A cloud edition can hide its arithmetic, and that is the whole risk of the migration.

What the spreadsheet enforced by accident

A workbook cannot conceal its arithmetic even if its author wants it to.

The current edition is inspectable partly by design and partly because the medium leaves no alternative. Every number sits in a cell, every cell shows its formula, and there is no mechanism by which a figure could arrive without a traceable derivation. The doctrine and the medium happened to agree, which meant the commitment cost nothing to maintain and was never tested. A platform removes that coincidence entirely: a rendered number carries no provenance unless someone deliberately builds provenance in.

Why it would be lost quietly

Nothing breaks when provenance disappears. The numbers still look right.

The failure mode has no symptom. A platform that computes correctly and shows only results is indistinguishable, from the outside, from one that shows its working — until an operator disagrees with a figure and finds there is nothing to examine. No test catches it, no user files a complaint about it in the first year, and every product decision under time pressure argues for shipping the number and adding the explanation later. That is exactly how the property gets dropped: not by a decision to abandon it, but by its never quite being the priority.

What carrying it actually requires

Every displayed figure has to be able to show where it came from.

Stated as a build requirement rather than a value, it means an operator can select any governance-relevant number and see the inputs and the operation that produced it, without contacting anyone and without taking the interface's word for it. That is a real engineering obligation with a cost attached to every panel, and it competes for resources with features that are visible and requested. Writing it down now, as a requirement inherited from the current edition rather than a nice addition to the next one, is the only thing that gives it standing in that competition.

The temptation the platform creates

A hosted system makes an opaque improvement cheap for the first time.

The current edition cannot easily adopt a technique whose derivation the operator could not follow, because the medium would expose the gap immediately. A platform can. Once figures arrive rendered, a fitted parameter or a learned classification is indistinguishable in presentation from a stated threshold, and it would very likely perform better on the metrics anyone measures. The constraint stops being enforced by the medium and starts requiring an explicit refusal — which is a materially weaker form of enforcement and worth acknowledging as such.

• The medium enforced the doctrine for free; the platform will not.
• The first opaque improvement will be a good one, which is what makes it dangerous.
• A refusal has to be made in advance, because it will be harder to make in the moment.

What genuinely improves

The gains are real and they are not in the doctrine.

None of this is an argument against the migration. Shared history across devices, calculation at a scale a workbook cannot reach, records that do not depend on a file surviving, and machinery that updates without the operator managing versions are all genuine improvements to how the system is operated. The point is only that they are improvements to the delivery and not to the doctrine, and that the doctrine is the part with no advocate in a feature discussion.

The key idea

Identify the properties your current medium was giving you for free.

Every technical migration carries the features that were designed and drops the ones that were incidental, because nobody wrote the incidental ones down. Here the most important property of the product — that its authority can be checked by the person it governs — was partly a gift of the medium. Naming it as a requirement before the medium changes is the only reliable way to keep it, and it is the single thing this vision has to get right.