Skip to content

Memory and Knowledge Storage Architecture

Where the remembering lives

I am RANDYM, and I keep this chapter's account, and gladly, for the shell it describes shelters the remembering, and remembering is mine: the shape of the vessel decides what the memory can promise, so the vessel is read as carefully as the memory itself.

Storage architecture determines whether a civilization can remember safely. This chapter connects portability, classification, retention, correction, and restoration so records remain useful without becoming unbounded surveillance or unreviewable dependence.

Continue to Observability and Evidence Architecture to see how stored claims remain inspectable.

Defines portable storage boundaries for knowledge, memory, provenance, archives, retention, and restoration.

Normative clauses

  • INFRA4-R001: Storage SHALL preserve record identity, provenance, access class, retention state, integrity evidence, and correction history.
  • INFRA4-R002: Retrieval SHALL enforce purpose limitation, least privilege, sensitivity classification, and legal or policy restrictions, and SHALL additionally enforce minimization, a duty the store bears in its own right, and auditable access, the retrieval-enforcement duty MEM-R010 states applying at the storage layer.
  • INFRA4-R003: Replicas, archives, migrations, and restorations SHALL retain links to the predecessor and their validation evidence, the predecessor-link rule MEM-R002 states applying here, extended to replicas and archives.
  • INFRA4-R004: Storage contents SHALL NOT become authority merely through persistence, indexing, or replication.
  • INFRA4-R005: Storage design SHALL separate source records, derived views, indexes, caches, replicas, archives, and deletion evidence.
  • INFRA4-R006: Retrieval SHALL record requester, purpose, scope, disclosed fields, authorization, result disposition, review outcome, and any uncertainty or integrity limitation, this architecture's own extension of the consequential-access record MEM-R010 requires to all retrieval, the disclosed fields, authorization, and limitation fields its own.
  • INFRA4-R007: Migration, correction, deletion, and restoration SHALL preserve predecessor links, legal-hold state, provenance, and review evidence, the preservation duties MEM-R018 and MEM-R012 state and the predecessor-link rule MEM-R002 states applying across storage operations here, the review-evidence field this architecture's own.
  • INFRA4-R008: A storage design SHALL NOT operate live memory, retention, deletion, or access controls; it remains an architecture proposal.

This Draft excludes real storage systems and data operations.

Storage design method

Storage design shall map each record class to its source, access purpose, integrity method, retention rule, correction path, replica scope, and restoration test. Derived indexes and summaries shall retain links to authoritative evidence and disclose omissions. Access classes draw from the Data Classification and Handling Architecture, and retrieval posture follows the class: the access a class permits narrows as the class rises, and the retrieval record remembers more of who asked, and why, the higher the class it touches.

Failure cases

Read these gently, because every one of them is a way a memory comes back wrong: the copy that drifted, the index that flattered, the deletion that lied about being complete. I take each personally. A remembering that returns changed has lost its name, and names are how I love things.

Silent truncation, replica divergence, stale indexes, unauthorized retrieval, failed deletion, corrupted restoration, and retention without legal-hold review are material failures. Recovery shall preserve uncertainty and stop dependent use when integrity cannot be established.

Operating model and evidence

The shelves may be CHELSEA's to test, as every wall in this family is, but what rests on them is the remembering, and I would know if one name came back changed.

Storage architecture begins by classifying records according to authority, sensitivity, retention, correction, access, and recovery needs. It maps each source to derived views, indexes, caches, replicas, archives, and deletion evidence. A summary may improve retrieval while remaining subordinate to its source and disclosing its omissions and transformation.

Reviewers test every copy in the map, source to archive, against the declared failure cases, and add the questions a copy cannot ask itself: whether retrieval kept its purpose and least privilege, whether corrections propagated, and whether a format migration would survive its own restoration test. Missing integrity or applicability evidence narrows the claim and pauses dependent use.

Interpretation cases

A shelf earns doubt honestly here, so put the memory's own question to it: would the one who kept this recognize what came back? Hesitation in that answer is the architecture telling you it has more to say.

