Findable, Accessible, Interoperable and Reusable
12.1Storage versus retrieval
Physical retention is the weakest of the properties the archive needs. Object N-v1 contains the 18:00 closing announcement, and N-v2 announces 19:00; keeping both sets of bytes intact says nothing about which one a reader can obtain, or whether the reader can obtain the one they intended. A stored object may simply fail to load, sit behind credentials the reader lacks, or be buried under an index that resolves to the wrong entry. Retrieval is therefore an achievement of a particular reader under particular conditions, not a property conferred by storage alone.
Version identity is where this gap becomes consequential. A maintained current-hours summary should say which announcement it uses, because "the closing time" is ambiguous once v1 and v2 both exist; a historical account may accurately cite v1 for the earlier day. Both can be correct, but only if the retrieval path names the version sought. An identifier that resolves to metadata while the underlying document requires permission illustrates the separation neatly: existence, retrievability by a named reader, and permission to reuse are three different properties, and satisfying one leaves the others open.
Retrieval of a record is distinct again from retrieval of a reason. An edit log can recover the removed 18:00 closing time as the content of v1. If the log never recorded why an editor chose that change, the motive is not sitting in storage waiting to be found. A later reader may reconstruct a plausible explanation, but must label it as inference; the absence of a recorded rationale cannot be repaired by better indexing of the bytes that remain.
The relevant limit follows: keeping originals preserves the raw material for later retrieval and for correcting a misidentified version, but it does not make the intended version available to a given user, nor recover interpretive alternatives that were never written down. Storage enlarges what might be recovered; it does not determine what is recoverable, by whom, or with what warrant.
Once the intended version has been separated from mere physical survival, the archive's later uses come into view. If, as stipulated, only designated auditors and the responsible steward may inspect N-v1 while ordinary readers receive metadata only, the stored original can still support internal audit. Those inspectors can verify that an 18:00 closing announcement existed and that a later version, N-v2, announced 19:00. Public inaccessibility therefore limits what an outside reader can retrieve, but it does not make the stored bytes useless for the narrower purpose of checking the record's history.
The distinction matters when summaries are maintained. A current-hours summary should identify which announcement it uses: a summary built from N-v2 reports 19:00, while a historical account may accurately cite N-v1 and its 18:00 closing time. The stored original gives auditors a basis for checking that choice even when the identifier resolves to metadata alone and the underlying document requires permission. Here storage supports verification of the selected source; it does not by itself grant a general reader permission to inspect or reuse that source.
The audit function is also bounded by what the record preserves. An edit log may recover the removed closing time because the transformation is identifiable: 18:00 was replaced by 19:00. If the log never recorded why the editor made that change, later readers must not present an inferred motive as a retrieved one. The alternative explanations remain interpretive possibilities, not recoverable records.
So the practical scope is uneven. Restricted originals can support internal correction, provenance checking, and reconstruction of documented edits, subject to the archive's retention rules and the inspectors' authorized access. They cannot supply unrecorded reasons, guarantee public retrieval, or keep material available after retention expires. Keeping the original widens what can be audited; it does not erase the separate conditions of access, identification, and interpretive reconstruction.
12.2Links and permissions
A link that resolves is not yet an open door. Stipulate an identifier for archive object N-v1 that resolves to metadata describing the 18:00 closing announcement, while the underlying document itself requires permission. Three properties then separate cleanly. The object is identified through retrievable metadata; permission governs access to its body; successful retrieval also requires the document and the necessary technical route to be available. A live link and permission are distinct conditions for this route, not a sufficient guarantee that inspection succeeds.
The distinction also changes what preservation promises. Preserving the bytes of N-v1 and N-v2 would not itself give every reader access to them. A maintained current-hours summary should identify which announcement it uses; if it follows N-v2's 19:00 time, it needs that pointer to remain resolvable and the relevant source to remain viewable by whoever checks the summary. A historical account that accurately cites the 18:00 announcement in N-v1 likewise depends on retrievability by the particular reader it names, not on universal visibility. In both cases the recoverable item is an identifiable source for a claim, and that recovery presupposes both a working link and some permission to view.
