- Treat name.md.enc as encrypted notes; forbid coexisting twins sharing assets - Convert between plain and encrypted notes via PUT ?convertFrom - Store keyring at .rawmark/keyring.json with versioned writes - Allow permanent deletion of single asset files - Exclude encrypted notes from the search index