docs/sharing.md

Rama main · réplica de lectura del repositorio original.

# Sharing

How a note gets from "only I can see this" to "anyone with the link can read it", and what each step actually grants.

## The three access levels

The Share dialog on a **personal** note (owner only) presents one choice with three levels (a note that belongs to a group has a simpler dialog — see [Notes in a group](#notes-in-a-group)):

- **Private** — only the owner. Picking this while the note has **members** shows an inline confirmation first, because removing people is destructive; the confirmation text also mentions the public link (including any custom public URL) when one is on, and confirming removes both — the link first, then the members — so if the operation is interrupted partway the worst case is "some members remain", never "the link is still live". With no members, switching to Private simply turns the public link off, no confirmation step.
- **Members only** — people the owner invites by email, each with a role (**editor** can change content, **viewer** can only read). The trash button next to a member asks first ("Remove <email> from this note?") and removes them only after you confirm. An editor's uploads into the note count against the owner's storage space, not theirs. Members use their own accounts, see the note in their sidebar, and get live collaboration. While a note is open, its header shows who else has it open right now — editors, viewers, the owner, and any AI agent working on it. Picking this while a public link exists turns the link off; the member list is untouched.
- **Public link** — anyone who has the link can **read** the note, no account needed. Members keep working exactly as before; the link is an addition, not a replacement.

When you add someone — in the **Members only** form here, or on a group's **Members** page — type a few characters of their email or name and a list of matching people you already know drops down; pick one with the mouse, or with ↑/↓ and Enter, and their email is filled in. The **Members only** form takes one address at a time, so the pick fills the box. The **Members** page's box takes several addresses (see [Notes in a group](#notes-in-a-group)), so suggestions follow the address you're typing: the pick replaces only that address and adds a comma after it unless a comma, semicolon or line break already follows, and people already in the group or already in the box aren't suggested. "People you already know" means the members of every group you're in and the people you've shared one of your own notes with — people whose email you can already see in Knotebook. Nobody else is suggested: not other accounts on the site, not the owner of a note someone shared with you (you see their username, not their email), and not disabled accounts. To add anyone else, type their full email; that works as before. Someone you stop sharing with, or who leaves your last shared group, stops being suggested right away.

The selector is an action trigger, not a live mirror: the choice you make sticks until you close the dialog.

## Notes in a group

A note can belong to one group (see the sidebar's **Groups** tab). A group note belongs to the group, not to a person: nobody owns it, and what you can do with it comes from your role in the group. Every role can read the group's notes. On top of that, a role allows any combination of six permissions — they are independent of each other:

- **Create** — create notes in the group. It doesn't include Edit: if your role can create notes but not edit them, a note you create is read-only for you too. In the web app the **+** next to the group's name appears only for roles that can both create and edit, so a role with Create alone can't start a new note from the sidebar: it can create one only through the API (`POST /api/notes` with `groupId`; `POST /api/notes/:id/copy` with `groupId`, which copies any note they can read into the group; or `POST /api/notes/:id/move`, which moves a personal note they own into it; see the [API contract summary](./api.md)) or from an AI assistant connected over MCP (`create_note` with `group_id`, `copy_note` with `group_id`, or `move_note_to_group`; see [MCP](./mcp.md)) — **Move to…** and **Copy to…** in a note's `⋮` menu don't offer the group either, since they list only groups where your role can both create and edit (see [Moving or copying a note into a group](#moving-or-copying-a-note-into-a-group)). In every case the note is read-only for them — their content and title can't be changed — unless the role also has Edit. (If the role has Manage public links, they can still turn the note's public link on and off and change its URL name — `slug` alone, since a request that also carries a `title` needs Edit.)
- **Edit** — change the content and title of the group's notes.
- **Delete** — move any note in the group to the trash, including ones other people created. A role that can also **Edit** sees the group's notes in the group's trash and can restore them or delete them permanently (see [Notes in the trash](#notes-in-the-trash)).
- **Manage public links** — turn the anonymous public link of the group's notes on and off, and give a note a custom URL name (an API-only feature, see the [API contract summary](./api.md)).
- **Manage members** — add and remove people (removing someone asks for confirmation first, naming their email; removing yourself says you will lose access and can't add yourself back, and after you confirm you leave the group's panel like **Leave group** does) and change their roles (except that a group always keeps at least one Admin), including making anyone, themselves included, an Admin.
- **Manage roles & group** — rename or delete the group, and create, change and delete its roles.

