THE GOLD STANDARD OF HYDROLOGY · SPECIALIST STUDY
Decommission the old forecast repository without deleting authority, evidence or the last recoverable copy
Custodial acceptance makes source decommissioning possible; it does not make it automatic. The old repository may still contain delta objects, privileged review copies, snapshots, caches, exports, backups, credentials and undocumented consumer dependencies. A defensible closeout discovers those residues, verifies that every continuing hold and retention duty works in the destination, preserves a tested recovery route, revokes access in the right order and records what was destroyed, retained or excepted under explicit authority.
This guide belongs to the Hydrology subject root, the Gold Standard of Education, and the How X Works hub. It begins with a concrete decision, then tests whether the method still holds when the context changes.
Choose a reading route
Authorise the decommission boundary · chapters 1, 2, 3
Discover copies and dependencies · chapters 4, 5
Prove destination recovery · chapters 6, 7, 8
Revoke, destroy and evidence · chapters 9, 10, 11
Audit closure and preserve exceptions · chapters 12, 13
The whole problem at a glance
| Closure question | Required evidence | Unsafe shortcut |
|---|---|---|
| What may stop? | System and custody boundary | Migration complete |
| What remains? | Copy and dependency inventory | Primary bucket empty |
| What can be destroyed? | Disposition and hold authority | Old means disposable |
| Can recovery work? | Independent restore test | Checksum match |
Discovery, disposition and destruction are separate decisions.
CHAPTER 1 OF 13 · Authorise the decommission boundary
1. Define exactly what is being decommissioned
A repository can include object storage, databases, indexes, key stores, workers, portals, backups, logs and identity integrations. Closing the application while leaving storage and credentials active creates a false finish. Define technical, operational, physical and custodial boundaries plus services that remain.
Evidence record: Keep system diagrams, accounts, storage classes, regions, vendors, contracts, custody roles, data flows, cutover state, continuing services and named owners. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Reject the phrase old system retired until every in-scope component has a verified disposition or exception. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A shared backup platform remains active; separate repository decommission from platform retention. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 1 check · what should survive an audit
- State the decision unit for “Define exactly what is being decommissioned”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 2 OF 13 · Authorise the decommission boundary
2. Confirm destination acceptance and continuing authority
Before touching source data, verify the receiving custodian accepted the exact manifest, holds, retention, access duties and unresolved exceptions. Amendments after transfer must be propagated to both environments until source closure.
Evidence record: Record acceptance version, object counts, authority notices, overlapping holds, retention schedules, exceptions, acknowledgements, effective times and later amendments. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Block destructive work while any source object lacks a destination match or an authority decision. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A hold narrows after acceptance; preserve effective dates and re-evaluate both repositories. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 2 check · what should survive an audit
- State the decision unit for “Confirm destination acceptance and continuing authority”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 3 OF 13 · Authorise the decommission boundary
3. Set a freeze, observation window and rollback point
The source should stop ordinary writes, but late forecast runs, corrections or emergency access can create deltas. Define read-only states, exception writes, observation length, rollback trigger and the last moment the source remains a viable fallback.
Evidence record: Keep freeze command, writer inventory, delta capture, emergency changes, clocks, monitoring, rollback conditions, capacity and authorised transition between states. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Extend the window when unexpected writes, reads or dependency calls appear. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A critical correction arrives during freeze; route it through a recorded bridge and reconcile before closure. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 3 check · what should survive an audit
- State the decision unit for “Set a freeze, observation window and rollback point”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 4 OF 13 · Discover copies and dependencies
4. Discover residual copies beyond the primary store
Residuals can exist in snapshots, backups, staging areas, notebooks, email attachments, analyst exports, local sync, caches, support bundles and vendor replicas. Use inventory, logs, configuration and owner attestations together; no single scanner sees every authorised or shadow copy.
Evidence record: Record location, custodian, object range, copy role, lineage, encryption, last access, discovery method, authority, owner and confidence or blind spot. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Quarantine unknown copies before deciding destruction, and escalate locations that cannot be inspected under current authority. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A vendor support snapshot lies outside the institution account; use contract and provider evidence rather than pretending direct inspection. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 4 check · what should survive an audit
- State the decision unit for “Discover residual copies beyond the primary store”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 5 OF 13 · Discover copies and dependencies
5. Trace consumers and hidden dependencies
Jobs, dashboards, APIs, citation links, recovery scripts and human procedures may still read the source after migration. Traffic silence over a short window can miss monthly reports or disaster-only paths. Combine access logs with code, configuration, schedules and stakeholder review.
