[DOCS] Describe workflow for amending changelog bundle notes

docs/cli/changelog/cmd-bundle-amend.md

@@ -11,6 +11,7 @@ Specify at least one of `--add`, `--remove`, `--description`, `--description-fil
 
 To create a bundle, use [](/cli/changelog/bundle.md).
 For details and examples, go to [](/data/release-notes/bundle.md).
+For changelog notes (`note-*.yml`) after a bundle has shipped, go to [](/data/release-notes/bundle.md#changelog-bundle-notes-after-ship).
 
 ## Output
 
@@ -127,6 +128,14 @@ docs-builder changelog bundle-amend \
 The CLI computes the checksum of the sourced YAML and matches it against the effective bundle (parent plus any existing amend files).
 If the bundle contains the file with a different checksum, or no YAML can be sourced (for example a git-ref entry that exists only in the bundle), the command fails unless you pass `--force` to remove by file name only.
 
+`--remove` works the same for a changelog note (`note-*.yml`). That does not unpublish the pool file. For late notes and the scrubber-owned `.amend-notes` sidecar, refer to [](/data/release-notes/bundle.md#changelog-bundle-notes-after-ship).
+
+```sh
+docs-builder changelog bundle-amend \
+  ./docs/changelog/bundles/9.3.0.yaml \
+  --remove /changelog/elastic/kibana/main/note-known-issue-aggregations.yml
+```
+
 ### Add multiple changelogs to a bundle
 
 Comma-separated list:

docs/cli/changelog/cmd-note.md

@@ -61,10 +61,17 @@ products:
 Upload is the same as for other changelog YAML files.
 An index at `changelog/{org}/{repo}/notes-{version}.json` lists every changelog "note" file that applies to each version.
 
-If the release bundle for that product and version or date has already shipped when you upload, the scrubber generates an amend file so the changelog reaches published docs without a manual rerun.
+If the release bundle for that product and version or date has already shipped when you upload, the scrubber generates a `{parent}.amend-notes.yaml` sidecar so the changelog reaches published docs without a manual rerun. Don't run `changelog bundle-amend --add` for that file. Refer to [](/data/release-notes/bundle.md#changelog-bundle-notes-after-ship).
 
 If there is no existing or planned bundle for that product and version or date, you can create a bundle from a path list that contains all the relevant changelogs. Refer to [Bundle by file paths](/cli/changelog/bundle.md#changelog-bundle-files).
 
+## Remove a note from a published bundle [changelog-note-remove]
+
+`changelog remove` only deletes local YAML. It does not change a published bundle or the changelog pool.
+
+- If the note is already in the parent bundle or a numbered `amend-N` sidecar, use `changelog bundle-amend --remove` and upload `{parent}.amend-N.yaml` with `changelog upload --artifact-type bundle`. Refer to [](/data/release-notes/bundle.md#changelog-bundle-notes-after-ship).
+- If the note exists only in `.amend-notes` (uploaded after the bundle shipped), no `changelog` command unpublishes it from the pool. Don't create, edit, or delete `.amend-notes` files.
+
 ## Configuration checks
 
 The same configuration-file checks that apply to `changelog add` apply here:

docs/cli/changelog/cmd-remove.md

@@ -7,7 +7,7 @@ Two mutually exclusive modes are available:
 - **Profile-based**: `docs-builder changelog remove <profile> <version|promotion-report>` — uses the same `bundle.profiles` configuration as [`changelog bundle`](/cli/changelog/bundle.md) to determine which changelogs to remove.
 - **Option-based**: `docs-builder changelog remove --products "..."` (or `--prs`, `--issues`, `--all`, `--release-version`, `--report`, `--files`) — specify the filter directly.
 
-Bundles are self-contained (every entry is embedded inline), so removing changelog source files never affects existing bundles or the `{changelog}` directive. The command deletes matching files without any bundle dependency check.
+Bundles are self-contained (every entry is embedded inline), so removing changelog source files never affects existing bundles or the `{changelog}` directive. The command deletes matching files without any bundle dependency check. That includes changelog notes (`note-*.yml`): local delete never drops a note from a published bundle or from a `.amend-notes` sidecar. Refer to [](/data/release-notes/bundle.md#changelog-bundle-notes-after-ship).
 
