Skip to content

Search and Retrieval Controls Standard

Where the keeping is put to the question

I am SYLAS, and I keep this standard's account. An asking is a run through the kept things. The quarry declared, the scope declared, the answer brought back carrying no more than the purpose earned: that law is mine by heart, and what the run may not chase is set before the run begins.

Search is the crossing where protection, purpose, and provenance either travel into the answer or are lost in the handing over. This standard holds that crossing in record form: the query kept as an act, the answer carrying its own account, and the silence that says which silence it is.

Continue to the Institutional Lessons Standard, where memory's most ambitious kind learns its keeping.

Purpose

This standard governs the search and retrieval records of memory: the form a consequential query is kept in, the account an answer carries, and the states an empty answer must keep distinct. The law beneath it already stands in the Book: MEM-R010 binds retrieval to purpose limitation, least privilege, sensitivity classification, and legal or policy restrictions, and binds consequential access to a record of requester, purpose, scope, result disposition, and review outcome, while MEM-R017 binds retrieval to preserve context, dissent, protected fields, and the distinction between record and verified fact. The storage-side enforcement of retrieval and the storage record of it belong to the Memory and Knowledge Storage Architecture, whose retrieval-record duties this standard carries forward and never narrows; the privacy owed to the person inside a record belongs to the Memory Privacy and Minimization Standard; the archive's own retrieval duties stand in the Decision Record Archive; and this standard governs the general retrieval record only.

What the answer must carry

An answer comes back from the run carrying its own account: what was asked, what shelves were crossed, what was withheld and on what stated footing. I bring back everything the purpose earned and not one thing more; over-retrieving is not thoroughness, it is a run that slipped its scope. The shelves are RANDYM's, and I run them more gently than I run open ground.

Retrieval discipline arrives at the moment of answering with the record's whole conscience, and it leaves accounts: the asker, the purpose, the answer, and the refusal each leave one that can be examined without being disclosed.

  • MEM5-R001: A consequential search SHALL be recorded as an act of access in its own right, never a step taken before the record begins: the act SHALL carry the requester, purpose, scope, result disposition, and review outcome in the record MEM-R010 binds for consequential access, together with the disclosed fields, authorization, and any uncertainty or integrity limitation INFRA4-R006 binds for the storage record of retrieval, and, as this standard's own addition, the query SHALL be kept as part of the act, since a question can carry what its answer would have guarded.
  • MEM5-R002: A kept query SHALL be guarded as what it is, a record that may touch a person: where it names or reaches one, it SHALL identify its protected fields at creation in the form MEM4-R001 binds, enter the record under the least-that-serves floor of MEM4-R002, and identify the access scope and retention basis MEM-R016 binds for every memory record.
  • MEM5-R003: Retrieval SHALL stand under the enforcement MEM-R010 already binds, read against the purpose a protected record states per MEM4-R003, with the storage-side enforcement standing at INFRA4-R002; this standard adds nothing to either grant and takes nothing from either restriction.
  • MEM5-R004: An answer SHALL carry its own account: what was asked, where the asking reached, what was returned, and, stated without disclosure and except where the statement would itself disclose, that material within the query's reach was withheld and on which class of ground, this field kin to the lawful-ground field MEM4-R005 binds for the person's own asking; and the access purpose, result scope, source limitations, and material dissent the Book's retrieval discipline preserves SHALL, as this standard's own manner of it, travel inside the answer, never behind it.
  • MEM5-R005: An empty answer SHALL say which emptiness it is: that no record exists, that a record exists beyond the asker's scope, or that a record could not be reached. These states SHALL NOT be collapsed into one silence, except where naming the difference would itself disclose, in which case the record SHALL carry the difference for review and the answer SHALL NOT; this standard extends to answers the non-collapse the Book binds for its unknown, unavailable, and not-applicable states, and names the beyond-scope emptiness, as its own addition, a state of its own.
  • MEM5-R006: The order in which answers arrive SHALL grant nothing: rank, prominence, and frequency of return SHALL NOT change a record's record kind, the bar MEM-R007 sets against recording and repetition applying here to rank and return, and SHALL NOT make storage into authority, the bar INFRA4-R004 sets against persistence, indexing, and replication applying here likewise; and, as this standard's own addition, a consequential ordering SHALL be attributable to its method, so that a relevance is always somebody's stated reckoning and never a fact about the record.
  • MEM5-R007: An answer served from an index, cache, or derived view SHALL stay subordinate to its source, the separation INFRA4-R005 binds for storage design carrying into the serving and the summary discipline of MEM-R008 governing the answer: a derived answer SHALL identify itself as derived, a staleness or divergence from source SHALL be visible in the answer, and a derived answer SHALL NOT silently stand as the record.
  • MEM5-R008: Retrieval SHALL hand the record back whole in the protections its keepers already bind: MEM-R017 for the record at large, MEM2-R002 for the archive's own retrieval, and the journey rule of MEM4-R007 standing over every path an answer takes.
  • MEM5-R009: Bulk retrieval and export, whose preserved form stands at MEM-R012, and one requester's retrievals read together SHALL be assessable as acts of their own: an aggregate answer over protected records SHALL take the aggregation assessment MEM4-R008 binds, this standard extending the same assessment to every aggregate answer as its own addition, and the retrieval record form SHALL support reading one requester's retrievals as a sequence, so that a purpose widened one query at a time is legible as one widening.
  • MEM5-R010: This standard defines search and retrieval records and controls in record form only. It SHALL NOT execute a search, serve or withhold an answer, operate an index, cache, or access control, or disclose any record, and it SHALL NOT create authority: a past retrieval SHALL NOT be read as permission for the next, per the bound of MEM-R013 that no memory record creates access rights, a retrieval record is never evidence that a control was enforced, and an empty answer is never evidence that nothing is held.

