When you share a bill in HiBill, something small but real changes hands. The split stops being yours. Each person who opens the link decides what they had, and the number next to their name is theirs — not a figure you assigned them, but one they stated.
That turns out to matter more than we expected when we tried to build the way back.
The dead end
Until this week, sharing was a one-way door. You could turn sharing off, but that only killed the link. The bill stayed an open split forever: split controls hidden, no way to edit how it divided, no way to re-share from the bill itself. Just a lock with the key thrown away.
Nobody designed that. It is the shape you get when you implement "share" and "stop sharing" as two ends of a switch and never ask what the switch is actually for. Turning sharing off answers should new people be able to claim? It does not answer who owns the split now? — and we had quietly assumed the second question resolved itself along with the first.
It does not.
Two doors that look like one
Consider what the obvious fix would have been: make Stop sharing put the bill back the way it was. One button, no new concepts, dead end gone.
We came close to shipping exactly that. It is wrong, and the reason is worth spelling out.
Turning off a link and taking editing power over other people's claimed shares are different decisions with different stakes. The first is housekeeping — the dinner is over, no more claims needed. The second changes who gets to decide what someone owes. If Stop sharing did both, then a person tidying up after a meal would silently acquire the ability to rewrite what four other people said they had, having pressed a button that promised only to switch off a URL.
So they are two doors. Stop sharing ends the link. Take back control — a separate action, with its own confirmation — converts the bill back into an ordinary split you own.
What "taking control" actually costs
Here is the part we think is interesting: taking the split back does not move a single number.
Everyone keeps the amount they claimed. The unclaimed remainder, which was sitting implicitly with whoever paid, becomes an explicit line for the payer. The receipt items stay. Run the balances before and after and they are identical.
What changes is authority. Those amounts stop being self-claimed, which means you can now edit them.
That sounds like nothing, and it is the whole thing. A number someone chose for themselves and a number you assigned them are worth different amounts of trust, even when they are the same number. The ledger is only useful because both people believe it, and belief comes from knowing who was allowed to write what.
So the confirmation says exactly that, rather than something reassuring about nothing changing: everyone keeps their current amount, but shares stop being self-claimed — you'll be able to edit anyone's share.
Giving something back
There is a symmetry we only noticed while building it.
A self-claimed share has no approve-or-decline buttons on it. Why would it — you cannot dispute a figure you chose. That is your consent, already given.
But when the split comes back under your control, that reasoning collapses. The share is no longer something they chose; it is something you can now change. So taking control back returns the approve-or-decline controls to everyone on the bill.
You gain the ability to edit their share. They gain the ability to say no to it. Neither half works honestly without the other, and we would have shipped only the first half if we had not gone looking for what the change actually took away from people.
One case we refuse
If claims add up to more than the bill — two people both certain they had the expensive thing — you cannot take the split back until that is sorted.
We could have made the numbers fit. Scale everything down, or floor the payer's remainder at zero and move on. Both produce a bill that adds up and quietly misrepresents what people said.
An over-claim is a real disagreement between two humans. The right place to resolve it is between them, not inside an arithmetic fix-up that hides the conflict. So HiBill says no, explains why, and waits.
The general lesson
We keep finding the same shape. A feature has an obvious forward direction, someone builds it, and the reverse is left as an exercise — not by decision, just by nobody asking.
Then the reverse turns out to carry a question the forward direction never had to answer. Sharing only had to ask "who can see this?". Unsharing had to ask "who owns this now?", and there was no answer in the code because there had never been an answer in our heads.
The dead end was the symptom. The missing question was the bug.