::extensions::test_launch(dir.path().join("ext-data"));
+        cx.update(|cx| cx.set_global(launch));
+    }
     let real = Recording::new();
     let switch = SwitchBackend::new(real.clone(), mode);
     let config = config.to_string();
@@ -313,6 +341,57 @@ fn real_is_back(e: &Env) -> bool {
     std::ptr::addr_eq(Arc::as_ptr(&cur), Arc::as_ptr(&e.real))
 }
 
+/// Run the window until `done`: the tour's extensions answer from other
+/// processes, in real time.
+fn wait(e: &mut Env, what: &str, mut done: impl FnMut(&mut Env) -> bool) {
+    let t = std::time::Instant::now();
+    loop {
+        e.cx.run_until_parked();
+        e.view
+            .update_in(e.cx, |v, window, cx| v.ext_pump(window, cx));
+        e.cx.update(|window, _| window.refresh());
+        e.cx.run_until_parked();
+        if done(e) {
+            return;
+        }
+        assert!(
+            t.elapsed() < Duration::from_secs(30),
+            "timed out waiting for {what}"
+        );
+        std::thread::sleep(Duration::from_millis(15));
+    }
+}
+
+/// The tour's sample extensions are up: both notes folders listed and the
+/// reading slots running.
+fn tour_extensions_ready(e: &mut Env) {
+    wait(e, "the tour's sample extensions", |e| {
+        e.view.read_with(e.cx, |v, _| {
+            let slots = v
+                .ext
+                .host
+                .as_ref()
+                .map(|h| h.entry_slots().len())
+                .unwrap_or(0);
+            v.ext_tour_on() && v.ext_libraries().len() >= 2 && slots >= 2
+        })
+    });
+}
+
+fn in_reader(e: &mut Env) -> bool {
+    e.view.read_with(e.cx, |v, _| {
+        v.reading.mode == crate::app::reading::stream_vm::ReadMode::Reader && v.reading.sources_open
+    })
+}
+
+fn drawn(e: &mut Env, sel: &'static str) -> bool {
+    e.cx.debug_bounds(sel).is_some()
+}
+
+fn wait_drawn(e: &mut Env, step: &str, sel: &'static str) {
+    wait(e, &format!("{step}: {sel} on screen"), |e| drawn(e, sel));
+}
+
 #[gpui_kit::test]
 fn first_launch_without_a_blyg_shows_onboarding(cx: &mut TestAppContext) {
     let mut e = setup(cx, "# fresh\n", false);
@@ -441,19 +520,30 @@ fn tutorial_steps_advance_on_their_key_only(cx: &mut TestAppContext) {
     settle(&mut e);
     assert_eq!(tour_step(&mut e), Some("create"));
     e.cx.simulate_keystrokes("enter");
-    settle(&mut e);
-    assert_eq!(tour_step(&mut e), Some("autosave"));
+    e.cx.run_until_parked();
     let (cur, fake) = e
         .view
         .read_with(e.cx, |v, _| (v.current.clone(), v.fake.clone()));
     assert!(cur.unwrap().content_md.starts_with("tide pools"));
+    settle(&mut e);
+    assert_eq!(tour_step(&mut e), Some("new"));
+
+    // ⌘N opens the empty editor; the step stays for a look, then Next.
+    e.cx.simulate_keystrokes(&crate::keymap::keys("cmd-n"));
+    settle(&mut e);
+    assert!(tour_done(&mut e));
+    assert_eq!(tour_step(&mut e), Some("new"), "it stays");
+    e.cx.simulate_keystrokes(&crate::keymap::keys("alt-cmd-right"));
+    settle(&mut e);
+    assert_eq!(tour_step(&mut e), Some("autosave"));
 
     // Typing advances "Just write"; ↓ doesn't.
     e.cx.simulate_keystrokes(&crate::keymap::keys("cmd-l down"));
     settle(&mut e);
     assert_eq!(tour_step(&mut e), Some("autosave"));
+    let autosave = STEPS.iter().position(|s| s.id == "autosave").unwrap();
     e.view.update_in(e.cx, |v, window, cx| {
-        v.tutorial_enter(2, window, cx);
+        v.tutorial_enter(autosave, window, cx);
     });
     e.cx.simulate_input(" at low tide");
     settle(&mut e);
@@ -563,6 +653,44 @@ fn do_step(e: &mut Env, id: &str) {
             e.cx.simulate_keystrokes(&crate::keymap::keys("cmd-shift-n"))
         }
         "browser" => e.cx.simulate_keystrokes("escape"),
+        "new" => e.cx.simulate_keystrokes(&crate::keymap::keys("cmd-n")),
+        // A click on Import OPML… (the chip's own call).
+        "opml" => e
+            .view
+            .update_in(e.cx, |v, window, cx| v.opml_pick(window, cx)),
+        // A click on ⋯ (the chip's own call).
+        "slots" => e.view.update_in(e.cx, |v, window, cx| {
+            let item = v
+                .reading
+                .sel
+                .as_ref()
+                .and_then(|k| {
+                    v.reading
+                        .rows
+                        .iter()
+                        .find(|r| r.subscription_id == k.0 && r.remote_id == k.1)
+                })
+                .cloned()
+                .expect("a post is selected");
+            v.slots_open(item, window, cx)
+        }),
+        // A click on the second folder's chip.
+        "notes-library" => e.view.update_in(e.cx, |v, window, cx| {
+            let second = v.ext_libraries().into_iter().nth(1).expect("two folders");
+            v.ext_lib_choose(Some(second.library.id), window, cx)
+        }),
+        "clip" => {
+            e.cx.simulate_keystrokes(&crate::keymap::keys("cmd-shift-c"))
+        }
+        "cross-post" => e.cx.simulate_keystrokes("escape"),
+        "extensions" => {
+            e.cx.simulate_keystrokes(&crate::keymap::keys("cmd-shift-p"))
+        }
+        // Manage extensions… is the palette's last row.
+        "manage" => e.cx.simulate_keystrokes("up enter"),
+        "consent" => {
+            e.cx.simulate_keystrokes(&crate::keymap::keys("cmd-backspace"))
+        }
         other => panic!("no way to do step {other}"),
     }
     e.cx.run_until_parked();
@@ -570,9 +698,10 @@ fn do_step(e: &mut Env, id: &str) {
 
 #[gpui_kit::test]
 fn every_step_advances_on_its_own_key(cx: &mut TestAppContext) {
-    let mut e = setup(cx, CONNECTED, true);
+    let mut e = setup_ext(cx);
     e.cx.dispatch_action(super::ShowTutorial);
     e.cx.run_until_parked();
+    tour_extensions_ready(&mut e);
     e.real.take();
     for (i, step) in STEPS.iter().enumerate() {
         if step.keys.is_empty() {
@@ -605,9 +734,10 @@ fn every_step_advances_on_its_own_key(cx: &mut TestAppContext) {
 
 #[gpui_kit::test]
 fn every_step_rings_something_on_screen(cx: &mut TestAppContext) {
-    let mut e = setup(cx, CONNECTED, true);
+    let mut e = setup_ext(cx);
     e.cx.dispatch_action(super::ShowTutorial);
     e.cx.run_until_parked();
+    tour_extensions_ready(&mut e);
     let (vw, vh) = e.cx.update(|window, _| {
         let s = window.viewport_size();
         (f32::from(s.width), f32::from(s.height))
@@ -630,12 +760,20 @@ fn every_step_rings_something_on_screen(cx: &mut TestAppContext) {
         );
         // What the caption points at is inside the ring.
         let inside: &[&str] = match step.region {
-            Region::Reader => &["mode-stream", "mode-reader"],
+            // The toggle in the Stream; in Reader mode, the sources pane.
+            Region::Reader if !in_reader(&mut e) => &["mode-stream", "mode-reader"],
             Region::StreamPost => &["stream-actions"],
             Region::ReaderPost => &["responses"],
-            Region::BrowserChrome => &["browser-shield", "browser-close"],
+            Region::BrowserChrome => &["browser-shield", "browser-clip", "browser-close"],
+            Region::MacroRun => &["browser-macro-stop", "browser-close"],
+            Region::ScreenHeader => &["opml-import-chip"],
+            Region::NotesDrawer => &["notes-tab-library", "lib-vault-0", "lib-vault-add"],
             _ => &[],
         };
+        // The drawer's folders come from the extension: wait for them.
+        if step.region == Region::NotesDrawer {
+            wait_drawn(&mut e, step.id, "lib-vault-1");
+        }
         for sel in inside {
             let b =
                 e.cx.debug_bounds(sel)
@@ -644,7 +782,7 @@ fn every_step_rings_something_on_screen(cx: &mut TestAppContext) {
             let (bx1, by1) = (f32::from(b.right()), f32::from(b.bottom()));
             // The browser pane may still be sliding in from the right (the
             // ring is where it lands): only its left and vertical edges.
-            let sliding = step.region == Region::BrowserChrome;
+            let sliding = matches!(step.region, Region::BrowserChrome | Region::MacroRun);
             assert!(
                 bx >= x - 1. && by >= y - 1. && (sliding || bx1 <= x + w + 1.) && by1 <= y + h + 1.,
                 "{}: {sel} ({bx}, {by})–({bx1}, {by1}) is outside the ring ({x}, {y}, {w}, {h})",
@@ -963,3 +1101,190 @@ fn an_update_remembers_the_version_once_seen(cx: &mut TestAppContext) {
         Some(env!("CARGO_PKG_VERSION"))
     );
 }
+
+// --- 0.10.0 and 0.11.0 --- the steps that teach them, on the real UI.
+
+/// Each new step lands on its feature: what its caption names is drawn in
+/// the state the step sets up, and after its key.
+#[gpui_kit::test]
+fn the_new_steps_show_their_features(cx: &mut TestAppContext) {
+    let mut e = setup_ext(cx);
+    let before = config_text(e.cx);
+    e.cx.dispatch_action(super::ShowTutorial);
+    e.cx.run_until_parked();
+    tour_extensions_ready(&mut e);
+
+    // ⌘N: an empty editor, a scratch note once typed in.
+    enter(&mut e, "new");
+    do_step(&mut e, "new");
+    assert!(e.view.read_with(e.cx, |v, _| v.new_post.is_some()));
+    assert!(tour_done(&mut e));
+
+    // reading-time's "· N min" and inspect's ⋯, then its sheet.
+    enter(&mut e, "slots");
+    wait_drawn(&mut e, "slots", "slot-byline-reading-time");
+    assert!(drawn(&mut e, "slot-more"), "the ⋯ chip");
+    do_step(&mut e, "slots");
+    wait_drawn(&mut e, "slots", "slot-sheet");
+    assert!(tour_done(&mut e));
+
+    // The lineage glyph's counts, and the map's.
+    enter(&mut e, "lineage");
+    wait_drawn(&mut e, "lineage", "lineage-glyph-counts");
+    do_step(&mut e, "lineage");
+    wait_drawn(&mut e, "lineage", "lineage-count-up");
+    assert!(drawn(&mut e, "lineage-count-down"));
+
+    // Import OPML… on Subscriptions: the preview of a sample file, the
+    // feed the sample data follows already marked.
+    enter(&mut e, "opml");
+    assert!(drawn(&mut e, "opml-import-chip"));
+    do_step(&mut e, "opml");
+    assert!(tour_done(&mut e));
+    wait_drawn(&mut e, "opml", "opml-row-2");
+    e.view.read_with(e.cx, |v, _| {
+        assert!(matches!(
+            v.reading.sheet,
+            Some(crate::app::reading::RSheet::Opml(_))
+        ))
+    });
+
+    // The drawer's Notes tab: a chip per folder, Add folder…, Remove.
+    enter(&mut e, "notes-library");
+    for sel in [
+        "notes-tab-library",
+        "lib-vault-0",
+        "lib-vault-1",
+        "lib-vault-2",
+        "lib-vault-add",
+        "lib-vault-remove",
+    ] {
+        wait_drawn(&mut e, "notes-library", sel);
+    }
+    do_step(&mut e, "notes-library");
+    assert!(tour_done(&mut e));
+    // Remove from Burrow and Add folder… write nothing in the tour.
+    e.view.update_in(e.cx, |v, window, cx| {
+        v.ext_remove_vault("vault-garden", window, cx);
+        v.ext_pick_vaults(window, cx);
+    });
+    e.cx.run_until_parked();
+
+    // ✂ Clip on the sample page: a quote with its link in a draft.
+    enter(&mut e, "clip");
+    assert!(drawn(&mut e, "browser-clip"));
+    do_step(&mut e, "clip");
+    assert!(tour_done(&mut e));
+    let text = e
+        .view
+        .read_with(e.cx, |v, cx| v.editor.read(cx).value().to_string());
+    assert!(
+        text.contains("blyg.example.com/tide-tables"),
+        "clipped: {text}"
+    );
+
+    // cross-post's run in the pane, then folded: the status bar's mark.
+    enter(&mut e, "cross-post");
+    wait_drawn(&mut e, "cross-post", "browser-macro-stop");
+    assert!(!drawn(&mut e, "macro-folded"));
+    do_step(&mut e, "cross-post");
+    wait_drawn(&mut e, "cross-post", "macro-folded");
+    assert!(tour_done(&mut e));
+    assert!(
+        ring_now(&mut e, Region::MacroRun).is_some(),
+        "the ring moves to the status bar"
+    );
+
+    // ⇧⌘P, then Manage: Turn off and Forget permissions on the sample.
+    enter(&mut e, "extensions");
+    do_step(&mut e, "extensions");
+    wait_drawn(&mut e, "extensions", "ext-sheet");
+    assert!(drawn(&mut e, "ext-pal-0"));
+    enter(&mut e, "manage");
+    do_step(&mut e, "manage");
+    wait_drawn(&mut e, "manage", "ext-off-markdown-notes");
+    assert!(drawn(&mut e, "ext-forget-markdown-notes"));
+    assert!(tour_done(&mut e));
+    e.view.update_in(e.cx, |v, window, cx| {
+        v.ext_turn_off(crate::app::extensions::NOTES, true, window, cx)
+    });
+    e.cx.run_until_parked();
+
+    // The consent sheet's ⌘⌫: the sheet goes, nothing is written.
+    enter(&mut e, "consent");
+    wait_drawn(&mut e, "consent", "ext-turn-off");
+    do_step(&mut e, "consent");
+    assert!(tour_done(&mut e));
+    e.view.read_with(e.cx, |v, _| {
+        assert!(v.ext.overlay.is_none());
+        assert!(v.ext.notices.is_empty(), "{:?}", v.ext.notices);
+    });
+
+    // Nothing the tour did reached the config file.
+    assert_eq!(config_text(e.cx), before);
+}
+
+/// Finishing the tour stops its extensions and puts the user's back.
+#[gpui_kit::test]
+fn the_tour_puts_the_users_extensions_back(cx: &mut TestAppContext) {
+    let mut e = setup_ext(cx);
+    let mine = e
+        .view
+        .read_with(e.cx, |v, _| v.ext.host.as_ref().map(|h| h.status().len()));
+    e.cx.dispatch_action(super::ShowTutorial);
+    e.cx.run_until_parked();
+    tour_extensions_ready(&mut e);
+    enter(&mut e, "notes-library");
+    wait_drawn(&mut e, "notes-library", "lib-vault-1");
+    enter(&mut e, "consent");
+    e.view
+        .update_in(e.cx, |v, window, cx| v.finish_tutorial(window, cx));
+    e.cx.run_until_parked();
+    e.view.read_with(e.cx, |v, _| {
+        assert!(!v.ext_tour_on());
+        assert!(v.ext.overlay.is_none(), "the sample sheet went");
+        assert!(!v.ext.lib.tab);
+        assert!(v.ext.notices.is_empty(), "{:?}", v.ext.notices);
+        // The user's host: nothing on, as before the tour.
+        assert_eq!(v.ext.host.as_ref().map(|h| h.status().len()), mine);
+        assert!(v.ext_libraries().is_empty());
+        assert!(!v.ext.started, "not started before the tour, nor after");
+    });
+    assert_eq!(
+        state::AppState::load(e.dir.path()).notes_vault,
+        None,
+        "the sample folder isn't remembered"
+    );
+}
+
+/// The first launch after updating from 0.10.0 to 0.11.0: the card lists
+/// 0.11.0's news, and "Show me what's new" lands on its first step.
+#[gpui_kit::test]
+fn a_launch_after_updating_from_0_10_starts_at_0_11s_first_step(cx: &mut TestAppContext) {
+    super::whats_new::TEST_VERSION.with(|v| *v.borrow_mut() = Some("0.11.0"));
+    let mut e = setup_full(cx, CONNECTED, Some("0.10.0"), Mode::Fake, false);
+    super::whats_new::TEST_VERSION.with(|v| *v.borrow_mut() = None);
+    assert!(news_up(&e), "the card is up");
+    let versions: Vec<_> = e.view.read_with(e.cx, |v, _| {
+        v.onboarding
+            .tutorial
+            .as_ref()
+            .unwrap()
+            .news
+            .iter()
+            .map(|r| r.version)
+            .collect()
+    });
+    assert_eq!(versions, ["0.11.0"]);
+    assert_eq!(
+        state::AppState::load(e.dir.path()).seen_version.as_deref(),
+        Some("0.11.0")
+    );
+    // ⏎ on the card: Show me what's new.
+    e.cx.simulate_keystrokes("enter");
+    e.cx.run_until_parked();
+    assert!(!news_up(&e));
+    let first_new = STEPS.iter().find(|s| s.since == "0.11.0").map(|s| s.id);
+    assert_eq!(tour_step(&mut e), first_new);
+    assert_eq!(tour_step(&mut e), Some("slots"));
+}
diff --git a/crates/blyg-app/src/onboarding/tutorial.rs b/crates/blyg-app/src/onboarding/tutorial.rs
index 163392b..1e38aac 100644
--- a/crates/blyg-app/src/onboarding/tutorial.rs
+++ b/crates/blyg-app/src/onboarding/tutorial.rs
@@ -128,6 +128,8 @@ impl MainView {
                 None
             }
         };
+        // --- extensions --- the sample extensions, over the tour's backend.
+        self.ext_tour_start(window, cx);
         crate::ai::init(cx);
         let provider = cx
             .global_mut::<crate::ai::AiGlobal>()
@@ -208,7 +210,9 @@ impl MainView {
         if let Some(notes) = p.notes.take() {
             self.notes_tour_restore(notes, cx);
         }
+        self.browser.automation.tour_sample(false);
         self.browser_tour_end(cx);
+        self.ext_tour_end(window, cx);
         // The reading mode as it was (the new reading state loads it).
         let data_dir = cx.try_global::<Connection>().map(|c| c.data_dir.clone());
         stream_vm::save_mode(data_dir.as_deref(), p.read_mode);
@@ -315,7 +319,12 @@ impl MainView {
     /// The user did `key`. If the step waits for it, show ✓ and move on
     /// after the step's pause (once things have settled, if it asks), or,
     /// for a step that `stay`s, leave the moving on to Next.
-    pub(super) fn tutorial_key(&mut self, key: Key, window: &mut Window, cx: &mut Context<Self>) {
+    pub(in crate::app) fn tutorial_key(
+        &mut self,
+        key: Key,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
         let Some(t) = self.onboarding.tutorial.as_mut() else {
             return;
         };
@@ -369,6 +378,7 @@ impl MainView {
         self.sheet.is_some()
             || self.reading.sheet.is_some()
             || self.ai.has_overlay()
+            || self.ext.has_overlay()
             || self.render_ai_status().is_some()
     }
 
@@ -412,6 +422,40 @@ impl MainView {
             (Key::SpellMenu, assist.menu_open()),
             (Key::Lineage, self.lineage_open()),
             (Key::LineageRing, self.lineage_ring_open()),
+            // --- extensions ---
+            (
+                Key::ExtPalette,
+                matches!(
+                    self.ext.overlay,
+                    Some(crate::app::extensions::Overlay::Palette { .. })
+                ),
+            ),
+            (
+                Key::ExtManage,
+                matches!(
+                    self.ext.overlay,
+                    Some(crate::app::extensions::Overlay::Manage { .. })
+                ),
+            ),
+            (
+                Key::ConsentAnswered,
+                !matches!(
+                    self.ext.overlay,
+                    Some(crate::app::extensions::Overlay::Consent { .. })
+                ),
+            ),
+            (Key::SlotSheet, self.ext.slots.sheet.is_some()),
+            (
+                Key::NotesVault,
+                self.ext_lib_showing() && {
+                    let first = self.ext_libraries().into_iter().next();
+                    first.is_some() && self.ext_library() != first
+                },
+            ),
+            (
+                Key::MacroFolded,
+                self.browser.automation.folded_run(self.browser.open),
+            ),
         ]
         .into_iter()
         .filter_map(|(k, on)| on.then_some(k))
@@ -472,6 +516,7 @@ impl MainView {
         let d = on!(d, crate::ai::AiGenerate, Key::AiGenerate);
         let d = on!(d, crate::ai::AiShorten, Key::AiShorten);
         let d = on!(d, crate::app::reading::ShowVersions, Key::ShowVersions);
+        let d = on!(d, crate::app::NewDraft, Key::NewPost);
         on!(d, crate::app::reading::QuotePicker, Key::QuotePicker)
     }
 
@@ -489,10 +534,12 @@ impl MainView {
         if self.notes.drawn() {
             self.notes_tour_hide(cx);
         }
+        self.browser.automation.tour_sample(false);
         self.browser_tour_hide(cx);
         if self.profile_sheet_open() {
             self.close_profile(window, cx);
         }
+        self.ext_tour_close_sheets(window, cx);
     }
 
     /// Reading, in `mode`, nothing open, the search cleared.
@@ -686,6 +733,31 @@ impl MainView {
                 self.tutorial_setup(Setup::Reader, window, cx);
                 self.browser_tour_open(window, cx);
             }
+            Setup::NotesLibrary => {
+                self.tutorial_setup(Setup::Reader, window, cx);
+                self.ext_lib_choose(None, window, cx);
+                if self.ext_library().is_some() || self.ext_notes_on() {
+                    self.ext_lib_show(window, cx);
+                } else {
+                    self.open_notes(window, cx);
+                }
+            }
+            Setup::CrossPost => {
+                self.tutorial_setup(Setup::Browser, window, cx);
+                self.browser.automation.tour_sample(true);
+            }
+            Setup::Palette => {
+                self.tutorial_setup(Setup::Posts, window, cx);
+                self.ext_toggle_palette(window, cx);
+            }
+            Setup::Consent => {
+                self.tutorial_setup(Setup::Posts, window, cx);
+                self.ext_tour_consent(window, cx);
+            }
+            Setup::Subscriptions => {
+                self.tutorial_tidy(window, cx);
+                self.show_view(View::Subscriptions, window, cx);
+            }
         }
     }
 
@@ -720,6 +792,37 @@ impl MainView {
             "quotes" => self.open_quote_picker(window, cx),
             "lineage" => self.toggle_lineage(window, cx),
             "ring" => self.lineage_open_ring(cx),
+            "new" => self.start_new_post(window, cx),
+            "opml" => self.opml_pick(window, cx),
+            "clip" => self.browser_clip(window, cx),
+            "cross-post" => self.close_browser(window, cx),
+            "extensions" => self.ext_toggle_palette(window, cx),
+            "manage" => {
+                self.ext.overlay = None;
+                self.ext_open_manage(window, cx);
+            }
+            "slots" => {
+                let item = self.reading.sel.as_ref().and_then(|k| {
+                    self.reading
+                        .rows
+                        .iter()
+                        .find(|r| r.subscription_id == k.0 && r.remote_id == k.1)
+                        .cloned()
+                });
+                if let Some(item) = item {
+                    self.slots_open(item, window, cx);
+                    self.slots_choose(0, cx);
+                }
+            }
+            "notes-library" => {
+                let garden = self
+                    .ext_libraries()
+                    .into_iter()
+                    .find(|l| l.library.title == "Garden");
+                if let Some(l) = garden {
+                    self.ext_lib_choose(Some(l.library.id), window, cx);
+                }
+            }
             _ => {}
         }
     }
@@ -772,6 +875,28 @@ impl MainView {
             Region::Editor => editor,
             Region::Counter => (0., h - STATUS_H, 230., STATUS_H),
             Region::Sheet => ((w - 468.) / 2., top, 468., 132.),
+            Region::NotesDrawer => {
+                if !self.notes.drawn() {
+                    return None;
+                }
+                let nw = crate::app::notes::WIDTH;
+                ((w - nw).max(0.), top, nw.min(w), h - top)
+            }
+            Region::ScreenHeader => {
+                if self.reading.view == View::Posts {
+                    return None;
+                }
+                (0., top, w, OMNI_H)
+            }
+            Region::MacroRun => {
+                if let Some([_, chrome]) = self.browser_rects(w, h) {
+                    chrome
+                } else if self.browser.automation.folded_run(self.browser.open) {
+                    (0., h - STATUS_H, w, STATUS_H)
+                } else {
+                    return None;
+                }
+            }
             Region::Stream
             | Region::StreamPost
             | Region::Reader
@@ -843,12 +968,12 @@ impl MainView {
     /// would draw over it).
     fn tutorial_overlays(&self, region: Region, w: f32, h: f32) -> Vec<Rect> {
         let mut v = Vec::new();
-        if region != Region::BrowserChrome
+        if !matches!(region, Region::BrowserChrome | Region::MacroRun)
             && let Some([pane, _]) = self.browser_rects(w, h)
         {
             v.push(pane);
         }
-        if self.notes.drawn() {
+        if self.notes.drawn() && region != Region::NotesDrawer {
             let nw = crate::app::notes::WIDTH;
             v.push(((w - nw).max(0.), TITLEBAR_H, nw, h - TITLEBAR_H));
         }
@@ -882,6 +1007,7 @@ impl MainView {
         let covered = self.sheet.is_some()
             || self.reading.sheet.is_some()
             || self.ai.has_overlay()
+            || self.ext.has_overlay() // --- extensions --- its sheets
             || self.profile_sheet_open()
             // The editor's @-mention popup and spelling menu.
             || assist.mention_open()
@@ -1034,9 +1160,15 @@ impl MainView {
                     .font_weight(FontWeight::SEMIBOLD)
                     .text_color(p.muted)
                     .child(format!(
-                        "TOUR · {} OF {} · SAMPLE DATA",
+                        "TOUR · {} OF {}{} · SAMPLE DATA",
                         index + 1,
-                        STEPS.len()
+                        STEPS.len(),
+                        // What this version added says so.
+                        if step.since == super::whats_new::running_version() {
+                            format!(" · NEW IN {}", step.since)
+                        } else {
+                            String::new()
+                        }
                     ))
                     .child(div().flex_1())
                     .child(
diff --git a/crates/blyg-app/src/onboarding/whats_new.rs b/crates/blyg-app/src/onboarding/whats_new.rs
index 335f784..3ddbfcf 100644
--- a/crates/blyg-app/src/onboarding/whats_new.rs
+++ b/crates/blyg-app/src/onboarding/whats_new.rs
@@ -2,6 +2,12 @@
 //! tutorial on a card listing it, with Take the tour, Start at what's new,
 //! and Skip tutorial. Add an entry when a release adds something the tour
 //! teaches, and set its version to the release's (CHANGELOG.md says when).
+//!
+//! The rule (every release): a new feature gets a tour step that lands on
+//! it, with `since` set to the release, existing steps are edited when
+//! what they show changed, and the entry's `first_step` is the first of the
+//! release's own steps. The tests below hold every entry from 0.10.0 on to
+//! that, and fail when the crate's version is an x.y.0 with no entry.
 
 /// One release's news.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -14,6 +20,27 @@ pub struct Release {
 }
 
 pub const RELEASES: &[Release] = &[
+    Release {
+        version: "0.11.0",
+        items: &[
+            "reading-time and inspect, two bundled extensions (off until you turn them on): \
+             “· 3 min” on each post you read, and ⋯ › inspect for the record behind it.",
+            "The lineage glyph, ⌘J and the ring now count: how many posts a post draws on, \
+             and how many draw on it.",
+            "Bring your feeds from another reader: Blyg › Import Subscriptions from OPML… (and \
+             Export). They land in an Imported feeds folder in the Reader.",
+            "markdown-notes takes several folders, and none until you choose one: Add folder… \
+             in the drawer's Notes tab, or Settings › Notes folders.",
+            "cross-post runs in the side pane, and you can fold the pane mid-run: the status \
+             bar says “macro running · show pane”.",
+            "⇧⌘P › Manage extensions can Turn off an extension or Forget its permissions; ⌘⌫ \
+             turns one off from the permission sheet.",
+            "Sign in again once after this update so read state keeps syncing between your Macs \
+             (studio 0.39 or later): Burrow › Disconnect…, keep the local copy, then Sign in \
+             with browser. An API token needs a new one with reading:state.",
+        ],
+        first_step: Some("slots"),
+    },
     Release {
         version: "0.10.0",
         items: &[
@@ -26,7 +53,7 @@ pub const RELEASES: &[Release] = &[
             "⌘N opens an empty editor; it's kept on this Mac until ⌘D makes it a draft.",
             "✂ Clip (⇧⌘C) in the browser pane quotes the page into a draft.",
         ],
-        first_step: Some("notes"),
+        first_step: Some("new"),
     },
     Release {
         version: "0.9.0",
@@ -45,7 +72,7 @@ pub const RELEASES: &[Release] = &[
         version: "0.8.0",
         items: &[
             "Lineage: a glyph beside each post's name shows which kinds of post it draws on and \
-         which draw on it (fork, reply, quote), never how many.",
+         which draw on it (fork, reply, quote).",
             "⌘J opens a post's lineage: what it draws on above, its responses below. Walk it one \
          step at a time with ⏎ and ⌫.",
             "Space on the post in the middle opens its actions on a ring: fork, reply, quote, link \
@@ -57,6 +84,30 @@ pub const RELEASES: &[Release] = &[
     },
 ];
 
+#[cfg(test)]
+thread_local! {
+    /// The version a test's window launches as (`running_version`).
+    pub static TEST_VERSION: std::cell::RefCell<Option<&'static str>> =
+        const { std::cell::RefCell::new(None) };
+}
+
+/// The version this launch counts as for what's new: the crate's. A debug
+/// build takes `BLYGGER_VERSION_AS` instead (screenshots of an update's
+/// card before the version is bumped), and a test its `TEST_VERSION`.
+pub fn running_version() -> String {
+    #[cfg(test)]
+    if let Some(v) = TEST_VERSION.with(|v| *v.borrow()) {
+        return v.to_string();
+    }
+    if cfg!(debug_assertions)
+        && let Ok(v) = std::env::var("BLYGGER_VERSION_AS")
+        && parse(&v).is_some()
+    {
+        return v;
+    }
+    env!("CARGO_PKG_VERSION").to_string()
+}
+
 fn parse(v: &str) -> Option<(u32, u32, u32)> {
     let mut it = v.trim().trim_start_matches('v').split('.');
     let n = |s: Option<&str>| s.and_then(|s| s.parse().ok());
@@ -114,4 +165,80 @@ mod tests {
             }
         }
     }
+
+    /// From this release on, every entry starts at a step of its own.
+    const GUARDED_FROM: (u32, u32, u32) = (0, 10, 0);
+
+    /// The guard against a what's-new card that starts the tour somewhere
+    /// unrelated (0.10.0's started at the old reading-notes step): each
+    /// entry's `first_step` is a step added for that release, and the first
+    /// of them in the tour, so "Show me what's new" lands on the news.
+    #[test]
+    fn each_release_starts_at_a_step_of_its_own() {
+        use super::super::steps::STEPS;
+        for r in RELEASES {
+            let v = parse(r.version).unwrap();
+            if v < GUARDED_FROM {
+                continue;
+            }
+            let own: Vec<&str> = STEPS
+                .iter()
+                .filter(|s| parse(s.since) == Some(v))
+                .map(|s| s.id)
+                .collect();
+            assert!(
+                !own.is_empty(),
+                "{}: no tour step teaches it (add one with since = {:?})",
+                r.version,
+                r.version
+            );
+            assert_eq!(
+                r.first_step,
+                Some(own[0]),
+                "{}: what's new should start at its first own step",
+                r.version
+            );
+        }
+        // No step claims a release that has no entry (a step added for a
+        // release whose card would never send anyone to it).
+        for s in STEPS {
+            let v = parse(s.since).unwrap();
+            if v >= GUARDED_FROM {
+                assert!(
+                    RELEASES.iter().any(|r| parse(r.version) == Some(v)),
+                    "{}: since {} has no what's-new entry",
+                    s.id,
+                    s.since
+                );
+            }
+        }
+    }
+
+    /// Cutting x.y.0 without a what's-new entry (and so without a tour step
+    /// for what it adds) fails here.
+    #[test]
+    fn this_minor_release_has_an_entry() {
+        let now = parse(env!("CARGO_PKG_VERSION")).unwrap();
+        if now.2 == 0 && now >= GUARDED_FROM {
+            assert!(
+                RELEASES.iter().any(|r| parse(r.version) == Some(now)),
+                "{} has no what's-new entry in RELEASES",
+                env!("CARGO_PKG_VERSION")
+            );
+        }
+    }
+
+    #[test]
+    fn a_launch_after_0_10_shows_0_11() {
+        let news = since(Some("0.10.0"), "0.11.0");
+        assert_eq!(news.len(), 1);
+        assert_eq!(news[0].version, "0.11.0");
+        assert_eq!(news[0].first_step, Some("slots"));
+        // Coming from 0.9, the tour starts at 0.10.0's first step.
+        let both: Vec<_> = since(Some("0.9.0"), "0.11.0")
+            .iter()
+            .map(|r| r.first_step)
+            .collect();
+        assert_eq!(both, [Some("slots"), Some("new")]);
+    }
 }
diff --git a/crates/blyg-app/src/reading/lineage.rs b/crates/blyg-app/src/reading/lineage.rs
index c8b8abc..46147f2 100644
--- a/crates/blyg-app/src/reading/lineage.rs
+++ b/crates/blyg-app/src/reading/lineage.rs
@@ -2,15 +2,18 @@
 //! on it below, one step each way. ⏎ on a neighbour makes it the centre (⌫
 //! walks back); Space on the centre opens the ring of the reader's actions
 //! in fixed places (f r q l v o), each previewed before ⏎ does it. The glyph
-//! on stream rows is the same map in miniature: which kinds, never how many
-//! (spec rule 1). Model: `lineage_vm.rs`.
+//! on stream rows is the same map in miniature: which kinds, and how many
+//! ("up · down", as blygger-studio's lineage-glyph counts them; SPEC rule 1's
+//! exception, 2026-10-09). The counts and graph come from the node when it
+//! serves the `lineage-glyph` extension, else from this Mac. Model:
+//! `lineage_vm.rs`.
 
 use blyg_core::profile::Relation;
 use blyg_core::{RemoteRef, SubscriptionKind};
 use gpui_kit::prelude::FluentBuilder as _;
 use gpui_kit::*;
 
-use super::lineage_vm::{self, Act, Kinds, Mark, Model, Sel};
+use super::lineage_vm::{self, Act, Glyph, Mark, Model, Sel};
 use super::{RSheet, vm};
 use crate::app::MainView;
 use crate::theme::Palette;
@@ -48,6 +51,8 @@ const UP_Y: f32 = 12.;
 const DOWN_Y: f32 = STAGE_H - 12. - CARD_H;
 /// Neighbours shown per row; the side list has them all.
 const ROW_MAX: usize = 5;
+/// At most this many rows' counts are asked of the node per refresh.
+const LINEAGE_KEYS_MAX: usize = 250;
 
 /// The colour of a relation: fork amber, reply the accent, quote green.
 pub(crate) fn rel_color(p: &Palette, rel: Relation) -> Hsla {
@@ -157,24 +162,29 @@ impl MainView {
             .flatten()
     }
 
-    /// Your published posts' references and your blyg's origin, for the
-    /// glyph's "drawn on by" side.
-    pub(super) fn own_lineage(&self) -> (Vec<blyg_core::PostRef>, Option<String>) {
+    /// Your published posts and your blyg's origin, for the glyph's "drawn
+    /// on by" side.
+    pub(super) fn own_lineage(&self) -> (Vec<blyg_core::Item>, Option<String>) {
         let Some(base) = self.base_url.clone() else {
             return (vec![], None);
         };
-        let rows = &self.reading.rows;
-        let refs = self
+        let posts = self
             .backend
             .items()
-            .iter()
+            .into_iter()
             .filter(|i| i.version > 0 && i.status == blyg_core::Status::Public)
-            .flat_map(|i| i.references(&base, rows))
             .collect();
-        (refs, Some(base))
+        (posts, Some(base))
     }
 
-    fn lineage_model(&self, origin: &str, id: &str) -> Model {
+    /// The view of `(origin, id)`: the node's graph when it served one
+    /// (`graph`, else its cached copy), otherwise what this Mac holds.
+    fn lineage_model(
+        &self,
+        origin: &str,
+        id: &str,
+        graph: Option<&blyg_core::lineage::LineageGraph>,
+    ) -> Model {
         let fresh;
         let rows = if self.reading.rows.is_empty() {
             fresh = self.backend.reading();
@@ -189,13 +199,107 @@ impl MainView {
             .ready()
             .map(Vec::as_slice)
             .unwrap_or(&[]);
+        let built;
+        let local = if self.reading.rows.is_empty() {
+            built =
+                blyg_core::lineage::Local::build(rows, &own, self.base_url.as_deref(), mentions);
+            &built
+        } else {
+            &self.reading.lineage
+        };
         let src = lineage_vm::Sources {
             rows,
             own: &own,
             own_origin: self.base_url.as_deref(),
             mentions,
+            local,
         };
-        lineage_vm::build(origin, id, &src, self.backend.responses(origin, id))
+        let local_model = lineage_vm::build(origin, id, &src);
+        let cached;
+        let graph = match graph {
+            Some(g) => Some(g),
+            None => {
+                cached = self
+                    .backend
+                    .cached_lineage_graph(&local_model.centre.query());
+                cached.as_ref()
+            }
+        };
+        match graph {
+            Some(g) => lineage_vm::from_graph(origin, id, &src, g),
+            None => local_model,
+        }
+    }
+
+    // ------------------------------------------------------------ counts from the node
+
+    /// Ask the node for the glyph counts of the rows (cached in the store;
+    /// fresh ones aren't asked again). What's cached shows at once; a node
+    /// that doesn't serve them leaves the counts to this Mac.
+    pub(super) fn refresh_lineage_counts(&mut self, cx: &mut Context<Self>) {
+        let keys: Vec<String> = self
+            .reading
+            .shown_rows()
+            .filter(|r| !r.subscription_id.is_empty())
+            .take(LINEAGE_KEYS_MAX)
+            .map(|r| blyg_core::lineage::imported_key(&r.subscription_id, &r.remote_id))
+            .collect();
+        if keys.is_empty() {
+            return;
+        }
+        if let Some(cached) = self.backend.cached_lineage_summaries(&keys) {
+            self.reading.served.extend(cached);
+        }
+        let backend = self.backend.clone();
+        let task = cx.background_spawn(async move {
+            backend.lineage_summaries(&keys, blyg_core::lineage::SUMMARY_TTL_MS)
+        });
+        cx.spawn(async move |this, cx| {
+            let got = task.await;
+            let _ = this.update(cx, |v, cx| {
+                match got {
+                    Some(got) => v.reading.served.extend(got),
+                    // Not served (any more): count here.
+                    None => v.reading.served.clear(),
+                }
+                cx.notify();
+            });
+        })
+        .detach();
+    }
+
+    /// Ask the node for the open sheet's graph; when it answers, the sheet
+    /// shows the node's neighbours and counts.
+    fn lineage_fetch_graph(&mut self, cx: &mut Context<Self>) {
+        let Some(s) = self.lineage_mut() else { return };
+        let centre = s.model.centre.query();
+        let (origin, id) = (s.model.centre.origin.clone(), s.model.centre.id.clone());
+        let backend = self.backend.clone();
+        let q = centre.clone();
+        let task = cx.background_spawn(async move {
+            backend.lineage_graph(&q, blyg_core::lineage::GRAPH_TTL_MS)
+        });
+        cx.spawn(async move |this, cx| {
+            let Some(graph) = task.await else {
+                return;
+            };
+            let _ = this.update(cx, |v, cx| {
+                let model = v.lineage_model(&origin, &id, Some(&graph));
+                if let Some(s) = v.lineage_mut()
+                    && s.model.centre.query() == centre
+                    && s.model != model
+                {
+                    s.model = model;
+                    s.sel = match s.sel {
+                        Sel::Up(i) if i < s.model.ups.len() => Sel::Up(i),
+                        Sel::Down(i) if i < s.model.downs.len() => Sel::Down(i),
+                        _ => Sel::Centre,
+                    };
+                }
+                cx.notify();
+            });
+        })
+        .detach();
     }
 
     pub(crate) fn open_lineage(
@@ -207,7 +311,7 @@ impl MainView {
     ) {
         let focus = cx.focus_handle();
         let sheet = Sheet {
-            model: self.lineage_model(&origin, &id),
+            model: self.lineage_model(&origin, &id, None),
             sel: Sel::Centre,
             hist: vec![],
             ring: false,
@@ -217,6 +321,7 @@ impl MainView {
         };
         self.open_reading_sheet(RSheet::Lineage(Box::new(sheet)), cx);
         window.focus(&focus, cx);
+        self.lineage_fetch_graph(cx);
     }
 
     /// The lineage sheet is up (the tutorial watches for it).
@@ -254,8 +359,8 @@ impl MainView {
         }
     }
 
-    fn lineage_recentre(&mut self, origin: String, id: String, back: bool) {
-        let model = self.lineage_model(&origin, &id);
+    fn lineage_recentre(&mut self, origin: String, id: String, back: bool, cx: &mut Context<Self>) {
+        let model = self.lineage_model(&origin, &id, None);
         if let Some(s) = self.lineage_mut() {
             if !back {
                 let c = &s.model.centre;
@@ -267,6 +372,7 @@ impl MainView {
             s.act = None;
             s.pin = Pin::Unknown;
         }
+        self.lineage_fetch_graph(cx);
     }
 
     // ------------------------------------------------------------ keys
@@ -276,7 +382,17 @@ impl MainView {
             return false;
         };
         let (ring, act, sel) = (s.ring, s.act, s.sel);
-        let node = s.model.node(sel).map(|n| (n.origin.clone(), n.id.clone()));
+        // Only a post can be the centre (a `{url}` stub is a page).
+        let node = s
+            .model
+            .node(sel)
+            .filter(|n| n.is_post())
+            .map(|n| (n.origin.clone(), n.id.clone()));
+        let page = s
+            .model
+            .node(sel)
+            .filter(|n| !n.is_post())
+            .map(|n| n.origin.clone());
         let centre = (s.model.centre.origin.clone(), s.model.centre.id.clone());
         if ring {
             match key {
@@ -316,7 +432,8 @@ impl MainView {
                 }
             }
             "enter" | "space" => match node {
-                Some((o, i)) => self.lineage_recentre(o, i, false),
+                Some((o, i)) => self.lineage_recentre(o, i, false, cx),
+                None if page.is_some() => {}
                 None => {
                     if let Some(s) = self.lineage_mut() {
                         s.ring = true;
@@ -328,10 +445,20 @@ impl MainView {
             "backspace" => {
                 let prev = self.lineage_mut().and_then(|s| s.hist.pop());
                 if let Some((o, i)) = prev {
-                    self.lineage_recentre(o, i, true);
+                    self.lineage_recentre(o, i, true, cx);
+                }
+            }
+            "o" if page.is_some() => {
+                if let Some(u) =
+                    page.filter(|u| u.starts_with("https://") || u.starts_with("http://"))
+                {
+                    cx.open_url(&u);
                 }
             }
             "o" => {
+                // Opened in the reader as a click in the list opens it: a
+                // held post is marked read on the way (`open_reading` →
+                // `Backend::mark_read`).
                 let (o, i) = node.unwrap_or(centre);
                 self.close_reading_sheet(window, cx);
                 self.open_original(o, i, None, window, cx);
@@ -523,7 +650,11 @@ impl MainView {
             .text_size(px(11.5))
             .text_color(p.muted)
             .child(div().flex_1().min_w_0().truncate().child(crumb))
-            .child("Responses: what this Mac holds")
+            .child(if s.model.served {
+                "Responses: what your blyg knows"
+            } else {
+                "Responses: what this Mac holds"
+            })
             .child("⌘J / esc closes");
         let body = div()
             .flex()
@@ -903,6 +1034,33 @@ impl MainView {
                     .truncate()
                     .child(c.who.clone()),
             );
+        // How many each way, beside the hexagon ("up · down" in words).
+        let summary = m.summary();
+        let tally = |y: f32, id: &'static str, text: String| {
+            div()
+                .id(id)
+                .debug_selector(move || id.into())
+                .absolute()
+                .left(px(10.))
+                .top(px(y))
+                .w(px(CX - RING_OUT - 16.))
+                .text_size(px(11.))
+                .text_color(p.muted)
+                .when(s.ring, |d| d.opacity(0.28))
+                .child(text)
+        };
+        let tallies = [
+            tally(
+                CY - 22.,
+                "lineage-count-up",
+                lineage_vm::side_words(summary.up, true),
+            ),
+            tally(
+                CY + 6.,
+                "lineage-count-down",
+                lineage_vm::side_words(summary.down, false),
+            ),
+        ];
         let labels: Vec<AnyElement> = if s.ring {
             Act::ALL
                 .iter()
@@ -950,7 +1108,11 @@ impl MainView {
                             div()
                                 .text_size(px(10.))
                                 .text_color(if on { p.bg } else { p.muted })
-                                .child(a.key().to_uppercase()),
+                                // How many already did this, known here.
+                                .child(match a.relation().map(|r| summary.down.get(r)) {
+                                    Some(n) if n > 0 => format!("{} · {n}", a.key().to_uppercase()),
+                                    _ => a.key().to_uppercase(),
+                                }),
                         )
                         .into_any_element()
                 })
@@ -977,6 +1139,7 @@ impl MainView {
             })
             .children(cards)
             .child(hex_text)
+            .children(tallies)
             .children(labels)
             .into_any_element()
     }
@@ -1085,6 +1248,14 @@ impl MainView {
                         }),
                 )
                 .child(div().mt(px(2.)).child(a.one()))
+                .children(a.relation().map(|r| {
+                    div()
+                        .debug_selector(|| "lineage-ring-count".into())
+                        .mt(px(2.))
+                        .text_size(px(12.))
+                        .text_color(p.muted)
+                        .child(lineage_vm::already_words(r, s.model.summary().down.get(r)))
+                }))
                 .child(
                     div()
                         .mt(px(4.))
@@ -1147,6 +1318,15 @@ impl MainView {
                 None,
             ),
         };
+        let summary = m.summary();
+        let heading = |text: String| {
+            div()
+                .mt(px(4.))
+                .text_size(px(11.))
+                .font_weight(FontWeight::SEMIBOLD)
+                .text_color(p.muted)
+                .child(text)
+        };
         let list = (s.sel == Sel::Centre).then(|| {
             div()
                 .mt(px(8.))
@@ -1154,6 +1334,12 @@ impl MainView {
                 .flex_col()
                 .gap(px(2.))
                 .text_size(px(12.))
+                .when(!m.ups.is_empty(), |d| {
+                    d.child(heading(format!(
+                        "Where it came from · {}",
+                        summary.up.total()
+                    )))
+                })
                 .children(m.ups.iter().map(|n| {
                     self.lineage_list_row(
                         &p,
@@ -1166,6 +1352,12 @@ impl MainView {
                         ),
                     )
                 }))
+                .when(!m.downs.is_empty(), |d| {
+                    d.child(heading(format!(
+                        "What came from it, known here · {}",
+                        summary.down.total()
+                    )))
+                })
                 .children(m.downs.iter().map(|n| {
                     self.lineage_list_row(
                         &p,
@@ -1230,24 +1422,34 @@ impl MainView {
 
     // ------------------------------------------------------------ the glyph
 
+    /// The glyph's numbers for `r`: this Mac's edges, with the node's counts
+    /// over them when it serves them.
+    pub(crate) fn lineage_glyph_of(&self, r: &blyg_core::ReadingItem) -> Glyph {
+        let served = (!r.subscription_id.is_empty())
+            .then(|| {
+                self.reading.served.get(&blyg_core::lineage::imported_key(
+                    &r.subscription_id,
+                    &r.remote_id,
+                ))
+            })
+            .flatten();
+        Glyph::of(&self.reading.lineage, &r.origin, &r.remote_id, served)
+    }
+
     /// The glyph for `r`: kinds in from the left (what it draws on), kinds
-    /// out to the right (what draws on it). Fixed slots: fork, reply, quote.
-    /// A click opens the lineage. Nothing when it has neither.
+    /// out to the right (what draws on it), in fixed slots (fork, reply,
+    /// quote), then "up · down": how many, as blygger-studio's lineage-glyph
+    /// counts them. A click opens the lineage. Nothing when it has neither.
     pub(super) fn render_lineage_glyph(
         &self,
         r: &blyg_core::ReadingItem,
         cx: &mut Context<Self>,
     ) -> Option<AnyElement> {
-        let up = Kinds::of(&r.references());
-        let down = self
-            .reading
-            .down
-            .get(&blyg_core::post_key(&r.origin, &r.remote_id))
-            .copied()
-            .unwrap_or_default();
-        if up.is_empty() && down.is_empty() {
+        let glyph = self.lineage_glyph_of(r);
+        if glyph.is_empty() {
             return None;
         }
+        let (up, down) = (glyph.up, glyph.down);
         let p = self.palette.on_page();
         let colors = [
             (Relation::Forks, rel_color(&p, Relation::Forks), 3.),
@@ -1256,19 +1458,7 @@ impl MainView {
         ];
         let ink = p.ink;
         let bg = p.bg;
-        let tip = {
-            let mut lines = Vec::new();
-            let u = up.words(true);
-            if !u.is_empty() {
-                lines.push(format!("This post {}", u.join(", ")));
-            }
-            let d = down.words(false);
-            if !d.is_empty() {
-                lines.push(format!("Others have {} it", d.join(", ")));
-            }
-            lines.push("⌘J or a click: see who".into());
-            lines.join("\n")
-        };
+        let tip = glyph.tip();
         let (origin, id) = (r.origin.clone(), r.remote_id.clone());
         let painter = canvas(
             |_, _, _| (),
@@ -1331,17 +1521,30 @@ impl MainView {
                 }
             },
         )
-        .size_full();
+        .w(px(46.))
+        .h(px(16.))
+        .flex_none();
         Some(
             div()
                 .id("lineage-glyph")
                 .debug_selector(|| "lineage-glyph".into())
-                .w(px(46.))
+                .flex()
+                .items_center()
+                .gap(px(3.))
+                .pr(px(4.))
                 .h(px(16.))
                 .rounded(px(5.))
                 .cursor_pointer()
                 .hover(|s| s.bg(p.sel))
                 .child(painter)
+                .child(
+                    div()
+                        .debug_selector(|| "lineage-glyph-counts".into())
+                        .text_size(px(10.5))
+                        .text_color(p.muted)
+                        .whitespace_nowrap()
+                        .child(glyph.label()),
+                )
                 .tooltip(move |_, cx| cx.new(|_| super::Tip(tip.clone())).into())
                 .on_click(cx.listener(move |this, _, window, cx| {
                     cx.stop_propagation();
diff --git a/crates/blyg-app/src/reading/lineage_vm.rs b/crates/blyg-app/src/reading/lineage_vm.rs
index 7f862a1..6cd27cc 100644
--- a/crates/blyg-app/src/reading/lineage_vm.rs
+++ b/crates/blyg-app/src/reading/lineage_vm.rs
@@ -1,15 +1,19 @@
-//! Lineage (⌘J): a post's neighbours one step each way, from what this Mac
-//! holds. What it draws on (its `stub_of`, `forked_from` and quotes) is
-//! exact; what draws on it is everything seen here: reading rows, your own
-//! published posts, and verified mentions of your posts. The same rules as
-//! blygger-studio's lineage view (one reference per post and target, fork >
-//! stub > quote, a passage quote marks it partial), but presence only: no
-//! counts anywhere (spec rule 1). Pure model; `lineage.rs` draws it.
-
-use std::collections::HashMap;
+//! Lineage (⌘J): a post's neighbours one step each way. What it draws on
+//! (its `stub_of`, `forked_from` and quotes) is exact; what draws on it is
+//! what's known here. On a node that serves blygger-studio's `lineage-glyph`
+//! extension the graph and counts come from it (`blyg_core::lineage`, ported
+//! from studio commit dc632c5); otherwise from what this Mac holds (reading
+//! rows, your own published posts, verified mentions of your posts) with the
+//! same rules (`blyg_core::lineage::Local`): one reference per post and
+//! target, fork > stub > quote, a passage quote marks it partial.
+//!
+//! The glyph, this view and the ring show how many of each kind, next to the
+//! kinds: SPEC rule 1's one exception (2026-10-09, a user decision). Pure
+//! model; `lineage.rs` draws it.
 
