A8 #311 (2026-07-28) — the missing own-note read.

Auth required, ANY tier (a private reading note is not a paid feature; require_min_tier is deliberately absent, so this route 401s for anon and never 402s).

Why this route exists. The annotation form pre-filled itself from the PUBLIC GET .../notes/{username} endpoint, which returns None for a private note by design (pg_get_reading_list_note filters is_public = TRUE so anonymous readers cannot probe for private notes). Private is the DEFAULT visibility, so the common case was: user writes a private note, returns to the entry page, sees an EMPTY textarea with no indication a note exists, types something, hits Save — and the (user_id, slug) UPSERT silently overwrites the note they could not see. Silent loss of user-authored content (feedback_user_trust). mcp_tools/writes.py already guarded the sibling half of this exact hazard by reading the existing row before its UPSERT; the browser path had no equivalent read.

Deliberately a SEPARATE path (/my-note), not /notes/me: a literal me segment would shadow a real user whose username is "me" on the /notes/{username} route, and route-order shadowing is invisible at review time.

Path is NOT the public URL shape — nothing here is indexable, and the response carries no-store so a shared cache can never hold one caller's private note.