We decided to stop interrupting you

A plan is a hypothesis. Shipping is the experiment. This is the post where the experiment came back and told us our hypothesis was wrong — in a good way — and where a few systems quietly grew up because of it.

In the previous post we named the metric that decides the product: stale-audio duration, the milliseconds of narration that keep playing after your eyes move on. The original design had an obvious answer for it — drive it to zero. Cancel the current narration the instant the page moves, then re-anchor. Honest, crisp, zero stale audio.

The obvious answer was the wrong one

We built exactly that, and used it. And it felt worse.

Cancelling mid-sentence every time the page moved turned narration into a stutter. You’d get half a thought, a cut, half of the next one, a cut — a voice that never finished an idea because your eyes never hold perfectly still while reading. The metric was beautiful and the experience was choppy. We’d optimized the number instead of the feeling.

If you can’t zero it, bound it

Giving up mid-scroll cancellation meant stale audio was back — so we reframed the goal from eliminate to bound. Instead of cutting the voice off, we cap how long any single utterance can run. The richest mode had its per-response output ceiling lowered so the worst-case tail that plays after you scroll on is measured in seconds, not minutes. A short, complete thought you’ve half-outrun is fine. A two-minute monologue chasing your scrollbar is not.

The precise barge-in machinery from the last post — invalidate, cancel, truncate to the milliseconds heard, flush — didn’t get deleted. It got reserved. It now fires only when the previous narration is genuinely obsolete, and the trigger list is deliberately specific:

• cumulative scrolling crosses a real relocation threshold (not a nudge);
• you switch to a different app or window;
• you make a selection, copy text, or ask a question out loud;
• your pointer re-anchors to a clearly new region;
• the session ages out, or you pause or stop.

Everything else — the constant small motion of reading — is left alone.

The right amount of interruption wasn’t zero. It was “only when something actually changed.”

Memory that knows where it is

“Don’t repeat yourself” sounds trivial until you ask: the same as what? Scroll has to recognize when you’ve returned to a document so it can skip the parts you’ve already heard — but it must not confuse two different files that happen to share a window title. So document identity is graded by how much evidence it has:

• Hard identity — a stable URL or document reference the app exposes. Strong enough to carry forward exactly which passages you’ve heard, so a resumed document doesn’t re-read itself.
• Soft identity — a window title plus a fingerprint of the visible content. Good enough to bring related context forward, but deliberately not allowed to suppress that first fresh read, because a soft match might be wrong.

That distinction matters for trust: the cost of a false “I already read this” is silence where you wanted narration. So the system only stays quiet when the evidence is hard, and the HUD tells you whether you’re resuming a document or just seeing related context. All of this memory lives on your Mac, ages out on its own, and never leaves.

Private by architecture, not by promise

The same review forced us to be honest about the scariest thing Scroll does: read your screen. “We take privacy seriously” is a promise. We wanted it to be a property of the architecture instead — true whether or not you trust us. The methodology has a few load-bearing parts:

• Extraction is on-device. Turning your screen into text happens on your Mac. In cloud mode, only that narrated text goes out — and it goes from your machine to the model provider on your own key, never through a server of ours, because we don’t run one.
• An exclusion list with teeth. Name an app — your bank, your password manager — and Scroll refuses to capture from it. Sensitive categories are excluded by default, before you configure anything.
• Redaction before egress. Right before any text leaves the machine, a scrub pass removes emails, card numbers, and similar secrets. It runs in the one place all outbound text funnels through, so there’s no path that skips it.
• A live inspector. Settings shows the exact text that was sent — and a note for any image — before and after redaction, so you can verify every claim on this list yourself rather than taking our word.
• A real local-only mode. Flip one switch and nothing leaves your Mac at all: Apple’s on-device models do the comprehension and the system voice does the speaking. Lower fidelity, fully offline, zero egress.

Two corrections shipped straight out of holding ourselves to that standard. Passive cloud screenshots — sending an occasional image when text alone seemed thin — had been silently on; we made them opt-in, off by default, with a one-time reset for anyone already installed. And the free trial’s start date, which used to live where a reinstall could wipe it, moved into the Keychain so the trial can’t be reset by reinstalling. Neither is glamorous. Both are just correct.

What got built on top

With behavior and trust settled, the work turned to resilience, across a run of releases: clean session lifecycle and resume semantics; a realtime connection supervisor with audio-route handling and de-clicked barge-in, guarded by protocol regression tests so the event schema can’t silently drift; and the confidence-scored capture and per-app behavior matrix from the last post, because accessibility coverage varies wildly across real apps and pretending otherwise just ships bugs.

The throughline here is a habit more than a feature: let the thing you shipped argue with the thing you planned, and believe the shipped version. That same habit shows up again in how we built read-along highlighting — including the dead ends — which is next.