+use blyg_core::lineage::{Edge, LineageGraph, LineageSummary, Local, Peer, RelationCounts, Via};
 use blyg_core::profile::Relation;
-use blyg_core::{Item, Kind, Mention, PostRef, ReadingItem, Response, post_key};
+use blyg_core::{Item, Kind, Mention, ReadingItem, post_key};
 
 use super::vm;
 
@@ -25,12 +29,14 @@ pub enum Mark {
     Whole,
 }
 
-/// Which kinds of relation a post has on one side. Never how many.
+/// Which kinds of relation a post has on one side, and how many of each
+/// (the studio's counts).
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
 pub struct Kinds {
     pub fork: Mark,
     pub stub: Mark,
     pub quote: Mark,
+    pub counts: RelationCounts,
 }
 
 impl Kinds {
@@ -44,6 +50,7 @@ impl Kinds {
             (Mark::Whole, _) | (_, false) => Mark::Whole,
             _ => Mark::Partial,
         };
+        self.counts.bump(rel);
     }
 
     pub fn get(&self, rel: Relation) -> Mark {
@@ -54,87 +61,119 @@ impl Kinds {
         }
     }
 
-    pub fn is_empty(&self) -> bool {
-        *self == Kinds::default()
+    pub fn total(&self) -> u32 {
+        self.counts.total()
     }
 
-    pub fn of(refs: &[PostRef]) -> Kinds {
+    pub fn of(edges: &[Edge]) -> Kinds {
         let mut k = Kinds::default();
-        for r in refs {
-            k.add(r.relation, r.partial);
+        for e in edges {
+            k.add(e.relation, e.partial);
         }
         k
     }
 
-    /// The kinds in words, for the glyph's tooltip: "a reply to, quotes".
-    pub fn words(&self, up: bool) -> Vec<&'static str> {
+    /// The node's counts win over this Mac's: a kind it counts shows (whole,
+    /// unless this Mac knows it's a passage), one it doesn't count doesn't.
+    pub fn served(mut self, counts: RelationCounts) -> Kinds {
+        for rel in [Relation::Forks, Relation::Stubs, Relation::Quotes] {
+            let m = match rel {
+                Relation::Forks => &mut self.fork,
+                Relation::Stubs => &mut self.stub,
+                Relation::Quotes => &mut self.quote,
+            };
+            *m = match (counts.get(rel), *m) {
+                (0, _) => Mark::None,
+                (_, Mark::None) => Mark::Whole,
+                (_, m) => m,
+            };
+        }
+        self.counts = counts;
+        self
+    }
+
+    /// The kinds with their counts in words, for the glyph's tooltip:
+    /// "1 fork, 2 replies (to passages)".
+    pub fn words(&self) -> Vec<String> {
         let mut out = Vec::new();
         for rel in [Relation::Forks, Relation::Stubs, Relation::Quotes] {
-            let m = self.get(rel);
-            if m == Mark::None {
+            let n = self.counts.get(rel);
+            if n == 0 {
                 continue;
             }
-            let partial = m == Mark::Partial;
-            out.push(match (up, rel, partial) {
-                (true, Relation::Forks, _) => "forks a post",
-                (true, Relation::Stubs, false) => "replies to a post",
-                (true, Relation::Stubs, true) => "replies to a passage",
-                (true, Relation::Quotes, false) => "quotes posts",
-                (true, Relation::Quotes, true) => "quotes passages",
-                (false, Relation::Forks, _) => "forked",
-                (false, Relation::Stubs, false) => "replied to",
-                (false, Relation::Stubs, true) => "replied to a passage of",
-                (false, Relation::Quotes, false) => "quoted",
-                (false, Relation::Quotes, true) => "quoted a passage of",
-            });
+            let noun = match (rel, n == 1) {
+                (Relation::Forks, true) => "fork",
+                (Relation::Forks, false) => "forks",
+                (Relation::Stubs, true) => "reply",
+                (Relation::Stubs, false) => "replies",
+                (Relation::Quotes, true) => "quote",
+                (Relation::Quotes, false) => "quotes",
+            };
+            let passage = if self.get(rel) == Mark::Partial {
+                if n == 1 {
+                    " (of a passage)"
+                } else {
+                    " (of passages)"
+                }
+            } else {
+                ""
+            };
+            out.push(format!("{n} {noun}{passage}"));
         }
         out
     }
 }
 
-/// The relation a mention names (`stub` | `transclusion` | `fork`).
-pub fn mention_relation(rel: Option<&str>) -> Option<Relation> {
-    match rel? {
-        "stub" => Some(Relation::Stubs),
-        "fork" => Some(Relation::Forks),
-        "transclusion" => Some(Relation::Quotes),
-        _ => None,
-    }
+/// A post's glyph: both sides.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct Glyph {
+    pub up: Kinds,
+    pub down: Kinds,
 }
 
-fn shown_mention(m: &Mention) -> bool {
-    m.status == "verified" && !m.hidden
-}
+impl Glyph {
+    /// From this Mac's edges, with the node's counts over them when it
+    /// serves them.
+    pub fn of(local: &Local, origin: &str, id: &str, served: Option<&LineageSummary>) -> Glyph {
+        let up = Kinds::of(local.up(origin, id));
+        let down = Kinds::of(local.down(origin, id));
+        match served {
+            Some(s) => Glyph {
+                up: up.served(s.up),
+                down: down.served(s.down),
+            },
+            None => Glyph { up, down },
+        }
+    }
 
-/// What draws on each post (by [`post_key`]), as kinds: the reading rows'
-/// references, your own posts' (`own_refs`), and verified mentions of your
-/// posts. One entry per post that has any.
-pub fn down_index(
-    rows: &[ReadingItem],
-    own_refs: &[PostRef],
-    mentions: &[Mention],
-    own_origin: Option<&str>,
-) -> HashMap<(String, String), Kinds> {
-    let mut out: HashMap<(String, String), Kinds> = HashMap::new();
-    for r in rows
-        .iter()
-        .flat_map(|r| r.references())
-        .chain(own_refs.iter().cloned())
-    {
-        out.entry((r.origin, r.id))
-            .or_default()
-            .add(r.relation, r.partial);
-    }
-    if let Some(own) = own_origin {
-        for m in mentions.iter().filter(|m| shown_mention(m)) {
-            if let Some(rel) = mention_relation(m.relation.as_deref()) {
-                out.entry(post_key(own, &m.target_item_id))
-                    .or_default()
-                    .add(rel, false);
-            }
+    pub fn is_empty(&self) -> bool {
+        self.up.total() == 0 && self.down.total() == 0
+    }
+
+    /// The studio's `glyphCounts`: "up · down", uncapped.
+    pub fn label(&self) -> String {
+        format!("{} · {}", self.up.total(), self.down.total())
+    }
+
+    /// The tooltip: the counts by kind, each side in words.
+    pub fn tip(&self) -> String {
+        let mut lines = Vec::new();
+        let u = self.up.words();
+        if !u.is_empty() {
+            lines.push(format!("Draws on {}: {}", self.up.total(), u.join(", ")));
+        }
+        let d = self.down.words();
+        if !d.is_empty() {
+            lines.push(format!(
+                "{} known here draw{} on it: {}",
+                self.down.total(),
+                if self.down.total() == 1 { "s" } else { "" },
+                d.join(", ")
+            ));
         }
+        lines.push("⌘J or a click: see who".into());
+        lines.join("\n")
     }
-    out
 }
 
 // ------------------------------------------------------------------ the view's model
@@ -142,7 +181,9 @@ pub fn down_index(
 /// One neighbour of the centre.
 #[derive(Debug, Clone, PartialEq)]
 pub struct Node {
+    /// Its origin; a `{url}` stub's URL (with an empty `id`).
     pub origin: String,
+    /// Empty for a neighbour that isn't a post (a `{url}` stub).
     pub id: String,
     pub relation: Relation,
     pub partial: bool,
@@ -153,6 +194,13 @@ pub struct Node {
     pub held: Option<ReadingItem>,
 }
 
+impl Node {
+    /// It's a post, so it can be the centre.
+    pub fn is_post(&self) -> bool {
+        !self.id.is_empty() && !self.origin.is_empty()
+    }
+}
+
 /// The post in the middle.
 #[derive(Debug, Clone, PartialEq)]
 pub struct Centre {
@@ -167,13 +215,48 @@ pub struct Centre {
     pub own: bool,
 }
 
+impl Centre {
+    /// How the lineage route names it.
+    pub fn query(&self) -> blyg_core::lineage::Centre {
+        use blyg_core::lineage::Centre as C;
+        match (&self.held, self.own) {
+            (Some(r), _) if !r.subscription_id.is_empty() => C::Imported {
+                sub: r.subscription_id.clone(),
+                id: r.remote_id.clone(),
+            },
+            (_, true) => C::Own(self.id.clone()),
+            _ => C::Remote {
+                origin: self.origin.clone(),
+                id: self.id.clone(),
+            },
+        }
+    }
+}
+
 #[derive(Debug, Clone, PartialEq)]
 pub struct Model {
     pub centre: Centre,
     /// What the centre draws on, in the order it names them.
     pub ups: Vec<Node>,
-    /// What draws on it, newest first.
+    /// What draws on it: held posts first, then mention-only ones.
     pub downs: Vec<Node>,
+    /// The neighbours are the node's (`lineage-glyph`), not this Mac's.
+    pub served: bool,
+}
+
+impl Model {
+    /// How many of each kind on each side: the lists counted, so the counts
+    /// and what's listed always agree.
+    pub fn summary(&self) -> LineageSummary {
+        let mut s = LineageSummary::default();
+        for n in &self.ups {
+            s.up.bump(n.relation);
+        }
+        for n in &self.downs {
+            s.down.bump(n.relation);
+        }
+        s
+    }
 }
 
 /// What the model is built from.
@@ -182,6 +265,8 @@ pub struct Sources<'a> {
     pub own: &'a [Item],
     pub own_origin: Option<&'a str>,
     pub mentions: &'a [Mention],
+    /// Every post's edges over the above (`Local::build`).
+    pub local: &'a Local,
 }
 
 impl Sources<'_> {
@@ -204,6 +289,15 @@ impl Sources<'_> {
                     .is_some_and(|s| s.0.eq_ignore_ascii_case(id))
         })
     }
+
+    /// (title, who) of a post, as well as this Mac can say.
+    fn describe(&self, origin: &str, id: &str) -> Option<(String, String, Option<ReadingItem>)> {
+        if let Some(h) = self.held(origin, id) {
+            return Some((vm::post_title(h), who_of(h), Some(h.clone())));
+        }
+        self.own_item(origin, id)
+            .map(|i| (i.title(), "you".to_string(), None))
+    }
 }
 
 fn who_of(r: &ReadingItem) -> String {
@@ -217,12 +311,10 @@ fn who_of(r: &ReadingItem) -> String {
         .unwrap_or_else(|| r.subscription_title.clone())
 }
 
-/// Build the view of `(origin, id)`. `responses` is `Backend::responses`
-/// for it (reading rows and your own posts).
-pub fn build(origin: &str, id: &str, src: &Sources, responses: Vec<Response>) -> Model {
+fn centre_of(origin: &str, id: &str, src: &Sources) -> Centre {
     let held = src.held(origin, id).cloned();
     let own = src.own_item(origin, id);
-    let centre = match (&held, own) {
+    match (&held, own) {
         (Some(r), _) => Centre {
             origin: r.origin.clone(),
             id: r.remote_id.clone(),
@@ -250,102 +342,205 @@ pub fn build(origin: &str, id: &str, src: &Sources, responses: Vec<Response>) ->
             held: None,
             own: false,
         },
-    };
+    }
+}
 
-    // What it draws on: its own references, described as well as we can.
-    let refs: Vec<PostRef> = match (&held, own) {
-        (Some(r), _) => r.references(),
-        (None, Some(i)) => i.references(src.own_origin.unwrap_or(origin), src.rows),
-        _ => vec![],
-    };
+/// Build the view of `(origin, id)` from what this Mac holds.
+pub fn build(origin: &str, id: &str, src: &Sources) -> Model {
+    let centre = centre_of(origin, id, src);
     let cited = |rid: &str| {
-        held.as_ref().and_then(|r| {
+        centre.held.as_ref().and_then(|r| {
             r.transclusions
                 .iter()
                 .find(|t| t.id.eq_ignore_ascii_case(rid))
                 .and_then(|t| t.cited.clone())
         })
     };
-    let ups = refs
-        .into_iter()
-        .map(|r| {
-            let h = src.held(&r.origin, &r.id).cloned();
-            let mine = src.own_item(&r.origin, &r.id);
-            let c = cited(&r.id);
-            let (title, who) = match (&h, mine) {
-                (Some(h), _) => (vm::post_title(h), who_of(h)),
-                (None, Some(i)) => (i.title(), "you".into()),
-                (None, None) => (
-                    c.as_ref()
-                        .and_then(|c| c.excerpt.clone().or(c.source.clone()))
-                        .unwrap_or_else(|| format!("A post on {}", vm::host(&r.origin))),
-                    c.as_ref()
-                        .and_then(|c| c.author.clone())
-                        .unwrap_or_else(|| vm::host(&r.origin)),
-                ),
+    // What it draws on: its own references, described as well as we can.
+    let ups = src
+        .local
+        .up(&centre.origin, &centre.id)
+        .iter()
+        .map(|e| {
+            let (origin, id) = match &e.peer {
+                Peer::Post { origin, id } => (origin.clone(), id.clone()),
+                Peer::Url(u) => (u.clone(), String::new()),
+                Peer::Bare(id) => (String::new(), id.clone()),
+            };
+            let (title, who, held) = match src.describe(&origin, &id) {
+                Some(d) if !id.is_empty() => d,
+                _ => {
+                    let c = cited(&id);
+                    let host = if origin.is_empty() {
+                        "an unknown blyg".to_string()
+                    } else {
+                        vm::host(&origin)
+                    };
+                    (
+                        c.as_ref()
+                            .and_then(|c| c.excerpt.clone().or(c.source.clone()))
+                            .unwrap_or_else(|| {
+                                if id.is_empty() {
+                                    format!("A page on {host}")
+                                } else {
+                                    format!("A post on {host}")
+                                }
+                            }),
+                        c.as_ref().and_then(|c| c.author.clone()).unwrap_or(host),
+                        None,
+                    )
+                }
             };
             Node {
-                origin: r.origin,
-                id: r.id,
-                relation: r.relation,
-                partial: r.partial,
+                origin,
+                id,
+                relation: e.relation,
+                partial: e.partial,
                 title,
                 who,
-                held: h,
+                held,
             }
         })
         .collect();
 
-    // What draws on it: responses held here, then verified mentions of
-    // your post that no held post accounts for.
-    let mut downs: Vec<Node> = responses
-        .into_iter()
-        .map(|r| Node {
-            origin: r.item.origin.clone(),
-            id: r.item.remote_id.clone(),
-            relation: r.relation,
-            partial: r.partial,
-            title: vm::post_title(&r.item),
-            who: who_of(&r.item),
-            held: (!r.item.subscription_id.is_empty()).then_some(r.item),
+    // What draws on it: held posts, then mentions no held post accounts for.
+    let downs = src
+        .local
+        .down(&centre.origin, &centre.id)
+        .iter()
+        .filter_map(|e| {
+            let Peer::Post { origin, id } = &e.peer else {
+                return None;
+            };
+            let mention = (e.via == Via::Mention)
+                .then(|| {
+                    src.mentions.iter().find(|m| {
+                        m.source_id
+                            .as_deref()
+                            .is_some_and(|s| s.eq_ignore_ascii_case(id))
+                    })
+                })
+                .flatten();
+            let (origin, title, who, held) = match (src.describe(origin, id), mention) {
+                (Some((t, w, h)), _) => (origin.clone(), t, w, h),
+                (None, Some(m)) => {
+                    let o = m.source_origin.clone().unwrap_or_else(|| m.source.clone());
+                    (
+                        o.clone(),
+                        format!("A post on {}", vm::host(&o)),
+                        m.source_author
+                            .as_ref()
+                            .and_then(|a| a.name.clone())
+                            .filter(|n| !n.trim().is_empty())
+                            .unwrap_or_else(|| vm::host(&o)),
+                        None,
+                    )
+                }
+                (None, None) => (
+                    origin.clone(),
+                    format!("A post on {}", vm::host(origin)),
+                    vm::host(origin),
+                    None,
+                ),
+            };
+            Some(Node {
+                origin,
+                id: id.clone(),
+                relation: e.relation,
+                partial: e.partial,
+                title,
+                who,
+                held,
+            })
         })
         .collect();
-    if centre.own {
-        for m in src
-            .mentions
-            .iter()
-            .filter(|m| shown_mention(m) && m.target_item_id.eq_ignore_ascii_case(&centre.id))
-        {
-            let (Some(rel), Some(sid)) = (mention_relation(m.relation.as_deref()), &m.source_id)
-            else {
-                continue;
-            };
-            let sorigin = m.source_origin.clone().unwrap_or_else(|| m.source.clone());
-            let key = post_key(&sorigin, sid);
-            if downs.iter().any(|d| post_key(&d.origin, &d.id) == key) {
-                continue;
-            }
-            let h = src.held(&sorigin, sid).cloned();
-            downs.push(Node {
-                title: h
-                    .as_ref()
-                    .map(vm::post_title)
-                    .unwrap_or_else(|| format!("A post on {}", vm::host(&sorigin))),
-                who: m
-                    .source_author
-                    .as_ref()
-                    .and_then(|a| a.name.clone())
-                    .filter(|n| !n.trim().is_empty())
-                    .unwrap_or_else(|| vm::host(&sorigin)),
-                origin: sorigin,
-                id: sid.clone(),
-                relation: rel,
-                partial: false,
-                held: h,
-            });
+    Model {
+        centre,
+        ups,
+        downs,
+        served: false,
+    }
+}
+
+/// Build the view of `(origin, id)` from the graph the node served: its
+/// neighbours, described by the node, matched to what this Mac holds.
+pub fn from_graph(origin: &str, id: &str, src: &Sources, graph: &LineageGraph) -> Model {
+    let centre = centre_of(origin, id, src);
+    let node = |n: &blyg_core::lineage::GraphNode| {
+        let p = &n.post;
+        let (origin, id) = match (&p.origin, &p.id) {
+            (Some(o), Some(i)) => (o.clone(), i.clone()),
+            (o, i) => (
+                o.clone().or(p.url.clone()).unwrap_or_default(),
+                i.clone().unwrap_or_default(),
+            ),
+        };
+        let mine = p.held == Some(blyg_core::lineage::Held::Own);
+        let local = (!id.is_empty())
+            .then(|| src.describe(&origin, &id))
+            .flatten();
+        let host = if origin.is_empty() {
+            "an unknown blyg".to_string()
+        } else {
+            vm::host(&origin)
+        };
+        let title = local
+            .as_ref()
+            .map(|d| d.0.clone())
+            .or_else(|| p.title.clone().filter(|t| !t.trim().is_empty()))
+            .or_else(|| p.excerpt.clone().filter(|t| !t.trim().is_empty()))
+            .unwrap_or_else(|| format!("A post on {host}"));
+        let who = if mine {
+            "you".to_string()
+        } else {
+            local
+                .as_ref()
+                .map(|d| d.1.clone())
+                .or_else(|| p.source.clone().filter(|s| !s.trim().is_empty()))
+                .unwrap_or(host)
+        };
+        Node {
+            origin,
+            id,
+            relation: n.relation.into(),
+            partial: n.partial,
+            title,
+            who,
+            held: local.and_then(|d| d.2),
         }
+    };
+    Model {
+        centre,
+        ups: graph.ancestors.iter().map(node).collect(),
+        downs: graph.descendants.iter().map(node).collect(),
+        served: true,
+    }
+}
+
+/// One side's count in words, beside the hexagon: "draws on 2" /
+/// "3 known here draw on it".
+pub fn side_words(c: RelationCounts, up: bool) -> String {
+    match (up, c.total()) {
+        (true, 0) => "draws on nothing".into(),
+        (true, n) => format!("draws on {n}"),
+        (false, 0) => "nothing known here draws on it".into(),
+        (false, 1) => "1 known here draws on it".into(),
+        (false, n) => format!("{n} known here draw on it"),
+    }
+}
+
+/// How many have already done what a ring action would do, known here.
+pub fn already_words(rel: Relation, n: u32) -> String {
+    let (one, many) = match rel {
+        Relation::Forks => ("fork", "forks"),
+        Relation::Stubs => ("reply", "replies"),
+        Relation::Quotes => ("quote", "quotes"),
+    };
+    match n {
+        0 => format!("No {many} of it known here yet."),
+        1 => format!("1 {one} of it known here."),
+        n => format!("{n} {many} of it known here."),
     }
-    Model { centre, ups, downs }
 }
 
 /// How a neighbour relates, from its side of the edge.
@@ -634,22 +829,48 @@ mod tests {
     }
 
     #[test]
-    fn kinds_say_presence_never_how_many() {
+    fn kinds_count_and_mark_passages() {
         let mut k = Kinds::default();
         k.add(Relation::Stubs, true);
         assert_eq!(k.stub, Mark::Partial);
+        assert_eq!(k.words(), ["1 reply (of a passage)"]);
         k.add(Relation::Stubs, false);
         k.add(Relation::Stubs, true);
         assert_eq!(k.stub, Mark::Whole);
         assert_eq!(k.fork, Mark::None);
-        assert_eq!(k.words(false), ["replied to"]);
-        for w in Kinds::default().words(true) {
-            assert!(!w.chars().any(|c| c.is_ascii_digit()));
-        }
+        assert_eq!(k.counts.stub, 3);
+        assert_eq!(k.words(), ["3 replies"]);
+        assert!(Kinds::default().words().is_empty());
+    }
+
+    #[test]
+    fn the_nodes_counts_win_over_this_macs() {
+        let mut k = Kinds::default();
+        k.add(Relation::Quotes, true);
+        k.add(Relation::Forks, false);
+        let served = k.served(RelationCounts {
+            stub: 2,
+            transclusion: 4,
+            fork: 0,
+        });
+        assert_eq!(
+            (served.fork, served.stub, served.quote),
+            (Mark::None, Mark::Whole, Mark::Partial)
+        );
+        assert_eq!(served.total(), 6);
+        let g = Glyph {
+            up: Kinds::default(),
+            down: served,
+        };
+        assert_eq!(g.label(), "0 · 6");
+        assert_eq!(
+            g.tip(),
+            "6 known here draw on it: 2 replies, 4 quotes (of passages)\n⌘J or a click: see who"
+        );
     }
 
     #[test]
-    fn the_down_index_takes_rows_your_posts_and_mentions() {
+    fn the_glyph_counts_rows_your_posts_and_mentions() {
         let mut reply = row(BO, "R", "Re");
         reply.stub_of = Some(StubOf {
             origin: Some(ADA.into()),
@@ -657,14 +878,12 @@ mod tests {
             version: Some(1),
             url: None,
         });
-        let (o, i) = post_key(ADA, "T");
-        let own = vec![PostRef {
-            origin: o,
-            id: i,
-            relation: Relation::Forks,
-            version: Some(1),
-            partial: false,
-        }];
+        let mut fork = mine("F1", "Forked");
+        fork.forked_from = Some(RemoteRef {
+            origin: ADA.into(),
+            id: "T".into(),
+            version: 1,
+        });
         let m = Mention {
             id: "m".into(),
             target_item_id: "MINE".into(),
@@ -680,17 +899,22 @@ mod tests {
             verified_at: None,
             hidden: false,
         };
-        let idx = down_index(&[reply], &own, &[m], Some(ME));
-        let t = idx[&post_key(ADA, "T")];
+        let local = Local::build(&[reply], &[fork], Some(ME), &[m]);
+        let t = Glyph::of(&local, ADA, "T", None);
         assert_eq!(
-            (t.fork, t.stub, t.quote),
+            (t.down.fork, t.down.stub, t.down.quote),
             (Mark::Whole, Mark::Whole, Mark::None)
         );
-        assert_eq!(idx[&post_key(ME, "mine")].quote, Mark::Whole);
+        assert_eq!(t.label(), "0 · 2");
+        assert_eq!(
+            Glyph::of(&local, ME, "mine", None).down.counts.transclusion,
+            1
+        );
+        assert_eq!(Glyph::of(&local, BO, "R", None).label(), "1 · 0");
     }
 
     #[test]
-    fn the_model_has_one_step_each_way() {
+    fn the_model_has_one_step_each_way_and_counts_what_it_lists() {
         const T: &str = "01ARZ3NDEKTSV4RRFFQ69G5FAV";
         let mut centre = row(ADA, T, "Tides\nbody");
         centre.forked_from = Some(RemoteRef {
@@ -713,14 +937,15 @@ mod tests {
         let kit = row(BO, "K", "Kit's original");
         let own = mine("Q1", &format!("Mine\n![[{T}]]"));
         let rows = [centre.clone(), kit];
+        let local = Local::build(&rows, std::slice::from_ref(&own), Some(ME), &[]);
         let src = Sources {
             rows: &rows,
             own: std::slice::from_ref(&own),
             own_origin: Some(ME),
             mentions: &[],
+            local: &local,
         };
-        let responses = blyg_core::model::own_responses(std::slice::from_ref(&own), ME, ADA, T);
-        let m = build(ADA, &T.to_lowercase(), &src, responses);
+        let m = build(ADA, &T.to_lowercase(), &src);
         assert_eq!(m.centre.title, "Tides");
         let ups: Vec<(&str, Relation, &str)> = m
             .ups
@@ -739,6 +964,10 @@ mod tests {
             (m.downs[0].who.as_str(), m.downs[0].relation),
             ("you", Relation::Quotes)
         );
+        // The view's counts are the glyph's.
+        assert_eq!(m.summary(), local.summary(ADA, T));
+        assert_eq!(m.summary().label(), "2 · 1");
+        assert!(!m.served);
         // Arrows: up to the middle of the row above, along it, back down.
         assert_eq!(m.step(Sel::Centre, "up"), Sel::Up(1));
         assert_eq!(m.step(Sel::Up(1), "left"), Sel::Up(0));
@@ -747,6 +976,61 @@ mod tests {
         assert_eq!(m.step(Sel::Centre, "down"), Sel::Down(0));
     }
 
+    #[test]
+    fn a_served_graph_becomes_the_model() {
+        const T: &str = "01ARZ3NDEKTSV4RRFFQ69G5FAV";
+        let centre = row(ADA, T, "Tides");
+        let held = row(BO, "K", "Kit's reply");
+        let rows = [centre, held];
+        let local = Local::build(&rows, &[], Some(ME), &[]);
+        let src = Sources {
+            rows: &rows,
+            own: &[],
+            own_origin: Some(ME),
+            mentions: &[],
+            local: &local,
+        };
+        let graph: LineageGraph = serde_json::from_value(serde_json::json!({
+            "node": { "origin": ADA, "id": T, "version": 1, "held": "imported", "sub": "S",
+                      "kind": "thread", "title": "Tides", "excerpt": null, "source": "Ada", "url": null },
+            "ancestors": [
+                { "origin": null, "id": null, "version": null, "held": null, "sub": null, "kind": null,
+                  "title": null, "excerpt": null, "source": "News site", "url": "https://news.example/s",
+                  "relation": "stub", "partial": false, "via": "reference" }
+            ],
+            "descendants": [
+                { "origin": BO, "id": "K", "version": 1, "held": "imported", "sub": "S2", "kind": "thread",
+                  "title": "K", "excerpt": null, "source": "Bo", "url": null,
+                  "relation": "transclusion", "partial": true, "via": "reference" },
+                { "origin": ME, "id": "M1", "version": 1, "held": "own", "sub": null, "kind": "fragment",
+                  "title": "Mine", "excerpt": null, "source": "you", "url": null,
+                  "relation": "fork", "partial": false, "via": "reference" }
+            ]
+        }))
+        .unwrap();
+        let m = from_graph(ADA, T, &src, &graph);
+        assert!(m.served);
+        assert_eq!(m.summary(), graph.summary());
+        assert_eq!(
+            (
+                m.ups[0].origin.as_str(),
+                m.ups[0].who.as_str(),
+                m.ups[0].is_post()
+            ),
+            ("https://news.example/s", "News site", false)
+        );
+        assert_eq!(m.downs[0].title, "Kit's reply", "described as held here");
+        assert!(m.downs[0].held.is_some());
+        assert_eq!(m.downs[1].who, "you");
+        assert_eq!(
+            m.centre.query(),
+            blyg_core::lineage::Centre::Imported {
+                sub: "S".into(),
+                id: T.into()
+            }
+        );
+    }
+
     #[test]
     fn the_ring_has_six_keys_in_fixed_places() {
         let keys: Vec<&str> = Act::ALL.iter().map(|a| a.key()).collect();
diff --git a/crates/blyg-app/src/reading/list.rs b/crates/blyg-app/src/reading/list.rs
index d7c76d0..3fe2a16 100644
--- a/crates/blyg-app/src/reading/list.rs
+++ b/crates/blyg-app/src/reading/list.rs
@@ -892,7 +892,7 @@ impl MainView {
                                 .child(b),
                         )
                     })
-                    // --- lineage --- which kinds, never how many.
+                    // --- lineage --- which kinds, and how many.
                     .children(self.render_lineage_glyph(r, cx))
                     .child(div().flex_1())
                     .child(when),
@@ -989,6 +989,7 @@ impl MainView {
             // --- end profiles ---
             .children(self.render_pill(o, cx))
             .children(self.render_lineage_glyph(item, cx)) // --- lineage ---
+            .children(self.slots_byline(item, cx)) // --- reading slots ---
             .child(div().flex_1())
             .when(!super::original::is_external(&o.key), |d| {
                 d.child(self.render_thumbs(item.thumb, cx))
@@ -1122,7 +1123,8 @@ impl MainView {
                     d.tooltip(move |_, cx| cx.new(|_| super::Tip(tip.clone())).into())
                 })
                 .into_any_element()
-            }));
+            }))
+            .children(self.slots_more_chip(item, cx)); // --- reading slots ---
 
         div()
             .id("reading-detail")
diff --git a/crates/blyg-app/src/reading/mod.rs b/crates/blyg-app/src/reading/mod.rs
index 7af7d44..9351ed0 100644
--- a/crates/blyg-app/src/reading/mod.rs
+++ b/crates/blyg-app/src/reading/mod.rs
@@ -24,6 +24,9 @@ pub(crate) mod lineage_vm;
 mod list;
 mod marks; // --- read/unread ---
 mod mentions;
+pub(crate) mod opml; // --- OPML import/export ---
+#[cfg(test)]
+mod opml_tests;
 pub(crate) mod pick_vm; // --- read/unread ---
 mod quote_picker;
 mod site_settings;
@@ -239,6 +242,8 @@ pub enum RSheet {
     },
     /// Lineage (⌘J).
     Lineage(Box<lineage::Sheet>),
+    /// --- OPML --- Import Subscriptions from OPML… (preview, run, summary).
+    Opml(Box<opml::Sheet>),
     /// The `[[` / `![[` picker with its own search box (⌘K, or typing the
     /// brackets with `picker_typing = panel`).
     Quote {
@@ -290,12 +295,16 @@ pub struct State {
     /// (a quote's version), when it's current or pinned.
     pub want_version: Option<u32>,
     // --- responses --- (and lineage)
-    /// What draws on each post (`post_key`s), as kinds: the glyph's right
-    /// side, never a count. From the rows, `own_refs` and the mentions.
-    pub down: HashMap<(String, String), lineage_vm::Kinds>,
-    /// What your own published posts point at, and your blyg's origin
-    /// (`MainView::refresh_own_lineage`).
-    pub own_refs: Vec<blyg_core::PostRef>,
+    /// Every post's lineage edges over what this Mac holds (the rows,
+    /// `own_posts` and the mentions): the glyph's two sides, and its counts
+    /// when the node doesn't serve them (`blyg_core::lineage::Local`).
+    pub lineage: blyg_core::lineage::Local,
+    /// The glyph counts the node serves (`lineage-glyph`), by reading entry
+    /// key (`blyg_core::lineage::imported_key`). Empty when it doesn't.
+    pub served: HashMap<String, blyg_core::lineage::LineageSummary>,
+    /// Your own published posts, and your blyg's origin
+    /// (`MainView::own_lineage`).
+    pub own_posts: Vec<blyg_core::Item>,
     pub own_origin: Option<String>,
     // --- reader folders --- the Reader's three panes.
     /// Local folders, in order, and subscription id → folder id.
@@ -354,8 +363,9 @@ impl State {
             ),
             stream: stream::Stream::new(),
             want_version: None,
-            down: HashMap::new(),
-            own_refs: Vec::new(),
+            lineage: Default::default(),
+            served: HashMap::new(),
+            own_posts: Vec::new(),
             own_origin: None,
             folders: backend.folders(),
             filed: backend.subscription_folders(),
@@ -400,11 +410,11 @@ impl State {
             let keys: Vec<vm::Key> = self.shown_rows().map(vm::key).collect();
             self.picked.retain_shown(&keys);
         }
-        self.down = lineage_vm::down_index(
+        self.lineage = blyg_core::lineage::Local::build(
             &self.rows,
-            &self.own_refs,
-            self.mentions.ready().map(Vec::as_slice).unwrap_or(&[]),
+            &self.own_posts,
             self.own_origin.as_deref(),
+            self.mentions.ready().map(Vec::as_slice).unwrap_or(&[]),
         );
     }
 
@@ -457,6 +467,7 @@ impl MainView {
         .on_action(cx.listener(|this, _: &SubscribeTo, window, cx| this.open_subscribe(window, cx)))
         .map(|d| self.stream_actions(d, cx))
         .map(|d| self.sources_actions(d, cx)) // --- reader folders ---
+        .map(|d| self.opml_actions(d, cx)) // --- OPML ---
     }
 
     /// Hook: the reading/backend event (`CoreEvent::ReadingChanged`).
@@ -487,11 +498,13 @@ impl MainView {
         } else {
             r.rows = vm::order(fresh);
         }
-        let (own_refs, own_origin) = self.own_lineage();
+        let (own_posts, own_origin) = self.own_lineage();
         let r = &mut self.reading;
-        r.own_refs = own_refs;
+        r.own_posts = own_posts;
         r.own_origin = own_origin;
         r.refilter();
+        self.refresh_lineage_counts(cx); // --- lineage counts ---
+        let r = &mut self.reading;
         if let Some(o) = &mut r.opened {
             // Fresh metadata (thumb, state), but keep the read version seen
             // at open time.
@@ -534,8 +547,9 @@ impl MainView {
                 self.reading.subs = self.backend.subscriptions();
                 self.reading.folders = self.backend.folders();
                 self.reading.filed = self.backend.subscription_folders();
-                (self.reading.own_refs, self.reading.own_origin) = self.own_lineage();
+                (self.reading.own_posts, self.reading.own_origin) = self.own_lineage();
                 self.reading.refilter();
+                self.refresh_lineage_counts(cx); // --- lineage counts ---
                 self.ensure_reading_search(window, cx);
                 if self.reading.mode == stream_vm::ReadMode::Stream {
                     self.ensure_stream_timer(window, cx);
@@ -801,6 +815,7 @@ impl MainView {
             RSheet::Lineage(s) => (880., self.render_lineage_sheet(s, cx)),
             RSheet::Folder { .. } => (420., self.render_folder_sheet(sheet, cx)), // --- reader folders ---
             RSheet::SubName { .. } => (440., self.render_sub_name_sheet(sheet, cx)),
+            RSheet::Opml(s) => (560., self.render_opml_sheet(s, cx)), // --- OPML ---
         };
         Some(self.sheet_frame(width, content, cx))
     }
diff --git a/crates/blyg-app/src/reading/opml.rs b/crates/blyg-app/src/reading/opml.rs
new file mode 100644
index 0000000..4295d02
--- /dev/null
+++ b/crates/blyg-app/src/reading/opml.rs
@@ -0,0 +1,649 @@
+//! Import subscriptions from an OPML file (another feed reader's export),
+//! and export every subscription as OPML (Blyg › Import Subscriptions from
+//! OPML… / Export Subscriptions as OPML…, and the Subscriptions screen).
+//!
+//! Import: a file picker, then a preview sheet (the Publish/Delete sheets'
+//! chrome) listing the file's feeds with ticks, grouped under the folders
+//! they had in the other reader (display only). Feeds already followed say
+//! so and start unticked. ⏎ imports the ticked ones through
+//! `blyg_core::opml::run_import`, off the main thread, slowly (see
+//! `opml::Pace`), into the local Reader folder "Imported feeds"; esc
+//! cancels (after the one in flight). A summary follows, with each
+//! failure's reason and Retry failed.
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use blyg_core::opml::{self, EXPORT_FILE_NAME, OpmlFeed, Outcome, Pace, Progress, Summary};
+use gpui_kit::prelude::FluentBuilder as _;
+use gpui_kit::*;
+
+use super::RSheet;
+use crate::app::MainView;
+
+gpui_kit::actions!(blygger, [ImportOpml, ExportOpml]);
+
+/// Where imported feeds go, in the user's words.
+pub const WHERE_THEY_GO: &str = "Added to the Imported feeds folder in the Reader";
+
+/// --- onboarding --- The tour's sample export from "another reader":
+/// one feed the sample data already follows, two it doesn't.
+const TOUR_OPML: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<opml version="2.0">
+  <head><title>Another reader's subscriptions</title></head>
+  <body>
+    <outline text="Rue" type="rss" xmlUrl="https://rue.blyg.example.com/feed.json"/>
+    <outline text="Tide Watch" type="rss" xmlUrl="https://tidewatch.example.com/feed.xml"/>
+    <outline text="Harbour Log" type="rss" xmlUrl="https://harbourlog.example.org/feed.xml"/>
+  </body>
+</opml>
+"#;
+
+/// The import pace; tests set a quicker one.
+pub struct ImportPace(pub Pace);
+
+impl Global for ImportPace {}
+
+/// One feed of the file.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Row {
+    pub feed: OpmlFeed,
+    /// The subscription that already follows it.
+    pub already: Option<String>,
+    pub ticked: bool,
+    pub outcome: Option<Outcome>,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Phase {
+    Preview,
+    Running {
+        done: usize,
+        total: usize,
+        /// Seconds the blyg asked Burrow to wait (a 429).
+        waiting: Option<u64>,
+        cancelling: bool,
+    },
+    Done(Summary),
+}
+
+/// The import sheet.
+pub struct Sheet {
+    /// The file's name, for the heading.
+    pub file: String,
+    /// Grouped by folder (first appearance), file order within each.
+    pub rows: Vec<Row>,
+    pub sel: usize,
+    pub duplicates: usize,
+    pub without_feed: usize,
+    pub phase: Phase,
+    pub cancel: Arc<AtomicBool>,
+    pub focus: FocusHandle,
+    pub scroll: ScrollHandle,
+}
+
+impl Sheet {
+    pub fn new(
+        file: String,
+        parsed: opml::Parsed,
+        subs: &[blyg_core::Subscription],
+        focus: FocusHandle,
+    ) -> Self {
+        let mut order: Vec<Option<String>> = vec![];
+        for f in &parsed.feeds {
+            if !order.contains(&f.folder) {
+                order.push(f.folder.clone());
+            }
+        }
+        // Feeds in no folder first, then each folder.
+        order.sort_by_key(|f| f.is_some());
+        let mut rows = vec![];
+        for group in &order {
+            for f in parsed.feeds.iter().filter(|f| &f.folder == group) {
+                let already = opml::followed(f, subs).map(|s| s.title.clone());
+                rows.push(Row {
+                    ticked: already.is_none(),
+                    already,
+                    feed: f.clone(),
+                    outcome: None,
+                });
+            }
+        }
+        Sheet {
+            file,
+            rows,
+            sel: 0,
+            duplicates: parsed.duplicates,
+            without_feed: parsed.without_feed,
+            phase: Phase::Preview,
+            cancel: Arc::new(AtomicBool::new(false)),
+            focus,
+            scroll: ScrollHandle::new(),
+        }
+    }
+
+    pub fn ticked(&self) -> usize {
+        self.rows.iter().filter(|r| r.ticked).count()
+    }
+
+    pub fn toggle(&mut self, i: usize) {
+        if let Some(r) = self.rows.get_mut(i) {
+            r.ticked = !r.ticked;
+        }
+    }
+
+    /// ⌘A: tick every feed not already followed, or untick all when they
+    /// already are.
+    pub fn toggle_all(&mut self) {
+        let all = self
+            .rows
+            .iter()
+            .filter(|r| r.already.is_none())
+            .all(|r| r.ticked);
+        for r in &mut self.rows {
+            r.ticked = !all && r.already.is_none();
+        }
+    }
+
+    /// The list's child index of row `i` (folder headings are children too).
+    fn child_index(&self, i: usize) -> usize {
+        let mut heads = 0;
+        let mut prev: Option<&Option<String>> = None;
+        for (j, r) in self.rows.iter().enumerate().take(i + 1) {
+            if prev != Some(&r.feed.folder) && (r.feed.folder.is_some() || j > 0) {
+                heads += 1;
+            }
+            prev = Some(&r.feed.folder);
+        }
+        i + heads
+    }
+
+    fn failed(&self) -> Vec<usize> {
+        self.rows
+            .iter()
+            .enumerate()
+            .filter(|(_, r)| matches!(r.outcome, Some(Outcome::Failed { .. })))
+            .map(|(i, _)| i)
+            .collect()
+    }
+}
+
+impl MainView {
+    /// Hook: the OPML actions on the root element.
+    pub(super) fn opml_actions(&self, d: Stateful<Div>, cx: &mut Context<Self>) -> Stateful<Div> {
+        d.on_action(cx.listener(|this, _: &ImportOpml, window, cx| this.opml_pick(window, cx)))
+            .on_action(cx.listener(|this, _: &ExportOpml, window, cx| this.opml_export(window, cx)))
+    }
+
+    /// Subscriptions live on the blyg: without one, say so.
+    fn opml_needs_blyg(&mut self, cx: &mut Context<Self>) -> bool {
+        if crate::connection::mode(cx) == Some(crate::connection::Mode::Disconnected) {
+            self.show_toast(
+                "Connect a blyg first",
+                Some("Subscriptions live on your blyg".into()),
+                cx,
+            );
+            return true;
+        }
+        false
+    }
+
+    /// Import Subscriptions from OPML…: the file picker.
+    pub(crate) fn opml_pick(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if self.opml_needs_blyg(cx) || self.reading.sheet.is_some() {
+            return;
+        }
+        // --- onboarding --- the tour's opml step: a sample file, no picker
+        // (importing it subscribes in the tour's sample data).
+        if self.onboarding.tutorial.is_some() {
+            self.tutorial_key(crate::app::onboarding::Key::OpmlImport, window, cx);
+            if let Ok(p) = opml::parse(TOUR_OPML) {
+                self.opml_open_preview("another-reader.opml".into(), p, window, cx);
+            }
+            return;
+        }
+        let rx = cx.prompt_for_paths(PathPromptOptions {
+            files: true,
+            directories: false,
+            multiple: false,
+            prompt: Some("Import".into()),
+        });
+        cx.spawn_in(window, async move |this, cx| {
+            let Ok(Ok(Some(paths))) = rx.await else {
+                return;
+            };
+            let Some(path) = paths.into_iter().next() else {
+                return;
+            };
+            let p2 = path.clone();
+            let parsed = cx
+                .background_spawn(async move { opml::read_file(&p2) })
+                .await;
+            let name = path
+                .file_name()
+                .map(|n| n.to_string_lossy().into_owned())
+                .unwrap_or_default();
+            let _ = this.update_in(cx, |v, window, cx| match parsed {
+                Ok(p) => v.opml_open_preview(name, p, window, cx),
+                Err(e) => v.show_toast(e.to_string(), None, cx),
+            });
+        })
+        .detach();
+    }
+
+    /// The preview sheet for a parsed file.
+    pub(crate) fn opml_open_preview(
+        &mut self,
+        file: String,
+        parsed: opml::Parsed,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let focus = cx.focus_handle();
+        window.focus(&focus, cx);
+        let subs = self.backend.subscriptions();
+        let sheet = Sheet::new(file, parsed, &subs, focus);
+        self.open_reading_sheet(RSheet::Opml(Box::new(sheet)), cx);
+    }
+
+    fn opml_sheet(&mut self) -> Option<&mut Sheet> {
+        match self.reading.sheet.as_mut() {
+            Some(RSheet::Opml(s)) => Some(s),
+            _ => None,
+        }
+    }
+
+    /// The preview's keys: 1–9 and space tick, ↑/↓ move, ⌘A all/none, ⏎
+    /// import, esc cancel. While importing, esc stops it; at the end ⏎ or
+    /// esc closes and r retries the failed ones.
+    fn opml_key(&mut self, ev: &KeyDownEvent, window: &mut Window, cx: &mut Context<Self>) -> bool {
+        let key = ev.keystroke.key.as_str();
+        let cmd = ev.keystroke.modifiers.secondary();
+        let Some(s) = self.opml_sheet() else {
+            return false;
+        };
+        match (&s.phase, key) {
+            (Phase::Preview, "enter") => self.opml_start(None, cx),
+            (Phase::Preview, "escape") => self.close_reading_sheet(window, cx),
+            (Phase::Preview, "a") if cmd => s.toggle_all(),
+            (Phase::Preview, "space") => {
+                let i = s.sel;
+                s.toggle(i);
+            }
+            (Phase::Preview, "down") => {
+                s.sel = (s.sel + 1).min(s.rows.len().saturating_sub(1));
+                s.scroll.scroll_to_item(s.child_index(s.sel));
+            }
+            (Phase::Preview, "up") => {
+                s.sel = s.sel.saturating_sub(1);
+                s.scroll.scroll_to_item(s.child_index(s.sel));
+            }
+            (Phase::Preview, k) if !cmd => match k.parse::<usize>() {
+                Ok(n @ 1..=9) => {
+                    s.toggle(n - 1);
+                    s.sel = (n - 1).min(s.rows.len().saturating_sub(1));
+                }
+                _ => return false,
+            },
+            (Phase::Running { .. }, "escape") => self.opml_cancel(cx),
+            (Phase::Done(_), "enter" | "escape") => self.close_reading_sheet(window, cx),
+            (Phase::Done(sum), "r") if !sum.failed.is_empty() => self.opml_retry(cx),
+            _ => return false,
+        }
+        cx.notify();
+        true
+    }
+
+    /// Esc while importing: stop after the ones in flight.
+    pub(crate) fn opml_cancel(&mut self, cx: &mut Context<Self>) {
+        if let Some(s) = self.opml_sheet() {
+            s.cancel.store(true, Ordering::Relaxed);
+            if let Phase::Running { cancelling, .. } = &mut s.phase {
+                *cancelling = true;
+            }
+            cx.notify();
+        }
+    }
+
+    /// Retry failed: tick only the failed ones and run them again.
+    pub(crate) fn opml_retry(&mut self, cx: &mut Context<Self>) {
+        let Some(s) = self.opml_sheet() else {
+            return;
+        };
+        let failed = s.failed();
+        self.opml_start(Some(failed), cx);
+    }
+
+    /// ⏎ Import N: run the ticked feeds (or `only` these rows).
+    pub(crate) fn opml_start(&mut self, only: Option<Vec<usize>>, cx: &mut Context<Self>) {
+        let pace = cx
+            .try_global::<ImportPace>()
+            .map(|p| p.0)
+            .unwrap_or_default();
+        let Some(s) = self.opml_sheet() else {
+            return;
+        };
+        let picked: Vec<usize> = match only {
+            Some(v) => v,
+            None => (0..s.rows.len()).filter(|&i| s.rows[i].ticked).collect(),
+        };
+        if picked.is_empty() {
+            return;
+        }
+        for &i in &picked {
+            s.rows[i].outcome = None;
+        }
+        let feeds: Vec<OpmlFeed> = picked.iter().map(|&i| s.rows[i].feed.clone()).collect();
+        s.cancel = Arc::new(AtomicBool::new(false));
+        let cancel = s.cancel.clone();
+        s.phase = Phase::Running {
+            done: 0,
+            total: feeds.len(),
+            waiting: None,
+            cancelling: false,
+        };
+        let backend = self.backend.clone();
+        let (tx, rx) = async_channel::unbounded::<Progress>();
+        let task = cx.background_spawn(async move {
+            opml::run_import(backend.as_ref(), &feeds, &pace, &cancel, &|p| {
+                let _ = tx.send_blocking(p);
+            })
+        });
+        cx.spawn(async move |this, cx| {
+            while let Ok(p) = rx.recv().await {
+                let picked = picked.clone();
+                let _ = this.update(cx, |v, cx| {
+                    if let Some(s) = v.opml_sheet()
+                        && let Phase::Running { done, waiting, .. } = &mut s.phase
+                    {
+                        match p {
+                            Progress::Waiting { seconds } => *waiting = Some(seconds),
+                            Progress::Done { index, outcome } => {
+                                *done += 1;
+                                *waiting = None;
+                                if let Some(&row) = picked.get(index) {
+                                    s.rows[row].outcome = Some(outcome);
+                                }
+                            }
+                        }
+                    }
+                    cx.notify();
+                });
+            }
+            let results = task.await;
+            let _ = this.update(cx, |v, cx| {
+                if let Some(s) = v.opml_sheet() {
+                    s.phase = Phase::Done(Summary::of(&results));
+                }
+                v.reading_changed(cx);
+                cx.notify();
+            });
+        })
+        .detach();
+        cx.notify();
+    }
+
+    /// Export Subscriptions as OPML…: a save dialog, then the file.
+    pub(crate) fn opml_export(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if self.opml_needs_blyg(cx) {
+            return;
+        }
+        let subs = self.backend.subscriptions();
+        if subs.is_empty() {
+            self.show_toast("No subscriptions to export", None, cx);
+            return;
+        }
+        let dir = blyg_core::config::paths::home_var()
+            .map(std::path::PathBuf::from)
+            .unwrap_or_else(std::env::temp_dir);
+        let rx = cx.prompt_for_new_path(&dir, Some(EXPORT_FILE_NAME));
+        cx.spawn_in(window, async move |this, cx| {
+            let Ok(Ok(Some(path))) = rx.await else {
+                return;
+            };
+            let n = subs.len();
+            let r = std::fs::write(&path, opml::export(&subs));
+            let _ = this.update(cx, |v, cx| match r {
+                Ok(()) => v.show_toast(
+                    format!("Exported {n} subscription{}", if n == 1 { "" } else { "s" }),
+                    Some(blyg_core::config::paths::tilde(&path).into()),
+                    cx,
+                ),
+                Err(e) => v.show_toast(format!("Couldn't save the file: {e}"), None, cx),
+            });
+        })
+        .detach();
+    }
+
+    // ------------------------------------------------------------ render
+
+    pub(super) fn render_opml_sheet(&self, s: &Sheet, cx: &mut Context<Self>) -> AnyElement {
+        let p = self.palette.on_page();
+        let theme = &*self.theme;
+        let running = matches!(s.phase, Phase::Running { .. });
+        let mut list = div()
+            .id("opml-list")
+            .debug_selector(|| "opml-list".into())
+            .flex()
+            .flex_col()
+            .max_h(px(340.))
+            .overflow_y_scroll()
+            .track_scroll(&s.scroll);
+        let mut prev: Option<&Option<String>> = None;
+        for (i, r) in s.rows.iter().enumerate() {
+            if prev != Some(&r.feed.folder) && (r.feed.folder.is_some() || i > 0) {
+                list = list.child(
+                    div()
+                        .mt(px(if i == 0 { 0. } else { 8. }))
+                        .mb(px(2.))
+                        .text_size(px(11.))
+                        .font_weight(FontWeight::SEMIBOLD)
+                        .text_color(p.muted)
+                        .child(r.feed.folder.clone().unwrap_or_else(|| "No folder".into())),
+                );
+            }
+            prev = Some(&r.feed.folder);
+            let on = r.ticked;
+            let selected = i == s.sel && matches!(s.phase, Phase::Preview);
+            let status: Option<(String, Hsla)> = match &r.outcome {
+                Some(Outcome::Added { .. }) => Some(("added".into(), p.green)),
+                Some(Outcome::AlreadyFollowing) => Some(("already following".into(), p.muted)),
+                Some(Outcome::Failed { kind, reason }) => {
+                    Some((format!("{}: {reason}", kind.label()), p.over))
+                }
+                None if r.already.is_some() => Some(("already following".into(), p.muted)),
+                None => None,
+            };
+            list = list.child(
+                div()
+                    .id(("opml-row", i))
+                    .debug_selector(move || format!("opml-row-{i}"))
+                    .flex()
+                    .items_start()
+                    .gap(px(8.))
+                    .px(px(4.))
+                    .py(px(3.))
+                    .rounded(px(5.))
+                    .when(selected, |d| d.bg(p.sel))
+                    .when(!running, |d| d.cursor_pointer())
+                    .on_click(cx.listener(move |this, _, _, cx| {
+                        if let Some(s) = this.opml_sheet()
+                            && s.phase == Phase::Preview
+                        {
+                            s.toggle(i);
+                            s.sel = i;
+                            cx.notify();
+                        }
+                    }))
+                    .child(
+                        div()
+                            .flex_none()
+                            .mt(px(1.))
+                            .size(px(15.))
+                            .flex()
+                            .items_center()
+                            .justify_center()
+                            .map(|d| crate::theme_ext::chip(d, theme, on))
+                            .text_size(px(11.))
+                            .when(on, |d| d.bg(p.pick()))
+                            .child(if on { "✓" } else { "" }),
+                    )
+                    .child(
+                        div()
+                            .flex_1()
+                            .min_w_0()
+                            .when(!on, |d| d.text_color(p.muted))
+                            .child(div().truncate().child(r.feed.title.clone()))
+                            .child(
+                                div()
+                                    .text_size(px(11.))
+                                    .text_color(p.muted)
+                                    .truncate()
+                                    .child(r.feed.xml_url.clone()),
+                            )
+                            .when_some(status, |d, (text, color)| {
+                                d.child(div().text_size(px(11.5)).text_color(color).child(text))
+                            }),
+                    )
+                    .when(i < 9, |d| {
+                        d.child(
+                            div()
+                                .flex_none()
+                                .text_size(px(10.5))
+                                .text_color(p.muted)
+                                .child(format!("{}", i + 1)),
+                        )
+                    }),
+            );
+        }
+        let n = s.ticked();
+        let mut notes = vec![];
+        if s.duplicates > 0 {
+            notes.push(format!(
+                "{} duplicate{} collapsed",
+                s.duplicates,
+                if s.duplicates == 1 { "" } else { "s" }
+            ));
+        }
+        if s.without_feed > 0 {
+            notes.push(format!("{} without a feed address skipped", s.without_feed));
+        }
+        let (status_line, keys): (String, Vec<AnyElement>) = match &s.phase {
+            Phase::Preview => (
+                format!(
+                    "{WHERE_THEY_GO}, slowly (each new subscription fetches its archive). \
+                     Imported feeds aren't added to your public blogroll."
+                ),
+                vec![
+                    crate::platform::key_button(
+                        div()
+                            .flex()
+                            .items_center()
+                            .gap(px(5.))
+                            .child(self.kbd("⏎"))
+                            .child(format!("import {n}")),
+                        "opml-import",
+                        cx.listener(|this, _, _, cx| this.opml_start(None, cx)),
+                    )
+                    .when(n > 0, |d| d.text_color(p.accent_text()))
+                    .into_any_element(),
+                    crate::platform::key_button(
+                        self.key_hint("esc", "cancel"),
+                        "opml-cancel",
+                        cx.listener(|this, _, window, cx| this.close_reading_sheet(window, cx)),
+                    )
+                    .into_any_element(),
+                    self.key_hint(crate::keymap::hint("⌘A"), "all/none")
+                        .into_any_element(),
+                    div().child("1–9 or space tick").into_any_element(),
+                ],
+            ),
+            Phase::Running {
+                done,
+                total,
+                waiting,
+                cancelling,
+            } => (
+                match (cancelling, waiting) {
+                    (true, _) => {
+                        format!("Stopping after the current one… ({done} of {total} done)")
+                    }
+                    (false, Some(w)) => format!(
+                        "Importing {} of {total}. The blyg asked Burrow to slow down: waiting {w} s",
+                        (done + 1).min(*total)
+                    ),
+                    (false, None) => format!("Importing {} of {total}…", (done + 1).min(*total)),
+                },
+                vec![
+                    crate::platform::key_button(
+                        self.key_hint("esc", "stop"),
+                        "opml-stop",
+                        cx.listener(|this, _, _, cx| this.opml_cancel(cx)),
+                    )
+                    .into_any_element(),
+                ],
+            ),
+            Phase::Done(sum) => {
+                let mut keys = vec![
+                    crate::platform::key_button(
+                        self.key_hint("⏎", "done"),
+                        "opml-done",
+                        cx.listener(|this, _, window, cx| this.close_reading_sheet(window, cx)),
+                    )
+                    .into_any_element(),
+                ];
+                if !sum.failed.is_empty() {
+                    keys.push(
+                        self.key_hint("r", "retry failed")
+                            .id("opml-retry")
+                            .debug_selector(|| "opml-retry".into())
+                            .cursor_pointer()
+                            .text_color(p.accent_text())
+                            .on_click(cx.listener(|this, _, _, cx| this.opml_retry(cx)))
+                            .into_any_element(),
+                    );
+                }
+                let mut line = sum.line();
+                if sum.added > 0 {
+                    line.push_str(&format!(". {WHERE_THEY_GO}."));
+                }
+                (line, keys)
+            }
+        };
+        let heading = match &s.phase {
+            Phase::Done(_) => "Import finished".to_string(),
+            _ => format!("Import subscriptions from {}", s.file),
+        };
+        div()
+            .track_focus(&s.focus)
+            .on_key_down(cx.listener(|this, ev: &KeyDownEvent, window, cx| {
+                if this.opml_key(ev, window, cx) {
+                    cx.stop_propagation();
+                }
+            }))
+            .child(self.sheet_heading(heading))
+            .child(div().mb(px(8.)).text_color(p.muted).child(format!(
+                "{} feed{} in the file{}",
+                s.rows.len(),
+                if s.rows.len() == 1 { "" } else { "s" },
+                if notes.is_empty() {
+                    String::new()
+                } else {
+                    format!(" · {}", notes.join(" · "))
+                }
+            )))
+            .child(list)
+            .child(
+                div()
+                    .id("opml-status")
+                    .debug_selector(|| "opml-status".into())
+                    .mt(px(10.))
+                    .text_size(px(12.))
+                    .line_height(relative(1.45))
+                    .text_color(p.muted)
+                    .child(status_line),
+            )
+            .child(self.keys_row(vec![]).children(keys))
+            .into_any_element()
+    }
+}
diff --git a/crates/blyg-app/src/reading/opml_tests.rs b/crates/blyg-app/src/reading/opml_tests.rs
new file mode 100644
index 0000000..df863a7
--- /dev/null
+++ b/crates/blyg-app/src/reading/opml_tests.rs
@@ -0,0 +1,240 @@
+//! The OPML import sheet: ticks, already-following, the run's summary and
+//! filing, retry and cancel, through real keystrokes on a zero-latency
+//! FakeBackend. (What the server answers is the e2e's job, against a real
+//! local studio.)
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use blyg_core::config::MemoryTokenStore;
+use blyg_core::opml::{self, FailKind, IMPORT_FOLDER, Outcome, Pace};
+use blyg_core::{Backend, ConfigStore};
+use gpui_kit::{Entity, TestAppContext, VisualTestContext};
+
+use super::RSheet;
+use super::opml::{ImportPace, Phase, Sheet};
+use crate::app::MainView;
+use crate::fake::{FakeBackend, Timing};
+use crate::prefs::Prefs;
+
+const CONNECTED: &str = "# test config\nblyg-url = https://blyg.example.com\n";
+
+/// One already followed (Rue's blyg, by its origin), one that can't be
+/// resolved, two new feeds in a folder, and a duplicate.
+const FILE: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<opml version="2.0"><head><title>Export</title></head><body>
+  <outline text="Rue" xmlUrl="https://rue.blyg.example.com/feed.xml" htmlUrl="https://rue.blyg.example.com/"/>
+  <outline text="Dead" xmlUrl="https://dead.invalid/rss"/>
+  <outline text="Tech">
+    <outline type="rss" text="Kit" xmlUrl="https://kit.example.org/feed.xml"/>
+    <outline type="rss" text="Moss" xmlUrl="https://moss.example.net/rss.xml"/>
+    <outline type="rss" text="Kit again" xmlUrl="https://kit.example.org/feed.xml"/>
+  </outline>
+</body></opml>"#;
+
+fn setup(cx: &mut TestAppContext) -> (Entity<MainView>, Arc<FakeBackend>, &mut VisualTestContext) {
+    let prefs = Prefs::from_config(ConfigStore::in_memory(CONNECTED).config());
+    cx.update(|cx| {
+        gpui_kit::init(cx);
+        crate::app::bind_keys(cx);
+        crate::settings::init(
+            ConfigStore::in_memory(CONNECTED),
+            Arc::new(MemoryTokenStore::default()),
+            None,
+            cx,
+        );
+        cx.set_global(ImportPace(Pace {
+            // One at a time runs on the task's own thread: the test
+            // scheduler refuses wakes from threads it doesn't know.
+            concurrency: 1,
+            interval: Duration::ZERO,
+            max_waits: 1,
+        }));
+    });
+    let fake = Arc::new(FakeBackend::with_timing(Timing::instant()).without_media_cache());
+    let backend: Arc<dyn Backend> = fake.clone();
+    let f2 = fake.clone();
+    let (view, cx) = cx.add_window_view(move |window, cx| {
+        MainView::new(
+            backend,
+            Some(f2),
+            prefs,
+            std::time::Instant::now(),
+            window,
+            cx,
+        )
+    });
+    cx.run_until_parked();
+    (view, fake, cx)
+}
+
+fn settle(cx: &mut VisualTestContext) {
+    for _ in 0..30 {
+        cx.run_until_parked();
+        std::thread::sleep(Duration::from_millis(3));
+    }
+}
+
+fn open(view: &Entity<MainView>, cx: &mut VisualTestContext) {
+    let parsed = opml::parse(FILE).unwrap();
+    view.update_in(cx, |v, window, cx| {
+        v.opml_open_preview("export.opml".into(), parsed, window, cx)
+    });
+    cx.run_until_parked();
+}
+
+fn sheet<R>(view: &Entity<MainView>, cx: &mut VisualTestContext, f: impl FnOnce(&Sheet) -> R) -> R {
+    view.read_with(cx, |v, _| match &v.reading.sheet {
+        Some(RSheet::Opml(s)) => f(s),
+        _ => panic!("the OPML sheet isn't open"),
+    })
+}
+
+fn ticks(view: &Entity<MainView>, cx: &mut VisualTestContext) -> Vec<bool> {
+    sheet(view, cx, |s| s.rows.iter().map(|r| r.ticked).collect())
+}
+
+#[gpui_kit::test]
+fn preview_marks_already_followed_and_ticks_with_keys(cx: &mut TestAppContext) {
+    let (view, _fake, cx) = setup(cx);
+    open(&view, cx);
+    let (titles, already, folders, dups) = sheet(&view, cx, |s| {
+        (
+            s.rows
+                .iter()
+                .map(|r| r.feed.title.clone())
+                .collect::<Vec<_>>(),
+            s.rows.iter().map(|r| r.already.clone()).collect::<Vec<_>>(),
+            s.rows
+                .iter()
+                .map(|r| r.feed.folder.clone())
+                .collect::<Vec<_>>(),
+            s.duplicates,
+        )
+    });
+    assert_eq!(titles, ["Rue", "Dead", "Kit", "Moss"]);
+    assert_eq!(
+        already[0].as_deref(),
+        Some("Rue"),
+        "followed by its blyg's origin"
+    );
+    assert!(already[1..].iter().all(Option::is_none));
+    assert_eq!(folders[2].as_deref(), Some("Tech"));
+    assert_eq!(dups, 1);
+    assert_eq!(
+        ticks(&view, cx),
+        [false, true, true, true],
+        "already followed starts unticked"
+    );
+
+    cx.simulate_keystrokes("3");
+    assert_eq!(ticks(&view, cx), [false, true, false, true]);
+    cx.simulate_keystrokes("3");
+    cx.simulate_keystrokes(&crate::keymap::keys("cmd-a"));
+    assert_eq!(ticks(&view, cx), [false, false, false, false], "⌘A: none");
+    cx.simulate_keystrokes(&crate::keymap::keys("cmd-a"));
+    assert_eq!(
+        ticks(&view, cx),
+        [false, true, true, true],
+        "⌘A: all not already followed"
+    );
+    cx.simulate_keystrokes("up up up space");
+    assert!(ticks(&view, cx)[0], "space ticks the selected row");
+
+    // esc cancels: nothing subscribed.
+    cx.simulate_keystrokes("escape");
+    view.read_with(cx, |v, _| assert!(v.reading.sheet.is_none()));
+}
+
+#[gpui_kit::test]
+fn import_files_new_ones_and_leaves_followed_ones_where_they_are(cx: &mut TestAppContext) {
+    let (view, fake, cx) = setup(cx);
+    let mine = fake.create_folder("Mine").unwrap();
+    fake.set_subscription_folder("sub-rue", Some(&mine.id))
+        .unwrap();
+    let before = fake.subscriptions().len();
+    open(&view, cx);
+    // Tick Rue too: the server's 409 makes it "already following".
+    cx.simulate_keystrokes("1");
+    cx.simulate_keystrokes("enter");
+    settle(cx);
+
+    let (phase, outcomes) = sheet(&view, cx, |s| {
+        (
+            s.phase.clone(),
+            s.rows.iter().map(|r| r.outcome.clone()).collect::<Vec<_>>(),
+        )
+    });
+    let Phase::Done(sum) = phase else {
+        panic!("finished: {phase:?}")
+    };
+    assert_eq!(sum.line(), "2 added, 1 already followed, 1 failed");
+    assert_eq!(outcomes[0], Some(Outcome::AlreadyFollowing));
+    assert!(matches!(
+        &outcomes[1],
+        Some(Outcome::Failed {
+            kind: FailKind::NotAFeed,
+            ..
+        })
+    ));
+    assert!(matches!(outcomes[2], Some(Outcome::Added { .. })));
+    assert_eq!(fake.subscriptions().len(), before + 2);
+
+    // The new ones are in "Imported feeds"; Rue stays in Mine.
+    let folder = fake
+        .folders()
+        .into_iter()
+        .find(|f| f.name == IMPORT_FOLDER)
+        .expect("the import folder");
+    let filed = fake.subscription_folders();
+    for o in &outcomes[2..] {
+        let Some(Outcome::Added { id, .. }) = o else {
+            panic!("added")
+        };
+        assert_eq!(filed.get(id), Some(&folder.id));
+    }
+    assert_eq!(filed.get("sub-rue"), Some(&mine.id));
+    assert!(super::opml::WHERE_THEY_GO.contains(IMPORT_FOLDER));
+    view.read_with(cx, |v, _| {
+        assert!(
+            v.reading.folders.iter().any(|f| f.name == IMPORT_FOLDER),
+            "the Reader sees it"
+        );
+    });
+
+    // Retry failed runs only the failed one, and reuses the folder.
+    cx.simulate_keystrokes("r");
+    settle(cx);
+    let phase = sheet(&view, cx, |s| s.phase.clone());
+    let Phase::Done(sum) = phase else {
+        panic!("finished again")
+    };
+    assert_eq!(sum.line(), "0 added, 0 already followed, 1 failed");
+    assert_eq!(
+        fake.folders()
+            .iter()
+            .filter(|f| f.name == IMPORT_FOLDER)
+            .count(),
+        1
+    );
+    cx.simulate_keystrokes("enter");
+    view.read_with(cx, |v, _| assert!(v.reading.sheet.is_none()));
+}
+
+#[gpui_kit::test]
+fn cancel_before_anything_starts_tries_nothing(cx: &mut TestAppContext) {
+    let (view, fake, cx) = setup(cx);
+    let before = fake.subscriptions().len();
+    open(&view, cx);
+    view.update(cx, |v, cx| {
+        v.opml_start(None, cx);
+        v.opml_cancel(cx);
+    });
+    settle(cx);
+    let phase = sheet(&view, cx, |s| s.phase.clone());
+    let Phase::Done(sum) = phase else {
+        panic!("finished: {phase:?}")
+    };
+    assert_eq!(sum.skipped, 3);
+    assert_eq!(fake.subscriptions().len(), before);
+}
diff --git a/crates/blyg-app/src/reading/responses.rs b/crates/blyg-app/src/reading/responses.rs
index a5a255e..91a75a9 100644
--- a/crates/blyg-app/src/reading/responses.rs
+++ b/crates/blyg-app/src/reading/responses.rs
@@ -155,9 +155,7 @@ impl MainView {
     /// This post has responses in your network (the glyph's right side).
     #[cfg(test)]
     pub(crate) fn has_responses(&self, origin: &str, id: &str) -> bool {
-        self.reading
-            .down
-            .contains_key(&blyg_core::post_key(origin, id))
+        !self.reading.lineage.down(origin, id).is_empty()
     }
 
