Disclosure is irrevocable

A document moves out of a private repository and into a shared one. Six people can now read it, and some number of them do. A week later somebody decides the move was a mistake, deletes the file, rewrites the history, and force-pushes. Ask what has been undone and the honest answer is narrow. The copy is gone. The reading is not.

Our workspace tooling refuses to blur that. Moving source across a read boundary produces a promotion event, and the contract for it has two fields whose values are constants rather than choices. The disclosure class is fixed at durable. The revocable flag is fixed at false. Not defaults, not an enumeration with a recommended member, but single permitted values, which means a document describing a promotion as reversible fails validation on its shape and never reaches anyone with standing to disagree with it. The boundary policy fails closed in the other direction too, refusing private-domain material that turns up in shared work with no promotion record behind it.

The mechanism is that the event is typed as durable and non-revocable in the format itself, so a system holding these records cannot represent a disclosure as undoable, because what the record describes is a reading and a reading has no artifact left to destroy.

That last clause is the whole of the argument, and it is worth setting beside the strongest counter-technique this corpus has published. Cryptographic erasure lets an append-only ledger forget a person completely. The personal content sits encrypted under a key held somewhere else, and destroying the key leaves the sequence and the hashes intact while the content inside becomes unrecoverable. It is a real capability with a real guarantee, and the reason it works is that it has a target. There is a specific object whose destruction accomplishes the erasure. Disclosure has no such object. When material crosses a read boundary the thing that happened is that a person’s attention, or a model’s context window, took it in, and there is no key, no vault, and no jurisdiction on which any destruction could operate. Erasure can destroy a key. A reading has no key to destroy.

Law reached the same wall from the other side and stopped at the same place. In the 2014 Google Spain judgment, the Court of Justice of the European Union granted a form of the right to be forgotten and granted it in a very particular shape. The search engine was required to delist the results, and the newspaper page they pointed at stayed lawfully published exactly where it was. The most powerful data-protection court on the continent, ruling in the complainant’s favor, could make the material harder to find and could not make it unread. Everything downstream of that judgment, including the erasure right written into European law four years later, inherits the same boundary.

What a system gives up by admitting this is the undo button, and the undo button is what people want. The compensation is that the recording budget goes somewhere useful. Because it cannot promise a takeback, the promotion record spends its required fields on the questions that still have answers, naming the source repository and its read boundary, the target repository and its read boundary, the identity of the material at both ends, the actor who moved it, and the exact commit on either side. After the fact the question is never whether it can be recalled. The question is what went, from where to where, and who decided, and a record built on the truth can answer that one completely.

There is a kind of relief in a system that stops pretending here. A promise of revocation is a promise about other people’s memories, which is not a thing anyone has ever been able to keep, and building on it quietly teaches everyone that disclosure is cheap and correctable. Building on the truth teaches the opposite, which is that the decision to let something be read is the decision, made once, at a specific moment, by a named person. Treat it that way and the moment gets the attention it always deserved.