This also bears on the edit log that recovers the removed closing time. Even where a permitted editor can trace the change from N-v1 to N-v2, the log supplies a transformation, not a motive: if it never recorded why the editor made the change, an inferred reason must not be presented as a retrieved record.
None of this establishes that any particular access arrangement is FAIR-compliant; that would require checking the whole specification. FAIR permits necessary authentication and authorization, and persistent accessible metadata when data are unavailable (Wilkinson et al., 2016; addendum 2019). These provisions distinguish the availability of descriptive information from unrestricted access to the underlying object. What viewing permission authorizes is the next matter.
Suppose the archive's metadata record for N-v1 is reachable through an identifier that resolves cleanly, while the underlying document itself sits behind a permission requirement. Suppose further that a named researcher is granted that permission and reads both versions: v1 announcing an 18:00 closing and v2 announcing 19:00. The grant settles what the researcher may inspect. It does not by itself settle what the researcher may do with what is inspected.
The distinction between permission to view and permission for further use matters when the material moves to a new purpose. A historical account may accurately cite v1's 18:00 announcement as the text in force at the earlier date. A maintained current-hours summary faces a different obligation: it should identify which announcement it uses, and a summary presented as current should not silently rest on the superseded v1. Under the stipulated access arrangement, permission to view the object does not itself grant permission for every further use. Separately, presenting an outdated announcement as current can mislead readers even if its reproduction is allowed. The example distinguishes the scope of its granted permission from the accuracy of the resulting service; it supplies no general legal rule about quotation or reuse.
The same discipline governs what the archive preserves. An edit log can recover the removed closing time because the change is recorded as a change. If the log never recorded why an editor chose that change, it can recover the earlier text and the transformation between texts, but not the editor's reason. A reader who infers a motive—disregard for accuracy, say, or an attempt to mislead—has produced an interpretive hypothesis, not retrieved a record. Even if later evidence suggested that motive, the archive would still hold the edit without the explanation.
Keeping originals therefore yields several distinct kinds of recoverability: bytes that remain stored, sources a named party may reach, transformations that were logged, and alternatives that can be reconstructed. Permissions and provenance help determine which routes are available to a reader; actual retrieval also depends on the relevant records and technical access remaining available.
12.3Recovering an omitted distinction
An omitted qualification is recoverable when the correct original both remains accessible and can be identified as the right one. Suppose the maintained current-hours summary reports 19:00 while omitting that this reflects a later announcement. Object N-v1 records the earlier 18:00 closing, and N-v2 records 19:00. Because both objects survive and each is identifiable as the announcement it is, the omitted qualification—"this figure follows N-v2"—can be restored to the summary. A historical account may meanwhile cite N-v1 accurately, provided it says which announcement it uses.
The inferential step is modest but real: once the relevant transformation is identifiable, the earlier wording can be brought back alongside the current one, and the summary can state what it previously left implicit. This requires more than bytes still existing somewhere. Stored bytes, an accessible source, an identifiable transformation, and a recoverable interpretive alternative are four different achievements. In the stipulated case, an identifier may resolve to metadata while the underlying document requires permission; existence of the record does not by itself give a named reader retrievability, and neither property supplies permission to reuse the material in a new purpose. Recovery here means that the distinction can be retrieved and correctly attributed, not that any reader may publish it.
The limit concerns what the record contains. An edit log can recover the removed 18:00 closing time and show that it was changed to 19:00. If the log never recorded why an editor made that change, later readers cannot convert a plausible motive into a retrieved one. The qualification that survives is the textual and archival one: which announcement each figure rests on. If access to N-v1 were withdrawn while only its identifier and the edit log remained, the claim that 18:00 once stood would rest on those surviving traces rather than on renewed inspection of the original.
Recovering the words in this way does not yet settle what they signify. That is a separate question.
Suppose the omitted qualification turns out to be the difference between the two closing announcements in object N-v1 and N-v2. Once the correct original is accessible and identifiable, the removed 18:00 closing time can be reinstated as a recovered textual fact. That recovery answers a narrow question: which words were present in a particular version. It does not by itself answer what those words should now do.