     /// The responses list for `(origin, id)`; `None` when there are none.
diff --git a/crates/blyg-app/src/reading/stream.rs b/crates/blyg-app/src/reading/stream.rs
index 59c300a..3584ff1 100644
--- a/crates/blyg-app/src/reading/stream.rs
+++ b/crates/blyg-app/src/reading/stream.rs
@@ -663,12 +663,13 @@ impl MainView {
             .child(vm::when_label(r, self.now))
             .child("·")
             .child(stream_vm::kind_word(r.kind))
-            // --- lineage --- which kinds of relation, never how many.
+            // --- lineage --- which kinds of relation, and how many.
             .children(self.render_lineage_glyph(r, cx))
             .when(edited, |d| {
                 d.child(badge(p, format!("edited · v{}", r.version)))
             })
-            .when(tombstone, |d| d.child(badge(p, "withdrawn".into())));
+            .when(tombstone, |d| d.child(badge(p, "withdrawn".into())))
+            .children(self.slots_byline(r, cx)); // --- reading slots ---
 
         let lineage = self.render_stream_lineage(r, cx);
 
@@ -907,6 +908,7 @@ impl MainView {
                 );
             }
         }
+        row.extend(self.slots_more_chip(r, cx)); // --- reading slots ---
         let thumb = r.thumb;
         let t = |id: &'static str, glyph: &'static str, want: i8| {
             let k = key.clone();
diff --git a/crates/blyg-app/src/reading/stream_tests.rs b/crates/blyg-app/src/reading/stream_tests.rs
index 2297da1..454abfb 100644
--- a/crates/blyg-app/src/reading/stream_tests.rs
+++ b/crates/blyg-app/src/reading/stream_tests.rs
@@ -554,3 +554,123 @@ fn lineage_walks_one_step_at_a_time_and_rings_the_actions(cx: &mut TestAppContex
     let draft = view.read_with(cx, |v, cx| v.editor.read(cx).value().to_string());
     assert!(draft.contains(&format!("[[{ADA_REPLY}]]")), "{draft}");
 }
+
+// --- lineage counts --- (SPEC rule 1's lineage exception, 2026-10-09)
+
+fn glyph_of(
+    view: &Entity<MainView>,
+    cx: &mut VisualTestContext,
+    id: &str,
+) -> super::lineage_vm::Glyph {
+    view.read_with(cx, |v, _| {
+        let r = v.reading.rows.iter().find(|r| r.remote_id == id).unwrap();
+        v.lineage_glyph_of(r)
+    })
+}
+
+#[gpui_kit::test]
+fn the_glyph_shows_how_many_next_to_the_kinds(cx: &mut TestAppContext) {
+    let (view, _, cx) = setup(cx);
+    cx.simulate_keystrokes(&crate::keymap::keys("cmd-r"));
+    settle(cx);
+    // Ada's reply both stubs and quotes Lin's bench note: one reference,
+    // counted once, as the stub (the studio's rule).
+    let reply = glyph_of(&view, cx, ADA_REPLY);
+    assert_eq!((reply.up.counts.stub, reply.up.counts.transclusion), (1, 0));
+    let bench = glyph_of(&view, cx, LIN_BENCH);
+    assert!(
+        bench.down.counts.stub >= 1,
+        "the reply draws on the bench note"
+    );
+    assert!(bench.label().starts_with("0 · "), "{}", bench.label());
+    assert!(cx.debug_bounds("lineage-glyph").is_some());
+    assert!(
+        cx.debug_bounds("lineage-glyph-counts").is_some(),
+        "the counts are drawn beside the glyph"
+    );
+
+    // The node's counts, when it serves them, win over this Mac's.
+    view.update(cx, |v, cx| {
+        let sub = v
+            .reading
+            .rows
+            .iter()
+            .find(|r| r.remote_id == LIN_BENCH)
+            .unwrap()
+            .subscription_id
+            .clone();
+        let mut s = blyg_core::lineage::LineageSummary::default();
+        s.down.stub = 4;
+        s.down.transclusion = 3;
+        v.reading
+            .served
+            .insert(blyg_core::lineage::imported_key(&sub, LIN_BENCH), s);
+        cx.notify();
+    });
+    settle(cx);
+    let bench = glyph_of(&view, cx, LIN_BENCH);
+    assert_eq!(bench.label(), "0 · 7");
+    assert_eq!(bench.down.quote, super::lineage_vm::Mark::Whole);
+    assert!(
+        bench.tip().contains("4 replies, 3 quotes"),
+        "{}",
+        bench.tip()
+    );
+}
+
+#[gpui_kit::test]
+fn lineage_and_its_ring_show_the_counts_and_opening_marks_read(cx: &mut TestAppContext) {
+    let (view, fake, cx) = setup(cx);
+    cx.simulate_keystrokes(&crate::keymap::keys("cmd-r"));
+    settle(cx);
+    assert_eq!(read_version(&fake, LIN_BENCH), None, "unread to begin with");
+    let ix = view.read_with(cx, |v, _| {
+        v.reading
+            .shown_rows()
+            .position(|r| r.remote_id == ADA_REPLY)
+            .unwrap()
+    });
+    view.update_in(cx, |v, window, cx| v.stream_select(ix, window, cx));
+    settle(cx);
+    cx.simulate_keystrokes(&crate::keymap::keys("cmd-j"));
+    settle(cx);
+    // The view counts what it lists, and agrees with the glyph.
+    let summary = view.read_with(cx, |v, _| match &v.reading.sheet {
+        Some(super::RSheet::Lineage(s)) => s.model.summary(),
+        _ => panic!("⌘J opens it"),
+    });
+    let glyph = glyph_of(&view, cx, ADA_REPLY);
+    assert_eq!(summary.up, glyph.up.counts);
+    assert_eq!(summary.down, glyph.down.counts);
+    assert!(cx.debug_bounds("lineage-count-up").is_some());
+    assert!(cx.debug_bounds("lineage-count-down").is_some());
+
+    // The ring says how many replies are known.
+    cx.simulate_keystrokes("space r");
+    settle(cx);
+    assert!(cx.debug_bounds("lineage-ring-count").is_some());
+    cx.simulate_keystrokes("escape escape");
+    settle(cx);
+
+    // Up to the bench note, `o` opens it in the reader: read, as from the list.
+    let at = view.read_with(cx, |v, _| match &v.reading.sheet {
+        Some(super::RSheet::Lineage(s)) => s
+            .model
+            .ups
+            .iter()
+            .position(|n| n.id.eq_ignore_ascii_case(LIN_BENCH))
+            .unwrap(),
+        _ => panic!("still open"),
+    });
+    cx.simulate_keystrokes("up");
+    for _ in 0..4 {
+        cx.simulate_keystrokes("left");
+    }
+    for _ in 0..at {
+        cx.simulate_keystrokes("right");
+    }
+    cx.simulate_keystrokes("o");
+    settle(cx);
+    assert_eq!(opened(&view, cx).as_deref(), Some(LIN_BENCH));
+    assert_eq!(read_version(&fake, LIN_BENCH), Some(1), "marked read");
+}
diff --git a/crates/blyg-app/src/reading/subscriptions.rs b/crates/blyg-app/src/reading/subscriptions.rs
index 7c8b60e..f56978a 100644
--- a/crates/blyg-app/src/reading/subscriptions.rs
+++ b/crates/blyg-app/src/reading/subscriptions.rs
@@ -161,10 +161,20 @@ impl MainView {
             .chip("subscribe", "+ Subscribe…")
             .on_click(cx.listener(|this, _, window, cx| this.open_subscribe(window, cx)))
             .into_any_element();
+        // --- OPML ---
+        let import = self
+            .chip("opml-import-chip", "Import OPML…")
+            .debug_selector(|| "opml-import-chip".into())
+            .on_click(cx.listener(|this, _, window, cx| this.opml_pick(window, cx)))
+            .into_any_element();
+        let export = self
+            .chip("opml-export-chip", "Export OPML…")
+            .on_click(cx.listener(|this, _, window, cx| this.opml_export(window, cx)))
+            .into_any_element();
         let header = self.screen_header(
             "Subscriptions",
             "following is private to this blyg · esc back".into(),
-            vec![add],
+            vec![import, export, add],
         );
         let rows = self.reading.subs.iter().enumerate().map(|(i, s)| {
             let paused = s.status == "paused";
diff --git a/crates/blyg-app/tests/cli.rs b/crates/blyg-app/tests/cli.rs
index af18c14..d5c52a9 100644
--- a/crates/blyg-app/tests/cli.rs
+++ b/crates/blyg-app/tests/cli.rs
@@ -120,7 +120,8 @@ fn ext_with_an_unknown_name_exits_2() {
     let err = String::from_utf8_lossy(&o.stderr);
     assert!(
         err.contains(
-            "`no-such-thing` isn't a bundled extension (bundled: markdown-notes, cross-post)"
+            "`no-such-thing` isn't a bundled extension \
+             (bundled: markdown-notes, cross-post, reading-time, inspect)"
         ),
         "{err}"
     );
@@ -193,6 +194,7 @@ fn list_extensions_shows_bundled_installed_and_broken() {
         &dir.path().join("config"),
         "extension = markdown-notes\n\
          extension-allow = markdown-notes ui\n\
+         extension-setting = markdown-notes vault=~/Notes\n\
          extension = hello\n\
          extension = ghost\n",
     );
diff --git a/crates/blyg-core/src/api/lineage.rs b/crates/blyg-core/src/api/lineage.rs
new file mode 100644
index 0000000..1b9874a
--- /dev/null
+++ b/crates/blyg-core/src/api/lineage.rs
@@ -0,0 +1,35 @@
+//! The `lineage-glyph` studio extension's owner reads (blygger-studio PR #53,
+//! `extensions/lineage-glyph/contract.ts` at dc632c5): `GET
+//! /api/ext/lineage-glyph/summaries` and `/lineage`, scope `owner:read`.
+//! Both answer 404 on a node that doesn't compile the extension in or hasn't
+//! enabled it: `Ok(None)` here, which the caller remembers as "not served".
+
+use std::collections::HashMap;
+
+use super::{Api, enc};
+use crate::backend::Result;
+use crate::lineage::{Centre, LineageGraph, LineageSummary, MAX_SUMMARY_KEYS, SummariesPage};
+
+impl Api {
+    /// Glyph counts for up to [`MAX_SUMMARY_KEYS`] reading entry keys
+    /// (`crate::lineage::imported_key`). Unknown keys are left out of the
+    /// answer. `None` on 404: the extension isn't enabled there.
+    pub fn lineage_summaries(
+        &self,
+        keys: &[String],
+    ) -> Result<Option<HashMap<String, LineageSummary>>> {
+        let keys = &keys[..keys.len().min(MAX_SUMMARY_KEYS)];
+        let json = serde_json::to_string(keys).unwrap_or_else(|_| "[]".into());
+        let path = format!("/api/ext/lineage-glyph/summaries?keys={}", enc(&json));
+        let page: Option<SummariesPage> = Self::optional(self.call_as("GET", &path, None))?;
+        Ok(page.map(|p| p.summaries))
+    }
+
+    /// One hop of lineage around `centre`. `None` on 404: the extension
+    /// isn't enabled there (or, for an imported post, its subscription is
+    /// unknown).
+    pub fn lineage_graph(&self, centre: &Centre) -> Result<Option<LineageGraph>> {
+        let path = format!("/api/ext/lineage-glyph/lineage?{}", centre.query());
+        Self::optional(self.call_as("GET", &path, None))
+    }
+}
diff --git a/crates/blyg-core/src/api/mod.rs b/crates/blyg-core/src/api/mod.rs
index 6e9a920..bf3dfa2 100644
--- a/crates/blyg-core/src/api/mod.rs
+++ b/crates/blyg-core/src/api/mod.rs
@@ -15,6 +15,7 @@
 //! advertised `read_state: true`.
 
 pub mod auth;
+pub mod lineage; // --- lineage counts --- (studio extension lineage-glyph)
 pub mod media;
 pub mod oauth;
 pub mod public;
@@ -1185,6 +1186,14 @@ fn read_json(res: std::result::Result<ureq::Response, ureq::Error>) -> Result<Va
             if let Some(issues) = body.get("issues").and_then(Value::as_array) {
                 details.extend(issues.iter().map(issue));
             }
+            // An unresolvable subscribe (422): `tried: [url, …]`.
+            if let Some(tried) = body.get("tried").and_then(Value::as_array) {
+                let n = tried.len();
+                details.push(format!(
+                    "tried {n} address{}",
+                    if n == 1 { "" } else { "es" }
+                ));
+            }
             Err(CoreError::Rejected {
                 status: code,
                 message,
diff --git a/crates/blyg-core/src/api/oauth.rs b/crates/blyg-core/src/api/oauth.rs
index 1d68281..607a586 100644
--- a/crates/blyg-core/src/api/oauth.rs
+++ b/crates/blyg-core/src/api/oauth.rs
@@ -14,7 +14,8 @@
 //!    owner signs in to the studio there and allows Burrow. The code comes
 //!    back to a listener on 127.0.0.1 ([`Loopback`]).
 //! 4. **Exchange** the code for a one-hour access token and a rotating
-//!    refresh token, bound to the API resource, with all four owner scopes.
+//!    refresh token, bound to the API resource, with every owner scope the
+//!    server knows ([`SCOPE`]).
 //!
 //! The grant ([`OAuthGrant`]) is kept as JSON under `<host> oauth`. An
 //! [`OAuthSession`] renews it shortly before it expires and after a 401,
@@ -41,10 +42,34 @@ use sha2::{Digest, Sha256};
 use crate::backend::{CoreError, Result};
 use crate::config::{TokenStore, token_account};
 
-/// The owner scopes (upstream `src/permissions.ts` `OWNER_SCOPES`).
-pub const OWNER_SCOPES: [&str; 4] = ["owner:read", "owner:draft", "owner:publish", "owner:manage"];
-/// What Burrow asks for: every owner scope, and a refresh token.
-pub const SCOPE: &str = "owner:read owner:draft owner:publish owner:manage offline_access";
+/// The read-state scope's name, the one place it's spelled (`READ_STATE_SCOPE`,
+/// `SCOPE` and `MANUAL_TOKEN_PERMISSIONS` all expand it). Studio 0.39 moved
+/// markRead, markUnread and both batch ops from `owner:manage` to it.
+/// PROVISIONAL: upstream may rename it; change it here.
+macro_rules! read_state_scope {
+    () => {
+        "reading:state"
+    };
+}
+/// The scope read-state writes need (studio 0.39+). Provisional name.
+pub const READ_STATE_SCOPE: &str = read_state_scope!();
+/// The owner scopes (upstream `src/auth-scopes.ts` `OWNER_SCOPES`, in its
+/// order, which is also the consent page's).
+pub const OWNER_SCOPES: [&str; 5] = [
+    "owner:read",
+    "owner:draft",
+    "owner:publish",
+    "owner:manage",
+    READ_STATE_SCOPE,
+];
+/// What Burrow asks for: every owner scope, and a refresh token. A studio
+/// that doesn't know one of them (`reading:state` before 0.39) refuses the
+/// lot, so `discover` keeps only those the server lists (`Discovery::scope`).
+pub const SCOPE: &str = concat!(
+    "owner:read owner:draft owner:publish owner:manage ",
+    read_state_scope!(),
+    " offline_access"
+);
 /// The name the studio's consent page shows (self-asserted).
 pub const CLIENT_NAME: &str = "Burrow";
 /// The loopback callback's path.
@@ -151,6 +176,14 @@ fn auth_param(header: &str, name: &str) -> Option<String> {
     None
 }
 
+/// The permissions a manual token needs, as Studio → More → Client access
+/// words them (`reading:state` is studio 0.39+; an older studio doesn't offer it).
+pub const MANUAL_TOKEN_PERMISSIONS: &str = concat!(
+    "every permission (read, draft, publish, manage, and ",
+    read_state_scope!(),
+    " where offered)"
+);
+
 /// What to say when the blyg answered 403 "insufficient scope". `granted`
 /// is the grant's scopes when known (browser sign-in); a manual token's
 /// aren't, so it names everything the call needed.
@@ -171,10 +204,10 @@ pub fn missing_scope_message(required: &[String], granted: Option<&str>) -> Stri
     };
     match granted {
         Some(_) => format!(
-            "The blyg refused: Burrow's sign-in lacks {named}. Sign in with the browser again and allow all four permissions."
+            "The blyg refused: Burrow's sign-in lacks {named}. Sign in with the browser again and allow every permission."
         ),
         None => format!(
-            "The blyg refused: this token lacks {named}. Make a new one in Studio → More → Client access, for the REST API, with all four permissions (read, draft, publish, manage)."
+            "The blyg refused: this token lacks {named}. Make a new one in Studio → More → Client access, for the REST API, with {MANUAL_TOKEN_PERMISSIONS}."
         ),
     }
 }
@@ -191,6 +224,22 @@ pub struct Discovery {
     pub revocation_endpoint: Option<String>,
     /// The REST API's resource identifier (`{origin}/api`).
     pub resource: String,
+    /// The `scope` Burrow asks this server for: [`SCOPE`], less any scope its
+    /// `scopes_supported` leaves out (an unknown one is `invalid_scope`).
+    pub scope: String,
+}
+
+/// [`SCOPE`] less what a server's `scopes_supported` leaves out; all of it
+/// when the server doesn't list them.
+pub fn scope_for(supported: Option<&[Value]>) -> String {
+    match supported {
+        None => SCOPE.to_string(),
+        Some(list) => SCOPE
+            .split(' ')
+            .filter(|s| list.iter().any(|x| x == s))
+            .collect::<Vec<_>>()
+            .join(" "),
+    }
 }
 
 /// `{blyg-url}/studio/auth/.well-known/openid-configuration`.
@@ -240,6 +289,11 @@ pub fn discover(base_url: &str) -> Result<Option<Discovery>> {
                 .map(str::to_string)
         })
         .unwrap_or_else(|| format!("{}/api", super::api_root(base_url)));
+    let scope = scope_for(
+        doc.get("scopes_supported")
+            .and_then(Value::as_array)
+            .map(Vec::as_slice),
+    );
     Ok(Some(Discovery {
         issuer,
         authorization_endpoint,
@@ -247,6 +301,7 @@ pub fn discover(base_url: &str) -> Result<Option<Discovery>> {
         registration_endpoint: registration,
         revocation_endpoint: s("revocation_endpoint"),
         resource,
+        scope,
     }))
 }
 
@@ -270,7 +325,7 @@ pub fn register(d: &Discovery) -> Result<Client> {
         "token_endpoint_auth_method": "none",
         "grant_types": ["authorization_code", "refresh_token"],
         "response_types": ["code"],
-        "scope": SCOPE,
+        "scope": d.scope,
     });
     let v: Value = match agent().post(&d.registration_endpoint).send_json(body) {
         Ok(r) => r
@@ -365,7 +420,7 @@ pub fn authorize_url(
         q.append_pair("response_type", "code")
             .append_pair("client_id", client_id)
             .append_pair("redirect_uri", redirect)
-            .append_pair("scope", SCOPE)
+            .append_pair("scope", &d.scope)
             .append_pair("state", state)
             .append_pair("code_challenge", challenge)
             .append_pair("code_challenge_method", "S256")
@@ -902,6 +957,7 @@ mod tests {
             registration_endpoint: "https://blyg.example.com/studio/auth/oauth2/register".into(),
             revocation_endpoint: None,
             resource: "https://blyg.example.com/api".into(),
+            scope: SCOPE.into(),
         };
         let u = authorize_url(&d, "cid", &redirect_uri(47811), "chal", "st", None).unwrap();
         let u = url::Url::parse(&u).unwrap();
@@ -916,7 +972,7 @@ mod tests {
         assert_eq!(q["resource"], "https://blyg.example.com/api");
         assert_eq!(
             q["scope"],
-            "owner:read owner:draft owner:publish owner:manage offline_access"
+            "owner:read owner:draft owner:publish owner:manage reading:state offline_access"
         );
         assert!(!q.contains_key("prompt"));
         assert_eq!(
@@ -925,6 +981,35 @@ mod tests {
         );
     }
 
+    #[test]
+    fn scope_lists_every_owner_scope_once() {
+        assert_eq!(READ_STATE_SCOPE, "reading:state");
+        assert_eq!(SCOPE, format!("{} offline_access", OWNER_SCOPES.join(" ")));
+        assert!(MANUAL_TOKEN_PERMISSIONS.contains(READ_STATE_SCOPE));
+    }
+
+    #[test]
+    fn asks_only_for_the_scopes_a_server_knows() {
+        // Studio 0.39+ lists reading:state; an older one doesn't, and would
+        // refuse an authorize or registration that asks for it.
+        let new: Vec<Value> = ["openid", "offline_access"]
+            .iter()
+            .chain(OWNER_SCOPES.iter())
+            .map(|s| json!(s))
+            .collect();
+        assert_eq!(scope_for(Some(&new)), SCOPE);
+        let old: Vec<Value> = new
+            .iter()
+            .filter(|v| *v != READ_STATE_SCOPE)
+            .cloned()
+            .collect();
+        assert_eq!(
+            scope_for(Some(&old)),
+            "owner:read owner:draft owner:publish owner:manage offline_access"
+        );
+        assert_eq!(scope_for(None), SCOPE);
+    }
+
     #[test]
     fn reads_an_insufficient_scope_challenge() {
         let h = r#"Bearer resource_metadata="https://blyg.example.com/studio/auth/resources/api", scope="owner:draft owner:publish", error="insufficient_scope""#;
@@ -945,6 +1030,15 @@ mod tests {
         let m = missing_scope_message(&["owner:publish".into()], None);
         assert!(m.contains("Studio → More → Client access"), "{m}");
         assert!(m.contains("owner:publish"), "{m}");
+        // An older browser sign-in, without the read-state scope.
+        let m = missing_scope_message(
+            &[READ_STATE_SCOPE.into()],
+            Some("owner:read owner:draft owner:publish owner:manage offline_access"),
+        );
+        assert!(m.contains("lacks the reading:state permission"), "{m}");
+        assert!(m.contains("Sign in with the browser again"), "{m}");
+        let m = missing_scope_message(&[READ_STATE_SCOPE.into()], None);
+        assert!(m.contains("reading:state where offered"), "{m}");
     }
 
