Share without exposing your library
Sharing is an optional action from the reader, not a social network built around your subscriptions.
Deliberate snapshots
The flow authorizes and snapshots only the selected article or eligible summary, with an unguessable hosted link and noindex metadata. Production email remains gated on provider and abuse evidence.
Revocable hosted access
Revocation can remove future hosted access and redirects. It cannot retract content that a recipient already received in an email.
Transactional delivery
Direct email sharing uses a durable outbox, permanent application idempotency, signed provider webhooks, suppression controls, and bounded application abuse limits. Live sending remains disabled until the provider gates pass.