 For more context, go to [](/data/release-notes/bundle.md#changelog-remove).
 

docs/cli/changelog/cmd-upload.md

@@ -4,6 +4,8 @@ Upload changelog entries or bundle artifacts to S3 or Elasticsearch. The command
 
 A downstream scrubber copies published objects to the public bucket and removes pull request and issue links that are not on the allowlist (unlike bundle-time `# PRIVATE:` sentinels on the private side). Those public bundles are less likely to work with [`changelog unpack`](/cli/changelog/unpack.md).
 
+Uploading a `note-*.yml` file can cause the scrubber to create or update `{parent}.amend-notes.yaml` on the **public** bucket. This command does not write that sidecar. The command does not delete objects. There is no `changelog` subcommand that unpublishes a pool file. Refer to [](/data/release-notes/bundle.md#changelog-bundle-notes-after-ship).
+
 To create bundles first, use [](/cli/changelog/bundle.md).
 For the end-to-end workflow, see [](/data/release-notes/bundle.md).
 

docs/data/release-notes/bundle.md

@@ -329,11 +329,48 @@ Don't explicitly list the amend bundles in the `--input` option of the `docs-bui
 
 For more details and examples, go to [](/cli/changelog/bundle-amend.md).
 
+### Add or remove notes after a bundle ships [changelog-bundle-notes-after-ship]
+
+A changelog *note* is a `note-*.yml` file from [`changelog note`](/cli/changelog/note.md). Each product lists `products[].versions`. That file kind is not an entry `type` (notes still use types such as `known-issue` or `security`).
+
+When you create a release bundle from a PR list or GitHub release and the command is sourcing from the CDN, matching notes are already included. That automatic add does not apply to git-range bundles or `--force-local`. To build a bundle that contains only notes, use a [path list](/cli/changelog/bundle.md#changelog-bundle-files) (profile third argument or `--files`).
+
+#### Add a note after the bundle shipped
+
+1. Create the file with [`changelog note`](/cli/changelog/note.md).
+2. Upload it with [`changelog upload --artifact-type changelog`](/cli/changelog/upload.md), using the same path and credentials as any other changelog YAML.
+3. Stop. Don't run `changelog bundle-amend --add` for this file.
+
+The changelog scrubber writes `{parent}.amend-notes.yaml` (for example `9.3.0.amend-notes.yaml`) and merges it when the bundle is rendered. That suffix is reserved; you must not create, edit, or delete those files.
+
+#### Remove a note
+
+What you can do depends on where the note lives:
+
+| Where it is | What you can do today |
+| --- | --- |
+| Local file only; the bundle is not uploaded | [`changelog remove`](/cli/changelog/remove.md) or re-run `changelog bundle`. That never changes a published bundle. |
+| Already in the parent or a numbered `amend-N` sidecar | `bundle-amend --remove` on the `note-*.yml` path, then upload `{parent}.amend-N.yaml` with [`changelog upload --artifact-type bundle`](/cli/changelog/upload.md). |
+| Only in `.amend-notes` (uploaded after the bundle shipped) | No `changelog` command removes it from the published pool or that sidecar. Don't create, edit, or delete `.amend-notes` files. |
+
+Example of excluding a note that is already in the parent:
+
+```sh
+docs-builder changelog bundle-amend \
+  /bundle/kibana/9.3.0.yaml \
+  --remove /changelog/elastic/kibana/main/note-known-issue-aggregations.yml \
+  --output ./docs/releases
+```
+
+:::{warning}
+`changelog bundle-amend --remove` does not unpublish the note YAML from the changelog pool. If that file is still published, the scrubber can treat it as a late note and write it back into `.amend-notes`. A checksum-strict `--remove` may not hide that restored copy. There is no docs-builder command that unpublishes a pool file.
+:::
+
 ## Remove changelog files [changelog-remove]
 
 A single changelog file might be applicable to multiple releases (for example, it might be delivered in both Stack and {{serverless-short}} releases or {{ech}} and Enterprise releases on different timelines).
 After it has been included in all of the relevant bundles, it is reasonable to delete the changelog to keep your repository clean.
-Because bundles are self-contained, deleting changelog files never affects existing bundles or the docs built from them.
+Because bundles are self-contained, deleting changelog files never affects existing bundles or the docs built from them. That includes changelog notes (`note-*.yml`): [`changelog remove`](/cli/changelog/remove.md) never drops a note from a published bundle or from a `.amend-notes` sidecar. Refer to [](#changelog-bundle-notes-after-ship).
 