     #[test]
diff --git a/crates/blyg-core/src/backend.rs b/crates/blyg-core/src/backend.rs
index 0152769..7577850 100644
--- a/crates/blyg-core/src/backend.rs
+++ b/crates/blyg-core/src/backend.rs
@@ -575,4 +575,55 @@ pub trait Backend: Send + Sync {
         let _ = (origin, id, version);
         Err(CoreError::Other("not supported here".into()))
     }
+
+    // --- lineage counts ---
+    // The `lineage-glyph` studio extension's owner reads (`crate::lineage`,
+    // blygger-studio PR #53), cached in the store. `None` from any of these
+    // means the node doesn't serve them (a 404, remembered for
+    // `lineage::OFF_RECHECK_MS`): the UI counts from what this Mac holds
+    // (`lineage::Local`). Additive; the defaults serve nothing.
+
+    /// Glyph counts for reading entry keys (`lineage::imported_key`):
+    /// cached answers younger than `max_age_ms` as they are, the rest
+    /// fetched (blocking, at most `lineage::MAX_SUMMARY_KEYS` a request). A
+    /// key the node didn't know is left out. Offline, the cached answers
+    /// whatever their age.
+    fn lineage_summaries(
+        &self,
+        keys: &[String],
+        max_age_ms: i64,
+    ) -> Option<std::collections::HashMap<String, crate::lineage::LineageSummary>> {
+        let _ = (keys, max_age_ms);
+        None
+    }
+
+    /// The cached glyph counts only, whatever their age. Local, instant.
+    fn cached_lineage_summaries(
+        &self,
+        keys: &[String],
+    ) -> Option<std::collections::HashMap<String, crate::lineage::LineageSummary>> {
+        let _ = keys;
+        None
+    }
+
+    /// One hop of lineage around `centre`, from the node (blocking; a cached
+    /// answer younger than `max_age_ms` is used as it is). `None` when the
+    /// node doesn't serve it or doesn't know the post.
+    fn lineage_graph(
+        &self,
+        centre: &crate::lineage::Centre,
+        max_age_ms: i64,
+    ) -> Option<crate::lineage::LineageGraph> {
+        let _ = (centre, max_age_ms);
+        None
+    }
+
+    /// The cached graph only, whatever its age. Local, instant.
+    fn cached_lineage_graph(
+        &self,
+        centre: &crate::lineage::Centre,
+    ) -> Option<crate::lineage::LineageGraph> {
+        let _ = centre;
+        None
+    }
 }
diff --git a/crates/blyg-core/src/config/keys.rs b/crates/blyg-core/src/config/keys.rs
index ff380e1..0bf40e6 100644
--- a/crates/blyg-core/src/config/keys.rs
+++ b/crates/blyg-core/src/config/keys.rs
@@ -328,8 +328,12 @@ pub const KEYS: &[KeySpec] = &[
     docs(
         list(key("extension-setting", ValueKind::Text, None), &[]),
         "A setting for one extension, as <name> key=value, e.g. extension-setting = \
-         markdown-notes vault=~/Notes. Repeatable; a later line for the same key wins. An \
-         extension sees its own settings and no other part of this file.",
+         markdown-notes vault=~/Notes. Keys are lowercase kebab-case. Repeatable; a later \
+         line for the same key wins. An extension sees its own settings and no other part of \
+         this file. markdown-notes reads one folder of notes per vault key: vault=~/Notes is \
+         the first, and each vault-<label>, e.g. extension-setting = markdown-notes \
+         vault-work=~/Work/Vault, adds another (Settings › Notes folders writes these). With \
+         no vault it uses no folder at all.",
     ),
     // --- end extensions ---
     docs(
diff --git a/crates/blyg-core/src/lib.rs b/crates/blyg-core/src/lib.rs
index 7fcb258..4378693 100644
--- a/crates/blyg-core/src/lib.rs
+++ b/crates/blyg-core/src/lib.rs
@@ -4,8 +4,10 @@
 pub mod api;
 pub mod backend;
 pub mod config;
+pub mod lineage; // --- lineage counts ---
 pub mod live;
 pub mod model;
+pub mod opml; // --- OPML import/export ---
 pub mod pick;
 pub mod profile; // --- profiles ---
 pub mod scratch_media;
diff --git a/crates/blyg-core/src/lineage.rs b/crates/blyg-core/src/lineage.rs
new file mode 100644
index 0000000..d38291d
--- /dev/null
+++ b/crates/blyg-core/src/lineage.rs
@@ -0,0 +1,757 @@
+//! Lineage counts: how many posts a post draws on ("up") and how many known
+//! here draw on it ("down"), by relation (stub, transclusion, fork).
+//!
+//! Ported from blygger-studio's `lineage-glyph` extension
+//! (`extensions/lineage-glyph/{contract,lineage,server}.ts` and
+//! `ui/{index,lineage}.tsx` at commit dc632c5, branch ext/lineage-glyph: one
+//! commit on studio 0.39.0, blygger-studio PR #53, still in review; its
+//! extension files are identical to the pre-rebase 861c825). Two halves:
+//!
+//! - the extension's contract (its owner reads `GET /api/ext/lineage-glyph/
+//!   summaries` and `/lineage`), vendored as Rust types, for a node that
+//!   serves them (`crate::api::lineage`, cached by `crate::store`);
+//! - the same counting rules over what this Mac holds ([`Local`]), for a
+//!   node that doesn't.
+//!
+//! The rules, as the studio has them:
+//!
+//! - Ancestors are a post's own references: `stub_of`, `forked_from` and
+//!   `transclusions[]`. One reference per (holder, target): a stub thread
+//!   both stubs and transcludes its target, which is one act. Fork > stub >
+//!   transclusion, and a partial transclusion marks the edge partial. A
+//!   `{url}` stub is an ancestor without a post; a bare transclusion means
+//!   the holding post's own origin.
+//! - Descendants are known here only: posts held here (reading rows, your
+//!   own public posts) that reference it, one per holder, plus, for your own
+//!   posts, verified mentions (hidden ones too: hiding is about your public
+//!   page) from posts not already counted.
+//!
+//! Counts are not capped: the studio prints `up · down` as plain totals.
+//! SPEC rule 1's exception for the lineage glyph (2026-10-09) allows them.
+
+pub(crate) mod reads;
+
+use std::collections::HashMap;
+
+use serde::{Deserialize, Serialize};
+
+use crate::model::{Item, Mention, ReadingItem, Status, post_key};
+use crate::profile::{Relation, normalize_origin};
+
+/// The extension's name: the `/api/ext/<name>/` prefix.
+pub const EXTENSION: &str = "lineage-glyph";
+/// At most this many reading entry keys per summaries request
+/// (`MAX_SUMMARY_KEYS` in the extension's contract).
+pub const MAX_SUMMARY_KEYS: usize = 50;
+/// A cached summary is fresh this long (the studio's `FRESH_MS`).
+pub const SUMMARY_TTL_MS: i64 = 30 * 1000;
+/// A cached graph (the ⌘J view) is fresh this long.
+pub const GRAPH_TTL_MS: i64 = 30 * 1000;
+/// After a node answered 404 (the extension isn't enabled there), ask
+/// again after this long: the owner may turn it on.
+pub const OFF_RECHECK_MS: i64 = 6 * 60 * 60 * 1000;
+
+// ------------------------------------------------------------------ contract
+
+/// How many references of each relation (`relationCounts`).
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RelationCounts {
+    pub stub: u32,
+    pub transclusion: u32,
+    pub fork: u32,
+}
+
+impl RelationCounts {
+    pub fn total(&self) -> u32 {
+        self.stub + self.transclusion + self.fork
+    }
+
+    pub fn get(&self, rel: Relation) -> u32 {
+        match rel {
+            Relation::Stubs => self.stub,
+            Relation::Quotes => self.transclusion,
+            Relation::Forks => self.fork,
+        }
+    }
+
+    pub fn bump(&mut self, rel: Relation) {
+        match rel {
+            Relation::Stubs => self.stub += 1,
+            Relation::Quotes => self.transclusion += 1,
+            Relation::Forks => self.fork += 1,
+        }
+    }
+}
+
+/// A post's glyph counts (`LineageGlyphSummary`).
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LineageSummary {
+    pub up: RelationCounts,
+    pub down: RelationCounts,
+}
+
+impl LineageSummary {
+    pub fn is_empty(&self) -> bool {
+        self.up.total() == 0 && self.down.total() == 0
+    }
+
+    /// The studio's `glyphCounts`: "up · down".
+    pub fn label(&self) -> String {
+        format!("{} · {}", self.up.total(), self.down.total())
+    }
+}
+
+/// A lineage relation as the contract spells it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum WireRelation {
+    Stub,
+    Transclusion,
+    Fork,
+}
+
+impl From<WireRelation> for Relation {
+    fn from(r: WireRelation) -> Relation {
+        match r {
+            WireRelation::Stub => Relation::Stubs,
+            WireRelation::Transclusion => Relation::Quotes,
+            WireRelation::Fork => Relation::Forks,
+        }
+    }
+}
+
+/// Where a node is held on the serving node.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Held {
+    Own,
+    Imported,
+}
+
+/// How a descendant is known: a stored document, or only a verified mention.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Via {
+    Reference,
+    Mention,
+}
+
+/// A post as the serving node describes it (`lineageNodeBase`). Every field
+/// is remote data: plain text, and `url` only ever http(s)/mailto (the
+/// studio filters it with `isFollowableUrl`).
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct GraphPost {
+    pub origin: Option<String>,
+    pub id: Option<String>,
+    pub version: Option<u32>,
+    pub held: Option<Held>,
+    pub sub: Option<String>,
+    /// "fragment" | "thread"
+    pub kind: Option<String>,
+    pub title: Option<String>,
+    pub excerpt: Option<String>,
+    pub source: Option<String>,
+    pub url: Option<String>,
+}
+
+/// A neighbour (`LineageGlyphNode`).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct GraphNode {
+    #[serde(flatten)]
+    pub post: GraphPost,
+    pub relation: WireRelation,
+    pub partial: bool,
+    pub via: Via,
+}
+
+/// One hop of lineage around a post (`LineageGlyphLineage`).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LineageGraph {
+    pub node: GraphPost,
+    pub ancestors: Vec<GraphNode>,
+    pub descendants: Vec<GraphNode>,
+}
+
+impl LineageGraph {
+    /// Its counts: the same numbers the summaries route gives the post.
+    pub fn summary(&self) -> LineageSummary {
+        let mut s = LineageSummary::default();
+        for n in &self.ancestors {
+            s.up.bump(n.relation.into());
+        }
+        for n in &self.descendants {
+            s.down.bump(n.relation.into());
+        }
+        s
+    }
+}
+
+/// `{summaries}` from the summaries route.
+#[derive(Debug, Clone, Default, Deserialize)]
+pub struct SummariesPage {
+    pub summaries: HashMap<String, LineageSummary>,
+}
+
+/// A reading entry's key, as `GET /api/reading` names it and the summaries
+/// route takes it: `imported:["<sub>","<id>"]` (the studio's
+/// `JSON.stringify([sub, id])`).
+pub fn imported_key(sub: &str, id: &str) -> String {
+    format!(
+        "imported:{}",
+        serde_json::to_string(&[sub, id]).unwrap_or_default()
+    )
+}
+
+/// The key of one of your own posts: `own:<id>`.
+pub fn own_key(id: &str) -> String {
+    format!("own:{id}")
+}
+
+/// The post the ⌘J view centres on, as the lineage route takes it.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub enum Centre {
+    /// One of yours (`?id=`).
+    Own(String),
+    /// An imported post (`?sub=&id=`).
+    Imported { sub: String, id: String },
+    /// Any other node a lineage named (`?origin=&id=`).
+    Remote { origin: String, id: String },
+}
+
+impl Centre {
+    /// The query string, also the cache key.
+    pub fn query(&self) -> String {
+        let e = |s: &str| url::form_urlencoded::byte_serialize(s.as_bytes()).collect::<String>();
+        match self {
+            Centre::Own(id) => format!("id={}", e(id)),
+            Centre::Imported { sub, id } => format!("id={}&sub={}", e(id), e(sub)),
+            Centre::Remote { origin, id } => format!("id={}&origin={}", e(id), e(origin)),
+        }
+    }
+}
+
+// ------------------------------------------------------------------ the local port
+
+/// What an edge points at, from one end.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub enum Peer {
+    /// A post, keyed as [`post_key`] keys it.
+    Post { origin: String, id: String },
+    /// A `{url}` stub: an ancestor without a post.
+    Url(String),
+    /// A stub naming an id without an origin: counted, but it can't be found.
+    Bare(String),
+}
+
+/// One edge of a post's lineage, seen from that post.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Edge {
+    /// Up: what the post draws on. Down: the post that draws on it.
+    pub peer: Peer,
+    pub relation: Relation,
+    pub partial: bool,
+    pub via: Via,
+}
+
+/// The studio's `referencesOf`: the references one document makes, deduped
+/// per target (fork > stub > transclusion; partial if any is partial), in
+/// first-seen order.
+fn dedupe(refs: impl IntoIterator<Item = (Peer, Relation, bool)>) -> Vec<Edge> {
+    let mut out: Vec<Edge> = Vec::new();
+    for (peer, relation, partial) in refs {
+        match out.iter_mut().find(|e| e.peer == peer) {
+            None => out.push(Edge {
+                peer,
+                relation,
+                partial,
+                via: Via::Reference,
+            }),
+            Some(e) => {
+                e.partial |= partial;
+                // `Relation`'s order is quote < stub < fork: the RANK.
+                if relation > e.relation {
+                    e.relation = relation;
+                }
+            }
+        }
+    }
+    out
+}
+
+fn post_peer(origin: Option<&str>, fallback: Option<&str>, id: &str) -> Peer {
+    match origin
+        .and_then(normalize_origin)
+        .or(fallback.map(str::to_string))
+    {
+        Some(o) => {
+            let (origin, id) = post_key(&o, id);
+            Peer::Post { origin, id }
+        }
+        None => Peer::Bare(id.trim().to_lowercase()),
+    }
+}
+
+/// A reading row's references.
+fn row_refs(r: &ReadingItem) -> Vec<Edge> {
+    let own = normalize_origin(&r.origin);
+    let mut refs = Vec::new();
+    if let Some(s) = &r.stub_of {
+        match (&s.id, &s.url) {
+            (Some(id), _) => refs.push((
+                post_peer(s.origin.as_deref(), None, id),
+                Relation::Stubs,
+                false,
+            )),
+            (None, Some(url)) => refs.push((Peer::Url(url.clone()), Relation::Stubs, false)),
+            _ => {}
+        }
+    }
+    if let Some(f) = &r.forked_from {
+        refs.push((
+            post_peer(Some(&f.origin), None, &f.id),
+            Relation::Forks,
+            false,
+        ));
+    }
+    for t in &r.transclusions {
+        refs.push((
+            post_peer(t.origin.as_deref(), own.as_deref(), &t.id),
+            Relation::Quotes,
+            t.selector.is_some(),
+        ));
+    }
+    dedupe(refs)
+}
+
+/// One of your published posts' references (`Item::references`: a quote
+/// names the held post with that id, else one of yours).
+fn own_refs(i: &Item, own_origin: &str, rows: &[ReadingItem]) -> Vec<Edge> {
+    dedupe(i.references(own_origin, rows).into_iter().map(|r| {
+        (
+            Peer::Post {
+                origin: r.origin,
+                id: r.id,
+            },
+            r.relation,
+            r.partial,
+        )
+    }))
+}
+
+/// The relation a mention names (`stub` | `transclusion` | `fork`).
+pub fn mention_relation(rel: Option<&str>) -> Option<Relation> {
+    match rel? {
+        "stub" => Some(Relation::Stubs),
+        "fork" => Some(Relation::Forks),
+        "transclusion" => Some(Relation::Quotes),
+        _ => None,
+    }
+}
+
+/// Every post's lineage edges over what this Mac holds: the studio's
+/// `loadGraph` + `descendantsOf`, keyed by [`post_key`].
+#[derive(Debug, Clone, Default)]
+pub struct Local {
+    up: HashMap<(String, String), Vec<Edge>>,
+    down: HashMap<(String, String), Vec<Edge>>,
+}
+
+impl Local {
+    /// Build it from the reading rows, your own posts (only published,
+    /// public ones count), your blyg's origin and your inbound mentions.
+    pub fn build(
+        rows: &[ReadingItem],
+        own: &[Item],
+        own_origin: Option<&str>,
+        mentions: &[Mention],
+    ) -> Local {
+        let mut local = Local::default();
+        let mut holders: Vec<((String, String), Vec<Edge>)> = Vec::new();
+        for r in rows {
+            holders.push((post_key(&r.origin, &r.remote_id), row_refs(r)));
+        }
+        if let Some(base) = own_origin {
+            for i in own
+                .iter()
+                .filter(|i| i.version > 0 && i.status == Status::Public)
+            {
+                let Some(sid) = &i.server_id else { continue };
+                holders.push((post_key(base, &sid.0), own_refs(i, base, rows)));
+            }
+        }
+        for (holder, edges) in holders {
+            for e in &edges {
+                let Peer::Post { origin, id } = &e.peer else {
+                    continue;
+                };
+                let down = local.down.entry((origin.clone(), id.clone())).or_default();
+                let from = Peer::Post {
+                    origin: holder.0.clone(),
+                    id: holder.1.clone(),
+                };
+                // One per holder: the first document seen counts.
+                if !down.iter().any(|d| d.peer == from) {
+                    down.push(Edge {
+                        peer: from,
+                        relation: e.relation,
+                        partial: e.partial,
+                        via: Via::Reference,
+                    });
+                }
+            }
+            local.up.entry(holder).or_insert(edges);
+        }
+        if let Some(base) = own_origin {
+            let ours = post_key(base, "").0;
+            for m in mentions.iter().filter(|m| m.status == "verified") {
+                let (Some(rel), Some(sid)) =
+                    (mention_relation(m.relation.as_deref()), &m.source_id)
+                else {
+                    continue;
+                };
+                let origin = m
+                    .source_origin
+                    .as_deref()
+                    .and_then(normalize_origin)
+                    .map(|o| post_key(&o, "").0)
+                    .unwrap_or_default();
+                let from = Peer::Post {
+                    origin,
+                    id: sid.trim().to_lowercase(),
+                };
+                let target = post_key(&ours, &m.target_item_id);
+                let down = local.down.entry(target).or_default();
+                if !down.iter().any(|d| d.peer == from) {
+                    down.push(Edge {
+                        peer: from,
+                        relation: rel,
+                        partial: false,
+                        via: Via::Mention,
+                    });
+                }
+            }
+        }
+        local
+    }
+
+    /// What `(origin, id)` draws on, in the order it names them.
+    pub fn up(&self, origin: &str, id: &str) -> &[Edge] {
+        self.up
+            .get(&post_key(origin, id))
+            .map_or(&[], Vec::as_slice)
+    }
+
+    /// What draws on `(origin, id)`: held posts first, then mention-only ones.
+    pub fn down(&self, origin: &str, id: &str) -> &[Edge] {
+        self.down
+            .get(&post_key(origin, id))
+            .map_or(&[], Vec::as_slice)
+    }
+
+    /// The studio's `lineageSummaries` for one post.
+    pub fn summary(&self, origin: &str, id: &str) -> LineageSummary {
+        LineageSummary {
+            up: counts(self.up(origin, id)),
+            down: counts(self.down(origin, id)),
+        }
+    }
+}
+
+/// Edges counted by relation.
+pub fn counts(edges: &[Edge]) -> RelationCounts {
+    let mut c = RelationCounts::default();
+    for e in edges {
+        c.bump(e.relation);
+    }
+    c
+}
+
+#[cfg(test)]
+mod tests {
+    //! Mirrors blygger-studio's `test/lineage.test.ts` (at dc632c5), over
+    //! what this Mac holds instead of the node's D1 tables.
+    use super::*;
+    use crate::model::{Kind, LocalId, RemoteRef, ServerId, StubOf, TransclusionRef};
+
+    const OURS: &str = "https://me.example/";
+    const THEM: &str = "https://them.example/blyg/";
+    const STRANGER: &str = "https://stranger.example/";
+    const A: &str = "0000000000000000000000000A";
+    const B: &str = "0000000000000000000000000B";
+    const C: &str = "0000000000000000000000000C";
+    const D: &str = "0000000000000000000000000D";
+    const E: &str = "0000000000000000000000000E";
+    const H: &str = "0000000000000000000000000H";
+    const FRAG: &str = "0000000000000000000000000F";
+    const THREAD: &str = "0000000000000000000000000T";
+
+    fn imported(id: &str) -> ReadingItem {
+        serde_json::from_value(serde_json::json!({
+            "subscription_id": "them", "remote_id": id, "subscription_title": "Their blyg",
+            "origin": THEM, "kind": "thread", "state": "current", "version": 2,
+            "created": null, "updated": null, "observed_at": "2026-10-02T00:00:00Z",
+            "content_md": "", "content_html": "", "author": null, "page": null,
+            "thumb": null, "hoppers": [],
+        }))
+        .unwrap()
+    }
+
+    fn quote(id: &str, origin: Option<&str>, partial: bool) -> TransclusionRef {
+        TransclusionRef {
+            id: id.into(),
+            version: Some(1),
+            origin: origin.map(str::to_string),
+            cited: None,
+            selector: partial.then(|| serde_json::json!({ "exact": "Answer me this." })),
+        }
+    }
+
+    fn mine(id: &str, md: &str) -> Item {
+        Item {
+            local_id: LocalId(format!("L{id}")),
+            server_id: Some(ServerId(id.into())),
+            kind: Kind::Thread,
+            status: Status::Public,
+            version: 1,
+            dirty: false,
+            content_md: md.into(),
+            created: "2026-10-01T00:00:00Z".into(),
+            updated: "2026-10-01T00:00:00Z".into(),
+            permalink: None,
+            stub_of: None,
+            forked_from: None,
+            show_responses: true,
+            responses_mode: None,
+            pending_sync: false,
+            conflict: false,
+            highlight: false,
+            highlight_mode: None,
+        }
+    }
+
+    fn mention(source_origin: &str, source_id: &str, status: &str, hidden: bool) -> Mention {
+        Mention {
+            id: format!("m-{source_id}"),
+            target_item_id: FRAG.into(),
+            status: status.into(),
+            relation: Some("stub".into()),
+            source: format!("{source_origin}f/{source_id}/"),
+            source_origin: Some(source_origin.into()),
+            source_id: Some(source_id.into()),
+            source_kind: Some("fragment".into()),
+            source_version: Some(3),
+            source_author: None,
+            first_seen: "2026-10-01T00:00:00Z".into(),
+            verified_at: None,
+            hidden,
+        }
+    }
+
+    fn rc(stub: u32, transclusion: u32, fork: u32) -> RelationCounts {
+        RelationCounts {
+            stub,
+            transclusion,
+            fork,
+        }
+    }
+
+    #[test]
+    fn a_thread_quoting_a_fragment_counts_both_ends() {
+        // "one summaries request counts both ends for a page of reading entries"
+        let own = [
+            mine(FRAG, "Counted fragment."),
+            mine(THREAD, &format!("![[{FRAG}]]\n\nCounting.")),
+        ];
+        let l = Local::build(&[], &own, Some(OURS), &[]);
+        assert_eq!(
+            l.summary(OURS, THREAD),
+            LineageSummary {
+                up: rc(0, 1, 0),
+                down: rc(0, 0, 0)
+            }
+        );
+        assert_eq!(
+            l.summary(OURS, FRAG),
+            LineageSummary {
+                up: rc(0, 0, 0),
+                down: rc(0, 1, 0)
+            }
+        );
+    }
+
+    #[test]
+    fn an_imported_entry_counts_its_own_references() {
+        // "imported entries are summarised under their imported key"
+        let mut h = imported(H);
+        h.transclusions = vec![quote(A, None, false)];
+        let l = Local::build(&[h], &[], Some(OURS), &[]);
+        assert_eq!(l.summary(THEM, H).up, rc(0, 1, 0));
+        assert_eq!(l.summary(THEM, H).down, rc(0, 0, 0));
+        assert_eq!(
+            imported_key("them", H),
+            format!("imported:[\"them\",\"{H}\"]")
+        );
+    }
+
+    #[test]
+    fn a_stub_that_also_quotes_us_is_one_partial_descendant() {
+        // "an imported stub of ours is one descendant, partial, however many
+        // ways it references us"
+        let mut a = imported(A);
+        a.stub_of = Some(StubOf {
+            origin: Some(OURS.into()),
+            id: Some(FRAG.into()),
+            version: Some(1),
+            url: None,
+        });
+        a.transclusions = vec![quote(FRAG, Some(OURS), true)];
+        let own = [mine(FRAG, "Answer me this.")];
+        let l = Local::build(&[a], &own, Some(OURS), &[]);
+        let down = l.down(OURS, FRAG);
+        assert_eq!(down.len(), 1);
+        assert_eq!((down[0].relation, down[0].partial), (Relation::Stubs, true));
+        assert_eq!(l.summary(OURS, FRAG).down, rc(1, 0, 0));
+        // From their side, we are its one ancestor.
+        assert_eq!(l.summary(THEM, A).up, rc(1, 0, 0));
+    }
+
+    #[test]
+    fn a_bare_transclusion_means_the_holders_origin() {
+        let b = imported(B);
+        let mut c = imported(C);
+        c.transclusions = vec![quote(B, None, false)];
+        let l = Local::build(&[b, c], &[], Some(OURS), &[]);
+        assert_eq!(l.summary(THEM, B).down, rc(0, 1, 0));
+        assert_eq!(l.summary(OURS, B).down, rc(0, 0, 0));
+    }
+
+    #[test]
+    fn a_fork_outranks_its_transclusion_and_a_url_stub_counts_up() {
+        let mut d = imported(D);
+        d.forked_from = Some(RemoteRef {
+            origin: OURS.into(),
+            id: FRAG.into(),
+            version: 1,
+        });
+        d.transclusions = vec![quote(FRAG, Some(OURS), false)];
+        d.stub_of = Some(StubOf {
+            url: Some("https://news.example/story".into()),
+            ..Default::default()
+        });
+        let l = Local::build(&[d], &[mine(FRAG, "Fork me.")], Some(OURS), &[]);
+        assert_eq!(l.summary(THEM, D).up, rc(1, 0, 1));
+        assert!(
+            l.up(THEM, D)
+                .iter()
+                .any(|e| e.peer == Peer::Url("https://news.example/story".into()))
+        );
+        assert_eq!(l.summary(OURS, FRAG).down, rc(0, 0, 1));
+    }
+
+    #[test]
+    fn verified_mentions_add_descendants_without_doubling_held_ones() {
+        let mut e = imported(E);
+        e.stub_of = Some(StubOf {
+            origin: Some(OURS.into()),
+            id: Some(FRAG.into()),
+            version: Some(1),
+            url: None,
+        });
+        let mentions = [
+            mention(THEM, E, "verified", false),
+            mention(STRANGER, "0000000000000000000000000S", "verified", false),
+            // Hidden from your public page, still known here (as the studio counts it).
+            mention(STRANGER, "0000000000000000000000000Q", "verified", true),
+            mention(STRANGER, "0000000000000000000000000X", "failed", false),
+        ];
+        let l = Local::build(&[e], &[mine(FRAG, "Mentioned.")], Some(OURS), &mentions);
+        let down = l.down(OURS, FRAG);
+        assert_eq!(down.len(), 3);
+        assert_eq!(down[0].via, Via::Reference);
+        assert!(down[1..].iter().all(|d| d.via == Via::Mention));
+        assert_eq!(l.summary(OURS, FRAG).down, rc(3, 0, 0));
+    }
+
+    #[test]
+    fn unpublished_and_private_posts_of_yours_hold_nothing() {
+        let mut draft = mine(THREAD, &format!("![[{FRAG}]]"));
+        draft.version = 0;
+        let l = Local::build(&[], &[draft, mine(FRAG, "x")], Some(OURS), &[]);
+        assert!(l.summary(OURS, FRAG).is_empty());
+    }
+
+    #[test]
+    fn the_types_match_the_vendored_contract() {
+        let doc: serde_json::Value =
+            serde_json::from_str(include_str!("../tests/fixtures/lineage-glyph.json")).unwrap();
+        let schemas = &doc["components"]["schemas"];
+        let required = |v: &serde_json::Value| {
+            let mut r: Vec<String> = v["required"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .map(|s| s.as_str().unwrap().to_string())
+                .collect();
+            r.sort();
+            r
+        };
+        let keys = |v: serde_json::Value| {
+            let mut k: Vec<String> = v.as_object().unwrap().keys().cloned().collect();
+            k.sort();
+            k
+        };
+        let node = GraphNode {
+            post: GraphPost::default(),
+            relation: WireRelation::Fork,
+            partial: false,
+            via: Via::Reference,
+        };
+        assert_eq!(
+            keys(serde_json::to_value(&node).unwrap()),
+            required(&schemas["LineageGlyphNode"])
+        );
+        assert_eq!(
+            keys(serde_json::to_value(GraphPost::default()).unwrap()),
+            required(&schemas["LineageGlyphLineage"]["properties"]["node"])
+        );
+        assert_eq!(
+            keys(serde_json::to_value(LineageSummary::default().up).unwrap()),
+            required(&schemas["LineageGlyphSummary"]["properties"]["up"])
+        );
+        assert_eq!(
+            doc["paths"]["/api/ext/lineage-glyph/summaries"]["get"]["parameters"][0]["schema"]["description"],
+            format!("A JSON array of up to {MAX_SUMMARY_KEYS} reading entry keys.")
+        );
+    }
+
+    #[test]
+    fn the_graph_summary_counts_its_lists_and_parses_the_contract() {
+        let g: LineageGraph = serde_json::from_value(serde_json::json!({
+            "node": { "origin": OURS, "id": FRAG, "version": 1, "held": "own", "sub": null,
+                      "kind": "fragment", "title": "Thin layer", "excerpt": null,
+                      "source": "you", "url": null },
+            "ancestors": [],
+            "descendants": [
+                { "origin": THEM, "id": A, "version": 2, "held": "imported", "sub": "them",
+                  "kind": "thread", "title": "A reply", "excerpt": null, "source": "Their blyg",
+                  "url": null, "relation": "stub", "partial": true, "via": "reference" },
+                { "origin": STRANGER, "id": "S", "version": 3, "held": null, "sub": null,
+                  "kind": "fragment", "title": null, "excerpt": null, "source": "A Stranger",
+                  "url": "https://stranger.example/f/S/", "relation": "transclusion",
+                  "partial": false, "via": "mention" }
+            ]
+        }))
+        .unwrap();
+        assert_eq!(g.summary().down, rc(1, 1, 0));
+        assert_eq!(g.summary().label(), "0 · 2");
+        assert_eq!(g.descendants[1].via, Via::Mention);
+        assert_eq!(
+            Centre::Imported {
+                sub: "them".into(),
+                id: A.into()
+            }
+            .query(),
+            format!("id={A}&sub=them")
+        );
+    }
+}
diff --git a/crates/blyg-core/src/lineage/reads.rs b/crates/blyg-core/src/lineage/reads.rs
new file mode 100644
index 0000000..166f317
--- /dev/null
+++ b/crates/blyg-core/src/lineage/reads.rs
@@ -0,0 +1,128 @@
+//! The `lineage-glyph` extension's reads for `LiveBackend`, over the store's
+//! cache. Whether the node serves the extension is found out the way the
+//! other server extensions are: by asking, and remembering a 404 (silently)
+//! as "not enabled there", asked again after `OFF_RECHECK_MS`.
+
+use std::collections::HashMap;
+
+use super::{Centre, LineageGraph, LineageSummary, MAX_SUMMARY_KEYS, OFF_RECHECK_MS};
+use crate::store::LineageServed as Served;
+use crate::sync::Engine;
+
+/// Whether to ask the node now: not while a recent 404 stands.
+fn may_ask(e: &Engine, now: i64) -> bool {
+    !matches!(e.store.lineage_served(), Served::Off(t) if now - t < OFF_RECHECK_MS)
+}
+
+fn served(e: &Engine) -> bool {
+    e.store.lineage_served() == Served::On
+}
+
+/// Find out whether the node serves the extension (a summaries request for
+/// no keys). An error (offline) leaves what's known as it is.
+fn probe(e: &Engine, now: i64) -> bool {
+    if served(e) {
+        return true;
+    }
+    if !may_ask(e, now) {
+        return false;
+    }
+    match e.api.lineage_summaries(&[]) {
+        Ok(Some(_)) => e.store.set_lineage_served(true, now).is_ok(),
+        Ok(None) => {
+            let _ = e.store.set_lineage_served(false, now);
+            false
+        }
+        Err(_) => false,
+    }
+}
+
+pub fn cached_summaries(e: &Engine, keys: &[String]) -> Option<HashMap<String, LineageSummary>> {
+    if !served(e) {
+        return None;
+    }
+    let cached = e.store.cached_lineage_summaries(keys).ok()?;
+    Some(
+        cached
+            .into_iter()
+            .filter_map(|(k, (s, _))| s.map(|s| (k, s)))
+            .collect(),
+    )
+}
+
+pub fn summaries(
+    e: &Engine,
+    keys: &[String],
+    max_age_ms: i64,
+    now: i64,
+) -> Option<HashMap<String, LineageSummary>> {
+    if !may_ask(e, now) {
+        return None;
+    }
+    let cached = e.store.cached_lineage_summaries(keys).unwrap_or_default();
+    let stale: Vec<String> = keys
+        .iter()
+        .filter(|k| cached.get(*k).is_none_or(|(_, at)| now - at >= max_age_ms))
+        .cloned()
+        .collect();
+    let mut out: HashMap<String, LineageSummary> = cached
+        .into_iter()
+        .filter_map(|(k, (s, _))| s.map(|s| (k, s)))
+        .collect();
+    if stale.is_empty() {
+        probe(e, now);
+    }
+    for chunk in stale.chunks(MAX_SUMMARY_KEYS) {
+        match e.api.lineage_summaries(chunk) {
+            Ok(Some(got)) => {
+                let _ = e.store.set_lineage_served(true, now);
+                let _ = e.store.put_lineage_summaries(chunk, &got, now);
+                for k in chunk {
+                    out.remove(k);
+                }
+                out.extend(got);
+            }
+            Ok(None) => {
+                // Not enabled there (or no longer): count locally.
+                let _ = e.store.set_lineage_served(false, now);
+                return None;
+            }
+            // Offline or refused: keep what's cached.
+            Err(_) => break,
+        }
+    }
+    served(e).then_some(out)
+}
+
+pub fn cached_graph(e: &Engine, centre: &Centre) -> Option<LineageGraph> {
+    if !served(e) {
+        return None;
+    }
+    e.store
+        .cached_lineage_graph(&centre.query())
+        .ok()
+        .flatten()
+        .and_then(|(g, _)| g)
+}
+
+pub fn graph(e: &Engine, centre: &Centre, max_age_ms: i64, now: i64) -> Option<LineageGraph> {
+    // The lineage route's 404 also means "no such subscription", so whether
+    // the extension is on is the summaries route's to say.
+    if !probe(e, now) {
+        return None;
+    }
+    let q = centre.query();
+    let cached = e.store.cached_lineage_graph(&q).ok().flatten();
+    if let Some((g, at)) = &cached
+        && now - at < max_age_ms
+    {
+        return g.clone();
+    }
+    match e.api.lineage_graph(centre) {
+        Ok(g) => {
+            let _ = e.store.put_lineage_graph(&q, g.as_ref(), now);
+            g
+        }
+        Err(_) => cached.and_then(|(g, _)| g),
+    }
+}
diff --git a/crates/blyg-core/src/live.rs b/crates/blyg-core/src/live.rs
index 06dd724..9d3502a 100644
--- a/crates/blyg-core/src/live.rs
+++ b/crates/blyg-core/src/live.rs
@@ -1251,4 +1251,36 @@ impl Backend for LiveBackend {
         self.e().store.put_pin(&p)?;
         Ok(p)
     }
+
+    // --- lineage counts --- (`crate::lineage::reads`)
+
+    fn lineage_summaries(
+        &self,
+        keys: &[String],
+        max_age_ms: i64,
+    ) -> Option<std::collections::HashMap<String, crate::lineage::LineageSummary>> {
+        crate::lineage::reads::summaries(self.e(), keys, max_age_ms, crate::util::now_ms())
+    }
+
+    fn cached_lineage_summaries(
+        &self,
+        keys: &[String],
+    ) -> Option<std::collections::HashMap<String, crate::lineage::LineageSummary>> {
+        crate::lineage::reads::cached_summaries(self.e(), keys)
+    }
+
+    fn lineage_graph(
+        &self,
+        centre: &crate::lineage::Centre,
+        max_age_ms: i64,
+    ) -> Option<crate::lineage::LineageGraph> {
+        crate::lineage::reads::graph(self.e(), centre, max_age_ms, crate::util::now_ms())
+    }
+
+    fn cached_lineage_graph(
+        &self,
+        centre: &crate::lineage::Centre,
+    ) -> Option<crate::lineage::LineageGraph> {
+        crate::lineage::reads::cached_graph(self.e(), centre)
+    }
 }
diff --git a/crates/blyg-core/src/opml.rs b/crates/blyg-core/src/opml.rs
new file mode 100644
index 0000000..6eb4681
--- /dev/null
+++ b/crates/blyg-core/src/opml.rs
@@ -0,0 +1,682 @@
+//! OPML: reading a feed reader's export (to import it as subscriptions),
+//! writing one of every subscription, and the paced import run.
+//!
+//! - [`outlines`] is the one OPML parser: a blogroll (`profile::parse_opml`)
+//!   and an import both use it. It is lenient on purpose (real exports from
+//!   Feedly, NetNewsWire, Inoreader, Miniflux, Reeder differ): nested
+//!   outlines are flattened with their folder kept for display, `type` is
+//!   ignored, HTML entities and double escaping are undone, and junk around
+//!   the outlines is skipped. It never fetches anything.
+//! - [`parse_bytes`] decodes a file (BOM, UTF-16, a "UTF-8" file that
+//!   isn't), caps its size and feed count, and collapses duplicates.
+//! - [`export`] writes OPML 2.0 the way the studio writes `blogroll.opml`,
+//!   but of every subscription (the public blogroll lists only some).
+//! - [`run_import`] subscribes to each feed through
+//!   `POST /api/subscriptions {url, confirm:true}` (the same call as a
+//!   hand-added subscription), a couple at a time and slowly, since every
+//!   new subscription backfills its whole archive on the server; a 429 waits
+//!   out its `Retry-After`. What's added goes into the local Reader folder
+//!   [`IMPORT_FOLDER`].
+
+use std::collections::HashSet;
+use std::sync::Mutex;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::time::{Duration, Instant};
+
+use crate::backend::{Backend, CoreError};
+use crate::model::{Folder, Subscription, SubscriptionKind};
+use crate::profile::{attrs, host_of, under_origin, xml_unescape};
+
+/// The largest OPML file read (a 2,000-feed export is well under 1 MB).
+pub const MAX_FILE_BYTES: usize = 5 * 1024 * 1024;
+/// The most feeds one import takes.
+pub const MAX_FEEDS: usize = 2000;
+/// The local Reader folder imported subscriptions are filed in.
+pub const IMPORT_FOLDER: &str = "Imported feeds";
+/// The default file name for an export.
+pub const EXPORT_FILE_NAME: &str = "burrow-subscriptions.opml";
+
+// ================================================================ parse
+
+/// One `<outline>` with a feed or site URL (http(s) only).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Outline {
+    pub title: String,
+    /// `xmlUrl`: the feed.
+    pub xml_url: Option<String>,
+    /// `htmlUrl`: the site.
+    pub html_url: Option<String>,
+    /// The folders it sits in, outermost first, joined with " / ".
+    pub folder: Option<String>,
+}
+
+/// One feed of an import: an outline with an `xmlUrl`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct OpmlFeed {
+    pub title: String,
+    pub xml_url: String,
+    pub html_url: Option<String>,
+    /// For display only: the folder it was in, in the other reader.
+    pub folder: Option<String>,
+}
+
+/// A parsed import file.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct Parsed {
+    /// Each feed once, in file order.
+    pub feeds: Vec<OpmlFeed>,
+    /// Outlines that named a feed already listed (collapsed).
+    pub duplicates: usize,
+    /// Outlines with a site but no feed URL (skipped).
+    pub without_feed: usize,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+pub enum OpmlError {
+    #[error(
+        "That file is {} MB; an OPML file Burrow imports is at most {} MB",
+        .0 / (1024 * 1024) + 1,
+        MAX_FILE_BYTES / (1024 * 1024)
+    )]
+    TooBig(usize),
+    #[error(
+        "That file lists {0} feeds; Burrow imports at most {MAX_FEEDS} at a time. Split it in your other reader and import each part"
+    )]
+    TooMany(usize),
+    #[error("That isn't an OPML file (no <opml> or <outline> in it)")]
+    NotOpml,
+    #[error("No feeds in that file: none of its outlines has an xmlUrl")]
+    NoFeeds,
+    #[error("Couldn't read the file: {0}")]
+    Read(String),
+}
+
+/// Bytes to text: a UTF-8 or UTF-16 BOM is honoured and dropped; bytes that
+/// aren't UTF-8 (a Windows-1252 file that says it's UTF-8) are read as
+/// Windows-1252, so a stray `é` never loses the whole file.
+pub fn decode(bytes: &[u8]) -> String {
+    let utf16 = |be: bool| {
+        let units: Vec<u16> = bytes[2..]
+            .as_chunks::<2>()
+            .0
+            .iter()
+            .map(|&c| {
+                if be {
+                    u16::from_be_bytes(c)
+                } else {
+                    u16::from_le_bytes(c)
+                }
+            })
+            .collect();
+        char::decode_utf16(units)
+            .map(|c| c.unwrap_or(char::REPLACEMENT_CHARACTER))
+            .collect::<String>()
+    };
+    match bytes {
+        [0xFF, 0xFE, ..] => utf16(false),
+        [0xFE, 0xFF, ..] => utf16(true),
+        _ => {
+            let b = bytes.strip_prefix(&[0xEF, 0xBB, 0xBF]).unwrap_or(bytes);
+            match std::str::from_utf8(b) {
+                Ok(s) => s.to_string(),
+                Err(_) => b.iter().map(|&c| cp1252(c)).collect(),
+            }
+        }
+    }
+}
+
+/// Windows-1252 byte → char (0x80–0x9F differ from Latin-1).
+fn cp1252(b: u8) -> char {
+    const HIGH: [char; 32] = [
+        '€', '\u{81}', '‚', 'ƒ', '„', '…', '†', '‡', 'ˆ', '‰', 'Š', '‹', 'Œ', '\u{8d}', 'Ž',
+        '\u{8f}', '\u{90}', '‘', '’', '“', '”', '•', '–', '—', '˜', '™', 'š', '›', 'œ', '\u{9d}',
+        'ž', 'Ÿ',
+    ];
+    match b {
+        0x80..=0x9F => HIGH[(b - 0x80) as usize],
+        _ => b as char,
+    }
+}
+
+/// A title as exports write it: entities undone, twice when the exporter
+/// escaped an already-escaped name (`&amp;amp;`), whitespace collapsed.
+fn clean_title(s: &str) -> String {
+    let once = xml_unescape(s);
+    let twice = if once.contains('&') {
+        xml_unescape(&once)
+    } else {
+        once
+    };
+    twice.split_whitespace().collect::<Vec<_>>().join(" ")
+}
+
+/// Where the start tag that begins at `from` (just past `<outline`) ends:
+/// the index of its `>`, skipping any inside quoted attribute values.
+fn tag_end(xml: &[u8], from: usize) -> Option<usize> {
+    let mut quote = None;
+    for (i, &c) in xml.iter().enumerate().skip(from) {
+        match (quote, c) {
+            (None, b'"' | b'\'') => quote = Some(c),
+            (Some(q), _) if c == q => quote = None,
+            (None, b'>') => return Some(i),
+            // A quote left open runs into the next tag: give up on it there.
+            (Some(_), b'<') => return None,
+            _ => {}
+        }
+    }
+    None
+}
+
+/// Every `<outline>` with an http(s) feed or site URL, in file order,
+/// with the folders around it. No dedupe. Comments are skipped; junk is
+/// tolerated.
+pub fn outlines(xml: &str) -> Vec<Outline> {
+    let lower = xml.to_ascii_lowercase();
+    let lb = lower.as_bytes();
+    // Open outlines: `Some(name)` for a folder, `None` for a feed left open.
+    let mut stack: Vec<Option<String>> = vec![];
+    let mut out = vec![];
+    let mut i = 0;
+    while let Some(off) = lower[i..].find('<') {
+        let at = i + off;
+        let rest = &lower[at..];
+        if rest.starts_with("<!--") {
+            i = rest.find("-->").map_or(lower.len(), |e| at + e + 3);
+            continue;
+        }
+        if let Some(r) = rest.strip_prefix("</outline") {
+            if r.starts_with(|c: char| c == '>' || c.is_ascii_whitespace()) {
+                stack.pop();
+            }
+            i = at + 2;
+            continue;
+        }
+        let name_end = at + "<outline".len();
+        let is_outline = rest.starts_with("<outline")
+            && lb
+                .get(name_end)
+                .is_some_and(|&c| c.is_ascii_whitespace() || c == b'>' || c == b'/');
+        if !is_outline {
+            i = at + 1;
+            continue;
+        }
+        let Some(end) = tag_end(lb, name_end) else {
+            i = at + 1;
+            continue;
+        };
+        let inner = &xml[at + 1..end];
+        let self_closing = inner.trim_end().ends_with('/');
+        let a = attrs(inner.trim_end().trim_end_matches('/'));
+        let http = |k: &str| {
+            a.get(k).map(|s| s.trim().to_string()).filter(|s| {
+                let l = s.to_ascii_lowercase();
+                l.starts_with("http://") || l.starts_with("https://")
+            })
+        };
+        let xml_url = http("xmlurl");
+        let html_url = http("htmlurl");
+        let label = a
+            .get("title")
+            .filter(|t| !t.trim().is_empty())
+            .or_else(|| a.get("text"))
+            .map(|s| clean_title(s))
+            .filter(|s| !s.is_empty());
+        if xml_url.is_some() || html_url.is_some() {
+            let folders: Vec<&str> = stack
+                .iter()
+                .flatten()
+                .map(String::as_str)
+                .filter(|f| !f.is_empty())
+                .collect();
+            out.push(Outline {
+                title: label
+                    .or_else(|| html_url.as_deref().or(xml_url.as_deref()).and_then(host_of))
+                    .unwrap_or_default(),
+                xml_url,
+                html_url,
+                folder: (!folders.is_empty()).then(|| folders.join(" / ")),
+            });
+            if !self_closing {
+                stack.push(None);
+            }
+        } else if !self_closing {
+            // An unnamed folder ("") still nests; it just isn't shown.
+            stack.push(Some(label.unwrap_or_default()));
+        }
+        i = end + 1;
+    }
+    out
+}
+
+/// Parse an OPML file's bytes for an import.
+pub fn parse_bytes(bytes: &[u8]) -> Result<Parsed, OpmlError> {
+    if bytes.len() > MAX_FILE_BYTES {
+        return Err(OpmlError::TooBig(bytes.len()));
+    }
+    parse(&decode(bytes))
+}
+
+/// Read and parse the OPML file at `path` (size-checked before reading).
+pub fn read_file(path: &std::path::Path) -> Result<Parsed, OpmlError> {
+    let len = std::fs::metadata(path)
+        .map_err(|e| OpmlError::Read(e.to_string()))?
+        .len() as usize;
+    if len > MAX_FILE_BYTES {
+        return Err(OpmlError::TooBig(len));
+    }
+    let bytes = std::fs::read(path).map_err(|e| OpmlError::Read(e.to_string()))?;
+    parse_bytes(&bytes)
+}
+
+/// Parse OPML text for an import: feeds with an `xmlUrl`, each once.
+pub fn parse(xml: &str) -> Result<Parsed, OpmlError> {
+    let all = outlines(xml);
+    let lower = xml.to_ascii_lowercase();
+    if all.is_empty() && !lower.contains("<opml") {
+        return Err(OpmlError::NotOpml);
+    }
+    let mut p = Parsed::default();
+    let mut seen = HashSet::new();
+    for o in all {
+        let Some(xml_url) = o.xml_url else {
+            p.without_feed += 1;
+            continue;
+        };
+        if !seen.insert(feed_key(&xml_url)) {
+            p.duplicates += 1;
+            continue;
+        }
+        p.feeds.push(OpmlFeed {
+            title: o.title,
+            xml_url,
+            html_url: o.html_url,
+            folder: o.folder,
+        });
+    }
+    if p.feeds.is_empty() {
+        return Err(OpmlError::NoFeeds);
+    }
+    if p.feeds.len() > MAX_FEEDS {
+        return Err(OpmlError::TooMany(p.feeds.len()));
+    }
+    Ok(p)
+}
+
+// ================================================================ matching
+
+/// A feed URL for comparing: scheme, `www.`, case of the host, fragment
+/// and a trailing slash don't count; the query does.
+pub fn feed_key(url: &str) -> String {
+    let t = url.trim();
+    let Ok(u) = url::Url::parse(t) else {
+        return t.trim_end_matches('/').to_ascii_lowercase();
+    };
+    let host = u.host_str().unwrap_or_default().to_ascii_lowercase();
+    let host = host.strip_prefix("www.").unwrap_or(&host);
+    let port = u.port().map(|p| format!(":{p}")).unwrap_or_default();
+    let path = u.path().trim_end_matches('/');
+    let query = u.query().map(|q| format!("?{q}")).unwrap_or_default();
+    format!("{host}{port}{path}{query}")
+}
+
+/// The subscription that already follows `feed`, if any: the same feed
+/// URL, or (for a blyg) a feed or site under its origin.
+pub fn followed<'a>(feed: &OpmlFeed, subs: &'a [Subscription]) -> Option<&'a Subscription> {
+    let key = feed_key(&feed.xml_url);
+    subs.iter().find(|s| {
+        feed_key(&s.feed_url) == key
+            || feed_key(&s.origin) == key
+            || (s.kind == SubscriptionKind::Blyg
+                && (under_origin(&feed.xml_url, &s.origin)
+                    || feed
+                        .html_url
+                        .as_deref()
+                        .is_some_and(|h| under_origin(h, &s.origin))))
+    })
+}
+
+// ================================================================ export
+
+fn esc(s: &str) -> String {
+    s.replace('&', "&amp;")
+        .replace('<', "&lt;")
+        .replace('>', "&gt;")
+        .replace('"', "&quot;")
+        .replace('\'', "&apos;")
+}
+
+/// OPML 2.0 of every subscription, in the studio's `blogroll.opml` shape:
+/// `text`/`title` its name, `xmlUrl` its feed (a blyg's `feed.xml`),
+/// `htmlUrl` its site (a feed's own URL when that's all that's known).
+pub fn export(subs: &[Subscription]) -> String {
+    let outlines: Vec<String> = subs
+        .iter()
+        .map(|s| {
+            let title = esc(if s.title.trim().is_empty() {
+                &s.origin
+            } else {
+                s.title.trim()
+            });
+            format!(
+                "    <outline text=\"{title}\" title=\"{title}\" type=\"rss\" xmlUrl=\"{}\" htmlUrl=\"{}\"/>",
+                esc(&s.feed_url),
+                esc(&s.origin)
+            )
+        })
+        .collect();
+    format!(
+        "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<opml version=\"2.0\">\n  <head>\n    <title>Burrow subscriptions</title>\n  </head>\n  <body>\n{}{}  </body>\n</opml>\n",
+        outlines.join("\n"),
+        if outlines.is_empty() { "" } else { "\n" }
+    )
+}
+
+// ================================================================ import
+
+/// Why one feed wasn't added.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FailKind {
+    /// 422: the blyg couldn't resolve it to a blyg or a feed (not a feed,
+    /// or nothing answered there).
+    NotAFeed,
+    /// Burrow couldn't reach your blyg.
+    Unreachable,
+    /// Any other refusal (with the server's reason).
+    Refused,
+}
+
+impl FailKind {
+    pub fn label(self) -> &'static str {
+        match self {
+            FailKind::NotAFeed => "not a feed",
+            FailKind::Unreachable => "unreachable",
+            FailKind::Refused => "refused",
+        }
+    }
+}
+
+/// What happened to one feed.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Outcome {
+    /// 201: subscribed (and filed in the import folder).
+    Added {
+        id: String,
+        title: String,
+    },
+    /// 409: already following it.
+    AlreadyFollowing,
+    Failed {
+        kind: FailKind,
+        reason: String,
+    },
+}
+
+/// How fast an import goes. Every new subscription makes the blyg backfill
+/// the source's archive, so the default is far under the owner write
+/// budget (120 a minute): two at a time, one started every 2 s (≤ 30 a
+/// minute).
+#[derive(Debug, Clone, Copy)]
+pub struct Pace {
+    pub concurrency: usize,
+    /// The least time between two subscribes starting.
+    pub interval: Duration,
+    /// How many 429s one feed waits out before it counts as failed.
+    pub max_waits: u32,
+}
+
+impl Default for Pace {
+    fn default() -> Self {
+        Pace {
+            concurrency: 2,
+            interval: Duration::from_secs(2),
+            max_waits: 5,
+        }
+    }
+}
+
+/// What a run reports as it goes (from its worker threads).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Progress {
+    /// The blyg asked to slow down: nothing starts for this long.
+    Waiting { seconds: u64 },
+    /// Feed `index` finished.
+    Done { index: usize, outcome: Outcome },
+}
+
+/// The local Reader folder named [`IMPORT_FOLDER`] (any case), made when
+/// missing. Never a second one.
+pub fn import_folder(backend: &dyn Backend) -> crate::Result<Folder> {
+    let find = || {
+        backend
+            .folders()
+            .into_iter()
+            .find(|f| f.name.trim().eq_ignore_ascii_case(IMPORT_FOLDER))
+    };
+    if let Some(f) = find() {
+        return Ok(f);
+    }
+    match backend.create_folder(IMPORT_FOLDER) {
+        Ok(f) => Ok(f),
+        // Made meanwhile (another window, the CLI): use that one.
+        Err(e) => find().ok_or(e),
+    }
+}
+
+/// Subscribe to one feed, mapping the answer. `Err(retry_after)` is a 429.
+fn outcome_of(r: crate::Result<Subscription>) -> Result<Outcome, u64> {
+    match r {
+        Ok(s) => Ok(Outcome::Added {
+            id: s.id,
+            title: s.title,
+        }),
+        Err(CoreError::RateLimited { retry_after }) => Err(retry_after),
+        Err(CoreError::Rejected { status: 409, .. }) => Ok(Outcome::AlreadyFollowing),
+        Err(CoreError::Rejected {
+            status: 422,
+            message,
+            details,
+        }) => Ok(Outcome::Failed {
+            kind: FailKind::NotAFeed,
+            reason: with_details(message, &details),
+        }),
+        Err(CoreError::Offline) => Ok(Outcome::Failed {
+            kind: FailKind::Unreachable,
+            reason: "couldn't reach your blyg".into(),
+        }),
+        Err(CoreError::Rejected {
+            message, details, ..
+        }) => Ok(Outcome::Failed {
+            kind: FailKind::Refused,
+            reason: with_details(message, &details),
+        }),
+        Err(e) => Ok(Outcome::Failed {
+            kind: FailKind::Refused,
+            reason: e.to_string(),
+        }),
+    }
+}
+
+fn with_details(message: String, details: &[String]) -> String {
+    if details.is_empty() {
+        message
+    } else {
+        format!("{message} ({})", details.join("; "))
+    }
+}
+
+/// Sleep `d`, waking early when `cancel` is set. False when cancelled.
+fn nap(d: Duration, cancel: &AtomicBool) -> bool {
+    let until = Instant::now() + d;
+    loop {
+        if cancel.load(Ordering::Relaxed) {
+            return false;
+        }
+        let now = Instant::now();
+        if now >= until {
+            return true;
+        }
+        std::thread::sleep((until - now).min(Duration::from_millis(100)));
+    }
+}
+
+/// Subscribe to `feeds` (blocking; run it off the UI thread). Each one is
+/// `POST /api/subscriptions {url, confirm:true}`: 201 is added and filed in
+/// the [`IMPORT_FOLDER`] Reader folder, 409 already followed (left where
+/// the user filed it), 422 not a feed, anything else failed with its
+/// reason; nothing fails the whole run. A 429 holds every worker for its
+/// `Retry-After`, then the same feed is tried again. Setting `cancel` stops
+/// it after the ones in flight; their results stand. One result per feed,
+/// `None` for the ones never tried.
+pub fn run_import(
+    backend: &dyn Backend,
+    feeds: &[OpmlFeed],
+    pace: &Pace,
+    cancel: &AtomicBool,
+    on: &(dyn Fn(Progress) + Sync),
+) -> Vec<Option<Outcome>> {
+    let folder = if feeds.is_empty() {
+        None
+    } else {
+        import_folder(backend).ok()
+    };
+    run_paced(
+        feeds,
+        pace,
+        cancel,
+        &|url| backend.subscribe(url, None),
+        &|id| {
+            if let Some(f) = &folder {
+                // Filed by id: membership is local and keyed to the id, so
+                // a subscription that only shows up at the next pull is
+                // already in the folder when it does.
+                let _ = backend.set_subscription_folder(id, Some(&f.id));
+            }
+        },
+        on,
+    )
+}
+
+/// [`run_import`]'s loop, over a `subscribe` call and a `file` call (an
+/// added subscription's id).
+pub(crate) fn run_paced(
+    feeds: &[OpmlFeed],
+    pace: &Pace,
+    cancel: &AtomicBool,
+    subscribe: &(dyn Fn(&str) -> crate::Result<Subscription> + Sync),
+    file: &(dyn Fn(&str) + Sync),
+    on: &(dyn Fn(Progress) + Sync),
+) -> Vec<Option<Outcome>> {
+    let results: Mutex<Vec<Option<Outcome>>> = Mutex::new(vec![None; feeds.len()]);
+    let next = Mutex::new(0usize);
+    // When the next subscribe may start (pacing and 429s).
+    let gate = Mutex::new(Instant::now());
+    let lock = |m: &Mutex<Instant>| *m.lock().unwrap_or_else(|p| p.into_inner());
+    let worker = || {
+        loop {
+            let index = {
+                let mut n = next.lock().unwrap_or_else(|p| p.into_inner());
+                if *n >= feeds.len() || cancel.load(Ordering::Relaxed) {
+                    return;
+                }
+                *n += 1;
+                *n - 1
+            };
+            let feed = &feeds[index];
+            let mut waits = 0;
+            let outcome = loop {
+                // Take the next start slot.
+                let start = {
+                    let mut g = gate.lock().unwrap_or_else(|p| p.into_inner());
+                    let start = (*g).max(Instant::now());
+                    *g = start + pace.interval;
+                    start
+                };
+                if !nap(start.saturating_duration_since(Instant::now()), cancel) {
+                    return;
+                }
+                match outcome_of(subscribe(&feed.xml_url)) {
+                    Ok(o) => break o,
+                    Err(secs) if waits < pace.max_waits => {
+                        waits += 1;
+                        let until = Instant::now() + Duration::from_secs(secs);
+                        {
+                            let mut g = gate.lock().unwrap_or_else(|p| p.into_inner());
+                            *g = (*g).max(until);
+                        }
+                        on(Progress::Waiting { seconds: secs });
+                        if !nap(
+                            lock(&gate).saturating_duration_since(Instant::now()),
+                            cancel,
+                        ) {
+                            return;
+                        }
+                    }
+                    Err(_) => {
+                        break Outcome::Failed {
+                            kind: FailKind::Refused,
+                            reason: "the blyg kept asking Burrow to slow down".into(),
+                        };
+                    }
+                }
+            };
+            if let Outcome::Added { id, .. } = &outcome {
+                file(id);
+            }
+            results.lock().unwrap_or_else(|p| p.into_inner())[index] = Some(outcome.clone());
+            on(Progress::Done { index, outcome });
+        }
+    };
+    if pace.concurrency <= 1 {
+        // One at a time runs on the caller's thread (no thread of its own).
+        worker();
+    } else {
+        std::thread::scope(|s| {
+            for _ in 0..pace.concurrency {
+                s.spawn(worker);
+            }
+        });
+    }
+    results.into_inner().unwrap_or_else(|p| p.into_inner())
+}
+
+/// The counts of a finished (or cancelled) run.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct Summary {
+    pub added: usize,
+    pub already: usize,
+    /// `(feed index, kind, reason)`.
+    pub failed: Vec<(usize, FailKind, String)>,
+    /// Never tried (cancelled first).
+    pub skipped: usize,
+}
+
+impl Summary {
+    pub fn of(results: &[Option<Outcome>]) -> Summary {
+        let mut s = Summary::default();
+        for (i, r) in results.iter().enumerate() {
+            match r {
+                Some(Outcome::Added { .. }) => s.added += 1,
+                Some(Outcome::AlreadyFollowing) => s.already += 1,
+                Some(Outcome::Failed { kind, reason }) => s.failed.push((i, *kind, reason.clone())),
+                None => s.skipped += 1,
+            }
+        }
+        s
+    }
+
+    /// "3 added, 1 already followed, 1 failed".
+    pub fn line(&self) -> String {
+        let mut parts = vec![
+            format!("{} added", self.added),
+            format!("{} already followed", self.already),
+            format!("{} failed", self.failed.len()),
+        ];
+        if self.skipped > 0 {
+            parts.push(format!("{} not tried", self.skipped));
+        }
+        parts.join(", ")
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/blyg-core/src/opml/tests.rs b/crates/blyg-core/src/opml/tests.rs
new file mode 100644
index 0000000..961bbf8
--- /dev/null
+++ b/crates/blyg-core/src/opml/tests.rs
@@ -0,0 +1,494 @@
+//! The OPML parser on exports in each big reader's style (invented feeds),
+//! the export round trip, matching, and the paced import loop.
+
+use std::sync::Mutex;
+use std::sync::atomic::AtomicBool;
+use std::time::{Duration, Instant};
+
+use super::*;
+
+/// Feedly: `type="rss"`, `text` and `title`, folders by category, entities.
+const FEEDLY: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<opml version="1.0">
+    <head>
+        <title>Ada subscriptions in feedly Cloud</title>
+    </head>
+    <body>
+        <outline text="Tech" title="Tech">
+            <outline type="rss" text="Ada &amp; Co" title="Ada &amp; Co" xmlUrl="https://ada.example.com/feed.xml" htmlUrl="https://ada.example.com/"/>
+            <outline type="rss" text="Rue&#8217;s notes" title="Rue&#8217;s notes" xmlUrl="https://rue.example.org/rss" htmlUrl="https://rue.example.org"/>
+        </outline>
+        <outline text="Cooking" title="Cooking">
+            <outline type="rss" text="Kale &amp;amp; More" title="Kale &amp;amp; More" xmlUrl="https://kale.example.net/atom.xml" htmlUrl="https://kale.example.net"/>
+        </outline>
+    </body>
+</opml>
+"#;
+
+/// NetNewsWire: OPML 1.1, no `type` on some, `title` missing (text only),
+/// nested folders, unescaped `'` quoting.
+const NETNEWSWIRE: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<!-- OPML generated by NetNewsWire -->
+<opml version="1.1">
+	<head>
+		<title>Subscriptions-OnMyMac.opml</title>
+	</head>
+<body>
+	<outline text="Blogs" title="Blogs">
+		<outline text="Friends">
+			<outline text='Ozzie writes' xmlUrl='https://ozzie.example.com/index.xml' htmlUrl='https://ozzie.example.com/'/>
+		</outline>
+		<outline text="Pim" type="rss" version="RSS" xmlUrl="https://pim.example.org/feed/"/>
+	</outline>
+	<outline text="Loose" xmlUrl="https://loose.example.com/feed.json" htmlUrl="https://loose.example.com"/>
+</body>
+</opml>"#;
+
+/// Inoreader: `type="rss"` everywhere, `&nbsp;` and `&eacute;` (HTML
+/// entities), a duplicate across folders.
+const INOREADER: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<opml version="1.0">
+  <head>
+    <title>Subscriptions from Inoreader [https://www.inoreader.com]</title>
+  </head>
+  <body>
+    <outline text="News" title="News">
+      <outline text="Caf&eacute;&nbsp;Daily" title="Caf&eacute;&nbsp;Daily" type="rss" xmlUrl="https://cafe.example.com/rss.xml" htmlUrl="https://cafe.example.com/"/>
+    </outline>
+    <outline text="Also" title="Also">
+      <outline text="Café again" title="Café again" type="rss" xmlUrl="http://www.cafe.example.com/rss.xml/" htmlUrl="https://cafe.example.com/"/>
+    </outline>
+  </body>
+</opml>"#;
+
+/// Miniflux: OPML 2.0, `type="rss"`, `title` with no `text`, categories.
+const MINIFLUX: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<opml version="2.0">
+  <head>
+    <title>Miniflux</title>
+    <dateCreated>Fri, 02 Oct 2026 10:00:00 UTC</dateCreated>
+  </head>
+  <body>
+    <outline text="All">
+      <outline title="Atom One" text="Atom One" xmlUrl="https://atom.example.org/atom" htmlUrl="https://atom.example.org/" type="atom"></outline>
+      <outline title="No Text" xmlUrl="https://notext.example.org/rss" htmlUrl="https://notext.example.org/" type="rss"></outline>
+    </outline>
+  </body>
+</opml>"#;
+
+/// Reeder: flat, no head title, a site-only outline, uppercase attributes.
+const REEDER: &str = r#"<?xml version="1.0" encoding="utf-8"?>
+<opml version="2.0"><head/><body>
+<outline TEXT="Shouty" XMLURL="https://shouty.example.com/feed"/>
+<outline text="Just a site" htmlUrl="https://site.example.com/"/>
+<outline text=""  xmlUrl="https://bare.example.net/rss.xml" />
+</body></opml>"#;
+
+fn titles(p: &Parsed) -> Vec<&str> {
+    p.feeds.iter().map(|f| f.title.as_str()).collect()
+}
+
+#[test]
+fn feedly_folders_and_entities() {
+    let p = parse(FEEDLY).unwrap();
+    assert_eq!(titles(&p), ["Ada & Co", "Rue’s notes", "Kale & More"]);
+    assert_eq!(p.feeds[0].folder.as_deref(), Some("Tech"));
+    assert_eq!(p.feeds[2].folder.as_deref(), Some("Cooking"));
+    assert_eq!(p.feeds[1].xml_url, "https://rue.example.org/rss");
+    assert_eq!(
+        p.feeds[1].html_url.as_deref(),
+        Some("https://rue.example.org")
+    );
+}
+
+#[test]
+fn netnewswire_nested_folders_and_missing_type() {
+    let p = parse(NETNEWSWIRE).unwrap();
+    assert_eq!(titles(&p), ["Ozzie writes", "Pim", "Loose"]);
+    assert_eq!(p.feeds[0].folder.as_deref(), Some("Blogs / Friends"));
+    assert_eq!(p.feeds[1].folder.as_deref(), Some("Blogs"));
+    assert_eq!(p.feeds[2].folder, None);
+}
+
+#[test]
+fn inoreader_html_entities_and_duplicates() {
+    let p = parse(INOREADER).unwrap();
+    // `&nbsp;` is whitespace, so it collapses to a plain space.
+    assert_eq!(titles(&p), ["Café Daily"]);
+    assert_eq!(p.duplicates, 1, "http/www/trailing-slash variant collapses");
+}
+
+#[test]
+fn miniflux_atom_type_and_title_only() {
+    let p = parse(MINIFLUX).unwrap();
+    assert_eq!(titles(&p), ["Atom One", "No Text"]);
+    assert!(p.feeds.iter().all(|f| f.folder.as_deref() == Some("All")));
+}
+
+#[test]
+fn reeder_flat_uppercase_and_site_only() {
+    let p = parse(REEDER).unwrap();
+    assert_eq!(titles(&p), ["Shouty", "bare.example.net"]);
+    assert_eq!(p.without_feed, 1);
+}
+
+#[test]
+fn bom_utf16_and_windows_1252() {
+    let mut bom = vec![0xEF, 0xBB, 0xBF];
+    bom.extend_from_slice(REEDER.as_bytes());
+    assert_eq!(parse_bytes(&bom).unwrap().feeds.len(), 2);
+
+    let mut utf16 = vec![0xFF, 0xFE];
+    for u in MINIFLUX.encode_utf16() {
+        utf16.extend_from_slice(&u.to_le_bytes());
+    }
+    assert_eq!(
+        titles(&parse_bytes(&utf16).unwrap()),
+        ["Atom One", "No Text"]
+    );
+
+    // Says UTF-8, is Windows-1252: "Caf\xe9 \x93Q\x94".
+    let mut cp =
+        br#"<?xml version="1.0" encoding="UTF-8"?><opml><body><outline text="Caf"#.to_vec();
+    cp.extend_from_slice(&[0xE9, b' ', 0x93, b'Q', 0x94]);
+    cp.extend_from_slice(br#"" xmlUrl="https://cp.example.com/rss"/></body></opml>"#);
+    assert_eq!(titles(&parse_bytes(&cp).unwrap()), ["Café “Q”"]);
+}
+
+#[test]
+fn junk_comments_and_quoted_angle_brackets() {
+    let xml = r#"<opml><body>
+      <!-- <outline text="commented out" xmlUrl="https://no.example.com/rss"/> -->
+      <outline text="a > b" xmlUrl="https://gt.example.com/rss"/>
+      <outline text="evil" xmlUrl="javascript:alert(1)"/>
+      <outlines text="not one" xmlUrl="https://no.example.com/x"/>
+      <outline text="ok" xmlUrl="HTTPS://case.example.com/rss"/>
+      <outline text="unterminated
+    </body></opml> junk <<<"#;
+    let p = parse(xml).unwrap();
+    assert_eq!(titles(&p), ["a > b", "ok"]);
+}
+
+#[test]
+fn refusals_have_clear_messages() {
+    assert_eq!(parse("<html>hello</html>"), Err(OpmlError::NotOpml));
+    assert_eq!(
+        parse("<opml><body><outline text=\"x\"/></body></opml>"),
+        Err(OpmlError::NoFeeds)
+    );
+    let big = vec![b' '; MAX_FILE_BYTES + 1];
+    let e = parse_bytes(&big).unwrap_err();
+    assert!(matches!(e, OpmlError::TooBig(_)));
+    assert!(e.to_string().contains("at most 5 MB"), "{e}");
+    let many: String = (0..=MAX_FEEDS)
+        .map(|i| format!("<outline text=\"f{i}\" xmlUrl=\"https://f{i}.example.com/rss\"/>"))
+        .collect();
+    let e = parse(&format!("<opml><body>{many}</body></opml>")).unwrap_err();
+    assert_eq!(e, OpmlError::TooMany(MAX_FEEDS + 1));
+    assert!(e.to_string().contains("at most 2000"), "{e}");
+}
+
+fn sub(id: &str, kind: SubscriptionKind, origin: &str, feed: &str, title: &str) -> Subscription {
+    Subscription {
+        id: id.into(),
+        kind,
+        origin: origin.into(),
+        feed_url: feed.into(),
+        title: title.into(),
+        status: "active".into(),
+        in_blogroll: false,
+        title_follows_source: true,
+    }
+}
+
+#[test]
+fn already_followed_by_feed_or_blyg_origin() {
+    let subs = vec![
+        sub(
+            "s1",
+            SubscriptionKind::Rss,
+            "https://ada.example.com/feed.xml",
+            "https://ada.example.com/feed.xml",
+            "Ada",
+        ),
+        sub(
+            "s2",
+            SubscriptionKind::Blyg,
+            "https://kit.example.org/blyg/",
+            "https://kit.example.org/blyg/feed.xml",
+            "Kit",
+        ),
+    ];
+    let feed = |x: &str, h: Option<&str>| OpmlFeed {
+        title: "t".into(),
+        xml_url: x.into(),
+        html_url: h.map(Into::into),
+        folder: None,
+    };
+    assert_eq!(
+        followed(&feed("http://www.ADA.example.com/feed.xml/", None), &subs).map(|s| &*s.id),
+        Some("s1")
+    );
+    // A blyg's other feed (its Atom, say) is still that blyg.
+    assert_eq!(
+        followed(&feed("https://kit.example.org/blyg/atom.xml", None), &subs).map(|s| &*s.id),
+        Some("s2")
+    );
+    assert!(followed(&feed("https://kit.example.org/other/rss", None), &subs).is_none());
+    assert!(followed(&feed("https://new.example.net/rss", None), &subs).is_none());
+}
+
+#[test]
+fn export_round_trips() {
+    let subs = vec![
+        sub(
+            "s1",
+            SubscriptionKind::Blyg,
+            "https://kit.example.org/blyg/",
+            "https://kit.example.org/blyg/feed.xml",
+            "Kit & \"Co\" <3",
+        ),
+        sub(
+            "s2",
+            SubscriptionKind::Rss,
+            "https://ada.example.com/feed.xml?x=1&y=2",
+            "https://ada.example.com/feed.xml?x=1&y=2",
+            "",
+        ),
+    ];
+    let xml = export(&subs);
+    assert!(xml.starts_with("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<opml version=\"2.0\">"));
+    assert!(xml.contains("type=\"rss\""));
+    let p = parse(&xml).unwrap();
+    let got: Vec<(&str, &str, Option<&str>)> = p
+        .feeds
+        .iter()
+        .map(|f| (f.title.as_str(), f.xml_url.as_str(), f.html_url.as_deref()))
+        .collect();
+    assert_eq!(
+        got,
+        [
+            (
+                "Kit & \"Co\" <3",
+                "https://kit.example.org/blyg/feed.xml",
+                Some("https://kit.example.org/blyg/")
+            ),
+            (
+                "https://ada.example.com/feed.xml?x=1&y=2",
+                "https://ada.example.com/feed.xml?x=1&y=2",
+                Some("https://ada.example.com/feed.xml?x=1&y=2")
+            ),
+        ]
+    );
+    // Every exported feed reads back as already followed.
+    assert!(p.feeds.iter().all(|f| followed(f, &subs).is_some()));
+    assert_eq!(export(&[]).matches("<outline").count(), 0);
+}
+
+// ---------------------------------------------------------------- the run
+
+fn feeds(urls: &[&str]) -> Vec<OpmlFeed> {
+    urls.iter()
+        .map(|u| OpmlFeed {
+            title: u.to_string(),
+            xml_url: u.to_string(),
+            html_url: None,
+            folder: None,
+        })
+        .collect()
+}
+
+fn quick() -> Pace {
+    Pace {
+        concurrency: 2,
+        interval: Duration::ZERO,
+        max_waits: 2,
+    }
+}
+
+fn rejected(status: u16, message: &str) -> CoreError {
+    CoreError::Rejected {
+        status,
+        message: message.into(),
+        details: vec![],
+    }
+}
+
+/// The answer the server gives for each URL, as the API client maps it.
+fn answer(url: &str) -> crate::Result<Subscription> {
+    match url {
+        u if u.contains("dead") => Err(CoreError::Rejected {
+            status: 422,
+            message: "could not resolve this URL to a blyg or a feed".into(),
+            details: vec!["tried 4 addresses".into()],
+        }),
+        u if u.contains("old") => Err(rejected(409, "already subscribed to Old")),
+        u if u.contains("bad") => Err(rejected(400, "url required")),
+        u => Ok(sub(&format!("id-{u}"), SubscriptionKind::Rss, u, u, "Feed")),
+    }
+}
+
+#[test]
+fn each_answer_maps_and_only_added_ones_are_filed() {
+    let fs = feeds(&[
+        "https://a/rss",
+        "https://old/rss",
+        "https://dead/rss",
+        "https://bad/rss",
+    ]);
+    let filed = Mutex::new(vec![]);
+    let seen = Mutex::new(vec![]);
+    let r = run_paced(
+        &fs,
+        &quick(),
+        &AtomicBool::new(false),
+        &answer,
+        &|id| filed.lock().unwrap().push(id.to_string()),
+        &|p| seen.lock().unwrap().push(p),
+    );
+    assert_eq!(
+        r[0],
+        Some(Outcome::Added {
+            id: "id-https://a/rss".into(),
+            title: "Feed".into()
+        })
+    );
+    assert_eq!(r[1], Some(Outcome::AlreadyFollowing));
+    assert_eq!(
+        r[2],
+        Some(Outcome::Failed {
+            kind: FailKind::NotAFeed,
+            reason: "could not resolve this URL to a blyg or a feed (tried 4 addresses)".into()
+        })
+    );
+    assert!(matches!(
+        &r[3],
+        Some(Outcome::Failed { kind: FailKind::Refused, reason }) if reason == "url required"
+    ));
+    assert_eq!(*filed.lock().unwrap(), ["id-https://a/rss"]);
+    assert_eq!(seen.lock().unwrap().len(), 4);
+    let s = Summary::of(&r);
+    assert_eq!(s.line(), "1 added, 1 already followed, 2 failed");
+    assert_eq!(s.failed[0].0, 2);
+}
+
+#[test]
+fn a_429_waits_out_retry_after_then_tries_the_same_feed_again() {
+    let calls = Mutex::new(0);
+    let seen = Mutex::new(vec![]);
+    let started = Instant::now();
+    let r = run_paced(
+        &feeds(&["https://a/rss"]),
+        &quick(),
+        &AtomicBool::new(false),
+        &|u| {
+            let mut n = calls.lock().unwrap();
+            *n += 1;
+            if *n == 1 {
+                Err(CoreError::RateLimited { retry_after: 1 })
+            } else {
+                answer(u)
+            }
+        },
+        &|_| {},
+        &|p| seen.lock().unwrap().push(p),
+    );
+    assert!(started.elapsed() >= Duration::from_millis(950));
+    assert_eq!(*calls.lock().unwrap(), 2);
+    assert!(matches!(r[0], Some(Outcome::Added { .. })));
+    assert_eq!(seen.lock().unwrap()[0], Progress::Waiting { seconds: 1 });
+}
+
+#[test]
+fn pacing_spaces_the_starts() {
+    let starts = Mutex::new(vec![]);
+    let pace = Pace {
+        concurrency: 3,
+        interval: Duration::from_millis(60),
+        max_waits: 0,
+    };
+    run_paced(
+        &feeds(&["https://a/1", "https://a/2", "https://a/3", "https://a/4"]),
+        &pace,
+        &AtomicBool::new(false),
+        &|u| {
+            starts.lock().unwrap().push(Instant::now());
+            answer(u)
+        },
+        &|_| {},
+        &|_| {},
+    );
+    let mut s = starts.into_inner().unwrap();
+    s.sort();
+    // Each start has its own slot 60 ms after the last (a thread may wake a
+    // little late, so pairs can be closer; the whole run can't be).
+    let span = s[3] - s[0];
+    assert!(span >= Duration::from_millis(150), "{span:?}");
+    for w in s.windows(2) {
+        assert!(
+            w[1] - w[0] >= Duration::from_millis(30),
+            "{:?}",
+            w[1] - w[0]
+        );
+    }
+}
+
+#[test]
+fn cancel_stops_after_the_one_in_flight() {
+    let cancel = AtomicBool::new(false);
+    let pace = Pace {
+        concurrency: 1,
+        interval: Duration::ZERO,
+        max_waits: 0,
+    };
+    let r = run_paced(
+        &feeds(&["https://a/1", "https://a/2", "https://a/3"]),
+        &pace,
+        &cancel,
+        &|u| {
+            cancel.store(true, std::sync::atomic::Ordering::Relaxed);
+            answer(u)
+        },
+        &|_| {},
+        &|_| {},
+    );
+    assert!(
+        matches!(r[0], Some(Outcome::Added { .. })),
+        "what's done stays done"
+    );
+    assert_eq!(r[1..], [None, None]);
+    assert_eq!(
+        Summary::of(&r).line(),
+        "1 added, 0 already followed, 0 failed, 2 not tried"
+    );
+}
+
+#[test]
+fn import_folder_is_made_once_and_reused_on_real_sqlite() {
+    let dir = tempfile::tempdir().unwrap();
+    let opts = crate::SyncOptions {
+        start_worker: false,
+        ..Default::default()
+    };
+    let b = crate::LiveBackend::open_with(
+        dir.path(),
+        "http://127.0.0.1:9",
+        crate::api::auth::Credential::Token("t".into()),
+        opts,
+    )
+    .unwrap();
+    b.create_folder("Mine").unwrap();
+    let f = import_folder(&b).unwrap();
+    assert_eq!(f.name, IMPORT_FOLDER);
+    assert_eq!(import_folder(&b).unwrap().id, f.id);
+    b.rename_folder(&f.id, "imported FEEDS").unwrap();
+    assert_eq!(
+        import_folder(&b).unwrap().id,
+        f.id,
+        "any case is the same folder"
+    );
+    assert_eq!(b.folders().len(), 2);
+    // Filing by id holds before the subscription is in the local list.
+    b.set_subscription_folder("sub-later", Some(&f.id)).unwrap();
+    assert_eq!(b.subscription_folders().get("sub-later"), Some(&f.id));
+}
diff --git a/crates/blyg-core/src/profile.rs b/crates/blyg-core/src/profile.rs
index ce9f08d..b2dc583 100644
--- a/crates/blyg-core/src/profile.rs
+++ b/crates/blyg-core/src/profile.rs
@@ -373,7 +373,8 @@ pub fn xml_unescape(s: &str) -> String {
                 .ok()
                 .and_then(char::from_u32),
             e if e.starts_with('#') => e[1..].parse().ok().and_then(char::from_u32),
-            _ => None,
+            // HTML's, which feed readers' exports and feeds use anyway.
+            e => html_entity(e),
         };
         match ch {
             Some(c) => {
@@ -390,9 +391,45 @@ pub fn xml_unescape(s: &str) -> String {
     out
 }
 
+/// The common HTML named entities that turn up in OPML and feeds.
+fn html_entity(name: &str) -> Option<char> {
+    Some(match name {
+        "nbsp" => '\u{a0}',
+        "eacute" => 'é',
+        "egrave" => 'è',
+        "ecirc" => 'ê',
+        "aacute" => 'á',
+        "agrave" => 'à',
+        "iacute" => 'í',
+        "oacute" => 'ó',
+        "uacute" => 'ú',
+        "auml" => 'ä',
+        "ouml" => 'ö',
+        "uuml" => 'ü',
+        "szlig" => 'ß',
+        "ntilde" => 'ñ',
+        "ccedil" => 'ç',
+        "hellip" => '…',
+        "mdash" => '—',
+        "ndash" => '–',
+        "lsquo" => '‘',
+        "rsquo" => '’',
+        "ldquo" => '“',
+        "rdquo" => '”',
+        "laquo" => '«',
+        "raquo" => '»',
+        "middot" => '·',
+        "bull" => '•',
+        "copy" => '©',
+        "reg" => '®',
+        "trade" => '™',
+        _ => return None,
+    })
+}
+
 /// The attributes of one start tag's inside (`outline text="a" xmlUrl='b'`),
 /// names lowercased. Unquoted values and junk are tolerated.
-fn attrs(tag: &str) -> BTreeMap<String, String> {
+pub(crate) fn attrs(tag: &str) -> BTreeMap<String, String> {
     let mut out = BTreeMap::new();
     let b = tag.as_bytes();
     let mut i = 0;
@@ -468,34 +505,17 @@ fn start_tags<'a>(xml: &'a str, name: &str) -> Vec<&'a str> {
 
 /// Parse an OPML blogroll: every `<outline>` with a feed or site URL (http(s)
 /// only). Nested folders are flattened; junk around them is ignored.
+/// The parser is `opml::outlines` (shared with the OPML import).
 pub fn parse_opml(xml: &str) -> Vec<BlogrollEntry> {
     let mut seen = HashSet::new();
-    start_tags(xml, "outline")
+    crate::opml::outlines(xml)
         .into_iter()
-        .filter_map(|t| {
-            let a = attrs(t);
-            let http = |k: &str| {
-                a.get(k)
-                    .map(|s| s.trim().to_string())
-                    .filter(|s| s.starts_with("http://") || s.starts_with("https://"))
-            };
-            let xml_url = http("xmlurl");
-            let html_url = http("htmlurl");
-            if xml_url.is_none() && html_url.is_none() {
-                return None;
-            }
-            let title = a
-                .get("title")
-                .or_else(|| a.get("text"))
-                .map(|s| s.trim().to_string())
-                .filter(|s| !s.is_empty())
-                .or_else(|| html_url.as_deref().or(xml_url.as_deref()).and_then(host_of))
-                .unwrap_or_default();
-            let key = xml_url.clone().or_else(|| html_url.clone());
+        .filter_map(|o| {
+            let key = o.xml_url.clone().or_else(|| o.html_url.clone());
             seen.insert(key).then_some(BlogrollEntry {
-                title,
-                xml_url,
-                html_url,
+                title: o.title,
+                xml_url: o.xml_url,
+                html_url: o.html_url,
             })
         })
         .collect()
diff --git a/crates/blyg-core/src/state.rs b/crates/blyg-core/src/state.rs
index 1aba239..cb741d7 100644
--- a/crates/blyg-core/src/state.rs
+++ b/crates/blyg-core/src/state.rs
@@ -46,6 +46,10 @@ pub struct AppState {
     /// --- notes --- The scratch note the notes drawer writes to (a local id).
     #[serde(skip_serializing_if = "Option::is_none")]
     pub notes_note: Option<String>,
+    /// --- extensions --- The notes drawer's chosen markdown-notes vault
+    /// (a library id: `notes`, `notes.<label>`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub notes_vault: Option<String>,
 }
 
 impl AppState {
diff --git a/crates/blyg-core/src/store/lineage.rs b/crates/blyg-core/src/store/lineage.rs
new file mode 100644
index 0000000..edbeb9d
--- /dev/null
+++ b/crates/blyg-core/src/store/lineage.rs
@@ -0,0 +1,233 @@
+//! --- lineage counts --- The `lineage-glyph` extension's answers, cached
+//! (`crate::lineage`): glyph summaries keyed by reading entry key, graphs
+//! keyed by the lineage route's query, each with when it was fetched; and
+//! whether the node serves the extension at all (meta `lineage_glyph`:
+//! `on`, or `off:<unix ms>` after a 404).
+//!
+//! `lineage_cache` is a cache, not data: it's created on first use outside
+//! the numbered migrations (so it never takes a schema version another
+//! change needs), and dropping it loses nothing but a few requests.
+
+use std::collections::HashMap;
+
+use rusqlite::{Connection, OptionalExtension, params};
+
+use super::Store;
+use crate::backend::Result;
+use crate::lineage::{LineageGraph, LineageSummary};
+
+const META: &str = "lineage_glyph";
+
+const TABLE: &str = "CREATE TABLE IF NOT EXISTS lineage_cache (
+    kind        TEXT NOT NULL,      -- 'summary' | 'graph'
+    key         TEXT NOT NULL,      -- reading entry key | the lineage query
+    json        TEXT NOT NULL,      -- the answer; 'null' = the node didn't know it
+    fetched_at  INTEGER NOT NULL,   -- unix ms
+    PRIMARY KEY (kind, key)
+)";
+
+/// Whether the node serves the extension, as last found out.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Served {
+    /// Never asked.
+    Unknown,
+    /// It answered.
+    On,
+    /// It answered 404 at this time (unix ms).
+    Off(i64),
+}
+
+fn table(c: &Connection) -> rusqlite::Result<()> {
+    c.execute_batch(TABLE)
+}
+
+impl Store {
+    pub fn lineage_served(&self) -> Served {
+        match self.meta(META).as_deref() {
+            Some("on") => Served::On,
+            Some(v) => v
+                .strip_prefix("off:")
+                .and_then(|t| t.parse().ok())
+                .map_or(Served::Unknown, Served::Off),
+            None => Served::Unknown,
+        }
+    }
+
+    /// Record what the node said. Turning off drops everything it served:
+    /// the counts then come from this Mac.
+    pub fn set_lineage_served(&self, on: bool, now: i64) -> Result<()> {
+        if on {
+            return self.set_meta(META, "on");
+        }
+        {
+            let c = self.conn();
+            table(&c)?;
+            c.execute("DELETE FROM lineage_cache", [])?;
+        }
+        self.set_meta(META, &format!("off:{now}"))
+    }
+
+    /// The cached summaries of `keys`, whatever their age: key → (summary,
+    /// or `None` when the node didn't know it; fetched at).
+    pub fn cached_lineage_summaries(
+        &self,
+        keys: &[String],
+    ) -> Result<HashMap<String, (Option<LineageSummary>, i64)>> {
+        let c = self.conn();
+        table(&c)?;
+        let mut q = c.prepare_cached(
+            "SELECT json, fetched_at FROM lineage_cache WHERE kind = 'summary' AND key = ?1",
+        )?;
+        let mut out = HashMap::new();
+        for k in keys {
+            let row: Option<(String, i64)> = q
+                .query_row([k], |r| Ok((r.get(0)?, r.get(1)?)))
+                .optional()?;
+            if let Some((json, at)) = row {
+                out.insert(k.clone(), (serde_json::from_str(&json).ok().flatten(), at));
+            }
+        }
+        Ok(out)
+    }
+
+    /// Store one summaries answer: every key asked gets a row, `null` for
+    /// those the node left out.
+    pub fn put_lineage_summaries(
+        &self,
+        asked: &[String],
+        got: &HashMap<String, LineageSummary>,
+        now: i64,
+    ) -> Result<()> {
+        let mut c = self.conn();
+        table(&c)?;
+        let tx = c.transaction()?;
+        {
+            let mut q = tx.prepare_cached(
+                "INSERT INTO lineage_cache (kind, key, json, fetched_at) VALUES ('summary', ?1, ?2, ?3)
+                 ON CONFLICT(kind, key) DO UPDATE SET json = excluded.json, fetched_at = excluded.fetched_at",
+            )?;
+            for k in asked {
+                let json = serde_json::to_string(&got.get(k)).unwrap_or_else(|_| "null".into());
+                q.execute(params![k, json, now])?;
+            }
+        }
+        tx.commit()?;
+        Ok(())
+    }
+
+    /// The cached graph for a lineage query, whatever its age: (graph, or
+    /// `None` when the node didn't know it; fetched at).
+    pub fn cached_lineage_graph(&self, query: &str) -> Result<Option<(Option<LineageGraph>, i64)>> {
+        let c = self.conn();
+        table(&c)?;
+        let row: Option<(String, i64)> = c
+            .query_row(
+                "SELECT json, fetched_at FROM lineage_cache WHERE kind = 'graph' AND key = ?1",
+                [query],
+                |r| Ok((r.get(0)?, r.get(1)?)),
+            )
+            .optional()?;
+        Ok(row.map(|(json, at)| (serde_json::from_str(&json).ok().flatten(), at)))
+    }
+
+    pub fn put_lineage_graph(
+        &self,
+        query: &str,
+        graph: Option<&LineageGraph>,
+        now: i64,
+    ) -> Result<()> {
+        let c = self.conn();
+        table(&c)?;
+        let json = serde_json::to_string(&graph).unwrap_or_else(|_| "null".into());
+        c.execute(
+            "INSERT INTO lineage_cache (kind, key, json, fetched_at) VALUES ('graph', ?1, ?2, ?3)
+             ON CONFLICT(kind, key) DO UPDATE SET json = excluded.json, fetched_at = excluded.fetched_at",
+            params![query, json, now],
+        )?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::lineage::{RelationCounts, imported_key};
+
+    fn summary(up: u32, down: u32) -> LineageSummary {
+        LineageSummary {
+            up: RelationCounts {
+                transclusion: up,
+                ..Default::default()
+            },
+            down: RelationCounts {
+                stub: down,
+                ..Default::default()
+            },
+        }
+    }
+
+    #[test]
+    fn summaries_round_trip_on_disk_with_their_age() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("blygger.db");
+        let (a, b) = (imported_key("s1", "A"), imported_key("s1", "B"));
+        {
+            let s = Store::open(&path).unwrap();
+            assert_eq!(s.lineage_served(), Served::Unknown);
+            assert!(
+                s.cached_lineage_summaries(std::slice::from_ref(&a))
+                    .unwrap()
+                    .is_empty()
+            );
+            let got = HashMap::from([(a.clone(), summary(1, 2))]);
+            s.put_lineage_summaries(&[a.clone(), b.clone()], &got, 1_000)
+                .unwrap();
+            s.set_lineage_served(true, 1_000).unwrap();
+        }
+        // A fresh connection reads what the last one wrote.
+        let s = Store::open(&path).unwrap();
+        assert_eq!(s.lineage_served(), Served::On);
+        let c = s.cached_lineage_summaries(&[a.clone(), b.clone()]).unwrap();
+        assert_eq!(c[&a], (Some(summary(1, 2)), 1_000));
+        assert_eq!(
+            c[&b],
+            (None, 1_000),
+            "left out by the node: known as unknown"
+        );
+        // A newer answer replaces the row.
+        s.put_lineage_summaries(
+            std::slice::from_ref(&a),
+            &HashMap::from([(a.clone(), summary(0, 5))]),
+            2_000,
+        )
+        .unwrap();
+        assert_eq!(
+            s.cached_lineage_summaries(std::slice::from_ref(&a))
+                .unwrap()[&a],
+            (Some(summary(0, 5)), 2_000)
+        );
+    }
+
+    #[test]
+    fn a_404_turns_it_off_and_drops_what_it_served() {
+        let s = Store::open_in_memory().unwrap();
+        let a = imported_key("s1", "A");
+        s.put_lineage_summaries(
+            std::slice::from_ref(&a),
+            &HashMap::from([(a.clone(), summary(1, 1))]),
+            5,
+        )
+        .unwrap();
+        s.put_lineage_graph("id=A&sub=s1", None, 5).unwrap();
+        assert_eq!(
+            s.cached_lineage_graph("id=A&sub=s1").unwrap(),
+            Some((None, 5))
+        );
+        s.set_lineage_served(false, 99).unwrap();
+        assert_eq!(s.lineage_served(), Served::Off(99));
+        assert!(s.cached_lineage_summaries(&[a]).unwrap().is_empty());
+        assert_eq!(s.cached_lineage_graph("id=A&sub=s1").unwrap(), None);
+        s.set_lineage_served(true, 100).unwrap();
+        assert_eq!(s.lineage_served(), Served::On);
+    }
+}
diff --git a/crates/blyg-core/src/store/mod.rs b/crates/blyg-core/src/store/mod.rs
index ac5917b..6b39f32 100644
--- a/crates/blyg-core/src/store/mod.rs
+++ b/crates/blyg-core/src/store/mod.rs
@@ -11,6 +11,8 @@
 //! `not_before` keeps moving).
 
 mod folders; // --- reader folders ---
+mod lineage; // --- lineage counts ---
+pub use lineage::Served as LineageServed;
 mod pick;
 mod provenance;
 pub use provenance::Tracked;
diff --git a/crates/blyg-core/src/sync/mod.rs b/crates/blyg-core/src/sync/mod.rs
index aebdb90..d114a54 100644
--- a/crates/blyg-core/src/sync/mod.rs
+++ b/crates/blyg-core/src/sync/mod.rs
@@ -160,12 +160,29 @@ struct NetState {
     pushed: HashMap<LocalId, Instant>,
     /// The earliest time a save held back by `SAVE_GAP` may go.
     paced_until: Option<Instant>,
-    /// --- read/unread --- The server refused a read-state write with 403
-    /// (a scoped token on a Worker that keeps those writes to the owner):
-    /// read state stays on this Mac for the rest of the session.
+    /// --- read/unread --- The server refused a read-state write with 403:
+    /// a credential without `reading:state` (studio 0.39+; a sign-in made
+    /// before it), or a scoped token on a Worker that keeps those writes to
+    /// the owner. Read ops stay queued but aren't sent for the rest of the
+    /// session (a new sign-in is a new session), and the rest of the outbox
+    /// goes on without them.
     read_denied: bool,
 }
 
+/// What to say, once a session, when the blyg refuses a read-state write.
+/// A studio 0.39+ names the scope (`reading:state`) in its challenge, and
+/// `e` carries `oauth::missing_scope_message` (sign in again / a new token).
+fn read_denied_message(e: &CoreError) -> String {
+    let why = match e {
+        CoreError::Rejected { message, .. } if !message.is_empty() => message.as_str(),
+        _ => "The blyg refused to save read state for this sign-in.",
+    };
+    format!(
+        "Read state isn't syncing. {why} Until then your read marks are kept on this \
+         Mac and wait to be sent; everything else syncs as usual."
+    )
+}
+
 /// The time allowed per pull for fetching item documents (lineage).
 const LINEAGE_BUDGET: Duration = Duration::from_secs(8);
 
@@ -451,6 +468,10 @@ impl Engine {
             let ran = self.run_op(&op);
             self.set_pushing(false);
             match ran {
+                // A read op held for the scope (`read_denied`): not a success,
+                // so no other 403's notice is reset; the loop goes on to the
+                // rest of the outbox, which skips the held reads.
+                Ok(()) if self.read_held(&op) => {}
                 Ok(()) => {
                     if op.kind == OpKind::Save {
                         self.state()
@@ -541,6 +562,11 @@ impl Engine {
             }
             // Ops for one item run strictly in order: a later save waits for
             // the create that assigns its server id.
+            // Read state the credential can't write waits, queued, for one
+            // that can; it holds nothing else up.
+            if self.read_held_locked(&st, &op) {
+                continue;
+            }
             if conflicted.contains(&op.local_id) || op.in_flight || (!force && op.not_before > now)
             {
                 blocked.insert(op.local_id.clone());
@@ -1131,22 +1157,29 @@ impl Engine {
     // ------------------------------------------------------------ read state
 