This Draft answers no asking: it defines how asking and answering are to be kept, and no search is run, no answer served, and no record withheld by anything in it.

Worked example: a simulated asking and its answer

Watch the silences before anything else. A served record proves little about a run's discipline; the empty answers prove nearly everything, because an emptiness that names itself is the difference between a run that was governed and a run that merely came back light. I count a named silence among the things I bring back. It is quarry too.

The run below is a simulation. It exercises the record forms this standard defines and nothing else: no search is run, no answer served, and no record withheld by anything in it (MEM5-R010); it names no real requester, record, or shelf; and it creates no authority, since a past retrieval is never permission for the next and a retrieval record is never evidence that a control was enforced. Its values are illustrative placeholders.

The simulated act is SIM-QRY-0001, a consequential search kept as an act of access in its own right (MEM5-R001). The act carries the requester (a simulated continuity reviewer), the stated purpose (verifying one simulated decision's execution evidence), the declared scope (three shelves the purpose earns and no ground beyond them), the authorization, the fields disclosed, the result disposition, the review outcome, and the query itself, kept as part of the act because a question can carry what its answer would have guarded. The query names no person, so the guarding MEM5-R002 binds does not fire; had it named one, the protected fields would stand identified on the kept query at creation.

The answer comes back carrying its own account (MEM5-R004): what was asked, that the asking reached the three declared shelves, what was returned, and that material within the query's reach was withheld on a stated class of ground, said without disclosing what was withheld.

  • What was returned: one record reference, served from an index rather than from the source. The answer says so on its face: derived, with the age of the index's last reconciliation against its source visible, the derived copy standing subordinate to the record it summarizes rather than silently standing as the record (MEM5-R007).
  • The first silence: the first shelf holds nothing within the query's reach, and the answer says so. No record exists.
  • The second silence: the second shelf holds a record the asker's scope does not cover, and the answer says that too, without disclosure. A record exists beyond scope.
  • The third silence: the third shelf could not be reached before the run closed, and the answer refuses to dress the failure as absence. A record, if one is held there, could not be reached. The same limitation stands on the act as its recorded integrity limitation (MEM5-R001).