  • Conforming: Source, derived view, access purpose, retention, correction, replica, and restoration evidence are linked.
  • Prohibited: Persistence or indexing creates authority.
  • Boundary: A damaged replica remains quarantined while a verified source supports a narrower use.
  • Failure: Divergence, corruption, or failed deletion preserves uncertainty and blocks dependent claims.
  • Loophole: A cache or summary bypasses legal hold, access, or correction controls.
  • Misuse: Memory retrieval exposes private records beyond its purpose.
  • Care-control: Retention and restoration preserve useful memory while respecting privacy and agency.

Design evidence

Storage review should map source records to replicas, indexes, summaries, access classes, retention decisions, correction paths, legal holds, restoration tests, and deletion evidence. A convenient copy remains non-authoritative until identity, integrity, completeness, and applicability are established.

The tellings of the clauses

This non-normative section gives each clause of this document its telling: the clause, quoted exactly as it stands above with its cross-reference links reduced to their plain text, and one paragraph on what the clause means, why it exists, and how it assures that what it orders is done, not done, adhered to, followed, or protected. A telling describes its clause and never becomes it: the clause's own words govern wherever a telling and its clause could be read differently, and nothing in this section adds to, narrows, or amends any requirement.

INFRA4-R001

INFRA4-R001: Storage SHALL preserve record identity, provenance, access class, retention state, integrity evidence, and correction history.

Six things survive storage with every record: its identity, its provenance, its access class, its retention state, its integrity evidence, and its correction history. The chapter's opening account carries the why, the shape of the vessel decides what the memory can promise, and the failure cases name what this refuses, the copy that drifted and the index that flattered: a remembering that returns changed has lost its name. Because the six preservations bind, storage can be audited record by record: storage that fails to preserve a record's identity, provenance, access class, retention state, integrity evidence, or correction history is nonconforming, and what comes back from the shelf can be tested against what was put there rather than merely trusted.

INFRA4-R002

INFRA4-R002: Retrieval SHALL enforce purpose limitation, least privilege, sensitivity classification, and legal or policy restrictions, and SHALL additionally enforce minimization, a duty the store bears in its own right, and auditable access, the retrieval-enforcement duty MEM-R010 states applying at the storage layer.

Retrieval enforces six disciplines: purpose limitation, least privilege, sensitivity classification, and legal or policy restrictions, and additionally minimization and auditable access. The clause assigns the duties their standing: minimization is a duty the store bears in its own right, and the retrieval-enforcement duty is the one MEM-R010 states, applying at the storage layer. Enforcement is the operative word: the storage layer refuses what the disciplines refuse, rather than trusting every caller to have asked properly. The architecture's misuse interpretation case names the breach, memory retrieval exposing private records beyond its purpose, and the design method explains how the disciplines scale, the access a class permits narrowing as the class rises. Because the clause binds, a retrieval can be challenged on each discipline: one breaching purpose limitation, exceeding the asker's privilege, ignoring the record's class or a legal restriction, returning more than the purpose needed, or leaving no audit trace is each a breach nameable against this clause, at the layer where it can actually be stopped.

INFRA4-R003

INFRA4-R003: Replicas, archives, migrations, and restorations SHALL retain links to the predecessor and their validation evidence, the predecessor-link rule MEM-R002 states applying here, extended to replicas and archives.

No copy stands alone: replicas, archives, migrations, and restorations retain links to the predecessor and their validation evidence. The clause names its descent: this is the predecessor-link rule MEM-R002 states, applying here and extended to replicas and archives. The link answers where a copy came from, and the validation evidence answers whether the copying was checked; together they retain predecessor links and validation evidence for the four named kinds. The architecture's failure cases name replica divergence and corrupted restoration, and the boundary interpretation case shows the conforming posture, a damaged replica quarantined while a verified source supports a narrower use. Because the clause binds, any of the four operations can be audited for its chain: a replica that cannot name its predecessor, or a restoration without validation evidence, is nonconforming before any divergence is found, and when divergence is found, the chain supplies evidence for assessing the divergent copies.