     /// The server syncs read state (extension 5, or upstream's read-state
-    /// routes), as of the last reading pull.
-    /// False for the rest of the session once a write was refused with 403
-    /// (`read_denied`): the marks stay here, unsent, and go up from a later
-    /// session that may write (each keeps its `read_at` until confirmed).
+    /// routes), as of the last reading pull. Still true once a write was
+    /// refused with 403 (`read_denied`): marks keep queueing, and wait.
     pub fn read_sync_on(&self) -> bool {
-        self.store.meta(READ_SYNC).as_deref() == Some("1") && !self.state().read_denied
+        self.store.meta(READ_SYNC).as_deref() == Some("1")
+    }
+
+    /// `op` is a read-state op this session's credential may not send.
+    fn read_held(&self, op: &Op) -> bool {
+        self.read_held_locked(&self.state(), op)
+    }
+
+    fn read_held_locked(&self, st: &NetState, op: &Op) -> bool {
+        st.read_denied && matches!(op.kind, OpKind::Read | OpKind::Unread)
     }
 
-    /// A read-state write answered 403: stop sending them this session, and
-    /// say so once. The local marks stay.
-    fn read_denied(&self) -> Result<()> {
+    /// A read-state write answered 403 (`e`, which names the missing scope,
+    /// `reading:state`, when the server says): hold read ops for the rest
+    /// of the session, queued, and say once how to get them sent. No retry
+    /// until a new sign-in (a new session) or the next launch.
+    fn read_denied(&self, e: &CoreError) -> Result<()> {
         let first = !std::mem::replace(&mut self.state().read_denied, true);
         if first {
-            self.emit(CoreEvent::Error(
-                "Read state stays on this Mac: this sign-in can't save it to your blyg".into(),
-            ));
+            self.emit(CoreEvent::Error(read_denied_message(e)));
         }
         Ok(())
     }
@@ -1194,6 +1227,9 @@ impl Engine {
     fn reconcile_reads(&self, pulled: &[ReadingItem]) -> Result<bool> {
         let clear = self.read_clear_on();
         if self.store.meta(READ_SYNC_UPLOADED).is_none() {
+            if self.state().read_denied {
+                return Ok(false);
+            }
             let marks = self.store.read_marks(clear)?;
             for chunk in marks.chunks(crate::api::wire::READ_BATCH_MAX) {
                 match self.api.put_reads(chunk) {
@@ -1202,8 +1238,9 @@ impl Engine {
                         self.set_read_sync(false)?;
                         return Ok(false);
                     }
-                    Err(CoreError::Rejected { status: 403, .. }) => {
-                        self.read_denied()?;
+                    Err(e @ CoreError::Rejected { status: 403, .. }) => {
+                        // Sent whole by a later session that may write.
+                        self.read_denied(&e)?;
                         return Ok(false);
                     }
                     // Refused outright (a row it doesn't like): the rest
@@ -1264,11 +1301,13 @@ impl Engine {
             }
             Ok(())
         };
-        let denied = |this: &Self| -> Result<()> {
-            // Unsent this session; the rows keep their `read_at` / floor,
-            // so a later session that may write sends them.
-            done(this)?;
-            this.read_denied()
+        let denied = |this: &Self, e: &CoreError| -> Result<()> {
+            // Held, not dropped: the batch stays queued for a credential
+            // that may write it (`read_denied`).
+            for o in &batch {
+                this.store.set_in_flight(o.seq, false)?;
+            }
+            this.read_denied(e)
         };
         let gone = |this: &Self| -> Result<()> {
             // The endpoint is gone (a downgraded server).
@@ -1295,7 +1334,7 @@ impl Engine {
                     done(self)
                 }
                 Err(CoreError::NotFound) => gone(self),
-                Err(CoreError::Rejected { status: 403, .. }) => denied(self),
+                Err(e @ CoreError::Rejected { status: 403, .. }) => denied(self, &e),
                 Err(e) => {
                     for o in &batch[1..] {
                         self.store.set_in_flight(o.seq, false)?;
@@ -1340,7 +1379,7 @@ impl Engine {
                 Ok(())
             }
             Err(CoreError::NotFound) => gone(self),
-            Err(CoreError::Rejected { status: 403, .. }) => denied(self),
+            Err(e @ CoreError::Rejected { status: 403, .. }) => denied(self, &e),
             // `read_at` refused (a strict body on a server that said it
             // could clear): stop sending it and retry without.
             Err(CoreError::Rejected {
@@ -1605,3 +1644,6 @@ impl Engine {
         self.pull()
     }
 }
+
+#[cfg(test)]
+mod read_held_tests; // --- read/unread ---
diff --git a/crates/blyg-core/src/sync/read_held_tests.rs b/crates/blyg-core/src/sync/read_held_tests.rs
new file mode 100644
index 0000000..8d43436
--- /dev/null
+++ b/crates/blyg-core/src/sync/read_held_tests.rs
@@ -0,0 +1,140 @@
+//! --- read/unread --- Read state held for the scope (`read_denied`), on
+//! real SQLite: the ops stay queued, new marks still queue, and the rest of
+//! the outbox goes on without them. (The 403 itself is tested against a
+//! real studio: `tests/e2e.rs`, `read_state_needs_its_own_scope`.)
+
+use std::collections::HashMap;
+
+use super::*;
+use crate::api::auth::Credential;
+
+fn row(rid: &str) -> ReadingItem {
+    ReadingItem {
+        subscription_id: "s1".into(),
+        remote_id: rid.into(),
+        subscription_title: "s1".into(),
+        origin: "https://a.example/".into(),
+        kind: Kind::Fragment,
+        state: "current".into(),
+        version: 1,
+        created: None,
+        updated: None,
+        observed_at: "2026-01-01T00:00:00Z".into(),
+        content_md: rid.into(),
+        content_html: String::new(),
+        author: None,
+        page: Some(format!("https://a.example/f/{rid}")),
+        thumb: None,
+        hoppers: vec![],
+        pinned_version_retained: None,
+        read_version: None,
+        stub_of: None,
+        forked_from: None,
+        transclusions: vec![],
+        lineage_known: false,
+    }
+}
+
+/// An engine on an in-memory store with read sync on, two reading rows,
+/// and a read op queued ahead of a draft's create. Nothing here touches the
+/// network (the API points at a closed port).
+fn engine() -> Engine {
+    let store = Store::open_in_memory().unwrap();
+    let kinds: HashMap<String, SubscriptionKind> =
+        [("s1".to_string(), SubscriptionKind::Blyg)].into();
+    store
+        .merge_reading(&[row("A"), row("B")], true, &kinds)
+        .unwrap();
+    store.set_meta(READ_SYNC, "1").unwrap();
+    assert_eq!(store.mark_read_rows("s1", "A", true).unwrap().len(), 1);
+    store.create_draft(Kind::Fragment, "a draft", 0).unwrap();
+    let api = Api::new("http://127.0.0.1:9", Credential::Token("t".into()));
+    Engine::new(store, api, SyncOptions::default())
+}
+
+fn kinds_queued(e: &Engine) -> Vec<OpKind> {
+    e.store.ops().unwrap().into_iter().map(|o| o.kind).collect()
+}
+
+#[test]
+fn a_held_read_stays_queued_and_lets_the_rest_through() {
+    let e = engine();
+    assert_eq!(kinds_queued(&e), vec![OpKind::Read, OpKind::Create]);
+    // Before a refusal, the read goes first.
+    assert_eq!(e.next_op(None, true).unwrap().unwrap().kind, OpKind::Read);
+
+    let refused = CoreError::Rejected {
+        status: 403,
+        message: crate::api::oauth::missing_scope_message(
+            &[crate::api::oauth::READ_STATE_SCOPE.into()],
+            Some("owner:read owner:draft owner:publish owner:manage offline_access"),
+        ),
+        details: vec![],
+    };
+    e.read_denied(&refused).unwrap();
+    // The create goes; the read waits, still queued, and isn't picked again.
+    let next = e.next_op(None, true).unwrap().unwrap();
+    assert_eq!(next.kind, OpKind::Create);
+    assert_eq!(kinds_queued(&e), vec![OpKind::Read, OpKind::Create]);
+    let read = &e.store.ops().unwrap()[0];
+    assert!(e.read_held(read) && !e.read_held(&next));
+    e.store.drop_op(next.seq).unwrap();
+    assert!(e.next_op(None, true).unwrap().is_none(), "no retry loop");
+
+    // Marks made meanwhile still queue, for a later sign-in to send.
+    assert!(e.read_sync_on());
+    e.store.mark_read_rows("s1", "B", true).unwrap();
+    assert_eq!(kinds_queued(&e), vec![OpKind::Read, OpKind::Read]);
+    assert!(e.next_op(None, true).unwrap().is_none());
+
+    // A new session (a new sign-in) sends them.
+    let again = Engine::new(
+        Store::open_in_memory().unwrap(),
+        Api::new("http://127.0.0.1:9", Credential::Token("t".into())),
+        SyncOptions::default(),
+    );
+    assert!(!again.state().read_denied);
+}
+
+#[test]
+fn the_notice_says_to_sign_in_again_and_names_the_scope() {
+    let refused = CoreError::Rejected {
+        status: 403,
+        message: crate::api::oauth::missing_scope_message(
+            &[crate::api::oauth::READ_STATE_SCOPE.into()],
+            Some("owner:read owner:draft owner:publish owner:manage offline_access"),
+        ),
+        details: vec![],
+    };
+    let m = read_denied_message(&refused);
+    assert!(m.starts_with("Read state isn't syncing."), "{m}");
+    assert!(m.contains("reading:state"), "{m}");
+    assert!(m.contains("Sign in with the browser again"), "{m}");
+    assert!(m.contains("kept on this Mac"), "{m}");
+    // A Worker's plain 403 (no challenge) still reads sensibly.
+    let m = read_denied_message(&CoreError::Rejected {
+        status: 403,
+        message: String::new(),
+        details: vec![],
+    });
+    assert!(m.contains("refused to save read state"), "{m}");
+}
+
+#[test]
+fn the_notice_is_sent_once_a_session() {
+    let e = engine();
+    let (tx, rx) = std::sync::mpsc::channel();
+    e.set_sink(Arc::new(move |ev| {
+        if let CoreEvent::Error(m) = ev {
+            let _ = tx.send(m);
+        }
+    }));
+    let refused = CoreError::Rejected {
+        status: 403,
+        message: "no".into(),
+        details: vec![],
+    };
+    e.read_denied(&refused).unwrap();
+    e.read_denied(&refused).unwrap();
+    assert_eq!(rx.try_iter().count(), 1);
+}
diff --git a/crates/blyg-core/tests/common/contract.rs b/crates/blyg-core/tests/common/contract.rs
index 9a6d1da..0c10c6f 100644
--- a/crates/blyg-core/tests/common/contract.rs
+++ b/crates/blyg-core/tests/common/contract.rs
@@ -27,6 +27,12 @@ pub fn extensions() -> &'static Contract {
     C.get_or_init(|| Contract::load(include_str!("../fixtures/extensions.json")))
 }
 
+/// The `lineage-glyph` studio extension's owner reads (studio dc632c5).
+pub fn lineage_glyph() -> &'static Contract {
+    static C: OnceLock<Contract> = OnceLock::new();
+    C.get_or_init(|| Contract::load(include_str!("../fixtures/lineage-glyph.json")))
+}
+
 impl Contract {
     fn load(text: &str) -> Contract {
         let doc: Value = serde_json::from_str(text).expect("contract JSON");
diff --git a/crates/blyg-core/tests/e2e.rs b/crates/blyg-core/tests/e2e.rs
index c03e25c..992a3bb 100644
--- a/crates/blyg-core/tests/e2e.rs
+++ b/crates/blyg-core/tests/e2e.rs
@@ -5,7 +5,7 @@
 //!
 //! - `BLYG_E2E_URL`   the Worker under test (e.g. `http://127.0.0.1:18787`)
 //! - `BLYG_E2E_TOKEN` its `BLYG_OWNER_TOKEN`, or on studio 0.28+ a manual
-//!   token minted with all four owner scopes
+//!   token minted with every owner scope (`reading:state` too, on 0.39+)
 //! - `BLYG_E2E_TOKEN_B` the same for `BLYG_E2E_URL_B` (studio 0.28+ only;
 //!   without it, `b` takes `a`'s credential)
 //! - `BLYG_E2E_OWNER_PASSWORD` its studio password, always: the browser
@@ -2105,7 +2105,7 @@ fn owner_allows(base: &str, authorize_url: &str, password: &str) -> String {
     assert_eq!(
         scopes,
         blyg_core::api::oauth::OWNER_SCOPES,
-        "all four offered"
+        "every owner scope offered (reading:state: studio 0.39+)"
     );
     let mut form: Vec<(&str, &str)> = vec![("handle", &handle), ("decision", "allow")];
     form.extend(scopes.iter().map(|s| ("scope", s.as_str())));
@@ -2393,6 +2393,205 @@ fn a_token_without_a_scope_says_which() {
     assert_eq!(server_item(&sid)["content_md"], text);
 }
 
+/// A manual token with `scope`, minted as Studio → More → Client access
+/// does; `None` (skipped) on a studio without manual tokens.
+fn minted_token(scope: &[&str]) -> Option<String> {
+    let e = e2e();
+    let password = owner_password()?;
+    let session = auth::login(&e.url, &password).expect("studio sign-in");
+    let minted = match agent()
+        .post(&format!("{}/api/authorizations", e.url))
+        .set("cookie", &format!("{}={session}", auth::SESSION_COOKIE))
+        .send_json(json!({"name": "burrow-e2e-scoped", "scope": scope, "resource": "api"}))
+    {
+        Ok(r) => r.into_json::<Value>().unwrap(),
+        Err(ureq::Error::Status(404, _)) => return None,
+        Err(e) => panic!("minting a token: {e}"),
+    };
+    Some(
+        minted["access_token"]
+            .as_str()
+            .expect("a token")
+            .to_string(),
+    )
+}
+
+/// The read/unread ops waiting in a closed backend's outbox.
+fn queued_reads(dir: &Path) -> usize {
+    let store = blyg_core::store::Store::open(&dir.join(blyg_core::live::DB_FILE)).unwrap();
+    store
+        .ops()
+        .unwrap()
+        .iter()
+        .filter(|o| {
+            matches!(
+                o.kind,
+                blyg_core::store::OpKind::Read | blyg_core::store::OpKind::Unread
+            )
+        })
+        .count()
+}
+
+#[test]
+#[ignore = "needs a local Worker: scripts/e2e-local.sh"]
+fn read_state_needs_its_own_scope() {
+    // Studio 0.39 moved the read-state writes from owner:manage to
+    // reading:state (provisional name). A sign-in from before then holds
+    // the four owner scopes only: its reads are refused, stay queued, and
+    // go once a credential with the scope arrives; the rest still syncs.
+    use blyg_core::api::oauth::READ_STATE_SCOPE;
+    let e = e2e();
+    let api = Api::new(&e.url, e.cred.clone());
+    let Some(page) = api.stock_reading(0).unwrap() else {
+        eprintln!("SKIP: no GET /api/reading");
+        return;
+    };
+    if !e.stock || !page.read_sync() {
+        eprintln!("SKIP: needs a stock studio that keeps read state (0.39+)");
+        return;
+    }
+    let old_four = ["owner:read", "owner:draft", "owner:publish", "owner:manage"];
+    let Some(old) = minted_token(&old_four) else {
+        eprintln!("SKIP: no manual tokens here");
+        return;
+    };
+    let src_url = url_b();
+    let (d1, d2, d3) = (
+        tempfile::tempdir().unwrap(),
+        tempfile::tempdir().unwrap(),
+        tempfile::tempdir().unwrap(),
+    );
+    let source = backend_at(d3.path(), &src_url, cred_b(), false);
+    let t = tag("scope");
+    let (_, a) = published(&source, Kind::Fragment, &format!("{t} A"), None);
+    let owner_mac = manual(d2.path());
+    let sub = owner_mac.subscribe(&src_url, Some("Scope")).unwrap();
+    let _unsub = Unsub(&owner_mac, sub.id.clone());
+    sync_until_held(&owner_mac, &[&a]);
+
+    // The API names the missing scope, never the token.
+    let scoped = Api::new(&e.url, Credential::Token(old.clone()));
+    match scoped.put_read(&sub.id, &a, 1, None) {
+        Err(CoreError::Rejected {
+            status: 403,
+            message,
+            ..
+        }) => {
+            assert!(message.contains(READ_STATE_SCOPE), "{message}");
+            assert!(!message.contains(&old), "never the token");
+        }
+        other => panic!("expected a 403 naming {READ_STATE_SCOPE}, got {other:?}"),
+    }
+    assert_eq!(server_read_version(&a), Some(Value::Null));
+
+    // The app on that token: the read is held, the draft still goes.
+    let b = backend_at(d1.path(), &e.url, Credential::Token(old), false);
+    let (tx, rx) = std::sync::mpsc::channel();
+    b.set_event_sink(Box::new(move |ev| {
+        if let CoreEvent::Error(m) = ev {
+            let _ = tx.send(m);
+        }
+    }));
+    sync_until_held(&b, &[&a]);
+    assert_eq!(b.set_read(&[(sub.id.clone(), a.clone())], true).unwrap(), 1);
+    let text = tag("goes-anyway");
+    let id = b.create_draft(Kind::Fragment, &text).unwrap();
+    b.sync_now().expect("other sync keeps working");
+    assert_eq!(server_item(&sid_of(&b, &id))["content_md"], text);
+    assert_eq!(server_read_version(&a), Some(Value::Null), "refused");
+    assert!(!reading_item(&b, &a).unwrap().is_unread(), "read here");
+    b.sync_now().unwrap();
+    b.sync_now().unwrap();
+    let notices: Vec<String> = rx.try_iter().collect();
+    let about_reads: Vec<&String> = notices
+        .iter()
+        .filter(|m| m.contains("Read state"))
+        .collect();
+    assert_eq!(about_reads.len(), 1, "said once: {notices:?}");
+    assert!(
+        about_reads[0].contains(READ_STATE_SCOPE),
+        "{}",
+        about_reads[0]
+    );
+    assert!(
+        about_reads[0].contains("Client access"),
+        "a manual token: make a new one: {}",
+        about_reads[0]
+    );
+    drop(b);
+    assert_eq!(queued_reads(d1.path()), 1, "the read is still queued");
+
+    // A credential with reading:state (a new sign-in) sends it.
+    let b = manual(d1.path());
+    b.sync_now().unwrap();
+    assert_eq!(server_read_version(&a), Some(json!(1)));
+    drop(b);
+    assert_eq!(queued_reads(d1.path()), 0);
+}
+
+#[test]
+#[ignore = "needs a local Worker: scripts/e2e-local.sh"]
+fn signing_in_again_with_a_kept_client_adds_reading_state() {
+    // An existing user's fix for held read state: sign in again. Burrow 0.10
+    // registered (and kept) its client asking for the four owner scopes;
+    // the studio doesn't hold a client to its registered scope, so the kept
+    // client is reused and the new grant has reading:state.
+    use blyg_core::api::oauth::{self, READ_STATE_SCOPE, client_key};
+    let e = e2e();
+    let Some(d) = oauth::discover(&e.url).unwrap() else {
+        eprintln!("skipped: this studio has no browser sign-in (older than 0.28)");
+        return;
+    };
+    if !d.scope.split(' ').any(|s| s == READ_STATE_SCOPE) {
+        eprintln!("skipped: this studio has no {READ_STATE_SCOPE} (older than 0.39)");
+        return;
+    }
+    let r: Value = agent()
+        .post(&d.registration_endpoint)
+        .send_json(json!({
+            "client_name": oauth::CLIENT_NAME,
+            "application_type": "native",
+            "redirect_uris": oauth::registered_redirect_uris(),
+            "token_endpoint_auth_method": "none",
+            "grant_types": ["authorization_code", "refresh_token"],
+            "response_types": ["code"],
+            "scope": "owner:read owner:draft owner:publish owner:manage offline_access",
+        }))
+        .expect("register a 0.10-style client")
+        .into_json()
+        .unwrap();
+    let old_id = r["client_id"].as_str().unwrap().to_string();
+    let mem = config::MemoryTokenStore::default();
+    let store: &dyn config::TokenStore = &mem;
+    store
+        .set(
+            &client_key(&e.url),
+            &json!({"issuer": d.issuer, "client_id": old_id,
+                    "redirect_uris": oauth::registered_redirect_uris()})
+            .to_string(),
+        )
+        .unwrap();
+    let Some(grant) = signed_in_with_browser(store) else {
+        return;
+    };
+    assert_eq!(grant.client_id, old_id, "the kept client is reused");
+    assert!(
+        grant.scope.split(' ').any(|s| s == READ_STATE_SCOPE),
+        "{}",
+        grant.scope
+    );
+    // And it may write read state (refused for a reading row it doesn't
+    // know only as `stored: false`, never 403).
+    let api = Api::new(
+        &e.url,
+        Credential::OAuth(oauth::OAuthSession::new(grant.clone())),
+    );
+    match api.put_read("no-such-sub", "no-such-item", 1, None) {
+        Ok(_) => {}
+        Err(e) => panic!("a reading:state grant may write read state: {e:?}"),
+    }
+}
+
 // ------------------------------------------------- studio 0.30–0.33 reading
 
 /// The source blyg's own name for itself, as a subscribe preview gives it.
@@ -2781,3 +2980,411 @@ fn read_and_unread_sync_through_upstreams_read_state() {
     assert!(!reading_item(&mac2, &b).unwrap().is_unread());
     mac1.unsubscribe(&sub.id).unwrap();
 }
+
+// --- lineage counts --- blygger-studio's `lineage-glyph` extension (PR #53,
+// dc632c5). Run against a studio built with it compiled in:
+// `BLYG_EXTENSIONS=lineage-glyph npm run build` in the Worker dir.
+
+/// Turn the extension on or off on `a` (`owner:manage`). False when the
+/// build doesn't carry it (the setting refuses unknown names).
+fn set_lineage_glyph(on: bool) -> bool {
+    let e = e2e();
+    let names = if on {
+        json!(["lineage-glyph"])
+    } else {
+        json!([])
+    };
+    let (st, v) = owner(
+        "PATCH",
+        &e.url,
+        "/api/settings",
+        Some(json!({ "extensions": names })),
+    );
+    if st != 200 {
+        eprintln!("lineage-glyph can't be turned on here ({st}): {v}");
+    }
+    st == 200
+}
+
+/// `GET path` as the owner must answer 200 with a body that matches the
+/// vendored lineage-glyph contract.
+fn lineage_conforms(path: &str) -> Value {
+    let e = e2e();
+    let (st, v) = owner("GET", &e.url, path, None);
+    let (p, _) = path.split_once('?').unwrap_or((path, ""));
+    let segs: Vec<&str> = p.trim_start_matches('/').split('/').collect();
+    if let Err(err) = contract::lineage_glyph().check_response("GET", &segs, st, &v) {
+        panic!("GET {path} broke the lineage-glyph contract: {err}\n{v}");
+    }
+    assert_eq!(st, 200, "GET {path}: {v}");
+    v
+}
+
+#[test]
+#[ignore = "needs a local Worker: scripts/e2e-local.sh"]
+fn lineage_counts_come_from_the_node_when_it_serves_them() {
+    use blyg_core::lineage::{Centre, Local, imported_key};
+    let e = e2e();
+    // A stock build takes `extensions: []` but refuses to turn on one it
+    // wasn't built with: find out before subscribing to anything, so a skip
+    // leaves nothing behind for the tests after it.
+    if !set_lineage_glyph(true) || !set_lineage_glyph(false) {
+        eprintln!("skipped: this studio build doesn't carry lineage-glyph");
+        return;
+    }
+    let src_url = url_b();
+    let (d1, d2, d3) = (
+        tempfile::tempdir().unwrap(),
+        tempfile::tempdir().unwrap(),
+        tempfile::tempdir().unwrap(),
+    );
+    let source = backend_at(d2.path(), &src_url, cred_b(), false);
+    let t = tag("lineage");
+    // On b: a fragment, and a thread that quotes it.
+    let (_, frag) = published(&source, Kind::Fragment, &format!("{t} the bench"), None);
+    let (_, thread) = published(
+        &source,
+        Kind::Thread,
+        &format!("![[{frag}]]\n\n{t} on the bench"),
+        None,
+    );
+
+    // a subscribes to b and holds both.
+    let off = manual(d1.path());
+    let sub = off.subscribe(&src_url, Some("Lineage source")).unwrap();
+    sync_until_held(&off, &[&frag, &thread]);
+    let keys = vec![imported_key(&sub.id, &frag), imported_key(&sub.id, &thread)];
+
+    // Off: the route is a 404, taken silently as "count here", and remembered.
+    let (st, _) = owner(
+        "GET",
+        &e.url,
+        "/api/ext/lineage-glyph/summaries?keys=%5B%5D",
+        None,
+    );
+    assert_eq!(st, 404);
+    assert_eq!(off.lineage_summaries(&keys, 0), None);
+    assert_eq!(off.cached_lineage_summaries(&keys), None);
+    let rows = off.reading();
+    let base = off.base_url().expect("a base url");
+    let local = Local::build(&rows, &off.items(), Some(&base), &[]);
+    let origin_b = reading_item(&off, &frag).unwrap().origin;
+    let here_frag = local.summary(&origin_b, &frag);
+    let here_thread = local.summary(&origin_b, &thread);
+    assert_eq!(here_frag.down.transclusion, 1, "{here_frag:?}");
+    assert_eq!(here_thread.up.transclusion, 1, "{here_thread:?}");
+
+    // On: a fresh Mac asks the node, and the node agrees with the local port.
+    assert!(set_lineage_glyph(true));
+    let on = manual(d3.path());
+    on.sync_now().unwrap();
+    let v = lineage_conforms(&format!(
+        "/api/ext/lineage-glyph/summaries?keys={}",
+        url::form_urlencoded::byte_serialize(serde_json::to_string(&keys).unwrap().as_bytes())
+            .collect::<String>()
+    ));
+    assert_eq!(v["summaries"].as_object().unwrap().len(), 2, "{v}");
+    let served = on.lineage_summaries(&keys, 0).expect("served now");
+    assert_eq!(served[&keys[0]], here_frag, "the node and this Mac agree");
+    assert_eq!(served[&keys[1]], here_thread);
+    assert_eq!(
+        on.cached_lineage_summaries(&keys).expect("cached")[&keys[0]],
+        here_frag
+    );
+
+    // The ⌘J graph: the thread is below the fragment, by reference.
+    lineage_conforms(&format!(
+        "/api/ext/lineage-glyph/lineage?{}",
+        Centre::Imported {
+            sub: sub.id.clone(),
+            id: frag.clone()
+        }
+        .query()
+    ));
+    let graph = on
+        .lineage_graph(
+            &Centre::Imported {
+                sub: sub.id.clone(),
+                id: frag.clone(),
+            },
+            0,
+        )
+        .expect("a graph");
+    assert_eq!(graph.summary(), here_frag);
+    assert!(
+        graph
+            .descendants
+            .iter()
+            .any(|d| d.post.id.as_deref() == Some(thread.as_str())),
+        "{graph:?}"
+    );
+
+    // Off again: the next ask finds out, drops what it served, and counts here.
+    assert!(set_lineage_glyph(false));
+    assert_eq!(on.lineage_summaries(&keys, 0), None);
+    assert_eq!(on.cached_lineage_summaries(&keys), None);
+    off.unsubscribe(&sub.id).unwrap();
+}
+
+// ---------------------------------------------------------------- OPML
+
+/// A tiny static feed server on 127.0.0.1 (never the internet): `path →
+/// body`, 404 for anything else. Lives as long as the test process.
+fn serve_feeds(files: Vec<(&'static str, String)>) -> String {
+    use std::io::{BufRead, BufReader, Write};
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    let addr = listener.local_addr().unwrap();
+    let files = std::sync::Arc::new(files);
+    std::thread::spawn(move || {
+        for stream in listener.incoming().flatten() {
+            let files = files.clone();
+            std::thread::spawn(move || {
+                let mut reader = BufReader::new(stream.try_clone().unwrap());
+                let mut line = String::new();
+                if reader.read_line(&mut line).is_err() {
+                    return;
+                }
+                // Drain the headers.
+                let mut h = String::new();
+                while reader.read_line(&mut h).is_ok_and(|n| n > 2) {
+                    h.clear();
+                }
+                // The path without the query.
+                let target = line.split_whitespace().nth(1).unwrap_or("/");
+                let path = target.split('?').next().unwrap_or("/");
+                let (status, ctype, body) = match files.iter().find(|(p, _)| *p == path) {
+                    Some((p, b)) => (
+                        "200 OK",
+                        if p.ends_with(".atom") {
+                            "application/atom+xml"
+                        } else {
+                            "application/rss+xml"
+                        },
+                        b.clone(),
+                    ),
+                    None => ("404 Not Found", "text/plain", "not here".to_string()),
+                };
+                let mut s = stream;
+                let _ = write!(
+                    s,
+                    "HTTP/1.1 {status}\r\nContent-Type: {ctype}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
+                    body.len()
+                );
+            });
+        }
+    });
+    format!("http://{addr}")
+}
+
+fn rss(title: &str, link: &str) -> String {
+    format!(
+        r#"<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"><channel><title>{title}</title><link>{link}</link><description>Invented sample feed</description><item><title>Hello from {title}</title><link>{link}hello</link><guid>{link}hello</guid><pubDate>Fri, 02 Oct 2026 10:00:00 GMT</pubDate><description>An invented post.</description></item></channel></rss>"#
+    )
+}
+
+fn atom(title: &str, link: &str) -> String {
+    format!(
+        r#"<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom"><title>{title}</title><link href="{link}"/><id>{link}</id><updated>2026-10-02T10:00:00Z</updated><entry><title>Hello from {title}</title><link href="{link}hello"/><id>{link}hello</id><updated>2026-10-02T10:00:00Z</updated><summary>An invented post.</summary></entry></feed>"#
+    )
+}
+
+/// OPML import against the real studio: a mixed file (two new feeds, one
+/// already followed, one dead URL) maps 201 / 409 / 422, files what's added
+/// in the local "Imported feeds" folder (and leaves the followed one where
+/// it was), keeps them out of the public blogroll, and export round-trips.
+/// With `BLYG_E2E_BLYGGER` (a built `blygger`), the CLI does it too.
+#[test]
+#[ignore]
+fn opml_import_and_export() {
+    use blyg_core::opml::{self, FailKind, IMPORT_FOLDER, Outcome, Pace};
+    let e = e2e();
+    let t = tag("opml");
+    let host = serve_feeds(vec![
+        ("/ada.xml", rss("Ada Example", "https://ada.example.com/")),
+        ("/kit.atom", atom("Kit Example", "https://kit.example.org/")),
+        ("/rue.xml", rss("Rue Example", "https://rue.example.net/")),
+        (
+            "/moss.xml",
+            rss("Moss Example", "https://moss.example.org/"),
+        ),
+    ]);
+    // A query makes each run's feeds new to the studio.
+    let (ada, kit, rue, dead) = (
+        format!("{host}/ada.xml?run={t}"),
+        format!("{host}/kit.atom?run={t}"),
+        format!("{host}/rue.xml?run={t}"),
+        format!("{host}/gone.xml"),
+    );
+    let d = tempfile::tempdir().unwrap();
+    let me = manual(d.path());
+
+    // Rue is already followed, and filed by the user.
+    let followed = me.subscribe(&rue, None).expect("subscribe to a local feed");
+    let mine = me.create_folder(&format!("Mine {t}")).unwrap();
+    me.set_subscription_folder(&followed.id, Some(&mine.id))
+        .unwrap();
+
+    let file = format!(
+        r#"<?xml version="1.0" encoding="UTF-8"?>
+<opml version="2.0"><head><title>Another reader</title></head><body>
+  <outline text="Tech" title="Tech">
+    <outline type="rss" text="Ada &amp; co" xmlUrl="{ada}" htmlUrl="https://ada.example.com/"/>
+    <outline type="atom" text="Kit" xmlUrl="{kit}"/>
+  </outline>
+  <outline text="Rue" xmlUrl="{}"/>
+  <outline text="Gone" xmlUrl="{dead}"/>
+</body></opml>"#,
+        followed.feed_url
+    );
+    let parsed = opml::parse(&file).unwrap();
+    assert_eq!(parsed.feeds.len(), 4);
+    // The preview marks Rue as followed.
+    let subs = me.subscriptions();
+    let marks: Vec<bool> = parsed
+        .feeds
+        .iter()
+        .map(|f| opml::followed(f, &subs).is_some())
+        .collect();
+    assert_eq!(marks, [false, false, true, false], "{subs:?}");
+
+    // Run all four (Rue too) to see each answer.
+    let pace = Pace {
+        concurrency: 2,
+        interval: Duration::from_millis(300),
+        max_waits: 3,
+    };
+    let results = opml::run_import(
+        &me,
+        &parsed.feeds,
+        &pace,
+        &std::sync::atomic::AtomicBool::new(false),
+        &|_| {},
+    );
+    let ids: Vec<String> = results[..2]
+        .iter()
+        .map(|r| match r {
+            Some(Outcome::Added { id, .. }) => id.clone(),
+            other => panic!("201 for a new feed: {other:?}"),
+        })
+        .collect();
+    assert_eq!(results[2], Some(Outcome::AlreadyFollowing), "409");
+    match &results[3] {
+        Some(Outcome::Failed {
+            kind: FailKind::NotAFeed,
+            reason,
+        }) => assert!(
+            reason.contains("could not resolve"),
+            "the server's reason: {reason}"
+        ),
+        other => panic!("422 for a dead URL: {other:?}"),
+    }
+    assert_eq!(
+        opml::Summary::of(&results).line(),
+        "2 added, 1 already followed, 1 failed"
+    );
+
+    // Filed locally; the followed one stays where the user put it.
+    let folder = me
+        .folders()
+        .into_iter()
+        .find(|f| f.name == IMPORT_FOLDER)
+        .expect("the Imported feeds folder");
+    let filed = me.subscription_folders();
+    for id in &ids {
+        assert_eq!(filed.get(id), Some(&folder.id));
+    }
+    assert_eq!(filed.get(&followed.id), Some(&mine.id));
+
+    // Not in the public blogroll: new subscriptions are in_blogroll = 0.
+    let api = Api::new(&e.url, e.cred.clone());
+    let server = api.list_subscriptions().unwrap();
+    for id in &ids {
+        let s = server.iter().find(|s| &s.id == id).expect("on the server");
+        assert!(!s.in_blogroll, "{s:?}");
+    }
+    let (_, roll) = public_get(&format!("{}/blogroll.opml", e.url));
+    assert!(!roll.contains(&host), "{roll}");
+
+    // Export round-trips: every subscription, read back as followed.
+    let all = me.subscriptions();
+    let xml = opml::export(&all);
+    let back = opml::parse(&xml).unwrap();
+    let keys = |v: Vec<String>| {
+        let mut k: Vec<String> = v.iter().map(|u| opml::feed_key(u)).collect();
+        k.sort();
+        k
+    };
+    assert_eq!(
+        keys(back.feeds.iter().map(|f| f.xml_url.clone()).collect()),
+        keys(all.iter().map(|s| s.feed_url.clone()).collect())
+    );
+    for s in all.iter().filter(|s| s.feed_url.starts_with(&host)) {
+        assert!(back.feeds.iter().all(|f| opml::followed(f, &all).is_some()));
+        assert!(xml.contains(&s.feed_url.replace('&', "&amp;")));
+    }
+    assert_eq!(
+        all.iter().filter(|s| s.feed_url.starts_with(&host)).count(),
+        3
+    );
+
+    // The CLI, when a built `blygger` is given.
+    if let (Ok(bin), Credential::Token(token)) = (std::env::var("BLYG_E2E_BLYGGER"), &e.cred) {
+        let moss = format!("{host}/moss.xml?run={t}");
+        let dir = tempfile::tempdir().unwrap();
+        let cfg = dir.path().join("config");
+        std::fs::write(&cfg, format!("blyg-url = {}\n", e.url)).unwrap();
+        let opml_file = dir.path().join("feeds.opml");
+        std::fs::write(
+            &opml_file,
+            format!(
+                "<opml version=\"2.0\"><body><outline text=\"Moss\" xmlUrl=\"{moss}\"/><outline text=\"Ada\" xmlUrl=\"{}\"/></body></opml>",
+                all.iter()
+                    .find(|s| s.id == ids[0])
+                    .map(|s| s.feed_url.clone())
+                    .unwrap()
+            ),
+        )
+        .unwrap();
+        let run = |args: &[&str]| {
+            let out = Command::new(&bin)
+                .args(args)
+                .env("BLYGGER_CONFIG", &cfg)
+                .env("BLYGGER_DATA_DIR", dir.path().join("data"))
+                .env("BLYGGER_TEST_TOKEN", token)
+                .output()
+                .unwrap();
+            let s = String::from_utf8_lossy(&out.stdout).into_owned();
+            let err = String::from_utf8_lossy(&out.stderr).into_owned();
+            assert!(!s.contains(token.as_str()) && !err.contains(token.as_str()));
+            (out.status.code(), s, err)
+        };
+        let f = opml_file.to_str().unwrap();
+        let (code, out, err) = run(&["+import-opml", f, "--dry-run"]);
+        assert_eq!(code, Some(0), "{out}{err}");
+        assert!(out.contains("would add") && out.contains("Moss"), "{out}");
+        assert!(out.contains("already followed"), "{out}");
+        let (code, out, err) = run(&["+import-opml", f]);
+        assert_eq!(code, Some(0), "{out}{err}");
+        assert!(
+            out.contains(
+                "1 added, 1 already followed, 0 failed. Added to the Imported feeds folder in the Reader."
+            ),
+            "{out}{err}"
+        );
+        let exported = dir.path().join("burrow-subscriptions.opml");
+        let (code, out, err) = run(&["+export-opml", exported.to_str().unwrap()]);
+        assert_eq!(code, Some(0), "{out}{err}");
+        let back = opml::read_file(&exported).unwrap();
+        assert!(back.feeds.iter().any(|f| f.xml_url.contains("/moss.xml")));
+        eprintln!("the CLI imported and exported");
+    } else {
+        eprintln!("BLYG_E2E_BLYGGER not set (or a password sign-in): the CLI part skipped");
+    }
+
+    // Leave the studio as it was.
+    for s in api.list_subscriptions().unwrap() {
+        if s.feed_url.starts_with(&host) {
+            api.delete_subscription(&s.id).unwrap();
+        }
+    }
+}
diff --git a/crates/blyg-core/tests/fixtures/README.md b/crates/blyg-core/tests/fixtures/README.md
index cfce307..ffa9368 100644
--- a/crates/blyg-core/tests/fixtures/README.md
+++ b/crates/blyg-core/tests/fixtures/README.md
@@ -12,5 +12,12 @@ against `extensions.json`. A route in neither fails the test. The mock
 server in `tests/common/` validates every request the app sends, and every
 response the mock gives, against them (`tests/common/contract.rs`).
 
+`lineage-glyph.json` is the two owner reads of blygger-studio's
+`lineage-glyph` extension (`GET /api/ext/lineage-glyph/summaries` and
+`/lineage`) and their schemas, cut from that studio's `openapi.json` at
+commit dc632c5 (branch ext/lineage-glyph, PR #53, studio 0.39.0; same
+license). The Rust types are in `src/lineage.rs`; its tests check them
+against this file, and the e2e checks a real studio's answers against it.
+
 To update it, copy `openapi.json` from a newer upstream checkout, then run
 `cargo test -p blyg-core`. Any contract violation fails the test that caused it.
diff --git a/crates/blyg-core/tests/fixtures/lineage-glyph.json b/crates/blyg-core/tests/fixtures/lineage-glyph.json
new file mode 100644
index 0000000..1365fc3
--- /dev/null
+++ b/crates/blyg-core/tests/fixtures/lineage-glyph.json
@@ -0,0 +1,729 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "blygger-studio lineage-glyph extension (vendored subset)",
+    "version": "0.39.0+dc632c5",
+    "description": "The two owner reads of the lineage-glyph studio extension, cut from blygger-studio openapi.json at commit dc632c5 (branch ext/lineage-glyph, PR #53). MIT License, Copyright (c) 2026 Venkatesh Rao."
+  },
+  "paths": {
+    "/api/ext/lineage-glyph/lineage": {
+      "get": {
+        "operationId": "extLineageGlyphGetLineage",
+        "tags": [
+          "extension",
+          "extension:lineage-glyph"
+        ],
+        "security": [
+          {
+            "ownerSession": []
+          },
+          {
+            "ownerOAuth": [
+              "owner:read"
+            ]
+          }
+        ],
+        "description": "Extension \"lineage-glyph\". Answers only on a node that compiles the extension in and has enabled it in Settings; otherwise 404.",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1
+            },
+            "required": true,
+            "name": "id",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": false,
+            "name": "sub",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": false,
+            "name": "origin",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/LineageGlyphLineage"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "405": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "413": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "415": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "422": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "502": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/ext/lineage-glyph/summaries": {
+      "get": {
+        "operationId": "extLineageGlyphListSummaries",
+        "tags": [
+          "extension",
+          "extension:lineage-glyph"
+        ],
+        "security": [
+          {
+            "ownerSession": []
+          },
+          {
+            "ownerOAuth": [
+              "owner:read"
+            ]
+          }
+        ],
+        "description": "Extension \"lineage-glyph\". Answers only on a node that compiles the extension in and has enabled it in Settings; otherwise 404.",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 2,
+              "description": "A JSON array of up to 50 reading entry keys."
+            },
+            "required": true,
+            "description": "A JSON array of up to 50 reading entry keys.",
+            "name": "keys",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "summaries": {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/components/schemas/LineageGlyphSummary"
+                      }
+                    }
+                  },
+                  "required": [
+                    "summaries"
+                  ]
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "405": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "413": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "415": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "422": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "502": {
+            "description": "Request failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "schemas": {
+      "LineageGlyphLineage": {
+        "type": "object",
+        "properties": {
+          "node": {
+            "type": "object",
+            "properties": {
+              "origin": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "id": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "version": {
+                "type": [
+                  "integer",
+                  "null"
+                ]
+              },
+              "held": {
+                "type": [
+                  "string",
+                  "null"
+                ],
+                "enum": [
+                  "own",
+                  "imported",
+                  null
+                ]
+              },
+              "sub": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "kind": {
+                "type": [
+                  "string",
+                  "null"
+                ],
+                "enum": [
+                  "fragment",
+                  "thread",
+                  null
+                ]
+              },
+              "title": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "excerpt": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "source": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "url": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              }
+            },
+            "required": [
+              "origin",
+              "id",
+              "version",
+              "held",
+              "sub",
+              "kind",
+              "title",
+              "excerpt",
+              "source",
+              "url"
+            ]
+          },
+          "ancestors": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/LineageGlyphNode"
+            }
+          },
+          "descendants": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/LineageGlyphNode"
+            }
+          }
+        },
+        "required": [
+          "node",
+          "ancestors",
+          "descendants"
+        ]
+      },
+      "LineageGlyphNode": {
+        "type": "object",
+        "properties": {
+          "origin": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "version": {
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
+          "held": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "enum": [
+              "own",
+              "imported",
+              null
+            ]
+          },
+          "sub": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "kind": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "enum": [
+              "fragment",
+              "thread",
+              null
+            ]
+          },
+          "title": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "excerpt": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "source": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "url": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "relation": {
+            "type": "string",
+            "enum": [
+              "stub",
+              "transclusion",
+              "fork"
+            ]
+          },
+          "partial": {
+            "type": "boolean"
+          },
+          "via": {
+            "type": "string",
+            "enum": [
+              "reference",
+              "mention"
+            ]
+          }
+        },
+        "required": [
+          "origin",
+          "id",
+          "version",
+          "held",
+          "sub",
+          "kind",
+          "title",
+          "excerpt",
+          "source",
+          "url",
+          "relation",
+          "partial",
+          "via"
+        ]
+      },
+      "LineageGlyphSummary": {
+        "type": "object",
+        "properties": {
+          "up": {
+            "type": "object",
+            "properties": {
+              "stub": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "transclusion": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "fork": {
+                "type": "integer",
+                "minimum": 0
+              }
+            },
+            "required": [
+              "stub",
+              "transclusion",
+              "fork"
+            ]
+          },
+          "down": {
+            "type": "object",
+            "properties": {
+              "stub": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "transclusion": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "fork": {
+                "type": "integer",
+                "minimum": 0
+              }
+            },
+            "required": [
+              "stub",
+              "transclusion",
+              "fork"
+            ]
+          }
+        },
+        "required": [
+          "up",
+          "down"
+        ]
+      },
+      "ApiError": {
+        "type": "object",
+        "properties": {
+          "error": {
+            "type": "string"
+          },
+          "errors": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "reason": {
+                  "type": "string"
+                },
+                "at": {
+                  "type": "number"
+                },
+                "id": {
+                  "type": "string"
+                },
+                "directive": {
+                  "type": "string"
+                }
+              },
+              "additionalProperties": {}
+            }
+          },
+          "tried": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "issues": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "path": {
+                  "type": "array",
+                  "items": {
+                    "anyOf": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "type": "number"
+                      }
+                    ]
+                  }
+                },
+                "message": {
+                  "type": "string"
+                }
+              },
+              "required": [
+                "path",
+                "message"
+              ]
+            }
+          }
+        },
+        "required": [
+          "error"
+        ],
+        "additionalProperties": {}
+      }
+    },
+    "securitySchemes": {
+      "ownerSession": {
+        "type": "apiKey",
+        "in": "cookie",
+        "name": "blyg_session"
+      },
+      "ownerOAuth": {
+        "type": "oauth2",
+        "flows": {
+          "authorizationCode": {
+            "authorizationUrl": "/studio/auth/oauth2/authorize",
+            "tokenUrl": "/studio/auth/oauth2/token",
+            "scopes": {
+              "owner:read": "Read private drafts, reading material, media, and settings",
+              "owner:draft": "Create and edit drafts, upload media, and use configured AI generation",
+              "owner:publish": "Publish, withdraw, refresh, pin, and change public item responses or media",
+              "owner:manage": "Change settings, subscriptions, signals, collections, and response moderation",
+              "reading:state": "Mark reading entries read or unread"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/crates/blyg-ext-inspect/Cargo.toml b/crates/blyg-ext-inspect/Cargo.toml
new file mode 100644
index 0000000..7827296
--- /dev/null
+++ b/crates/blyg-ext-inspect/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "blyg-ext-inspect"
+edition.workspace = true
+version.workspace = true
+license.workspace = true
+description = "inspect: Burrow's bundled extension that shows the record Burrow holds for a reading entry (ids, versions, references, hashes) and its JSON"
+
+[dependencies]
+blyg-ext = { path = "../blyg-ext" }
+serde_json = "1"
+
+[dev-dependencies]
+# A real reading row, for the round trip.
+blyg-core = { path = "../blyg-core", default-features = false }
diff --git a/crates/blyg-ext-inspect/src/lib.rs b/crates/blyg-ext-inspect/src/lib.rs
new file mode 100644
index 0000000..595b0fc
--- /dev/null
+++ b/crates/blyg-ext-inspect/src/lib.rs
@@ -0,0 +1,253 @@
+//! inspect: Burrow's bundled extension that adds "inspect" to each reading
+//! entry's ⋯ sheet: the record Burrow holds for the entry (ids, versions,
+//! references, hashes) and its JSON, bodies elided. For people building
+//! clients and debugging mentions and imports. A port of blygger-studio's
+//! `inspect` extension (studio 0.39.0).
+//!
+//! It contributes one reading slot, an `[[entry-actions]]` row (docs/
+//! EXTENSIONS.md § Reading slots), and answers `extension/entry.action`
+//! from the record the host sends: nothing is fetched from the item's
+//! origin. Off until `extension = inspect` and consent (`reading.read`).
+//!
+//! - [`shape`]: elision and the summary, pure.
+
+pub mod shape;
+
+use std::path::PathBuf;
+use std::process::ExitCode;
+
+use blyg_ext::ext::{Extension, HostClient, serve};
+use blyg_ext::manifest::{Installed, Manifest, Origin};
+use blyg_ext::protocol::{InitializeParams, InitializeResult, PROTOCOL_VERSION, RpcError};
+use blyg_ext::reading::{ENTRY_ACTION, EntryActionParams, EntrySheet, SheetField};
+use blyg_ext::rpc::{params, to_value};
+use serde_json::Value;
+
+/// The extension's name (`extension = inspect`).
+pub const NAME: &str = "inspect";
+/// Its one ⋯ row.
+pub const ACTION: &str = "inspect";
+
+const MANIFEST: &str = r#"
+name = "inspect"
+version = "0.1.0"
+protocol = 1
+description = "Adds “inspect” to each reading entry’s ⋯ sheet: the record Burrow holds for it (ids, versions, references, hashes) and its JSON."
+capabilities = ["reading.read"]
+
+[[entry-actions]]
+id = "inspect"
+title = "inspect"
+detail = "ids, versions, references, JSON"
+icon = "{ }"
+"#;
+
+/// The key prefix of a post Burrow fetched to show a quote's original
+/// (`reading/original.rs`): never a real subscription id.
+const EXTERNAL: &str = "ext:";
+
+/// The manifest (checked by the same rules as any extension's).
+pub fn manifest() -> Manifest {
+    Manifest::parse(MANIFEST, true).expect("the bundled manifest is valid")
+}
+
+/// The bundled extension for the host's `HostConfig::bundled`: run as
+/// `program args…` (the app passes its own executable and
+/// `["+ext", "inspect"]`). Off until `extension = inspect`.
+pub fn bundled(program: PathBuf, args: Vec<String>) -> Installed {
+    Installed {
+        manifest: manifest(),
+        origin: Origin::Bundled { program, args },
+    }
+}
+
+/// The sheet for one entry.
+pub fn inspect(p: &EntryActionParams) -> Result<EntrySheet, RpcError> {
+    if p.action != ACTION {
+        return Err(RpcError::invalid_params(format!(
+            "{NAME} has no action {:?}",
+            p.action
+        )));
+    }
+    let record = if p.record.is_null() {
+        serde_json::to_value(&p.entry).unwrap_or(Value::Null)
+    } else {
+        p.record.clone()
+    };
+    let fields = shape::summary(&record, p.entry.content_hash.as_deref())
+        .into_iter()
+        .map(|(label, value)| SheetField { label, value })
+        .collect();
+    let description = if p.entry.subscription_id.starts_with(EXTERNAL) {
+        "Fetched from the author’s public files to show it; Burrow doesn’t keep it."
+    } else {
+        "The copy Burrow imported."
+    };
+    Ok(EntrySheet {
+        title: "inspect".into(),
+        description: Some(description.into()),
+        text: String::new(),
+        fields,
+        code: Some(shape::shaped_json(&record)),
+        language: Some("json".into()),
+    })
+}
+
+/// The extension: stateless.
+#[derive(Debug, Default)]
+pub struct InspectExt;
+
+impl Extension for InspectExt {
+    fn initialize(
+        &mut self,
+        _host: &HostClient,
+        _p: InitializeParams,
+    ) -> Result<InitializeResult, RpcError> {
+        Ok(InitializeResult {
+            protocol_version: PROTOCOL_VERSION,
+            name: NAME.into(),
+            version: env!("CARGO_PKG_VERSION").into(),
+            commands: vec![],
+            sources: vec![],
+            libraries: vec![],
+        })
+    }
+
+    fn request(&mut self, _host: &HostClient, method: &str, p: Value) -> Result<Value, RpcError> {
+        match method {
+            ENTRY_ACTION => {
+                let p: EntryActionParams = params(p)?;
+                to_value(&inspect(&p)?)
+            }
+            m => Err(RpcError::method_not_found(m)),
+        }
+    }
+}
+
+/// Serve the extension over `read`/`write` until shutdown.
+pub fn run<R, W>(read: R, write: W) -> ExitCode
+where
+    R: std::io::Read + Send + 'static,
+    W: std::io::Write + Send + 'static,
+{
+    serve(read, write, &mut InspectExt);
+    ExitCode::SUCCESS
+}
+
+/// [`run`] over this process's stdin/stdout (`blygger +ext inspect`).
+pub fn run_stdio() -> ExitCode {
+    run(std::io::stdin(), std::io::stdout())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use blyg_ext::Capability;
+    use blyg_ext::protocol::codes;
+    use blyg_ext::reading::{ReadingEntry, record_of};
+
+    /// An invented reading row in Burrow's own shape.
+    fn row() -> Value {
+        serde_json::json!({
+            "subscription_id": "sub-1", "remote_id": "r1", "subscription_title": "Rue",
+            "origin": "https://blyg.example.com", "kind": "fragment", "state": "current",
+            "version": 2, "created": null, "updated": null,
+            "observed_at": "2026-10-01T00:00:00Z",
+            "content_md": "The harbour bench floods.",
+            "content_html": "<p>The harbour bench floods.</p>",
+            "author": null, "page": null, "thumb": null, "hoppers": [],
+            "stub_of": {"url": "https://elsewhere.example/post"},
+        })
+    }
+
+    fn params(record: Value) -> EntryActionParams {
+        let entry = ReadingEntry {
+            subscription_id: "sub-1".into(),
+            remote_id: "r1".into(),
+            origin: "https://blyg.example.com".into(),
+            kind: "fragment".into(),
+            state: "current".into(),
+            version: 2,
+            title: String::new(),
+            content_html: "<p>The harbour bench floods.</p>".into(),
+            content_md: "The harbour bench floods.".into(),
+            content_hash: Some("sha256:00".into()),
+        };
+        EntryActionParams {
+            action: ACTION.into(),
+            entry,
+            record,
+        }
+    }
+
+    #[test]
+    fn the_manifest_adds_one_row_and_asks_to_read() {
+        let m = manifest();
+        assert_eq!(m.name, NAME);
+        assert_eq!(m.capabilities, vec![Capability::ReadingRead]);
+        assert!(!m.entry_byline);
+        assert_eq!(m.entry_actions.len(), 1);
+        let a = &m.entry_actions[0];
+        assert_eq!((a.id.as_str(), a.title.as_str()), ("inspect", "inspect"));
+        assert_eq!(a.detail, "ids, versions, references, JSON");
+        assert_eq!(a.icon.as_deref(), Some("{ }"));
+    }
+
+    #[test]
+    fn the_sheet_summarises_and_elides() {
+        let s = inspect(&params(row())).unwrap();
+        assert_eq!(s.title, "inspect");
+        assert_eq!(s.description.as_deref(), Some("The copy Burrow imported."));
+        let f: Vec<(&str, &str)> = s
+            .fields
+            .iter()
+            .map(|f| (f.label.as_str(), f.value.as_str()))
+            .collect();
+        assert_eq!(
+            f,
+            [
+                ("id", "r1"),
+                ("kind", "fragment"),
+                ("version", "2"),
+                ("state", "current"),
+                ("content hash", "sha256:00"),
+                ("stub of", "https://elsewhere.example/post"),
+                ("transclusions", "0"),
+            ]
+        );
+        let code = s.code.unwrap();
+        assert!(
+            code.contains("\"content_md\": \"‹25 characters, not shown›\""),
+            "{code}"
+        );
+        assert!(!code.contains("harbour"), "bodies never shown");
+        assert_eq!(s.language.as_deref(), Some("json"));
+    }
+
+    #[test]
+    fn a_real_reading_row_round_trips() {
+        let r: blyg_core::ReadingItem = serde_json::from_value(row()).unwrap();
+        let entry = ReadingEntry::of(&r);
+        assert_eq!(
+            entry.content_hash.as_deref(),
+            Some(blyg_core::content_hash("The harbour bench floods.").as_str())
+        );
+        let mut p = params(record_of(&r));
+        p.entry = entry;
+        let s = inspect(&p).unwrap();
+        assert!(s.fields.iter().any(|f| f.label == "id" && f.value == "r1"));
+        assert!(
+            s.fields
+                .iter()
+                .any(|f| f.label == "content hash" && f.value.starts_with("sha256:"))
+        );
+        assert_eq!(s.fields.last().map(|f| f.value.as_str()), Some("0"));
+    }
+
+    #[test]
+    fn another_action_is_refused() {
+        let mut p = params(row());
+        p.action = "other".into();
+        assert_eq!(inspect(&p).unwrap_err().code, codes::INVALID_PARAMS);
+    }
+}
diff --git a/crates/blyg-ext-inspect/src/shape.rs b/crates/blyg-ext-inspect/src/shape.rs
new file mode 100644
index 0000000..79590f3
--- /dev/null
+++ b/crates/blyg-ext-inspect/src/shape.rs
@@ -0,0 +1,305 @@
+//! What the inspect sheet shows: the record the client holds for an entry,
+//! reshaped for reading. A port of blygger-studio's
+//! `extensions/inspect/ui/shape.ts` (studio 0.39.0), so both clients elide
+//! and summarise alike. Nothing is fetched; this is the client's copy.
+//!
+//! Two changes, both display only:
+//!   - content bodies (`content_md`, `content_html`) become a character
+//!     count (UTF-16 units, as JavaScript's `length`), so the protocol
+//!     fields are not buried under the text;
+//!   - references kept as JSON strings in `*_json` fields are parsed, so a
+//!     `stub_of` or `transclusions` list reads as a structure.
+
+use serde_json::{Map, Value};
+
+const BODY: [&str; 2] = ["content_md", "content_html"];
+
+/// How a body reads once elided: "‹12 characters, not shown›".
+pub fn elided(body: &str) -> String {
+    format!("‹{} characters, not shown›", body.encode_utf16().count())
+}
+
+/// The record with bodies elided and `*_json` strings parsed, at any depth.
+pub fn shape_record(value: &Value) -> Value {
+    match value {
+        Value::Array(a) => Value::Array(a.iter().map(shape_record).collect()),
+        Value::Object(o) => Value::Object(
+            o.iter()
+                .map(|(key, field)| {
+                    let shaped = match field {
+                        Value::String(s) if BODY.contains(&key.as_str()) => {
+                            Value::String(elided(s))
+                        }
+                        Value::String(s) if key.ends_with("_json") => {
+                            match serde_json::from_str::<Value>(s) {
+                                Ok(v) => shape_record(&v),
+                                Err(_) => field.clone(),
+                            }
+                        }
+                        _ => shape_record(field),
+                    };
+                    (key.clone(), shaped)
+                })
+                .collect::<Map<_, _>>(),
+        ),
+        _ => value.clone(),
+    }
+}
+
+/// The few fields worth reading first, as label/value pairs; absent ones
+/// are left out. As the Studio's `summary`, plus Burrow's own reading row:
+/// its `transclusions` list is a top-level field (left out when empty),
+/// and it keeps no `content_hash`, so the hash of the Markdown it holds
+/// (`held_hash`, the protocol's `content_hash`) stands in.
+pub fn summary(record: &Value, held_hash: Option<&str>) -> Vec<(String, String)> {
+    let get = |k: &str| record.get(k).filter(|v| !v.is_null());
+    let published = get("published");
+    let transclusions = match published.and_then(|p| p.get("transclusions")) {
+        Some(Value::Array(a)) => Some(Value::from(a.len())),
+        _ => match get("transclusions_json") {
+            Some(Value::String(s)) => match serde_json::from_str::<Value>(s) {
+                Ok(Value::Array(a)) => Some(Value::from(a.len())),
+                Ok(Value::String(s)) => Some(Value::from(s.encode_utf16().count())),
+                Ok(_) => Some(Value::from(0)),
+                Err(_) => None,
+            },
+            _ => match get("transclusions") {
+                Some(Value::Array(a)) => Some(Value::from(a.len())),
+                // A Burrow reading row says nothing when it quotes nothing.
+                _ if get("remote_id").is_some() && get("subscription_id").is_some() => {
+                    Some(Value::from(0))
+                }
+                _ => None,
+            },
+        },
+    };
+    let hash = published
+        .and_then(|p| p.get("content_hash"))
+        .filter(|v| !v.is_null())
+        .or_else(|| get("content_hash"))
+        .cloned()
+        .or_else(|| held_hash.map(Value::from));
+    let rows: Vec<(&str, Option<Value>)> = vec![
+        ("id", get("id").or_else(|| get("remote_id")).cloned()),
+        ("kind", get("kind").cloned()),
+        ("version", get("version").cloned()),
+        ("state", get("status").or_else(|| get("state")).cloned()),
+        ("content hash", hash),
+        (
+            "stub of",
+            describe(
+                get("stub_of")
+                    .cloned()
+                    .or_else(|| parse(get("stub_of_json"))),
+            ),
+        ),
+        (
+            "forked from",
+            describe(
+                get("forked_from")
+                    .cloned()
+                    .or_else(|| parse(get("forked_from_json"))),
+            ),
+        ),
+        ("transclusions", transclusions),
+    ];
+    rows.into_iter()
+        .filter_map(|(k, v)| {
+            let v = v.filter(|v| !v.is_null())?;
+            let s = js_string(&v);
+            (!s.is_empty()).then(|| (k.to_string(), s))
+        })
+        .collect()
+}
+
+fn parse(field: Option<&Value>) -> Option<Value> {
+    match field {
+        Some(Value::String(s)) => serde_json::from_str(s).ok(),
+        _ => None,
+    }
+}
+
+/// A reference in one line: origin + id + version, or a `{url}` target.
+fn describe(r: Option<Value>) -> Option<Value> {
+    let r = r?;
+    let o = r.as_object()?;
+    if let Some(Value::String(url)) = o.get("url") {
+        return Some(Value::String(url.clone()));
+    }
+    let version = o.get("version").map(|v| format!("v{}", js_string(v)));
+    let parts: Vec<String> = [o.get("origin").cloned(), o.get("id").cloned()]
+        .into_iter()
+        .flatten()
+        .filter(truthy)
+        .map(|v| js_string(&v))
+        .chain(version)
+        .collect();
+    Some(Value::String(parts.join(" ")))
+}
+
+/// JavaScript's `Boolean(v)`.
+fn truthy(v: &Value) -> bool {
+    match v {
+        Value::Null => false,
+        Value::Bool(b) => *b,
+        Value::Number(n) => n.as_f64().is_some_and(|f| f != 0.0 && !f.is_nan()),
+        Value::String(s) => !s.is_empty(),
+        _ => true,
+    }
+}
+
+/// JavaScript's `String(v)`, for the values a record holds.
+fn js_string(v: &Value) -> String {
+    match v {
+        Value::Null => "null".into(),
+        Value::Bool(b) => b.to_string(),
+        Value::Number(n) => match (n.as_i64(), n.as_f64()) {
+            (Some(i), _) => i.to_string(),
+            (None, Some(f)) if f.fract() == 0.0 && f.abs() < 1e21 => format!("{f:.0}"),
+            _ => n.to_string(),
+        },
+        Value::String(s) => s.clone(),
+        Value::Array(a) => a
+            .iter()
+            .map(|x| {
+                if x.is_null() {
+                    String::new()
+                } else {
+                    js_string(x)
+                }
+            })
+            .collect::<Vec<_>>()
+            .join(","),
+        Value::Object(_) => "[object Object]".into(),
+    }
+}
+
+/// The JSON the sheet shows (two-space indent, as `JSON.stringify(…, null, 2)`).
+pub fn shaped_json(record: &Value) -> String {
+    serde_json::to_string_pretty(&shape_record(record)).unwrap_or_default()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    fn pairs(v: &[(&str, &str)]) -> Vec<(String, String)> {
+        v.iter()
+            .map(|(a, b)| (a.to_string(), b.to_string()))
+            .collect()
+    }
+
+    // The Studio's own example (test-ui/default-extensions.test.ts).
+    #[test]
+    fn elides_bodies_parses_json_columns_and_summarises_references() {
+        let imported = json!({
+            "remote_id": "abc", "kind": "thread", "version": 3, "state": "current",
+            "content_hash": "sha256-x",
+            "content_md": "hello", "content_html": "<p>hello</p>",
+            "stub_of_json": json!({"origin": "https://a.example/", "id": "p1", "version": 2}).to_string(),
+            "transclusions_json": json!([{"id": "t1"}, {"id": "t2"}]).to_string(),
+            "forked_from_json": null, "media_json": "not json",
+        });
+        let mut want = imported.clone();
+        want["content_md"] = json!("‹5 characters, not shown›");
+        want["content_html"] = json!("‹12 characters, not shown›");
+        want["stub_of_json"] = json!({"origin": "https://a.example/", "id": "p1", "version": 2});
+        want["transclusions_json"] = json!([{"id": "t1"}, {"id": "t2"}]);
+        assert_eq!(shape_record(&imported), want);
+        assert_eq!(
+            summary(&imported, None),
+            pairs(&[
+                ("id", "abc"),
+                ("kind", "thread"),
+                ("version", "3"),
+                ("state", "current"),
+                ("content hash", "sha256-x"),
+                ("stub of", "https://a.example/ p1 v2"),
+                ("transclusions", "2"),
+            ])
+        );
+        let own = json!({
+            "id": "mine", "kind": "fragment", "status": "public", "version": 1, "content_md": "x",
+            "stub_of": {"url": "https://elsewhere.example/post"}, "forked_from": null,
+            "published": {"content_hash": "sha256-y", "content_html": "<p>x</p>", "transclusions": []},
+            "versions": [{"version": 1, "content_md": "x", "content_html": "<p>x</p>"}],
+        });
+        assert_eq!(
+            summary(&own, None),
+            pairs(&[
+                ("id", "mine"),
+                ("kind", "fragment"),
+                ("version", "1"),
+                ("state", "public"),
+                ("content hash", "sha256-y"),
+                ("stub of", "https://elsewhere.example/post"),
+                ("transclusions", "0"),
+            ])
+        );
+        assert_eq!(
+            shape_record(&own)["versions"][0]["content_html"],
+            "‹8 characters, not shown›"
+        );
+    }
+
+    #[test]
+    fn burrows_reading_row_summarises_too() {
+        let row = json!({
+            "subscription_id": "sub-1", "remote_id": "r9", "origin": "https://blyg.example.com",
+            "kind": "thread", "state": "current", "version": 4,
+            "content_md": "Tides 🌊", "content_html": "<p>Tides 🌊</p>",
+            "forked_from": {"origin": "https://other.example.com", "id": "p2", "version": 1},
+        });
+        assert_eq!(
+            summary(&row, Some("sha256:ab")),
+            pairs(&[
+                ("id", "r9"),
+                ("kind", "thread"),
+                ("version", "4"),
+                ("state", "current"),
+                ("content hash", "sha256:ab"),
+                ("forked from", "https://other.example.com p2 v1"),
+                ("transclusions", "0"),
+            ])
+        );
+        // UTF-16 units, as the Studio counts: the wave is two.
+        assert_eq!(
+            shape_record(&row)["content_md"],
+            "‹8 characters, not shown›"
+        );
+        let mut quoting = row.clone();
+        quoting["transclusions"] = json!([{"id": "t1", "version": 2}]);
+        assert!(summary(&quoting, None).contains(&("transclusions".into(), "1".into())));
+        assert!(
+            !summary(&quoting, None)
+                .iter()
+                .any(|(k, _)| k == "content hash"),
+            "no hash held, none shown"
+        );
+    }
+
+    #[test]
+    fn references_read_as_one_line() {
+        assert_eq!(describe(Some(json!({"id": "p1"}))), Some(json!("p1")));
+        assert_eq!(
+            describe(Some(json!({"origin": "", "id": "p1", "version": null}))),
+            Some(json!("p1 vnull")),
+            "as JavaScript's template string"
+        );
+        assert_eq!(describe(Some(json!("x"))), None);
+        assert_eq!(describe(None), None);
+        // An empty description is left out of the summary.
+        let r = json!({"kind": "fragment", "stub_of": {}});
+        assert_eq!(summary(&r, None), pairs(&[("kind", "fragment")]));
+    }
+
+    #[test]
+    fn the_json_is_indented_by_two() {
+        let s = shaped_json(&json!({"a": {"content_md": "hi"}}));
+        assert_eq!(
+            s,
+            "{\n  \"a\": {\n    \"content_md\": \"‹2 characters, not shown›\"\n  }\n}"
+        );
+    }
+}
diff --git a/crates/blyg-ext-notes/src/lib.rs b/crates/blyg-ext-notes/src/lib.rs
index f56e632..df3bb2a 100644
--- a/crates/blyg-ext-notes/src/lib.rs
+++ b/crates/blyg-ext-notes/src/lib.rs
@@ -1,10 +1,25 @@
-//! markdown-notes: Burrow's bundled extension for a folder of Markdown notes
-//! (an Obsidian vault). A notes reader and writer of its own, separate from
+//! markdown-notes: Burrow's bundled extension for folders of Markdown notes
+//! (Obsidian vaults). A notes reader and writer of its own, separate from
 //! the blyg: it lists, searches, reads, creates and edits notes, and never
 //! needs a signed-in blyg, an item id or any `items.*` capability. Burrow's
 //! notes panel shows the notes and copies text from them into a post (a
 //! host action); "Save selection to notes" makes a new plain note.
 //!
+//! Any number of folders ("vaults"), each its own library:
+//!
+//! ```text
+//! extension-setting = markdown-notes vault=~/Notes
+//! extension-setting = markdown-notes vault-work=~/Work/Vault
+//! ```
+//!
+//! `vault` is the first (library `notes`); each `vault-<label>` adds one
+//! more (library `notes.<label>`). Setting keys are lowercase kebab-case
+//! (the config checks that), so the label is too, and since each key is
+//! its own, the config's "a later line for the same key wins" never drops
+//! a vault. A vault is titled by its folder's name, or by its label when
+//! the label isn't just that name. With no vault, the extension asks only
+//! for `ui` and has no library: Burrow offers to choose a folder.
+//!
 //! - [`vault`]: the folder logic, usable without Burrow.
 //! - [`frontmatter`]: the bit of YAML frontmatter it reads (never writes).
 //! - [`run`]: the BXP extension around it (`blygger +ext markdown-notes`).
@@ -22,40 +37,38 @@ pub use run::{NotesExt, run, run_stdio};
 