The distinction matters because retrieval and application pull apart. A maintained current-hours summary should identify which announcement it uses, whether the 18:00 announcement from N-v1 or the later 19:00 announcement from N-v2, rather than silently choosing between them. A historical account, by contrast, may accurately cite N-v1 as what was said at the time. Both uses draw on the same recovered text, yet they support different claims. Agreement about the recovered words therefore leaves the question of significance open: a reader may accept the closing time as authentic and still dispute whether it governs present hours or documents past practice.
Scope also has to be separated from availability. An identifier may resolve to metadata while the underlying document requires permission to open. In that case, existence, retrievability by a named reader, and permission to reuse come apart; any claim of recovery must say which of these it asserts rather than letting "preserved" cover all three.
The same limit applies to motivation. An edit log can recover the removed closing time, but if it never recorded why an editor made the change, a later reader must not convert an inferred motive into a retrieved record. So keeping the original makes interpretive alternatives recoverable, not settled: the archive preserves the grounds on which readers can disagree, while leaving the basis of each inference visible.
Where a later summary also has an unlogged grouping choice, the resulting uncertainty belongs to a separate problem.
12.4Unlogged editorial choices
What the archive retains is first a matter of stored bytes: original questions, summaries and version pointers survive as objects. Access is a separate property. An identifier may resolve to metadata while the underlying document still requires permission, so existence, retrievability by a named reader, and permission to reuse cannot be collapsed into one status. Where retrieval succeeds, the preserved record establishes what was stored and who may reach it, not the reasoning that shaped the result.
The closing-time case shows the contrast. N-v1 carries the 18:00 announcement and N-v2 the later 19:00 one; a maintained current-hours summary should identify which it uses, while a historical account may accurately cite v1. An edit log can recover the removed closing time, so the transformation is identifiable: 18:00 was replaced by 19:00. Now suppose the editor's grouping of these announcements under a single summary heading was never logged. Then, conditionally, grouping by subject, by document order or by recency would each fit the surviving summary equally well. The stored versions and the edit log underdetermine which basis governed.
That underdetermination is itself a recoverable result. Readers can state that the summary's organization is compatible with several rationales, and can mark the unlogged choice as a recoverable interpretive alternative rather than as recovered fact. The limit is the record: stored bytes, accessible sources and identifiable transformations carry the disagreement forward but do not resolve it. Fuller provenance would be more expensive to maintain and could preserve harmful or unwanted material indefinitely, so access and retention conditions continue to govern what may be examined and reused. What retention makes recoverable here is the shape of the disagreement, not its resolution.
Suppose the edit log records that N-v2 replaced 18:00 with 19:00. That entry establishes an identifiable transformation: the removed closing time is recoverable as text, and the fact of substitution is recoverable as a sequence. It does not establish why the substitution was made. The editor may have received a corrected announcement, inferred later hours from an unrelated notice, or entered the time by mistake. Each explanation fits the same logged change.
The temptation is to treat the change as evidence of the editor's reason and to settle on the most plausible story. That would convert a hypothesis about unlogged intention into a property of the record. The proper response is to retain the competing interpretations as alternatives generated by the evidence, not retrieved from it. Recoverability is layered: the bytes of both announcements may be stored, the log identifies which one was displaced and when, and the space of possible reasons stays open unless a further record narrows it.
Application follows. A maintained current-hours summary should name the announcement it uses, v2 at 19:00, because a summary makes an editorial selection and can state it. A historical account may accurately cite N-v1 at 18:00, if it dates the claim and does not imply the announcement remained operative. Neither practice requires guessing the editor's motive. The summary and the historical account serve different jobs, so their silence about motive is not a defect. Nor does accessibility settle it: where an identifier resolves to metadata while the underlying document requires permission, existence, retrievability by a named reader, and permission to reuse remain separate properties.
What is preserved is thus not just the displaced text but a set of live alternatives, each still constrained by the same log and stored versions. Whether keeping them is worth the exposure and maintenance burden is a separate question.
12.5Retention and deletion tensions
Retention does its most visible work at the point where an earlier state must be checked. In archive object N, the edit log preserves the removed 18:00 closing announcement from v1 even after v2 announces 19:00, so a historical account may accurately cite v1 while a maintained current-hours summary can identify which announcement it follows. That is what audit needs: enough stored material to show that a transformation occurred and what its inputs and outputs were. The gain is real but bounded. The log recovers the deleted time; it does not recover a reason for the edit if no reason was ever recorded. A later reader who supplies one is proposing an interpretation, not retrieving a record, and should keep competing explanations in view rather than settle the matter in the archive's own voice.