Evidence record: Keep consumer, credential, endpoint, purpose, frequency, last use, replacement path, owner, test and retirement acknowledgement. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Do not revoke the last working path until the destination replacement is proven for critical consumers. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: An annual audit script has no recent calls; test it deliberately before removing the endpoint. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 5 check · what should survive an audit
- State the decision unit for “Trace consumers and hidden dependencies”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
Worked residual-copy register
| Location | Copy role | Authority | Disposition |
|---|---|---|---|
| Source object store | Former master | Transferred and verified | Destroy after gate |
| Backup vault | Disaster copy | Hold still applies | Retain |
| Analyst export | Review derivative | Purpose expired | Quarantine then destroy |
| Job cache | Temporary fragment | No active purpose | Sanitise |
Each copy needs lineage, authority and accountable action.
CHAPTER 6 OF 13 · Prove destination recovery
6. Classify copy roles and authoritative status
Identical bytes can represent a master, backup, derivative, review copy, cache or evidentiary snapshot with different duties. Deduplication does not erase record identity or custody. Classify role, provenance and decision use before applying a schedule.
Evidence record: Preserve source object, derivative process, record identity, manifest link, decision use, hold coverage, retention, privacy, privilege and authoritative-copy designation. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Never infer disposable status from duplication, age or file path alone. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A review copy contains annotations absent from the master; evaluate it as a separate record. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 6 check · what should survive an audit
- State the decision unit for “Classify copy roles and authoritative status”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 7 OF 13 · Prove destination recovery
7. Reconcile deltas and exception backlog
Late arrivals, checksum mismatches, missing metadata, unresolved keys and inaccessible objects form an exception backlog. Aggregate migration success cannot close them. Every item needs status, owner, containment, due date and destination or disposition evidence.
Evidence record: Keep exception ID, object, discovery, severity, authority, current location, owner, action, test, dependency, ageing and escalation. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Prevent source destruction for any exception whose recovery or legal consequence still depends on it. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A metadata mismatch does not alter bytes but breaks hold scope; treat it as material until repaired. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 7 check · what should survive an audit
- State the decision unit for “Reconcile deltas and exception backlog”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 8 OF 13 · Prove destination recovery
8. Prove destination recovery independently
Checksums show byte consistency but not that authorised users can find, decrypt, interpret and reconstruct a forecast package. Select representative and high-risk objects, restore into a controlled environment and verify metadata, software dependencies, lineage and access rules.
Evidence record: Record sample design, object IDs, keys, tools, environment, restore time, outputs, comparisons, failures, remediation and independent reviewer. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Require successful recovery for masters and critical representations before the source stops being a fallback. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A file restores but its model configuration reference is broken; recovery remains incomplete. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 8 check · what should survive an audit
- State the decision unit for “Prove destination recovery independently”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 9 OF 13 · Revoke, destroy and evidence
9. Verify hold and lifecycle controls after transfer
Exercise prohibited deletion, overwrite, retention expiry and administrative bypass in the destination. Confirm alerts, dual control and amendment processing. A configuration screenshot cannot prove that lifecycle jobs will respect held objects.
Evidence record: Preserve test objects, policies, roles, attempted actions, observed denials, alerts, bypass routes, approvals and remediation. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Keep source protection active when destination controls fail or cannot be tested safely. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A cloud administrator can bypass object lock; document governance and compensating dual control. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 9 check · what should survive an audit
- State the decision unit for “Verify hold and lifecycle controls after transfer”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
Decommission acceptance gate
| Gate | Close evidence | Block when |
|---|---|---|
| Completeness | Residual search reconciled | Unknown storage or delta |
| Authority | Holds and schedules mapped | Conflicting disposition |
| Recovery | Destination restore proven | Only source can recover |
| Access | Credentials revoked and monitored | Unowned service account |
An exception backlog remains part of custody until resolved.
CHAPTER 10 OF 13 · Revoke, destroy and evidence
10. Revoke credentials in dependency order
Human accounts, service principals, API tokens, SSH keys, encryption keys and vendor access should be revoked only after replacement consumers and recovery paths work. Inventory shared credentials and secrets embedded in automation; rotating one front-door password is not closure.
Evidence record: Keep credential owner, scope, consumers, replacement, last use, revocation time, confirmation, denied-use monitoring, emergency access and key-destruction authority. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Revoke by a reviewed sequence and monitor for failed calls that reveal missed dependencies. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A destination restore still needs a source-held key; transfer or escrow it before revocation. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 10 check · what should survive an audit
- State the decision unit for “Revoke credentials in dependency order”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 11 OF 13 · Revoke, destroy and evidence
11. Destroy or sanitise under explicit authority
Deletion requires a disposition basis, hold clearance and method suited to the medium, encryption and provider. Logical delete, key destruction, media sanitisation and vendor purge prove different things. Preserve evidence proportionately without retaining the sensitive content being destroyed.