 /// The extension's name (`extension = markdown-notes`).
 pub const NAME: &str = "markdown-notes";
-/// The library's id.
+/// The first vault's library id (`vault=…`); `vault-<label>` is
+/// `notes.<label>`.
 pub const LIBRARY: &str = "notes";
 /// The palette command that saves the selection as a new note.
 pub const SAVE_SELECTION: &str = "save-selection";
-/// The vault when `extension-setting = markdown-notes vault=…` isn't set.
-pub const DEFAULT_VAULT: &str = "~/Notes";
+/// The first vault's setting key; more are `vault-<label>`.
+pub const VAULT_KEY: &str = "vault";
+/// The longest `<label>` in `vault-<label>`.
+pub const LABEL_MAX: usize = 40;
 
 const MANIFEST: &str = r#"
 name = "markdown-notes"
 version = "0.1.0"
 protocol = 1
-description = "Reads and writes a folder of Markdown notes (an Obsidian vault). Works without a blyg."
-capabilities = ["fs:@VAULT@", "ui"]
+description = "Reads and writes folders of Markdown notes (Obsidian vaults). Works without a blyg."
+capabilities = [@CAPS@]
 
 [[commands]]
 id = "save-selection"
 title = "Save selection to notes"
-detail = "A new note in your notes folder, with the selected text"
+detail = "A new note in your first notes folder, with the selected text"
 when = "always"
 
-[[libraries]]
-id = "notes"
-title = "Notes"
-writable = true
-
 [[settings]]
 key = "vault"
 kind = "path"
-docs = "The folder of Markdown notes (default ~/Notes)."
+docs = "A folder of Markdown notes. Add more as vault-<label>=<folder>."
 
 [[settings]]
 key = "folder"
 kind = "text"
-docs = "The folder inside it where new notes go (default: the top)."
+docs = "The folder inside each vault where new notes go (default: the top)."
 
 [[settings]]
 key = "poll-ms"
@@ -63,24 +76,191 @@ kind = "number"
 docs = "How often to look for changed notes, in milliseconds (default 2000)."
 "#;
 
-/// The vault folder as configured (unexpanded), or [`DEFAULT_VAULT`].
-pub fn vault_setting(settings: &BTreeMap<String, String>) -> String {
-    settings
-        .get("vault")
-        .map(|v| v.trim())
-        .filter(|v| !v.is_empty())
-        .unwrap_or(DEFAULT_VAULT)
+/// One configured folder of notes.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct VaultSpec {
+    /// Its setting key: `vault` or `vault-<label>`.
+    pub key: String,
+    /// The folder as configured (unexpanded, `~/…`).
+    pub path: String,
+    /// Its library id: `notes` or `notes.<label>`.
+    pub library: String,
+    /// What the drawer calls it: the folder's name, or the label when
+    /// it's more than that name (`vault-work` → "work").
+    pub title: String,
+}
+
+/// A label usable in `vault-<label>`: lowercase letters and digits in
+/// `-`-separated words (a config setting key's grammar).
+pub fn valid_label(label: &str) -> bool {
+    label.len() <= LABEL_MAX
+        && !label.is_empty()
+        && label.split('-').all(|w| {
+            !w.is_empty()
+                && w.chars()
+                    .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit())
+        })
+}
+
+/// The last part of a folder (`~/Work/Vault` → `Vault`), else "Notes".
+pub fn folder_name(path: &str) -> String {
+    path.trim_end_matches(['/', '\\'])
+        .rsplit(['/', '\\'])
+        .next()
+        .filter(|n| !n.is_empty() && *n != "~")
+        .unwrap_or("Notes")
         .to_string()
 }
 
-/// The manifest, asking for `fs:<vault>` so the consent sheet names the
-/// actual folder.
-pub fn manifest(vault: &str) -> Manifest {
-    Manifest::parse(
-        &MANIFEST.replace("@VAULT@", &vault.replace('\\', "\\\\").replace('"', "\\\"")),
-        true,
-    )
-    .expect("the bundled manifest is valid")
+/// A folder written two ways (`~/Notes/`, `~/Notes`) is one folder.
+pub fn same_folder(a: &str, b: &str) -> bool {
+    a.trim().trim_end_matches(['/', '\\']) == b.trim().trim_end_matches(['/', '\\'])
+}
+
+/// `s` as a label: lowercase, runs of anything but letters and digits
+/// become one `-` (`My vault (2024)` → `my-vault-2024`).
+fn slug(s: &str) -> String {
+    let mut out = String::new();
+    for c in s.chars().flat_map(char::to_lowercase) {
+        if c.is_ascii_lowercase() || c.is_ascii_digit() {
+            out.push(c);
+        } else if !out.is_empty() && !out.ends_with('-') {
+            out.push('-');
+        }
+    }
+    let mut out: String = out
+        .trim_end_matches('-')
+        .chars()
+        .take(LABEL_MAX - 4)
+        .collect();
+    while out.ends_with('-') {
+        out.pop();
+    }
+    out
+}
+
+/// The configured vaults, in order: `vault` first, then each
+/// `vault-<label>` by label. Empty values, bad labels and a folder already
+/// listed are left out (with none, there's no library).
+pub fn vaults(settings: &BTreeMap<String, String>) -> Vec<VaultSpec> {
+    let mut out: Vec<VaultSpec> = vec![];
+    let first = settings.get(VAULT_KEY).map(|v| (VAULT_KEY, None, v));
+    let rest = settings.iter().filter_map(|(k, v)| {
+        let label = k.strip_prefix(VAULT_KEY)?.strip_prefix('-')?;
+        Some((k.as_str(), Some(label), v))
+    });
+    for (key, label, value) in first.into_iter().chain(rest) {
+        let path = value.trim();
+        if path.is_empty() || out.iter().any(|v| same_folder(&v.path, path)) {
+            continue;
+        }
+        let name = folder_name(path);
+        let (library, title) = match label {
+            None => (LIBRARY.to_string(), name),
+            Some(l) if valid_label(l) => {
+                let title = if slug(&name) == l {
+                    name
+                } else {
+                    l.replace('-', " ")
+                };
+                (format!("{LIBRARY}.{l}"), title)
+            }
+            Some(_) => continue,
+        };
+        out.push(VaultSpec {
+            key: key.to_string(),
+            path: path.to_string(),
+            library,
+            title,
+        });
+    }
+    out
+}
+
+/// The setting key a new folder `path` gets: `vault` when there's no first
+/// vault yet, else `vault-<label>` from the folder's name, made unique
+/// (`~/Work/Notes` beside `~/Notes` is `vault-work-notes`). `None` when the
+/// folder is already configured.
+pub fn new_vault_key(settings: &BTreeMap<String, String>, path: &str) -> Option<String> {
+    let have = vaults(settings);
+    if have.iter().any(|v| same_folder(&v.path, path)) {
+        return None;
+    }
+    if settings.get(VAULT_KEY).is_none_or(|v| v.trim().is_empty()) {
+        return Some(VAULT_KEY.into());
+    }
+    let parts: Vec<&str> = path
+        .trim_end_matches(['/', '\\'])
+        .rsplit(['/', '\\'])
+        .filter(|p| !p.is_empty() && *p != "~")
+        .collect();
+    let mut base = slug(parts.first().copied().unwrap_or(""));
+    if base.is_empty() {
+        base = "notes".into();
+    }
+    // Taken: the key is used, or a vault already goes by that name.
+    let taken = |l: &str| {
+        settings.contains_key(&format!("{VAULT_KEY}-{l}"))
+            || have.iter().any(|v| slug(&v.title) == l)
+    };
+    let mut label = base.clone();
+    if taken(&label)
+        && let Some(parent) = parts.get(1).map(|p| slug(p)).filter(|p| !p.is_empty())
+    {
+        label = slug(&format!("{parent}-{base}"));
+    }
+    let start = label.clone();
+    let mut n = 2;
+    while taken(&label) {
+        label = format!("{start}-{n}");
+        n += 1;
+    }
+    Some(format!("{VAULT_KEY}-{label}"))
+}
+
+/// A TOML basic string.
+fn toml_str(s: &str) -> String {
+    let mut out = String::from("\"");
+    for c in s.chars() {
+        match c {
+            '\\' => out.push_str("\\\\"),
+            '"' => out.push_str("\\\""),
+            '\n' => out.push_str("\\n"),
+            '\r' => out.push_str("\\r"),
+            '\t' => out.push_str("\\t"),
+            c if c.is_control() => out.push_str(&format!("\\u{:04X}", c as u32)),
+            c => out.push(c),
+        }
+    }
+    out.push('"');
+    out
+}
+
+/// The manifest for these vaults: `fs:<folder>` for each (so the consent
+/// sheet names each folder) and `ui`, a library per vault, and a
+/// `vault-<label>` setting for each labelled one (so the config check
+/// knows it). No vaults: just `ui`.
+pub fn manifest(vaults: &[VaultSpec]) -> Manifest {
+    let mut caps: Vec<String> = vaults
+        .iter()
+        .map(|v| toml_str(&format!("fs:{}", v.path)))
+        .collect();
+    caps.push(toml_str("ui"));
+    let mut text = MANIFEST.replace("@CAPS@", &caps.join(", "));
+    for v in vaults {
+        text.push_str(&format!(
+            "\n[[libraries]]\nid = {}\ntitle = {}\nwritable = true\n",
+            toml_str(&v.library),
+            toml_str(&v.title)
+        ));
+        if v.key != VAULT_KEY {
+            text.push_str(&format!(
+                "\n[[settings]]\nkey = {}\nkind = \"path\"\ndocs = \"Another folder of Markdown notes.\"\n",
+                toml_str(&v.key)
+            ));
+        }
+    }
+    Manifest::parse(&text, true).expect("the bundled manifest is valid")
 }
 
 /// The bundled extension for the host's `HostConfig::bundled`: run as
@@ -93,7 +273,7 @@ pub fn bundled(
     settings: &BTreeMap<String, String>,
 ) -> Installed {
     Installed {
-        manifest: manifest(&vault_setting(settings)),
+        manifest: manifest(&vaults(settings)),
         origin: Origin::Bundled { program, args },
     }
 }
@@ -103,9 +283,16 @@ mod tests {
     use super::*;
     use blyg_ext::Capability;
 
+    fn s(pairs: &[(&str, &str)]) -> BTreeMap<String, String> {
+        pairs
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.to_string()))
+            .collect()
+    }
+
     #[test]
-    fn the_manifest_asks_only_for_its_folder_and_ui() {
-        let m = manifest("~/Notes");
+    fn the_manifest_asks_only_for_its_folders_and_ui() {
+        let m = manifest(&vaults(&s(&[("vault", "~/Notes")])));
         assert_eq!(m.name, NAME);
         assert_eq!(
             m.capabilities,
@@ -118,19 +305,136 @@ mod tests {
                 | Capability::ReadingRead
                 | Capability::HookPublished
         )));
-        let w = manifest("C:\\Users\\someone\\Notes \"x\"");
+        let w = manifest(&vaults(&s(&[("vault", "C:\\Users\\someone\\Notes \"x\"")])));
         assert_eq!(
             w.capabilities[0],
             Capability::Fs("C:\\Users\\someone\\Notes \"x\"".into())
         );
         assert_eq!(m.commands[0].id, SAVE_SELECTION);
         assert_eq!(m.libraries[0].id, LIBRARY);
+        assert_eq!(m.libraries[0].title, "Notes");
+    }
+
+    #[test]
+    fn no_folder_asks_only_for_ui_and_has_no_library() {
+        for settings in [s(&[]), s(&[("vault", "  ")]), s(&[("folder", "Inbox")])] {
+            let m = manifest(&vaults(&settings));
+            assert_eq!(m.capabilities, vec![Capability::Ui], "{settings:?}");
+            assert!(m.libraries.is_empty());
+            assert_eq!(m.commands[0].id, SAVE_SELECTION);
+        }
     }
 
     #[test]
-    fn vault_setting_defaults() {
-        assert_eq!(vault_setting(&BTreeMap::new()), DEFAULT_VAULT);
-        let s: BTreeMap<String, String> = [("vault".to_string(), " ~/Vault ".to_string())].into();
-        assert_eq!(vault_setting(&s), "~/Vault");
+    fn several_vaults_are_several_libraries_and_grants() {
+        let settings = s(&[
+            ("vault-work", "~/Work/Vault"),
+            ("vault", "~/Notes"),
+            ("vault-garden-notes", "~/Garden notes/"),
+            ("folder", "Inbox"),
+        ]);
+        let v = vaults(&settings);
+        let keys: Vec<&str> = v.iter().map(|v| v.key.as_str()).collect();
+        assert_eq!(keys, ["vault", "vault-garden-notes", "vault-work"]);
+        let libs: Vec<&str> = v.iter().map(|v| v.library.as_str()).collect();
+        assert_eq!(libs, ["notes", "notes.garden-notes", "notes.work"]);
+        let titles: Vec<&str> = v.iter().map(|v| v.title.as_str()).collect();
+        assert_eq!(titles, ["Notes", "Garden notes", "work"]);
+        let m = manifest(&v);
+        assert_eq!(
+            m.capabilities,
+            vec![
+                Capability::Fs("~/Notes".into()),
+                Capability::Fs("~/Garden notes/".into()),
+                Capability::Fs("~/Work/Vault".into()),
+                Capability::Ui
+            ]
+        );
+        assert_eq!(m.libraries.len(), 3);
+        assert!(m.libraries.iter().all(|l| l.writable));
+        // Each labelled vault is a declared setting (so the config check
+        // doesn't call it unknown).
+        let keys: Vec<&str> = m.settings.iter().map(|s| s.key.as_str()).collect();
+        assert!(keys.contains(&"vault-garden-notes") && keys.contains(&"vault-work"));
+    }
+
+    #[test]
+    fn labelled_vaults_work_without_a_first_one() {
+        let v = vaults(&s(&[("vault-work", "~/Work/Vault")]));
+        assert_eq!(v.len(), 1);
+        assert_eq!(v[0].library, "notes.work");
+        assert_eq!(manifest(&v).libraries[0].id, "notes.work");
+    }
+
+    #[test]
+    fn bad_labels_empty_folders_and_repeats_are_left_out() {
+        let v = vaults(&s(&[
+            ("vault", "~/Notes"),
+            ("vault-", "~/A"),
+            ("vault-Upper", "~/B"),
+            ("vault-again", "~/Notes/"),
+            ("vault-empty", ""),
+            ("vaults", "~/C"),
+            ("vault-ok", "~/D"),
+        ]));
+        let keys: Vec<&str> = v.iter().map(|v| v.key.as_str()).collect();
+        assert_eq!(keys, ["vault", "vault-ok"]);
+    }
+
+    #[test]
+    fn titles_come_from_the_folder_name() {
+        assert_eq!(folder_name("~/Work/Vault"), "Vault");
+        assert_eq!(folder_name("~/Work/Vault/"), "Vault");
+        assert_eq!(folder_name("C:\\Users\\someone\\Brain"), "Brain");
+        assert_eq!(folder_name("~"), "Notes");
+        assert_eq!(folder_name("/"), "Notes");
+        assert_eq!(slug("My vault (2024)"), "my-vault-2024");
+        assert_eq!(slug("  Ünïcode  "), "n-code");
+    }
+
+    #[test]
+    fn a_new_folder_gets_a_free_key() {
+        let none = s(&[]);
+        assert_eq!(new_vault_key(&none, "~/Notes").as_deref(), Some("vault"));
+        let one = s(&[("vault", "~/Notes")]);
+        assert_eq!(new_vault_key(&one, "~/Notes/"), None, "already there");
+        assert_eq!(
+            new_vault_key(&one, "~/Work/Vault").as_deref(),
+            Some("vault-vault")
+        );
+        assert_eq!(
+            new_vault_key(&one, "~/Work/My vault (2024)").as_deref(),
+            Some("vault-my-vault-2024")
+        );
+        // Named like the first one: its parent tells them apart.
+        assert_eq!(
+            new_vault_key(&one, "~/Work/Notes").as_deref(),
+            Some("vault-work-notes")
+        );
+        let two = s(&[("vault", "~/Notes"), ("vault-work-notes", "~/Work/Notes")]);
+        assert_eq!(
+            new_vault_key(&two, "~/Other/Work/Notes").as_deref(),
+            Some("vault-work-notes-2")
+        );
+        // Only labelled ones left: the next one is the first again.
+        let labelled = s(&[("vault-work", "~/Work/Vault")]);
+        assert_eq!(
+            new_vault_key(&labelled, "~/Notes").as_deref(),
+            Some("vault")
+        );
+        // Every key it makes is a vault, titled by its folder's name when
+        // it can be.
+        for (settings, path, title) in [
+            (&one, "~/Work/Vault", "Vault"),
+            (&one, "~/Work/My vault (2024)", "My vault (2024)"),
+            (&two, "~/x/Work/Notes", "work notes 2"),
+        ] {
+            let key = new_vault_key(settings, path).unwrap();
+            let mut with = settings.clone();
+            with.insert(key.clone(), path.into());
+            let v = vaults(&with);
+            let got = v.iter().find(|v| v.key == key).expect("a vault");
+            assert_eq!(got.title, title, "{key}");
+        }
     }
 }
diff --git a/crates/blyg-ext-notes/src/run.rs b/crates/blyg-ext-notes/src/run.rs
index dd84c19..1b82291 100644
--- a/crates/blyg-ext-notes/src/run.rs
+++ b/crates/blyg-ext-notes/src/run.rs
@@ -1,7 +1,9 @@
-//! The BXP extension around [`Vault`]: the `notes` library
-//! (`extension/library.*`) and the "Save selection to notes" command. It
-//! never calls a `burrow/*` item method; the folder is the only thing it
-//! touches, and only once the user has granted `fs:<vault>`.
+//! The BXP extension around [`Vault`]: one library per configured vault
+//! (`extension/library.*`: `notes` for `vault=`, `notes.<label>` for
+//! `vault-<label>=`) and the "Save selection to notes" command. It never
+//! calls a `burrow/*` item method; the folders are the only thing it
+//! touches, each only once the user has granted its `fs:<folder>`. A vault
+//! without its grant refuses with "permission denied"; the others work.
 
 use std::collections::BTreeMap;
 use std::path::PathBuf;
@@ -16,26 +18,37 @@ use blyg_ext::rpc::{params, to_value};
 use serde_json::{Value, json};
 
 use crate::vault::{Hit, Vault, VaultError};
-use crate::{LIBRARY, SAVE_SELECTION, vault_setting};
+use crate::{SAVE_SELECTION, VaultSpec, vaults};
 
-/// How often the vault is re-scanned when `poll-ms` isn't set.
+/// How often the vaults are re-scanned when `poll-ms` isn't set.
 pub const DEFAULT_POLL: Duration = Duration::from_secs(2);
 
+/// One configured vault: open, or why not (no grant, not a folder).
+struct Slot {
+    spec: VaultSpec,
+    vault: Result<Vault, RpcError>,
+}
+
 /// The extension's state.
 #[derive(Default)]
 pub struct NotesExt {
-    vault: Option<Vault>,
-    /// Why there's no vault (no grant, not a folder).
-    problem: Option<RpcError>,
+    slots: Vec<Slot>,
     folder: Option<String>,
     poll: Option<Duration>,
     granted: Vec<Capability>,
     home: Option<PathBuf>,
 }
 
+/// Why there's nothing to use.
+fn no_folder() -> RpcError {
+    RpcError::new(
+        codes::REFUSED,
+        "no notes folder: choose one in Settings › Notes folders",
+    )
+}
+
 impl NotesExt {
     fn configure(&mut self, settings: &BTreeMap<String, String>) {
-        let vault = vault_setting(settings);
         self.folder = settings
             .get("folder")
             .map(|f| f.trim().to_string())
@@ -47,39 +60,50 @@ impl NotesExt {
                 .map(|ms| Duration::from_millis(ms.max(50)))
                 .unwrap_or(DEFAULT_POLL),
         );
-        let want = Capability::Fs(vault.clone());
-        self.vault = None;
-        self.problem = None;
-        if !self.granted.iter().any(|g| want.covered_by(g)) {
-            self.problem = Some(RpcError::permission_denied(&want.as_string()));
-            return;
-        }
-        match Vault::open(expand_home(&vault, self.home.as_deref())) {
-            Ok(v) => self.vault = Some(v),
-            Err(e) => {
-                self.problem = Some(RpcError::new(
-                    codes::REFUSED,
-                    format!("notes folder {vault}: {e}"),
-                ))
-            }
+        // A vault already open on the same folder, still granted, is kept
+        // (no re-scan).
+        let mut old = std::mem::take(&mut self.slots);
+        for spec in vaults(settings) {
+            let want = Capability::Fs(spec.path.clone());
+            let vault = if !self.granted.iter().any(|g| want.covered_by(g)) {
+                Err(RpcError::permission_denied(&want.as_string()))
+            } else if let Some(i) = old
+                .iter()
+                .position(|s| s.spec.path == spec.path && s.vault.is_ok())
+            {
+                old.swap_remove(i).vault
+            } else {
+                Vault::open(expand_home(&spec.path, self.home.as_deref())).map_err(|e| {
+                    RpcError::new(codes::REFUSED, format!("notes folder {}: {e}", spec.path))
+                })
+            };
+            self.slots.push(Slot { spec, vault });
         }
     }
 
-    fn vault(&mut self) -> Result<&mut Vault, RpcError> {
-        match &mut self.vault {
-            Some(v) => Ok(v),
-            None => Err(self
-                .problem
-                .clone()
-                .unwrap_or_else(|| RpcError::new(codes::REFUSED, "no notes folder"))),
-        }
+    /// Library `id`'s vault (`None`: the first).
+    fn vault(&mut self, id: &Option<String>) -> Result<&mut Vault, RpcError> {
+        let slot = match id.as_deref() {
+            None => self.slots.first_mut().ok_or_else(no_folder)?,
+            Some(id) => self
+                .slots
+                .iter_mut()
+                .find(|s| s.spec.library == id)
+                .ok_or_else(|| RpcError::invalid_params(format!("no library {id:?}")))?,
+        };
+        slot.vault.as_mut().map_err(|e| e.clone())
     }
-}
 
-fn check_library(l: &Option<String>) -> Result<(), RpcError> {
-    match l.as_deref() {
-        None | Some(LIBRARY) => Ok(()),
-        Some(other) => Err(RpcError::invalid_params(format!("no library {other:?}"))),
+    /// Where "Save selection to notes" writes: the first vault that's open.
+    fn first_open(&mut self) -> Result<&mut Vault, RpcError> {
+        let problem = match self.slots.first() {
+            None => return Err(no_folder()),
+            Some(s) => s.vault.as_ref().err().cloned(),
+        };
+        self.slots
+            .iter_mut()
+            .find_map(|s| s.vault.as_mut().ok())
+            .ok_or_else(|| problem.unwrap_or_else(no_folder))
     }
 }
 
@@ -132,8 +156,10 @@ impl Extension for NotesExt {
         match method {
             methods::LIBRARY_LIST => {
                 let p: LibraryListParams = params(p)?;
-                check_library(&p.library)?;
-                let entries = self.vault()?.list(p.path.as_deref()).map_err(err)?;
+                let entries = self
+                    .vault(&p.library)?
+                    .list(p.path.as_deref())
+                    .map_err(err)?;
                 let out: Vec<LibraryEntry> = entries
                     .into_iter()
                     .map(|e| LibraryEntry {
@@ -148,9 +174,8 @@ impl Extension for NotesExt {
             }
             methods::LIBRARY_SEARCH => {
                 let p: LibrarySearchParams = params(p)?;
-                check_library(&p.library)?;
                 let hits: Vec<SourceEntry> = self
-                    .vault()?
+                    .vault(&p.library)?
                     .search(&p.query, p.limit)
                     .into_iter()
                     .map(entry)
@@ -159,8 +184,7 @@ impl Extension for NotesExt {
             }
             methods::LIBRARY_READ => {
                 let p: LibraryReadParams = params(p)?;
-                check_library(&p.library)?;
-                let n = self.vault()?.read(&p.id).map_err(err)?;
+                let n = self.vault(&p.library)?.read(&p.id).map_err(err)?;
                 to_value(&LibraryDocument {
                     id: n.id,
                     title: n.title,
@@ -171,9 +195,8 @@ impl Extension for NotesExt {
             }
             methods::LIBRARY_WRITE => {
                 let p: LibraryWriteParams = params(p)?;
-                check_library(&p.library)?;
                 let folder = p.folder.clone().or_else(|| self.folder.clone());
-                let v = self.vault()?;
+                let v = self.vault(&p.library)?;
                 let n = match &p.id {
                     Some(id) => {
                         let base = p.base_hash.as_deref().ok_or_else(|| {
@@ -200,7 +223,7 @@ impl Extension for NotesExt {
                 }
                 let folder = self.folder.clone();
                 let n = self
-                    .vault()?
+                    .first_open()?
                     .create(folder.as_deref(), None, &text)
                     .map_err(err)?;
                 to_value(&CommandResult {
@@ -228,8 +251,10 @@ impl Extension for NotesExt {
     }
 
     fn tick(&mut self, _host: &HostClient) {
-        if let Some(v) = &mut self.vault {
-            v.refresh();
+        for s in &mut self.slots {
+            if let Ok(v) = &mut s.vault {
+                v.refresh();
+            }
         }
     }
 
diff --git a/crates/blyg-ext-notes/tests/vault.rs b/crates/blyg-ext-notes/tests/vault.rs
index 009b049..430b8f5 100644
--- a/crates/blyg-ext-notes/tests/vault.rs
+++ b/crates/blyg-ext-notes/tests/vault.rs
@@ -402,3 +402,174 @@ fn without_the_folder_grant_it_touches_nothing() {
     assert!(describe(&st.missing[0]).starts_with("read and write files in "));
     assert_eq!(env.files(), before);
 }
+
+// ------------------------------------------------------------ several vaults
+
+/// The extension over `settings`, granted `ui` and `fs` for each of `fs`.
+fn start(
+    dir: &Path,
+    settings: BTreeMap<String, String>,
+    fs: &[&Path],
+) -> (Host, Receiver<ExtEvent>) {
+    let mut c = HostConfig::new(dir.join("data"), "0.0.0-test");
+    c.bundled = vec![bundled(
+        PathBuf::from(env!("CARGO_BIN_EXE_burrow-markdown-notes")),
+        vec![],
+        &settings,
+    )];
+    c.enabled = vec![NAME.into()];
+    let mut lines = vec![format!("{NAME} ui")];
+    for f in fs {
+        lines.push(format!("{NAME} fs:{}", f.to_string_lossy()));
+    }
+    c.grants = Grants::from_allow_lines(&lines).0;
+    c.settings = [(NAME.to_string(), settings)].into();
+    let (tx, events) = channel();
+    let host = Host::new(c, Arc::new(NoBlyg), move |e| {
+        let _ = tx.send(e);
+    });
+    host.start();
+    let deadline = Instant::now() + WAIT;
+    loop {
+        match events.recv_timeout(deadline.saturating_duration_since(Instant::now())) {
+            Ok(ExtEvent::Started { .. }) => break,
+            Ok(ExtEvent::Failed { message, .. }) => panic!("{message}"),
+            Ok(_) => {}
+            Err(_) => panic!("markdown-notes didn't start"),
+        }
+    }
+    (host, events)
+}
+
+/// Two vaults (`vault=` and `vault-work=`) with a note each.
+fn two_vaults(dir: &Path) -> (PathBuf, PathBuf, BTreeMap<String, String>) {
+    let notes = dir.join("Notes");
+    let work = dir.join("Work").join("Vault");
+    write(&notes.join("Tide tables.md"), "The moon pulls the sea.\n");
+    write(&work.join("Standup.md"), "The moon project ships Friday.\n");
+    let settings: BTreeMap<String, String> = [
+        ("vault".to_string(), notes.to_string_lossy().into_owned()),
+        (
+            "vault-work".to_string(),
+            work.to_string_lossy().into_owned(),
+        ),
+    ]
+    .into();
+    (notes, work, settings)
+}
+
+fn search_in(host: &Host, library: &str, q: &str) -> Result<Vec<String>, ExtError> {
+    let p = LibrarySearchParams {
+        library: Some(library.into()),
+        query: q.into(),
+        limit: 20,
+    };
+    Ok(host
+        .library_search(NAME, &p)?
+        .into_iter()
+        .map(|h| h.id)
+        .collect())
+}
+
+#[test]
+fn each_vault_is_its_own_library() {
+    let dir = tempfile::tempdir().unwrap();
+    let (notes, work, settings) = two_vaults(dir.path());
+    let (host, _events) = start(dir.path(), settings, &[&notes, &work]);
+    let libs: Vec<(String, String)> = host
+        .libraries()
+        .into_iter()
+        .map(|l| (l.library.id, l.library.title))
+        .collect();
+    assert_eq!(
+        libs,
+        [
+            ("notes".to_string(), "Notes".to_string()),
+            ("notes.work".to_string(), "work".to_string())
+        ]
+    );
+    assert_eq!(
+        search_in(&host, "notes", "moon").unwrap(),
+        ["Tide tables.md"]
+    );
+    assert_eq!(
+        search_in(&host, "notes.work", "moon").unwrap(),
+        ["Standup.md"]
+    );
+    assert!(matches!(
+        search_in(&host, "notes.nope", "moon"),
+        Err(ExtError::Rpc(e)) if e.code == codes::INVALID_PARAMS
+    ));
+    // A new note goes to the library it names.
+    let w = host
+        .library_write(
+            NAME,
+            &LibraryWriteParams {
+                library: Some("notes.work".into()),
+                id: None,
+                title: None,
+                folder: None,
+                markdown: "Retro notes\n".into(),
+                base_hash: None,
+            },
+        )
+        .unwrap();
+    assert!(work.join(&w.id).exists());
+    assert!(!notes.join(&w.id).exists());
+    // "Save selection to notes" writes to the first vault.
+    let ctx = CommandContext {
+        selection: Some("Lanterns on the pier".into()),
+        ..Default::default()
+    };
+    host.command(NAME, SAVE_SELECTION, ctx).unwrap();
+    assert!(notes.join("Lanterns on the pier.md").exists());
+}
+
+#[test]
+fn a_vault_without_its_grant_doesnt_break_the_others() {
+    let dir = tempfile::tempdir().unwrap();
+    let (notes, work, settings) = two_vaults(dir.path());
+    // Only the work vault is allowed.
+    let (host, _events) = start(dir.path(), settings, &[&work]);
+    assert!(matches!(
+        search_in(&host, "notes", "moon"),
+        Err(ExtError::Rpc(e)) if e.code == codes::PERMISSION_DENIED
+    ));
+    assert_eq!(
+        search_in(&host, "notes.work", "moon").unwrap(),
+        ["Standup.md"]
+    );
+    let st = &host.status()[0];
+    assert_eq!(
+        st.missing,
+        [Capability::Fs(notes.to_string_lossy().into_owned())],
+        "the consent sheet can offer the other folder"
+    );
+    // Saving a selection falls through to the vault that's open.
+    let ctx = CommandContext {
+        selection: Some("Kept anyway".into()),
+        ..Default::default()
+    };
+    host.command(NAME, SAVE_SELECTION, ctx).unwrap();
+    assert!(work.join("Kept anyway.md").exists());
+    assert!(!notes.join("Kept anyway.md").exists());
+}
+
+#[test]
+fn no_vault_asks_only_for_ui_and_offers_no_library() {
+    let dir = tempfile::tempdir().unwrap();
+    let (host, _events) = start(dir.path(), BTreeMap::new(), &[]);
+    let st = &host.status()[0];
+    assert_eq!(st.requested, [Capability::Ui]);
+    assert!(host.libraries().is_empty());
+    let r = host.library_list(NAME, &LibraryListParams::default());
+    assert!(
+        matches!(&r, Err(ExtError::Rpc(e)) if e.code == codes::REFUSED && e.message.contains("no notes folder")),
+        "{r:?}"
+    );
+    let ctx = CommandContext {
+        selection: Some("Nowhere to go".into()),
+        ..Default::default()
+    };
+    assert!(host.command(NAME, SAVE_SELECTION, ctx).is_err());
+}
diff --git a/crates/blyg-ext-reading-time/Cargo.toml b/crates/blyg-ext-reading-time/Cargo.toml
new file mode 100644
index 0000000..94970d5
--- /dev/null
+++ b/crates/blyg-ext-reading-time/Cargo.toml
@@ -0,0 +1,15 @@
+[package]
+name = "blyg-ext-reading-time"
+edition.workspace = true
+version.workspace = true
+license.workspace = true
+description = "reading-time: Burrow's bundled extension that shows an estimated reading time at the end of each reading entry's byline"
+
+[dependencies]
+blyg-ext = { path = "../blyg-ext" }
+# An entry held only as Markdown is counted from the HTML its blyg would
+# publish, as Burrow's reader shows it.
+blyg-render = { path = "../blyg-render" }
+serde_json = "1"
+# Unicode classes and scripts, as the Studio's regular expressions use them.
+regex = "1"
diff --git a/crates/blyg-ext-reading-time/src/count.rs b/crates/blyg-ext-reading-time/src/count.rs
new file mode 100644
index 0000000..6a4ca2d
--- /dev/null
+++ b/crates/blyg-ext-reading-time/src/count.rs
@@ -0,0 +1,186 @@
+//! How long an entry takes to read, from the HTML the reading view already
+//! holds. A port of blygger-studio's `extensions/reading-time/ui/count.ts`
+//! (studio 0.39.0), rule for rule, so the two clients show the same
+//! number for the same post.
+//!
+//! Words are runs of letters and digits. Han, kana and Hangul are not
+//! written with spaces, so those characters are counted one by one at their
+//! own rate rather than as one enormous "word".
+
+use std::sync::LazyLock;
+
+use regex::Regex;
+
+/// Words per minute for space-separated scripts.
+pub const WORDS_PER_MINUTE: f64 = 230.0;
+/// Characters per minute for Han, kana and Hangul.
+pub const CJK_PER_MINUTE: f64 = 500.0;
+
+// `/[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}]/gu`
+static CJK: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r"[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}]")
+        .expect("valid")
+});
+// `/[\p{L}\p{N}][\p{L}\p{N}'’-]*/gu`
+static WORD: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"[\p{L}\p{N}][\p{L}\p{N}'’-]*").expect("valid"));
+// The opening of `/<(script|style)\b[\s\S]*?<\/\1>/gi`; JavaScript's `\b`
+// without the `u` flag is ASCII.
+static RAW_OPEN: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"(?i)<(script|style)(?-u:\b)").expect("valid"));
+// `/<[^>]*>/g`
+static TAG: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"<[^>]*>").expect("valid"));
+// `/&[#\w]+;/g`, `\w` being ASCII without the `u` flag.
+static ENTITY: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"&[#A-Za-z0-9_]+;").expect("valid"));
+
+/// What [`reading_time`] finds.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct ReadingTime {
+    pub words: usize,
+    pub cjk: usize,
+    pub minutes: f64,
+}
+
+/// `<script>…</script>` and `<style>…</style>` become a space: the first
+/// closing tag of the same name (any case) ends one; an opening with no
+/// closing is left for the tag rule, as the Studio's regular expression
+/// leaves it.
+fn without_raw_text(html: &str) -> String {
+    let mut out = String::with_capacity(html.len());
+    let mut done = 0; // copied up to here
+    let mut from = 0; // look for the next opening from here
+    while let Some(m) = RAW_OPEN.captures_at(html, from) {
+        let whole = m.get(0).expect("match");
+        let name = m[1].to_ascii_lowercase();
+        let close = format!("</{name}>");
+        let rest = &html[whole.end()..];
+        match find_ascii_ci(rest, &close) {
+            Some(at) => {
+                out.push_str(&html[done..whole.start()]);
+                out.push(' ');
+                done = whole.end() + at + close.len();
+                from = done;
+            }
+            None => {
+                // No match here; JavaScript tries the next position.
+                from = whole.start() + 1;
+            }
+        }
+    }
+    out.push_str(&html[done..]);
+    out
+}
+
+/// Where `needle` (ASCII, lower case) first occurs in `hay`, ignoring
+/// ASCII case.
+fn find_ascii_ci(hay: &str, needle: &str) -> Option<usize> {
+    let (h, n) = (hay.as_bytes(), needle.as_bytes());
+    (0..h.len().checked_sub(n.len())? + 1).find(|&i| h[i..i + n.len()].eq_ignore_ascii_case(n))
+}
+
+/// The text of an HTML fragment, near enough for counting: tags become
+/// spaces.
+pub fn text_of(html: &str) -> String {
+    let s = without_raw_text(html);
+    let s = TAG.replace_all(&s, " ");
+    ENTITY.replace_all(&s, " ").into_owned()
+}
+
+/// Words, CJK characters and minutes for an HTML fragment.
+pub fn reading_time(html: &str) -> ReadingTime {
+    let text = text_of(html);
+    let cjk = CJK.find_iter(&text).count();
+    let words = WORD.find_iter(&CJK.replace_all(&text, " ")).count();
+    ReadingTime {
+        words,
+        cjk,
+        minutes: words as f64 / WORDS_PER_MINUTE + cjk as f64 / CJK_PER_MINUTE,
+    }
+}
+
+/// "< 1 min", "4 min", or "" when there is nothing to read. Rounds half
+/// up, as `Math.round` does for a positive number.
+pub fn format_minutes(minutes: f64) -> String {
+    if minutes <= 0.0 || minutes.is_nan() {
+        String::new()
+    } else if minutes < 1.0 {
+        "< 1 min".into()
+    } else {
+        format!("{} min", (minutes + 0.5).floor())
+    }
+}
+
+/// The hover text: "460 words", "6 characters", "1 words, 2 characters"
+/// (the Studio's words exactly, plural and all).
+pub fn count_label(t: &ReadingTime) -> String {
+    let mut parts = vec![];
+    if t.words > 0 {
+        parts.push(format!("{} words", t.words));
+    }
+    if t.cjk > 0 {
+        parts.push(format!("{} characters", t.cjk));
+    }
+    parts.join(", ")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // The Studio's own examples (test-ui/default-extensions.test.ts).
+    #[test]
+    fn counts_words_from_html_and_cjk_characters_separately() {
+        let words: Vec<String> = (0..460).map(|i| format!("word{i}")).collect();
+        let t = reading_time(&format!("<p>{}</p>", words.join(" ")));
+        assert_eq!((t.words, t.cjk, t.minutes), (460, 0, 2.0));
+        // Tags, entities, scripts and styles are not words; an apostrophe
+        // or hyphen does not split one.
+        let t = reading_time(
+            "<p>It’s <em>well-known</em>&nbsp;now</p><script>var a = 1</script><style>p{}</style>",
+        );
+        assert_eq!(t.words, 3);
+        let t = reading_time("<p>日本語の文章</p>");
+        assert_eq!((t.words, t.cjk), (0, 6));
+        let t = reading_time("<p>Blygger 日本</p>");
+        assert_eq!((t.words, t.cjk), (1, 2));
+        assert_eq!(format_minutes(0.0), "");
+        assert_eq!(format_minutes(0.2), "< 1 min");
+        assert_eq!(format_minutes(3.6), "4 min");
+    }
+
+    #[test]
+    fn rounds_like_math_round_and_labels_like_the_studio() {
+        assert_eq!(format_minutes(1.0), "1 min");
+        assert_eq!(format_minutes(2.5), "3 min");
+        assert_eq!(format_minutes(2.49), "2 min");
+        assert_eq!(format_minutes(-1.0), "");
+        let t = reading_time("<p>one two three</p>");
+        assert_eq!(format_minutes(t.minutes), "< 1 min");
+        assert_eq!(count_label(&t), "3 words");
+        assert_eq!(
+            count_label(&reading_time("<p>Blygger 日本</p>")),
+            "1 words, 2 characters"
+        );
+        assert_eq!(count_label(&reading_time("")), "");
+    }
+
+    #[test]
+    fn raw_text_ends_at_its_own_closing_tag_in_any_case() {
+        assert_eq!(reading_time("<SCRIPT type=x>a b c</Script> one").words, 1);
+        // `<scripts>` isn't a script (the `\b`), so only its tag goes.
+        assert_eq!(reading_time("<scripts>a b</scripts>").words, 2);
+        // An unclosed script is just a tag; its text counts.
+        assert_eq!(reading_time("<script>a b").words, 2);
+        // A style inside a script's text ends nothing.
+        assert_eq!(
+            reading_time("<script>x</style>y</script>z <style>q</style>w").words,
+            2
+        );
+        // Kana, Hangul and Han all count as characters.
+        let t = reading_time("カタカナ ひらがな 한국어 漢字");
+        assert_eq!((t.words, t.cjk), (0, 4 + 4 + 3 + 2));
+        // Numbers are words; a lone apostrophe isn't.
+        assert_eq!(reading_time("1984 ’ - 3.5").words, 3);
+        assert_eq!(text_of("a&amp;b&#8217;c&;d"), "a b c&;d");
+    }
+}
diff --git a/crates/blyg-ext-reading-time/src/lib.rs b/crates/blyg-ext-reading-time/src/lib.rs
new file mode 100644
index 0000000..51a330d
--- /dev/null
+++ b/crates/blyg-ext-reading-time/src/lib.rs
@@ -0,0 +1,172 @@
+//! reading-time: Burrow's bundled extension that shows an estimated
+//! reading time ("4 min", the word count on hover) at the end of each
+//! reading entry's byline. A port of blygger-studio's `reading-time`
+//! extension (studio 0.39.0), so both clients show the same estimate.
+//!
+//! It contributes one reading slot, `entry-byline` (docs/EXTENSIONS.md §
+//! Reading slots), and answers `extension/entry.byline` from the entry the
+//! host sends: no fetch, no file, no network. Off until
+//! `extension = reading-time` and consent (`reading.read`).
+//!
+//! - [`count`]: the counting, pure.
+//! - [`run`]: the BXP extension around it (`blygger +ext reading-time`).
+
+pub mod count;
+
+use std::path::PathBuf;
+use std::process::ExitCode;
+
+use blyg_ext::ext::{Extension, HostClient, serve};
+use blyg_ext::manifest::{Installed, Manifest, Origin};
+use blyg_ext::protocol::{InitializeParams, InitializeResult, PROTOCOL_VERSION, RpcError};
+use blyg_ext::reading::{ENTRY_BYLINE, EntryByline, EntryBylineParams, ReadingEntry};
+use blyg_ext::rpc::{params, to_value};
+use serde_json::Value;
+
+/// The extension's name (`extension = reading-time`).
+pub const NAME: &str = "reading-time";
+
+const MANIFEST: &str = r#"
+name = "reading-time"
+version = "0.1.0"
+protocol = 1
+description = "Shows an estimated reading time and word count at the end of each reading entry's byline."
+capabilities = ["reading.read"]
+entry-byline = true
+"#;
+
+/// The manifest (checked by the same rules as any extension's).
+pub fn manifest() -> Manifest {
+    Manifest::parse(MANIFEST, true).expect("the bundled manifest is valid")
+}
+
+/// The bundled extension for the host's `HostConfig::bundled`: run as
+/// `program args…` (the app passes its own executable and
+/// `["+ext", "reading-time"]`). Off until `extension = reading-time`.
+pub fn bundled(program: PathBuf, args: Vec<String>) -> Installed {
+    Installed {
+        manifest: manifest(),
+        origin: Origin::Bundled { program, args },
+    }
+}
+
+/// The marker for one entry: "< 1 min" with "3 words" on hover, or none
+/// when there's nothing to read. An entry held only as Markdown is
+/// counted from the HTML its blyg publishes for it.
+pub fn byline(entry: &ReadingEntry) -> Option<EntryByline> {
+    let html = if entry.content_html.trim().is_empty() && !entry.content_md.trim().is_empty() {
+        blyg_render::render_markdown(&entry.content_md)
+    } else {
+        entry.content_html.clone()
+    };
+    let t = count::reading_time(&html);
+    let label = count::format_minutes(t.minutes);
+    if label.is_empty() {
+        return None;
+    }
+    let tip = count::count_label(&t);
+    Some(EntryByline {
+        text: label,
+        tip: (!tip.is_empty()).then_some(tip),
+    })
+}
+
+/// The extension: stateless.
+#[derive(Debug, Default)]
+pub struct ReadingTimeExt;
+
+impl Extension for ReadingTimeExt {
+    fn initialize(
+        &mut self,
+        _host: &HostClient,
+        _p: InitializeParams,
+    ) -> Result<InitializeResult, RpcError> {
+        Ok(InitializeResult {
+            protocol_version: PROTOCOL_VERSION,
+            name: NAME.into(),
+            version: env!("CARGO_PKG_VERSION").into(),
+            commands: vec![],
+            sources: vec![],
+            libraries: vec![],
+        })
+    }
+
+    fn request(&mut self, _host: &HostClient, method: &str, p: Value) -> Result<Value, RpcError> {
+        match method {
+            ENTRY_BYLINE => {
+                let p: EntryBylineParams = params(p)?;
+                to_value(&byline(&p.entry))
+            }
+            m => Err(RpcError::method_not_found(m)),
+        }
+    }
+}
+
+/// Serve the extension over `read`/`write` until shutdown.
+pub fn run<R, W>(read: R, write: W) -> ExitCode
+where
+    R: std::io::Read + Send + 'static,
+    W: std::io::Write + Send + 'static,
+{
+    serve(read, write, &mut ReadingTimeExt);
+    ExitCode::SUCCESS
+}
+
+/// [`run`] over this process's stdin/stdout (`blygger +ext reading-time`).
+pub fn run_stdio() -> ExitCode {
+    run(std::io::stdin(), std::io::stdout())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use blyg_ext::Capability;
+
+    fn entry(html: &str, md: &str) -> ReadingEntry {
+        ReadingEntry {
+            subscription_id: "s1".into(),
+            remote_id: "r1".into(),
+            origin: "https://blyg.example.com".into(),
+            kind: "fragment".into(),
+            state: "current".into(),
+            version: 1,
+            title: String::new(),
+            content_html: html.into(),
+            content_md: md.into(),
+            content_hash: None,
+        }
+    }
+
+    #[test]
+    fn the_manifest_asks_to_read_and_adds_a_byline_only() {
+        let m = manifest();
+        assert_eq!(m.name, NAME);
+        assert_eq!(m.capabilities, vec![Capability::ReadingRead]);
+        assert!(m.entry_byline);
+        assert!(m.entry_actions.is_empty() && m.commands.is_empty() && m.macros.is_empty());
+    }
+
+    // As the Studio's byline test: "· < 1 min" with "3 words" on hover,
+    // and nothing for an empty entry (the host draws the "·").
+    #[test]
+    fn the_byline_shows_minutes_with_the_count_on_hover() {
+        let b = byline(&entry("<p>one two three</p>", "one two three")).unwrap();
+        assert_eq!(b.text, "< 1 min");
+        assert_eq!(b.tip.as_deref(), Some("3 words"));
+        assert_eq!(byline(&entry("", "")), None);
+        let long = "tide ".repeat(920);
+        let b = byline(&entry(&format!("<p>{long}</p>"), "")).unwrap();
+        assert_eq!(b.text, "4 min");
+        assert_eq!(b.tip.as_deref(), Some("920 words"));
+    }
+
+    #[test]
+    fn markdown_only_entries_count_their_rendered_html() {
+        let b = byline(&entry(
+            "",
+            "# Tides\n\nThe *moon* pulls the [sea](https://example.com).",
+        ))
+        .unwrap();
+        assert_eq!(b.tip.as_deref(), Some("6 words"));
+    }
+}
diff --git a/crates/blyg-ext/Cargo.toml b/crates/blyg-ext/Cargo.toml
index 0789c41..f5de276 100644
--- a/crates/blyg-ext/Cargo.toml
+++ b/crates/blyg-ext/Cargo.toml
@@ -22,3 +22,10 @@ name = "bxp-test-ext"
 path = "src/bin/bxp-test-ext.rs"
 test = false
 doc = false
+
+# --- reading slots --- The test extension `tests/reading.rs` spawns.
+[[bin]]
+name = "bxp-slots-ext"
+path = "src/bin/bxp-slots-ext.rs"
+test = false
+doc = false
diff --git a/crates/blyg-ext/src/bin/bxp-slots-ext.rs b/crates/blyg-ext/src/bin/bxp-slots-ext.rs
new file mode 100644
index 0000000..2621d0a
--- /dev/null
+++ b/crates/blyg-ext/src/bin/bxp-slots-ext.rs
@@ -0,0 +1,86 @@
+//! The reading-slots test extension (`tests/reading.rs`): answers
+//! `extension/entry.byline` and `extension/entry.action` from what the host
+//! sends, so the test can see exactly what crossed the wire.
+//!
+//! - byline: `v<version> <remoteId>` with the content hash as the tip;
+//!   nothing for an entry whose Markdown says "silent"; an error for
+//!   "broken"; a 3 s nap for "slow".
+//! - action `echo`: a sheet whose fields are the entry's ids and the
+//!   record's keys, and whose code is the record; action `fail`: an error.
+
+use blyg_ext::ext::{Extension, HostClient, serve};
+use blyg_ext::protocol::*;
+use blyg_ext::reading::*;
+use blyg_ext::rpc::{params, to_value};
+use serde_json::Value;
+
+struct Slots;
+
+impl Extension for Slots {
+    fn initialize(
+        &mut self,
+        _host: &HostClient,
+        _p: InitializeParams,
+    ) -> Result<InitializeResult, RpcError> {
+        Ok(InitializeResult {
+            protocol_version: PROTOCOL_VERSION,
+            name: "bxp-slots".into(),
+            version: "0.0.1".into(),
+            commands: vec![],
+            sources: vec![],
+            libraries: vec![],
+        })
+    }
+
+    fn request(&mut self, _host: &HostClient, method: &str, p: Value) -> Result<Value, RpcError> {
+        match method {
+            ENTRY_BYLINE => {
+                let p: EntryBylineParams = params(p)?;
+                let md = p.entry.content_md.as_str();
+                if md.contains("slow") {
+                    std::thread::sleep(std::time::Duration::from_secs(3));
+                }
+                if md.contains("broken") {
+                    return Err(RpcError::new(-1, "broken entry"));
+                }
+                if md.contains("silent") {
+                    return Ok(Value::Null);
+                }
+                to_value(&EntryByline {
+                    text: format!("v{} {}", p.entry.version, p.entry.remote_id),
+                    tip: p.entry.content_hash.clone(),
+                })
+            }
+            ENTRY_ACTION => {
+                let p: EntryActionParams = params(p)?;
+                match p.action.as_str() {
+                    "echo" => {
+                        let keys = p
+                            .record
+                            .as_object()
+                            .map(|o| o.keys().cloned().collect::<Vec<_>>().join(","))
+                            .unwrap_or_default();
+                        to_value(&EntrySheet {
+                            title: "echo".into(),
+                            description: None,
+                            text: format!("{} {}", p.entry.subscription_id, p.entry.remote_id),
+                            fields: vec![SheetField {
+                                label: "keys".into(),
+                                value: keys,
+                            }],
+                            code: Some(p.record.to_string()),
+                            language: Some("json".into()),
+                        })
+                    }
+                    "fail" => Err(RpcError::new(-1, "it didn't work")),
+                    other => Err(RpcError::invalid_params(other)),
+                }
+            }
+            m => Err(RpcError::method_not_found(m)),
+        }
+    }
+}
+
+fn main() {
+    serve(std::io::stdin(), std::io::stdout(), &mut Slots);
+}
diff --git a/crates/blyg-ext/src/capability.rs b/crates/blyg-ext/src/capability.rs
index 2649442..feadedd 100644
--- a/crates/blyg-ext/src/capability.rs
+++ b/crates/blyg-ext/src/capability.rs
@@ -176,7 +176,12 @@ pub fn describe(cap: &Capability) -> String {
     let base = match cap {
         Capability::ItemsRead => "read your posts, drafts and scratch notes".to_string(),
         Capability::ItemsWrite => "create and edit drafts (it can never publish)".to_string(),
-        Capability::ReadingRead => "read the posts held from your subscriptions".to_string(),
+        // --- reading slots --- the same posts reach its byline marker and ⋯ rows.
+        Capability::ReadingRead => {
+            "read the posts held from your subscriptions, and add to how each one shows \
+             while you read"
+                .to_string()
+        }
         Capability::BlygIdentity => "know your blyg's address (never your sign-in)".to_string(),
         Capability::Ui => "show messages and select posts in the list".to_string(),
         Capability::HookPublished => "be told when you publish, with the post's text".to_string(),
diff --git a/crates/blyg-ext/src/host.rs b/crates/blyg-ext/src/host.rs
index 686804f..c26df2d 100644
--- a/crates/blyg-ext/src/host.rs
+++ b/crates/blyg-ext/src/host.rs
@@ -785,7 +785,20 @@ impl Host {
         lock(&self.inner.state).running.get(name).cloned()
     }
 