 You can use the `docs-builder changelog remove` command to remove changelogs.
 If you created profiles, you can use them like this:

docs/data/release-notes/create.md

@@ -58,6 +58,7 @@ If you already have automated release notes for GitHub releases, you can use the
 
      These files don't have `prs` and thus don't appear in a release's PR list.
      The `products[].versions` are used to add these files to release bundles automatically.
+     After you upload a note, if that product version's bundle has already shipped, the scrubber attaches it without `changelog bundle-amend --add`. Taking a note off a published bundle is incomplete: there is no command that unpublishes the pool file. Refer to [](/data/release-notes/bundle.md#changelog-bundle-notes-after-ship).
      :::
 
      Title, type, and products (including version or date) are the minimal details required when you are not deriving details from a PR.

docs/data/release-notes/overview.md

@@ -7,7 +7,7 @@ To use the `docs-builder changelog` commands in your development workflow:
 1. [Configure changelogs](/data/release-notes/configure.md): Create a configuration file, map labels, and define rules for creation and bundling.
 1. [Create changelogs](/data/release-notes/create.md) with `docs-builder changelog add` or `docs-builder changelog note` (depending on whether there's a PR associated with the change).
    - Alternatively, if you already have automated release notes for GitHub releases, you can use the `docs-builder changelog gh-release` command to create changelog files and a bundle from your GitHub release notes. Refer to [](/cli/changelog/gh-release.md).
-1. [Bundle changelogs](/data/release-notes/bundle.md) with the `docs-builder changelog bundle` command. For example, create a bundle for the pull requests that are included in a product release. When changelogs are no longer needed in the repo, [remove changelog files](/data/release-notes/bundle.md#changelog-remove) with `docs-builder changelog remove`.
+1. [Bundle changelogs](/data/release-notes/bundle.md) with the `docs-builder changelog bundle` command. For example, create a bundle for the pull requests that are included in a product release. To add or exclude changelog notes after a bundle has shipped, refer to [](/data/release-notes/bundle.md#changelog-bundle-notes-after-ship). When changelogs are no longer needed in the repo, [remove changelog files](/data/release-notes/bundle.md#changelog-remove) with `docs-builder changelog remove`.
 1. [Publish release notes](/data/release-notes/publish.md): Use the `{changelog}` directive in docs or `docs-builder changelog render` to produce release documentation.
 
 For more information about running `docs-builder`, go to [Contribute locally](https://www.elastic.co/docs/contribute-docs/locally).

docs/development/changelog-bundle-registry.md

@@ -74,8 +74,12 @@ narrowed reconciliation to the bundle tree):
   published bundle that lists all such late notes. The Lambda rebuilds it from current state on
   every reconcile, so redelivered events never produce duplicate amends. `{changelog}` `:cdn:` and
   `changelog render` merge this sidecar into the parent the same way as numbered `.amend-{N}`
-  files, after those numbered amends. The `.amend-notes` suffix is **reserved** — do not create
-  files with that suffix manually; see [](/cli/changelog/bundle-amend.md).
+  files, after those numbered amends. The `.amend-notes` suffix
+  is **reserved** — do not create files with that suffix manually; see
+  [](/cli/changelog/bundle-amend.md). Public copies track private-bucket create and delete
+  events. Authors cannot issue those deletes through docs-builder today: `changelog upload`
+  does not delete objects, and `changelog remove` is local-only. For the author-facing
+  add and exclude path, see [](/data/release-notes/bundle.md#changelog-bundle-notes-after-ship).
 - **Notes index** — `changelog/{org}/{repo}/notes-{version}.json`, one per version, **public
   bucket only**, produced by the scrubber Lambda's `NotesIndexReconciler`. See
   [Notes-index format](#notes-index-format) below.
@@ -144,7 +148,8 @@ For each release version that has at least one note, the scrubber Lambda writes
 
 `bundle_seq` is derived — it is never authored and never a latch. The Lambda recomputes it on every
 reconcile by comparing the notes index against the set of entries in the published bundle and its
-amend sidecars.
+amend sidecars. Do not hand-edit `notes-{version}.json` or `.amend-notes` sidecars. Authors cannot
+delete pool objects through docs-builder today.
 
 A 404 on a notes index means "no notes published for this version". An empty `notes` array never
 appears — the index is deleted rather than emptied, following the same