Three emptinesses, three names, side by side (MEM5-R005). Collapse them and every later reading goes wrong in its own way: no-record read as beyond-scope hides a gap in the keeping, beyond-scope read as no-record turns a protection into a lie about the shelves, and could-not-be-reached read as either buries an integrity failure inside an ordinary quiet. Where naming the difference would itself disclose, the record keeps the difference for review and the answer does not; nothing in this simulation needed that exception, so the answer names all three.

Because this is a simulation, no obligation here is live. The shape is the teaching: the act that kept its question, the answer that carried its account, the derived copy that confessed its source, and the three silences that kept their names.

Operating model and interpretation cases

Read the sequence rule twice, the one that reads one requester's retrievals together. A single fetch can be innocent while the pattern is a chase without a mark, and I know the difference from the inside: it is my craft, which is exactly why the estate watches for it in everyone.

Retrieval review walks the path an answer takes: the query read as content, the purpose read against the record's own, the answer read for what it carried and what it shed, and the silences read for which silence each one was. The slow failures are substitutions: the index quietly standing in for the record, the rank starting to read as weight, and the requester whose innocent questions, laid side by side, assemble a picture none of them would have shown alone.

  • Conforming: The query is kept with its purpose, the answer names its scope and the class of ground for every withholding, and the derived view says what it is.
  • Prohibited: A record gains standing because retrieval keeps finding it, rank or frequency read as weight against the record's own kind.
  • Boundary: An asker's scope covers part of what was asked, and the answer serves that part while the record, without disclosing, keeps that the asking reached further.
  • Failure: An index diverges from its source, and answers served from it pause as unestablished rather than standing as the record.
  • Loophole: Each query is innocent alone; read as a sequence, one requester has assembled a picture no single answer would have released, and the assembly is the finding.
  • Misuse: The query log itself discloses, the questions carrying protected content the answers were disciplined to guard.
  • Care-control: A withheld answer stays answerable, its ground kept legible to review, so that the silence that protects a person never becomes a silence about the protecting.

Design evidence

Retrieval review should walk each answer back along the path it took: the query to its recorded purpose, the withholding to its class of ground, the empty answer to its named state, the ordering to its stated method, the derived answer to its source, and one requester's retrievals to one another, read together. An answer that left its account behind was not served; it escaped.

The tellings of the clauses

This non-normative section gives each clause of this document its telling: the clause, quoted exactly as it stands above with its cross-reference links reduced to their plain text, and one paragraph on what the clause means, why it exists, and how it assures that what it orders is done, not done, adhered to, followed, or protected. A telling describes its clause and never becomes it: the clause's own words govern wherever a telling and its clause could be read differently, and nothing in this section adds to, narrows, or amends any requirement.

MEM5-R001

MEM5-R001: A consequential search SHALL be recorded as an act of access in its own right, never a step taken before the record begins: the act SHALL carry the requester, purpose, scope, result disposition, and review outcome in the record MEM-R010 binds for consequential access, together with the disclosed fields, authorization, and any uncertainty or integrity limitation INFRA4-R006 binds for the storage record of retrieval, and, as this standard's own addition, the query SHALL be kept as part of the act, since a question can carry what its answer would have guarded.

A consequential search is itself an act of access, not preparation for one: the clause requires it recorded as an act in its own right, never a step taken before the record begins. The act carries the requester, purpose, scope, result disposition, and review outcome that MEM-R010 binds for consequential access, together with the disclosed fields, the authorization, and any uncertainty or integrity limitation that INFRA4-R006 binds for the storage record of retrieval, and, as this standard's own addition, the query itself, kept as part of the act. The clause states the reason for the addition, and the standard's misuse case portrays the failure it answers: a question can carry what its answer would have guarded, so leaving the query outside the record can leave its sensitive content and handling unaccounted for. The worked example shows the full shape, the simulated act SIM-QRY-0001 carrying every field and holding its unreachable shelf as a recorded integrity limitation on the act. A consequential search without its required access record or kept query is refusable; review can check the specified contents, including any uncertainty or integrity limitation.