-    fn request<T: DeserializeOwned>(
+    /// --- reading slots --- Running extensions' manifests and grants
+    /// (`crate::reading`).
+    pub(crate) fn running_manifests(
+        &self,
+    ) -> Vec<(String, crate::manifest::Manifest, Vec<Capability>)> {
+        let st = lock(&self.inner.state);
+        st.running
+            .iter()
+            .filter(|(_, e)| *lock(&e.state) == ExtState::Running)
+            .map(|(n, e)| (n.clone(), e.installed.manifest.clone(), e.granted()))
+            .collect()
+    }
+
+    pub(crate) fn request<T: DeserializeOwned>(
         &self,
         name: &str,
         method: &str,
@@ -822,7 +835,7 @@ impl Host {
         }
     }
 
-    fn timing(&self) -> Timing {
+    pub(crate) fn timing(&self) -> Timing {
         lock(&self.inner.state).config.timing.clone()
     }
 
diff --git a/crates/blyg-ext/src/lib.rs b/crates/blyg-ext/src/lib.rs
index 331fa8a..3ca3724 100644
--- a/crates/blyg-ext/src/lib.rs
+++ b/crates/blyg-ext/src/lib.rs
@@ -22,6 +22,7 @@ pub mod grants;
 pub mod host;
 pub mod manifest;
 pub mod protocol;
+pub mod reading; // --- reading slots ---
 pub mod recipe;
 pub mod rpc;
 pub mod spawn;
diff --git a/crates/blyg-ext/src/manifest.rs b/crates/blyg-ext/src/manifest.rs
index 6208ffc..b52160e 100644
--- a/crates/blyg-ext/src/manifest.rs
+++ b/crates/blyg-ext/src/manifest.rs
@@ -97,6 +97,11 @@ struct Raw {
     sites: Vec<SiteSpec>,
     #[serde(default)]
     macros: Vec<MacroSpec>,
+    // --- reading slots --- (crate::reading; both need `reading.read`)
+    #[serde(default, rename = "entry-byline", alias = "entryByline")]
+    entry_byline: bool,
+    #[serde(default, rename = "entry-actions", alias = "entryActions")]
+    entry_actions: Vec<crate::reading::EntryActionSpec>,
 }
 
 /// A validated manifest.
@@ -119,6 +124,12 @@ pub struct Manifest {
     pub sites: Vec<SiteSpec>,
     /// Browser macros, checked ([`crate::recipe::check_macro`]).
     pub macros: Vec<MacroSpec>,
+    /// --- reading slots --- It answers `extension/entry.byline`
+    /// (`entry-byline = true`); needs `reading.read`.
+    pub entry_byline: bool,
+    /// Its rows in a reading entry's ⋯ sheet (`[[entry-actions]]`); needs
+    /// `reading.read`.
+    pub entry_actions: Vec<crate::reading::EntryActionSpec>,
 }
 
 impl Manifest {
@@ -236,6 +247,21 @@ impl Manifest {
         for m in &raw.macros {
             check_macro(m, &sites).map_err(|e| ManifestError(e.to_string()))?;
         }
+        // --- reading slots ---
+        unique_ids(
+            "entry action",
+            raw.entry_actions.iter().map(|a| a.id.as_str()),
+        )?;
+        for a in &raw.entry_actions {
+            if a.title.trim().is_empty() {
+                return err(format!("entry action {:?} has no title", a.id));
+            }
+        }
+        if (raw.entry_byline || !raw.entry_actions.is_empty())
+            && !capabilities.contains(&Capability::ReadingRead)
+        {
+            return err("entry-byline and entry-actions need \"reading.read\" in capabilities");
+        }
         Ok(Manifest {
             name: raw.name,
             version: raw.version,
@@ -249,6 +275,8 @@ impl Manifest {
             settings: raw.settings,
             sites,
             macros: raw.macros,
+            entry_byline: raw.entry_byline,
+            entry_actions: raw.entry_actions,
         })
     }
 }
diff --git a/crates/blyg-ext/src/protocol.rs b/crates/blyg-ext/src/protocol.rs
index f79bfbc..2173a8c 100644
--- a/crates/blyg-ext/src/protocol.rs
+++ b/crates/blyg-ext/src/protocol.rs
@@ -36,6 +36,9 @@ pub mod methods {
     /// Optional: shape a macro's text before the preview sheet
     /// ([`super::MacroPrepareParams`]). Method-not-found = use the template.
     pub const MACRO_PREPARE: &str = "extension/macro.prepare";
+    /// Optional, reading slots ([`crate::reading`]): a reading entry's
+    /// byline marker, and one of its ⋯ rows.
+    pub use crate::reading::{ENTRY_ACTION, ENTRY_BYLINE};
     // host -> extension (notifications)
     pub const ITEM_PUBLISHED: &str = "burrow/itemPublished";
     pub const ITEM_SAVED: &str = "burrow/itemSaved";
diff --git a/crates/blyg-ext/src/reading.rs b/crates/blyg-ext/src/reading.rs
new file mode 100644
index 0000000..e55d793
--- /dev/null
+++ b/crates/blyg-ext/src/reading.rs
@@ -0,0 +1,386 @@
+//! Reading-pane slots: what an extension adds to each reading entry. They
+//! mirror the web Studio's extension slots (blygger-studio
+//! `src/ui/extension-api.ts`), named after them:
+//!
+//! - **`entryByline`**: a short text marker at the end of each entry's
+//!   byline (the bundled `reading-time` shows "4 min"). Manifest
+//!   `entry-byline = true`; the host asks `extension/entry.byline` per
+//!   entry, off the main thread, and caches the answer by (entry, version).
+//!   No answer, an error or an empty `text` shows nothing.
+//! - **`entryActions`**: rows in an entry's ⋯ sheet (manifest
+//!   `[[entry-actions]]`). Choosing one asks `extension/entry.action`, and
+//!   the host shows the answer ([`EntrySheet`]) natively: plain text,
+//!   label/value fields, and an optional monospaced code block with a Copy
+//!   button. The bundled `inspect` is one.
+//!
+//! Both hand the extension the entry's data, so both need `reading.read`:
+//! the manifest must declare it, and the host only asks extensions that
+//! were granted it. Both are optional methods of protocol 1 (an extension
+//! that doesn't declare them is never asked), so no version bump.
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+use crate::capability::Capability;
+use crate::host::{ExtError, Host};
+use crate::protocol::{RpcError, codes, kind_str};
+use crate::rpc::to_value;
+
+/// `extension/entry.byline` (host -> extension, 2 s): the marker for one
+/// entry ([`EntryBylineParams`] -> [`EntryByline`]).
+pub const ENTRY_BYLINE: &str = "extension/entry.byline";
+/// `extension/entry.action` (host -> extension, 5 s): the sheet for one of
+/// the extension's ⋯ rows on one entry ([`EntryActionParams`] ->
+/// [`EntrySheet`]).
+pub const ENTRY_ACTION: &str = "extension/entry.action";
+
+/// The longest marker the host draws, in characters; longer ones are cut
+/// with "…".
+pub const BYLINE_MAX: usize = 40;
+
+/// A row an extension adds to every reading entry's ⋯ sheet (manifest
+/// `[[entry-actions]]`, as the Studio's `EntryAction`).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EntryActionSpec {
+    /// Sent back in [`EntryActionParams::action`].
+    pub id: String,
+    /// The row's label ("inspect").
+    pub title: String,
+    /// A line under it ("ids, versions, references, JSON").
+    #[serde(default)]
+    pub detail: String,
+    /// A short glyph before it ("{ }").
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub icon: Option<String>,
+}
+
+/// One reading entry, as the client holds it: the post from a
+/// subscription (or one fetched to show a quote's original).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ReadingEntry {
+    pub subscription_id: String,
+    pub remote_id: String,
+    /// The author's blyg (or the feed's site).
+    pub origin: String,
+    /// `fragment` or `thread`.
+    pub kind: String,
+    /// `current` or `tombstone`.
+    pub state: String,
+    pub version: u32,
+    #[serde(default)]
+    pub title: String,
+    /// The published HTML as held; `""` when the client holds only the
+    /// Markdown (render `contentMd` then, as Burrow's reader does).
+    #[serde(default)]
+    pub content_html: String,
+    #[serde(default)]
+    pub content_md: String,
+    /// `"sha256:" + hex(SHA-256(contentMd))`, the protocol's
+    /// `content_hash`; absent when the client holds no Markdown.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub content_hash: Option<String>,
+}
+
+impl ReadingEntry {
+    pub fn of(r: &blyg_core::ReadingItem) -> Self {
+        ReadingEntry {
+            subscription_id: r.subscription_id.clone(),
+            remote_id: r.remote_id.clone(),
+            origin: r.origin.clone(),
+            kind: kind_str(r.kind).into(),
+            state: r.state.clone(),
+            version: r.version,
+            title: blyg_core::plain_title(&r.content_md).unwrap_or_default(),
+            content_html: r.content_html.clone(),
+            content_md: r.content_md.clone(),
+            content_hash: (!r.content_md.is_empty())
+                .then(|| blyg_core::content_hash(&r.content_md)),
+        }
+    }
+}
+
+/// The record the client stores for `r`, as JSON (snake_case, Burrow's
+/// own reading row, bodies included): what `inspect` shows.
+pub fn record_of(r: &blyg_core::ReadingItem) -> Value {
+    serde_json::to_value(r).unwrap_or(Value::Null)
+}
+
+/// `extension/entry.byline`.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EntryBylineParams {
+    pub entry: ReadingEntry,
+}
+
+/// The answer to `extension/entry.byline`. An empty `text` shows nothing.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EntryByline {
+    /// Plain text, one line ("4 min"); the host puts it after a "·".
+    #[serde(default)]
+    pub text: String,
+    /// Shown on hover ("920 words").
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub tip: Option<String>,
+}
+
+impl EntryByline {
+    /// What the host draws: trimmed, on one line, at most [`BYLINE_MAX`]
+    /// characters; `None` when there's nothing.
+    pub fn shown(&self) -> Option<EntryByline> {
+        let line: String = self.text.split_whitespace().collect::<Vec<_>>().join(" ");
+        if line.is_empty() {
+            return None;
+        }
+        let text = if line.chars().count() > BYLINE_MAX {
+            let cut: String = line.chars().take(BYLINE_MAX - 1).collect();
+            format!("{}…", cut.trim_end())
+        } else {
+            line
+        };
+        Some(EntryByline {
+            text,
+            tip: self.tip.clone().filter(|t| !t.trim().is_empty()),
+        })
+    }
+}
+
+/// `extension/entry.action`.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EntryActionParams {
+    /// The [`EntryActionSpec::id`] chosen.
+    pub action: String,
+    pub entry: ReadingEntry,
+    /// The record the client stores for the entry ([`record_of`]).
+    #[serde(default)]
+    pub record: Value,
+}
+
+/// One label/value line of an [`EntrySheet`].
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SheetField {
+    pub label: String,
+    pub value: String,
+}
+
+/// The answer to `extension/entry.action`: a sheet the host draws
+/// natively, in this order: title, description, text, fields, code (with
+/// a Copy button that copies it). Nothing in it is markup.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EntrySheet {
+    #[serde(default)]
+    pub title: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Plain text (paragraphs separated by blank lines).
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub text: String,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub fields: Vec<SheetField>,
+    /// A block shown monospaced, as given.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub code: Option<String>,
+    /// What the code is (`json`): the Copy button says "Copy JSON".
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub language: Option<String>,
+}
+
+impl EntrySheet {
+    /// The Copy button's label.
+    pub fn copy_label(&self) -> String {
+        match self.language.as_deref().map(str::trim) {
+            Some(l) if l.eq_ignore_ascii_case("json") => "Copy JSON".into(),
+            Some(l) if !l.is_empty() => format!("Copy {l}"),
+            _ => "Copy".into(),
+        }
+    }
+}
+
+/// The reading slots of one running extension granted `reading.read`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct EntrySlots {
+    pub ext: String,
+    /// It answers `extension/entry.byline`.
+    pub byline: bool,
+    pub actions: Vec<EntryActionSpec>,
+}
+
+impl Host {
+    /// The reading slots of running extensions that declare any and hold
+    /// `reading.read`, by extension name. Cheap (no call into an
+    /// extension): the UI asks it while drawing.
+    pub fn entry_slots(&self) -> Vec<EntrySlots> {
+        self.running_manifests()
+            .into_iter()
+            .filter(|(_, m, granted)| {
+                (m.entry_byline || !m.entry_actions.is_empty())
+                    && granted
+                        .iter()
+                        .any(|g| Capability::ReadingRead.covered_by(g))
+            })
+            .map(|(ext, m, _)| EntrySlots {
+                ext,
+                byline: m.entry_byline,
+                actions: m.entry_actions,
+            })
+            .collect()
+    }
+
+    /// Ask `ext` for `entry`'s byline marker (blocking, up to
+    /// `Timing::search`; run it off the main thread). `Ok(None)` when it
+    /// has nothing to show (or doesn't implement the method).
+    pub fn entry_byline(
+        &self,
+        ext: &str,
+        entry: &ReadingEntry,
+    ) -> Result<Option<EntryByline>, ExtError> {
+        self.slot_allowed(ext, |s| s.byline)?;
+        let p = to_value(&EntryBylineParams {
+            entry: entry.clone(),
+        })
+        .map_err(ExtError::Rpc)?;
+        match self.request::<Option<EntryByline>>(ext, ENTRY_BYLINE, p, self.timing().search) {
+            Ok(b) => Ok(b.and_then(|b| b.shown())),
+            Err(ExtError::Rpc(e)) if e.code == codes::METHOD_NOT_FOUND => Ok(None),
+            Err(e) => Err(e),
+        }
+    }
+
+    /// Run one of `ext`'s ⋯ rows on `r` (blocking, up to `Timing::read`).
+    pub fn entry_action(
+        &self,
+        ext: &str,
+        action: &str,
+        r: &blyg_core::ReadingItem,
+    ) -> Result<EntrySheet, ExtError> {
+        self.slot_allowed(ext, |s| s.actions.iter().any(|a| a.id == action))?;
+        let p = to_value(&EntryActionParams {
+            action: action.into(),
+            entry: ReadingEntry::of(r),
+            record: record_of(r),
+        })
+        .map_err(ExtError::Rpc)?;
+        self.request(ext, ENTRY_ACTION, p, self.timing().read)
+    }
+
+    /// `ext` is running, holds `reading.read` and declares the slot.
+    fn slot_allowed(&self, ext: &str, has: impl Fn(&EntrySlots) -> bool) -> Result<(), ExtError> {
+        match self.entry_slots().iter().find(|s| s.ext == ext) {
+            Some(s) if has(s) => Ok(()),
+            Some(_) => Err(ExtError::Rpc(RpcError::method_not_found(ENTRY_ACTION))),
+            None if self.running_manifests().iter().any(|(n, _, _)| n == ext) => {
+                Err(ExtError::Rpc(RpcError::permission_denied(
+                    &Capability::ReadingRead.as_string(),
+                )))
+            }
+            None => Err(ExtError::NotRunning),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn the_wire_is_camel_case_and_tolerant() {
+        let e = ReadingEntry {
+            subscription_id: "s1".into(),
+            remote_id: "r1".into(),
+            origin: "https://blyg.example.com".into(),
+            kind: "fragment".into(),
+            state: "current".into(),
+            version: 2,
+            title: String::new(),
+            content_html: "<p>Hi</p>".into(),
+            content_md: "Hi".into(),
+            content_hash: Some(blyg_core::content_hash("Hi")),
+        };
+        let v = serde_json::to_value(EntryBylineParams { entry: e.clone() }).unwrap();
+        assert_eq!(v["entry"]["remoteId"], "r1");
+        assert_eq!(v["entry"]["contentHtml"], "<p>Hi</p>");
+        let b: EntryByline = serde_json::from_value(json!({"text": "1 min", "x": 1})).unwrap();
+        assert_eq!(b.text, "1 min");
+        let s: EntrySheet = serde_json::from_value(json!({"title": "inspect"})).unwrap();
+        assert!(s.code.is_none() && s.fields.is_empty());
+        let a: EntryActionParams =
+            serde_json::from_value(json!({"action": "inspect", "entry": v["entry"]})).unwrap();
+        assert_eq!(a.record, Value::Null);
+    }
+
+    #[test]
+    fn a_marker_is_one_short_line_or_nothing() {
+        let b = |t: &str| EntryByline {
+            text: t.into(),
+            tip: Some(" ".into()),
+        };
+        assert_eq!(b("  ").shown(), None);
+        let s = b(" 4\nmin ").shown().unwrap();
+        assert_eq!(s.text, "4 min");
+        assert_eq!(s.tip, None, "a blank tip is none");
+        let long = b(&"word ".repeat(20)).shown().unwrap();
+        assert_eq!(long.text.chars().count(), BYLINE_MAX);
+        assert!(long.text.ends_with('…'));
+    }
+
+    #[test]
+    fn manifests_declare_slots_behind_reading_read() {
+        use crate::manifest::Manifest;
+        let head = "name = \"x\"\nversion = \"1\"\nprotocol = 1\ncommand = [\"x\"]\n";
+        let m = Manifest::parse(
+            &format!(
+                "{head}capabilities = [\"reading.read\"]\nentry-byline = true\n\
+                 [[entry-actions]]\nid = \"look\"\ntitle = \"look\"\nicon = \"◇\"\n"
+            ),
+            false,
+        )
+        .unwrap();
+        assert!(m.entry_byline);
+        assert_eq!(m.entry_actions[0].id, "look");
+        assert_eq!(m.entry_actions[0].icon.as_deref(), Some("◇"));
+        // camelCase spellings load too.
+        let m = Manifest::parse(
+            &format!("{head}capabilities = [\"reading.read\"]\nentryByline = true\n"),
+            false,
+        )
+        .unwrap();
+        assert!(m.entry_byline);
+        let none = Manifest::parse(head, false).unwrap();
+        assert!(!none.entry_byline && none.entry_actions.is_empty());
+        let bad = |extra: &str| {
+            Manifest::parse(&format!("{head}{extra}"), false)
+                .unwrap_err()
+                .0
+        };
+        assert!(bad("entry-byline = true\n").contains("reading.read"));
+        assert!(
+            bad(
+                "capabilities = [\"reading.read\"]\n[[entry-actions]]\nid = \"a\"\ntitle = \" \"\n"
+            )
+            .contains("no title")
+        );
+        assert!(
+            bad(
+                "capabilities = [\"reading.read\"]\n[[entry-actions]]\nid = \"a\"\ntitle = \"A\"\n\
+                 [[entry-actions]]\nid = \"a\"\ntitle = \"B\"\n"
+            )
+            .contains("twice")
+        );
+    }
+
+    #[test]
+    fn the_copy_button_names_the_language() {
+        let mut s = EntrySheet::default();
+        assert_eq!(s.copy_label(), "Copy");
+        s.language = Some("json".into());
+        assert_eq!(s.copy_label(), "Copy JSON");
+        s.language = Some("toml".into());
+        assert_eq!(s.copy_label(), "Copy toml");
+    }
+}
diff --git a/crates/blyg-ext/tests/host.rs b/crates/blyg-ext/tests/host.rs
index 14abbdc..48ce46b 100644
--- a/crates/blyg-ext/tests/host.rs
+++ b/crates/blyg-ext/tests/host.rs
@@ -872,3 +872,38 @@ fn library_calls_map_stale_writes() {
         })
     );
 }
+
+#[test]
+fn a_reload_without_its_extension_line_stops_it() {
+    // Running: Burrow's Turn off removes `extension = <name>`, keeping its grants.
+    let env = setup(&["ui"], &["ui"], &[]);
+    env.started();
+    let mut off = config(env.dir.path(), &["ui"], &[]);
+    off.enabled.clear();
+    env.host.reload(off);
+    env.wait_for("Stopped", |e| {
+        matches!(e, ExtEvent::Stopped { message: None, .. })
+    });
+    assert_eq!(env.host.status()[0].state, ExtState::Disabled);
+    assert_eq!(env.command("echo", None), Err(ExtError::NotRunning));
+    // Back on: its grants were kept, so it starts without asking.
+    env.host.reload(config(env.dir.path(), &["ui"], &[]));
+    env.started();
+
+    // Waiting out a crash's backoff: it stops and isn't started again.
+    let env = setup_with(&[], &[], &["crash-init=1"], |c| {
+        c.timing.max_failures = 100;
+        c.timing.backoff = vec![Duration::from_millis(400)];
+    });
+    env.wait_for("Failed", |e| matches!(e, ExtEvent::Failed { .. }));
+    let mut off = config(env.dir.path(), &[], &["crash-init=1"]);
+    off.enabled.clear();
+    env.host.reload(off);
+    env.wait_for("Stopped", |e| {
+        matches!(e, ExtEvent::Stopped { message: None, .. })
+    });
+    let starts = read_lines(&env.storage().join("starts.log")).len();
+    std::thread::sleep(Duration::from_millis(600));
+    assert_eq!(read_lines(&env.storage().join("starts.log")).len(), starts);
+    assert_eq!(env.host.status()[0].state, ExtState::Disabled);
+}
diff --git a/crates/blyg-ext/tests/reading.rs b/crates/blyg-ext/tests/reading.rs
new file mode 100644
index 0000000..6251a7a
--- /dev/null
+++ b/crates/blyg-ext/tests/reading.rs
@@ -0,0 +1,233 @@
+//! Reading slots over the wire: the host against a real extension process
+//! (`bxp-slots-ext`) that echoes what it was sent. `extension/entry.byline`
+//! and `extension/entry.action` carry the entry (camelCase) and the record
+//! the client holds (snake_case), only to an extension granted
+//! `reading.read`, and the answers come back as the host's types.
+
+use std::sync::Arc;
+use std::sync::mpsc::{Receiver, channel};
+use std::time::{Duration, Instant};
+
+use blyg_core::ReadingItem;
+use blyg_ext::protocol::codes;
+use blyg_ext::reading::{EntryActionSpec, EntrySlots, ReadingEntry};
+use blyg_ext::*;
+use serde_json::{Value, json};
+
+const NAME: &str = "bxp-slots";
+const WAIT: Duration = Duration::from_secs(15);
+
+fn manifest() -> String {
+    let exe = env!("CARGO_BIN_EXE_bxp-slots-ext");
+    format!(
+        r#"name = "{NAME}"
+version = "0.0.1"
+protocol = 1
+command = ['{exe}']
+capabilities = ["reading.read", "ui"]
+entry-byline = true
+
+[[entry-actions]]
+id = "echo"
+title = "echo"
+detail = "what the host sent"
+icon = "◇"
+
+[[entry-actions]]
+id = "fail"
+title = "fail"
+"#
+    )
+}
+
+struct Env {
+    _dir: tempfile::TempDir,
+    host: Host,
+    events: Receiver<ExtEvent>,
+}
+
+fn setup(grants: &[&str], tweak: impl FnOnce(&mut HostConfig)) -> Env {
+    let dir = tempfile::tempdir().unwrap();
+    let ext_dir = dir.path().join("extensions").join(NAME);
+    std::fs::create_dir_all(&ext_dir).unwrap();
+    std::fs::write(ext_dir.join(MANIFEST_FILE), manifest()).unwrap();
+    let mut c = HostConfig::new(dir.path().join("data"), "0.0.0-test");
+    c.enabled = vec![NAME.into()];
+    let lines: Vec<String> = grants.iter().map(|g| format!("{NAME} {g}")).collect();
+    c.grants = Grants::from_allow_lines(&lines).0;
+    c.extensions_dir = Some(dir.path().join("extensions"));
+    c.timing.shutdown = Duration::from_secs(5);
+    tweak(&mut c);
+    let (tx, events) = channel();
+    let host = Host::new(c, Arc::new(NoBlyg), move |e| {
+        let _ = tx.send(e);
+    });
+    host.start();
+    Env {
+        _dir: dir,
+        host,
+        events,
+    }
+}
+
+impl Env {
+    fn started(&self) {
+        let deadline = Instant::now() + WAIT;
+        loop {
+            let left = deadline.saturating_duration_since(Instant::now());
+            match self.events.recv_timeout(left) {
+                Ok(ExtEvent::Started { .. }) => return,
+                Ok(_) => continue,
+                Err(_) => panic!("not started within {WAIT:?}"),
+            }
+        }
+    }
+}
+
+/// An invented reading row.
+fn item(md: &str, version: u32) -> ReadingItem {
+    serde_json::from_value(json!({
+        "subscription_id": "sub-1", "remote_id": "r1", "subscription_title": "Rue",
+        "origin": "https://blyg.example.com", "kind": "thread", "state": "current",
+        "version": version, "created": "2026-10-01T09:00:00Z", "updated": null,
+        "observed_at": "2026-10-01T09:05:00Z",
+        "content_md": md, "content_html": format!("<p>{md}</p>"),
+        "author": {"name": "Rue", "url": null}, "page": null, "thumb": null, "hoppers": [],
+        "stub_of": {"origin": "https://other.example.com", "id": "p7", "version": 2},
+    }))
+    .unwrap()
+}
+
+#[test]
+fn slots_reach_an_extension_granted_reading_read() {
+    let env = setup(&["reading.read", "ui"], |_| {});
+    env.started();
+    assert_eq!(
+        env.host.entry_slots(),
+        [EntrySlots {
+            ext: NAME.into(),
+            byline: true,
+            actions: vec![
+                EntryActionSpec {
+                    id: "echo".into(),
+                    title: "echo".into(),
+                    detail: "what the host sent".into(),
+                    icon: Some("◇".into()),
+                },
+                EntryActionSpec {
+                    id: "fail".into(),
+                    title: "fail".into(),
+                    detail: String::new(),
+                    icon: None,
+                },
+            ],
+        }]
+    );
+
+    // The byline: the entry crossed as camelCase (version, ids, hash).
+    let r = item("The harbour bench floods.", 3);
+    let b = env
+        .host
+        .entry_byline(NAME, &ReadingEntry::of(&r))
+        .unwrap()
+        .unwrap();
+    assert_eq!(b.text, "v3 r1");
+    assert_eq!(
+        b.tip.as_deref(),
+        Some(blyg_core::content_hash("The harbour bench floods.").as_str())
+    );
+    // `null` is nothing to show; an error is the extension's.
+    let silent = ReadingEntry::of(&item("silent", 1));
+    assert_eq!(env.host.entry_byline(NAME, &silent).unwrap(), None);
+    match env
+        .host
+        .entry_byline(NAME, &ReadingEntry::of(&item("broken", 1)))
+    {
+        Err(ExtError::Rpc(e)) => assert_eq!(e.message, "broken entry"),
+        other => panic!("{other:?}"),
+    }
+
+    // A ⋯ row: the record went as Burrow stores it (snake_case, bodies in).
+    let sheet = env.host.entry_action(NAME, "echo", &r).unwrap();
+    assert_eq!(sheet.title, "echo");
+    assert_eq!(sheet.text, "sub-1 r1");
+    let keys: Vec<&str> = sheet.fields[0].value.split(',').collect();
+    assert!(keys.contains(&"subscription_id") && keys.contains(&"content_html"));
+    let record: Value = serde_json::from_str(sheet.code.as_deref().unwrap()).unwrap();
+    assert_eq!(record["content_md"], "The harbour bench floods.");
+    assert_eq!(record["stub_of"]["id"], "p7");
+    assert_eq!(record["version"], 3);
+    assert_eq!(sheet.copy_label(), "Copy JSON");
+    match env.host.entry_action(NAME, "fail", &r) {
+        Err(ExtError::Rpc(e)) => assert_eq!(e.message, "it didn't work"),
+        other => panic!("{other:?}"),
+    }
+    // A row the manifest doesn't declare is never sent.
+    match env.host.entry_action(NAME, "nope", &r) {
+        Err(ExtError::Rpc(e)) => assert_eq!(e.code, codes::METHOD_NOT_FOUND),
+        other => panic!("{other:?}"),
+    }
+    assert_eq!(
+        env.host
+            .entry_byline("not-running", &ReadingEntry::of(&r))
+            .unwrap_err(),
+        ExtError::NotRunning
+    );
+    env.host.shutdown();
+}
+
+#[test]
+fn without_reading_read_there_are_no_slots_and_no_calls() {
+    let env = setup(&["ui"], |_| {});
+    env.started();
+    assert!(env.host.entry_slots().is_empty(), "nothing to draw");
+    let r = item("The harbour bench floods.", 1);
+    for e in [
+        env.host
+            .entry_byline(NAME, &ReadingEntry::of(&r))
+            .unwrap_err(),
+        env.host.entry_action(NAME, "echo", &r).unwrap_err(),
+    ] {
+        match e {
+            ExtError::Rpc(e) => {
+                assert_eq!(e.code, codes::PERMISSION_DENIED);
+                assert_eq!(e.data.unwrap()["capability"], "reading.read");
+            }
+            other => panic!("{other:?}"),
+        }
+    }
+    env.host.shutdown();
+}
+
+#[test]
+fn a_slow_byline_times_out_and_the_next_one_answers() {
+    let env = setup(&["reading.read"], |c| {
+        c.timing.search = Duration::from_millis(400);
+        c.timing.timeouts_before_restart = 100;
+    });
+    env.started();
+    let slow = ReadingEntry::of(&item("slow", 1));
+    assert_eq!(
+        env.host.entry_byline(NAME, &slow).unwrap_err(),
+        ExtError::Timeout
+    );
+    // The extension answers one request at a time: the next waits out
+    // the nap, then answers.
+    let t = Instant::now();
+    let mut ok = None;
+    while t.elapsed() < WAIT {
+        match env
+            .host
+            .entry_byline(NAME, &ReadingEntry::of(&item("quick", 2)))
+        {
+            Ok(b) => {
+                ok = b;
+                break;
+            }
+            Err(ExtError::Timeout) => continue,
+            Err(e) => panic!("{e:?}"),
+        }
+    }
+    assert_eq!(ok.map(|b| b.text).as_deref(), Some("v2 r1"));
+    env.host.shutdown();
+}
diff --git a/docs/EXTENSIONS.md b/docs/EXTENSIONS.md
index 37dbdc2..317e3c3 100644
--- a/docs/EXTENSIONS.md
+++ b/docs/EXTENSIONS.md
@@ -3,7 +3,9 @@
 An extension is a separate program that Burrow starts and talks to over its
 stdin/stdout. It can add commands to the Extensions palette (⇧⌘P), offer a
 library of documents to the notes panel (the bundled `markdown-notes` is
-one), and, with the user's permission, read and edit the user's own posts.
+one), add a marker or a ⋯ row to each reading entry (the bundled
+`reading-time` and `inspect`), and, with the user's permission, read and
+edit the user's own posts.
 Code: `crates/blyg-ext` (protocol, manifest, grants, host) and
 `crates/blyg-ext-notes` (the bundled extension).
 
@@ -73,7 +75,7 @@ Unknown keys are ignored. On Windows a bare `command` name also tries the
 |---|---|---|
 | `items.read` | `burrow/listItems`, `getItem`, `searchItems` over your own posts, drafts and scratch notes | yes |
 | `items.write` | `burrow/createDraft` (draft or scratch), `burrow/saveItem` (working copy; never publishes) | yes |
-| `reading.read` | `burrow/listReading`: posts held locally from subscriptions | yes |
+| `reading.read` | `burrow/listReading`: posts held locally from subscriptions; and the reading slots (each entry's data, see Reading slots) | yes |
 | `blyg.identity` | the blyg's origin in `initialize` (never a token) | yes |
 | `ui` | `burrow/toast`, `burrow/openItem` | yes |
 | `hooks:itemPublished`, `hooks:itemSaved`, `hooks:itemCreated` | the matching notifications, with the post's text | yes |
@@ -190,6 +192,75 @@ Substack Notes (`tested = "2026-10-09"`), and a `macro.prepare` that fits
 the opening paragraph and the link into `max-chars` (280) characters,
 counted as grapheme clusters.
 
+## Reading slots
+
+Two contributions put an extension on each reading entry, in the stream
+and in the reader. They mirror the web Studio's extension slots
+(blygger-studio `src/ui/extension-api.ts`) and take their names:
+
+```toml
+capabilities = ["reading.read"]    # both slots need it
+
+entry-byline = true                # entryByline: a marker on each byline
+
+[[entry-actions]]                  # entryActions: rows in an entry's ⋯ sheet
+id = "inspect"
+title = "inspect"
+detail = "ids, versions, references, JSON"   # optional
+icon = "{ }"                                 # optional, a short glyph
+```
+
+The manifest is refused if it declares either without `reading.read`, and
+Burrow only asks extensions that were granted it (`Host::entry_slots`). The
+consent sheet's words for `reading.read` say so: "read the posts held from
+your subscriptions, and add to how each one shows while you read".
+
+- **`extension/entry.byline {entry}`** (2 s) → `{text, tip?}` or `null`.
+  Burrow asks the first time an entry is drawn, off the main thread, one
+  request after another, and caches the answer by (extension, entry,
+  version) until the extension restarts. Drawing never waits: until the
+  answer arrives, and when it is `null`, empty, an error or a timeout, the
+  byline shows nothing. The text is drawn after a "·", on one line, cut at
+  40 characters; `tip` shows on hover.
+- **`extension/entry.action {action, entry, record}`** (5 s) →
+  `{title, description?, text?, fields?: [{label, value}], code?,
+  language?}` (`EntrySheet`). An entry's actions gain a "⋯" chip when any
+  extension adds a row; it opens a sheet listing the rows (↑/↓, 1–9, ⏎).
+  Choosing one sends the request, and Burrow draws the answer natively, in
+  that order: nothing in it is markup. `code` is monospaced, with a Copy
+  button (⌘C; "Copy JSON" when `language` is `json`). An error is shown in
+  the sheet.
+
+`entry` (`ReadingEntry`) is the entry as Burrow holds it:
+`{subscriptionId, remoteId, origin, kind, state, version, title,
+contentHtml, contentMd, contentHash?}`. `contentHtml` is the published HTML
+(`""` for an entry held only as Markdown), and `contentHash` is
+`content_hash(contentMd)`. `record` is Burrow's stored reading row as JSON
+(snake_case, bodies included: `blyg_ext::reading::record_of`). Both methods
+are optional parts of protocol 1: an extension that doesn't declare the
+slots is never asked, and method-not-found on a byline is "nothing".
+Types: `crates/blyg-ext/src/reading.rs`.
+
+Two bundled extensions use them, both off until the config names them
+(`extension = reading-time`, `extension = inspect`) and the user allows
+`reading.read`. They are ports of blygger-studio 0.39.0's extensions of the
+same names, so the two clients agree:
+
+- **reading-time** (`crates/blyg-ext-reading-time`): "· 4 min" on each
+  byline, "920 words" on hover. Words are runs of letters and digits
+  (`[\p{L}\p{N}][\p{L}\p{N}'’-]*`) in the HTML's text (scripts, styles,
+  tags and entities become spaces); Han, kana and Hangul count one by one.
+  Minutes are words ÷ 230 + those characters ÷ 500, shown as "< 1 min"
+  under one and rounded half up otherwise; nothing to read shows nothing.
+  An entry held only as Markdown is counted from the HTML `blyg-render`
+  makes of it.
+- **inspect** (`crates/blyg-ext-inspect`): an "inspect" row. Its sheet
+  summarises id, kind, version, state, content hash, stub of, forked from
+  and the number of transclusions, then shows the record's JSON
+  (two-space indent) with `content_md` and `content_html` elided to
+  "‹N characters, not shown›" (N in UTF-16 units, as the Studio counts) and
+  `*_json` strings parsed. Nothing is fetched.
+
 ## Wire format
 
 JSON-RPC 2.0, one JSON object per line (LF or CRLF), both directions on the
@@ -216,7 +287,8 @@ per capability per session; only capabilities the manifest declares),
 (`browser.automate:` for the URL's origin) → `{url}`.
 
 Host → extension, also: `extension/macro.prepare` (10 s, optional; see
-Browser above).
+Browser above), `extension/entry.byline` (2 s) and `extension/entry.action`
+(5 s) (optional; see Reading slots above).
 
 Errors: `-32000` timeout, `-32001` permission denied
 (`data.capability`), `-32002` stale (`data.currentHash`: the item or
@@ -239,8 +311,12 @@ restart it. Its stderr goes to `<data dir>/extensions/<name>/stderr.log`
 ## markdown-notes
 
 Bundled, opt-in (`extension = markdown-notes`), and independent of any
-blyg: it reads and writes a folder of Markdown notes and needs only
-`fs:<vault>` and `ui`. It never adds frontmatter, never links notes to
-posts, and never deletes. An edit is refused if the file changed on disk
-since it was read; a new note never replaces an existing file. Settings:
-`vault` (default `~/Notes`), `folder` (where new notes go), `poll-ms`.
+blyg: it reads and writes folders of Markdown notes ("vaults") and needs
+only `fs:<folder>` for each one and `ui`. It never adds frontmatter, never
+links notes to posts, and never deletes. An edit is refused if the file
+changed on disk since it was read; a new note never replaces an existing
+file. Settings: `vault` (the first folder), `vault-<label>` (one more
+folder each, e.g. `vault-work=~/Work/Vault`), `folder` (where new notes go
+inside each), `poll-ms`. Each vault is its own library (`notes`,
+`notes.<label>`). There's no default folder: with no vault it asks only
+for `ui` and has no library.
diff --git a/docs/SERVER.md b/docs/SERVER.md
index 605d780..0f2ca8f 100644
--- a/docs/SERVER.md
+++ b/docs/SERVER.md
@@ -11,8 +11,8 @@ checked against `openapi.json` in its tests (`crates/blyg-core/tests/fixtures/`)
 studio's consent page, and keeps the grant (a one-hour access token, renewed with a
 rotating refresh token until the grant ends, at most 30 days after your studio
 sign-in) in your Keychain. Signing out revokes it. Or make an **API token** in Studio →
-More → Client access (REST API, all four permissions: read, draft, publish, manage;
-it lasts 30 days) and paste it. A token missing a permission gets a 403 that names
+More → Client access (REST API, every permission: read, draft, publish, manage, and
+on studio 0.39+ `reading:state`; it lasts 30 days) and paste it. A token missing a permission gets a 403 that names
 it. On an older studio, or as a fallback, sign in with the **studio password**: Burrow
 signs in at `{blyg-url}/studio/login` like the browser does, keeps the session cookie
 in memory only (the password is in your Keychain), and signs in again when the
@@ -91,7 +91,16 @@ is deleted. Upstream's change triggers also advance the `reading` revision of
 The app reads the read version only when `read_state` is `true`. It checks the flags on
 every pull and remembers the last answer.
 
-**Writes** (owner auth, like every `/api` call):
+**Writes** (owner auth, like every `/api` call). **Scope:** since blygger-studio 0.39
+(migration `0026_read_state.sql`) these four writes (`markRead`, `markUnread`,
+`markReadBatch`, `markUnreadBatch`) need the bearer scope **`reading:state`**, and
+`owner:manage` alone is refused with `403 insufficient_scope`. The name is
+**provisional** (upstream may rename it); the app spells it in one place,
+`READ_STATE_SCOPE` in `crates/blyg-core/src/api/oauth.rs`. The browser sign-in asks for
+it when the studio lists it in `scopes_supported` (an older studio would refuse the whole
+request for a scope it doesn't know). A client registered before (Burrow 0.10) is reused;
+the studio grants it the new scope. The wire shapes are unchanged: `version` must be ≥ 1 there, and `read_at` is still
+accepted (for offline queues), though the studio's own client no longer sends it.
 
 | Call | Body | Success | Errors |
 |---|---|---|---|
@@ -136,8 +145,13 @@ endpoints as "this server doesn't keep read state".
   server later gains `read_state_clear`, those local unreads are sent then.
 - The first time a database sees the capability, the app batch-uploads every read version
   it holds (500 per call) and records that in its `meta` table.
-- A `403` on a write (a Worker that keeps these writes to the owner's own token) keeps read
-  state on this Mac for the rest of the session, says so once, and doesn't retry.
+- A `403` on a write (a sign-in or token without `reading:state`, such as one made before
+  studio 0.39, or a Worker that keeps these writes to the owner's own token) holds read
+  state for the rest of the session: the ops stay queued (nothing is dropped), new marks
+  keep queueing, and the rest of the outbox syncs as usual. The app says so once, with the
+  server's reason: sign in with the browser again (or make a new token with
+  `reading:state`). It doesn't retry until the next sign-in or launch, which sends what
+  waited.
 - **Without the capability**, read state stays on this Mac. The app makes no requests to
   these endpoints and shows no errors. A `404` from them turns sync off and drops anything
   queued.
diff --git a/docs/SPEC.md b/docs/SPEC.md
index af0eab4..7000136 100644
--- a/docs/SPEC.md
+++ b/docs/SPEC.md
@@ -199,7 +199,8 @@ uses are in `docs/SERVER.md`. The key points:
 `read_state: true` and a per-item `read_version: number|null`;
 `PUT /api/reading/:sub/:remoteId/read {version}` and
 `POST /api/reading/read {items: [{sub, remote_id, version}]}` (≤ 500) store
-`max(existing, version)`.
+`max(existing, version)`. On blygger-studio 0.39+ the read-state writes need the scope
+`reading:state` (a provisional name; `oauth::READ_STATE_SCOPE`), not `owner:manage`.
 
 Transclusion syntax is `![[<26-char id>]]` alone on its own line, and is only
 valid in threads. See upstream `worker/src/transclusion.ts` for which ids resolve
@@ -220,15 +221,17 @@ valid in threads. See upstream `worker/src/transclusion.ts` for which ids resolv
 
 **Reader is three panes, NetNewsWire style** (`reading/sources.rs`, `sources_vm.rs`): sources | posts | the post. The sources pane lists smart feeds (All unread: never read or edited since you read it; Today: the post's own date, local time; Thumbed: 👍; All, the default), then the user's **folders** with their subscriptions, then the subscriptions in no folder. Each subscription shows its name (or host) with its cached profile avatar, else a letter badge, and a dot when something is unread; smart feeds and folders show a muted unread count (reader-local, private: allowed by rule 1). Picking a source filters the list (the search is scoped to it); a post read in a source stays listed until the source changes. **Folders are local only**: the store's `folders` / `folder_members` tables (schema v7), one folder per subscription, never sent to the blyg and not the server's hoppers (`Backend::folders`, `subscription_folders`, `create_folder`, `rename_folder`, `delete_folder`, which unfiles, `move_folder`, `set_subscription_folder`). File a subscription by dragging it onto a folder (onto the "Subscriptions" heading unfiles it), from its context menu (Move to folder ›), or on the Subscriptions screen; folders are made with Blyg › New Folder… or the pane's context menu, renamed, deleted, and reordered by dragging or Move Up / Move Down. Keys: ←/→ move between the panes, ↑/↓ within one (the sources pane picks as it moves; in the post pane they scroll), j/k next/previous post from anywhere, ⏎ goes right, Space pages through the post and then opens the next unread one, esc returns to the list, [ / ] step through versions (←/→ still do in the stream's pane). ⌥⌘S (Blyg › Sources Pane, or the header's button) hides the pane; its edge drags to resize (`state.json`: `reader_sources_hidden`, `reader_sources_width`). **Picking and marking** (`reading/marks.rs`, model `pick_vm.rs`): ⌘-click adds or drops a post, ⇧-click adds the run from the anchor, ⌘A picks everything the list shows, esc lets go; **r** marks the picks (else the open post) read and **u** unread, as does the row menu (right-click: Mark Read / Mark N Unread). Marks are local and instant (`Backend::set_read`); how they reach the server is docs/SERVER.md § Extension 5. **Subscriptions** (studio 0.30): a subscription's menu in the pane has **Rename…** (a name of your own, kept when the blyg renames itself), **Use the Blyg's Own Name** once renamed (`title: null`; `Subscription::title_follows_source`), and **Check Now** (a blyg's index reconciled at once, `POST /subscriptions/{id}/resync`; a feed is polled with the rest); the pane's menu and **⇧⌘R** (Blyg › Check All Feeds Now) poll every feed (`POST /subscriptions/poll`). A pull follows each, and another a few seconds later.
 
+**OPML import and export** (`blyg_core::opml`, `reading/opml.rs`; blygger/blygger-studio#63). Blyg › Import Subscriptions from OPML… (and Import OPML… on the Subscriptions screen; no key) opens a file picker, then a sheet in the Publish/Delete chrome listing the file's feeds: one OPML parser (`opml::outlines`, also behind `profile::parse_opml`) reads OPML 1.0/2.0 leniently (nested outlines flattened, the folder kept for display only, `xmlUrl` required, `title` else `text`, HTML entities and double escaping undone, BOM / UTF-16 / Windows-1252-labelled-UTF-8 decoded), at most 5 MB and 2,000 feeds, never fetching. Duplicates collapse by normalised feed URL; a feed already followed (same normalised feed URL, or under a blyg subscription's origin) shows "already following" and starts unticked. Keys: 1–9 / Space tick, ↑/↓, ⌘A all or none, ⏎ Import N, esc cancel. The run (`opml::run_import`, off the main thread) sends `POST /api/subscriptions {url, confirm:true}` per feed with no title (the source names itself) and no separate resolve, two at a time with starts ≥ 2 s apart (≤ 30 a minute, far under the owner write budget, because each subscribe backfills the archive server-side); a 429 holds every worker for its `Retry-After` and retries that feed (5 times at most). 201 is added, 409 already following, 422 not a feed (the server's reason shown), Offline unreachable, anything else refused with its reason; nothing fails the whole run. Esc stops after the requests in flight. Each added subscription is filed (by the id in the 201) in the local Reader folder **Imported feeds**, made on first use and reused by name; 409s are never moved, and the OPML's folders never become folders. `createSubscription` has no `in_blogroll` member and new rows default to `in_blogroll = 0`, so imports stay out of the public blogroll without a PATCH. The summary gives the counts and each failure with Retry failed (r). Blyg › Export Subscriptions as OPML… saves OPML 2.0 of every subscription (save dialog, `burrow-subscriptions.opml`), in the studio's `blogroll.opml` shape: `text`/`title` the name, `type="rss"`, `xmlUrl` the feed, `htmlUrl` the origin. Both need a connected blyg. CLI: `blygger +import-opml <file> [--dry-run]` (skips feeds already followed, files into the same folder; opens the local database without the sync worker) and `blygger +export-opml <file>`.
+
 **Quote boxes and lineage lines open the original** (`reading/original.rs`, issue #3). In the reader's WebView each resolved quote box gets a footer, "quoted from &lt;name&gt; · v2 · open original" (added by the app's reader layer after sanitizing, `studio::reader::quote_footers`; blyg-render's output is unchanged): the name opens the origin's profile, a click anywhere else in the box opens the original post. The stream's quote boxes and the "↳ stub of …" / "⑂ forked from …" lines (stream and reader header) work the same way: the name goes to the profile, the rest to the post. A post held in the reading store opens at once, at the quoted version when that version is current or pinned (unpinned versions are never shown); one that isn't held is fetched from its author's public item document (`Backend::public_item`, `public_pinned`: the token-less `PublicClient`, only on that click) and shown with Subscribe / Reply · new stub / Open on web, never marked read.
 
-**Responses: who quoted, stubbed or forked a post** (`reading/responses.rs`, issue #7). A list, never a count: who · "quoted this" / "stubbed this" / "forked this" · when, each opening that post. Two sources: for your own posts, the verified, unhidden mentions (`GET /api/mentions`), listed under the post in ⌘Y and in the reading pane when your own post is open there; for anyone's post, "seen in your network": reading rows, and your own published posts, whose `transclusions`, `stub_of` or `forked_from` point at it (`Backend::responses`, an index lookup on the derived `reading_refs` table, schema v6, rewritten on every upsert; a quote without an origin is from the quoting post's own blyg). One response per post: a stub thread both stubs and quotes its target, which is one act, so the strongest relation wins (fork > stub > quote), and a quote with a `selector` marks it partial ("stubbed a passage of this"; `reading_refs.partial`, schema v9). This is the one-hop lineage blygger-studio's lineage view computes server-side (studio PR #35, `GET /api/lineage`), with the same rules, from what this Mac holds. The list sits at the bottom of the reading pane; the stream marks a post that has any with a small "↩", no number.
+**Responses: who quoted, stubbed or forked a post** (`reading/responses.rs`, issue #7). A list, never a count: who · "quoted this" / "stubbed this" / "forked this" · when, each opening that post. Two sources: for your own posts, the verified, unhidden mentions (`GET /api/mentions`), listed under the post in ⌘Y and in the reading pane when your own post is open there; for anyone's post, "seen in your network": reading rows, and your own published posts, whose `transclusions`, `stub_of` or `forked_from` point at it (`Backend::responses`, an index lookup on the derived `reading_refs` table, schema v6, rewritten on every upsert; a quote without an origin is from the quoting post's own blyg). One response per post: a stub thread both stubs and quotes its target, which is one act, so the strongest relation wins (fork > stub > quote), and a quote with a `selector` marks it partial ("stubbed a passage of this"; `reading_refs.partial`, schema v9). This is the one-hop lineage blygger-studio's lineage view computes server-side (studio PR #35, `GET /api/lineage`), with the same rules, from what this Mac holds. The list sits at the bottom of the reading pane, and stays a list without a count; in the stream the lineage glyph (below) marks a post that has any.
 
-**Lineage** (`reading/lineage.rs`, model `lineage_vm.rs`; mock `docs/prototype/lineage.html`). A **glyph** beside each stream post's name replaces the old "↩": lines in from the left are the kinds of post it draws on, lines out to the right the kinds that draw on it, in fixed slots (fork, reply, quote; amber, accent, green), dotted when every one of that kind is of a passage. Presence only, never how many (rule 1); the tooltip says the kinds in words. **⌘J** (or a click on the glyph) opens the lineage sheet: the post in a hexagon, what it draws on above, what draws on it below ("what this Mac holds": reading rows, your published posts, verified mentions of your posts), at most five a row around the selection. Arrows move; ⏎ on a neighbour makes it the centre and ⌫ walks back; `o` opens the selected post in the reader; esc closes. **Space** (or ⏎) on the centre opens the **ring**: the reader's actions in blygger-studio's compass positions (right Fork, lower right Reply, lower left Quote, left Link post, upper left Versions, upper right Open). A letter (f r q l v o) previews the action: a dashed node where its result would go, and the same four facts for every action (a response? the author told? their words in yours? shown under their post?). ⏎ or the same letter again does it; esc backs out a layer at a time. The ring uses existing actions only, so it needs nothing from the server; the web Studio's glyph shows counts, Burrow's doesn't, on purpose.
+**Lineage** (`reading/lineage.rs`, model `lineage_vm.rs`; mock `docs/prototype/lineage.html`). A **glyph** beside each stream post's name replaces the old "↩": lines in from the left are the kinds of post it draws on, lines out to the right the kinds that draw on it, in fixed slots (fork, reply, quote; amber, accent, green), dotted when every one of that kind is of a passage, then **"up · down"**: how many it draws on and how many known here draw on it (rule 1's lineage exception, 2026-10-09). The counts are blygger-studio's `lineage-glyph` extension's (studio PR #53, ported from commit dc632c5 in `blyg-core/src/lineage.rs`): one reference per (post, target), fork > stub > quote, a `{url}` stub counts as an ancestor, a bare quote means the quoting post's own blyg; descendants are held posts that reference it, one per post, plus, for your own posts, verified mentions (hidden ones too) from posts not already counted. Plain totals, uncapped, as the studio prints them; the tooltip gives the counts by kind in words. **Where the numbers come from:** on a node that serves the extension (`GET /api/ext/lineage-glyph/summaries` and `/lineage`, `owner:read`), from it: summaries for the reading rows (50 keys a request, by reading entry key `imported:["sub","id"]`) and the graph for ⌘J, cached in the store's `lineage_cache` (fresh for 30 s, the studio's `FRESH_MS`; asked again when the reading list changes or opens). Whether it's served is found out by asking: a 404 means "not enabled there", silently, remembered for six hours (meta `lineage_glyph`), and its cached answers are dropped. Otherwise, and offline before any answer, Burrow counts from what this Mac holds with the same rules (`lineage::Local`). **⌘J** (or a click on the glyph) opens the lineage sheet: the post in a hexagon, what it draws on above, what draws on it below ("what your blyg knows" when the node served the graph, else "what this Mac holds": reading rows, your published posts, verified mentions of your posts), at most five a row around the selection, with the count each way beside the hexagon and on the side list's headings. A `{url}` stub is a neighbour that's a page, not a post: `o` opens it in the browser and it can't be the centre. Arrows move; ⏎ on a neighbour makes it the centre and ⌫ walks back; `o` opens the selected post in the reader; esc closes. **Space** (or ⏎) on the centre opens the **ring**: the reader's actions in blygger-studio's compass positions (right Fork, lower right Reply, lower left Quote, left Link post, upper left Versions, upper right Open). A letter (f r q l v o) previews the action: a dashed node where its result would go, and the same four facts for every action (a response? the author told? their words in yours? shown under their post?). Each of Fork, Reply and Quote shows how many of that kind are already known ("R · 2"), and the panel says so in words. ⏎ or the same letter again does it; esc backs out a layer at a time. The ring uses existing actions only. Opening a post from the sheet (`o`, Versions) goes through the reader's own open, so a held post is marked read as a click in the list marks it (`Backend::mark_read`; subject to change in review). Until 2026-10-09 Burrow's glyph showed kinds only while the web Studio's showed counts; both now show the same numbers.
 
 **Posts are dated by their author, not by the import.** The list sorts newest first by the post's own `updated` (else `created`), so an author's edit moves the post up; a row says "edited 3d ago" when `updated` is more than ten minutes after `created`, else shows when it was published. `observed_at` (when your blyg imported it) is only the fallback for a post with no usable date. Dates parse as RFC 3339 or RFC 2822 (`ReadingItem::post_time`); the store keeps the normalized sort key in `reading.sort_at` (indexed).
 
-**Read state syncs through your blyg when the server supports it.** Read state is a number per reading row: the highest version you've read. Marking a post read is always instant and local, and it marks every duplicate of the same post. When the blyg advertises read-state sync (extension 5, `docs/SERVER.md`), the same mark also queues a `read` op per row in the outbox, which is sent like any other change (offline-safe, retried, coalesced to the highest version per row). A pull merges `max(local, server)`, so read state never goes backwards. The first time a database sees the capability, it uploads everything it has read in batches, once, and records that in `meta`. So a post read on one Mac reads as read on your others, and a fresh install isn't all unread. Without the extension, read state stays on this Mac, and nothing is sent. Nothing new is shown in the UI.
+**Read state syncs through your blyg when the server supports it.** Read state is a number per reading row: the highest version you've read. Marking a post read is always instant and local, and it marks every duplicate of the same post. When the blyg advertises read-state sync (extension 5, `docs/SERVER.md`), the same mark also queues a `read` op per row in the outbox, which is sent like any other change (offline-safe, retried, coalesced to the highest version per row). A pull merges `max(local, server)`, so read state never goes backwards. The first time a database sees the capability, it uploads everything it has read in batches, once, and records that in `meta`. So a post read on one Mac reads as read on your others, and a fresh install isn't all unread. Without the extension, read state stays on this Mac, and nothing is sent. Nothing new is shown in the UI. The writes need the bearer scope `reading:state` (studio 0.39+; the name is provisional, kept in `oauth::READ_STATE_SCOPE`), which the browser sign-in asks for. A sign-in or token without it (one made before 0.39) gets a 403: the read ops stay queued, the rest of the outbox syncs, and Burrow says once that read state is waiting and to sign in again; the next sign-in sends what waited.
 
 **Search, Notational Velocity style.** A search field sits above the reading list (the Posts omnibar isn't on this screen). ⌘F or `/` (with the list focused) puts the caret in it; typing filters the list live: a case-insensitive substring over the title, the author and blyg (subscription, origin) names, and the post's text (`content_md`, or the published HTML's text when an item has no Markdown), over posts **already held locally**. Nothing is fetched to search. Title matches are highlighted as in the Posts list. ↑/↓ move through the matches from the field, ⏎ goes to the list (opening the first match when nothing is open), and esc clears the search (esc on an empty field returns to the list; esc in the list with a search clears it before it leaves the screen). An empty result shows "No posts match “…”". The open post stays open while it still matches; otherwise the selection and the reader clear, so typing never opens (or marks read) anything.
 
@@ -259,11 +262,14 @@ Disclosure: **always on**. Edited reading items move **to the top**. Helpers in
 
 The first launch is an onboarding flow: connect a blyg (URL plus token, or owner password), then optionally connect AI accounts. After that comes an **interactive tutorial** that walks through the features (the ▶ demos in the mocks are the script), with a "Show this tutorial every time I open Burrow" checkbox. It can be re-enabled or replayed from Settings › Help. **After an update**, the first launch of a newer version opens the tutorial on a "What's new in Burrow x.y" card (`onboarding/whats_new.rs`, compared with `seen_version` in state.json): ⏎ starts at the first new step, "Take the whole tour" starts at the beginning, esc or "Skip tutorial" closes it. A first run never sees it.
 