A group starts with two built-in roles. **Admin** always has every permission and can't be changed. **Member** is the role new members get unless someone picks another, and it starts with Create and Edit: members can read, create and edit notes, but not delete them — not even the ones they created. People whose role can manage roles and the group can change Member's permissions (but not rename or delete it) and can create more roles, on the **Roles** page of the group's panel; a new role starts with none of the six turned on, so the people who hold it can only read. Every member can see the group's roles. There is no per-person sharing on a group note: to let someone in, add them to the group.

Changing someone's role, or a role's permissions, takes effect on the next request; an editor someone already has open follows within a few seconds. On a group note someone has open, losing Edit turns their editor read-only, and getting Edit back makes it editable again — normally without closing the editor (if their browser doesn't answer the server's re-check in time, the connection is dropped and reconnects with the new role). Changing any of a role's other permissions leaves open editors alone, and the next request that needs a permission the person no longer has is refused. Since every role can read, nobody loses read access to a note because of a role change. Deleting a role moves the people who had it to Member.

Two of the permissions can be used to gain the others: someone whose role can manage members can make anyone — themselves included — an Admin, and someone whose role can manage roles and the group can give their own role Manage members. Keeping them apart is a convenience, not a security boundary: give either one only to people you would trust as an Admin.

Group notes live at `https://your-host/g/<group id>/<name>`; the name is unique within the group. If your server ran a pre-release build that already had groups (a build of the `main` branch from after #103 and before migration 0012), notes that were already in a group when it was upgraded moved to that form, and their old `/n/<username>/<name>` address keeps forwarding to the new one for a month — unless the person whose username is in it gives one of their own notes the same name in the meantime, which then takes the address over for as long as it keeps that name. The same one-month forwarding applies to a personal note you move into a group (see below). When a group is deleted and its notes are given to an admin, each note's old `/g/` address forwards to its new address the same way, for a month — but only for people who can read the note, which right after the deletion means only that admin (see below).

The Share dialog on a group note explains who has access and links to the group's panel. If your role can manage public links, it also has a **Public link** switch — the same anonymous link as on a personal note (a group note has no custom public URL). Anyone who can read the note sees the Share button. If your role can't manage public links, neither the button nor the dialog tells you whether the note has a public link: they show only the group's access, even when the note is also public.

Groups are created from the sidebar's **Groups** tab (**+**); managing one — renaming it, adding and removing people, changing someone's role, defining roles, leaving — lives in the group's panel (the group's `⋮` menu in the sidebar → **Members & settings**, or **View members** if your role can't manage members), with the pages **Members**, **Roles**, **Storage** and **About**; renaming and leaving are also on the `⋮` menu itself. **Settings → Groups** only lists your groups, with your role and its permissions in each. Being removed from a group (or leaving it) takes effect immediately, the same way a revoked share does (a note you have open closes within a few seconds — see [Known limitations](./known-limitations.md)).

If your role can manage members, you can add several people at once on the **Members** page. Type or paste their email addresses into the email box, separated by commas, semicolons, spaces or line breaks — full-width commas and semicolons (`，` `；`) and the enumeration comma `、` work too (a column pasted from a spreadsheet works, and so does `Name <address>` copied from an email's recipients — only the address is used), or press **Import from another group…**, pick one of the other groups you're in, and untick anyone you don't want — people already in this group, and you, aren't listed. Everyone is added with the role picked next to the email box, and there's no limit on how many at a time. They are added one at a time in a dialog that counts them as it goes; **Stop** ends it once the one being added is done, and the rest aren't added. At the end the dialog lists who was added, who was already a member, which addresses have no account, which weren't email addresses and which weren't processed. An unexpected error stops it there, and the dialog says why. Every address that wasn't added — no account, not an email address, the one that hit the error, or not processed — is put in the email box so you can fix it or try again. Closing the dialog before it's done stops it the same way, but then there's no list: the people who were added show up in the members table, and the addresses that weren't added are put in the email box. Closing the group's panel while it's running stops it too, also without a list. Importing is a one-time copy: the two groups aren't linked, so people who join or leave the other group later aren't added to or removed from this one. Adding people also tells you which emails have an account here — see [Known limitations](./known-limitations.md).

