Part 7: What happens when your box goes away

Post 7 of a series introducing Mesaĝkesto, a protocol for secure messaging between self-certifying identifiers.

Time for the objection.

Everything in this series has leaned on a box: a place on the internet that holds messages until you collect them. Which means there is a machine, run by somebody, that your communication depends on. If it's down, you're not receiving. If it's gone, whatever it was holding is gone with it. Post 1 sold you a protocol with no landlord and then handed you a server. That objection is correct, and it deserves a straight answer rather than a deflection. The answer starts by splitting the failure in two, because "unavailable" and "gone" are entirely different problems and conflating them is how systems end up over-engineered in the wrong direction.

Two failures, not one

Your box is down for a while. Nobody can deposit into it; you can't drain it. Senders' boxes hold their outbound traffic and retry, so most of what was sent arrives late rather than never. You are, for that period, uncontactable — the same way you're uncontactable when your phone is off, except it isn't your choice. This is an availability problem, it's annoying, and it's the ordinary condition of all infrastructure.

Your box is gone permanently. Shut down, seized, bankrupt, or it simply stopped paying its own bills. This is the failure that decides whether the premise of this series was real, so let's do the accounting properly: what exactly did you lose?

What was in there anyway

Go back through what each part of the system actually holds.

Your identity isn't there. It's keys you control and a log about those keys. The box was a pointer in that log, not a component of it. Losing it doesn't touch who you are — this is Part 2's payoff, and it's the reason the rest of the accounting comes out well.

Your conversations aren't there — or not only there. Every message is a signed event, and everyone in a conversation collects the ones addressed to them. A 1:1 conversation exists in two copies; a group exists in as many copies as it has members. The box held them briefly on the way through. If it evaporates, the record is still in the hands of the people who were part of it, which is a considerably better replication strategy than trusting one operator with the only copy, and it's how correspondence worked for several centuries before we forgot.

Your contacts aren't there.Part 4 saw to that: the box held a bag of opaque tokens it couldn't interpret. Your actual contact list was never uploaded, so there's nothing to lose.

What genuinely is lost: anything the box was holding that had not yet been collected by anyone. Messages that arrived while your devices were offline and died with the box. That's a real gap, it's bounded by how long your devices were away, and it's the honest cost. So the damage from a permanent failure is: some in-flight messages, and the inconvenience of moving. Compare that to a messaging account being closed today, where the damage is your name, your contacts, your history and your reachability, all at once, permanently.

Standing it back up

Recovery, concretely.

You pick another box. You publish a new signed line in your key event log (KEL) saying so. Every correspondent's box resolves your KEL the next time it delivers and finds the new answer — nobody has to be notified, no forwarding address exists, nothing about your identifier changed. Part 6's routing does this without being asked.

Group conversations recover the same way, from the participants rather than from the operator. Any member who still holds the history can re-establish the channel on a new box and replay the events into it; everyone else re-syncs from wherever they had got to, using the same "give me everything after N" that post 3 uses for a phone that's been in a drawer. Recovery isn't a special mode — it's ordinary catch-up pointed at a new address.

Public channels get the strongest version of this. Because every entry is signed and verifiable independently of where it's served from (part 5), anyone who cared enough to keep a copy can serve the archive, and readers can confirm it's genuine. A publication outlives its publisher's hosting arrangements. Not as a favour, and not requiring the original operator's cooperation.

The economics this creates

Now the part that matters more than the mechanics.

When leaving costs nothing, every provider is permanently auditioning. If your box gets slow, raises prices unreasonably, starts behaving in ways you dislike, or simply annoys you, you move — and you keep your name, your contacts, your groups and your history. The switching cost is a signed line in a log and a few minutes.

Think about what that does to the business. Nobody can build a plan on customers who can't leave, because they can. The things left to compete on are the things a buffer should compete on: uptime, latency, capacity, how long it keeps your messages, what jurisdiction it sits in, whether support answers, whether the operator is someone you'd want holding even the metadata. Those are service qualities, and service qualities are a healthy market.

It also makes paying for it honest. A box that keeps everything indefinitely at no charge is not a gift — Part 3 said it and it's worth repeating here, because this is where it bites. Storage costs money; if you're not paying, the payment is your data, your attention, or an eventual pivot. Charge for a buffer directly and the deal is legible: this much space, this much retention, this much throughput, this price. Different boxes will sell different bundles. Some will be free with tight limits, which is fine when the limits are stated rather than compensated for elsewhere. And it changes who can plausibly run one. A box does very little (part 3), and it learns almost nothing (part 4) — so running one isn't a licence to build a social network, it's more like running a mail relay or an NTP server. A telco, a bank, an ISP, a university, a municipality, a hospital, an employer, a housing co-op, a family with a spare machine: any of them can host boxes for the people they already serve, without becoming a platform, because there's no platform to become. Institutions that would never be trusted to run a social network can perfectly well be trusted to run a buffer that can't read anything.

That is what commodity infrastructure looks like, and it's the same shape as the post office in Part 1: many operators, one protocol, universal reach.

What's still hard

Availability is not solved by portability. Everything above is about permanent loss. For an outage on a Tuesday, the honest answer is that you wait, or you keep more than one box — which the protocol permits, since your log can publish more than one place to reach you, but which is not yet the smooth, automatic, no-thought-required experience it should be. Redundancy is available; convenient redundancy is engineering work that isn't finished.

Somebody has to have kept the history. Conversations survive in participants' hands — so if every participant has lost every device, the conversation is gone regardless of how many boxes were involved. Device backup is therefore load-bearing, and backup UX is a genuinely hard problem that this protocol does not magically improve.

The in-flight window is real. If your box dies while messages are sitting in it undelivered, those are lost. Senders' retries cover the temporary case, not the permanent one.

Concentration is still possible.Part 6 said it and it stands: nothing stops everyone choosing the same three boxes. What's different is that concentration can't harden into capture — a provider who accumulates users without accumulating lock-in has market share, not hostages, and market share that can leave on a Tuesday behaves very differently from market share that can't.

The point of the whole thing

Here's the test I'd apply to any communication system, and it's the reason this post exists rather than being a footnote:

If the company running it disappeared overnight, what would you lose?

For everything most people use today, the answer is: your identity there, your contacts, your history, your reachability — everything except the memories.

For a box, the answer should be: some undelivered mail, and an afternoon.

That gap is what "platformless" actually means. Not that no servers exist — they obviously do, someone has to hold the letter between the writing and the reading — but that no server is in a position to hold you.

Next, and last: What we haven't solved — the metadata that survives all of this, and the key-loss problem nobody should pretend is finished.