+**Every release updates the tour and the docs (the maintainer's rule).** A new feature gets a step in `onboarding/steps.rs` that lands on it (its `since` is the release), steps whose UI changed are edited, and the release's what's-new entry starts at the first of its own steps; `whats_new.rs`'s tests fail otherwise, and fail for an x.y.0 version with no entry. A step that teaches the running version's news says "NEW IN x.y.z" on its card. The tour runs on the FakeBackend and also on **sample extensions** (`extensions/tour.rs`): the user's extension host is parked and a tour host runs the bundled markdown-notes (two sample folders allowed, one not), reading-time and inspect over invented notes in `<data dir>/tour-sample/`, deleted when the tour ends (and cleared when the next one starts); nothing in the tour writes the config file (Allow, Turn on/off, Forget permissions and the notes folders' Add and Remove say what they would do instead). The cross-post step shows a sample run in the pane (■ Stop, then "macro running · show pane" once folded) with nothing running, and ✂ Clip on the sample page clips its sample text. The `opml` step rings the Subscriptions screen's header; its **Import OPML…** chip opens the preview of a sample export (one feed already followed, two new) instead of a file picker, and importing it subscribes in the sample data.
+
 ## Protocol philosophy → UI rules (from the creator's talk, blygger.org/talks/2026-09-24-blygger/)
 
 Core principle: *"anything the protocol can't verify, it declines to represent."* The app is a **studio**. It follows these rules:
 
-1. **No counts, anywhere social.** Responses and mentions are shown as *a list, never a count*: who, origin, relation, when. Mentions and responses never get numeric badges; use a dot for "something new". There are no follower lists or follower counts: following is client-local and invisible. (A reader-local unread count for *your own* reading list is fine; it's private state, not a social metric.)
+1. **No counts, anywhere social.** Responses and mentions are shown as *a list, never a count*: who, origin, relation, when. Mentions and responses never get numeric badges; use a dot for "something new". There are no follower lists or follower counts: following is client-local and invisible. (A reader-local unread count for *your own* reading list is fine; it's private state, not a social metric. So are a post's word count and reading time, which describe the text, not its audience: the opt-in `reading-time` extension.)
+   **One exception, the lineage glyph (2026-10-09, the user's decision).** The lineage glyph beside a post, the ⌘J lineage view and its action ring show *how many* posts a post draws on and how many known here draw on it, by kind (stub, quote, fork), next to the kinds, because the web Studio's `lineage-glyph` extension shows the same numbers and the data is there. The numbers are blygger-studio's, counted by its rules (from the node when it serves the extension, else from this Mac). The exception covers those three surfaces only: responses lists, mentions, profiles and everything else social stay lists without counts.
 2. **Generation happens in the studio, at authoring time, with review.** Publishing never generates. The TK tint shows in the editor only; published bytes are identical, apart from the `generated` metadata and the `blyg-tk-gen` class. Provenance is self-asserted, so the app always records it (the provenance extension).
 3. **Transclusion is quoting, and it's snapshotted at publish.** Later edits to the source never rewrite the quote. The picker offers only what's already held (your own posts plus imported items from blyg subscriptions). It never fetches by URL. The picker opens with ⌘K, or by typing `![[` at the start of a line in a thread (after optional indent, outside a fenced code block): the typed `![[` comes out, what you type next filters the picker, ⏎ inserts the whole `![[id]]` line, and esc puts the `![[` back so it can be typed literally. Only typing triggers it, never a paste. In a fragment it shows the "Quotes go in threads" toast and leaves the text alone.
 4. **Forking descends from pins only.** Pins are the costly, irrevocable signal: confirm with plain words ("This version will be served forever. You can't undo this.").
@@ -406,9 +412,10 @@ Extensions add commands and libraries to Burrow without touching its core. Nothi
 - **Consent:** the first start of an enabled extension, or a manifest that asks for capabilities not granted yet, shows a sheet ("markdown-notes wants to: read and write files in ~/Notes · show messages"). Each capability can be unticked. Allow writes the `extension-allow` lines (comment-preserving write-back) and starts it. Not now leaves it stopped, with a status-bar notice that reopens the sheet. An extension may ask again with `burrow/requestCapability`, once per capability per session.
 - **Install and discovery:** an extension is a folder with an `extension.toml` manifest (name, version, protocol, command, capabilities, commands, libraries, settings) in `~/.config/blygger/extensions/<name>/` (`BLYGGER_EXTENSIONS_DIR` overrides it). Install means copying a folder. There's no registry, download or auto-update. Third-party extensions are allowed in v1. A folder can't shadow a bundled extension's name. `blygger +list-extensions` shows what's installed, enabled, granted and running.
 - **Contributions:** commands go in an ⇧⌘P Extensions palette, filtered by where they apply (always, editor, reading, notes). A **library** contribution (`extension/library.list`, `library.search`, `library.read`, `library.write`, the last refusing a stale `baseHash` with `-32002`) gives the host a browsable, searchable, writable collection of Markdown documents. The quote picker can show a library as a read-only chip. Hooks deliver publish, save and create events to extensions granted them. Automatic export happens only for published posts, through `hooks:itemPublished`. Drafts are never sent on their own, only through an explicit command.
-- **Browser:** the browser pane is an extension surface behind two enforced capabilities. `browser.capture` gives `burrow/browser.page` while one of the extension's commands runs: the page's address, canonical URL, title, selection, readable text as Markdown and author (`-32004` with no page), never cookies, storage, headers or script. `browser.automate:<origin>` names one website exactly (http(s), host, optional port, no path or wildcards; normalised: lower-case host, `xn--` for international names, default port dropped) and lets the extension's `[[macros]]` run there and `burrow/browser.open` load URLs on it; the consent sheet says "fill in and, when you confirm, click Post on social.example.com, signed in as you". A macro is a declarative recipe in the manifest, run by Burrow, never stepped by the extension: a `[[sites]]` entry (origin, sign-in `home`, optional `signed-out` selector, `content-blocking`, `min-interval`) and steps `open`, `waitFor`, `assert`, `focus`, `click`, `insert`, `submit`, `done`, over `querySelectorAll` selectors with an optional exact text. Its text comes from a template (`{{title}}`, `{{excerpt}}`, `{{permalink}}`) and, optionally, `extension/macro.prepare`. The rules are checked when the manifest loads (`crates/blyg-ext/src/recipe.rs`): every `open` on a declared site, the first step an `open`, exactly one `insert` with a `submit` after it and none before, no `click` after `insert`, `done` last, timeouts at most 30 s. Every run shows the text first (editable), fills the composer in the pane the user watches, shows what the composer holds, and submits only when the user clicks Post; nothing is scheduled, repeated or run in the background. The pane and macros share the pane's own website data store, where the user signs in by hand; Burrow never reads cookies and never fills a sign-in form.
-- **Bundled: markdown-notes.** A standalone notes reader and writer over a folder of Markdown files (an Obsidian vault, say), deliberately kept apart from blygs, so it works as its own app and with no blyg connected. It browses the folder tree, searches titles and bodies (an in-memory index, refreshed by polling), reads a note, creates notes and saves edits. A save is refused if the file changed on disk since it was read, so nothing is overwritten, and it never deletes. Burrow shows notes in its own notes panel. **Copy into post** inserts the selection or the whole note into the current draft at the cursor, either as a quote or verbatim (the user picks). This is a host action, not `items.write`. The **Save selection to notes** command writes a new plain note. It adds no ids or frontmatter to notes (existing frontmatter is kept untouched), and nothing is exported when you publish. It needs only `fs:<vault>` and `ui`, and it runs as `blygger +ext markdown-notes`, through the same host path as a third-party extension. Opt-in through the config and consent like any other.
-- **In the window** (`crates/blyg-app/src/extensions/`): the host starts about a second after the window opens, answers extensions from the window's backend (a switch, so connecting or disconnecting a blyg needs no rewiring, and nothing needs a blyg), follows Reload Config, and stops its children on quit. Its toasts name the extension; a failure or a pending permission is a status-bar notice (a click opens Manage extensions or the consent sheet). The **consent sheet** (the Publish/Delete sheets' chrome) lists each capability in `blyg_ext::describe`'s words with a tick (1–9 toggle), then `CONSENT_CAVEAT`; ⏎ Allow writes the ticked `extension-allow` lines (unticked ones aren't asked again this session), esc Not now leaves the notice. ⇧⌘P **Extensions…** (Post menu) lists the running extensions' commands for the screen, "Browse <library>", and **Manage extensions…** (what's installed, its state, what's allowed and not, Turn on, Allow…, manifest problems). A command runs off the main thread with the selection (notes drawer, browser pane, reading pane or editor), the open item and the screen. A **library** is a tab in the notes drawer ("Reading notes | Notes"): breadcrumbs, a search box (each keystroke searches again, only the newest answer shows; after 2 s "Notes didn't answer"), folders and notes; a note opens in an editor showing its body (frontmatter kept aside and written back unchanged), Save names the hash it was read at, and a refused save says "Changed on disk" and offers Reload or Keep mine as a new note. **Quote into post** / **Copy verbatim** put the selection, or the whole note, into the open draft at its caret (a new draft when none is open). The quote picker (⌘K) has a "notes" chip that searches the library and quotes the note as a `>` blockquote naming it, never `![[…]]`. Settings › Notes folder ("Markdown notes folder…") writes `extension = markdown-notes` and its `vault` setting, then asks for the folder. Publishing calls `Host::item_published`.
+- **Browser:** the browser pane is an extension surface behind two enforced capabilities. `browser.capture` gives `burrow/browser.page` while one of the extension's commands runs: the page's address, canonical URL, title, selection, readable text as Markdown and author (`-32004` with no page), never cookies, storage, headers or script. `browser.automate:<origin>` names one website exactly (http(s), host, optional port, no path or wildcards; normalised: lower-case host, `xn--` for international names, default port dropped) and lets the extension's `[[macros]]` run there and `burrow/browser.open` load URLs on it; the consent sheet says "fill in and, when you confirm, click Post on social.example.com, signed in as you". A macro is a declarative recipe in the manifest, run by Burrow, never stepped by the extension: a `[[sites]]` entry (origin, sign-in `home`, optional `signed-out` selector, `content-blocking`, `min-interval`) and steps `open`, `waitFor`, `assert`, `focus`, `click`, `insert`, `submit`, `done`, over `querySelectorAll` selectors with an optional exact text. Its text comes from a template (`{{title}}`, `{{excerpt}}`, `{{permalink}}`) and, optionally, `extension/macro.prepare`. The rules are checked when the manifest loads (`crates/blyg-ext/src/recipe.rs`): every `open` on a declared site, the first step an `open`, exactly one `insert` with a `submit` after it and none before, no `click` after `insert`, `done` last, timeouts at most 30 s. Every run shows the text first (editable), fills the composer in the pane the user watches, shows what the composer holds, and submits only when the user clicks Post; nothing is scheduled, repeated or run in the background. A run uses the ordinary side pane (from the right, two thirds of the window; an open pane is reused as it is, full width after a ⌘-click), and the Preview and Post sheets sit beside it over the app's content so the page stays in view (over the window, the web view hidden, when the pane is full width or less than 360 pt is left beside it). The user can fold the pane while a run goes on (esc, ×, ⇧⌘B): the run keeps going, the web view stays alive (parked off the window's edge, never torn down while a macro runs), and the status bar shows "macro running · show pane" (a click or ⇧⌘B unfolds it). Before any step that types in the page (`focus`, `insert`) and for the Post sheet, the pane unfolds itself: a macro only fills in the pane the user watches. When the run ends the pane goes back to how it was before (folded again if it was folded), except when the user folded or unfolded it during the run, or the page still matters: "I'll click Post myself", a failure (signed out, a step missed), or a stop after Post was clicked. Code: `browser_run_open`, `macro_unfold`, `macro_restore_pane`, `macro_sheet_right`. The pane and macros share the pane's own website data store, where the user signs in by hand; Burrow never reads cookies and never fills a sign-in form.
+- **Reading slots** (`blyg_ext::reading`, `extensions/reading_slots.rs`): blygger-studio's extension slots `entryByline` and `entryActions`, over BXP. Behind `reading.read`, an extension can put a short marker at the end of each reading entry's byline (`entry-byline`, `extension/entry.byline`, asked off the main thread when an entry is first drawn and cached by entry and version, so nothing waits and no answer shows nothing) and rows in the entry's ⋯ sheet (`[[entry-actions]]`, `extension/entry.action`): a "⋯" chip in the stream's and the reader's actions lists them, and the answer is drawn natively (text, label/value fields, a monospaced code block with Copy). **Bundled, both off by default:** `reading-time` ("· 4 min" on the byline, the word count on hover) and `inspect` (the record Burrow holds for the entry: ids, versions, references, hashes, and its JSON with bodies elided), ports of the studio 0.39.0 extensions with the same rules, run as `blygger +ext reading-time` / `+ext inspect`. docs/EXTENSIONS.md § Reading slots.
+- **Bundled: markdown-notes.** A standalone notes reader and writer over folders of Markdown files (Obsidian vaults, say), deliberately kept apart from blygs, so it works as its own app and with no blyg connected. **Several vaults:** `extension-setting = markdown-notes vault=~/Notes` is the first, and each `vault-<label>=<folder>` (e.g. `vault-work=~/Work/Vault`) adds one; a key per vault survives the config's "later line for the same key wins", and labels follow the config's kebab-case key grammar, so existing `vault=` configs read as before. Each vault is its own library (`notes`, `notes.<label>`), titled by its folder's name (or the label when it's more than that name), and the manifest asks for `fs:<folder>` for each, so consent names every folder. There is no default folder: with no vault it asks only for `ui` and has no library. A vault without its grant refuses with permission denied while the others work. It browses each folder tree, searches titles and bodies (an in-memory index, refreshed by polling), reads a note, creates notes and saves edits. A save is refused if the file changed on disk since it was read, so nothing is overwritten, and it never deletes. Burrow shows notes in its own notes panel. **Copy into post** inserts the selection or the whole note into the current draft at the cursor, either as a quote or verbatim (the user picks). This is a host action, not `items.write`. The **Save selection to notes** command writes a new plain note in the first vault it can use (a command carries no library, so not the drawer's chosen one). It adds no ids or frontmatter to notes (existing frontmatter is kept untouched), and nothing is exported when you publish. It needs only `fs:<folder>` per vault and `ui`, and it runs as `blygger +ext markdown-notes`, through the same host path as a third-party extension. Opt-in through the config and consent like any other.
+- **In the window** (`crates/blyg-app/src/extensions/`): the host starts about a second after the window opens, answers extensions from the window's backend (a switch, so connecting or disconnecting a blyg needs no rewiring, and nothing needs a blyg), follows Reload Config, and stops its children on quit. Its toasts name the extension; a failure or a pending permission is a status-bar notice (a click opens Manage extensions or the consent sheet). The **consent sheet** (the Publish/Delete sheets' chrome) lists each capability in `blyg_ext::describe`'s words with a tick (1–9 toggle), then `CONSENT_CAVEAT`; ⏎ Allow writes the ticked `extension-allow` lines (unticked ones aren't asked again this session), esc Not now leaves the notice, ⌘⌫ Turn off backs out (as Manage's Turn off). ⇧⌘P **Extensions…** (Post menu) lists the running extensions' commands for the screen, "Browse <library>", and **Manage extensions…** (what's installed, its state, what's allowed and not, Turn on, Allow…, manifest problems; **Turn off**, in any state, removes its `extension` line, so the reload stops it and its notice goes, while its `extension-allow` and `extension-setting` lines stay for the next Turn on; **Forget permissions** turns it off and removes its `extension-allow` lines too). A command runs off the main thread with the selection (notes drawer, browser pane, reading pane or editor), the open item and the screen. A **library** is a tab in the notes drawer ("Reading notes | Notes"; markdown-notes' tab shows once it's on, even with no folder, where it says so with **Choose a folder…**). markdown-notes' vaults get a switcher above it: a chip per vault (one not allowed yet in the warning colour, and choosing it shows "Burrow needs your permission…" with **Allow…**), **Add folder…** (the folder picker, several at once), and the chosen vault's folder with **Remove from Burrow** (drops its `vault…` line and its `fs:` grant; never touches the folder). The chosen vault is remembered (`state.json`, `notes_vault`). Under it: breadcrumbs, a search box (each keystroke searches again, only the newest answer shows; after 2 s "Notes didn't answer"), folders and notes; a note opens in an editor showing its body (frontmatter kept aside and written back unchanged), Save names the hash it was read at, and a refused save says "Changed on disk" and offers Reload or Keep mine as a new note. **Quote into post** / **Copy verbatim** put the selection, or the whole note, into the open draft at its caret (a new draft when none is open). The quote picker (⌘K) has a "notes" chip that searches every vault (with more than one, each row names its vault; a vault not allowed yet is skipped) and quotes the note as a `>` blockquote naming it, never `![[…]]`. Search, New note, Quote into post and Copy verbatim act on the chosen vault. Settings › Notes folders lists the vaults, each with Remove, and **Add folder…** (several at once) writes `extension = markdown-notes` and a `vault` (the first) or `vault-<label>` line per folder (comments kept), then the consent sheet asks for the new folders. Publishing calls `Host::item_published`.
 
 ## Naming
 
diff --git a/extensions/community.toml b/extensions/community.toml
new file mode 100644
index 0000000..f4a2a5a
--- /dev/null
+++ b/extensions/community.toml
@@ -0,0 +1,41 @@
+# Community extensions for Burrow.
+#
+# Every entry here is listed on the documentation site's "Community extensions"
+# page (site/src/generated/community-extensions.md, made by
+# scripts/build-site.sh). The Burrow maintainers do NOT review, verify, audit
+# or endorse these extensions. A listing only means the entry below passed
+# scripts/community-extensions.py check, which looks at its format, nothing
+# else.
+#
+# To list your extension, open a pull request that adds one [[extension]]
+# table, kept in alphabetical order by `name`. See "Submit your extension" on
+# the Extensions page of the documentation site.
+#
+# Fields (all strings unless noted; plain text, no Markdown or HTML):
+#
+#   name          required. The `name` in your extension.toml: lowercase
+#                 kebab-case ([a-z0-9]+(-[a-z0-9]+)*), at most 40 characters,
+#                 not a bundled extension's name, not already listed.
+#   title         required. A short human name, at most 60 characters.
+#   description   required. One line, at most 160 characters.
+#   repo          required. https:// URL of the source code.
+#   homepage      optional. https:// URL of a page about it.
+#   author        required. Your GitHub handle, without "@". Never an email.
+#   capabilities  required, a list (may be empty). Exactly what your
+#                 manifest's `capabilities` asks for, e.g. "items.read", "ui",
+#                 "net", "fs:~/Notes", "browser.automate:https://example.com".
+#   platforms     required, a non-empty list: "macos", "windows".
+#   added         required, a TOML date (no quotes): the day it was listed.
+#
+# Example (commented out; it is not a real extension):
+#
+# [[extension]]
+# name = "wordcount"
+# title = "Word count"
+# description = "Shows the word count and reading time of the open draft."
+# repo = "https://github.com/example/burrow-ext-wordcount"
+# homepage = "https://example.com/wordcount"
+# author = "example"
+# capabilities = ["items.read", "ui"]
+# platforms = ["macos", "windows"]
+# added = 2026-10-09
diff --git a/scripts/build-site.sh b/scripts/build-site.sh
index d3103dc..293368b 100755
--- a/scripts/build-site.sh
+++ b/scripts/build-site.sh
@@ -44,6 +44,10 @@ if [ -z "${MDBOOK:-}" ]; then
   fi
 fi
 
+# The Community extensions page is made from extensions/community.toml (and
+# fails the build when an entry is malformed); it isn't committed.
+python3 scripts/community-extensions.py render
+
 log="$(mktemp)"
 trap 'rm -f "$log"' EXIT
 "$MDBOOK" build site 2>&1 | tee "$log"
diff --git a/scripts/community-extensions.py b/scripts/community-extensions.py
new file mode 100755
index 0000000..1eb7f87
--- /dev/null
+++ b/scripts/community-extensions.py
@@ -0,0 +1,340 @@
+#!/usr/bin/env python3
+"""Check the community extension list, and render it as a documentation page.
+
+    scripts/community-extensions.py check  [extensions/community.toml]
+    scripts/community-extensions.py render [extensions/community.toml] [OUT.md]
+
+`check` exits 1 and prints every problem when an entry is malformed. `render`
+checks first (and fails the same way), then writes the "Community extensions"
+page (default: site/src/generated/community-extensions.md).
+scripts/build-site.sh runs `render`; CI runs `check` on every pull request.
+
+The checks are about format only: they never fetch, run or review an
+extension. Python 3.11+ standard library only (tomllib).
+"""
+import datetime
+import os
+import re
+import sys
+import tomllib
+from urllib.parse import urlsplit
+
+ROOT = os.path.normpath(os.path.join(os.path.dirname(os.path.abspath(__file__)), ".."))
+DATA = os.path.join(ROOT, "extensions", "community.toml")
+OUT = os.path.join(ROOT, "site", "src", "generated", "community-extensions.md")
+
+NAME_MAX = 40  # crates/blyg-ext/src/manifest.rs NAME_MAX
+TITLE_MAX = 60
+DESCRIPTION_MAX = 160
+PLATFORMS = ("macos", "windows")
+PLATFORM_WORDS = {"macos": "macOS", "windows": "Windows"}
+REQUIRED = ("name", "title", "description", "repo", "author", "capabilities", "platforms", "added")
+OPTIONAL = ("homepage",)
+
+NAME_RE = re.compile(r"^[a-z0-9]+(-[a-z0-9]+)*$")
+# GitHub's rule: 1-39 alphanumerics or single hyphens, not starting or ending with one.
+HANDLE_RE = re.compile(r"^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$")
+EMAIL_RE = re.compile(r"[^\s@<>()]+@[^\s@<>()]+\.[A-Za-z]{2,}")
+
+# What each capability lets an extension do, in the words of site/src/extensions.md.
+CAPABILITY_WORDS = {
+    "items.read": "read your posts, drafts and scratch notes",
+    "items.write": "create drafts and scratch notes, and edit their text",
+    "reading.read": "read the posts held from your subscriptions",
+    "blyg.identity": "know your blyg's address",
+    "ui": "show messages, and select a post in the list",
+    "hooks:itemPublished": "be told when you publish a post, with its text",
+    "hooks:itemSaved": "be told when you edit a post, with its text",
+    "hooks:itemCreated": "be told when you create a post, with its text",
+    "browser.capture": "read the page open in the browser pane",
+    "net": "use the network (declared, not enforced)",
+}
+FS_PREFIX = "fs:"
+AUTOMATE_PREFIX = "browser.automate:"
+
+
+def read_rust_strings(path, pattern):
+    try:
+        with open(path, encoding="utf-8") as fh:
+            return re.findall(pattern, fh.read())
+    except OSError:
+        return []
+
+
+def known_capabilities():
+    """EXTENSION_CAPABILITIES from the config key table, so the two can't drift."""
+    keys = os.path.join(ROOT, "crates", "blyg-core", "src", "config", "keys.rs")
+    try:
+        with open(keys, encoding="utf-8") as fh:
+            m = re.search(r"EXTENSION_CAPABILITIES: &\[&str\] = &\[(.*?)\];", fh.read(), re.S)
+    except OSError:
+        m = None
+    caps = re.findall(r'"([^"]+)"', m.group(1)) if m else []
+    return caps or list(CAPABILITY_WORDS)
+
+
+def bundled_names():
+    """The `NAME` of every bundled extension crate (crates/blyg-ext-*)."""
+    names = {"markdown-notes", "cross-post"}
+    crates = os.path.join(ROOT, "crates")
+    if os.path.isdir(crates):
+        for d in sorted(os.listdir(crates)):
+            if d.startswith("blyg-ext-"):
+                lib = os.path.join(crates, d, "src", "lib.rs")
+                names.update(read_rust_strings(lib, r'pub const NAME: &str = "([^"]+)";'))
+    return names
+
+
+def check_url(value):
+    if not isinstance(value, str):
+        return "must be a string"
+    if re.search(r"[\s<>\"'`]", value):
+        return "must not contain spaces, quotes or angle brackets"
+    parts = urlsplit(value)
+    if parts.scheme != "https":
+        return "must be an https:// URL"
+    if not parts.hostname or "." not in parts.hostname:
+        return "must name a host"
+    if parts.username or parts.password:
+        return "must not contain a user name or password"
+    return None
+
+
+def check_plain(value, limit):
+    if not isinstance(value, str):
+        return "must be a string"
+    if not value.strip():
+        return "must not be empty"
+    if value != value.strip():
+        return "must not start or end with spaces"
+    if any(c in value for c in "\r\n\t"):
+        return "must be one line"
+    if re.search(r"[<>`]", value):
+        return "must be plain text (no HTML or Markdown code)"
+    if len(value) > limit:
+        return f"is {len(value)} characters; at most {limit}"
+    return None
+
+
+def check_capability(cap, known):
+    if not isinstance(cap, str):
+        return "must be a string"
+    if cap.startswith(FS_PREFIX):
+        path = cap[len(FS_PREFIX):]
+        if not path.strip() or path != path.strip() or re.search(r"[<>`\n]", path):
+            return "an fs: capability needs a folder, e.g. fs:~/Notes"
+        return None
+    if cap.startswith(AUTOMATE_PREFIX):
+        origin = cap[len(AUTOMATE_PREFIX):]
+        parts = urlsplit(origin)
+        if parts.scheme not in ("https", "http") or not parts.hostname or parts.path not in ("", "/") \
+                or parts.query or parts.fragment or parts.username:
+            return "browser.automate: needs an origin, e.g. browser.automate:https://example.com"
+        return None
+    if cap not in known:
+        return f"isn't a capability Burrow knows (one of {', '.join(known)}, fs:<folder> or browser.automate:<origin>)"
+    return None
+
+
+def validate(path):
+    """Return (entries, problems)."""
+    try:
+        with open(path, "rb") as fh:
+            data = tomllib.load(fh)
+    except OSError as e:
+        return [], [f"can't read it: {e}"]
+    except tomllib.TOMLDecodeError as e:
+        return [], [f"isn't valid TOML: {e}"]
+
+    problems = []
+    extra = sorted(set(data) - {"extension"})
+    if extra:
+        problems.append(f"unknown top-level keys {extra}: entries are [[extension]] tables")
+    entries = data.get("extension", [])
+    if not isinstance(entries, list):
+        return [], problems + ["`extension` must be an array of tables ([[extension]])"]
+
+    known = known_capabilities()
+    bundled = bundled_names()
+    seen_names, seen_repos = {}, {}
+    today = datetime.date.today()
+
+    for i, e in enumerate(entries, 1):
+        label = f"entry {i}"
+        if isinstance(e, dict) and isinstance(e.get("name"), str):
+            label += f" ({e['name']})"
+
+        def bad(field, msg):
+            problems.append(f"{label}: `{field}` {msg}")
+
+        if not isinstance(e, dict):
+            problems.append(f"{label}: must be a table")
+            continue
+        for f in REQUIRED:
+            if f not in e:
+                bad(f, "is required")
+        for f in sorted(set(e) - set(REQUIRED) - set(OPTIONAL)):
+            bad(f, "isn't a known field")
+
+        name = e.get("name")
+        if "name" in e:
+            if not isinstance(name, str) or not NAME_RE.match(name):
+                bad("name", "must be lowercase kebab-case, like word-count")
+            elif len(name) > NAME_MAX:
+                bad("name", f"is longer than {NAME_MAX} characters")
+            elif name in bundled:
+                bad("name", "is the name of an extension bundled with Burrow")
+            elif name in seen_names:
+                bad("name", f"is already listed (entry {seen_names[name]})")
+            else:
+                seen_names[name] = i
+
+        for f, limit in (("title", TITLE_MAX), ("description", DESCRIPTION_MAX)):
+            if f in e and (msg := check_plain(e[f], limit)):
+                bad(f, msg)
+
+        for f in ("repo", "homepage"):
+            if f in e and (msg := check_url(e[f])):
+                bad(f, msg)
+        repo = e.get("repo")
+        if isinstance(repo, str):
+            key = repo.rstrip("/").lower()
+            if key in seen_repos:
+                bad("repo", f"is already listed (entry {seen_repos[key]})")
+            seen_repos[key] = i
+
+        if "author" in e:
+            a = e["author"]
+            if not isinstance(a, str) or not HANDLE_RE.match(a):
+                bad("author", "must be a GitHub handle, like octocat (no @, no email)")
+
+        if "capabilities" in e:
+            caps = e["capabilities"]
+            if not isinstance(caps, list):
+                bad("capabilities", "must be a list, e.g. [\"items.read\", \"ui\"] (or [])")
+            else:
+                for c in caps:
+                    if msg := check_capability(c, known):
+                        bad("capabilities", f"{c!r} {msg}")
+                if len(set(map(str, caps))) != len(caps):
+                    bad("capabilities", "lists a capability twice")
+
+        if "platforms" in e:
+            ps = e["platforms"]
+            if not isinstance(ps, list) or not ps:
+                bad("platforms", f"must be a non-empty list of {', '.join(PLATFORMS)}")
+            else:
+                for p in ps:
+                    if p not in PLATFORMS:
+                        bad("platforms", f"{p!r} isn't one of {', '.join(PLATFORMS)}")
+                if len(set(map(str, ps))) != len(ps):
+                    bad("platforms", "lists a platform twice")
+
+        if "added" in e:
+            d = e["added"]
+            if not isinstance(d, datetime.date) or isinstance(d, datetime.datetime):
+                bad("added", "must be a TOML date without quotes, like 2026-10-09")
+            elif d > today + datetime.timedelta(days=1):
+                bad("added", "is in the future")
+
+        for f, v in e.items():
+            if isinstance(v, str) and EMAIL_RE.search(v):
+                bad(f, "looks like it contains an email address; don't list one")
+
+    names = [e.get("name") for e in entries if isinstance(e, dict) and isinstance(e.get("name"), str)]
+    if names != sorted(names):
+        problems.append(f"entries must be sorted by name: {', '.join(sorted(names))}")
+
+    return entries, problems
+
+
+DISCLAIMER = """\
+> **Use at your own risk.** These are third-party extensions, written and
+> published by other people. The Burrow maintainers do not review, verify,
+> audit or endorse them: a listing only means its entry is in the right
+> format. An extension is a program that runs with your user's rights.
+> Burrow enforces most of the permissions you grant it, but `fs:` and `net`
+> are only the extension's own declarations, so it can read and change your
+> files and use the network whatever it declares. Read the source before
+> you install one, and install only what you trust. If a listing is
+> malicious or misleading,
+> [open an issue](https://github.com/aneeshsathe/blygger-desktop/issues/new)
+> and it will be removed."""
+
+
+def md(text):
+    """Escape plain text for Markdown (it was already checked for HTML)."""
+    return re.sub(r"([\\`*_\[\]{}#|!~&])", r"\\\1", text)
+
+
+def capability_words(cap):
+    if cap.startswith(FS_PREFIX):
+        return f"read and write files in `{cap[len(FS_PREFIX):]}` (declared, not enforced)"
+    if cap.startswith(AUTOMATE_PREFIX):
+        return f"fill in and, when you confirm, post on {md(cap[len(AUTOMATE_PREFIX):])}, signed in as you"
+    return CAPABILITY_WORDS.get(cap, md(cap))
+
+
+def render(entries):
+    out = [
+        "<!-- Generated from extensions/community.toml by scripts/build-site.sh",
+        "     (scripts/community-extensions.py render). Don't edit it by hand. -->",
+        "",
+        "# Community extensions",
+        "",
+        DISCLAIMER,
+        "",
+        "Extensions other people have written for Burrow. To install one, follow",
+        "[Installing someone else's extension](../extensions.md#installing-someone-elses-extension);",
+        "to list yours here, see [Submit your extension](../extensions.md#submit-your-extension).",
+        "",
+    ]
+    if not entries:
+        out += ["*No community extensions yet — be the first.*", ""]
+        return "\n".join(out)
+    for e in entries:
+        caps = e["capabilities"]
+        out += [f"## {md(e['title'])}", "", md(e["description"]), ""]
+        out.append(f"- **Name:** `{e['name']}`")
+        out.append(f"- **Source:** [{md(e['repo'])}]({e['repo']})")
+        if e.get("homepage"):
+            out.append(f"- **Homepage:** [{md(e['homepage'])}]({e['homepage']})")
+        out.append(f"- **Author:** [{md(e['author'])}](https://github.com/{e['author']})")
+        if caps:
+            out.append("- **Asks to:**")
+            out += [f"  - `{c}`: {capability_words(c)}" for c in caps]
+        else:
+            out.append("- **Asks to:** nothing (no capabilities)")
+        out.append("- **Platforms:** " + ", ".join(PLATFORM_WORDS[p] for p in e["platforms"]))
+        out.append(f"- **Listed:** {e['added'].isoformat()}")
+        out.append("")
+    return "\n".join(out)
+
+
+def main(argv):
+    if len(argv) < 2 or argv[1] not in ("check", "render"):
+        print(__doc__.strip(), file=sys.stderr)
+        return 2
+    data = argv[2] if len(argv) > 2 else DATA
+    inside = os.path.abspath(data).startswith(ROOT + os.sep)
+    shown = os.path.relpath(data, ROOT) if inside else data
+    entries, problems = validate(data)
+    for p in problems:
+        print(f"{shown}: {p}", file=sys.stderr)
+    if problems:
+        print(f"{len(problems)} problem(s); see \"Submit your extension\" in site/src/extensions.md",
+              file=sys.stderr)
+        return 1
+    if argv[1] == "check":
+        print(f"{shown}: {len(entries)} extension(s), all well-formed")
+        return 0
+    out = argv[3] if len(argv) > 3 else OUT
+    os.makedirs(os.path.dirname(out), exist_ok=True)
+    with open(out, "w", encoding="utf-8") as fh:
+        fh.write(render(entries))
+    print(f"wrote {os.path.relpath(out, ROOT)} ({len(entries)} extension(s))")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))
diff --git a/scripts/e2e-wrangler.sh b/scripts/e2e-wrangler.sh
index aa2df2b..2f1c434 100755
--- a/scripts/e2e-wrangler.sh
+++ b/scripts/e2e-wrangler.sh
@@ -6,7 +6,8 @@
 #   e2e-wrangler.sh setup                 derive the scratch config + secrets
 #   e2e-wrangler.sh token | password      print a scratch dev secret
 #   e2e-wrangler.sh mint-token <port>     sign in once and mint a manual API
-#                                         token with all four owner scopes
+#                                         token with every owner scope, and
+#                                         reading:state on studio 0.39+
 #                                         (studio 0.28+); prints it, or nothing
 #                                         on an older studio
 #   e2e-wrangler.sh start <name> <port> [KEY=value…]
@@ -110,9 +111,18 @@ mint_token() {
   jar="$BLYG_E2E_SCRATCH/cookies.$port"
   curl -fsS -o /dev/null -c "$jar" --data-urlencode "password=$(password)" "$base/studio/login" \
     || die "signing in to :$port failed"
+  # reading:state (studio 0.39+; the name is provisional, see READ_STATE_SCOPE
+  # in crates/blyg-core/src/api/oauth.rs): an older studio refuses a scope it
+  # doesn't know with a 400, so it gets the four owner scopes.
+  local four='"owner:read","owner:draft","owner:publish","owner:manage"'
   out="$(curl -sS -b "$jar" -H 'content-type: application/json' -w '\n%{http_code}' \
-    -d '{"name":"burrow-e2e","scope":["owner:read","owner:draft","owner:publish","owner:manage"],"resource":"api"}' \
+    -d "{\"name\":\"burrow-e2e\",\"scope\":[$four,\"reading:state\"],\"resource\":\"api\"}" \
     "$base/api/authorizations")"
+  if [ "${out##*$'\n'}" = 400 ]; then
+    out="$(curl -sS -b "$jar" -H 'content-type: application/json' -w '\n%{http_code}' \
+      -d "{\"name\":\"burrow-e2e\",\"scope\":[$four],\"resource\":\"api\"}" \
+      "$base/api/authorizations")"
+  fi
   rm -f "$jar"
   case "${out##*$'\n'}" in
     200) printf '%s' "${out%$'\n'*}" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>process.stdout.write(JSON.parse(s).access_token))' ;;
diff --git a/site/src/SUMMARY.md b/site/src/SUMMARY.md
index 015544b..d9257bc 100644
--- a/site/src/SUMMARY.md
+++ b/site/src/SUMMARY.md
@@ -12,6 +12,7 @@
 - [AI helpers](ai.md)
 - [Themes](themes.md)
 - [Extensions](extensions.md)
+  - [Community extensions](generated/community-extensions.md)
 
 # Reference
 
diff --git a/site/src/config.md b/site/src/config.md
index 672ccfe..319df66 100644
--- a/site/src/config.md
+++ b/site/src/config.md
@@ -54,6 +54,8 @@ standard install, it's `/Applications/Burrow.app/Contents/MacOS/blygger`.
 | `+validate-config` | problems in the config file(s) |
 | `+list-fonts` | fonts for `font-family-writing` / `font-family-ui` |
 | `+list-keybinds` | every keyboard shortcut, and the ones reserved |
+| `+import-opml <file> [--dry-run]` | subscribes to every feed in an OPML file you don't follow yet ([Import and export subscriptions](reading.md#import-and-export-subscriptions-opml)); `--dry-run` only lists them |
+| `+export-opml <file>` | saves every subscription as an OPML file |
 | `+version` | the version |
 | `+help` | this list |
 
diff --git a/site/src/dev/building.md b/site/src/dev/building.md
index 80d1c39..c559175 100644
--- a/site/src/dev/building.md
+++ b/site/src/dev/building.md
@@ -163,7 +163,8 @@ It downloads the pinned mdBook release into `target/` the first time
 (checksum-verified), and fails on an mdBook error (such as a missing
 `\{{#include}}` file) or a broken internal link. CI runs it on every pull request. With mdBook installed
 yourself, `mdbook serve site` serves the site at `http://localhost:3000` and
-rebuilds it as you edit.
+rebuilds it as you edit. Run `python3 scripts/community-extensions.py render`
+once first: the Community extensions page is generated, not committed.
 
 `.github/workflows/pages.yml` publishes the site to GitHub Pages on every push
 to `main` that touches the site, `docs/`, the config keys, the keymap or the
diff --git a/site/src/extensions.md b/site/src/extensions.md
index 2211c33..badd4fb 100644
--- a/site/src/extensions.md
+++ b/site/src/extensions.md
@@ -5,17 +5,30 @@ separate program that Burrow starts and talks to. **Nothing runs unless your
 config file names it**, and an extension gets only the permissions you grant
 it.
 
-Burrow comes with two extensions, **markdown-notes** and **cross-post**. You
-can also install extensions other people write, or write your own.
+Burrow comes with four extensions, all off until you turn them on:
+**markdown-notes**, **cross-post**, **reading-time** and **inspect**. You can
+also install extensions other people write, or write your own.
+
+**⇧⌘P** (Post › Extensions…) opens the Extensions palette: the commands your
+running extensions offer on this screen, **Browse** for each notes folder,
+and **Manage extensions…** (what's installed, whether it's on, and what it's
+allowed). Manage is also where you turn one on or off; see
+[Turning an extension off](#turning-an-extension-off).
+
+The tour (Help › Burrow Tutorial) shows markdown-notes, reading-time and
+inspect running on sample notes, even when yours are off; nothing it does
+changes your config file.
 
 ## markdown-notes
 
-markdown-notes reads and writes a folder of Markdown notes, such as an
-Obsidian vault. It's kept apart from your blyg, so it works with no blyg
-connected, and it never links notes to posts.
+markdown-notes reads and writes folders of Markdown notes, such as Obsidian
+vaults, as many as you like. It's kept apart from your blyg, so it works with
+no blyg connected, and it never links notes to posts.
 
-- **The notes panel** lists the folder, searches titles and bodies, and opens
-  a note to read or edit.
+- **The notes panel** (the notes drawer's Notes tab) switches between your
+  folders, lists the one you pick, searches titles and bodies, and opens a
+  note to read or edit. **Add folder…** adds more; **Remove from Burrow**
+  forgets a folder (its notes stay where they are).
 - **Copy into post** puts the selection, or the whole note, into your draft at
   the cursor, as a quote or as it is (you pick).
 - **Save selection to notes**, in the Extensions palette (⇧⌘P), makes a new
@@ -27,19 +40,26 @@ it, your save is refused, so it never overwrites the other change.
 
 ### Turning it on
 
-Add these lines to the config file (**Burrow › Open Config File**), then
-reload it (⇧⌘,):
+The easy way: **Settings › Notes folders › Add folder…**, then pick one or
+more folders. Burrow writes the config lines for you and asks for permission
+to use those folders.
+
+Or add the lines to the config file (**Burrow › Open Config File**) yourself,
+then reload it (⇧⌘,):
 
 ```text
 extension = markdown-notes
 extension-setting = markdown-notes vault=~/Notes
+extension-setting = markdown-notes vault-work=~/Work/Vault
 ```
 
-`vault` is the folder of notes (it defaults to `~/Notes`). It has two more
-settings:
+`vault` is your first folder of notes, and each `vault-<label>` adds another
+(the label is lowercase letters, digits and dashes). There's no default: with
+no folder, the Notes tab offers **Choose a folder…**, and Burrow never reads a
+folder you didn't pick. It has two more settings:
 
 ```text
-# where new notes go, inside the vault (default: the top of the vault)
+# where new notes go, inside each folder (default: the top of the folder)
 extension-setting = markdown-notes folder=Inbox
 # how often it looks for changed notes, in milliseconds (default 2000)
 extension-setting = markdown-notes poll-ms=5000
@@ -85,6 +105,15 @@ them:
 2. **Post this to Substack Notes?** You see what the notes box now holds. Post
    clicks Substack's Post button; you can also click Post yourself, or cancel.
 
+The run uses the same side pane as a link you click, with the sheets beside
+it so you can see the page. You can fold the pane (esc, ×, or ⇧⌘B) while it
+runs: the run keeps going, and the status bar shows **macro running · show
+pane**. Click that, or press ⇧⌘B, to bring the pane back. The pane comes back
+by itself before the text goes in, and for the second sheet. Afterwards
+it's folded again if it was folded before, unless you folded or unfolded it
+during the run, or you still need the page (you chose to click Post
+yourself, or the run stopped with a problem).
+
 The note is the post's first paragraph of prose (headings, quotes, images and
 code are skipped, and Markdown marks are taken out), a blank line, and the
 link. The whole note is at most 280 characters, the link included, counted as
@@ -117,12 +146,39 @@ extension-setting = cross-post max-chars=500
   you typed and clicked yourself. If Substack limits or acts on an account
   for automated posting, that's your risk; check its terms.
 
+## reading-time and inspect
+
+Two small extensions for what you read, ports of blygger-studio 0.39's
+extensions of the same names, so the web Studio and Burrow agree:
+
+- **reading-time** ends each post's byline, in the stream and in Reader, with
+  an estimated reading time (**· 4 min**); hover over it for the word count.
+  It describes the text, not its audience.
+- **inspect** adds **⋯** to each post's actions. Click it, then **inspect**:
+  the record Burrow holds for the post (ids, versions, references, hashes),
+  and its JSON with the bodies left out, with a Copy button. It's for people
+  building clients, or checking why a mention or an import looks wrong.
+
+Both need only `reading.read`, fetch nothing and use no network:
+
+```text
+extension = reading-time
+extension-allow = reading-time reading.read
+extension = inspect
+extension-allow = inspect reading.read
+```
+
+Or turn them on in ⇧⌘P › Manage extensions… (Turn on, then Allow).
+
 ## Permissions and consent
 
 The first time Burrow starts an extension, it shows what the extension asks
 for, such as "markdown-notes wants to: read and write files in ~/Notes · show
-messages". You can untick any item. **Allow** writes your answer into the
-config file as `extension-allow` lines, and starts the extension:
+messages". You can untick any item (or press its number). **Allow** (⏎)
+writes your answer into the config file as `extension-allow` lines, and
+starts the extension; **Not now** (esc) leaves it waiting, with a notice in
+the status bar that brings the sheet back; **Turn off** (⌘⌫) says you don't
+want it after all and turns it off:
 
 ```text
 extension-allow = markdown-notes ui
@@ -154,6 +210,22 @@ Whatever it's granted, no extension can publish, withdraw, pin, delete or fork
 a post, change your blyg's settings, or see your sign-in, your Keychain or
 Burrow's database.
 
+## Turning an extension off
+
+In ⇧⌘P › **Manage extensions…**, each extension that's on has:
+
+- **Turn off**: removes its `extension` line, so it stops. Its
+  `extension-allow` and `extension-setting` lines stay, so **Turn on** later
+  brings it back as it was, without asking again.
+- **Forget permissions** (on any extension that's been allowed something,
+  on or off): turns it off and removes its `extension-allow` lines too, so
+  the next Turn on asks again.
+
+Turn off works in any state: running, waiting for permission, or stopped
+after crashing. Any question or notice about the extension goes with it.
+Editing the config file does the same: delete the `extension` line to turn it
+off, or its `extension-allow` lines to take permissions back.
+
 ## Checking your extensions
 
 ```sh
@@ -207,3 +279,59 @@ repository.
 For an extension in Rust, the `blyg-ext` crate has the protocol types and a
 `serve` loop, and markdown-notes (`crates/blyg-ext-notes`) is a worked
 example.
+
+## Submit your extension
+
+Wrote an extension? List it on the
+[Community extensions](generated/community-extensions.md) page. The page is
+made from one file in the repository, `extensions/community.toml`, every time
+the documentation site is built, so a merged entry shows up on its own.
+
+> **Community extensions are used at your own risk.** The Burrow maintainers
+> do not review, verify, audit or endorse them. An extension is a program that
+> runs with your user's rights, and `fs:` and `net` are its own declarations,
+> not something Burrow can enforce. Read the source before you install one. To
+> report a malicious or misleading listing,
+> [open an issue](https://github.com/aneeshsathe/blygger-desktop/issues/new)
+> and it will be removed.
+
+To submit one, open a pull request that adds an `[[extension]]` table to
+`extensions/community.toml`, in alphabetical order by `name`:
+
+```toml
+[[extension]]
+name = "wordcount"                  # the name in your extension.toml
+title = "Word count"
+description = "Shows the word count and reading time of the open draft."
+repo = "https://github.com/example/burrow-ext-wordcount"
+homepage = "https://example.com/wordcount"   # optional
+author = "example"                  # your GitHub handle, not an email
+capabilities = ["items.read", "ui"] # exactly what your manifest asks for
+platforms = ["macos", "windows"]
+added = 2026-10-09                  # a date, without quotes
+```
+
+If you'd rather not open a pull request, fill in the
+[extension submission form](https://github.com/aneeshsathe/blygger-desktop/issues/new?template=extension-submission.yml)
+and a maintainer will add the entry for you.
+
+CI runs `scripts/community-extensions.py check` on the pull request (you can
+run it yourself first). It checks that:
+
+- the file is valid TOML, and every entry has all the fields above and no
+  others (only `homepage` is optional);
+- `name` is lowercase kebab-case (`word-count`), at most 40 characters, not
+  already listed, and not the name of an extension that comes with Burrow;
+- `title` (at most 60 characters) and `description` (one line, at most 160)
+  are plain text, with no HTML or Markdown code;
+- `repo` and `homepage` are `https://` addresses;
+- `author` is a GitHub handle, and no field holds an email address;
+- each capability is one Burrow knows (see
+  [Permissions and consent](#permissions-and-consent)), and `platforms` is
+  `macos`, `windows` or both;
+- the entries are sorted by `name`.
+
+A maintainer merges an entry after a light look at its format, and nothing
+more: the source code isn't read, run or tested. List the source code's
+repository, keep `capabilities` in step with your manifest, and open another
+pull request when the details change, or to take the entry down.
diff --git a/site/src/faq.md b/site/src/faq.md
index ea1ad2e..4d9332d 100644
--- a/site/src/faq.md
+++ b/site/src/faq.md
@@ -76,7 +76,32 @@ preview flags one that isn't, and publishing refuses it.
 ### Why doesn't Burrow show follower counts or likes?
 
 Blygger shows responses as a list, never a count, and following is private.
-Burrow follows the protocol's rules: no counts anywhere social.
+Burrow follows the protocol's rules: no counts anywhere social. The one
+exception is the [lineage glyph](reading.md#lineage), which says how many
+posts a post draws on and how many draw on it, the same numbers the web
+Studio shows.
+
+### Do I need to sign in again after updating?
+
+Once, after updating to 0.11 or later, if your blyg runs blygger-studio 0.39
+or later and you read on more than one Mac. Studio 0.39 keeps read state
+behind its own permission (`reading:state`), which a sign-in made before
+then doesn't have. Until you sign in again, posts you read are marked read on
+this Mac and wait to be sent; everything else syncs as usual, and Burrow says
+once that read state is waiting. To sign in again: **Burrow › Disconnect…**
+(keep the local copy), then connect with **Sign in with browser** and allow
+every permission. With an API token, make a new one in the studio's **More ›
+Client access** that includes reading:state.
+
+### Can I bring my feeds from another reader?
+
+Yes. **Blyg › Import Subscriptions from OPML…** (or **Import OPML…** on the
+Subscriptions screen, ⇧⌘S) reads the OPML file most feed readers export:
+tick the feeds you want, and Burrow subscribes them a few at a time, files
+them in an **Imported feeds** folder in the Reader, and keeps them out of
+your public blogroll. **Blyg › Export Subscriptions as OPML…** goes the
+other way. See
+[Import and export subscriptions](reading.md#import-and-export-subscriptions-opml).
 
 ### Can I sign in with my Claude Pro/Max subscription?
 
diff --git a/site/src/generated/config-keys.md b/site/src/generated/config-keys.md
index 068f269..d4cdb35 100644
--- a/site/src/generated/config-keys.md
+++ b/site/src/generated/config-keys.md
@@ -235,7 +235,7 @@ net and fs: are declarations you agree to, not a sandbox: an extension runs as a
 - **Default:** none
 - **Repeatable:** yes, one value per line
 
-A setting for one extension, as &lt;name> key=value, e.g. extension-setting = markdown-notes vault=~/Notes. Repeatable; a later line for the same key wins. An extension sees its own settings and no other part of this file.
+A setting for one extension, as &lt;name> key=value, e.g. extension-setting = markdown-notes vault=~/Notes. Keys are lowercase kebab-case. Repeatable; a later line for the same key wins. An extension sees its own settings and no other part of this file. markdown-notes reads one folder of notes per vault key: vault=~/Notes is the first, and each vault-&lt;label>, e.g. extension-setting = markdown-notes vault-work=~/Work/Vault, adds another (Settings › Notes folders writes these). With no vault it uses no folder at all.
 
 
 ### `config-file`
diff --git a/site/src/generated/keybindings.md b/site/src/generated/keybindings.md
index 082bde6..2adf542 100644
--- a/site/src/generated/keybindings.md
+++ b/site/src/generated/keybindings.md
@@ -85,6 +85,8 @@
 | Check for a new release now (whatever auto-update says) | Burrow › Check for Updates… |
 | Quick capture (the global hotkey, capture-hotkey) | Burrow › Quick Capture |
 | Subscribe to a blyg or feed | Blyg › Subscribe… |
+| Import subscriptions from another reader's OPML file | Blyg › Import Subscriptions from OPML… |
+| Save every subscription as an OPML file | Blyg › Export Subscriptions as OPML… |
 | The blyg's site settings (title, bio, links) | Blyg › Site Settings… |
 | A new folder for your subscriptions (on this Mac only) | Blyg › New Folder… |
 | Withdraw this published post (asks first; permanent and visible) | Post › Withdraw… |
diff --git a/site/src/getting-started.md b/site/src/getting-started.md
index 8abc879..bc0f31f 100644
--- a/site/src/getting-started.md
+++ b/site/src/getting-started.md
@@ -8,15 +8,23 @@ on; installed `claude` / `codex` CLIs are detected), and **Buttons or
 keyboard?** (`show-buttons`). esc skips it at any step.
 
 Then comes an optional **interactive tour** of the real window: each step
-highlights a part of it and waits for you to press the key (⌘T, ⌘⏎, ⌘3, ⌘G,
-⌘Y, ⌘R, ⌘K…). The tour runs on sample data, so your own blyg isn't touched,
-and your posts come back when it ends. Replay it from **Help › Burrow
-Tutorial** or **Settings (⌘,) › Help**, or set `tutorial-on-launch = true` to
-see it every time.
+highlights a part of it and waits for you to press the key (⌘N, ⌘T, ⌘⏎, ⌘3,
+⌘G, ⌘Y, ⌘R, ⌘J, ⌘K, ⇧⌘C, ⇧⌘P…). It covers writing, reading, lineage, the
+notes drawer, the browser pane, and extensions: the bundled markdown-notes,
+reading-time and inspect run on sample notes during the tour, even if yours
+are off. The tour runs on sample data, so your own blyg isn't touched, nothing
+it does changes your config file, and your posts come back when it ends.
+Replay it from **Help › Burrow Tutorial** or **Settings (⌘,) › Help**, or set
+`tutorial-on-launch = true` to see it every time.
 
 **After an update**, the first launch opens the tour on a **What's new**
-card: ⏎ starts at the steps that teach the new things, **Take the whole tour**
-starts at the beginning, and esc skips it.
+card: ⏎ starts at the steps that teach the new things (each says **NEW IN**
+its version), **Take the whole tour** starts at the beginning, and esc skips
+it. After updating to 0.11, sign in again once if you read on several Macs
+(see [the FAQ](faq.md#do-i-need-to-sign-in-again-after-updating)).
+
+**Coming from another feed reader?** Blyg › Import Subscriptions from OPML…
+brings its feeds along (see the [FAQ](faq.md#can-i-bring-my-feeds-from-another-reader)).
 
 ![What's new after an update](screenshots/whats-new.png)
 
@@ -41,8 +49,9 @@ in:
   if you revoke it in the studio (**More › Client access**), it asks you to
   sign in again.
 - **API token**: make one in your studio under **More › Client access**
-  (REST API, with all four permissions) and paste it. A server with Burrow's
-  extensions also takes its `BLYG_OWNER_TOKEN` here.
+  (REST API, with every permission, including reading:state on studio 0.39+)
+  and paste it. A server with Burrow's extensions also takes its
+  `BLYG_OWNER_TOKEN` here.
 - **Studio password**, for a studio older than 0.28.
 
 It checks them with the server before saving anything, and says plainly what's
diff --git a/site/src/notes-and-browser.md b/site/src/notes-and-browser.md
index a82a6d2..f915eb9 100644
--- a/site/src/notes-and-browser.md
+++ b/site/src/notes-and-browser.md
@@ -26,6 +26,25 @@ will quote your selection into your draft (see
 
 ![The notes drawer over the stream](screenshots/notes-drawer.png)
 
+### Your Markdown notes: the Notes tab
+
+With the bundled [markdown-notes](extensions.md#markdown-notes) extension
+turned on, the drawer has two tabs: **Reading notes** and **Notes**. The Notes
+tab opens folders of Markdown notes (Obsidian vaults, say), as many as you
+like:
+
+- a chip per folder switches between them (a folder Burrow isn't allowed to
+  use yet shows in the warning colour, with **Allow…**);
+- **Add folder…** picks more (several at once), and **Remove from Burrow**,
+  beside the chosen folder's path, forgets it: the folder and its notes stay
+  where they are;
+- search, browse, open a note to edit it, or **Quote into post** / **Copy
+  verbatim** to put it (or the selected part) in your draft.
+
+There's no default folder. Until you choose one, the tab says so and offers
+**Choose a folder…**. **Settings › Notes folders** lists the same folders,
+each with Remove, and has its own **Add folder…**.
+
 ## The browser pane
 
 A link in a post opens in a pane that slides in from the right, over the
@@ -34,8 +53,18 @@ browser instead, and esc closes it. ⇧⌘B brings back the last page.
 
 The pane has back, forward and reload (⌘[ ⌘] ⌘R), an address field (⌘L), 🛡
 (content blocking on or off for this site), ↗ (open in your default
-browser), **→ Notes**, and **→ Draft** (which reads **❝ Quote → Draft**
-while text is selected on the page).
+browser), **→ Notes**, **→ Draft** (which reads **❝ Quote → Draft**
+while text is selected on the page), and **✂ Clip**.
+
+- **✂ Clip** (⇧⌘C, or Post › Clip Page to Draft) quotes the passage you
+  selected on the page, or else the page's main article, in your draft, with
+  the page's title and link. With no draft open it starts a new one (a thread
+  when the clip is longer than a fragment).
+- **Extensions run here too.** A macro, such as the bundled
+  [cross-post](extensions.md#cross-post), uses this same side pane. You can
+  fold the pane (esc, ×, ⇧⌘B) while it runs: the run goes on and the status
+  bar shows **macro running · show pane**; click it or press ⇧⌘B to unfold.
+  While a macro runs, the pane's bar has **■ Stop**.
 
 - **Content blocking.** Ads and trackers are blocked with uBlock Origin's
   default filter lists, as WebKit content blockers, downloaded about once a
diff --git a/site/src/reading.md b/site/src/reading.md
index 27adb67..0398d09 100644
--- a/site/src/reading.md
+++ b/site/src/reading.md
@@ -60,6 +60,42 @@ subscription at once.
 |---|---|
 | ![A subscription's menu](screenshots/reader-sub-menu.png) | ![Renaming a subscription](screenshots/reader-sub-rename.png) |
 
+## Import and export subscriptions (OPML)
+
+Moving from another feed reader? Export an OPML file there (Feedly,
+NetNewsWire, Inoreader, Miniflux, Reeder and most others can), then choose
+**Blyg › Import Subscriptions from OPML…**, or **Import OPML…** on the
+Subscriptions screen (⇧⌘S).
+
+- Burrow lists the file's feeds, grouped under the folders they had in the
+  other reader. Feeds you already follow say **already following** and start
+  unticked, and a feed listed twice appears once.
+- 1–9 or Space tick and untick, ⌘A ticks all or none, ⏎ imports the ticked
+  ones, and esc cancels.
+- Every feed is subscribed on your blyg, as if you'd added it by hand. The
+  import goes slowly, about 30 feeds a minute, because each new subscription
+  makes your blyg fetch that feed's archive. Esc stops it after the feed in
+  progress, and what's done stays done.
+- Imported feeds go into a folder named **Imported feeds** in the Reader,
+  made the first time you import (file them elsewhere whenever you like).
+  Feeds you already followed stay where you filed them. The other reader's
+  folders are only shown in the list; they don't become folders here.
+- Imported feeds aren't added to your public blogroll.
+- At the end Burrow says how many were added, already followed, or failed,
+  with each failure's reason: *not a feed* (nothing at that address your blyg
+  could read as a blyg or a feed), *unreachable* (Burrow couldn't reach your
+  blyg), or *refused*. **r** retries the failed ones.
+
+**Blyg › Export Subscriptions as OPML…** (or **Export OPML…** on the
+Subscriptions screen) saves every subscription to an OPML file
+(`burrow-subscriptions.opml`) that other readers can import. Your blyg's
+public `blogroll.opml` lists only the subscriptions you put in your blogroll;
+the export lists them all.
+
+Both need a connected blyg, since your subscriptions live there. From a
+terminal: `blygger +import-opml <file>` (add `--dry-run` to see what would be
+added) and `blygger +export-opml <file>`.
+
 ## Acting on a post
 
 The selected post shows its actions. Each says what it makes:
@@ -139,14 +175,21 @@ Beside each post's name, in the stream and in Reader, a small **glyph** shows
 its lineage: lines coming in on the left are the kinds of post it draws on,
 lines going out on the right the kinds that draw on it. Each kind has its own
 place (fork at the top, reply in the middle, quote at the bottom) and colour,
-and a dotted line means only a passage. It never says how many; hover for the
-kinds in words.
+and a dotted line means only a passage. Beside it, **2 · 3** says how many:
+the posts it draws on, then the posts known here that draw on it. Hover for
+the counts by kind in words. These are the same numbers the web Studio's
+lineage glyph shows: when your blyg runs blygger-studio with the
+`lineage-glyph` extension turned on, Burrow asks it for them; otherwise it
+counts what this Mac holds, by the same rules. The lineage glyph is the one
+place Burrow shows counts: responses and mentions stay lists.
 
 **⌘J** (Post › Lineage…), or a click on the glyph, opens the lineage view. The
 post sits in a hexagon, what it draws on above it and what draws on it below.
 The arrow keys move between them, ⏎ makes a neighbour the centre so you can
 walk a conversation one step at a time, ⌫ walks back, **o** opens the selected
-post in the reader, and esc closes. Responses are what this Mac holds: posts
+post in the reader (marking it read, as opening it from the list does), and
+esc closes. Beside the hexagon it says how many each way. Responses are what
+your blyg knows when it serves the lineage, else what this Mac holds: posts
 in your reading list, your own posts, and verified mentions of your posts.
 
 ![The lineage view](screenshots/lineage.png)
@@ -156,12 +199,21 @@ actions, always in the same places: **F** fork, **R** reply, **Q** quote,
 **L** link post, **V** versions, **O** open on the web. A letter previews the
 action: a dashed node shows what it would make, and the panel answers the same
 four questions for each (is it a response, is the author told, are their
-words in yours, does it show under their post). ⏎, or the same letter again,
+words in yours, does it show under their post). Fork, reply and quote also
+say how many of that kind are already known (**R · 2**). ⏎, or the same letter again,
 does it; esc backs out. An action that can't be done (a fork of a post with
 no pinned version, say) says why.
 
 ![The action ring, previewing Reply](screenshots/lineage-ring.png)
 
+## Reading time and inspect
+
+Two bundled [extensions](extensions.md#reading-time-and-inspect), off until
+you turn them on, add to each post: **reading-time** ends its byline with
+**· 4 min** (the word count on hover), and **inspect** adds **⋯** to its
+actions, with the record Burrow holds for it (ids, versions, references,
+hashes, and its JSON).
+
 ## Mentions and responses
 
 **Mentions** (⇧⌘M) lists the verified responses to your own posts: who