A group can be deleted by people whose role can manage roles and the group (and by site admins), from **Delete group** in the group's `⋮` menu or on the **About** page of the group's panel. Deleting it asks what happens to its notes:

- **Give them to an admin** — every note in the group becomes the personal note of the group's Admin you pick (you, if you are one). Its address changes from `/g/…` to `/n/<that person's username>/…`, keeping its name unless that person already has a note by that name, in which case a number is added. The old `/g/` address forwards to the new one for a month, but only for that admin — for everyone else it's a 404, because everyone else in the group loses access to the notes, and a note they have open closes within a few seconds. The notes' public links are turned off too (both the anonymous link and any custom public URL), so each one ends up as an unshared personal note; a public page someone already has open stops working when it's reloaded. The notes keep their AI edit history, their attachments and the links between them and other notes. The group's notes in its trash go to that admin's trash, still counting their retention period from when they were deleted (and, like the others, without a public link). If the group has folders (or notes in its trash whose folder was deleted), a new folder named after the group is created at the top level of that admin's **My notes**, and the group's folders, with the notes in them, and the group's top-level notes all go into it; a group with neither has its notes land at the top level of that admin's notes.
- **Delete everything** — the notes, their attachments and their AI edit history are permanently deleted with the group, including the notes in the group's trash; none of them go to the trash. The group's folders are deleted with it. You have to tick a confirmation first. Someone who has one of the notes open is told "This note has been deleted." (with an exception described in [Known limitations](./known-limitations.md)).

## Moving or copying a note into a group

The `⋮` menu of a note has **Move to…** and **Copy to…**. Each lists places one level at a time: places in the space the note is in first and, after a divider, other places — each list below says which of these it has. Groups are listed only where your role can both create and edit notes (the same rule as the **+** next to a group's name in the sidebar). What each offers:

- On a personal note you own: **Move to…** lists **Top level** (when the note is in a folder) and your folders in **My notes**, then those groups; **Copy to…** lists **Make a copy** (a copy in the same place as the original), **Top level** (when the note is in a folder) and your folders, then those groups.
- On a group note: **Move to…** only moves the note within its group (a note can't be taken out of a group): it lists **Top level** (when the note is in a folder) and the group's folders, and is there only if your role can edit notes. **Copy to…** lists **Make a copy** (a copy in the same place as the original), **Top level** (when the note is in a folder) and the group's folders — only if your role there can create and edit — then **My notes** (a copy in your own notes) and your other groups. Someone who can only read the group still gets **My notes**.
- On a personal note someone shared with you (as a viewer or an editor): **Move to…** lists **Top level** (when you have put the note in a folder) and your folders in **Shared with me** (see [Folders](#folders)); **Copy to…** lists **My notes** and those groups.

An item with nothing to list isn't shown. A folder with subfolders, and a space (**My notes** or a group) that has folders, leads on to the next level; a folder without subfolders is picked directly. When moving, the folder the note is already in is greyed out (for a folder with subfolders, its **Move here** is). How the levels are shown depends on the screen. On a wide window with a mouse, hovering an item opens its list beside the menu, and an item with an arrow opens its own list beside that one; that list starts with **Move here** (or **Copy here**) — or **Top level**, for a space — and then the folders in it, and there is no **Back**. With the keyboard, Right opens a list, Left closes it, and **Esc** closes the one level you are in before it closes the menu. On a narrow window or a touch screen (a touch screen counts as narrow however wide it is), tapping the item expands the list right below it, inside the same menu; picking an item with an arrow replaces the list with the next level without closing the menu, and that level starts with **Back** (shown with a left arrow), then **Move here** (or **Copy here**) — or **Top level**, for a space — and then the folders in it. With the keyboard, Right opens the list and goes into a place with an arrow, Left goes back a level (on the first level, it closes the list), and **Esc** closes the list before it closes the menu. If the window or the pointer changes while the menu is open so that the screen counts as the other kind (say, the window is resized across the line), the menu closes.

Moving a note to another place in the space it is in — a personal note within **My notes**, a group note within its group, a shared note within **Shared with me** — happens right away, without asking. The notice that follows, "Moved to …", offers **Undo**, which puts the note back where it was; if that fails (say, the folder it came from has been deleted in the meantime), an error is shown instead and it isn't retried. Moving a personal note into a group, and every copy, opens a confirmation dialog first; when you picked a folder, it names the folder's full path (moving into a group shows a notice, "Moved into …", when it is done):

