I wonder, Ned, if this isn't more practicality than ownership model?
Does it matter? It would be pretty easy on some systems to have a "sender
ownership" model. In some cases it is probably simpler than a "receiver owns"
model -- it certainly would be on VMS, and VMS doesn't even use a shared
message copy scheme that would make it a *major* advantage.
I think the real problem is the practicality of the model itself. The bottom
line is that while users may like this as message senders, they certainly don't
care for it as message receivers. Most people receive more mail than they
ever send, so which is the more important role??
I wonder if some of us wouldn't welcome a brief (automatic) delay before
delivery in which we could cancel our error or hasty response. I don't
believe that such a thing would be contrary to the "ownership model" you
describe, especially if it was handled by my user-agent client, so as to
remove issues of authentication (at least sometimes) and ownership.
This sort of stuff just falls out of implementations that support disconnected
operation.
I note in passing that this sort of stuff is even supported in X.400 at the
transport layer -- there's a deferred delivery service element for it.
(Presumably I "own" my mail until it's been sent along its way by my user
agent, at least when that user agent is sitting on my desktop on my own
system.)
This is an entirely reasonable implementation strategy.
Ned