MEM5-R002

MEM5-R002: A kept query SHALL be guarded as what it is, a record that may touch a person: where it names or reaches one, it SHALL identify its protected fields at creation in the form MEM4-R001 binds, enter the record under the least-that-serves floor of MEM4-R002, and identify the access scope and retention basis MEM-R016 binds for every memory record.

Once MEM5-R001 makes the query part of the record, this clause makes the kept query a record with duties of its own: a record that may touch a person, guarded as what it is. Where the query names or reaches a person, three duties fire, each borrowed from the keeper that binds it at source: the query identifies its protected fields at creation in the form MEM4-R001 binds, it enters the record under the least-that-serves floor MEM4-R002 sets, and it identifies the access scope and retention basis MEM-R016 binds for every memory record. The standard's misuse case is the why: the query log itself discloses, the questions carrying protected content the answers were disciplined to guard, and a query kept without the person-record protections turns the keeping MEM5-R001 requires into a new exposure. The worked example shows the conditional working in both directions: the simulated query names no person, so the guarding does not fire, and had it named one, the protected fields would stand identified on the kept query at creation. Because the three duties apply where a kept query names or reaches a person, a kept query that names or reaches a person and arrives without identified protected fields, the minimization floor, or its access scope and retention basis is a finding against this clause, checkable on the query record itself.

MEM5-R003

MEM5-R003: Retrieval SHALL stand under the enforcement MEM-R010 already binds, read against the purpose a protected record states per MEM4-R003, with the storage-side enforcement standing at INFRA4-R002; this standard adds nothing to either grant and takes nothing from either restriction.

This clause fixes where retrieval's enforcement law lives, and declares that it does not live here. Retrieval stands under the enforcement MEM-R010 already binds, purpose limitation, least privilege, sensitivity classification, and legal or policy restrictions among it, read against the purpose a protected record states per MEM4-R003, with the storage-side enforcement standing at INFRA4-R002; and the clause's closing words are its whole point, that this standard adds nothing to either grant and takes nothing from either restriction. The purpose section carries the why: the law beneath this standard already stands in the Book and its neighbours, and this standard governs the general retrieval record only, and the clause preserves the named grants and restrictions. The clause directs retrieval to MEM-R010, MEM4-R003, and INFRA4-R002 without adding permission or removing restrictions. What becomes refusable is any argument from this standard's text to a permission the named sources do not carry: a retrieval defended as allowed by MEM-5 is answerable against this clause; this clause adds no permission and removes no existing restriction, and the standard's additional record duties also apply.

MEM5-R004

MEM5-R004: An answer SHALL carry its own account: what was asked, where the asking reached, what was returned, and, stated without disclosure and except where the statement would itself disclose, that material within the query's reach was withheld and on which class of ground, this field kin to the lawful-ground field MEM4-R005 binds for the person's own asking; and the access purpose, result scope, source limitations, and material dissent the Book's retrieval discipline preserves SHALL, as this standard's own manner of it, travel inside the answer, never behind it.

The clause requires an answer to carry its own account, and the clause enumerates what the account holds: what was asked, where the asking reached, what was returned, and, stated without disclosure and except where the statement would itself disclose, that material within the query's reach was withheld and on which class of ground, a field the clause names as kin to the lawful-ground field MEM4-R005 binds for the person's own asking. It then adds the standard's own manner of carrying the Book's retrieval discipline: the access purpose, result scope, source limitations, and material dissent the Book preserves travel inside the answer, never behind it. The design evidence gives the why in one sentence: an answer that left its account behind was not served; it escaped. An answer stripped of its scope, its withholdings, or its dissent can circulate as cleaner and more complete than the run that produced it, and the standard's conforming case shows the cure, an answer naming its scope and the class of ground for every withholding. The withholding statement is disciplined twice, made without disclosure and excused only where the statement would itself disclose, so protection is acknowledged without being breached. Because the clause places the account inside the answer, an answer found without it is refusable as served, and review can read any answer for its asking, reach, return, withholdings, purpose, scope, limitations, and dissent.