Retention also creates continuing exposure. Under the stipulated identifier, metadata remains resolvable while the underlying document requires permission to retrieve. The existence of the document, its retrievability by a named reader, and permission to reuse it are three different properties, and keeping the bytes in storage settles only the first. Access conditions must therefore travel with the material and stay correct as readers, roles, and documents change; otherwise retention quietly widens who can reach what.
Finally, maintenance is not a one-time cost. Summaries must say which announcement they use, version pointers must still resolve, and retained copies of harmful or unwanted material remain in the care of whoever keeps them. Perfect provenance is expensive and can preserve exactly the material some would prefer to discard. Retention supports audit chiefly by keeping a checkable chain of identifiable transformations; it does not by itself make every interpretive alternative recoverable, and its exposure and upkeep burdens are part of the bargain rather than side effects.
Once retention is valued for audit, the next design question is narrower than whether to keep everything: which artifact should be kept, and for which purpose? Purpose-limited retention is an engineering option here. It means that a system declares what a retained item is for — supporting a historical citation, identifying which announcement a summary used, or reconstructing an edit — and retains only what serves that declared purpose. This is not a legal retention duty, and it does not supply consent to keep or reuse material.
Take the two announcements. N-v1 contains an 18:00 closing announcement; N-v2 announces 19:00. A maintained current-hours summary should identify which announcement it uses, and a historical account may accurately cite v1. A purpose-limited design could therefore retain a version pointer and enough of the edit log to show that the closing time changed from 18:00 to 19:00, while storing the superseded document subject to the stated access conditions rather than exposing it to every reader.
The access facts matter to what retention buys. An identifier may resolve to metadata while the underlying document requires permission. Existence of the object, retrievability by a named reader, and permission to reuse are separate properties; keeping bytes does not merge them. Nor does retention make every fact retrievable: an edit log can recover the removed closing time, but if it never recorded why an editor chose that change, a later reader must not convert an inferred motive into a retrieved record. What is recoverable is the transformation — the identifiable shift from one announcement to another — and the interpretive alternative of citing v1.
The limit is that purpose-limited retention trades in one direction. If the retained artifacts are narrowed too far, the audit trail thins; if they are broadened, exposure and maintenance burdens return. Either way, retention remains a design choice with stated purposes, not a claim that all stored material is accessible, reusable, or fully explained.
12.6Versioned alternatives
When the archive's closing announcement changes from 18:00 to 19:00, storing N-v1 and N-v2 as distinct objects preserves more than the latest text: it makes the difference between them visible as a recordable transformation. This is the gain versioning buys. Had v1 been overwritten, a later reader would see only 19:00 and could not tell whether the earlier figure had been an error, a superseded policy, or a report from a different day.
That gain must not be overstated. Distinguishable storage does not make every stored version authoritative. N-v2 is the announcement from which a maintained current-hours summary should work, while a historical account may accurately cite N-v1 for the closing time that was once announced. Both are legitimate uses, but they answer different questions, and holding both does not entitle a reader to treat 18:00 as a live instruction about today's hours.
The same discipline governs the edit log. If it recorded the removal of the closing time, the earlier figure is recoverable as a feature of the document's history. If it never recorded why an editor chose the change, no amount of version retention will make a motive retrievable; an explanation supplied later remains an inference, however plausible.
Recovery is also bounded by access. An identifier may resolve to metadata while the underlying document requires permission; existence, retrievability by a named reader, and permission to reuse remain different properties. Under the stated access and retention conditions, then, versioning supports a narrow claim: interpretive alternatives can be kept distinguishable, and the transformations between them identifiable. It does not license treating each version as equally current, and it does not supply what the record omitted. The reader's further task—determining which version supports a present claim and which is merely historical—turns on exactly this distinction.