Evidence record: Record object class, authority, exclusions, method, tool or provider, time, operator, witness, result, failed items, certificate and residual risk. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Do not issue a blanket certificate when only a job submission succeeded or provider scope is unclear. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A backup is immutable until expiry; document controlled retention and later destruction rather than claiming immediate deletion. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 11 check · what should survive an audit
- State the decision unit for “Destroy or sanitise under explicit authority”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 12 OF 13 · Audit closure and preserve exceptions
12. Treat deletion certificates as claims to verify
A certificate should identify scope, method, authority, performer and exceptions. It can be incomplete, generic or inconsistent with logs. Reconcile certificates with manifests, provider reports, key records and residual discovery before accepting them as closure evidence.
Evidence record: Keep certificate ID, issuer, object range, storage layer, method, dates, exceptions, corroborating logs, reviewer and acceptance decision. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Reject certificates that cannot be tied to the approved inventory and authority. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A vendor certificate covers an account but not replicated backups; preserve the uncovered scope as an exception. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 12 check · what should survive an audit
- State the decision unit for “Treat deletion certificates as claims to verify”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 13 OF 13 · Audit closure and preserve exceptions
13. Run a post-transfer audit and retain reopen triggers
After shutdown, verify destination access, holds, recovery, monitoring, citations and absence of source use over a period that covers important cycles. Search again for residuals and failed credentials. Publish exceptions, not just a green conclusion.
Evidence record: Archive audit scope, timing, samples, restored objects, alerts, denied calls, new residues, open exceptions, owners, corrective actions and governance sign-off. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Close decommissioning only when unresolved items are accepted by the proper authority and retain triggers for rediscovery, hold change or failed recovery. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Transfer the method to an education research archive while adding consent, ethics and personal-data obligations. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 13 check · what should survive an audit
- State the decision unit for “Run a post-transfer audit and retain reopen triggers”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
Verification lab: work the decision twice
Build a source-repository boundary covering storage, backups, indexes, keys, service accounts and scheduled consumers. Mark what stops, remains or is excepted.
Discover four fictional residual copies, classify their roles and authority, then reconcile one late delta and one immutable-backup exception.
Restore a forecast package from the destination, revoke credentials in dependency order, validate a deletion certificate and design a ninety-day post-transfer audit.
Limits and misconceptions
Migration completion does not authorise destruction
Disposition, holds and accepted custody remain separate gates.
Checksum equality is not recovery proof
Retrieval, decryption, metadata and reconstruction must work.
A deletion certificate is evidence, not magic
Its scope and method need reconciliation.
Traffic silence does not prove no dependencies
Long-cycle and disaster-only consumers require deliberate tests.
Questions readers ask
When can the source repository be decommissioned?
- After accepted custody, residual discovery, authority reconciliation, destination recovery and control tests, and resolved or governed exceptions.
What counts as a residual copy?
- Any remaining master, backup, snapshot, export, derivative, cache or evidentiary copy inside the defined discovery scope.
Should credentials be revoked immediately?
- In a reviewed sequence after replacement consumers and recovery paths are proven.
What should a deletion certificate contain?
- Scope, authority, method, performer, time, result and exceptions tied to the approved inventory.
What if an immutable backup cannot be deleted yet?
- Keep it controlled under continuing authority, document expiry and verify later destruction.
Why audit after shutdown?
- To catch residuals, failed consumers, broken recovery, hold changes and evidence gaps that appear only in steady state.
Practise, verify and continue
Decommission a held forecast source after custody transfer. Define the boundary, discover residuals, reconcile deltas, prove restore, test holds, revoke credentials, validate destruction and audit closure.
Move the method to a public-health archive. Preserve custody, recovery, authority, exceptions and destruction evidence while adding stricter privacy, ethics and disclosure controls.
Practical evidence check
Before implementation, write a one-page evidence map with the decision, unit of analysis, version or time boundary, inputs, outcomes, uncertainty, authority and stop rule. Attach one worked case that passes and one that fails. A reviewer should be able to reproduce the reasoning without relying on the memory of the person who built the system.
Run one changed-context rehearsal before approval. Alter a mechanism rather than a cosmetic detail, then identify which calculation, safeguard or governance gate must change. Record any conclusion that does not transfer. This short rehearsal is often the fastest way to expose a hidden assumption before it becomes an operational dependency.
Related eduKate reading
Forecast archive custody transfer during legal hold
Forecast archive legal hold and preservation freeze
Forecast archive format migration and preservation validation
Forecast archive fixity audits and repair
Authoritative sources and scope
US National Archives accessioning and custody guidance
US National Archives FAQ on source-record disposition after validated digitisation
National Archives of Australia digital transfer and checksum guidance
US National Archives policy on records holds
The archival sources support custody, transfer, checksums, holds and source-record disposition within their jurisdictions. They do not provide legal advice or prescribe this hydrological decommission workflow. Residuals are fictional; actual authorities, privacy, contracts, storage guarantees, sanitisation methods and evidence requirements must be verified.