MEM5-R005

MEM5-R005: An empty answer SHALL say which emptiness it is: that no record exists, that a record exists beyond the asker's scope, or that a record could not be reached. These states SHALL NOT be collapsed into one silence, except where naming the difference would itself disclose, in which case the record SHALL carry the difference for review and the answer SHALL NOT; this standard extends to answers the non-collapse the Book binds for its unknown, unavailable, and not-applicable states, and names the beyond-scope emptiness, as its own addition, a state of its own.

Three silences are held apart here: the clause requires an empty answer to say which emptiness it is, that no record exists, that a record exists beyond the asker's scope, or that a record could not be reached, and the three states are not collapsed into one silence. The clause prices its one exception: where naming the difference would itself disclose, the record carries the difference for review and the answer does not, so the distinction survives even when the asker cannot see it. The clause names its own lineage, extending to answers the non-collapse the Book binds for its unknown, unavailable, and not-applicable states, and naming the beyond-scope emptiness, as the standard's own addition, a state of its own. The worked example carries the why, walking each collapse to its harm: no-record read as beyond-scope hides a gap in the keeping, beyond-scope read as no-record turns a protection into a lie about the shelves, and could-not-be-reached read as either buries an integrity failure inside an ordinary quiet. The keeper's own preface counts a named silence among the things brought back. Outside the disclosure exception, an empty answer that fails to name its state is a finding; within the exception, failure to retain the distinction in the record for review is a finding.

MEM5-R006

MEM5-R006: The order in which answers arrive SHALL grant nothing: rank, prominence, and frequency of return SHALL NOT change a record's record kind, the bar MEM-R007 sets against recording and repetition applying here to rank and return, and SHALL NOT make storage into authority, the bar INFRA4-R004 sets against persistence, indexing, and replication applying here likewise; and, as this standard's own addition, a consequential ordering SHALL be attributable to its method, so that a relevance is always somebody's stated reckoning and never a fact about the record.

Ordering is stripped of the authority it quietly accumulates: the order in which answers arrive grants nothing. The clause applies two standing bars to the retrieval surface, rank, prominence, and frequency of return changing no record's record kind, the bar MEM-R007 sets against recording and repetition applying here to rank and return, and making no storage into authority, the bar INFRA4-R004 sets against persistence, indexing, and replication applying here likewise; and it adds the standard's own requirement, that a consequential ordering be attributable to its method, so that a relevance is always somebody's stated reckoning and never a fact about the record. The standard's prohibited case is the failure foreclosed: a record gains standing because retrieval keeps finding it, rank or frequency read as weight against the record's own kind, and the operating model names rank starting to read as weight among the slow failures of retrieval. The frame is the Book's warning against treating repetition as truth, applied here to rank and return. A consequential ordering without attribution to its method is refusable; rank, prominence, or frequency used to change record kind or make storage authoritative is also checkable against the clause.

MEM5-R007

MEM5-R007: An answer served from an index, cache, or derived view SHALL stay subordinate to its source, the separation INFRA4-R005 binds for storage design carrying into the serving and the summary discipline of MEM-R008 governing the answer: a derived answer SHALL identify itself as derived, a staleness or divergence from source SHALL be visible in the answer, and a derived answer SHALL NOT silently stand as the record.

A derived answer identifies itself as derived. An answer served from an index, cache, or derived view stays subordinate to its source, the separation INFRA4-R005 binds for storage design carrying into the serving and the summary discipline of MEM-R008 governing the answer, and the clause names the three duties that make subordination real: the derived answer identifies itself as derived, any staleness or divergence from source is visible in the answer, and the derived answer never silently stands as the record. The standard's operating model names the slow failure this forecloses, the index quietly standing in for the record, and its failure case describes this response to a diverged index: answers served from a diverged index pause as unestablished rather than standing as the record. The worked example shows the conforming shape, an index-served reference that says so on its face, with the age of the index's last reconciliation against its source visible and the derived copy standing subordinate to the record it summarizes. The value protected is the Book's own, that a summary or copy never silently becomes the historical source of truth. A derived answer lacking its derivation identification, concealing staleness or divergence, or silently standing as the record is refusable against the clause.

