Share without exposing your library
A shared article or summary should stand on its own. It should not turn a private reader profile into a public social graph.
Deliberate snapshots
The flow authorizes and snapshots only the selected article or eligible summary, with an unguessable hosted link and noindex metadata. Production email remains gated on provider and abuse evidence.
Revocable hosted access
Revocation can remove future hosted access and redirects. It cannot retract content that a recipient already received in an email.
Transactional delivery
Direct email sharing uses a durable outbox, permanent application idempotency, signed provider webhooks, suppression controls, and bounded application abuse limits. Live sending remains disabled until the provider gates pass.