M9: team links the list no longer hands out are removed at startup; a team link is made before the list changes

docs/collab-protocol.md

@@ -684,7 +684,8 @@ resuming with its offline edits, and leaving the session going back to snapshot
 - **Revoking.** Revoking a link (`Admin revoke`) that leaves the file without a coded link revokes
   its team links too, in the same answer (`Handled::revoked` names every link revoked), so whoever
   joined with one is disconnected. Admission refuses a team link while the list is off, gives
-  another access, or the file isn't shared, whatever `links.json` still holds.
+  another access, or the file isn't shared, whatever `links.json` still holds, and the server
+  removes such team links when it starts.
 
 *Built* (document sync between apps):
 

docs/server.md

@@ -193,7 +193,9 @@ someone in, so keep it off on a server open to anyone.
   `<web_url>#join=<the link, escaped>`, which opens the file in the browser.
 - **Stopping.** When the last of a file's links with a code is revoked (Stop sharing does), its
   team link is revoked with it and whoever joined with it is disconnected, as with the other
-  links. Turning the list off, or changing `team_files`, refuses the old team links at once.
+  links. Turning the list off, or changing `team_files`, refuses the old team links at once, and
+  the next start removes them for good (setting it back doesn't bring them back; the next join
+  makes a new one).
 - **What the server keeps.** Unlike other links, a team link's token is kept readable in the
   file's `links.json`, so the server can hand it out: as private as the server key beside it.
 - **Upgrade note.** An app older than the team list shows no list and can't open its links (it