Permanence as a Design Constraint

The Central Question

A decision that can be revised is cheap to make. This is normally counted as an advantage, and for most decisions it is. Revisability lowers the cost of being wrong, so more things get tried, and trying more things is usually how anything good is found.

But there is a class of decision where revisability quietly removes the thing that made the decision worth making. A number that identifies a piece is only useful because it will not be reassigned. A record is only evidence because it was not edited after the fact.

So the question is: when is the inability to change something the feature rather than the cost?

Main Discussion

The answer seems to be: whenever the value of the thing depends on somebody else being able to rely on it.

This is a narrower condition than it sounds. Most design decisions are made for a user who is present — they can be asked, and if the answer changes, the decision can change with it. Permanence matters for decisions made on behalf of someone who is not present and cannot be consulted: the second owner, the person who inherits, the person verifying the piece in thirty years.

Those people cannot tell you what they need. What they can do is fail to trust the record, and that failure is invisible at the moment the decision is made.

There is a second effect, harder to argue for and in practice more useful. Permanence is a filter on ambition. A decision that cannot be undone is made more slowly and with fewer people agreeing to it out of politeness. Ideas that would have survived a revisable process — because nobody objects strongly to something they assume can be fixed later — do not survive this one.

The cost is real and should be stated plainly: some good ideas are also filtered out, because the difference between a good idea and a plausible one is not always visible in advance. Permanence does not select for correctness. It selects for conviction, and those are not the same thing.

Examples & Observations

An identifier that is never reused costs almost nothing to implement and forecloses an entire category of future convenience. You cannot tidy the sequence. You cannot close a gap left by a piece that was destroyed. The gap stays, and the gap is the record.

A published date that is never backdated has the same shape. It makes the timeline occasionally embarrassing — some things took much longer than they should have — and that embarrassment is precisely what makes the rest of the timeline believable.

An observation that has held up: the parts of a system people trust are almost always the parts that are visibly unable to flatter their owner. Anything that could have been quietly adjusted is read, correctly, as something that might have been.