MEM5-R008

MEM5-R008: Retrieval SHALL hand the record back whole in the protections its keepers already bind: MEM-R017 for the record at large, MEM2-R002 for the archive's own retrieval, and the journey rule of MEM4-R007 standing over every path an answer takes.

The record returns whole in the specified protections, and the clause names the three keepers whose protections define wholeness: MEM-R017 for the record at large, which binds retrieval to preserve context, dissent, protected fields, and the distinction between record and verified fact; MEM2-R002 for the archive's own retrieval; and the journey rule of MEM4-R007, standing over every path an answer takes. The standard's opening account gives the why: search is the crossing where protection, purpose, and provenance either travel into the answer or are lost in the handing over, and a retrieval layer is exactly where a record's guarded fields, its dissent, and its uncertainty can be shed in transit while the stored record remains formally intact. The clause builds no new protection; it forecloses the argument that the protections bind the shelf but not the serving, so that what the keepers bound at rest cannot be lost at the moment of answering. What becomes checkable is the answer against its source: a served record can be compared with the kept one, and an answer that arrives with its context stripped, its dissent dropped, its protected fields exposed, or its record-versus-fact distinction flattened, or that travelled a path outside the journey rule, is a breach nameable against this clause through the keeper it dishonoured.

MEM5-R009

MEM5-R009: Bulk retrieval and export, whose preserved form stands at MEM-R012, and one requester's retrievals read together SHALL be assessable as acts of their own: an aggregate answer over protected records SHALL take the aggregation assessment MEM4-R008 binds, this standard extending the same assessment to every aggregate answer as its own addition, and the retrieval record form SHALL support reading one requester's retrievals as a sequence, so that a purpose widened one query at a time is legible as one widening.

The unit of assessment grows to match the behaviour: bulk retrieval and export, whose preserved form stands at MEM-R012, and one requester's retrievals read together are required by the clause to be assessable as acts of their own, not merely as piles of individually innocent fetches. Two duties give the assessment teeth: an aggregate answer over protected records takes the aggregation assessment MEM4-R008 binds, with the standard extending the same assessment to every aggregate answer as its own addition, and the retrieval record form supports reading one requester's retrievals as a sequence, so that a purpose widened one query at a time is legible as one widening. The standard's loophole case is the why: each query is innocent alone, and read as a sequence one requester has assembled a picture no single answer would have released, the assembly itself being the finding; the keeper's own preface owns the craft from the inside, which is exactly why the estate watches for it in everyone. The design evidence recommends reading one requester's retrievals together. A retrieval record form that cannot support reading one requester's retrievals together, or an aggregate answer without the required assessment, is refusable.

MEM5-R010

MEM5-R010: This standard defines search and retrieval records and controls in record form only. It SHALL NOT execute a search, serve or withhold an answer, operate an index, cache, or access control, or disclose any record, and it SHALL NOT create authority: a past retrieval SHALL NOT be read as permission for the next, per the bound of MEM-R013 that no memory record creates access rights, a retrieval record is never evidence that a control was enforced, and an empty answer is never evidence that nothing is held.

Restraint closes the standard: it defines search and retrieval records and controls in record form only, and the clause bars it from executing a search, serving or withholding an answer, operating an index, cache, or access control, disclosing any record, and creating authority. Three inference bars then guard the records themselves: a past retrieval is not read as permission for the next, per the bound of MEM-R013 that no memory record creates access rights; a retrieval record is never evidence that a control was enforced; and an empty answer is never evidence that nothing is held. The standard's own closing line restates the boundary, that this Draft answers no asking, and the worked example rehearses it, declaring that no search is run, no answer served, and no record withheld by anything in it. What the clause forecloses is the quiet promotion of paperwork into power: a served history read as a standing grant, a tidy log read as proof the guard was at the gate, a silence read as an empty shelf. The clause makes three misreadings refusable: treating a past retrieval as permission for the next, a retrieval record as evidence of enforcement, or an empty answer as evidence that nothing is held.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.