Revoke what you already sent

Claim: the sender needs a local outbox

Relay indexes ciphertext; Inbox stays local drew the recipient boundary: delivery is not custody of pending Accept decisions.

Senders have a symmetric problem.

After you Share a Bank item to an accountant, or a Credential to a co-founder, two questions return: is that package still reachable, and what happened to it? Viewed? Accepted? Declined? Expired? Revoked?

Those answers belong in a sender outbox—a local read model of shares you created—not in a server-side “Sent” folder full of field-shaped JSON.

The claim: outbox tracks what left the vault; revoke hits hosted ciphertext where the transport allows; the edge never becomes a readable sent-mail archive.

Constraint: fire-and-forget is how shares haunt you

Encrypted handoffs often stop at “send succeeded.” The product shows a toast. The bytes leave. The owner is left with memory and hope.

That gap creates bad pressure.

If only the recipient’s Inbox exists, senders cannot close the loop. Support tickets become “did they get it?” Engineering invents a cloud query that lists pending shares by email. Suddenly the provider can read staging metadata that looks a lot like mail headers—and product pressure grows to store titles, previews, and “helpful” dumps.

If revoke is fake for every transport, users learn the wrong lesson. A .nt2share already copied to a USB stick cannot be remotely erased by wishing at an API. An honest product says which shares can still be killed (hosted link ciphertext, relay-held Mode A blobs still undelivered or within policy) and which cannot. Pretending every send is remotely wipeable is worse than a clear “file left your custody.”

If disposition lives only on the server, offline and multi-device sync fight the model. The vault that created the share may be offline. Another replica of the same owner may need the same outbox rows. The authoritative sender dashboard should be local SQLite that Premium sync can replicate as vault state—not a provider mailbox that becomes the source of truth for “what I sent.”

If outbox stores share passphrases “so you can remind the recipient,” custody flipped. The outbox is a status surface. It is not a password manager for disposable handoff secrets. Reminding someone of a share passphrase is an OOB human act; it is not a server feature that reconstructs package keys.

The constraint: closure without custody. Senders deserve status. Providers must not earn a readable archive of everyone’s disclosures.

Design: local rows, opaque relay disposition

NT²’s Share outbox sits on the sender device.

When you create a Mode A, B, or C share, the vault writes a local outbox row: what kind of share, when it was created, when it expires, opaque identifiers needed to correlate with the relay, and disposition fields that evolve over time—pending, viewed, accepted, declined, revoked, expired, and related states the product surfaces.

flowchart LR
  Create[Create share] --> Outbox[Local share outbox]
  Create --> Cipher[Ciphertext package]
  Cipher -->|Mode B hosted / Mode A relay| Edge[Blind relay index]
  Edge -->|opaque disposition| Sync[Status sync]
  Sync --> Outbox
  Outbox -->|revoke when possible| Edge
  Outbox -->|UI dashboard| Owner[Sender vault]

Local read model. The dashboard you open in the unlocked vault reads SQLite, not a provider inbox API shaped like email. Display names for Mode A recipients come from local Contacts—not from a cloud social graph.

Relay syncs disposition, not plaintext. For cloud-hosted links and relay-delivered Mode A packages, the edge may know enough to answer: still listed? revoked? expired? acknowledged? It does not need item fields, share passphrases, or master passwords to do that. Status sync updates local outbox rows from opaque metadata.

Revoke is transport-honest. One-tap revoke for hosted ciphertext removes or marks the blob unreachable at the relay when that is still meaningful. File shares that already left the device are marked for the owner’s understanding; the product does not claim magical remote wipe of every USB copy.

Inbox and outbox stay different jobs. Inbox is the recipient’s pending Accept surface (relay / Inbox). Outbox is the sender’s closure surface. Confusing the two words rebuilds a mail server under Share branding.

Security log is not the outbox. Append-only security activity can record that a share was created or revoked for audit. The outbox is the human dashboard—“did the accountant open it?”—with revoke controls. Both can exist; they must not collapse into one cloud table of readable events.

Trade-off: honesty about what revoke cannot do

A local outbox costs UI and sync work. Disposition states multiply. File and QR paths will not always offer post-delivery kill switches. Marketing cannot promise “unsend anything, anytime.”

We accept that honesty because the alternative is a fake cloud Sent folder. Readable sent-mail is how zero-knowledge Share becomes a disclosure archive with better encryption vocabulary.

When trust should end—block a contact, stop Mode A, expire a link—the outbox is where you see what is still live. The story half lives in when trust should end; this essay is the sender machinery behind that moment.

What we refuse

We refuse a server-side human-readable sent-mail folder of shares. Disposition metadata may be opaque; field plaintext must not become edge mail.

We refuse “forgot share passphrase” recovery via the outbox. Losing the passphrase ends that Mode B/C handoff—same fail-closed honesty as share passphrase ≠ master password.

We refuse pretending every transport supports post-delivery wipe. Revoke where ciphertext still sits under relay policy; tell the truth when a file already left custody.

We refuse storing share passphrases on the edge “to help the sender remind the recipient.” OOB reminder is human; package keys stay client-side.

We refuse making Accept a cloud procedure that rewrites a server mailbox. Accept stays local on the recipient; outbox only learns opaque outcomes the transport can report.

Close: send, then own the aftermath

Cross-vault sharing does not end when bytes leave. The sender needs an outbox that answers status without minting a provider archive. The recipient needs a local Inbox that asks Accept. The edge indexes ciphertext and disposition—nothing more.

Peer connections decide who Mode A can address—see a peer connection is not a phone contact. Outbox decides what still exists after you hit Share. Delayed legacy release, next in this series, stretches that idea across time: a package that must not open until inactivity says it may.

If you want Share with a sender dashboard that stays honest about revoke, explore NT² Vault.