- **Move** hands the note over to the group, into the folder you picked or at the group's top level. Before anything happens, the confirmation says what the move does: its per-person shares are removed (it names the people; anyone who isn't also in the group loses access, and a note they have open closes within a few seconds), its public link is turned off (when it has one), its address changes, you stop owning it (what you can do with it afterwards depends on your role in the group), and its version history is cleared. The custom public URL, if the note had one, goes with the public link. The note's new address is `https://your-host/g/<group id>/<name>`: it keeps its name, unless the group already has a note by that name, in which case a number is added. Its old `/n/<username>/<name>` address forwards to the new one for a month; if you had changed the note's URL name earlier, the name it had before that stops working. Its AI edit history, its attachments and the links between it and other notes stay with it; its version history is cleared and doesn't come back. If the note has changed hands elsewhere by the time you confirm — say, you already moved it from another tab — nothing is moved, and a notice says so.
- **Copy** creates a new note in the target (a group or your own notes, at the top level or in the folder you picked; with **Make a copy**, in the same folder as the original) and leaves the original as it is. The confirmation says so. If the original's folder has been deleted by then, **Make a copy** puts the copy at the top level instead, and the notice says so. The copy gets its own copies of the note's attachments, so its images don't depend on the original — deleting the original doesn't break them (the exceptions are in [Known limitations](./known-limitations.md)). The original's AI edit history, version history, backlinks, per-person shares and public link are not copied.

Any note you can read — a group note, or a personal note someone shared with you, as a viewer or an editor — can be copied to your own notes with **Copy to… → My notes** in its `⋮` menu; the copy gets its own copies of the attachments the same way. After a copy is made, a notice offers **Open copy**. Copying counts against your upload limit, one unit per attachment — see the `copy` row of the [API contract summary](./api.md).

To move, copy or delete several notes or folders at once, press **Select** (the check-box button at the top of the **My notes**, **Groups**, **Shared with me** or **Recent** tab) and tick them; folders can be ticked like notes, a group's row can't. Shift-click selects a range. **Select all** (on a wide window, the check box in the top row) ticks the folders and notes you can see, so it leaves out what's inside the groups and folders you have collapsed; anything you ticked before collapsing stays ticked and is included. Ticking a folder doesn't tick what's in it, but moving or deleting the folder takes what's in it along, so a note or folder you also ticked inside it isn't handled a second time.

Then use the buttons. On a narrow window or a touch screen they are at the bottom of the sidebar, with **Select all** and **Done** above the list. On a wide window with a mouse the top row holds everything instead, and the buttons at the bottom (and **New note**) are not shown: an ✕ (**Exit selection**), the **Select all** check box (partly ticked when only some of the rows you can see are ticked; clicking it when all of them are ticked unticks everything, including what's in collapsed folders), how many are ticked — which is replaced by the progress while a batch is running — and icon buttons for **Move to**, **Copy to** and delete, whose names show when you hover them. **Move to** (in **My notes**, **Groups** and **Shared with me**) and **Copy to** open a dialog that lists places level by level, the same way as **Move to…** and **Copy to…** in a note's `⋮` menu (in **Recent**, and in **Groups** when the ticked notes are in more than one group, **Copy to** lists only **My notes** and the groups). In **Groups**, **Move to** can't be used while the notes and folders it would move are in different groups. When folders are ticked, **Copy to** can't be used (folders can't be copied). Hovering such a button shows why; on a narrow window or a touch screen, tapping it shows the reason in a message. Folders can only be moved within their own space: the other spaces are greyed out, and so are the folder itself, its subfolders, and places that would put it more than five levels deep. Moving within the same space doesn't ask; its message offers **Undo**, which moves the items back one at a time, and if that stops partway, says how many were moved back. Moving notes into a group, and copying, ask once for all of the notes; after you confirm, the confirmation shows how far it has got and can't be closed until it finishes or stops. The red trash button moves the notes to the trash without asking; when folders you can delete are ticked, a confirmation first says how many folders will be deleted and how many notes will move to the trash, and a folder holding notes you can't delete isn't deleted (the message says how many). When notes were moved to the trash, the message offers **Undo**, which brings them all back — unless one of them is a group note your role can delete but not edit (see [Notes in the trash](#notes-in-the-trash)). In **Shared with me**, the trash button is there only while folders are ticked and any ticked notes are inside them, and it removes the folders after asking: the shared notes in them go back to the top level, no note is deleted, and there is no **Undo**. If the note you have open is moved to the trash, you're taken to the home page.

