- Shipped
- August 19, 2026 at 6:38 PM UTC
- Author
- Kamo
- Commit
- 92d6104
A note whose body cannot be deciphered came back with content null and nothing else, which is exactly what an empty note looks like on the wire. Clients could not tell the difference, and the one that mattered - the editor - resolved it the destructive way: it treated the blank as an unsaved edit and autosaved it over the ciphertext it had failed to read. NoteDTO now carries decryptionFailed so unreadable is a state a client can see and refuse to write to. Also corrects Note#user's doc: content keys are derived from the member id now, matching the scope, not from the account.