You Decide What Crosses

Lend somebody a book and they get the book. Not your other books, not the receipts, not the margins of everything else on the shelf. The loan has edges, and nobody had to negotiate them—you handed over one object and kept the rest because the rest stayed where it was.

Software forgot how to do this.

Share a document and you share the whole history: every revision, every comment you deleted, every version where the chapter was worse. Hand a project to a collaborator and they get the project, entire. The unit of sharing is the account, or the file, or the workspace—never the thing you actually meant to hand over. So people work around it. They copy the chapter into a new document. They make a “clean version.” They keep a private file the tool does not know about, which is the same move as keeping a diary in a drawer, and about as well supported.

We think the handover should have edges, and that the person making it should draw them.

Some of this is ordinary decency about privacy. Most of it is not. It is about who holds the boundary. There are two ways to keep a note private from the person reading your manuscript. You can send them everything and ask the software to hide part of it. Or you can not send that part.

The first is a permission: a setting we honour, enforced by us, revocable by us, dependent on our continued good behaviour and our continued existence. It works right up until a policy changes, a company is bought, or a checkbox is redesigned.

The second is arithmetic. The note is not there. Nothing has to be trusted, because nothing was transmitted.

We prefer arithmetic, and we would rather build the version that needs less faith in us. This is not modesty. A promise we make is a thing we could break, and the best way to be unable to break it is to have no way to.

That has a cost, and we would rather say it than discover it in a support thread: you cannot un-send. Deciding what crosses is a decision made once, at the moment of crossing, and there is no calling it back afterwards. A tool that implied otherwise—a revoke button, an expiring link, a “delete for everyone”—would be selling the comfortable lie. What left, left. We can make the edges easy to draw and impossible to draw by accident. We cannot make them retroactive, and we will not pretend.

The compensation is that this cuts the other way too. If what crosses is yours to decide, then what doesn’t cross needs no defending. Nobody has to trust our retention policy about a file we never received.

So: the work stays where you put it, and travels only the distance you send it. Not because we promise to look away, but because we are not standing there.