The items are handled one at a time. Items you can't act on are skipped, and the message at the end says how many: both those the button doesn't apply to (a note you can't delete, say) and those the server turns down because you don't have permission or the note no longer exists (or, when deleting, the folder no longer exists). A button stays disabled while none of the ticked items allows it. Anything else that goes wrong — too many requests, a group that's gone, a folder that's gone (other than one being deleted, or the original's folder for **Make a copy**, which then puts that copy at the top level), a full storage space — stops it there; the message then names the problem and how many items were done (not how many were skipped), and only the item it stopped at and those after it stay ticked. **Done** (on a wide window, the ✕) leaves selecting, and so does switching tabs or searching.

A single note can't be taken out of a group — to get a personal version, copy it. Deleting the whole group is the exception: it can give all of the group's notes to one of its admins (see [Notes in a group](#notes-in-a-group)).

Over MCP, `move_note_to_group` and `copy_note` move and copy into a group the same way, but at the group's top level the only group condition they check is Create; putting the note in one of the group's folders (`folder_id`) also needs Edit. Moving a note within the space it is in is MCP's `move_note_to_folder` (see [MCP](./mcp.md)).

## Folders

The sidebar's **My notes**, **Groups** and **Shared with me** tabs show folders, which nest up to five levels. In **My notes** and **Shared with me**, **New folder** next to the tab's name makes a top-level folder; in **Groups**, **New folder in** on a group's row makes one in that group. A folder's `⋮` menu creates a note or a subfolder in it, renames it, picks how the notes in it are sorted (by name, last modified or size), and deletes it; in **Shared with me** it doesn't create notes, and has **Remove folder** instead of deleting. To put notes in a folder, use **Move to…** in a note's `⋮` menu, or **Move to** in selection mode, which moves folders too (see [Moving or copying a note into a group](#moving-or-copying-a-note-into-a-group)). With a mouse you can also drag a note onto a folder in the sidebar, one note at a time (see [known limitations](./known-limitations.md#folders)).

- **Your folders in My notes** are seen only by you, names included. Sharing a note that is in one of them doesn't show the folder to the people you share it with.
- **A group's folders**, names included, are seen by every member of the group, since every role can read the group's notes. A role that can edit notes can create, rename and delete the group's folders (**New folder in** appears on the group's row only for such a role). Deleting a folder that still has notes in it also needs a role that can delete notes; without it the deletion is refused as a whole, and in the sidebar **Delete folder** says so instead of going ahead. Creating a note in a group folder needs a role that can both create and edit notes.
- **Your folders in Shared with me** are seen only by you, names included. Putting a note someone shared with you into one of them only files it for you: the person who shared it, and anyone else it's shared with, don't see where you put it. When the note stops being shared with you, your placement of it goes too. **Remove folder** asks first, then removes the folder and its subfolders; the shared notes in them go back to the top of **Shared with me**, and no note is deleted.
- **Deleting a folder** asks first. The notes in it, including those in its subfolders, move to the trash; **Undo** on the message that follows, or restoring them from the trash later, puts each note back in its folder, re-creating the folders it was in, and opens those folders in the sidebar.

## Notes in the trash

Deleting a note moves it to the trash (the sidebar's **Trash** tab) instead of deleting it for good. It stays there for the site's retention period — 7 days unless a site admin changed it — and is then permanently deleted automatically, unless a site admin turned automatic deletion off (see [Trash](./self-hosting.md#trash) for the schedule). Until then it can be restored, or deleted permanently, from the Trash tab.

Over MCP, `delete_note` and `restore_note` move a note to the trash and bring it back, and `delete_folder` deletes a folder and the folders in it, moving the notes in your own or a group's folders to the trash, all with the same role rules as the web app; the three need the `notes:delete` scope, and no MCP tool deletes a note permanently.

- **Who sees it.** A personal note is in the trash only for its owner. A group note is in the trash only for members whose role can **both** edit and delete notes; they can restore it or delete it permanently. Someone whose role can delete notes but not edit them can't get back a note they deleted, because after the deletion they can't see it — give the **Delete** permission together with **Edit**.
- **While it is in the trash,** people it was shared with one by one lose access to it, and its public link (including a custom public URL) answers like a link that doesn't exist. Restoring the note brings both back as they were.
- **Attachments** still count toward storage until the note is permanently deleted, and only then are they freed.

