Someone Dropped Out of the Secret Santa: How to Repair a Draw

Repairs are priced in edges

A draw is a set of facts of the form Ana gives to Ben. Call one an edge: a twelve-person draw has twelve, and is one of 176,214,841 possible draws. Judge a repair by one question — how many edges does somebody learn that they did not have, and who?

Two of those four are cooperative protocols, not cryptographic ones. They work because the group knows each other and reads the same thread. Anyone can post a false announcement and nothing in the maths prevents it; the defence is social — it lands where the person it names can object. Where that is not true of your group, redraw, which asks nobody to be honest.

While the draw tab is still open, the repair is free

The results screen says the page holds the draw in memory until you close it, never displaying it, writing it down or sending it anywhere. Holding it for the life of the tab is what makes a repair cost nothing.

At that stage a leaver costs one message to one person. Whoever drew the leaver takes the leaver's recipient instead and gets a fresh sealed link; every other link is untouched. Nothing is announced and no edge changes hands outside the page. A late joiner is the same shape, at two links rather than one.

Simpler still, and always available while the tab is alive: correct the list of names and seal again. That is a redraw rather than a splice, so everybody needs a new message, but zero disclosure either way. The option ends when the tab does — there is no server holding your draw, and nothing to log back into.

Someone drops out after the tab is gone

Removing one person breaks a draw in two places. The leaver was giving to somebody — call her Jo — and somebody was giving to the leaver. Now Jo has no gift coming, and whoever drew the leaver has one with nowhere to put it.

The repair costs one announcement, made by the person who is leaving anyway. They post to the group: I'm out. I had Jo, so whoever drew me, Jo is yours now.

That is the whole protocol. Whoever drew the leaver reads it, says nothing, and gives to Jo instead. They are never identified: not to Jo, not to the leaver, not to the group. The group learns one edge, and it is a dead one, because that gift will not now happen. Live edges disclosed: zero. Post it to the group, not to the organizer: nobody knows who drew the leaver.

One honest footnote: everybody now knows Jo's giver is not the leaver. At twenty people that is worth nothing. On small lists it is worth more, because small draws leak anyway: four people have only nine possible draws, and below five anyone who opens their own link can work out most of the rest — the generator says so on screen. Below about six, redraw.

Someone joins after the draw

A late joiner breaks nothing, which is why it feels easier than it is. The draw is complete; there is no room in it, and making room means breaking an edge that already exists.

The cheap version costs one person one fact, and that person volunteers for it. Ask in the group: we have somebody new, who is happy to swap? One volunteer answers, tells the new arrival privately who they had, and gives to the new arrival instead.

The books balance: the volunteer's old recipient still gets one gift, the new arrival gives and receives, and every other sealed link stays correct. The price is one live edge — the new arrival gives to the volunteer's old recipient — and the volunteer is the one who learns it. The new arrival, in turn, works out what the volunteer had. Two people know one thing about each other, and the group knows which two.

That is why it is done by a volunteer, out loud, rather than quietly by the organizer. Somebody has to hold the extra fact, and naming who is the difference between a disclosed cost and a hidden one. If nobody volunteers, redraw.

The redraw, and what the draw ID does not prove

Redrawing is always available, and it is the right answer whenever the priced repairs do not fit: too small a group for a splice to stay quiet, two people gone, no volunteer. It costs one announcement and one new message per person, and nobody a fact.

What makes it clean is the draw ID: four random bytes shown as eight hex characters, printed on the organizer's screen and on every reveal page. Any link showing 9C4A2F71 is dead, use the one sent today is unambiguous in a way that ignore the earlier link is not.

Be exact about what that ID is. It tells a participant two links came from the same run. It does not prove the draw was fair, does not prove it was valid, does not prove nobody looked, and anyone who can make a link can make one bearing it — in a Quick draw the key travels inside the link, so minting one is free. Use it to tell rounds apart and nothing else.

Lost links, and the copy you were made to take

"I can't find my link" is more common than a drop-out and has a shorter answer. If the draw tab is still open, re-seal that person's link and change nothing else. The old one keeps working too, because nothing stores it and nothing can revoke it: both open the same name.

If the tab is gone, you still hold the copy the tool made you take before it would show the send list: the copied block, the text file or the printout. Every sealed link sits beside the name it belongs to, so resending one is a single paste — but only ever back into the thread the original went to, never to a fresh message or a forwarded request, because a Quick link opens for whoever holds it and "I lost mine, can you resend?" is the cheapest way to ask you for somebody else's.

If the copy and the tab are both gone, redraw. There is deliberately nothing else, because the alternative would be a server of ours holding your draw. Tell participants not to screenshot the reveal page as a backup: that writes a recipient's name into a camera roll and usually a cloud photo library. The page offers the un-stripped link instead.