Document LNURL mint kind and live probe notes.

Capture the NIP kind contract and wire-level NOTES so indexing and probing
can follow observed LNURL mint behavior rather than outdated assumptions.

Co-authored-by: Cursor <cursoragent@cursor.com>

NOTES.md

@@ -130,6 +130,38 @@ are matched by bare domain (too loose, a review of `mint.minibits.cash/Bitcoin`
 `mint.minibits.cash/Anything`). The new backend fixes both directions: one normalizer, path is part
 of identity, applied to mints and reviews alike (see `api/src/normalize.ts`).
 
+### The slug is deterministic, not reversible
+
+Found while building on-demand indexing (`POST /api/index`), which is the first thing that
+has to turn a *page address* back into a *mint address* rather than the other way round.
+
+`mint.example.com/Bitcoin` slugs to `mint.example.com-bitcoin`, and so would a mint whose
+hostname really is `mint.example.com-bitcoin`. Looking a row up is unaffected — both
+spellings are stored, and the slug column is what the lookup uses — but *indexing* from a
+slug means opening a socket to whatever it decodes to, and guessing wrong there means
+probing, and possibly listing, somebody else's server.
+
+So `addressFromSlug` (shared/src/indexing.ts) only derives an address from the one
+unambiguous shape: a plain hostname, optionally with the `-3338` port suffix. Anything
+else returns null and the 404 page says it cannot work the address out from the link
+alone, offering the dialog where a reader can paste the full URL including its path.
+The `lnurl-` collision prefix is deliberately *not* stripped there either: a slug only
+takes that prefix at insert time, so a link carrying one describes a row that already
+exists and never reaches that code, while a hostname that merely begins `lnurl-` is a
+real possibility.
+
+Two URL shapes that fought the normalizer while testing this, both now covered by
+`api/src/check-index.ts`:
+
+- **The port suffix round trip.** `https://smilemoji.cash:3338` slugs to
+  `smilemoji.cash-3338`, which reads as a hostname with a trailing number until you know
+  the rule. The derivation has to put the colon back, and only for a 2 to 5 digit tail.
+- **Case, scheme and trailing slash together.** `MINT.600.WTF`, `http://mint.600.wtf`,
+  `mint.600.wtf/` and `https://mint.600.wtf:443/` are one mint, and the endpoint has to
+  answer "already indexed" for all four rather than creating a second row. They collapse
+  in `normalizeMintUrl`, before the row is looked up and before the in-flight map is
+  keyed, which is what makes the dedup and the lookup agree.
+
 ## Old scoring
 
 `src/hooks/usePopularMints.ts`: