Export Tisty

PRIVACY.md

@@ -37,6 +37,7 @@ What you can choose, and what each implies:
 | **A folder your cloud client keeps in step** (Google Drive, OneDrive, iCloud, Dropbox, pCloud…) | That provider, under their terms and their jurisdiction |
 | **A folder on hardware you own** (a NAS, an external drive) | Whoever can reach that hardware |
 | **A backup zip you keep somewhere** | Wherever you put it |
+| **A `.tistyx` parcel of documents you hand to somebody** | Them, and whoever they hand it to. You decide what goes in it and when |
 
 For syncing, Tisty only ever reads and writes local paths. It has no network
 code for it, no credentials, and no idea which provider — if any — is behind the
@@ -66,6 +67,15 @@ visible instead of making it for you.
   identifier itself does appear in the shared folder — it names your device's
   directory and stamps every event — because that is what tells two writers
   apart. What must never be shared is the file that binds it to this machine.
+- **An alias, if you write one** — it exists so that a document you share still
+  says who wrote it. It is optional, it lives in the log like everything else,
+  and so it reaches your other machines through the folder you sync and travels
+  inside any parcel you hand out. It goes out with the sync before you share
+  anything, which is why it should be a name you are content for others to read.
+  A log only ever grows: an alias you write today can be changed tomorrow, but
+  the old one stays written. Your real name and your address are **not** asked
+  for anywhere, and the two fields reserved for them in the log are written by
+  nothing in this version.
 - **The time zone you were in** — every event carries the IANA zone of whoever
   wrote it, so an hour reads back where it happened instead of drifting when you
   travel. It goes to the shared folder with the rest, and a long enough history

README.es.md

@@ -402,6 +402,16 @@ columna con de qué va el documento, el formato que el menú `/` escondía y su
 índice. **Tisty genera su propio PDF** —A4, Carta o una hoja sin fin, con sus
 propios márgenes y los adjuntos dentro— y te lo enseña antes de exportarlo.
 
+**Y salen enteros.** Un documento se copia como Markdown, se escribe en una
+carpeta con sus páginas y sus adjuntos al lado, o se exporta para Tisty en un
+archivo `.tistyx` que además guarda lo que el Markdown no sabe decir: las
+carpetas con su orden, su icono y su color, de qué documento cuelga cada
+página, qué está archivado y con qué alias se firmó. Así se mudan tus
+documentos a otro equipo o llegan a otra persona que usa Tisty; dentro no viaja
+ni una línea del historial. Si escribes un alias —opcional, y solo tú decides
+cuál—, cada documento queda firmado con él, y lo que te llegue de otra persona
+conserva el suyo.
+
 ![Documentos en Markdown, con adjuntos](assets/Store/jpg/es-03-documentos.jpg)
 
 **Un atajo global** abre un campo pequeño encima de lo que estés haciendo, así

README.md

@@ -402,6 +402,16 @@ outline. **Tisty makes its own PDF** — A4, Letter or one endless sheet, with i
 own margins and the attachments carried inside — and shows it to you before you
 export it.
 
+**And they leave whole.** A document copies as Markdown, writes out into a
+folder with its pages and attachments beside it, or is exported for Tisty into a
+`.tistyx` file that also carries what Markdown cannot say: folders with their order,
+icon and colour, which document each page hangs from, what is archived, and the
+alias it was signed with. That is how your documents move to another machine
+or reach somebody else who uses Tisty, and not one line of the history travels
+inside it. Write an alias — optional, and yours to choose — and every
+document is signed with it, while whatever arrives from somebody else keeps
+theirs.
+
 ![Documents in Markdown, with attachments](assets/Store/jpg/en-03-documents.jpg)
 
 **A global shortcut** opens a small field over whatever you are doing, so a task

SECURITY.md

@@ -116,6 +116,24 @@ Being explicit here matters more than sounding reassuring.
   outright — that removal is absorbing, so a removed identifier is never valid
   again and a machine that returns comes back as a new one.
 
+- **A parcel of documents is a file somebody hands you**, and it is treated as
+  such. Every path inside the zip must be an ordinary relative path under
+  `docs/` or `attachments/` — anything climbing out with `..`, an absolute path
+  or a drive prefix is dropped rather than written. The names written in the
+  manifest go through the same door as any other document name, so a manifest
+  cannot point the reader at a file elsewhere on your disk. The manifest itself
+  is read under a ceiling, and so is the parcel: bytes actually written are
+  counted rather than the sizes the archive declares, and both the number of
+  files and the number of entries in the manifest are capped. A folder name or
+  an alias arriving inside is trimmed to the same limits the window applies, and
+  an icon or a colour it does not recognise is dropped instead of stored.
+
+  What a parcel cannot do is prove who wrote what: anyone can edit the manifest
+  in a zip. Tisty decides what came from elsewhere by the identity of the store
+  that sent it, not by the name written inside, so a parcel never quietly turns
+  somebody else's writing into yours — but a name in a parcel is a claim, not a
+  signature, and nothing here verifies it.
+
 ## An assistant, if you admit one
 
 Tisty speaks MCP so an assistant already running on your machine can file work