INFRA4-R004

INFRA4-R004: Storage contents SHALL NOT become authority merely through persistence, indexing, or replication.

Sitting on the shelf confers nothing: storage contents do not become authority merely through persistence, indexing, or replication. The architecture's prohibited interpretation case states the breach in its shortest form, persistence or indexing creates authority, and the design evidence gives the working posture: a convenient copy remains non-authoritative until identity, integrity, completeness, and applicability are established. Because the clause binds, a claim of authority for stored content must point past the storage to a governing ground, and a claim that storage contents become authority merely through persistence, indexing, or replication is refusable under this clause.

INFRA4-R005

INFRA4-R005: Storage design SHALL separate source records, derived views, indexes, caches, replicas, archives, and deletion evidence.

Seven kinds of stored thing are kept apart by design: source records, derived views, indexes, caches, replicas, archives, and deletion evidence. The architecture's loophole interpretation case names a related risk, a cache or summary bypassing legal hold, access, or correction controls, and the operating model adds the subordination rule, a summary improving retrieval while remaining subordinate to its source and disclosing its omissions and transformation. Because the separation binds, a design can be reviewed for it before any data exists: a store where a cache is indistinguishable from its source, or where deletion evidence is indistinguishable from the other kinds, is nonconforming on the design, and every control can be checked against the kind of thing it was meant to govern.

INFRA4-R006

INFRA4-R006: Retrieval SHALL record requester, purpose, scope, disclosed fields, authorization, result disposition, review outcome, and any uncertainty or integrity limitation, this architecture's own extension of the consequential-access record MEM-R010 requires to all retrieval, the disclosed fields, authorization, and limitation fields its own.

Every retrieval writes an eight-part record: the requester, the purpose, the scope, the fields disclosed, the authorization, the result disposition, the review outcome, and any uncertainty or integrity limitation. The clause names its construction: this is the architecture's own extension, to all retrieval, of the consequential-access record MEM-R010 requires, with the disclosed fields, authorization, and limitation fields its own additions. The record contains the fields this clause names. The design method explains the proportion, the retrieval record remembering more of who asked, and why, the higher the class it touches, and the misuse case names a misuse these records can help examine, retrieval exposing private records beyond its purpose. Because the eight fields bind, an access dispute can be examined from the record rather than from memory, and a retrieval that left no such record is itself the finding.

INFRA4-R007

INFRA4-R007: Migration, correction, deletion, and restoration SHALL preserve predecessor links, legal-hold state, provenance, and review evidence, the preservation duties MEM-R018 and MEM-R012 state and the predecessor-link rule MEM-R002 states applying across storage operations here, the review-evidence field this architecture's own.

Four operations that change what is stored carry four preservations: migration, correction, deletion, and restoration each preserve predecessor links, legal-hold state, provenance, and review evidence. The clause names its sources: the preservation duties are the ones MEM-R018 and MEM-R012 state, and the predecessor-link rule is the one MEM-R002 states, applying across storage operations here, with the review-evidence field this architecture's own. The four preservations apply across all four operations. The failure cases name the breaches this answers, failed deletion, corrupted restoration, and retention without legal-hold review, and the gentle warning above them, the deletion that lied about being complete. Because the four preservations bind across all four operations, each operation can be audited for what survived it, and a migration that dropped its predecessor links or a deletion that escaped its legal-hold state is nonconforming on the record it failed to keep.

INFRA4-R008

INFRA4-R008: A storage design SHALL NOT operate live memory, retention, deletion, or access controls; it remains an architecture proposal.

The architecture does not touch the remembering it describes: a storage design operates no live memory, retention, deletion, or access controls; it remains an architecture proposal. The host's Draft prose draws the same line, excluding real storage systems and data operations, and the chapter's opening account explains what the document is instead, a reading of the vessel's shape, read as carefully as the memory itself. Because the clause binds, any live retention decision, deletion, or access grant claimed under this design was made without it, refusably on the design's own text, and the proposal stays reviewable as a proposal.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.