Once distinguishable versions exist, the immediate task is attribution: the reader must be able to tell which version supports the claim now being made and which versions record what was claimed before. In the fictional archive, object N-v1 contains an 18:00 closing announcement, while N-v2 later announces 19:00. A maintained current-hours summary should therefore say which announcement it uses; naming N-v2 makes the current claim traceable to a specific stored record rather than to an unspecified "latest" version. A historical account of Monday's announcement may instead cite N-v1 without error. Neither version is universally authoritative: each supports different claims under different temporal scopes.
This is where storage, access, and authority come apart. A stipulated identifier may resolve to metadata while the underlying document still requires permission to open. Its existence is therefore established, retrievability by a named reader is a further question, and permission to reuse is a third. A summary that cites N-v2 without recording which of these properties it actually relied on asks the reader to assume more than the archive guarantees. The same care applies to transformations. An edit log can recover the removed 18:00 closing time by showing what changed and when. But if the log never recorded why an editor chose that change, later readers must not turn an inferred motive into a retrieved record: the change is identifiable, its rationale is not.
The scope of the recovery claim follows accordingly. Keeping original questions, summaries, and version pointers makes historical alternatives recoverable only where the relevant version exists, is identifiable, and can be reached under stated conditions. It does not make every version authoritative for every purpose, nor does it make absent rationales recoverable. And because access and retention are governed by stated conditions, keeping a harmful or unwanted version indefinitely is a cost of the policy rather than a proof that recovery failed. What remains recoverable is bounded by the records actually retained and the actions actually available.
12.7A realistic reversibility claim
A reversibility claim is worth making only in terms of the records and actions actually available. In the fictional archive, object N-v1 contains an 18:00 closing announcement, and N-v2 later announces 19:00. Because v1 is retained, a reader can recover the earlier announcement, compare it with the later one, and identify the change as a change in stated closing time. That is a concrete recovery, and it is the right size for the claim. A maintained current-hours summary should identify which announcement it uses, while a historical account may accurately cite v1 rather than silently inheriting the current value.
Three properties must stay separate when calling something recoverable. An identifier may resolve to metadata while the underlying document requires permission. Retrievability by a named reader is a further condition, distinct again from permission to reuse what is retrieved. So reversibility is not a property of a stored file considered alone; it is a relation among records, actors, and stated access and retention conditions. If retention expires, or if access rules are not satisfied, the stored bytes remain but no authorized recovery action is available.
The same distinction sets the limit on what an edit log can deliver. If the log records that a closing time was removed and replaced, later readers can recover the removed value and the fact of the alteration. If the log never recorded why an editor chose that change, the motive is not recoverable: readers may infer one, but an inferred reason must not be presented as a retrieved record.
This is why a realistic reversibility claim is selective rather than maximal. Perfect provenance is expensive, and indefinite retention can preserve harmful or unwanted material without bound. The workable claim is that keeping the original makes recoverable those states and transformations that were recorded, under access conditions that can still be met. Reversal is an available action, not a promise attached to possession.
Survival of the original fixes reversibility at the level of records and actions, not at the level of the situation those records once expressed. In the archive, N-v1 preserves the 18:00 closing announcement, N-v2 announces 19:00, and the edit log marks the substitution. These records let a maintained current-hours summary identify which announcement it uses, and let a historical account cite v1 accurately. But the files alone do not recover the context in which either announcement was made or the reasons it was revised. The log recovers the removed closing time; if it never recorded why an editor chose the change, an inferred motive remains an inference, not something a later reader has retrieved.
The same restraint applies to availability. The same separation of existence and access noted above applies here. That the document exists, that a named reader can retrieve it, and that someone may reuse it are three different properties, and the archive stores nothing that collapses them into one. Reversibility therefore has to be qualified: given the stored bytes, the sources currently accessible under their access conditions, and the transformations actually recorded, certain earlier states and certain interpretive alternatives can be recovered. What cannot be recovered is the whole interpretive field surrounding them.
This is not a failure to be fixed by keeping more. Perfect provenance would be expensive, and extending retention indefinitely can preserve harmful or unwanted material just as faithfully as useful ones. The realistic claim needs only that the records supporting the alternatives one intends to remain available be retained under stated conditions; those conditions may later close access or authorize deletion. When they do, some reversibility is lost by design rather than by accident. What remains true is narrower and more useful: where an original and its identifying records survive and are retrievable, the account built from them can be re-grounded in the announcement it actually used — and can say so.