## What a public link is

Turning on **Public link** generates an unguessable token (`base64url(randomBytes(32))`, 43 characters) and gives you a URL of the form `https://your-host/p/<token>`. That page:

- requires no login, and never redirects to one;
- is **read-only** — there is no anonymous editing, and the page ships none of the editing machinery;
- shows the note's title and content, including images uploaded to that note (served through a public image endpoint that the token authorizes — see the `/api/public/...` rows in the [API contract summary](./api.md));
- shows **no** backlinks, no AI actions, and no timestamp (the note record's timestamp only tracks title/slug changes, not content edits, so showing it would mislead);
- follows a link to another note, opening that note's public page, only when that note has a public link with **Anonymous link** turned off. Links to notes that are private, members-only or public only through an anonymous link show as plain text, except a link to a place that this page also has, which scrolls there (see [Known limitations](./known-limitations.md));
- is sent with `X-Robots-Tag: noindex`, so well-behaved search engines won't index it. The link itself is still a capability: anyone it's forwarded to can read the note;
- has a **Present** button that plays the note as a slide show. Like the page itself, the presentation is a snapshot: it picks up new content when the page fetches the note again (for example when the tab regains focus), and keeps your current slide when it can — it is not live.

Whoever manages the public link can set the width of the public page — Standard, Wide or Full width — in the Share dialog while the link is on, and every reader sees the page at that width. Turning the link off, moving the note into a group, or a group handing its notes to an admin keeps that choice: when the link is turned on again, the page uses the same width.

**The content is a snapshot, not a live view.** Anonymous readers get the state the collaboration server last persisted — during active editing that lags the editors by roughly the persistence debounce (about 2 seconds, up to 10 seconds under continuous typing, flushed when the last editor disconnects). Reloading the page fetches a fresh snapshot. Live sync for anonymous readers is deliberately out of scope.

## Anonymous link and the custom public URL

On a personal note, while a public link is on, an **Anonymous link** toggle (on by default) controls the trade-off between two forms the same public URL can take (a group note's public link is always the anonymous token form):

- **Anonymous link on** (the default) — the URL is `https://your-host/p/<token>`.
- **Anonymous link off** — the URL becomes `https://your-host/p/<your-username>/<name-you-choose>` (a random name to start; you can edit it and save a custom one). It serves the exact same read-only page (including images) as the token URL.

Turning the toggle off doesn't add a second URL alongside the token one — it replaces which form the single public URL takes. What it changes is the trade-off:

- **Readable and memorable** — you can put it on a slide or say it out loud.
- **Guessable, and it reveals your username.** Anyone who can guess `/p/alice/roadmap` can read the note, and the URL itself tells them the note belongs to `alice`. For anonymous sharing, keep **Anonymous link** turned on.
- The custom-URL page carries the same `X-Robots-Tag: noindex` as the token page.
- Renaming your account (changing your username) kills the old custom URL immediately — old usernames are never forwarded — while the underlying token is unaffected. Once someone else takes your old username, the old custom URL leads to their note if they have one with the same custom name and a public link.
- Turning **Anonymous link** back on returns the URL to the token form; the custom name is unique per account: two of your notes can't share one, but another user's `roadmap` doesn't collide with yours.

## Revoking and regenerating

- **Regenerate link** mints a new token. With **Anonymous link** on, that's the whole story: the old URL stops working immediately (byte-identical 404 with any other unknown token) and the new one takes over. With **Anonymous link** off, it replaces **both** the token and the custom name — a new random name as well as a new token — so the exact custom URL that was leaked stops working too, not just its underlying token; the custom URL doesn't just point at the same still-guessable name with a fresh token behind it. Use it when a link has spread further than intended but you still want one.
- Switching to **Members only** or **Private** (on a group note, turning the **Public link** switch off) deletes the token — and the custom name with it, in the same update. The public endpoints answer 404 immediately (`Cache-Control: no-store` on the content response means no cache keeps serving it) — with one caveat: images an anonymous reader's browser has *already* downloaded may remain in that browser's cache, same as the revoked-member case in [known limitations](./known-limitations.md).
- Moving the note to the trash takes its public link offline — it answers like a link that doesn't exist — until the note is restored, which brings the link back unchanged; permanently deleting the note deletes the link with it.

Tokens are stored as-is (not hashed) so the dialog can always show you the current link — the trade-offs behind that, and the other sharp edges (what a Yjs snapshot exposes, cross-note images, the `TRUST_PROXY` interaction with the public endpoints' rate limiting), are collected in [known limitations](./known-limitations.md); the deployment side is in the [self-hosting guide](./self-hosting.md).